diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4b963e0153..45ea7f8a5e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,6 +19,16 @@ on:
   schedule:
     - cron: "42 6 * * 0"
 
+# New pushes cancel older runs for the same pull request. Each job queues by
+# workflow, job, and author, so one author runs one copy of each job at a time.
+# GitHub orders jobs by when they start waiting, but does not guarantee FIFO.
+# Each queue holds up to 100 pending jobs; later arrivals are canceled.
+# Timeouts release queues after hung jobs. Bots and non-PR events use unique
+# run IDs and do not queue together.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -28,6 +38,10 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: 45
+    concurrency:
+      group: ${{ github.workflow }}-analyze-${{ matrix.language }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     permissions:
       # required for all workflows
       security-events: write
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 5419097d86..5a00f839e2 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -8,10 +8,24 @@ on:
 permissions:
   contents: read
 
+# New pushes cancel older runs for the same pull request. Each job queues by
+# workflow, job, and author, so one author runs one copy of each job at a time.
+# GitHub orders jobs by when they start waiting, but does not guarantee FIFO.
+# Each queue holds up to 100 pending jobs; later arrivals are canceled.
+# Timeouts release queues after hung jobs. Bots and non-PR events use unique
+# run IDs and do not queue together.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   check-claude-md-symlink:
     name: CLAUDE.md symlink guard
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: ${{ github.workflow }}-check-claude-md-symlink-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -42,6 +56,10 @@ jobs:
   check-ci-node-pin:
     name: CI Node pin guard
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: ${{ github.workflow }}-check-ci-node-pin-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -66,6 +84,10 @@ jobs:
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest
+    timeout-minutes: 25
+    concurrency:
+      group: ${{ github.workflow }}-format-rust-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -97,6 +119,25 @@ jobs:
           cache: npm
           cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
 
+      # The concurrency guard runs here because `cargo fmt` is a required check.
+      # Pin the yq binary by checksum, so a replaced release asset cannot run in
+      # CI with this job's token.
+      - name: Install yq
+        shell: bash
+        run: |
+          curl --fail --location --silent --show-error \
+            https://github.com/mikefarah/yq/releases/download/v4.54.1/yq_linux_amd64 \
+            --output "$RUNNER_TEMP/yq"
+          echo "8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f  $RUNNER_TEMP/yq" | sha256sum --check --strict
+          chmod +x "$RUNNER_TEMP/yq"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
+      - name: Test the CI concurrency policy guard
+        run: node --test scripts/check-ci-concurrency.test.mjs
+
+      - name: Require per-PR cancellation, per-author job queues and timeouts
+        run: scripts/check-ci-concurrency.sh
+
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
 
@@ -136,6 +177,10 @@ jobs:
 
   format-typescript:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-format-typescript-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     defaults:
       run:
         working-directory: crates/trusted-server-js/lib
@@ -167,6 +212,10 @@ jobs:
 
   format-docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-format-docs-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     defaults:
       run:
         working-directory: docs
@@ -208,6 +257,10 @@ jobs:
   docs-proposal-scripts:
     name: docs-proposal scripts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-docs-proposal-scripts-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 8500af3508..a7231cd842 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -10,6 +10,16 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+# New pushes cancel older runs for the same pull request. Each job queues by
+# workflow, job, and author, so one author runs one copy of each job at a time.
+# GitHub orders jobs by when they start waiting, but does not guarantee FIFO.
+# Each queue holds up to 100 pending jobs; later arrivals are canceled.
+# Timeouts release queues after hung jobs. Bots and non-PR events use unique
+# run IDs and do not queue together.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 env:
   ORIGIN_PORT: 8888
   ARTIFACTS_DIR: /tmp/integration-test-artifacts
@@ -23,6 +33,9 @@ jobs:
     name: prepare integration artifacts
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    concurrency:
+      group: ${{ github.workflow }}-prepare-artifacts-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -64,6 +77,9 @@ jobs:
     needs: prepare-artifacts
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    concurrency:
+      group: ${{ github.workflow }}-integration-tests-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -119,6 +135,9 @@ jobs:
     needs: prepare-artifacts
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    concurrency:
+      group: ${{ github.workflow }}-integration-tests-fastly-ec-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -159,6 +178,9 @@ jobs:
     # Playwright cannot install chromium on the ubuntu-latest 26.04 image.
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    concurrency:
+      group: ${{ github.workflow }}-trace-runtime-tests-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -254,6 +276,9 @@ jobs:
     # once the pinned Playwright version supports the newer image.
     runs-on: ubuntu-24.04
     timeout-minutes: 15
+    concurrency:
+      group: ${{ github.workflow }}-browser-tests-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/pbs-example.yml b/.github/workflows/pbs-example.yml
index dced0c7b63..0282e5a066 100644
--- a/.github/workflows/pbs-example.yml
+++ b/.github/workflows/pbs-example.yml
@@ -17,11 +17,24 @@ on:
 permissions:
   contents: read
 
+# New pushes cancel older runs for the same pull request. Each job queues by
+# workflow, job, and author, so one author runs one copy of each job at a time.
+# GitHub orders jobs by when they start waiting, but does not guarantee FIFO.
+# Each queue holds up to 100 pending jobs; later arrivals are canceled.
+# Timeouts release queues after hung jobs. Bots and non-PR events use unique
+# run IDs and do not queue together.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   local-checks:
     name: PBS Terraform and Compose checks
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    concurrency:
+      group: ${{ github.workflow }}-local-checks-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     env:
       TF_IN_AUTOMATION: 'true'
       AWS_EC2_METADATA_DISABLED: 'true'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 60af0bb5d1..f2315fd21a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,11 +8,24 @@ on:
     branches: [main]
   pull_request:
 
+# New pushes cancel older runs for the same pull request. Each job queues by
+# workflow, job, and author, so one author runs one copy of each job at a time.
+# GitHub orders jobs by when they start waiting, but does not guarantee FIFO.
+# Each queue holds up to 100 pending jobs; later arrivals are canceled.
+# Timeouts release queues after hung jobs. Bots and non-PR events use unique
+# run IDs and do not queue together.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   test-rust:
     name: cargo test
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    concurrency:
+      group: ${{ github.workflow }}-test-rust-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -79,6 +92,9 @@ jobs:
     name: HTML EOF runtime (Fastly)
     runs-on: ubuntu-latest
     timeout-minutes: 25
+    concurrency:
+      group: ${{ github.workflow }}-test-fastly-eof-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -127,6 +143,10 @@ jobs:
   test-axum:
     name: cargo test (axum native)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    concurrency:
+      group: ${{ github.workflow }}-test-axum-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -208,6 +228,10 @@ jobs:
   test-cloudflare:
     name: cargo check (cloudflare native + wasm32-unknown-unknown)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: ${{ github.workflow }}-test-cloudflare-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -242,6 +266,10 @@ jobs:
   test-spin:
     name: cargo check/build/test (spin native + wasm32-wasip1)
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    concurrency:
+      group: ${{ github.workflow }}-test-spin-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -288,6 +316,10 @@ jobs:
   test-parity:
     name: cargo test (cross-adapter parity)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: ${{ github.workflow }}-test-parity-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -322,6 +354,10 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    concurrency:
+      group: ${{ github.workflow }}-test-cli-${{ matrix.os }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       - uses: actions/checkout@v4
 
@@ -394,6 +430,10 @@ jobs:
     name: ts dev lint domains (changed lines)
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-lint-domains-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     steps:
       # A PR checkout is GitHub's merge commit; depth 2 also fetches its
       # parents, so `HEAD^1` is the exact base commit the PR merges into.
@@ -428,6 +468,10 @@ jobs:
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-test-typescript-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     defaults:
       run:
         working-directory: crates/trusted-server-js/lib
diff --git a/.github/workflows/worker-auction-deadlines.yml b/.github/workflows/worker-auction-deadlines.yml
index dda7e26e8d..3335736c4d 100644
--- a/.github/workflows/worker-auction-deadlines.yml
+++ b/.github/workflows/worker-auction-deadlines.yml
@@ -8,10 +8,23 @@ on:
 permissions:
   contents: read
 
+# New pushes cancel older runs for the same pull request. Each job queues by
+# workflow, job, and author, so one author runs one copy of each job at a time.
+# GitHub orders jobs by when they start waiting, but does not guarantee FIFO.
+# Each queue holds up to 100 pending jobs; later arrivals are canceled.
+# Timeouts release queues after hung jobs. Bots and non-PR events use unique
+# run IDs and do not queue together.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   worker-deadlines:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    concurrency:
+      group: ${{ github.workflow }}-worker-deadlines-${{ matrix.adapter }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
+      queue: max
     strategy:
       fail-fast: false
       matrix:
diff --git a/.gitignore b/.gitignore
index 770aa83ef8..41dc3aaaf4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -68,3 +68,6 @@ src/*.html
 
 # Documentation proposal workflow scratch space
 /.docs-proposal/
+# Wrangler config rendered by the Cloudflare integration-test harness from
+# wrangler.ci.toml for CI or test-specific configuration overrides.
+wrangler.integration.generated.toml
diff --git a/AGENTS.md b/AGENTS.md
index d90eda1f2d..7164165eb4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -377,6 +377,7 @@ Every PR must pass:
 13. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
 14. Fastly absolute-deadline network fixtures under Viceroy (the harness builds the adapter test binary itself): `node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"`
 15. Worker auction-deadline runtime fixtures (`worker-auction-deadlines.yml`): build and lint the runtime fixture, then run it under the local runtime. For Cloudflare, `cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare` and `node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"` (requires wrangler and the `Cargo.lock` wasm-bindgen CLI). For Spin, `cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin` and `node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"`. CI lints each fixture with the same `cargo clippy` arguments plus `-- -D warnings`
+16. CI concurrency policy guard: `node --test scripts/check-ci-concurrency.test.mjs && scripts/check-ci-concurrency.sh` (requires yq v4); every PR-triggered workflow must use `test.yml`'s per-PR cancellation block, and every non-reusable job must set a timeout and a per-author `queue: max` group. Matrix jobs must also include their matrix values in the group.
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d5d0b9ea8..f418058af4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   Fastly abandons unfinished requests; Axum, Cloudflare, and Spin cancel owned work.
 - Explicit TS Console activation with `?ts_console=1` now sets a 30-minute diagnostics cookie instead of a browser-session cookie, independently of the mobile trace flag. Ordinary requests do not refresh it; end and explicitly enable diagnostics again to adopt the lifetime for an existing session.
 - Publisher documents with diagnostics active now use private, no-store responses and strip conditional and range request headers before fetching the origin. An unexpected origin `304` becomes a private `502` because it cannot supply an instrumented document, including when mobile tracing is disabled.
+- Access telemetry v2 now uses `auction_collected_ms` for collection return, sets `ts_version` to the TS build identifier matching `x-ts-version`, and adds `delivery_result` for local complete/partial/error transport handoff. It does not establish client receipt. Coordinate any deployed preview v2 schema before updating the producer.
+- Access ingestion now dispatches without waiting for Tinybird's reply. Start failures are reported; later transport errors, non-2xx responses and remote ingestion acceptance are unobserved, with no retry.
+- `/auction`, page-bids and HTML collectors share measured collection waits and outcome mapping. Real mediator-only work can have collection/wait/commit timing without a provider dispatch offset; routing and admission still decide whether any request is sent.
+- Prebid diagnostics listener, targeting and correlation code now lives in the optional diagnostics bundle. Badge evidence passes clicks through, its small control sits outside observed creative bounds, and selecting the latest request no longer opens history.
+
+- Auction telemetry failure batches for `/auction` and page-bids now include provider launch-failure rows alongside the summary, so a failed dispatch can emit more than one row. `/auction` summary `elapsed_ms` now uses the orchestrator's elapsed time.
+- GPT diagnostics JSON exports now include bounded server winner and Prebid candidate/win bidder codes and bucketed `hb_pb` values. These observations do not establish which creative GAM ultimately served; raw CPM and creative markup remain excluded.
+- The Axum dev server now runs its own serve loop to apply terminal request-timing handling.
+- The default `tinybird.access_dataset` is now `access_logs_v2`. Since this field is serialized, an upgrade from TOML that omits it may produce a one-time config-envelope diff; review and push once to settle it. Explicit legacy dataset values must be changed before enabling access telemetry.
+- Consent decoding for identity providers is stricter: a raw consent string that cannot be decoded blocks a provider whose policy is strict, and the GPP sharing, targeted-advertising and GPC fields of the US sections now block it too. A header-only GPP string with no applicable section does not block where TCF does not apply.
+- The Lockr proxy now logs only the path of the upstream URL, never its query string.
+- Identity KV is written at most once per EC-bearing request. Only a full page navigation from a returning visitor (the writer request) writes KV, once, after the response is sent: browser EIDs, pull partner results and the cluster size all go in that one write, with a generation check and no retry of the whole write. Every other route reads KV and stages but writes nothing. A consent-withdrawal tombstone and the removal-only retry of a failed write are the only exceptions. Mid-branch builds drop browser ingest until the whole change ships.
+- `POST /auction`, `GET /_ts/page-bids` and `GET /_ts/api/v1/identify` no longer write KV, and `/_ts/api/v1/identify` omits expired IDs. The `/identify` response shape is unchanged: one UID per source.
+- Pull partners now run from a visitor's second page load, from the writer request after send, and back off on errors. They are paced by `[ec.identity.providers.pull-<id>]` (`refresh_after_sec`, `max_calls_per_minute`), so the old default of 10 calls per hour becomes an effective 60 per hour. That 60 per hour is a ceiling, not a rate: `refresh_after_sec` and error backoff gate each partner first. Runtime startup now builds each pull partner's descriptor: a partner whose allowed host fails the descriptor host check stops startup. See [Identity Providers](docs/guide/configuration.md#identity-providers-ec-identity).
+- **Breaking:** `ec.pull_sync_concurrency`, and `pull_sync_ttl_sec` and `pull_sync_rate_limit` on `[[ec.partners]]`, are removed, and validation now rejects them with an error that names the replacement. Use `[ec.identity].max_concurrency` (the example config's value moves from 3 to the default 4), `refresh_after_sec`, and `max_calls_per_minute = ceil(N / 60)` for `pull_sync_rate_limit = N`, the last two in `[ec.identity.providers.<pull-id>]`.
+- Identity providers that resolve must now declare the TCF purposes their GVL entry lists (`ConsentPolicy::with_tcf_purposes`) and their GVL ID (`with_tcf_vendor`), or opt out of vendor consent with `without_tcf_vendor`; `ConsentPolicy::strict()` alone now requires only Purpose 1, and `build()` rejects an undeclared resolver.
+- A new visitor's first navigation that runs an auction now runs hold-mode identity providers that do not read the EC ID, and creates its row with their answers in the one create write, so a visitor who leaves after one page can still get a provider ID. It waits up to `hold_budget_ms`; without such a provider the create runs before routing as before.
+- A same-origin `/_ts/page-bids` call from a real browser now writes browser ingest and after-send provider results, at most once per `ec.identity.spa_writer_interval_sec` (default 300, `0` turns it off), so single-page apps do not wait for a full navigation.
+- A removal whose KV writes all fail now waits in a `pending:<ec_id>` KV key (one-day TTL) for the next writer navigation to merge, counted in `removal_deferred`; `removal_lost` counts only a removal that could not reach that key either. Positive IDs a capture sees on a request that is not the writer wait there too, so a capture's full entry set reaches KV. Every returning writer navigation reads that key once, a second KV read.
+- A global revoke (`revoke_scope = "global"`) now also sets an `HttpOnly` `ts-ec-revoked` cookie with a fingerprint of the visitor's consent, and no EC is minted until that consent changes, so a CMP that still grants does not undo the revoke on the next page.
+- `max_calls_per_ip_per_minute` (default 10) on each `[ec.identity.providers.<id>]` caps calls to that provider from one client address across visitors, next to the per-visitor cap.
+- `[ec.identity] max_backend_requests` (default 32, Fastly's per-execution limit) bounds the origin, auction and identity provider calls of one request together. A provider call past it is skipped and is not counted as a failure, so it never opens the provider's circuit breaker. Hold-mode calls also cap their connect timeout at their call timeout.
+- A provider opt-out clears on a TCF re-grant only when the opt-out was recorded under a TCF denial that is now granted; a later CMP re-save that was already granting no longer clears it. A clear records the opt-out it lifted rather than its own time, so it cannot lift an opt-out written after its request read the row.
+- `Resolves::with_refresh_grace` lets an identity provider without private state keep an expired ID it wrote for a source it owns as a refresh anchor until the expiry plus the grace. The ID is never served meanwhile.
+- With `[ec.identity] mirror_enabled = true` (off by default), `/auction` responses carry `ext.ts_eids_s` and `/_ts/page-bids` responses carry `ts_eids_s`: the payload (`value` with `max_age`, `clear`, or absent) for the client-only `__Host-ts-eids-s` mirror cookie, at most 2,048 bytes and one day. The shim now writes only `[[ec.partners]]` sources into `ts-eids`, merging each auction's entries per source instead of replacing the cookie, and no longer clears it when a request carries no EIDs (a TCF block still clears it).
+- The `ts-ec-pull-complete` cookie is removed: Trusted Server no longer sets or reads it, and a copy a browser holds expires within one hour.
+- **Breaking:** The KV identity row moves to schema version 2. A release before this one cannot read a version 2 row, so rolling back past this release is unsupported once it has written one. See [Rolling back](docs/guide/configuration.md#rolling-back). This release should merge after the EID-fidelity changes, whose behaviour its golden tests pin.
+- The `EID sync measurement: ...` log line is no longer logged for returning visitors; only a new EC still logs it. Each request now logs one `identity request measurement: ...` line after the response is sent, with the inbound `Cookie` header size, KV reads and writes by route kind, the flush outcome, lost removals and the after-send withdrawal run. It holds no identifiers. Operator dashboards that read the old line should read the new one.
+- **Breaking:** Prebid Server no longer receives any Trusted Server identity cookie (`ts-ec`, `ts-eids`, and the `__Host-ts-eids-s` mirror that this release's shim writes); today it receives `ts-ec` and `ts-eids`. The publisher origin still receives `ts-ec` and `ts-eids` but never the mirror. `[ec] strip_eids_cookie_from_origin = true` strips `ts-eids` from origin requests too.
 - **Breaking:** `x-ts-version` now reports the deployed git version — the release tag, else the branch, else the first 6 characters of the commit — compiled in from the build-time `TRUSTED_SERVER__GIT_VERSION` (set by the deploy pipeline) or local git, and is sent by every adapter, including on the Fastly `GET /health` probe. The Fastly service version it previously carried is now `x-ts-fastly-version`; update dashboards, monitors, and scripts that read `x-ts-version` as the Fastly version number. Builds with neither the override nor git omit the header.
 - **Breaking:** `ts audit ad-templates generate` now previews the managed-field diff on stderr and asks before writing a changed config. Runs whose stdin or stderr is not a terminal fail without writing unless `--yes` is passed, so add `--yes` to scripts and CI jobs that apply generated slots. A declined prompt exits non-zero, `--yes` cannot be combined with `--dry-run`, and a candidate whose managed fields are unchanged is no longer rewritten.
 - **Breaking:** `ts prebid bundle` is now `ts prebid client`, alongside the new `ts prebid server` namespace. Update scripts and runbooks to use `ts prebid client` with the same arguments. The old `bundle` spelling is no longer accepted and has no compatibility alias.
@@ -52,6 +81,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Lockr and Permutive SDK recognition now uses parsed vendor hostnames and SDK pathnames instead of searching the whole URL (#1199). The browser Lockr guard no longer replaces unrelated scripts that mention a Lockr host in their path or query, use a lookalike host, or serve a non-SDK resource from a Lockr host. Query strings and fragments no longer prevent SDK recognition in the server matchers, the browser Permutive guard, or the browser Lockr guard on `identity.loc.kr`. Matching URLs use the existing configured-SDK routes; their original query and fragment are not forwarded upstream. Server matching trims leading and trailing C0 controls and spaces, removes tab, CR, and LF, and accepts backslashes as authority separators. It no longer recognizes attribute values that contain a NUL or that write slashes as character references such as `&#x2F;`, so markup like that can load the SDK from the vendor host.
 - `rewrite.exclude_domains` matching is now case-insensitive and ignores surrounding whitespace. Entries written with uppercase letters previously never matched and now take effect, so those hosts stop being proxied and click-wrapped, and `/first-party/sign` now rejects them with `502`; it used to sign them, or return `403` when the host was also outside `proxy.allowed_domains`. Empty and bare `"*"` `exclude_domains` entries, which never matched a host, are dropped at load with a warning, and other entries that can never match a host are logged with a warning. Absolute `http(s)` creative URLs that cannot be parsed (for example, a host containing a space) are now left untouched; previously the trimmed value was written back re-quoted (with `https:` prepended to `//` input, so `src=" //example.com invalid/x "` became `https://example.com invalid/x`), an unparseable quoted URL in `<style>` or `style=` was re-quoted through `cssparser::serialize_string`, and a link also gained `data-tsclick`. `/first-party/sign` now answers unparseable `http(s)` input with `unsupported url` instead of `invalid url`; both map to `502`. The first `ts config push` after upgrading shows a one-time `exclude_domains` diff for configs with mixed-case, padded, empty or bare `"*"` entries. Audit `exclude_domains` for mixed-case entries before upgrading.
 - Next.js and Google Tag Manager script rewrites now compose in streamed HTML instead of overwriting each other, preserving Pages Router JSON and App Router Flight payloads with recomputed decoded `T`-record lengths. GTM/GA Flight rewrites require both integrations to be enabled. Buffering is bounded and per document; an uncaptured data head (including inert text quoting a Flight push), an unsupported or binary push, or a size limit keeps the remaining Flight stream raw and restores queued originals, but cannot undo already-streamed rewrites. Complete serialized form state does not disable later rewriting, foreign property references no longer hide a later qualified Flight push, and placeholder-stage document fallback emits a reason-bearing warning without source data (#1206, #1207, #1208).
 - Publisher HTML is now processed when the request carries its host only in the URI (absolute-form HTTP/1.1, or HTTP/2 without a usable `Host`), instead of being returned unmodified with an "Empty request host" warning (#1118). URI userinfo is excluded from rewritten URLs, while ports and IPv6 brackets are preserved.
@@ -71,6 +101,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `[rewrite] include_domains` limits creative asset rewriting to listed hosts. When non-empty, only asset URLs on matching hosts are proxied through `/first-party/proxy`, so only those hosts receive the EC ID on newly rewritten or signed asset URLs. The list is not enforced when a proxy URL is fetched, so previously issued proxy URLs can still forward the EC ID to hosts later removed from it. Other assets keep their original URL, and `/first-party/sign` returns `502` for them so the creative runtime loads them directly. Click-through links are not affected, and `exclude_domains` still wins. Entries must be host names, optionally prefixed with `*.`, dotted-quad IPv4 addresses, or bracketed IPv6 addresses; entries with a scheme, port, path, spaces or non-ASCII characters are rejected at load. Upgrading: deploy the binary first, then push a config that sets `include_domains`. Rolling back: remove `include_domains`, push the resulting config, then roll back the binary; older binaries reject the key because `[rewrite]` denies unknown fields.
 - Added `[auction].rewrite_clicks` to control creative click-through wrapping (`<a href>`/`<area href>` → signed `/first-party/click`) independently of asset rewriting. Unset (the default) follows `rewrite_creatives` for `POST /auction` and SSAT/page-bids and keeps wrapping links in HTML fetched through `/first-party/proxy`, so existing configs keep their asset and link behavior; an explicit value applies to every path. `rewrite_creatives` now governs asset URLs only; bidder `<base>` handling and, on `POST /auction`, creative TSJS injection run when either setting is on. Click wrapping is what forwards the visitor's EC ID (`ts-ec`) to landing pages, so `rewrite_clicks = false` stops that on every path and `rewrite_clicks = true` starts it for configs with `rewrite_creatives = false`. Also changed for every config with rewriting on, including the default, and for HTML fetched through `/first-party/proxy` under every config: a bidder `<base target>` is now kept with its `href` dropped, instead of removing the whole element, so raw links keep opening where the bidder intended. Upgrading: deploy the binary first, then push a config that sets `rewrite_clicks`. Rolling back: remove any explicit `rewrite_clicks` (and its environment override), push the resulting config, then roll back the binary. Older binaries tie click wrapping to `rewrite_creatives` in both directions, so rolling back turns clicks back on for `rewrite_creatives = true` with `rewrite_clicks = false`, and off for `rewrite_creatives = false` with `rewrite_clicks = true`; rolling back from any `rewrite_clicks = false` also turns click wrapping back on in HTML fetched through `/first-party/proxy`.
 - Added the `[auction].rewrite_creatives` (default `true`) and `[auction].sanitize_creatives` (default `false`) options. `rewrite_creatives` rewrites winning-bid adm to first-party endpoints across `POST /auction` and publisher SSAT/page-bids delivery (asset URL conversion to `/first-party/proxy`; bidder `<base>` handling, which drops the `href` and keeps a `target`, and creative TSJS injection on `POST /auction` only, both of which also run when `rewrite_clicks` is on). Click-through wrapping is controlled by `[auction].rewrite_clicks`, which follows `rewrite_creatives` when unset. Enabling `sanitize_creatives` strips executable markup from winning-bid adm before delivery.
+- Added opt-in request-phase `Server-Timing` on private Fastly/Axum responses and sampled post-delivery Fastly access telemetry. Deploy the new `access_logs_v2` datasource and its scoped APPEND token before enabling access emission; the legacy `access_logs_raw` schema and data remain unchanged. Access rows retain bounded route templates and coarse operational dimensions for 30 days, with random UUID joins for active auction observations and null UUIDs for disabled auctions. Each row stores its sampling rate. Access ingestion starts after delivery without waiting for a reply. Before rolling back to an older binary, disable access emission, remove non-default `[observability]` config, and re-push; access-only deployments must also disable the Tinybird master switch. See the telemetry guide and Tinybird cutover runbook.
+- Server-side identity provider framework. An integration registers an `IdentityProvider` with `try_with_identity_provider`, and the coordinator handles consent, transport limits, backoff and the single KV write. Provider authors get a test harness (`ProviderHarness`, `check_conformance`, `output_eids`). See [Writing an Identity Provider](docs/guide/identity-providers.md). No vendor ships with the framework.
+- Source ownership: `owner` on an `[[ec.partners]]` entry names the provider that owns a source. An owner's result replaces the source's whole entry set, and batch sync writes an owned source only when the row holds no value for it (an expired owned record counts as present and is not filled). Validation rejects an owner that is not enabled, is capture-only, does not claim the source, or collides with another provider. See [Source ownership](docs/guide/configuration.md#source-ownership-ec-partners-owner).
+- Hold mode: `mode = "hold"` in `[ec.identity.providers.<id>]` runs a provider before the navigation's auction, within the shared `hold_budget_ms`, with `timeout_ms` and `after_send_timeout_ms` as call timeouts.
+- Revoke-only passive capture for providers that proxy a vendor's API: a captured removal or opt-out is written to KV, a positive result clears an opt-out, and positive IDs are only counted. `revoke_scope` (`provider` by default, or `global` to run the consent-withdrawal tombstone) sets how far an opt-out reaches. Removals and opt-outs apply from any client, as consent withdrawals do; only a clear needs a real browser. A capture-only provider must list its `sources`. See the [capture provider checklist](docs/guide/edge-cookies.md#capture-provider-checklist).
+- Complete provider EIDs: a provider can return several entries and UIDs per source, with UID-level `atype` and `ext` and EID-level `inserter`, `matcher`, `mm` and `ext`. KV, the bidstream, `x-ts-eids` and the `ts-eids-s` mirror carry the whole set in order; `/identify` still returns one UID per source. See [Complete provider EIDs](docs/guide/edge-cookies.md#complete-provider-eids).
+- `/_ts/api/v1/identify` returns an ID a server-side provider wrote only to a browser call from the publisher's site (an allowed `Origin` and `Sec-Fetch-Site: same-origin` or `same-site`), because the EC ID is a bearer value partners and the origin hold. Other IDs are returned as before.
+- The `capture_unpersisted` and `removal_lost` counters in the `identity request measurement: ...` log line, and a per-provider circuit breaker (`breaker_failures_per_minute`) that skips a provider for every visitor after repeated transport failures, timeouts, 429s or 5xx responses.
+
+- Added the `[auction].rewrite_creatives` (default `true`) and `[auction].sanitize_creatives` (default `false`) options. `rewrite_creatives` rewrites winning-bid adm to first-party endpoints across `POST /auction` and publisher SSAT/page-bids delivery (proxy/click URL conversion, bidder `<base>` removal; creative TSJS injection on `POST /auction` only). Enabling `sanitize_creatives` strips executable markup from winning-bid adm before delivery.
 - `creative_opportunities.slot.gam_unit_path` is now a template supporting `{network_id}`, `{slot_id}`, and `{section}`, so a publisher whose ad unit varies by site section expresses it in one slot rule instead of one per (slot × section). `{section}` derives from the request path: `[creative_opportunities].section_segment` selects which path segment names the section (0-based, default `0`; set `1` for locale-prefixed URLs), and `section_root` supplies the value for paths with no such segment. `section_root` is required when a template uses `{section}`. Existing static and absent `gam_unit_path` configs are unchanged. Startup rejects a blank `gam_network_id` only when an absent/default path or `{network_id}` template consumes it. Trusted Server conservatively caps whole rendered dynamic paths at 100 UTF-8 bytes, informed by Google's 100-character per-ad-unit-code limit; an over-limit request-specific path omits that slot without failing the response. During typed/startup finalization, every placeholder-bearing template that omits `section_segment` materializes `section_segment = 0`, so an older binary rejects the blob loudly. Static and absent paths remain legacy-schema compatible only when both `section_root` and `section_segment` are omitted. Before rolling back below this feature, replace or remove dynamic paths, remove both keys, re-push and finalize the config, then roll back the binary.
 - Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
 - Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
diff --git a/Cargo.lock b/Cargo.lock
index 70316712ac..a2ace809df 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1530,7 +1530,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "base16ct 1.0.0",
  "serde",
@@ -1543,7 +1543,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-axum"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1571,7 +1571,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-cloudflare"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1594,7 +1594,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-fastly"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1624,7 +1624,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-spin"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1651,7 +1651,7 @@ dependencies = [
 [[package]]
 name = "edgezero-cli"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "chrono",
  "clap",
@@ -1676,7 +1676,7 @@ dependencies = [
 [[package]]
 name = "edgezero-core"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "anyhow",
  "async-compression",
@@ -1708,7 +1708,7 @@ dependencies = [
 [[package]]
 name = "edgezero-macros"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.11#87456c708ffe9edf86b3a0f8b06dfd15d60b07b5"
+source = "git+https://github.com/IABTechLab/edgezero?rev=511ce06ff3df59996641af2ea64cbc54cdac7ea5#511ce06ff3df59996641af2ea64cbc54cdac7ea5"
 dependencies = [
  "log",
  "proc-macro2",
@@ -6600,6 +6600,7 @@ dependencies = [
  "futures",
  "log",
  "log-fastly",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "toml",
diff --git a/Cargo.toml b/Cargo.toml
index 139cf4f610..80866ab790 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -56,12 +56,14 @@ cssparser = "0.36"
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-cli = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11" }
-edgezero-core = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
+# RC-only pin for EdgeZero #389, including main's lifecycle and ingress APIs.
+# Replace all six revisions with an approved release tag before merging the RC.
+edgezero-adapter-axum = { git = "https://github.com/IABTechLab/edgezero", rev = "511ce06ff3df59996641af2ea64cbc54cdac7ea5", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/IABTechLab/edgezero", rev = "511ce06ff3df59996641af2ea64cbc54cdac7ea5", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/IABTechLab/edgezero", rev = "511ce06ff3df59996641af2ea64cbc54cdac7ea5", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/IABTechLab/edgezero", rev = "511ce06ff3df59996641af2ea64cbc54cdac7ea5", default-features = false }
+edgezero-cli = { git = "https://github.com/IABTechLab/edgezero", rev = "511ce06ff3df59996641af2ea64cbc54cdac7ea5" }
+edgezero-core = { git = "https://github.com/IABTechLab/edgezero", rev = "511ce06ff3df59996641af2ea64cbc54cdac7ea5", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
@@ -103,7 +105,7 @@ rustls = "0.23"
 rustls-pemfile = "2"
 scraper = "0.24.0"
 serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0.149"
+serde_json = { version = "1.0.149", features = ["raw_value"] }
 serde_yaml_ng = "0.10"
 sha2 = "0.11"
 similar = "2.7"
diff --git a/crates/trusted-server-adapter-axum/Cargo.toml b/crates/trusted-server-adapter-axum/Cargo.toml
index af707aa24e..798d644440 100644
--- a/crates/trusted-server-adapter-axum/Cargo.toml
+++ b/crates/trusted-server-adapter-axum/Cargo.toml
@@ -20,6 +20,7 @@ path = "src/main.rs"
 
 [dependencies]
 async-trait = { workspace = true }
+axum = { workspace = true }
 edgezero-adapter-axum = { workspace = true, features = ["axum"] }
 edgezero-core = { workspace = true }
 error-stack = { workspace = true }
@@ -27,7 +28,8 @@ futures = { workspace = true }
 log = { workspace = true }
 reqwest = { workspace = true }
 simple_logger = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "sync", "time"] }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "signal", "sync", "time"] }
+tower = { workspace = true, features = ["util"] }
 trusted-server-core = { workspace = true }
 web-time = { workspace = true }
 
@@ -37,4 +39,3 @@ axum = { workspace = true }
 base64 = { workspace = true }
 temp-env = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-tower = { workspace = true, features = ["util"] }
diff --git a/crates/trusted-server-adapter-axum/src/app.rs b/crates/trusted-server-adapter-axum/src/app.rs
index 0b1858e208..87f629c08a 100644
--- a/crates/trusted-server-adapter-axum/src/app.rs
+++ b/crates/trusted-server-adapter-axum/src/app.rs
@@ -2,6 +2,7 @@ use core::future::Future;
 use std::sync::Arc;
 
 use edgezero_adapter_axum::context::AxumRequestContext;
+use edgezero_adapter_axum::service::EdgeZeroAxumService;
 use edgezero_core::app::Hooks;
 use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
@@ -19,6 +20,7 @@ use trusted_server_core::ec::EcContext;
 use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported, deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::finalize::BrowserSeed;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -234,6 +236,8 @@ async fn dispatch_fallback(
                 kv: None,
                 ec_context: &mut ec_context,
                 services,
+                is_real_browser: false,
+                seed: &BrowserSeed::empty(),
                 req,
             })
             .await
@@ -328,7 +332,7 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
     Method::DELETE,
 ];
 
-fn named_routes() -> [NamedRoute; 17] {
+fn named_routes() -> [NamedRoute; 18] {
     [
         NamedRoute {
             path: "/.well-known/trusted-server.json",
@@ -374,6 +378,13 @@ fn named_routes() -> [NamedRoute; 17] {
             primary_methods: &[Method::GET],
             handler: NamedRouteHandler::AdminEcNotSupported,
         },
+        // The provider opt-out clear writes the EC identity graph, so it
+        // answers like the lookup: not available on this adapter.
+        NamedRoute {
+            path: "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
+            primary_methods: &[Method::DELETE],
+            handler: NamedRouteHandler::AdminEcNotSupported,
+        },
         // Admin EIDs echo: pure request inspection (no KV), so the dev
         // server serves the real handler.
         NamedRoute {
@@ -619,16 +630,10 @@ impl Hooks for TrustedServerApp {
         "TrustedServer"
     }
 
+    /// Returns the bare router without terminal timing; serve with
+    /// [`Self::dev_server_service`] to preserve `Server-Timing` emission.
     fn routes() -> RouterService {
-        let state = match build_state() {
-            Ok(s) => s,
-            Err(ref e) => {
-                log::error!("failed to build application state: {:?}", e);
-                return startup_error_router(e);
-            }
-        };
-
-        build_router(&state)
+        Self::routes_with_server_timing_flag().0
     }
 }
 
@@ -650,6 +655,43 @@ impl TrustedServerApp {
         Ok(build_router(&state))
     }
 
+    /// The dev server's fully configured tower service: the application
+    /// router wrapped in the terminal timing layer
+    /// ([`crate::timing::TimingService`]), with `server_timing_enabled`
+    /// read from the same settings snapshot that built the router.
+    ///
+    /// This is the standard construction path for serving this adapter.
+    /// [`Hooks::routes`] satisfies the `Hooks` trait contract and returns
+    /// the bare router without the timing layer; callers who serve traffic
+    /// should use this instead so `server_timing_enabled` is never
+    /// silently discarded.
+    #[must_use]
+    pub fn dev_server_service() -> crate::timing::TimingService<EdgeZeroAxumService> {
+        let (router, server_timing_enabled) = Self::routes_with_server_timing_flag();
+        crate::timing::TimingService::new(EdgeZeroAxumService::new(router), server_timing_enabled)
+    }
+
+    /// Build the router alongside whether `Server-Timing` emission is
+    /// enabled, read from the same settings snapshot used to build the
+    /// router.
+    ///
+    /// The Axum dev server's terminal timing layer ([`crate::timing`]) needs
+    /// this flag once at startup. The Axum dev server builds its application
+    /// state once and reuses the same [`RouterService`] for every request.
+    #[must_use]
+    fn routes_with_server_timing_flag() -> (RouterService, bool) {
+        let state = match build_state() {
+            Ok(s) => s,
+            Err(ref e) => {
+                log::error!("failed to build application state: {:?}", e);
+                return (startup_error_router(e), false);
+            }
+        };
+
+        let server_timing_enabled = state.settings.observability.server_timing_enabled;
+        (build_router(&state), server_timing_enabled)
+    }
+
     /// Build the full router with explicit settings and runtime services.
     ///
     /// Each request receives a clone of the supplied services, allowing callers
@@ -680,10 +722,12 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
     let trace_state = Arc::clone(state);
 
     let mut router = RouterService::builder()
-        .pre_dispatch_hook_arc(Arc::new(TracePreDispatchHook::new(
-            Arc::clone(&state.settings),
-            Arc::new(move |request| trace_metadata(&trace_state, request)),
-        )))
+        .pre_dispatch_hook(crate::ingress::HttpTracePreDispatchHook(
+            TracePreDispatchHook::new(
+                Arc::clone(&state.settings),
+                Arc::new(move |request| trace_metadata(&trace_state, request)),
+            ),
+        ))
         // Outermost middleware: strips the configured trusted-client-IP
         // headers before anything else sees the request. Must stay first —
         // any middleware registered ahead of it would observe the
diff --git a/crates/trusted-server-adapter-axum/src/ingress.rs b/crates/trusted-server-adapter-axum/src/ingress.rs
new file mode 100644
index 0000000000..38692b2d3c
--- /dev/null
+++ b/crates/trusted-server-adapter-axum/src/ingress.rs
@@ -0,0 +1,202 @@
+//! Ingress capture for the plain HTTP listener owned by this adapter.
+//!
+//! The custom listener keeps terminal timing outside `EdgeZeroAxumService`, but
+//! bypasses `EdgeZero`'s dev-server-only transport marker. Capture equivalent
+//! metadata here and restore it after SDK conversion, before trace preflight.
+
+use async_trait::async_trait;
+use axum::body::Body;
+use axum::http::{HeaderMap, Request, Uri, header::HOST};
+use edgezero_core::error::EdgeError;
+use edgezero_core::http::{Request as CoreRequest, Response};
+use edgezero_core::ingress::{
+    CapturedTarget, HeaderFidelity, InboundOrigin, OriginSource, Preservation, RequestIngress,
+    TargetSource,
+};
+use edgezero_core::router::PreDispatchHook;
+use trusted_server_core::trace::TracePreDispatchHook;
+
+// Not constructible from request headers or outside this listener bridge.
+#[derive(Clone)]
+struct HttpListenerIngress(RequestIngress);
+
+/// Capture ingress at the adapter-owned plain HTTP listener boundary.
+///
+/// Call only when serving plain HTTP, never to infer a transport scheme from
+/// forwarded headers. As in `EdgeZero`'s listener, Host must be singular and agree
+/// with any absolute request URI. Header and target preservation stay unknown.
+pub fn capture_http_ingress(request: &mut Request<Body>) {
+    let source = if request.uri().scheme().is_some() {
+        TargetSource::RuntimeUrl
+    } else {
+        TargetSource::RuntimePathAndQuery
+    };
+    let ingress = RequestIngress::new(
+        CapturedTarget::capture(&request.uri().to_string(), source, Preservation::Unknown),
+        http_origin(request.uri(), request.headers()),
+        HeaderFidelity::RUNTIME_HEADER_MAP,
+    );
+    request
+        .extensions_mut()
+        .insert(HttpListenerIngress(ingress));
+}
+
+fn http_origin(uri: &Uri, headers: &HeaderMap) -> Option<InboundOrigin> {
+    let mut hosts = headers.get_all(HOST).iter();
+    let host = hosts.next()?.to_str().ok()?;
+    if hosts.next().is_some() {
+        return None;
+    }
+    let origin = InboundOrigin::parse("http", host, OriginSource::TransportBinding).ok()?;
+    if uri
+        .scheme_str()
+        .is_some_and(|scheme| !scheme.eq_ignore_ascii_case("http"))
+    {
+        return None;
+    }
+    if let Some(authority) = uri.authority() {
+        let supplied =
+            InboundOrigin::parse("http", authority.as_str(), OriginSource::TransportBinding)
+                .ok()?;
+        if !origin.same_authority(&supplied) {
+            return None;
+        }
+    }
+    Some(origin)
+}
+
+pub(crate) struct HttpTracePreDispatchHook(pub(crate) TracePreDispatchHook);
+
+#[async_trait(?Send)]
+impl PreDispatchHook for HttpTracePreDispatchHook {
+    async fn handle(&self, request: &mut CoreRequest) -> Result<Option<Response>, EdgeError> {
+        // SDK conversion installs its own snapshot without a transport origin.
+        // Only the private listener snapshot can replace it. Bare services keep
+        // the SDK's fail-closed behavior when no transport has been established.
+        if let Some(HttpListenerIngress(ingress)) =
+            request.extensions_mut().remove::<HttpListenerIngress>()
+        {
+            request.extensions_mut().insert(ingress);
+        }
+        self.0.handle(request).await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::http::HeaderValue;
+    use edgezero_core::ingress::{MAX_AUTHORITY_BYTES, MAX_TARGET_BYTES, TargetUnavailable};
+
+    #[test]
+    fn listener_origin_requires_one_valid_host_consistent_with_http_uri() {
+        for (uri, hosts, accepted) in [
+            ("/_ts/trace/enable", vec!["localhost:8787"], true),
+            (
+                "http://localhost:8787/_ts/trace/enable",
+                vec!["localhost:8787"],
+                true,
+            ),
+            (
+                "http://LOCALHOST:80/_ts/trace/enable",
+                vec!["localhost"],
+                true,
+            ),
+            (
+                "http://[::1]:8787/_ts/trace/enable",
+                vec!["[::1]:8787"],
+                true,
+            ),
+            ("/_ts/trace/enable", vec![], false),
+            (
+                "/_ts/trace/enable",
+                vec!["localhost:8787", "localhost:8787"],
+                false,
+            ),
+            (
+                "/_ts/trace/enable",
+                vec!["localhost:8787,localhost:8787"],
+                false,
+            ),
+            ("/_ts/trace/enable", vec!["user@localhost:8787"], false),
+            ("/_ts/trace/enable", vec!["localhost:invalid"], false),
+            (
+                "https://localhost:8787/_ts/trace/enable",
+                vec!["localhost:8787"],
+                false,
+            ),
+            (
+                "http://other.example.com/_ts/trace/enable",
+                vec!["localhost:8787"],
+                false,
+            ),
+            (
+                "http://localhost:8788/_ts/trace/enable",
+                vec!["localhost:8787"],
+                false,
+            ),
+            ("http://localhost:8787/_ts/trace/enable", vec![], false),
+        ] {
+            let mut request = Request::builder()
+                .uri(uri)
+                .header("forwarded", "host=localhost:8787;proto=https")
+                .header("x-forwarded-host", "localhost:8787")
+                .header("x-forwarded-proto", "https")
+                .body(Body::empty())
+                .expect("should build listener request");
+            for host in hosts {
+                request.headers_mut().append(
+                    HOST,
+                    HeaderValue::from_str(host).expect("should construct visible Host"),
+                );
+            }
+            capture_http_ingress(&mut request);
+            let ingress = &request
+                .extensions()
+                .get::<HttpListenerIngress>()
+                .expect("should capture listener metadata")
+                .0;
+            assert_eq!(ingress.origin().is_some(), accepted, "URI {uri}");
+            if let Some(origin) = ingress.origin() {
+                assert_eq!(origin.scheme(), "http");
+                assert_eq!(origin.source(), OriginSource::TransportBinding);
+            }
+            assert_eq!(
+                ingress.header_fidelity(&HOST),
+                HeaderFidelity::RUNTIME_HEADER_MAP,
+                "should not claim original header preservation"
+            );
+            let CapturedTarget::Complete(target) = ingress.target() else {
+                panic!("should capture bounded runtime target");
+            };
+            assert_eq!(target.value(), uri);
+            assert_eq!(target.fidelity(), Preservation::Unknown);
+        }
+    }
+
+    #[test]
+    fn listener_capture_preserves_bounds_and_rejects_non_utf8_host() {
+        let mut request = Request::builder()
+            .uri(format!("/_ts/trace?{}", "x".repeat(MAX_TARGET_BYTES)))
+            .body(Body::empty())
+            .expect("should build oversized visible target");
+        for host in [
+            HeaderValue::from_bytes(b"\xff").expect("should build non-UTF8 Host"),
+            HeaderValue::from_str(&"x".repeat(MAX_AUTHORITY_BYTES + 1))
+                .expect("should build oversized Host"),
+        ] {
+            request.headers_mut().insert(HOST, host);
+            capture_http_ingress(&mut request);
+            let ingress = &request
+                .extensions()
+                .get::<HttpListenerIngress>()
+                .expect("should capture listener metadata")
+                .0;
+            assert!(ingress.origin().is_none());
+            assert!(matches!(
+                ingress.target(),
+                CapturedTarget::Unavailable(TargetUnavailable::TooLarge)
+            ));
+        }
+    }
+}
diff --git a/crates/trusted-server-adapter-axum/src/lib.rs b/crates/trusted-server-adapter-axum/src/lib.rs
index 2f15e566d2..4dc8356f55 100644
--- a/crates/trusted-server-adapter-axum/src/lib.rs
+++ b/crates/trusted-server-adapter-axum/src/lib.rs
@@ -6,7 +6,12 @@
 
 /// Application routing and handler registration for the Axum dev server.
 pub mod app;
+/// Transport ingress for the adapter-owned plain HTTP listener.
+pub mod ingress;
 /// Request middleware (auth, response finalisation).
 pub mod middleware;
 /// Platform-trait implementations backed by env vars and `reqwest`.
 pub mod platform;
+/// Terminal timing layer wrapping the Axum dev server's tower `Service`
+/// boundary with the request-phase `Server-Timing` freeze point.
+pub mod timing;
diff --git a/crates/trusted-server-adapter-axum/src/main.rs b/crates/trusted-server-adapter-axum/src/main.rs
index 66d592e0b7..8933710f3b 100644
--- a/crates/trusted-server-adapter-axum/src/main.rs
+++ b/crates/trusted-server-adapter-axum/src/main.rs
@@ -1,7 +1,18 @@
-use edgezero_adapter_axum::dev_server::{AxumDevServer, AxumDevServerConfig};
-use edgezero_core::app::Hooks as _;
+use std::convert::Infallible;
+use std::net::SocketAddr;
+
+use axum::Router;
+use axum::body::Body;
+use axum::http::{Request, Response};
+use edgezero_adapter_axum::dev_server::AxumDevServerConfig;
+use edgezero_adapter_axum::service::EdgeZeroAxumService;
 use log::LevelFilter;
+use tokio::net::TcpListener;
+use tokio::runtime::Builder as RuntimeBuilder;
+use tokio::signal;
+use tower::{Service, ServiceExt as _, service_fn};
 use trusted_server_adapter_axum::app::TrustedServerApp;
+use trusted_server_adapter_axum::timing::TimingService;
 
 /// Environment variable that sets the maximum log level.
 const LOG_LEVEL_ENV: &str = "RUST_LOG";
@@ -37,14 +48,91 @@ fn main() {
         None => AxumDevServerConfig::default(),
     };
 
-    log::info!("Listening on http://{}", config.addr);
-    let router = TrustedServerApp::routes();
-    if let Err(err) = AxumDevServer::with_config(router, config).run() {
+    let service = TrustedServerApp::dev_server_service();
+    if let Err(err) = run(service, config) {
         log::error!("trusted-server-adapter-axum failed: {err}");
         std::process::exit(1);
     }
 }
 
+/// Runs the Axum dev server with the request-phase timing terminal layer
+/// ([`trusted_server_adapter_axum::timing::TimingService`]) wrapped around
+/// `EdgeZeroAxumService`, ahead of `axum::serve`.
+///
+/// This does not use `edgezero_adapter_axum::dev_server::AxumDevServer::run`:
+/// that helper only accepts a bare [`RouterService`](edgezero_core::router::RouterService) and builds its own
+/// `EdgeZeroAxumService` and `axum::Router` internally, with no seam for an
+/// outer service wrapper. Router-generated 404/405 responses bypass
+/// `RouterBuilder::middleware` (see `trusted_server_adapter_axum::timing`),
+/// so the freeze point has to wrap the tower `Service` boundary itself.
+/// Driving `axum::serve` directly here mirrors that helper's own internal
+/// bind/wrap/serve/shutdown sequence closely enough to keep behavior
+/// identical for callers (`PORT` env var, ctrl-c graceful shutdown).
+///
+/// # Errors
+///
+/// Returns an error if the Tokio runtime fails to start, the listener fails
+/// to bind, or the underlying serve loop errors.
+fn run(
+    service: TimingService<EdgeZeroAxumService>,
+    config: AxumDevServerConfig,
+) -> std::io::Result<()> {
+    let runtime = RuntimeBuilder::new_multi_thread()
+        .enable_all()
+        .build()
+        .map_err(|error| {
+            std::io::Error::new(
+                error.kind(),
+                format!("failed to build tokio runtime: {error}"),
+            )
+        })?;
+    runtime.block_on(serve(service, config))
+}
+
+async fn serve(
+    service: TimingService<EdgeZeroAxumService>,
+    config: AxumDevServerConfig,
+) -> std::io::Result<()> {
+    let listener = TcpListener::bind(config.addr).await.map_err(|error| {
+        std::io::Error::new(
+            error.kind(),
+            format!("failed to bind dev server to {}: {error}", config.addr),
+        )
+    })?;
+
+    log::info!("Listening on http://{}", listener.local_addr()?);
+
+    let make_service =
+        dev_server_router(service).into_make_service_with_connect_info::<SocketAddr>();
+
+    let server = axum::serve(listener, make_service);
+    if config.enable_ctrl_c {
+        server
+            .with_graceful_shutdown(async {
+                let _ctrl_c = signal::ctrl_c().await;
+            })
+            .await
+    } else {
+        server.await
+    }
+    .map_err(|error| std::io::Error::new(error.kind(), format!("axum server error: {error}")))
+}
+
+fn dev_server_router<S>(service: S) -> Router
+where
+    S: Service<Request<Body>, Response = Response<Body>, Error = Infallible>
+        + Clone
+        + Send
+        + Sync
+        + 'static,
+    S::Future: Send + 'static,
+{
+    Router::new().fallback_service(service_fn(move |mut req| {
+        trusted_server_adapter_axum::ingress::capture_http_ingress(&mut req);
+        service.clone().oneshot(req)
+    }))
+}
+
 /// Parses an optional `RUST_LOG` value into the logger's maximum level.
 ///
 /// Absent and blank values resolve to [`DEFAULT_LOG_LEVEL`]. Any other value
@@ -84,10 +172,189 @@ fn port_from_env() -> Option<u16> {
 
 #[cfg(test)]
 mod tests {
+    use std::future::{Ready, ready};
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::task::{Context, Poll};
+
     use super::*;
 
-    #[test]
-    fn crate_compiles() {}
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn listener_trace_actions_require_matching_transport_origin() {
+        let settings = trusted_server_core::settings::Settings::from_toml(
+            r#"
+            [[handlers]]
+            path = "^/_ts/admin"
+            username = "admin"
+            password = "admin-pass"
+            [publisher]
+            domain = "localhost"
+            cookie_domain = "localhost"
+            origin_url = "https://origin.example.com"
+            proxy_secret = "integration-test-proxy-secret"
+            [ec]
+            passphrase = "test-secret-key-32-bytes-minimum"
+            [integrations.gpt_diagnostics]
+            enabled = true
+            trace_page_enabled = true
+            [observability]
+            server_timing_enabled = true
+            "#,
+        )
+        .expect("should parse listener trace settings");
+        let routes = TrustedServerApp::routes_with_settings(settings)
+            .expect("should build listener trace routes");
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("should bind an isolated HTTP listener");
+        let origin = format!(
+            "http://{}",
+            listener.local_addr().expect("should expose port")
+        );
+        let service = TimingService::new(EdgeZeroAxumService::new(routes), true);
+        let unbound = service
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri(format!("{origin}/_ts/trace/enable"))
+                    .header("host", origin.trim_start_matches("http://"))
+                    .header("origin", &origin)
+                    .header("sec-fetch-site", "same-origin")
+                    .header("x-ts-trace-action", "enable")
+                    .body(Body::empty())
+                    .expect("should build unbound trace action"),
+            )
+            .await
+            .expect("should reject action without listener metadata");
+        assert_eq!(unbound.status().as_u16(), 403);
+        assert!(!unbound.headers().contains_key("set-cookie"));
+        let server = tokio::spawn(async move {
+            axum::serve(
+                listener,
+                dev_server_router(service).into_make_service_with_connect_info::<SocketAddr>(),
+            )
+            .await
+            .expect("should serve trace requests");
+        });
+        let client = reqwest::Client::new();
+        for action in ["enable", "end"] {
+            for (browser_origin, expected_status) in [
+                ("https://attacker.example.com", 403),
+                (origin.as_str(), 200),
+            ] {
+                let response = client
+                    .post(format!("{origin}/_ts/trace/{action}"))
+                    .header("origin", browser_origin)
+                    .header("sec-fetch-site", "same-origin")
+                    .header("x-ts-trace-action", action)
+                    .header("forwarded", "host=attacker.example.com;proto=https")
+                    .header("x-forwarded-host", "attacker.example.com")
+                    .header("x-forwarded-proto", "https")
+                    .send()
+                    .await
+                    .expect("should request trace action through the listener");
+                assert_eq!(response.status().as_u16(), expected_status);
+                assert_eq!(response.headers()["cache-control"], "no-store, private");
+                assert!(response.headers().contains_key("content-security-policy"));
+                assert!(response.headers().contains_key("server-timing"));
+                assert_eq!(
+                    response.headers().contains_key("set-cookie"),
+                    expected_status == 200,
+                    "should mutate cookies only for the listener's matching origin"
+                );
+            }
+        }
+        server.abort();
+    }
+
+    struct ReadinessSensitiveService {
+        polled: bool,
+        readied: bool,
+        pending_polls: Arc<AtomicUsize>,
+        calls: Arc<AtomicUsize>,
+    }
+
+    impl Clone for ReadinessSensitiveService {
+        fn clone(&self) -> Self {
+            Self {
+                polled: false,
+                readied: false,
+                pending_polls: Arc::clone(&self.pending_polls),
+                calls: Arc::clone(&self.calls),
+            }
+        }
+    }
+
+    impl Service<Request<Body>> for ReadinessSensitiveService {
+        type Response = Response<Body>;
+        type Error = Infallible;
+        type Future = Ready<Result<Self::Response, Self::Error>>;
+
+        fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            if !self.polled {
+                self.polled = true;
+                self.pending_polls.fetch_add(1, Ordering::Relaxed);
+                cx.waker().wake_by_ref();
+                return Poll::Pending;
+            }
+            self.readied = true;
+            Poll::Ready(Ok(()))
+        }
+
+        fn call(&mut self, _request: Request<Body>) -> Self::Future {
+            assert!(
+                self.readied,
+                "should wait for this instance to become ready"
+            );
+            self.readied = false;
+            self.calls.fetch_add(1, Ordering::Relaxed);
+            ready(Ok(Response::builder()
+                .header("cache-control", "private")
+                .body(Body::empty())
+                .expect("should build a private response")))
+        }
+    }
+
+    #[tokio::test]
+    async fn dev_server_bridge_waits_for_readiness_on_timed_and_health_paths() {
+        for path in ["/private", "/health"] {
+            for enabled in [true, false] {
+                let pending_polls = Arc::new(AtomicUsize::new(0));
+                let calls = Arc::new(AtomicUsize::new(0));
+                let router = dev_server_router(TimingService::new(
+                    ReadinessSensitiveService {
+                        polled: false,
+                        readied: false,
+                        pending_polls: Arc::clone(&pending_polls),
+                        calls: Arc::clone(&calls),
+                    },
+                    enabled,
+                ));
+
+                for expected_calls in 1..=2 {
+                    let response = router
+                        .clone()
+                        .oneshot(
+                            Request::builder()
+                                .uri(path)
+                                .body(Body::empty())
+                                .expect("should build a bridge request"),
+                        )
+                        .await
+                        .expect("should serve the request after readiness");
+
+                    assert_eq!(calls.load(Ordering::Relaxed), expected_calls);
+                    assert_eq!(pending_polls.load(Ordering::Relaxed), expected_calls);
+                    assert_eq!(
+                        response.headers().contains_key("server-timing"),
+                        enabled && path != "/health",
+                        "should preserve timing configuration and health exclusion"
+                    );
+                }
+            }
+        }
+    }
 
     #[test]
     fn parse_log_level_defaults_to_info_when_unset_or_blank() {
diff --git a/crates/trusted-server-adapter-axum/src/platform.rs b/crates/trusted-server-adapter-axum/src/platform.rs
index 229bb902f7..72c3d18ad7 100644
--- a/crates/trusted-server-adapter-axum/src/platform.rs
+++ b/crates/trusted-server-adapter-axum/src/platform.rs
@@ -745,6 +745,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
+            connect_timeout: None,
             host_header_override: None,
             discriminator: None,
         };
@@ -766,6 +767,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
+            connect_timeout: None,
             host_header_override: None,
             discriminator: None,
         };
diff --git a/crates/trusted-server-adapter-axum/src/timing.rs b/crates/trusted-server-adapter-axum/src/timing.rs
new file mode 100644
index 0000000000..16da24d126
--- /dev/null
+++ b/crates/trusted-server-adapter-axum/src/timing.rs
@@ -0,0 +1,518 @@
+//! Terminal timing layer for the Axum dev server.
+//!
+//! [`TimingService`](crate::timing::TimingService) wraps the tower `Service`
+//! boundary the Axum dev server's router sits behind: it reuses the generic
+//! handle in request extensions or creates one, exposing it through the
+//! [`RequestTimings`](trusted_server_core::request_timing::RequestTimings)
+//! facade. Downstream core handlers can record into it. The wrapper stamps
+//! `mark_headers_ready` on the way back and appends the `Server-Timing` header via
+//! [`append_server_timing_if_private`](trusted_server_core::request_timing::append_server_timing_if_private).
+//!
+//! This wraps *outside* `RouterService` rather than registering as
+//! `RouterBuilder::middleware` because the tower boundary is the terminal
+//! freeze point. Before a response reaches this layer,
+//! `RouterService::oneshot` inside `EdgeZeroAxumService::call` has
+//! converted any dispatch error into a plain response. Every response is
+//! covered uniformly regardless of how routing produced it, and the
+//! position survives future routing changes. (In this application's router
+//! a catch-all fallback spans every path and publisher method, so
+//! router-generated 404/405s that bypass middleware are close to
+//! unreachable today; the outer position does not depend on them.)
+//!
+//! `/health` is excluded by path match before a
+//! [`RequestTimings`](trusted_server_core::request_timing::RequestTimings)
+//! collector is even created: this wrapper bypasses timing for every method
+//! on that path, leaving any preinstalled handle unchanged.
+//!
+//! The Axum dev server builds its application state once at startup, so
+//! `ts-appbuild` never appears in its per-request header. Fastly records
+//! per-request setup and, on cold requests, application construction in
+//! `Phase::AppBuild`.
+
+use std::convert::Infallible;
+use std::future::Future;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use axum::body::Body as AxumBody;
+use axum::http::{Request, Response};
+use tower::Service;
+use trusted_server_core::request_timing::{RequestTimings, append_server_timing_if_private};
+
+/// Path excluded from timing collection and `Server-Timing` emission: health
+/// checks bypass this wrapper for every method.
+const HEALTH_PATH: &str = "/health";
+
+/// Wraps an inner Axum tower service with the request-phase timing freeze
+/// point described in the module docs.
+#[derive(Clone)]
+pub struct TimingService<S> {
+    inner: S,
+    server_timing_enabled: bool,
+}
+
+impl<S> TimingService<S> {
+    /// Wraps `inner`, appending `Server-Timing` when `server_timing_enabled`
+    /// is set and the response is conclusively private.
+    #[must_use]
+    pub fn new(inner: S, server_timing_enabled: bool) -> Self {
+        Self {
+            inner,
+            server_timing_enabled,
+        }
+    }
+}
+
+impl<S> Service<Request<AxumBody>> for TimingService<S>
+where
+    S: Service<Request<AxumBody>, Response = Response<AxumBody>, Error = Infallible>
+        + Clone
+        + Send
+        + 'static,
+    S::Future: Send + 'static,
+{
+    type Error = Infallible;
+    type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;
+    type Response = Response<AxumBody>;
+
+    fn call(&mut self, mut req: Request<AxumBody>) -> Self::Future {
+        // Readiness belongs to the polled instance, not necessarily its clone.
+        let replacement = self.inner.clone();
+        let mut inner = std::mem::replace(&mut self.inner, replacement);
+
+        // Bypass installation and finalization for `/health`, regardless of method.
+        // A preinstalled collector remains available to the inner service.
+        if req.uri().path() == HEALTH_PATH {
+            return Box::pin(async move { inner.call(req).await });
+        }
+
+        let server_timing_enabled = self.server_timing_enabled;
+        let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_else(|| {
+            let timings = RequestTimings::new();
+            req.extensions_mut().insert(timings.handle().clone());
+            timings
+        });
+
+        Box::pin(async move {
+            let mut response = inner.call(req).await?;
+            append_server_timing_if_private(&mut response, &timings, server_timing_enabled);
+            Ok(response)
+        })
+    }
+
+    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        self.inner.poll_ready(cx)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::future::{Ready, ready};
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    use super::*;
+    use axum::http::header::CACHE_CONTROL;
+    use axum::http::{HeaderValue, StatusCode};
+    use edgezero_adapter_axum::service::EdgeZeroAxumService;
+    use edgezero_core::body::Body as EdgeBody;
+    use edgezero_core::context::RequestContext;
+    use edgezero_core::error::EdgeError;
+    use edgezero_core::http::response_builder;
+    use edgezero_core::router::RouterService;
+    use tower::{ServiceExt as _, service_fn};
+
+    struct ReadinessSensitiveService {
+        readied: bool,
+        calls: Arc<AtomicUsize>,
+    }
+
+    impl Clone for ReadinessSensitiveService {
+        fn clone(&self) -> Self {
+            Self {
+                readied: false,
+                calls: Arc::clone(&self.calls),
+            }
+        }
+    }
+
+    impl Service<Request<AxumBody>> for ReadinessSensitiveService {
+        type Response = Response<AxumBody>;
+        type Error = Infallible;
+        type Future = Ready<Result<Self::Response, Self::Error>>;
+
+        fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            self.readied = true;
+            Poll::Ready(Ok(()))
+        }
+
+        fn call(&mut self, _req: Request<AxumBody>) -> Self::Future {
+            assert!(
+                self.readied,
+                "should call the instance whose readiness permit was reserved"
+            );
+            self.readied = false;
+            self.calls.fetch_add(1, Ordering::Relaxed);
+            ready(Ok(Response::builder()
+                .header(CACHE_CONTROL, "private")
+                .body(AxumBody::empty())
+                .expect("should build a private fixture response")))
+        }
+    }
+
+    #[tokio::test]
+    async fn axum_calls_the_readied_instance_on_timed_and_health_paths() {
+        for path in ["/private", "/health"] {
+            for enabled in [true, false] {
+                let calls = Arc::new(AtomicUsize::new(0));
+                let inner = ReadinessSensitiveService {
+                    readied: false,
+                    calls: Arc::clone(&calls),
+                };
+                let mut service = TimingService::new(inner, enabled);
+
+                for expected_calls in 1..=2 {
+                    let request = Request::builder()
+                        .uri(path)
+                        .body(AxumBody::empty())
+                        .expect("should build a request for readiness testing");
+                    let response = service
+                        .ready()
+                        .await
+                        .expect("should reserve readiness")
+                        .call(request)
+                        .await
+                        .expect("should call the readied service");
+
+                    assert_eq!(
+                        calls.load(Ordering::Relaxed),
+                        expected_calls,
+                        "should forward each request exactly once"
+                    );
+                    assert_eq!(
+                        header(&response, "server-timing").is_some(),
+                        enabled && path != HEALTH_PATH,
+                        "should preserve the timing flag and health bypass"
+                    );
+                }
+            }
+        }
+    }
+
+    /// Builds a private (`cache-control: private, no-store`) response for a
+    /// handler under test.
+    fn private_ok_response() -> Result<edgezero_core::http::Response, EdgeError> {
+        Ok(response_builder()
+            .status(StatusCode::OK)
+            .header("cache-control", "private, no-store")
+            .body(EdgeBody::from("ok"))
+            .expect("should build a private response fixture"))
+    }
+
+    /// Reads a response header as a UTF-8 string, or `None` if absent.
+    fn header(response: &Response<AxumBody>, name: &str) -> Option<String> {
+        response
+            .headers()
+            .get(name)
+            .and_then(|value| value.to_str().ok())
+            .map(ToOwned::to_owned)
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_preserves_preinstalled_collector_and_origin() {
+        let timings = RequestTimings::new();
+        timings.record(
+            trusted_server_core::request_timing::Phase::Filter,
+            std::time::Duration::from_millis(7),
+        );
+        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+        let router = RouterService::builder()
+            .get("/private", |ctx: RequestContext| async move {
+                let timings = RequestTimings::from_extensions(ctx.request().extensions())
+                    .expect("should receive preinstalled collector");
+                assert_eq!(
+                    timings.snapshot().filter_ms,
+                    Some(7),
+                    "should preserve upstream phase"
+                );
+                timings.mark_auction_dispatched();
+                assert!(
+                    timings
+                        .snapshot()
+                        .auction_dispatched_ms
+                        .expect("should mark dispatch")
+                        >= 20,
+                    "should preserve the pre-aged origin"
+                );
+                private_ok_response()
+            })
+            .build();
+        let terminal = TimingService::new(EdgeZeroAxumService::new(router), true);
+        let upstream_timings = timings.clone();
+        let mut upstream = service_fn(move |mut req: Request<AxumBody>| {
+            req.extensions_mut()
+                .insert(upstream_timings.handle().clone());
+            let mut service = terminal.clone();
+            async move { service.call(req).await }
+        });
+        let request = Request::builder()
+            .uri("/private")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = upstream
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should handle request");
+        let value = header(&response, "server-timing").expect("should render private timing");
+        assert!(
+            value.contains("ts-filter;dur=7.0"),
+            "should render upstream phase: {value}"
+        );
+        assert!(
+            timings
+                .snapshot()
+                .time_elapsed_ms
+                .expect("should stamp original handle")
+                >= 20,
+            "terminal rendering should use the original clock"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_emits_header_on_private_response() {
+        let router = RouterService::builder()
+            .get("/private", |_ctx: RequestContext| async {
+                private_ok_response()
+            })
+            .build();
+        let mut service = TimingService::new(EdgeZeroAxumService::new(router), true);
+
+        let request = Request::builder()
+            .uri("/private")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = service
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should not fail");
+
+        let server_timing = header(&response, "server-timing").expect("should emit header");
+        assert!(
+            server_timing.contains("ts-total;dur="),
+            "should carry the collected total: {server_timing}"
+        );
+        assert!(
+            !server_timing.contains("ts-appbuild"),
+            "the Axum dev server builds state once at startup, so there is no \
+             per-request app-build interval to render: {server_timing}"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_suppresses_timing_when_edge_cache_header_collides_with_private_cache_control() {
+        let router = RouterService::builder()
+            .get("/collision", |_ctx: RequestContext| async {
+                Ok(response_builder()
+                    .status(StatusCode::OK)
+                    .header("cache-control", "private, no-store")
+                    .header("cdn-cache-control", "max-age=60")
+                    .body(EdgeBody::from("ok"))
+                    .expect("should build a response with conflicting cache directives"))
+            })
+            .build();
+        let mut service = TimingService::new(EdgeZeroAxumService::new(router), true);
+
+        let request = Request::builder()
+            .uri("/collision")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = service
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should not fail");
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            header(&response, "cdn-cache-control").as_deref(),
+            Some("max-age=60")
+        );
+        assert!(
+            header(&response, "server-timing").is_none(),
+            "must not expose timing when a CDN header can make the private response cacheable"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_suppresses_header_when_flag_is_off() {
+        let router = RouterService::builder()
+            .get("/private", |_ctx: RequestContext| async {
+                private_ok_response()
+            })
+            .build();
+        let mut service = TimingService::new(EdgeZeroAxumService::new(router), false);
+
+        let request = Request::builder()
+            .uri("/private")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = service
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should not fail");
+
+        assert!(
+            header(&response, "server-timing").is_none(),
+            "should not emit server-timing when server_timing_enabled is false"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_round_trips_phase_timings_recorded_in_the_handler() {
+        // The collector crosses the adapter boundary as a request extension;
+        // this pins the round trip end to end: a phase recorded inside a
+        // core-style handler must come back out in the rendered header, so
+        // a future adapter conversion that drops request extensions fails
+        // here instead of silently losing every phase.
+        let router = RouterService::builder()
+            .get("/private", |ctx: RequestContext| async move {
+                if let Some(timings) = RequestTimings::from_extensions(ctx.request().extensions()) {
+                    timings.record(
+                        trusted_server_core::request_timing::Phase::Filter,
+                        std::time::Duration::from_millis(7),
+                    );
+                }
+                private_ok_response()
+            })
+            .build();
+        let mut service = TimingService::new(EdgeZeroAxumService::new(router), true);
+
+        let request = Request::builder()
+            .uri("/private")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = service
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should not fail");
+
+        let server_timing = header(&response, "server-timing").expect("should emit header");
+        assert!(
+            server_timing.contains("ts-filter;dur=7.0"),
+            "a phase recorded in the handler should survive the adapter round trip: {server_timing}"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_404_carries_header_when_private() {
+        // An empty router has no routes at all, so any path dispatches
+        // through `RouterInner::dispatch`'s `NotFound` branch, exactly the
+        // path that bypasses `RouterBuilder::middleware`. The router's own
+        // `EdgeError::into_response` does not attach `Cache-Control`, so a
+        // small wrapping service forces the response private here, standing
+        // in for whatever upstream layer would normally mark a genuinely
+        // private 404. This proves the freeze point still runs for a
+        // router-generated response without weakening
+        // `append_server_timing_if_private`'s real gating logic.
+        let empty_router = RouterService::builder().build();
+        let inner = EdgeZeroAxumService::new(empty_router);
+        let force_private = service_fn(move |req: Request<AxumBody>| {
+            let mut svc = inner.clone();
+            async move {
+                let mut response = svc.call(req).await?;
+                response
+                    .headers_mut()
+                    .insert(CACHE_CONTROL, HeaderValue::from_static("private, no-store"));
+                Ok::<_, Infallible>(response)
+            }
+        });
+        let mut service = TimingService::new(force_private, true);
+
+        let request = Request::builder()
+            .uri("/does-not-exist")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = service
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should not fail");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::NOT_FOUND,
+            "should still be the router's own not-found response"
+        );
+        let server_timing = header(&response, "server-timing")
+            .expect("a router-generated 404 must still carry the header when private");
+        assert!(
+            server_timing.contains("ts-total;dur="),
+            "should carry the collected total: {server_timing}"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_health_is_excluded() {
+        for method in [axum::http::Method::GET, axum::http::Method::POST] {
+            for path in ["/health", "/health?probe=1"] {
+                for preinstalled in [false, true] {
+                    let timings = RequestTimings::new();
+                    let inner = service_fn(move |req: Request<AxumBody>| async move {
+                        assert_eq!(
+                            RequestTimings::from_extensions(req.extensions()).is_some(),
+                            preinstalled,
+                            "health bypass should not install or remove a handle"
+                        );
+                        Ok::<_, Infallible>(
+                            Response::builder()
+                                .header("cache-control", "private")
+                                .body(AxumBody::empty())
+                                .expect("should build private response"),
+                        )
+                    });
+                    let mut service = TimingService::new(inner, true);
+                    let mut request = Request::builder()
+                        .method(method.clone())
+                        .uri(path)
+                        .body(AxumBody::empty())
+                        .expect("should build request");
+                    if preinstalled {
+                        request.extensions_mut().insert(timings.handle().clone());
+                    }
+                    let response = service
+                        .ready()
+                        .await
+                        .expect("should be ready")
+                        .call(request)
+                        .await
+                        .expect("should not fail");
+                    assert!(
+                        header(&response, "server-timing").is_none(),
+                        "health should not emit timing"
+                    );
+                    assert_eq!(
+                        timings.snapshot().time_elapsed_ms,
+                        None,
+                        "health bypass should not finalize timing"
+                    );
+                }
+            }
+        }
+    }
+}
diff --git a/crates/trusted-server-adapter-axum/tests/routes.rs b/crates/trusted-server-adapter-axum/tests/routes.rs
index b785734968..6baef1b597 100644
--- a/crates/trusted-server-adapter-axum/tests/routes.rs
+++ b/crates/trusted-server-adapter-axum/tests/routes.rs
@@ -116,6 +116,7 @@ fn all_explicit_routes_are_registered() {
         ("POST", "/_ts/admin/keys/deactivate"),
         ("GET", "/_ts/admin/ec"),
         ("GET", "/_ts/admin/ec/{id}"),
+        ("DELETE", "/_ts/admin/ec/{id}/providers/{provider}/opt-out"),
         ("GET", "/_ts/admin/eids"),
         ("POST", "/admin/keys/rotate"),
         ("POST", "/admin/keys/deactivate"),
@@ -390,6 +391,55 @@ async fn authenticated_admin_ec_routes_return_501() {
     }
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn authenticated_admin_opt_out_clear_route_returns_501() {
+    // The clear writes the EC identity graph, which is Fastly KV backed, so
+    // the Axum dev server answers the DELETE locally with 501 like the EC
+    // lookup.
+    let path = format!(
+        "/_ts/admin/ec/{}.abc123/providers/pull-ssp-example-com/opt-out",
+        "a".repeat(64)
+    );
+    let send = |method: &'static str| {
+        let path = path.clone();
+        async move {
+            let req = Request::builder()
+                .method(method)
+                .uri(&path)
+                .header("authorization", "Basic YWRtaW46YWRtaW4tcGFzcw==")
+                .body(AxumBody::empty())
+                .expect("should build request");
+            make_service()
+                .ready()
+                .await
+                .expect("should be ready")
+                .call(req)
+                .await
+                .expect("should respond")
+        }
+    };
+
+    let deleted = send("DELETE").await;
+    assert_eq!(
+        deleted.status().as_u16(),
+        501,
+        "DELETE {path} should report that the opt-out clear is unsupported"
+    );
+    assert_eq!(
+        deleted
+            .headers()
+            .get("content-type")
+            .and_then(|v| v.to_str().ok()),
+        Some("application/json"),
+        "should answer with the same JSON as the EC lookup"
+    );
+    assert_eq!(
+        send("GET").await.status().as_u16(),
+        404,
+        "control: GET {path} should be denied locally as an unknown admin route"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn admin_ec_route_without_credentials_returns_401() {
     let mut svc = make_service();
diff --git a/crates/trusted-server-adapter-cloudflare/src/app.rs b/crates/trusted-server-adapter-cloudflare/src/app.rs
index 668b025ccb..9c5a14e01b 100644
--- a/crates/trusted-server-adapter-cloudflare/src/app.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/app.rs
@@ -22,6 +22,7 @@ use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported as core_admin_ec_lookup_not_supported,
     deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::finalize::BrowserSeed;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -40,6 +41,7 @@ use trusted_server_core::publisher::{
 use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
 };
+use trusted_server_core::request_timing::RequestTimingMiddleware;
 use trusted_server_core::settings::Settings;
 use trusted_server_core::trace::{TraceMetadata, TracePreDispatchHook};
 
@@ -545,6 +547,8 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         kv: None,
                         ec_context: &mut ec_context,
                         services: &services,
+                        is_real_browser: false,
+                        seed: &BrowserSeed::empty(),
                         req,
                     })
                     .await
@@ -609,6 +613,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // any middleware registered ahead of it would observe the
             // shared-secret authentication header.
             .middleware(SanitizeRequestMiddleware::new(Arc::clone(&state.settings)))
+            .middleware(RequestTimingMiddleware::default().with_excluded_paths(&["/health"]))
             .middleware(FinalizeResponseMiddleware::new(Arc::clone(&state.settings)))
             .middleware(AuthMiddleware::new(Arc::clone(&state.settings)))
             .get(
@@ -650,6 +655,14 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             .get("/_ts/admin/ec/{id}", |_ctx: RequestContext| async {
                 Ok::<Response, EdgeError>(admin_ec_lookup_not_supported())
             })
+            // The provider opt-out clear writes the EC identity graph, so it
+            // answers like the lookup.
+            .delete(
+                "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
+                |_ctx: RequestContext| async {
+                    Ok::<Response, EdgeError>(admin_ec_lookup_not_supported())
+                },
+            )
             // Admin EIDs echo: pure request inspection (no KV), so this
             // adapter serves the real handler.
             .get(
diff --git a/crates/trusted-server-adapter-cloudflare/src/middleware.rs b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
index af19241163..6bb7255c86 100644
--- a/crates/trusted-server-adapter-cloudflare/src/middleware.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
@@ -56,9 +56,9 @@ impl Middleware for SanitizeRequestMiddleware {
 /// (injected by the Cloudflare Workers runtime). On the native host target the
 /// header is absent, so `X-Geo-Info-Available: false` is emitted.
 ///
-/// Registered directly inside [`SanitizeRequestMiddleware`] and ahead of
-/// [`AuthMiddleware`] so that every outgoing response — including auth-rejected
-/// ones — carries a consistent set of headers.
+/// Registered inside [`RequestTimingMiddleware`](trusted_server_core::request_timing::RequestTimingMiddleware) and ahead of [`AuthMiddleware`]
+/// so that every outgoing response — including auth-rejected ones — carries a
+/// consistent set of headers.
 pub struct FinalizeResponseMiddleware {
     settings: Arc<Settings>,
 }
@@ -163,6 +163,8 @@ pub(crate) fn apply_finalize_headers(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use edgezero_core::router::RouterService;
+    use trusted_server_core::request_timing::{RequestTimingMiddleware, RequestTimings};
 
     use std::collections::HashMap;
     use std::sync::Mutex;
@@ -182,10 +184,10 @@ mod tests {
             .expect("should build empty test response")
     }
 
-    fn empty_ctx() -> RequestContext {
+    fn ctx_for_path(path: &str) -> RequestContext {
         let req = request_builder()
             .method(Method::GET)
-            .uri("/test")
+            .uri(path)
             .header("x-reader-ip", "198.51.100.7")
             .header("x-reader-ip-auth", "fictional-shared-secret-0123456789")
             .body(Body::empty())
@@ -193,6 +195,10 @@ mod tests {
         RequestContext::new(req, PathParams::new(HashMap::new()))
     }
 
+    fn empty_ctx() -> RequestContext {
+        ctx_for_path("/test")
+    }
+
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
         // Build from explicit test settings: the settings baked into the
         // binary contain placeholder secrets that `get_settings()` rejects
@@ -291,6 +297,77 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_timing_middleware_preserves_shared_handle_and_health_policy() {
+        for method in [Method::GET, Method::POST] {
+            for path in ["/test", "/health", "/health?probe=1", "/health/child"] {
+                for preinstalled in [false, true] {
+                    let route_path = path.split('?').next().expect("should have path");
+                    let expected = preinstalled || route_path != "/health";
+                    let timings = RequestTimings::new();
+                    timings.record(
+                        trusted_server_core::request_timing::Phase::Filter,
+                        std::time::Duration::from_millis(7),
+                    );
+                    std::thread::sleep(std::time::Duration::from_millis(2));
+                    let router = RouterService::builder()
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .route(route_path, method.clone(), move |ctx: RequestContext| async move {
+                            let installed = RequestTimings::from_extensions(ctx.request().extensions());
+                            assert_eq!(installed.is_some(), expected, "should preserve exact health policy");
+                            if let Some(installed) = installed {
+                                if preinstalled {
+                                    assert_eq!(installed.snapshot().filter_ms, Some(7), "should retain upstream facts");
+                                    installed.mark_auction_dispatched();
+                                    assert!(installed.snapshot().auction_dispatched_ms.expect("should mark dispatch") >= 2,
+                                        "should retain upstream origin");
+                                } else {
+                                    assert_eq!(installed.snapshot(), trusted_server_core::request_timing::TimingSnapshot::default(),
+                                        "should install independent empty facts");
+                                }
+                                installed.record_auction_wait(
+                                    trusted_server_core::request_timing::AuctionWaitPlacement::PreHeader,
+                                    std::time::Duration::from_millis(3));
+                            }
+                            Ok::<Response, EdgeError>(empty_response())
+                        })
+                        .build();
+                    let mut request = request_builder()
+                        .method(method.clone())
+                        .uri(path)
+                        .body(Body::empty())
+                        .expect("should build request");
+                    if preinstalled {
+                        request.extensions_mut().insert(timings.handle().clone());
+                    }
+                    let response =
+                        block_on(router.oneshot(request)).expect("should dispatch request");
+                    assert!(
+                        response.headers().get("server-timing").is_none(),
+                        "attachment should not expose timing"
+                    );
+                    if preinstalled {
+                        assert_eq!(
+                            timings.snapshot().auction_wait_ms,
+                            Some(3),
+                            "should share handler updates"
+                        );
+                        assert_eq!(
+                            timings.snapshot().request_elapsed_ms,
+                            None,
+                            "should not fabricate completion"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn sanitize_middleware_strips_configured_trust_headers_before_routing() {
         let mut settings = settings_with_response_headers(vec![]);
diff --git a/crates/trusted-server-adapter-cloudflare/tests/routes.rs b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
index f385bf5295..b4ba6a457c 100644
--- a/crates/trusted-server-adapter-cloudflare/tests/routes.rs
+++ b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
@@ -254,6 +254,7 @@ fn all_explicit_routes_are_registered() {
         ("POST", "/_ts/admin/keys/deactivate"),
         ("GET", "/_ts/admin/ec"),
         ("GET", "/_ts/admin/ec/{id}"),
+        ("DELETE", "/_ts/admin/ec/{id}/providers/{provider}/opt-out"),
         ("GET", "/_ts/admin/eids"),
         ("POST", "/auction"),
         // SPA re-auction endpoint, plus its deprecated `/__ts/` alias. Both
@@ -353,6 +354,49 @@ async fn authenticated_admin_ec_routes_return_501() {
     }
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn authenticated_admin_opt_out_clear_route_returns_501() {
+    // The clear writes the EC identity graph, which is Fastly KV backed, so
+    // Cloudflare answers the DELETE locally with 501 like the EC lookup.
+    let path = format!(
+        "/_ts/admin/ec/{}.abc123/providers/pull-ssp-example-com/opt-out",
+        "a".repeat(64)
+    );
+    let delete = request_builder()
+        .method("DELETE")
+        .uri(&path)
+        .header("authorization", "Basic YWRtaW46YWRtaW4tcGFzcw==")
+        .body(edgezero_core::body::Body::empty())
+        .expect("should build request");
+    let resp = route(test_router(), delete).await;
+
+    assert_eq!(
+        resp.status().as_u16(),
+        501,
+        "DELETE {path} should report that the opt-out clear is unsupported"
+    );
+    assert_eq!(
+        resp.headers()
+            .get("content-type")
+            .and_then(|v| v.to_str().ok()),
+        Some("application/json"),
+        "should answer with the same JSON as the EC lookup"
+    );
+
+    let get = request_builder()
+        .method("GET")
+        .uri(&path)
+        .header("authorization", "Basic YWRtaW46YWRtaW4tcGFzcw==")
+        .body(edgezero_core::body::Body::empty())
+        .expect("should build request");
+    let resp = route(test_router(), get).await;
+    assert_eq!(
+        resp.status().as_u16(),
+        404,
+        "control: GET {path} should be denied locally as an unknown admin route"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn admin_ec_route_without_credentials_returns_401() {
     let req = request_builder()
diff --git a/crates/trusted-server-adapter-fastly/Cargo.toml b/crates/trusted-server-adapter-fastly/Cargo.toml
index 6c7121d0d6..70d7b1c817 100644
--- a/crates/trusted-server-adapter-fastly/Cargo.toml
+++ b/crates/trusted-server-adapter-fastly/Cargo.toml
@@ -34,6 +34,7 @@ fern = { workspace = true }
 futures = { workspace = true }
 log = { workspace = true }
 log-fastly = { workspace = true }
+rand = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 trusted-server-core = { workspace = true }
diff --git a/crates/trusted-server-adapter-fastly/src/app.rs b/crates/trusted-server-adapter-fastly/src/app.rs
index ce06ce7e30..c72007f0d8 100644
--- a/crates/trusted-server-adapter-fastly/src/app.rs
+++ b/crates/trusted-server-adapter-fastly/src/app.rs
@@ -24,6 +24,7 @@
 //! | POST | `/_ts/admin/keys/deactivate` | [`handle_deactivate_key`] |
 //! | GET | `/_ts/admin/ec` | [`handle_admin_ec_lookup`] |
 //! | GET | `/_ts/admin/ec/{id}` | [`handle_admin_ec_lookup`] |
+//! | DELETE | `/_ts/admin/ec/{id}/providers/{provider}/opt-out` | [`handle_admin_opt_out_clear`] |
 //! | GET | `/_ts/admin/eids` | [`handle_admin_eids_lookup`] |
 //! | POST | `/_ts/api/v1/batch-sync` | [`handle_batch_sync`] |
 //! | GET | `/_ts/api/v1/identify` | [`handle_identify`] |
@@ -98,6 +99,7 @@ use edgezero_core::http::{
 };
 use edgezero_core::router::RouterService;
 use error_stack::Report;
+use trusted_server_core::access_telemetry::{RouteClass, RouteMetadata, publisher_route_template};
 use trusted_server_core::auction::AuctionTelemetrySink;
 use trusted_server_core::auction::endpoints::handle_auction;
 use trusted_server_core::auction::{
@@ -108,22 +110,27 @@ use trusted_server_core::config_payload::DEFAULT_SECRET_STORE_ID;
 use trusted_server_core::constants::{COOKIE_SHAREDID, COOKIE_TS_EIDS};
 use trusted_server_core::ec::admin::{
     deny_admin_diagnostic_fallback, handle_admin_ec_lookup, handle_admin_eids_lookup,
+    handle_admin_opt_out_clear,
 };
 use trusted_server_core::ec::batch_sync::handle_batch_sync;
 use trusted_server_core::ec::consent::ec_consent_withdrawn;
 use trusted_server_core::ec::device::DeviceSignals;
+use trusted_server_core::ec::finalize::{BrowserSeed, browser_seed};
 use trusted_server_core::ec::identify::{cors_preflight_identify, handle_identify};
+use trusted_server_core::ec::identity::IdentityRuntime;
 use trusted_server_core::ec::kv::KvIdentityGraph;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::ec::{EcContext, EidSyncSource};
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
+use trusted_server_core::geo::GeoLookupState;
 use trusted_server_core::http_util::is_navigation_request;
 use trusted_server_core::integrations::{
     IntegrationRegistry, ProxyDispatchInput, RequestFilterEffects, RequestFilterRegistryInput,
     RequestFilterRegistryOutcome,
 };
 use trusted_server_core::platform::{
-    ClientInfo, GeoInfo, PlatformGeo as _, PlatformKvStore, RuntimeServices, StoreName,
+    ClientInfo, GeoInfo, PlatformGeo, PlatformHttpClient, PlatformKvStore, RuntimeServices,
+    StoreName,
 };
 use trusted_server_core::proxy::{
     AssetProxyCachePolicy, handle_asset_proxy_request, handle_first_party_click,
@@ -138,6 +145,7 @@ use trusted_server_core::request_signing::{
     handle_deactivate_key, handle_rotate_key, handle_trusted_server_discovery,
     handle_verify_signature,
 };
+use trusted_server_core::request_timing::{Phase, RequestTimings};
 use trusted_server_core::settings::{ProxyAssetRoute, Settings};
 use trusted_server_core::settings_data::{DEFAULT_CONFIG_STORE_ID, get_settings_from_config_store};
 use trusted_server_core::tester_cookie::{handle_clear_tester, handle_set_tester};
@@ -190,6 +198,18 @@ pub(crate) struct AppState {
     pub(crate) registry: Arc<IntegrationRegistry>,
     pub(crate) default_kv_store: Arc<dyn PlatformKvStore>,
     pub(crate) auction_telemetry_sink: Arc<dyn AuctionTelemetrySink>,
+    /// Identity providers, keys and policy, built once per settings load.
+    pub(crate) identity: Arc<IdentityRuntime>,
+    /// The identity graph over `ec.ec_store`, built once. `None` when no
+    /// store is configured.
+    pub(crate) identity_graph: Option<KvIdentityGraph>,
+    /// Replaces the Fastly HTTP client in tests, so a request reaches a
+    /// scripted origin and bidder instead of the network.
+    #[cfg(test)]
+    pub(crate) http_client_for_test: Option<Arc<dyn PlatformHttpClient>>,
+    /// Replaces the Fastly geolocation in tests, which Viceroy does not serve.
+    #[cfg(test)]
+    pub(crate) geo_for_test: Option<Arc<dyn PlatformGeo>>,
 }
 
 /// Build the application state, loading settings and constructing all per-application components.
@@ -216,6 +236,49 @@ pub(crate) fn load_settings_from_config_store(
     )
 }
 
+/// Builds the identity runtime for one settings load.
+///
+/// # Errors
+///
+/// Returns an error when a provider cannot be described or the catalog rules fail.
+pub(crate) fn build_identity_runtime(
+    settings: &Settings,
+    integrations: &IntegrationRegistry,
+) -> Result<Arc<IdentityRuntime>, Report<TrustedServerError>> {
+    IdentityRuntime::from_settings(settings, integrations).map(Arc::new)
+}
+
+/// Builds the identity runtime for settings loaded without application
+/// state, from the integration registry those settings describe.
+///
+/// A plan or registry failure is logged and the runtime is built with no
+/// registered providers, so generic pull providers still run.
+///
+/// # Errors
+///
+/// Returns an error when the identity runtime cannot be built.
+pub(crate) fn build_identity_runtime_from_reloaded_settings(
+    settings: &Settings,
+) -> Result<Arc<IdentityRuntime>, Report<TrustedServerError>> {
+    let registry = compile_auction_plan(settings)
+        .and_then(|plan| IntegrationRegistry::with_plan(settings, Arc::new(plan)));
+    identity_runtime_from_registry_result(settings, registry)
+}
+
+fn identity_runtime_from_registry_result(
+    settings: &Settings,
+    registry: Result<IntegrationRegistry, Report<TrustedServerError>>,
+) -> Result<Arc<IdentityRuntime>, Report<TrustedServerError>> {
+    let registry = registry.unwrap_or_else(|error| {
+        log::warn!(
+            "identity runtime built without registered providers: integration registry unavailable after settings reload: {}",
+            error.current_context()
+        );
+        IntegrationRegistry::default()
+    });
+    build_identity_runtime(settings, &registry)
+}
+
 pub(crate) fn build_state_from_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -225,19 +288,71 @@ pub(crate) fn build_state_from_settings(
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Fastly)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
     let registry = IntegrationRegistry::with_plan(&settings, plan)?;
+    let identity = build_identity_runtime(&settings, &registry)?;
 
     let auction_telemetry_sink = crate::tinybird::auction_sink_from_settings(&settings);
     let default_kv_store = Arc::new(UnavailableKvStore) as Arc<dyn PlatformKvStore>;
+    let identity_graph = crate::maybe_identity_graph(&settings);
 
     Ok(Arc::new(AppState {
         settings: Arc::new(settings),
         orchestrator: Arc::new(orchestrator),
         registry: Arc::new(registry),
         default_kv_store,
+        identity_graph,
         auction_telemetry_sink,
+        identity,
+        #[cfg(test)]
+        http_client_for_test: None,
+        #[cfg(test)]
+        geo_for_test: None,
     }))
 }
 
+/// Builds application state from `settings` with `graph` as its identity
+/// graph, so routing, finalize and the after-send flush all use one store.
+#[cfg(test)]
+pub(crate) fn app_state_with_graph_for_test(
+    settings: Settings,
+    graph: KvIdentityGraph,
+) -> Arc<AppState> {
+    let state = build_state_from_settings(settings).expect("should build app state from settings");
+    let mut state = Arc::try_unwrap(state)
+        .unwrap_or_else(|_| unreachable!("a freshly built state should have one owner"));
+    state.identity_graph = Some(graph);
+    Arc::new(state)
+}
+
+/// `state` with `identity` as its identity runtime, for a request that
+/// reaches a provider no configuration can name.
+#[cfg(test)]
+pub(crate) fn app_state_with_identity_for_test(
+    state: Arc<AppState>,
+    identity: IdentityRuntime,
+) -> Arc<AppState> {
+    let mut state = Arc::try_unwrap(state)
+        .unwrap_or_else(|_| unreachable!("a freshly built state should have one owner"));
+    state.identity = Arc::new(identity);
+    Arc::new(state)
+}
+
+/// As [`app_state_with_graph_for_test`], with `client` answering every
+/// outbound request the routes make and `geo` locating every client.
+#[cfg(test)]
+pub(crate) fn app_state_with_network_for_test(
+    settings: Settings,
+    graph: KvIdentityGraph,
+    client: Arc<dyn PlatformHttpClient>,
+    geo: Arc<dyn PlatformGeo>,
+) -> Arc<AppState> {
+    let state = app_state_with_graph_for_test(settings, graph);
+    let mut state = Arc::try_unwrap(state)
+        .unwrap_or_else(|_| unreachable!("a freshly built state should have one owner"));
+    state.http_client_for_test = Some(client);
+    state.geo_for_test = Some(geo);
+    Arc::new(state)
+}
+
 fn warn_if_certificate_check_disabled(settings: &Settings) {
     if !settings.proxy.certificate_check {
         log::warn!(
@@ -264,6 +379,13 @@ fn warn_if_certificate_check_disabled(settings: &Settings) {
 fn build_per_request_services(state: &AppState, ctx: &RequestContext) -> RuntimeServices {
     // No cooperative timer is installed: Fastly host calls block. EOF consumers
     // must bound their own transport calls using the remaining finish budget.
+    let http_client: Arc<dyn PlatformHttpClient> = Arc::new(FastlyPlatformHttpClient::default());
+    #[cfg(test)]
+    let http_client = state.http_client_for_test.clone().unwrap_or(http_client);
+    let geo: Arc<dyn PlatformGeo> = Arc::new(FastlyPlatformGeo);
+    #[cfg(test)]
+    let geo = state.geo_for_test.clone().unwrap_or(geo);
+
     let client_info = ctx
         .request()
         .extensions()
@@ -284,8 +406,8 @@ fn build_per_request_services(state: &AppState, ctx: &RequestContext) -> Runtime
         .template_cache(Arc::new(crate::template_cache::FastlyTemplateCache::new()))
         .template_assembler(Arc::new(crate::esi_assembly::FastlyTemplateAssembler))
         .backend(Arc::new(FastlyPlatformBackend))
-        .http_client(Arc::new(FastlyPlatformHttpClient))
-        .geo(Arc::new(FastlyPlatformGeo))
+        .http_client(http_client)
+        .geo(geo)
         .auction_telemetry_sink(Arc::clone(&state.auction_telemetry_sink))
         .client_info(client_info)
         .build()
@@ -307,6 +429,12 @@ fn uses_dynamic_tsjs_fallback(method: &Method, path: &str) -> bool {
     *method == Method::GET && path.starts_with("/static/tsjs=")
 }
 
+/// Coarse route template for every `tsjs` bundle request, used as the
+/// `route_template` in the [`RouteMetadata`] attached by the tsjs branch of
+/// [`dispatch_fallback`]. Actual filenames vary by module/hash; the prefix
+/// alone is the route identity that matters for access telemetry.
+const TSJS_ROUTE_TEMPLATE: &str = "/static/tsjs=*";
+
 // ---------------------------------------------------------------------------
 // EC request state
 // ---------------------------------------------------------------------------
@@ -316,21 +444,20 @@ fn uses_dynamic_tsjs_fallback(method: &Method, path: &str) -> bool {
 ///
 /// `edgezero_main` pops this from the response after dispatch and runs
 /// [`trusted_server_core::ec::finalize::ec_finalize_response`] plus the
-/// pull-sync hook on the converted fastly response — the same EC response
+/// after-send identity flush on the converted fastly response — the same EC response
 /// lifecycle the legacy path drives through `RouteResult`.
 #[derive(Clone)]
 pub(crate) struct EcFinalizeState {
     pub(crate) ec_context: EcContext,
     /// Whether EC finalization may write to the KV identity graph.
-    /// `KvIdentityGraph` wraps a non-`Sync` `dyn EcKvStore` and cannot ride
-    /// in response extensions, so `edgezero_main` rebuilds the graph from
-    /// settings when this is set.
+    /// `edgezero_main` takes the graph from application state when this is
+    /// set.
     pub(crate) use_finalize_kv: bool,
     pub(crate) eids_cookie: Option<String>,
     pub(crate) sharedid_cookie: Option<String>,
     pub(crate) is_real_browser: bool,
-    /// Per-request services carried to the entry point so the pull-sync
-    /// dispatcher can reuse the same platform HTTP client.
+    /// Per-request services carried to the entry point so the after-send
+    /// providers reuse the same platform HTTP client.
     pub(crate) services: RuntimeServices,
 }
 
@@ -342,6 +469,11 @@ struct EcRequestState {
     ec_context: EcContext,
     kv_graph: Option<KvIdentityGraph>,
     finalize_kv_graph: Option<KvIdentityGraph>,
+    /// The graph integration proxy dispatch gets, for every client: a
+    /// proxied capture's removals and opt-outs are revocations and keep the
+    /// write path, as consent withdrawals do (spec 4.7). EC generation on
+    /// that route checks the real-browser flag itself.
+    proxy_kv_graph: Option<KvIdentityGraph>,
     eids_cookie: Option<String>,
     sharedid_cookie: Option<String>,
     is_real_browser: bool,
@@ -359,15 +491,53 @@ struct EcRequestState {
 
 impl EcRequestState {
     fn into_finalize_state(self) -> EcFinalizeState {
+        // A global revoke is a withdrawal from any client (spec 8).
+        let use_finalize_kv =
+            self.finalize_kv_graph.is_some() || self.ec_context.global_revoke_requested();
         EcFinalizeState {
             ec_context: self.ec_context,
-            use_finalize_kv: self.finalize_kv_graph.is_some(),
+            use_finalize_kv,
             eids_cookie: self.eids_cookie,
             sharedid_cookie: self.sharedid_cookie,
             is_real_browser: self.is_real_browser,
             services: self.services,
         }
     }
+
+    /// Derives the carried [`GeoLookupState`] from this request's geo lookup
+    /// outcome, so response-phase finalize can reuse it instead of repeating
+    /// the lookup. `build_ec_request_state` always attempts the lookup, so
+    /// `None` here means the lookup ran and failed, not that it was skipped.
+    fn geo_lookup_state(&self) -> GeoLookupState {
+        match &self.geo_info {
+            Some(info) => GeoLookupState::Resolved(info.clone()),
+            None => GeoLookupState::Attempted,
+        }
+    }
+}
+
+/// Collects the request's browser ingest for a new EC's one create.
+///
+/// An unreadable partner registry yields an empty seed: the create still
+/// happens, without the ingest.
+fn browser_seed_for(state: &AppState, ec: &EcRequestState) -> BrowserSeed {
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |elapsed| elapsed.as_secs());
+    match PartnerRegistry::from_config(&state.settings.ec.partners) {
+        Ok(registry) => browser_seed(
+            &state.settings,
+            &registry,
+            ec.ec_context.consent(),
+            ec.eids_cookie.as_deref(),
+            ec.sharedid_cookie.as_deref(),
+            now,
+        ),
+        Err(err) => {
+            log::warn!("Browser ingest skipped: partner registry is unavailable: {err:?}");
+            BrowserSeed::empty()
+        }
+    }
 }
 
 /// Derives device signals from the request's `User-Agent` header.
@@ -405,10 +575,11 @@ fn device_signals_for(req: &Request) -> DeviceSignals {
 /// Builds the per-request EC state, mirroring the pre-routing prelude of the
 /// legacy `route_request` step by step.
 fn build_ec_request_state(
-    settings: &Settings,
+    state: &AppState,
     services: &RuntimeServices,
     req: &Request,
 ) -> EcRequestState {
+    let settings = &*state.settings;
     let device_signals = device_signals_for(req);
     let is_real_browser = device_signals.looks_like_browser();
     if !is_real_browser {
@@ -423,18 +594,26 @@ fn build_ec_request_state(
     let eids_cookie = crate::extract_cookie_value(req, COOKIE_TS_EIDS);
     let sharedid_cookie = crate::extract_cookie_value(req, COOKIE_SHAREDID);
 
-    let geo_info = services
-        .geo()
-        .lookup(services.client_info().client_ip)
-        .unwrap_or_else(|e| {
-            log::warn!("geo lookup failed during EC setup: {e}");
-            None
-        });
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
+    let geo_info = {
+        let _span = timings.span(Phase::Geo);
+        services
+            .geo()
+            .lookup(services.client_info().client_ip)
+            .unwrap_or_else(|e| {
+                log::warn!("geo lookup failed during EC setup: {e}");
+                None
+            })
+    };
 
     let (ec_context, setup_error) =
         match EcContext::read_from_request_with_geo(settings, req, services, geo_info.as_ref()) {
             Ok(mut context) => {
                 context.set_device_signals(device_signals);
+                context.set_real_browser(is_real_browser);
+                context.set_identity_runtime(Arc::clone(&state.identity));
+                context
+                    .set_identity_rate_limiter(Arc::new(FastlyRateLimiter::new(RATE_COUNTER_NAME)));
                 // Orphan-recovery eligibility is intentionally left false here.
                 // Authorizing it during generic pre-routing would let named
                 // routes and request-filter short circuits (e.g. a DataDome
@@ -450,7 +629,15 @@ fn build_ec_request_state(
     // Bot gate: suppress KV-backed EC writes for unrecognized clients, except
     // consent withdrawals. Revocations keep the write path so tombstones stay
     // authoritative even for privacy-extension-heavy clients.
-    let kv_graph = crate::maybe_identity_graph(settings);
+    let kv_graph = state
+        .identity_graph
+        .clone()
+        .map(|graph| graph.with_request_timings(&timings));
+    let proxy_kv_graph = if setup_error.is_none() {
+        kv_graph.clone()
+    } else {
+        None
+    };
     let finalize_kv_graph = if setup_error.is_none()
         && (is_real_browser || ec_consent_withdrawn(ec_context.consent()))
     {
@@ -464,6 +651,7 @@ fn build_ec_request_state(
         ec_context,
         kv_graph,
         finalize_kv_graph,
+        proxy_kv_graph,
         eids_cookie,
         sharedid_cookie,
         is_real_browser,
@@ -502,6 +690,14 @@ async fn run_pre_route_filters(
     req: &mut Request,
     geo_info: Option<&GeoInfo>,
 ) -> PreRoute {
+    // Only recorded when a filter is actually registered, so unconfigured
+    // deployments omit ts-filter from the Server-Timing header entirely.
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
+    let _span = state
+        .registry
+        .has_request_filters()
+        .then(|| timings.span(Phase::Filter));
+
     match state
         .registry
         .filter_request(RequestFilterRegistryInput {
@@ -535,6 +731,7 @@ fn attach_dispatch_extensions(
     ec: EcRequestState,
     effects: RequestFilterEffects,
 ) -> Response {
+    response.extensions_mut().insert(ec.geo_lookup_state());
     response.extensions_mut().insert(ec.into_finalize_state());
     if !effects.response_headers.is_empty() {
         response.extensions_mut().insert(effects);
@@ -575,6 +772,17 @@ async fn execute_named(
     // These diagnostics are read-only. Running the normal EC lifecycle would
     // attach finalization state and could ingest request cookies into KV after
     // the handler returns, violating that contract.
+    // The opt-out clear writes one KV row through the removal write, never the
+    // request's cookies, so it skips the EC lifecycle for the same reason.
+    if matches!(handler, NamedRouteHandler::AdminOptOutClear) {
+        let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
+        let graph = state
+            .identity_graph
+            .clone()
+            .map(|graph| graph.with_request_timings(&timings));
+        return Ok(handle_admin_opt_out_clear(graph.as_ref(), &req));
+    }
+
     if matches!(
         handler,
         NamedRouteHandler::AdminEcLookup | NamedRouteHandler::AdminEidsLookup
@@ -585,8 +793,18 @@ async fn execute_named(
                     // Deliberately do not use an EC request-state graph: that
                     // copy is bot-gated, while operators use curl for this
                     // authenticated diagnostic.
-                    let kv = crate::maybe_identity_graph(&state.settings);
-                    handle_admin_ec_lookup(kv.as_ref(), &registry, &req)
+                    let timings =
+                        RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
+                    let kv = state
+                        .identity_graph
+                        .clone()
+                        .map(|graph| graph.with_request_timings(&timings));
+                    handle_admin_ec_lookup(
+                        kv.as_ref(),
+                        &registry,
+                        Some(state.identity.as_ref()),
+                        &req,
+                    )
                 }
                 NamedRouteHandler::AdminEidsLookup => handle_admin_eids_lookup(&registry, &req),
                 _ => unreachable!("admin diagnostics should use early dispatch"),
@@ -602,7 +820,7 @@ async fn execute_named(
         return Ok(http_error(&report));
     }
 
-    let mut ec = build_ec_request_state(&state.settings, &services, &req);
+    let mut ec = build_ec_request_state(&state, &services, &req);
     // EcContext creation errors short-circuit before filters, mirroring legacy:
     // the legacy path returns its error response before running filter_request.
     if let Some(report) = ec.setup_error.take() {
@@ -650,6 +868,9 @@ async fn run_named_route(
         NamedRouteHandler::AdminCachePurge => {
             unreachable!("cache purge should be handled before EC setup")
         }
+        NamedRouteHandler::AdminOptOutClear => {
+            unreachable!("opt-out clear should be handled before EC setup")
+        }
         NamedRouteHandler::LegacyAdminDenied => Ok(legacy_admin_alias_denied()),
         NamedRouteHandler::BatchSync => {
             // Dispatched by execute_named before EC state is built.
@@ -659,7 +880,11 @@ async fn run_named_route(
             if req.method() == Method::OPTIONS {
                 cors_preflight_identify(&state.settings, &req)
             } else {
-                let kv = crate::require_identity_graph(&state.settings)?;
+                let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
+                let kv = match state.identity_graph.clone() {
+                    Some(graph) => graph.with_request_timings(&timings),
+                    None => crate::require_identity_graph_with_timing(&state.settings, &timings)?,
+                };
                 let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
                 handle_identify(
                     &state.settings,
@@ -739,16 +964,17 @@ async fn run_named_route(
 /// graph + partner registry + rate limiter, with a default EC context for
 /// response finalization.
 fn run_batch_sync(state: &AppState, services: &RuntimeServices, req: Request) -> Response {
-    let device_signals = device_signals_for(&req);
-    let is_real_browser = device_signals.looks_like_browser();
+    let is_real_browser = device_signals_for(&req).looks_like_browser();
     let eids_cookie = crate::extract_cookie_value(&req, COOKIE_TS_EIDS);
     let sharedid_cookie = crate::extract_cookie_value(&req, COOKIE_SHAREDID);
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
 
-    let result = crate::require_identity_graph(&state.settings).and_then(|kv| {
-        let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
-        let limiter = FastlyRateLimiter::new(RATE_COUNTER_NAME);
-        handle_batch_sync(&kv, &partner_registry, &limiter, req)
-    });
+    let result =
+        crate::require_identity_graph_with_timing(&state.settings, &timings).and_then(|kv| {
+            let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
+            let limiter = FastlyRateLimiter::new(RATE_COUNTER_NAME);
+            handle_batch_sync(&kv, &partner_registry, &limiter, &state.identity, req)
+        });
 
     let mut response = result.unwrap_or_else(|e| http_error(&e));
     // Legacy parity: batch-sync responses still pass through
@@ -792,7 +1018,7 @@ async fn dispatch_fallback(
         return http_error(&report);
     }
 
-    let mut ec = build_ec_request_state(&state.settings, services, &req);
+    let mut ec = build_ec_request_state(state, services, &req);
     if let Some(report) = ec.setup_error.take() {
         let response = http_error(&report);
         return attach_dispatch_extensions(response, ec, RequestFilterEffects::default());
@@ -808,21 +1034,45 @@ async fn dispatch_fallback(
         PreRoute::Continue { effects } => effects,
     };
 
+    // Assigned exactly once, per branch below, alongside the routing
+    // decision itself, so the access-telemetry route identity always
+    // reflects which branch actually dispatched the request — including
+    // when that branch's handler errors. The asset-route sub-branch is an
+    // early return handled separately by `dispatch_asset_fallback`, so it
+    // never reaches (or needs to assign) this binding.
+    let route_metadata: Option<RouteMetadata>;
+
     let result = if uses_dynamic_tsjs_fallback(&method, &path) {
+        route_metadata = Some(RouteMetadata {
+            route_class: RouteClass::Tsjs,
+            route_template: TSJS_ROUTE_TEMPLATE.to_owned(),
+        });
         handle_tsjs_dynamic(&req, &state.registry, EdgeCacheHeader::SurrogateControl)
-    } else if state.registry.has_route(&method, &path) {
+    } else if let Some(pattern) = state.registry.matched_route_pattern(&method, &path) {
         // Integration-proxy responses are not bounded by
         // publisher.max_buffered_body_bytes. Publisher fallback below uses the
         // publisher-specific streaming finalizer instead.
+        // The matched route pattern is an integration-defined literal
+        // (bounded and content-free by construction), so telemetry keeps it
+        // verbatim instead of running the request path through the lossy
+        // publisher classifier.
+        route_metadata = Some(RouteMetadata {
+            route_class: RouteClass::IntegrationProxy,
+            route_template: pattern.to_owned(),
+        });
+        ec.ec_context.decide_writer(&req, true, ec.is_real_browser);
+        let seed = browser_seed_for(state, &ec);
         state
             .registry
             .handle_proxy(ProxyDispatchInput {
                 method: &method,
                 path: &path,
                 settings: &state.settings,
-                kv: ec.kv_graph.as_ref(),
+                kv: ec.proxy_kv_graph.as_ref(),
                 ec_context: &mut ec.ec_context,
                 services,
+                is_real_browser: ec.is_real_browser,
+                seed: &seed,
                 req,
             })
             .await
@@ -841,22 +1091,55 @@ async fn dispatch_fallback(
             .then(|| state.settings.asset_route_for_path(&path))
             .flatten();
         if let Some(asset_route) = matched_asset_route {
-            return dispatch_asset_fallback(state, services, req, asset_route, &effects).await;
+            // The template is the operator-configured route prefix, so it
+            // is bounded and content-free by construction (unlike request
+            // paths, which need `publisher_route_template`).
+            let asset_metadata = RouteMetadata {
+                route_class: RouteClass::Asset,
+                route_template: format!("{}/*", asset_route.prefix.trim_end_matches('/')),
+            };
+            let mut response = dispatch_asset_fallback(
+                state,
+                services,
+                req,
+                asset_route,
+                &effects,
+                ec.geo_lookup_state(),
+            )
+            .await;
+            response.extensions_mut().insert(asset_metadata);
+            return response;
         }
 
+        route_metadata = Some(RouteMetadata {
+            route_class: RouteClass::PublisherHtml,
+            route_template: publisher_route_template(
+                &path,
+                &state.settings.observability.route_sections,
+            ),
+        });
+
         // Generate an EC ID if needed — mirrors the legacy catch-all arm.
         // Only for document navigations by recognised browsers; subresource
         // requests may lack consent signals such as Sec-GPC.
         let is_navigation = is_navigation_request(&req);
+        ec.ec_context.decide_writer(&req, true, ec.is_real_browser);
         if is_navigation {
             ec.ec_context.set_eid_sync_source(EidSyncSource::Navigation);
         }
         let is_publisher_navigation = ec.is_real_browser && is_navigation;
-        if is_publisher_navigation
-            && let Err(err) = ec
-                .ec_context
-                .generate_if_needed(&state.settings, ec.kv_graph.as_ref())
-        {
+        let seed = browser_seed_for(state, &ec);
+        // With a hold-mode provider that can run before the row exists, the
+        // create waits for it inside the publisher handler (spec 4.7).
+        let minted = if !is_publisher_navigation {
+            Ok(())
+        } else if state.identity.holds_on_first_navigation() {
+            ec.ec_context.mint_deferred(&state.settings, &seed)
+        } else {
+            ec.ec_context
+                .generate_if_needed(&state.settings, ec.kv_graph.as_ref(), &seed)
+        };
+        if let Err(err) = minted {
             log::warn!("EC generation failed for publisher proxy: {err:?}");
         }
 
@@ -910,7 +1193,10 @@ async fn dispatch_fallback(
         }
     };
 
-    let response = result.unwrap_or_else(|e| http_error(&e));
+    let mut response = result.unwrap_or_else(|e| http_error(&e));
+    if let Some(metadata) = route_metadata {
+        response.extensions_mut().insert(metadata);
+    }
     attach_dispatch_extensions(response, ec, effects)
 }
 
@@ -934,7 +1220,10 @@ fn asset_response_carries_body(method: &Method, status: StatusCode) -> bool {
 /// [`AssetProxyCachePolicy`] out via response extensions so `edgezero_main`
 /// can reapply protected cache directives after finalization. EC finalization
 /// is intentionally skipped: no [`EcFinalizeState`] is attached, matching the
-/// legacy `should_finalize_ec = false` behavior for asset responses.
+/// legacy `should_finalize_ec = false` behavior for asset responses. The
+/// caller's [`GeoLookupState`] is still attached, since `build_ec_request_state`
+/// already attempted the lookup before the asset route was matched — this is
+/// the one exit path that carries geo state without an `EcFinalizeState`.
 ///
 /// Like legacy `route_request`, asset bodies are streamed straight to the client
 /// with no cap: the origin stream is attached to the response and `edgezero_main`
@@ -949,6 +1238,7 @@ async fn dispatch_asset_fallback(
     req: Request,
     asset_route: &ProxyAssetRoute,
     effects: &RequestFilterEffects,
+    geo_state: GeoLookupState,
 ) -> Response {
     log::info!("No explicit route matched; proxying via configured asset route");
 
@@ -970,6 +1260,7 @@ async fn dispatch_asset_fallback(
             }
 
             response.extensions_mut().insert(cache_policy);
+            response.extensions_mut().insert(geo_state);
             attach_request_filter_effects(&mut response, effects);
             response
         }
@@ -978,6 +1269,7 @@ async fn dispatch_asset_fallback(
             response
                 .extensions_mut()
                 .insert(AssetProxyCachePolicy::NoStorePrivate);
+            response.extensions_mut().insert(geo_state);
             attach_request_filter_effects(&mut response, effects);
             response
         }
@@ -1081,6 +1373,7 @@ enum NamedRouteHandler {
     DeactivateKey,
     AdminEcLookup,
     AdminEidsLookup,
+    AdminOptOutClear,
     AdminCachePurge,
     /// Legacy `/admin/keys/*` aliases — denied locally with 404 so they never
     /// reach the publisher fallback (which would leak admin credentials).
@@ -1101,6 +1394,10 @@ struct NamedRoute {
     path: &'static str,
     primary_methods: &'static [Method],
     handler: NamedRouteHandler,
+    /// Access-telemetry traffic category for this row. Attached verbatim
+    /// alongside `path` (the route-table pattern) to every response this
+    /// route produces — see [`named_route_handler`].
+    route_class: RouteClass,
 }
 
 /// Every method an admin route must claim to keep non-primary methods from falling
@@ -1123,21 +1420,25 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: "/.well-known/trusted-server.json",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::TrustedServerDiscovery,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/verify-signature",
         primary_methods: &[Method::POST],
         handler: NamedRouteHandler::VerifySignature,
+        route_class: RouteClass::Ec,
     },
     NamedRoute {
         path: "/_ts/admin/keys/rotate",
         primary_methods: &[Method::POST],
         handler: NamedRouteHandler::RotateKey,
+        route_class: RouteClass::Ec,
     },
     NamedRoute {
         path: "/_ts/admin/keys/deactivate",
         primary_methods: &[Method::POST],
         handler: NamedRouteHandler::DeactivateKey,
+        route_class: RouteClass::Ec,
     },
     // Every method is claimed, not just POST. A method this route did not claim would
     // fall through to the publisher, and `enforce_basic_auth` leaves the `Authorization`
@@ -1147,6 +1448,7 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: "/_ts/admin/cache/purge",
         primary_methods: LEGACY_ADMIN_DENY_METHODS,
         handler: NamedRouteHandler::AdminCachePurge,
+        route_class: RouteClass::Other,
     },
     // Admin EC lookup: the bare route reads the EC ID from the caller's
     // `ts-ec` cookie; the parameterized route takes an explicit EC ID.
@@ -1154,11 +1456,22 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: "/_ts/admin/ec",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::AdminEcLookup,
+        route_class: RouteClass::Ec,
     },
     NamedRoute {
         path: "/_ts/admin/ec/{id}",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::AdminEcLookup,
+        route_class: RouteClass::Ec,
+    },
+    // Operator clear of a provider's sticky opt-out (`ps.o`). Only DELETE is
+    // claimed: any other method reaches the publisher fallback, which denies
+    // the reserved admin namespace locally.
+    NamedRoute {
+        path: "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
+        primary_methods: &[Method::DELETE],
+        handler: NamedRouteHandler::AdminOptOutClear,
+        route_class: RouteClass::Ec,
     },
     // Admin EIDs echo: decodes the request's ts-eids/sharedId cookies with
     // an ingestion preview. Pure request inspection — no KV access.
@@ -1166,6 +1479,7 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: "/_ts/admin/eids",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::AdminEidsLookup,
+        route_class: RouteClass::Ec,
     },
     // The legacy non-`/_ts` aliases (`/admin/keys/*`) are denied locally with a
     // 404 instead of executing key operations: the production basic-auth handler
@@ -1177,36 +1491,43 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: "/admin/keys/rotate",
         primary_methods: LEGACY_ADMIN_DENY_METHODS,
         handler: NamedRouteHandler::LegacyAdminDenied,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/admin/keys/deactivate",
         primary_methods: LEGACY_ADMIN_DENY_METHODS,
         handler: NamedRouteHandler::LegacyAdminDenied,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/_ts/api/v1/batch-sync",
         primary_methods: &[Method::POST],
         handler: NamedRouteHandler::BatchSync,
+        route_class: RouteClass::Ec,
     },
     NamedRoute {
         path: "/_ts/api/v1/identify",
         primary_methods: &[Method::GET, Method::OPTIONS],
         handler: NamedRouteHandler::Identify,
+        route_class: RouteClass::Ec,
     },
     NamedRoute {
         path: "/_ts/set-tester",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::SetTester,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/_ts/clear-tester",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::ClearTester,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/auction",
         primary_methods: &[Method::POST],
         handler: NamedRouteHandler::Auction,
+        route_class: RouteClass::AuctionApi,
     },
     // GET runs the SPA re-auction; OPTIONS is denied in-handler as a CORS
     // preflight guard for this side-effecting endpoint.
@@ -1214,6 +1535,7 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: PAGE_BIDS_PATH,
         primary_methods: &[Method::GET, Method::OPTIONS],
         handler: NamedRouteHandler::PageBids,
+        route_class: RouteClass::AuctionApi,
     },
     // Deprecated double-underscore alias. tsjs bundles served before the
     // `/_ts/page-bids` rename keep requesting this path from already-loaded
@@ -1224,21 +1546,29 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         path: PAGE_BIDS_LEGACY_PATH,
         primary_methods: &[Method::GET, Method::OPTIONS],
         handler: NamedRouteHandler::PageBids,
+        route_class: RouteClass::AuctionApi,
     },
+    // Classified `Other` rather than `IntegrationProxy`: that class is
+    // reserved for `state.registry.handle_proxy` (the js-integration proxy
+    // dispatch in `dispatch_fallback`), which these first-party proxy routes
+    // do not go through.
     NamedRoute {
         path: "/first-party/proxy",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::FirstPartyProxy,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/first-party/click",
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::FirstPartyClick,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/first-party/sign",
         primary_methods: &[Method::GET, Method::POST],
         handler: NamedRouteHandler::FirstPartySign,
+        route_class: RouteClass::Other,
     },
     NamedRoute {
         path: "/first-party/proxy-rebuild",
@@ -1247,16 +1577,35 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         // POST is blocked by CORS and the guard navigates here for a 302 instead.
         primary_methods: &[Method::GET, Method::POST],
         handler: NamedRouteHandler::FirstPartyProxyRebuild,
+        route_class: RouteClass::Other,
     },
 ];
 
+/// Wraps [`execute_named`], attaching a [`RouteMetadata`] extension carrying
+/// `route_class` and the route-table pattern (`route_template`, verbatim,
+/// with parameters left as placeholders) to every response the handler
+/// produces — including its early-return diagnostic and setup-error arms,
+/// since the attachment happens once around the whole future rather than in
+/// each branch.
 fn named_route_handler(
     state: Arc<AppState>,
     handler: NamedRouteHandler,
+    route_class: RouteClass,
+    route_template: &'static str,
 ) -> impl Fn(RequestContext) -> HandlerFuture + Clone + Send + Sync + 'static {
     move |ctx: RequestContext| {
         let state = Arc::clone(&state);
-        Box::pin(execute_named(state, ctx, handler))
+        Box::pin(async move {
+            execute_named(state, ctx, handler)
+                .await
+                .map(|mut response| {
+                    response.extensions_mut().insert(RouteMetadata {
+                        route_class,
+                        route_template: route_template.to_owned(),
+                    });
+                    response
+                })
+        })
     }
 }
 
@@ -1298,7 +1647,7 @@ impl TrustedServerApp {
         (Self::routes_for_state(&state), Some(state))
     }
 
-    fn routes_for_state(state: &Arc<AppState>) -> RouterService {
+    pub(crate) fn routes_for_state(state: &Arc<AppState>) -> RouterService {
         let mut router = RouterService::builder()
             .pre_dispatch_hook_arc(Arc::new(TracePreDispatchHook::new(
                 Arc::clone(&state.settings),
@@ -1321,7 +1670,12 @@ impl TrustedServerApp {
                 router = router.route(
                     route.path,
                     method.clone(),
-                    named_route_handler(Arc::clone(state), route.handler),
+                    named_route_handler(
+                        Arc::clone(state),
+                        route.handler,
+                        route.route_class,
+                        route.path,
+                    ),
                 );
             }
 
@@ -1400,8 +1754,9 @@ mod tests {
 
     use super::{
         AppState, AuctionDispatch, EcContext, EdgeCacheHeader, EidSyncSource, HandlerFuture,
-        NAMED_ROUTES, NamedRouteHandler, PAGE_BIDS_LEGACY_PATH, PAGE_BIDS_PATH, RuntimeStoreConfig,
-        TrustedServerApp, build_orchestrator_with_plan, build_per_request_services,
+        NAMED_ROUTES, NamedRouteHandler, PAGE_BIDS_LEGACY_PATH, PAGE_BIDS_PATH, RouteClass,
+        RouteMetadata, RuntimeStoreConfig, TSJS_ROUTE_TEMPLATE, TrustedServerApp,
+        build_identity_runtime, build_orchestrator_with_plan, build_per_request_services,
         build_state_from_settings, compile_auction_plan, handle_publisher_request,
         publisher_response_into_streaming_response, startup_error_router,
     };
@@ -1412,29 +1767,34 @@ mod tests {
     use edgezero_core::context::RequestContext;
     use edgezero_core::http::{
         HeaderValue, Method, Request, Response, StatusCode, header, request_builder,
+        response_builder,
     };
     use edgezero_core::key_value_store::NoopKvStore;
     use edgezero_core::params::PathParams;
     use edgezero_core::router::RouterService;
     use std::net::{IpAddr, Ipv4Addr};
+    use trusted_server_core::ec::identity::test_support::ec_partner;
 
     use error_stack::Report;
     use futures::StreamExt as _;
     use futures::executor::block_on;
-    use trusted_server_core::constants::HEADER_X_GEO_INFO_AVAILABLE;
+    use trusted_server_core::constants::{HEADER_X_GEO_COUNTRY, HEADER_X_GEO_INFO_AVAILABLE};
     use trusted_server_core::ec::device::DeviceSignals;
     use trusted_server_core::error::TrustedServerError;
+    use trusted_server_core::geo::GeoLookupState;
     use trusted_server_core::integrations::{
         HeaderMutation, IntegrationRegistry, IntegrationRequestFilter, RequestFilterDecision,
         RequestFilterEffects, RequestFilterInput,
     };
     use trusted_server_core::platform::{
-        ClientInfo, PlatformBackend, PlatformBackendSpec, PlatformError, PlatformHttpClient,
-        PlatformHttpRequest, PlatformKvStore, PlatformPendingRequest, PlatformResponse,
-        PlatformSelectResult, PlatformTemplateCache, PlatformTemplateCacheReservation,
-        RuntimeServices, TemplateCacheError, TemplateCacheKey, TemplateCacheLookup,
-        TemplateCacheMiss, TemplateCacheReservation, TemplateEntry, TemplateMetadata,
+        ClientInfo, GeoInfo, PlatformBackend, PlatformBackendSpec, PlatformError, PlatformGeo,
+        PlatformHttpClient, PlatformHttpRequest, PlatformKvStore, PlatformPendingRequest,
+        PlatformResponse, PlatformSelectResult, PlatformTemplateCache,
+        PlatformTemplateCacheReservation, RuntimeServices, TemplateCacheError, TemplateCacheKey,
+        TemplateCacheLookup, TemplateCacheMiss, TemplateCacheReservation, TemplateEntry,
+        TemplateMetadata,
     };
+    use trusted_server_core::request_timing::RequestTimings;
     use trusted_server_core::settings::Settings;
     use trusted_server_core::test_support::nextjs_auction;
 
@@ -1509,6 +1869,28 @@ mod tests {
         block_on(router.oneshot(request)).expect("should route request")
     }
 
+    #[test]
+    fn reloaded_identity_runtime_keeps_pull_providers_when_the_registry_fails() {
+        let mut settings = test_settings();
+        settings.ec.partners = vec![ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        )];
+        let failed = Err(Report::new(TrustedServerError::Configuration {
+            message: "registry failed".to_owned(),
+        }));
+
+        let runtime = super::identity_runtime_from_registry_result(&settings, failed)
+            .expect("should still build the pull runtime");
+
+        assert_eq!(
+            format!("{runtime:?}"),
+            "IdentityRuntime { providers: 1, .. }",
+            "should hold the generic pull provider"
+        );
+    }
+
     fn test_settings() -> Settings {
         Settings::from_toml(
             r#"
@@ -1590,13 +1972,15 @@ mod tests {
         );
     }
 
-    /// Builds a router whose `AppState` uses a registry containing the given
-    /// request filters (and no routes), so dispatch-level request-filter
-    /// behavior can be exercised without a real integration.
-    fn router_with_request_filters(
+    /// Builds an `AppState` whose registry contains the given request
+    /// filters (and no routes), so dispatch-level request-filter behavior can
+    /// be exercised without a real integration.
+    fn state_with_request_filters(
         filters: Vec<Arc<dyn IntegrationRequestFilter>>,
-    ) -> RouterService {
+    ) -> Arc<AppState> {
         let settings = test_settings();
+        let identity = build_identity_runtime(&settings, &IntegrationRegistry::default())
+            .expect("should build the identity runtime");
         let plan = Arc::new(
             trusted_server_core::auction::compile_auction_plan(&settings)
                 .expect("should compile auction plan"),
@@ -1607,7 +1991,7 @@ mod tests {
         let registry = IntegrationRegistry::from_request_filters(filters);
         let default_kv_store =
             Arc::new(crate::platform::UnavailableKvStore) as Arc<dyn super::PlatformKvStore>;
-        let state = Arc::new(super::AppState {
+        Arc::new(super::AppState {
             auction_telemetry_sink: Arc::new(
                 trusted_server_core::auction::NoopAuctionTelemetrySink,
             ),
@@ -1615,8 +1999,19 @@ mod tests {
             orchestrator: Arc::new(orchestrator),
             registry: Arc::new(registry),
             default_kv_store,
-        });
-        TrustedServerApp::routes_for_state(&state)
+            identity,
+            identity_graph: None,
+            http_client_for_test: None,
+            geo_for_test: None,
+        })
+    }
+
+    /// Builds a router on top of [`state_with_request_filters`] so
+    /// dispatch-level request-filter behavior can be exercised end-to-end.
+    fn router_with_request_filters(
+        filters: Vec<Arc<dyn IntegrationRequestFilter>>,
+    ) -> RouterService {
+        TrustedServerApp::routes_for_state(&state_with_request_filters(filters))
     }
 
     /// Continues routing while mutating the request and emitting a response
@@ -2100,6 +2495,35 @@ mod tests {
         );
     }
 
+    #[test]
+    fn admin_opt_out_clear_route_is_registered() {
+        // The operator clear is a DELETE on its own route. The route must call
+        // the core handler, and `/_ts/admin/ec/{id}` must stay GET-only so the
+        // clear is reachable only through the dedicated path.
+        let route = NAMED_ROUTES
+            .iter()
+            .find(|route| route.path == "/_ts/admin/ec/{id}/providers/{provider}/opt-out")
+            .expect("should register the provider opt-out clear route");
+        assert!(
+            matches!(route.handler, NamedRouteHandler::AdminOptOutClear),
+            "the route must map to the opt-out clear handler"
+        );
+        assert_eq!(
+            route.primary_methods,
+            &[Method::DELETE],
+            "the route must have DELETE as its only primary method"
+        );
+        let lookup = NAMED_ROUTES
+            .iter()
+            .find(|route| route.path == "/_ts/admin/ec/{id}")
+            .expect("should register the lookup route");
+        assert_eq!(
+            lookup.primary_methods,
+            &[Method::GET],
+            "control: the lookup route must stay GET-only"
+        );
+    }
+
     #[test]
     fn page_bids_serves_canonical_path_and_deprecated_alias() {
         // The SPA re-auction endpoint lives at the canonical single-underscore
@@ -2489,6 +2913,114 @@ mod tests {
         );
     }
 
+    /// `Authorization: Basic` header value for `test_settings()`'s
+    /// `^/_ts/admin` handler (`admin` / `admin-pass`).
+    fn admin_basic_auth_header() -> edgezero_core::http::HeaderValue {
+        let credentials = base64::engine::general_purpose::STANDARD.encode("admin:admin-pass");
+        format!("Basic {credentials}")
+            .parse()
+            .expect("should parse basic-auth header value")
+    }
+
+    #[test]
+    fn named_route_attaches_the_table_pattern_verbatim_even_with_a_real_id_in_the_path() {
+        // A named-route response must carry the route-TABLE pattern
+        // (`{id}` left as a placeholder), never the caller's actual matched
+        // path segment — this is what keeps a real EC identifier out of
+        // access telemetry, independent of anything the row-serialization
+        // layer does.
+        let router = test_router();
+        let ec_id = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01";
+        let mut req = empty_request(Method::GET, &format!("/_ts/admin/ec/{ec_id}"));
+        req.headers_mut()
+            .insert(header::AUTHORIZATION, admin_basic_auth_header());
+        let response = route(&router, req);
+
+        let metadata = response
+            .extensions()
+            .get::<RouteMetadata>()
+            .expect("named-route responses should carry RouteMetadata");
+        assert_eq!(metadata.route_class, RouteClass::Ec);
+        assert_eq!(metadata.route_template, "/_ts/admin/ec/{id}");
+        assert!(
+            !metadata.route_template.contains(ec_id),
+            "the attached template must never contain the matched id"
+        );
+    }
+
+    #[test]
+    fn named_route_attaches_metadata_even_on_a_read_only_diagnostic_early_return() {
+        // AdminEidsLookup is handled by an early-return arm inside
+        // execute_named, before the normal EC lifecycle runs (see the
+        // "read-only diagnostics" comment there). named_route_handler wraps
+        // the whole future, so the attachment must still happen here too.
+        let router = test_router();
+        let mut req = empty_request(Method::GET, "/_ts/admin/eids");
+        req.headers_mut()
+            .insert(header::AUTHORIZATION, admin_basic_auth_header());
+        let response = route(&router, req);
+
+        let metadata = response
+            .extensions()
+            .get::<RouteMetadata>()
+            .expect("even a read-only diagnostic early-return response should carry RouteMetadata");
+        assert_eq!(metadata.route_class, RouteClass::Ec);
+        assert_eq!(metadata.route_template, "/_ts/admin/eids");
+    }
+
+    #[test]
+    fn tsjs_fallback_attaches_tsjs_route_metadata() {
+        let router = test_router();
+        let response = route(
+            &router,
+            empty_request(Method::GET, "/static/tsjs=tsjs-unified.min.js"),
+        );
+
+        let metadata = response
+            .extensions()
+            .get::<RouteMetadata>()
+            .expect("tsjs fallback responses should carry RouteMetadata");
+        assert_eq!(metadata.route_class, RouteClass::Tsjs);
+        assert_eq!(metadata.route_template, TSJS_ROUTE_TEMPLATE);
+    }
+
+    #[test]
+    fn integration_proxy_fallback_attaches_integration_proxy_route_metadata() {
+        // test_settings() enables the prebid integration, which registers a
+        // proxy route at /integrations/prebid/bundle.js.
+        let router = test_router();
+        let response = route(
+            &router,
+            empty_request(Method::GET, "/integrations/prebid/bundle.js"),
+        );
+
+        let metadata = response
+            .extensions()
+            .get::<RouteMetadata>()
+            .expect("integration-proxy fallback responses should carry RouteMetadata");
+        assert_eq!(metadata.route_class, RouteClass::IntegrationProxy);
+        assert_eq!(
+            metadata.route_template, "/integrations/prebid/bundle.js",
+            "should carry the registered route pattern verbatim, not a classifier output"
+        );
+    }
+
+    #[test]
+    fn publisher_fallback_attaches_publisher_html_route_metadata() {
+        let router = test_router();
+        let response = route(&router, empty_request(Method::GET, "/news/some-article"));
+
+        let metadata = response
+            .extensions()
+            .get::<RouteMetadata>()
+            .expect("publisher fallback responses should carry RouteMetadata");
+        assert_eq!(metadata.route_class, RouteClass::PublisherHtml);
+        assert_eq!(
+            metadata.route_template, "/other/*",
+            "the default empty section allowlist should collapse publisher paths"
+        );
+    }
+
     fn browser_request(method: Method, path: &str, fetch_destination: &str) -> Request {
         let mut request = empty_request(method, path);
         request.headers_mut().insert(
@@ -2514,6 +3046,38 @@ mod tests {
             .eid_sync_source()
     }
 
+    #[test]
+    fn auction_route_carries_the_raw_ts_eids_cookie_to_finalization() {
+        let router = test_router();
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::json!([{ "source": "ids.example.com", "uids": [{ "id": "example-uid" }] }])
+                .to_string(),
+        );
+        let mut request = browser_request(Method::POST, "/auction", "empty");
+        request.headers_mut().insert(
+            header::COOKIE,
+            HeaderValue::from_str(&format!("ts-eids={eids_cookie}"))
+                .expect("should build cookie header"),
+        );
+
+        let response = route(&router, request);
+
+        let state = response
+            .extensions()
+            .get::<super::EcFinalizeState>()
+            .expect("auction responses should carry EC finalization state");
+        assert_eq!(
+            state.eids_cookie.as_deref(),
+            Some(eids_cookie.as_str()),
+            "the adapter should hand finalization the raw ts-eids cookie"
+        );
+        assert_eq!(
+            state.ec_context.eid_sync_source(),
+            Some(EidSyncSource::Auction),
+            "finalization should know this was an /auction request"
+        );
+    }
+
     #[test]
     fn dispatch_limits_returning_user_eid_sync_to_eligible_routes() {
         let router = test_router();
@@ -2929,6 +3493,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn asset_fallback_carries_geo_state_without_ec_finalize_state() {
+        // The asset-route fallback is the one exit path that skips
+        // EcFinalizeState but must still carry GeoLookupState, since
+        // build_ec_request_state (and its geo lookup) already ran before the
+        // asset route was matched. Without this, the finalize step would
+        // silently repeat the lookup for every asset request.
+        let settings = Settings::from_toml(
+            r#"
+            [[handlers]]
+            path = "^/_ts/admin"
+            username = "admin"
+            password = "admin-pass"
+
+            [publisher]
+            domain = "test-publisher.com"
+            cookie_domain = ".test-publisher.com"
+            # Keep the host aligned with the shared settings fixture.
+            origin_url = "https://origin.test-publisher.com" # allow-domain: origin.test-publisher.com
+            proxy_secret = "unit-test-proxy-secret"
+
+            [ec]
+            passphrase = "test-secret-key-32-bytes-minimum"
+
+            [request_signing]
+            enabled = false
+            config_store_id = "test-config-store-id"
+            secret_store_id = "test-secret-store-id"
+
+            [proxy]
+
+            [[proxy.asset_routes]]
+            prefix = "/.image/"
+            origin_url = "https://assets.example.com"
+            "#,
+        )
+        .expect("should parse asset-route settings");
+        let state = build_state_from_settings(settings).expect("should build state");
+        let router = TrustedServerApp::routes_for_state(&state);
+
+        let response = route(&router, empty_request(Method::GET, "/.image/banner.png"));
+
+        assert!(
+            response.extensions().get::<GeoLookupState>().is_some(),
+            "asset-route responses should still carry GeoLookupState even though \
+             EC finalization is skipped"
+        );
+        assert!(
+            response
+                .extensions()
+                .get::<super::EcFinalizeState>()
+                .is_none(),
+            "asset-route responses must skip EC finalization (no EcFinalizeState)"
+        );
+    }
+
     struct FixedBackend;
 
     impl PlatformBackend for FixedBackend {
@@ -3352,6 +3972,7 @@ mod tests {
             req,
             asset_route,
             &effects,
+            trusted_server_core::geo::GeoLookupState::NotAttempted,
         ));
 
         assert_eq!(
@@ -3447,6 +4068,193 @@ mod tests {
         );
     }
 
+    /// A [`PlatformGeo`] stub that counts every `lookup` call and always
+    /// returns the same canned result, used to prove the request-phase geo
+    /// lookup is never repeated during finalize.
+    struct CountingGeo {
+        calls: Arc<AtomicUsize>,
+        result: Option<GeoInfo>,
+    }
+
+    impl PlatformGeo for CountingGeo {
+        fn lookup(&self, _: Option<IpAddr>) -> Result<Option<GeoInfo>, Report<PlatformError>> {
+            self.calls.fetch_add(1, Ordering::SeqCst);
+            Ok(self.result.clone())
+        }
+    }
+
+    fn sample_geo_info() -> GeoInfo {
+        GeoInfo {
+            city: "Testville".to_string(),
+            country: "US".to_string(),
+            continent: "NorthAmerica".to_string(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        }
+    }
+
+    fn runtime_services_with_geo(geo: Arc<dyn PlatformGeo>) -> RuntimeServices {
+        RuntimeServices::builder()
+            .config_store(Arc::new(crate::platform::FastlyPlatformConfigStore))
+            .secret_store(Arc::new(crate::platform::FastlyPlatformSecretStore))
+            .kv_store(Arc::new(NoopKvStore) as Arc<dyn PlatformKvStore>)
+            .backend(Arc::new(FixedBackend))
+            .http_client(Arc::new(StreamingHttpClient))
+            .geo(geo)
+            .client_info(ClientInfo::default())
+            .build()
+    }
+
+    #[test]
+    fn finalize_reuses_request_phase_geo_without_second_lookup() {
+        // Dispatching a publisher route runs build_ec_request_state, which
+        // attempts the geo lookup once and carries the result via
+        // GeoLookupState. The finalize step (resolve_geo_for_response) must
+        // reuse that carried value instead of calling the geo backend again.
+        let calls = Arc::new(AtomicUsize::new(0));
+        let geo = Arc::new(CountingGeo {
+            calls: Arc::clone(&calls),
+            result: Some(sample_geo_info()),
+        });
+        let state = app_state_for_settings(test_settings());
+        let services = runtime_services_with_geo(geo);
+        let req = empty_request(Method::GET, "/some-page");
+
+        let response = block_on(super::dispatch_fallback(&state, &services, req));
+
+        let carried = response
+            .extensions()
+            .get::<GeoLookupState>()
+            .cloned()
+            .expect("dispatch should attach GeoLookupState");
+        assert!(
+            matches!(carried, GeoLookupState::Resolved(_)),
+            "a successful lookup should carry Resolved"
+        );
+
+        let geo_info =
+            crate::middleware::resolve_geo_for_response(&response, &carried, None, |_| {
+                panic!("finalize must not repeat a resolved geo lookup");
+            });
+
+        assert_eq!(
+            calls.load(Ordering::SeqCst),
+            1,
+            "only the request-phase lookup should have run"
+        );
+
+        let mut response = response;
+        geo_info
+            .expect("geo info should have resolved")
+            .set_response_headers(&mut response);
+        assert!(
+            response.headers().get(HEADER_X_GEO_COUNTRY).is_some(),
+            "x-geo-country should still be set on the response after reusing the carried geo"
+        );
+    }
+
+    #[test]
+    fn failed_lookup_is_not_retried() {
+        // When the request-phase lookup fails (returns None), dispatch must
+        // carry GeoLookupState::Attempted rather than NotAttempted, and
+        // finalize must not retry it.
+        let calls = Arc::new(AtomicUsize::new(0));
+        let geo = Arc::new(CountingGeo {
+            calls: Arc::clone(&calls),
+            result: None,
+        });
+        let state = app_state_for_settings(test_settings());
+        let services = runtime_services_with_geo(geo);
+        let req = empty_request(Method::GET, "/some-page");
+
+        let response = block_on(super::dispatch_fallback(&state, &services, req));
+
+        let carried = response
+            .extensions()
+            .get::<GeoLookupState>()
+            .cloned()
+            .expect("dispatch should attach GeoLookupState even for a failed lookup");
+        assert!(
+            matches!(carried, GeoLookupState::Attempted),
+            "a failed lookup should carry Attempted, not Resolved or NotAttempted"
+        );
+
+        let geo_info =
+            crate::middleware::resolve_geo_for_response(&response, &carried, None, |_| {
+                panic!("finalize must not retry a failed geo lookup");
+            });
+
+        assert_eq!(
+            calls.load(Ordering::SeqCst),
+            1,
+            "only the request-phase lookup should have run"
+        );
+        assert!(
+            geo_info.is_none(),
+            "no geo info should be available after a failed lookup"
+        );
+    }
+
+    #[test]
+    fn filter_span_recorded_when_request_filter_runs() {
+        // The Filter phase span should only be recorded when the registry
+        // actually has a request filter registered, so unconfigured
+        // deployments omit ts-filter from the Server-Timing header entirely.
+        let state = state_with_request_filters(vec![Arc::new(RecordingRequestFilter)]);
+        let services = RuntimeServices::builder()
+            .config_store(Arc::new(crate::platform::FastlyPlatformConfigStore))
+            .secret_store(Arc::new(crate::platform::FastlyPlatformSecretStore))
+            .kv_store(Arc::new(NoopKvStore) as Arc<dyn PlatformKvStore>)
+            .backend(Arc::new(FixedBackend))
+            .http_client(Arc::new(StreamingHttpClient))
+            .geo(Arc::new(crate::platform::FastlyPlatformGeo))
+            .client_info(ClientInfo::default())
+            .build();
+        let mut req = empty_request(Method::GET, "/some-page");
+        let timings = RequestTimings::new();
+        req.extensions_mut().insert(timings.handle().clone());
+
+        let _ = block_on(super::run_pre_route_filters(
+            &state, &services, &mut req, None,
+        ));
+
+        assert!(
+            timings.snapshot().filter_ms.is_some(),
+            "should record the Filter phase span when a request filter is registered and runs"
+        );
+    }
+
+    #[test]
+    fn filter_span_not_recorded_when_no_request_filters_registered() {
+        // Mirror test: an empty registry must never record the Filter span,
+        // even though run_pre_route_filters still runs (as a no-op loop).
+        let state = state_with_request_filters(Vec::new());
+        let services = RuntimeServices::builder()
+            .config_store(Arc::new(crate::platform::FastlyPlatformConfigStore))
+            .secret_store(Arc::new(crate::platform::FastlyPlatformSecretStore))
+            .kv_store(Arc::new(NoopKvStore) as Arc<dyn PlatformKvStore>)
+            .backend(Arc::new(FixedBackend))
+            .http_client(Arc::new(StreamingHttpClient))
+            .geo(Arc::new(crate::platform::FastlyPlatformGeo))
+            .client_info(ClientInfo::default())
+            .build();
+        let mut req = empty_request(Method::GET, "/some-page");
+        let timings = RequestTimings::new();
+        req.extensions_mut().insert(timings.handle().clone());
+
+        let _ = block_on(super::run_pre_route_filters(
+            &state, &services, &mut req, None,
+        ));
+
+        assert!(
+            timings.snapshot().filter_ms.is_none(),
+            "should omit the Filter phase span when no request filters are registered"
+        );
+    }
+
     #[test]
     fn dispatch_runs_request_filter_and_threads_response_effects() {
         // Regression guard for the EdgeZero request-filter bypass: the publisher
@@ -3506,6 +4314,61 @@ mod tests {
         );
     }
 
+    /// Joins every instance of a response header into one comma-separated
+    /// string (mirroring how a client sees repeated header fields), or
+    /// `None` if the header is absent.
+    fn response_header(response: &Response, name: &str) -> Option<String> {
+        let values: Vec<&str> = response
+            .headers()
+            .get_all(name)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .collect();
+        if values.is_empty() {
+            None
+        } else {
+            Some(values.join(", "))
+        }
+    }
+
+    #[test]
+    fn server_timing_emitted_on_private_response_when_enabled() {
+        let mut response = response_builder()
+            .header("cache-control", "private, no-store")
+            .body(Body::empty())
+            .expect("should build a private response fixture");
+        let timings = RequestTimings::new();
+
+        crate::apply_server_timing_header(&mut response, &timings, true);
+
+        let header = response_header(&response, "server-timing").expect("should emit header");
+        assert!(
+            header.contains("ts-total;dur="),
+            "should carry the stored total: {header}"
+        );
+        assert_eq!(
+            header.matches("ts-total").count(),
+            1,
+            "should emit exactly one TS-owned metric set"
+        );
+    }
+
+    #[test]
+    fn server_timing_absent_when_flag_off() {
+        let mut response = response_builder()
+            .header("cache-control", "private, no-store")
+            .body(Body::empty())
+            .expect("should build a private response fixture");
+        let timings = RequestTimings::new();
+
+        crate::apply_server_timing_header(&mut response, &timings, false);
+
+        assert!(
+            response_header(&response, "server-timing").is_none(),
+            "should not emit server-timing when the flag is off"
+        );
+    }
+
     fn recovery_eligible_of(response: &Response) -> bool {
         response
             .extensions()
@@ -3549,6 +4412,32 @@ mod tests {
         );
     }
 
+    #[test]
+    fn server_timing_absent_on_cacheable_responses() {
+        // tsjs route policy: public, long max-age, immutable.
+        let mut tsjs_response = response_builder()
+            .header("cache-control", "public, max-age=31536000, immutable")
+            .body(Body::empty())
+            .expect("should build a tsjs-style response fixture");
+        // A bare shared-cacheable response with no private/no-store directive.
+        let mut public_response = response_builder()
+            .header("cache-control", "max-age=60")
+            .body(Body::empty())
+            .expect("should build a bare max-age response fixture");
+
+        crate::apply_server_timing_header(&mut tsjs_response, &RequestTimings::new(), true);
+        crate::apply_server_timing_header(&mut public_response, &RequestTimings::new(), true);
+
+        assert!(
+            response_header(&tsjs_response, "server-timing").is_none(),
+            "should not emit on the public immutable tsjs cache policy"
+        );
+        assert!(
+            response_header(&public_response, "server-timing").is_none(),
+            "should not emit on a bare shared-cacheable max-age response"
+        );
+    }
+
     #[test]
     fn filter_short_circuit_response_is_not_eligible_for_eid_persistence() {
         // A request-filter short circuit (e.g. a DataDome challenge/block) must
@@ -3586,6 +4475,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn server_timing_absent_when_no_cache_control_header_exists() {
+        // The fail-closed case: absence of Cache-Control is not evidence of
+        // privacy, so emission must be suppressed rather than defaulted on.
+        let mut response = response_builder()
+            .body(Body::empty())
+            .expect("should build a response with no cache-control header");
+
+        crate::apply_server_timing_header(&mut response, &RequestTimings::new(), true);
+
+        assert!(
+            response_header(&response, "server-timing").is_none(),
+            "should not emit when the response carries no Cache-Control at all"
+        );
+    }
+
+    #[test]
+    fn preexisting_server_timing_values_survive() {
+        let mut response = response_builder()
+            .header("cache-control", "private, no-store")
+            .header("server-timing", "upstream;dur=1")
+            .body(Body::empty())
+            .expect("should build a private response fixture carrying an upstream Server-Timing");
+        let timings = RequestTimings::new();
+
+        crate::apply_server_timing_header(&mut response, &timings, true);
+
+        let header =
+            response_header(&response, "server-timing").expect("should still carry a header");
+        assert!(
+            header.contains("upstream;dur=1"),
+            "should preserve the pre-existing entry: {header}"
+        );
+        assert!(
+            header.contains("ts-total"),
+            "should append the TS-owned set: {header}"
+        );
+    }
+
     #[test]
     fn publisher_navigation_origin_start_failure_is_not_recovery_eligible() {
         // Recovery is authorized only after a successful origin start. With no
diff --git a/crates/trusted-server-adapter-fastly/src/backend.rs b/crates/trusted-server-adapter-fastly/src/backend.rs
index 0151cbb165..a0d08faab6 100644
--- a/crates/trusted-server-adapter-fastly/src/backend.rs
+++ b/crates/trusted-server-adapter-fastly/src/backend.rs
@@ -82,6 +82,8 @@ fn compute_host_header(scheme: &str, host: &str, port: u16) -> String {
 pub(crate) const DEFAULT_FIRST_BYTE_TIMEOUT: Duration = Duration::from_secs(15);
 /// Default timeout between response body bytes for backends (10 seconds).
 pub(crate) const DEFAULT_BETWEEN_BYTES_TIMEOUT: Duration = Duration::from_secs(10);
+/// Connect timeout of a backend whose spec sets none.
+pub(crate) const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(1);
 
 /// Configuration for creating a dynamic Fastly backend.
 ///
@@ -94,6 +96,7 @@ pub struct BackendConfig<'a> {
     certificate_check: bool,
     first_byte_timeout: Duration,
     between_bytes_timeout: Duration,
+    connect_timeout: Option<Duration>,
     host_header_override: Option<&'a str>,
     discriminator: Option<&'a str>,
 }
@@ -112,6 +115,7 @@ impl<'a> BackendConfig<'a> {
             certificate_check: true,
             first_byte_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
             between_bytes_timeout: DEFAULT_BETWEEN_BYTES_TIMEOUT,
+            connect_timeout: None,
             host_header_override: None,
             discriminator: None,
         }
@@ -154,6 +158,14 @@ impl<'a> BackendConfig<'a> {
         self
     }
 
+    /// Set the maximum time to wait for the connection. `None`, the default,
+    /// uses [`DEFAULT_CONNECT_TIMEOUT`].
+    #[must_use]
+    pub fn connect_timeout(mut self, timeout: Option<Duration>) -> Self {
+        self.connect_timeout = timeout;
+        self
+    }
+
     /// Set the outbound Host header sent to the backend origin.
     #[must_use]
     pub fn host_header_override(mut self, host: Option<&'a str>) -> Self {
@@ -183,6 +195,7 @@ impl<'a> BackendConfig<'a> {
             certificate_check: self.certificate_check,
             first_byte_timeout: self.first_byte_timeout,
             between_bytes_timeout: self.between_bytes_timeout,
+            connect_timeout: self.connect_timeout,
             discriminator: self.discriminator.map(str::to_owned),
         }
     }
@@ -237,7 +250,7 @@ impl<'a> BackendConfig<'a> {
         // Target base is host[:port]; SSL is enabled only for https scheme
         let mut builder = Backend::builder(&backend_name, &host_with_port)
             .override_host(&host_header)
-            .connect_timeout(Duration::from_secs(1))
+            .connect_timeout(self.connect_timeout.unwrap_or(DEFAULT_CONNECT_TIMEOUT))
             .first_byte_timeout(self.first_byte_timeout)
             .between_bytes_timeout(self.between_bytes_timeout);
         if self.scheme.eq_ignore_ascii_case("https") {
diff --git a/crates/trusted-server-adapter-fastly/src/ec_kv.rs b/crates/trusted-server-adapter-fastly/src/ec_kv.rs
index c427ede96b..660b51d0ed 100644
--- a/crates/trusted-server-adapter-fastly/src/ec_kv.rs
+++ b/crates/trusted-server-adapter-fastly/src/ec_kv.rs
@@ -7,7 +7,7 @@
 use error_stack::{Report, ResultExt};
 use fastly::kv_store::{InsertMode, KVStore, KVStoreError, ListPage};
 use trusted_server_core::ec::kv_backend::{
-    EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome,
+    EcKvLookup, EcKvRateLimited, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome,
 };
 use trusted_server_core::ec::log_id;
 use trusted_server_core::error::TrustedServerError;
@@ -151,6 +151,15 @@ impl EcKvStore for FastlyEcKvStore {
             Err(fastly::kv_store::KVStoreError::ItemPreconditionFailed) => {
                 Ok(EcKvWriteOutcome::PreconditionFailed)
             }
+            Err(KVStoreError::TooManyRequests) => Err(Report::new(KVStoreError::TooManyRequests)
+                .change_context(TrustedServerError::KvStore {
+                    store_name: self.store_name.clone(),
+                    message: format!(
+                        "Per-key write limit refused the entry for key '{}'",
+                        log_id(key)
+                    ),
+                })
+                .attach_opaque(EcKvRateLimited)),
             Err(err) => Err(
                 Report::new(err).change_context(TrustedServerError::KvStore {
                     store_name: self.store_name.clone(),
@@ -187,6 +196,10 @@ impl EcKvStore for FastlyEcKvStore {
                 message: format!("Failed to delete key '{}'", log_id(key)),
             })
     }
+
+    fn pause(&self, duration: std::time::Duration) {
+        std::thread::sleep(duration);
+    }
 }
 
 #[cfg(test)]
@@ -227,6 +240,18 @@ mod tests {
         .expect("should build a list page")
     }
 
+    #[test]
+    fn pause_blocks_for_the_duration() {
+        let started = std::time::Instant::now();
+
+        store().pause(Duration::from_millis(50));
+
+        assert!(
+            started.elapsed() >= Duration::from_millis(50),
+            "should block for at least the requested duration"
+        );
+    }
+
     #[test]
     fn exact_existence_follows_cursors_and_rejects_prefix_collisions() {
         let mut cursors = Vec::new();
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index 3cc13fdfa8..9b6f7655da 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -1,4 +1,5 @@
 use std::sync::Arc;
+use std::time::{Instant, SystemTime, UNIX_EPOCH};
 
 use edgezero_adapter_fastly::config_store::FastlyConfigStore as EdgeZeroFastlyConfigStore;
 use edgezero_adapter_fastly::request::into_core_request;
@@ -10,20 +11,36 @@ use edgezero_core::response::IntoResponse;
 use error_stack::Report;
 use fastly::http::Method as FastlyMethod;
 use fastly::{Request as FastlyRequest, Response as FastlyResponse};
+use rand::Rng as _;
 
+use trusted_server_core::access_telemetry::{
+    AccessTelemetrySnapshot, DeliveryResult, RouteClass, RouteMetadata, access_event_row,
+};
 use trusted_server_core::cache_policy::{EdgeCacheHeader, cache_control_headers_have_directive};
-use trusted_server_core::constants::HEADER_X_TS_VERSION;
+use trusted_server_core::constants::{
+    ENV_FASTLY_IS_STAGING, ENV_FASTLY_POP, ENV_FASTLY_SERVICE_ID, HEADER_X_TS_VERSION,
+};
+use trusted_server_core::ec::EcKvSnapshot;
 use trusted_server_core::ec::device::DeviceSignals;
-use trusted_server_core::ec::finalize::ec_finalize_response;
-use trusted_server_core::ec::kv::KvIdentityGraph;
-use trusted_server_core::ec::pull_sync::{
-    PullSyncContext, build_pull_sync_context, dispatch_pull_sync,
+use trusted_server_core::ec::finalize::{ec_finalize_response, retry_failed_withdrawals};
+use trusted_server_core::ec::identity::IdentityRuntime;
+use trusted_server_core::ec::identity::flush::{
+    AfterSendInput, FlushOutcome, defer_capture_writes, lose_pending_removals, may_flush,
+    retry_pending_removals, run_after_send,
 };
+use trusted_server_core::ec::identity::measurement::{IdentityMeasurement, MeasurementInput};
+use trusted_server_core::ec::kv::KvIdentityGraph;
+use trusted_server_core::ec::kv_backend::KvOperationCounts;
+use trusted_server_core::ec::rate_limiter::RateLimiter;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::TrustedServerError;
+use trusted_server_core::geo::GeoLookupState;
 use trusted_server_core::integrations::RequestFilterEffects;
 use trusted_server_core::platform::PlatformGeo as _;
+use trusted_server_core::platform::PlatformHttpClient;
 use trusted_server_core::proxy::{AssetProxyCachePolicy, stream_asset_body};
+use trusted_server_core::publisher::TemplateCacheResponseState;
+use trusted_server_core::request_timing::{Phase, RequestTimings, append_server_timing_if_private};
 use trusted_server_core::response_privacy::TerminalPrivateResponse;
 use trusted_server_core::settings::Settings;
 use trusted_server_core::trace::{TraceTerminalResponse, is_trace_path};
@@ -45,7 +62,7 @@ mod tinybird;
 
 use crate::app::{
     AppState, EcFinalizeState, RuntimeStoreConfig, TrustedServerApp,
-    load_settings_from_config_store,
+    build_identity_runtime_from_reloaded_settings, load_settings_from_config_store,
 };
 use crate::ec_kv::FastlyEcKvStore;
 use crate::middleware::{HEADER_X_TS_FINALIZED, apply_finalize_headers, resolve_geo_for_response};
@@ -378,7 +395,10 @@ fn edgezero_main(
         return;
     }
 
-    let config_store =
+    let timings = RequestTimings::new();
+
+    let config_store = {
+        let _appbuild = timings.span(Phase::AppBuild);
         match open_trusted_server_config_store(runtime_stores.config_store_name.as_ref()) {
             Ok(cs) => cs,
             Err(e) => {
@@ -388,8 +408,8 @@ fn edgezero_main(
                     .send_to_client();
                 return;
             }
-        };
-
+        }
+    };
     // Build lazily, once per sandbox. Reached only past the health, JA4, and
     // counters short-circuits, so none of those pays for construction.
     //
@@ -400,6 +420,7 @@ fn edgezero_main(
     // permanent error mode, and the next callback retries construction.
     let failed_build = sandbox
         .initialize(|| {
+            let _appbuild = timings.span(Phase::AppBuild);
             let (app, state) = TrustedServerApp::build_app_with_state(&runtime_stores);
             match state {
                 Some(state) => Ok(RetainedApp { app, state }),
@@ -424,6 +445,18 @@ fn edgezero_main(
     let settings_snapshot = app_state.as_ref().map(|state| Arc::clone(&state.settings));
     let counters =
         SandboxCounters::capture(sandbox, ordinal, request_id, settings_snapshot.as_deref());
+    let server_timing_enabled = settings_snapshot
+        .as_deref()
+        .is_some_and(|settings| settings.observability.server_timing_enabled);
+    let access_sample_rate = settings_snapshot
+        .as_deref()
+        .map_or(0.0, |settings| settings.tinybird.access_sample_rate);
+    let access_telemetry_enabled = settings_snapshot
+        .as_deref()
+        .is_some_and(|settings| settings.tinybird.enabled && settings.tinybird.access_enabled);
+    let publisher_domain = settings_snapshot
+        .as_deref()
+        .map_or("unknown", |settings| settings.publisher.domain.as_str());
     let trusted_client_ip = settings_snapshot
         .as_deref()
         .and_then(|settings| settings.trusted_client_ip.as_ref());
@@ -443,6 +476,9 @@ fn edgezero_main(
         compat::resolve_and_sanitize_client_ip(&mut req, trusted_client_ip)
     };
 
+    // Retain the method before dispatch consumes the request, including trace paths.
+    let request_method = req.get_method().clone();
+
     if !trace_path {
         // Re-inject a trusted TLS scheme signal after sanitization has stripped any
         // client-sent fastly-ssl header. Setting it from Fastly's native TLS
@@ -491,6 +527,7 @@ fn edgezero_main(
                 core_req.extensions_mut().insert(device_signals);
             }
             core_req.extensions_mut().insert(client_info);
+            core_req.extensions_mut().insert(timings.handle().clone());
             match futures::executor::block_on(app.router().oneshot(core_req)) {
                 Ok(response) => response,
                 Err(error) => edge_error_response(error),
@@ -511,7 +548,7 @@ fn edgezero_main(
         .is_some()
     {
         // Trace responses keep their exact hardened headers; no sandbox counters.
-        send_response_to_client(response, None);
+        send_response_to_client(response, None, &timings, None);
         return;
     }
 
@@ -519,14 +556,34 @@ fn edgezero_main(
     let ec_state = response.extensions_mut().remove::<EcFinalizeState>();
     let asset_cache_policy = response.extensions_mut().remove::<AssetProxyCachePolicy>();
     let request_filter_effects = response.extensions_mut().remove::<RequestFilterEffects>();
+    // Read rather than pop: the access-telemetry snapshot built later in
+    // `send_edgezero_response` reads this same extension, so it must still
+    // be attached to `response` at that point.
+    let geo_lookup_state = response
+        .extensions()
+        .get::<GeoLookupState>()
+        .cloned()
+        .unwrap_or(GeoLookupState::NotAttempted);
 
     if !take_finalize_sentinel(&mut response) {
         if let Some(settings) = settings_snapshot.as_deref() {
-            apply_entry_point_finalize_headers(settings, &mut response, client_ip);
+            apply_entry_point_finalize_headers(
+                settings,
+                &mut response,
+                client_ip,
+                &geo_lookup_state,
+                &timings,
+            );
         } else {
             match load_settings_from_config_store(&runtime_stores) {
                 Ok(settings) => {
-                    apply_entry_point_finalize_headers(&settings, &mut response, client_ip);
+                    apply_entry_point_finalize_headers(
+                        &settings,
+                        &mut response,
+                        client_ip,
+                        &geo_lookup_state,
+                        &timings,
+                    );
                 }
                 Err(e) => {
                     log::warn!("entry-point finalize skipped: failed to reload settings: {e:?}");
@@ -542,56 +599,143 @@ fn edgezero_main(
         policy.apply_after_route_finalization(&mut response, EdgeCacheHeader::SurrogateControl);
     }
 
+    let send_context = SendContext {
+        timings: timings.clone(),
+        server_timing_enabled,
+        method: request_method.as_str(),
+        publisher_domain,
+        access_sample_rate,
+        access_telemetry_enabled,
+    };
+    let access_http_client = platform::FastlyPlatformHttpClient::default();
+
     if let Some(mut ec_state) = ec_state {
-        if let Some(settings) = settings_snapshot.as_deref() {
-            match apply_edgezero_ec_finalize(settings, &mut ec_state, &mut response) {
-                Ok(partner_registry) => {
-                    send_edgezero_response(
-                        response,
-                        request_filter_effects.as_ref(),
-                        counters.as_ref(),
-                    );
-                    run_edgezero_pull_sync_after_send(settings, &partner_registry, &ec_state);
-                    return;
-                }
-                Err(e) => {
-                    log::error!(
-                        "EdgeZero EC finalize skipped: failed to build partner registry: {e:?}"
-                    );
+        let limiter = FastlyRateLimiter::new(RATE_COUNTER_NAME);
+        if let Some(state) = app_state.as_deref() {
+            let graph = || {
+                if state.identity_graph.is_none() {
+                    log::warn!("identity graph unavailable: ec.ec_store is not configured");
                 }
-            }
-        } else {
-            match load_settings_from_config_store(&runtime_stores) {
-                Ok(settings) => {
-                    match apply_edgezero_ec_finalize(&settings, &mut ec_state, &mut response) {
-                        Ok(partner_registry) => {
-                            send_edgezero_response(
+                state.identity_graph.clone()
+            };
+            run_post_send_steps(
+                || {
+                    let mut outcome = None;
+                    finalize_send_and_flush(
+                        PostRouteInput {
+                            runtime: Some(&state.identity),
+                            settings: &state.settings,
+                            ec_state: &mut ec_state,
+                            graph: &graph,
+                            rate_limiter: &limiter,
+                            timings: Some(&timings),
+                        },
+                        response,
+                        &mut |response| {
+                            outcome = Some(send_edgezero_response(
                                 response,
                                 request_filter_effects.as_ref(),
+                                &send_context,
                                 counters.as_ref(),
-                            );
-                            run_edgezero_pull_sync_after_send(
-                                &settings,
-                                &partner_registry,
-                                &ec_state,
-                            );
-                            return;
-                        }
-                        Err(e) => {
-                            log::error!(
-                                "EdgeZero EC finalize skipped: failed to build partner registry: {e:?}"
-                            );
-                        }
+                            ));
+                        },
+                    );
+                    outcome.expect("finalize_send_and_flush always sends the response")
+                },
+                |outcome| {
+                    emit_access_telemetry_after_send(
+                        &access_http_client,
+                        &state.settings,
+                        &outcome,
+                        &timings,
+                    )
+                },
+            );
+            return;
+        }
+        match load_settings_from_config_store(&runtime_stores) {
+            Ok(settings) => {
+                // No application state was built, so the identity runtime
+                // comes from the reloaded settings. Without one, finalize and
+                // the withdrawal retry still run; only phase 4 is skipped.
+                let identity = match build_identity_runtime_from_reloaded_settings(&settings) {
+                    Ok(identity) => {
+                        ec_state
+                            .ec_context
+                            .set_identity_runtime(Arc::clone(&identity));
+                        Some(identity)
                     }
-                }
-                Err(e) => {
-                    log::warn!("EdgeZero EC finalize skipped: failed to reload settings: {e:?}");
-                }
+                    Err(e) => {
+                        log::warn!(
+                            "identity flush skipped: identity runtime unavailable after settings reload: {}",
+                            e.current_context()
+                        );
+                        None
+                    }
+                };
+                let graph = || {
+                    require_identity_graph(&settings)
+                        .map_err(|e| {
+                            log::warn!("identity graph unavailable: {}", e.current_context());
+                        })
+                        .ok()
+                };
+                run_post_send_steps(
+                    || {
+                        let mut outcome = None;
+                        finalize_send_and_flush(
+                            PostRouteInput {
+                                runtime: identity.as_deref(),
+                                settings: &settings,
+                                ec_state: &mut ec_state,
+                                graph: &graph,
+                                rate_limiter: &limiter,
+                                timings: Some(&timings),
+                            },
+                            response,
+                            &mut |response| {
+                                outcome = Some(send_edgezero_response(
+                                    response,
+                                    request_filter_effects.as_ref(),
+                                    &send_context,
+                                    counters.as_ref(),
+                                ));
+                            },
+                        );
+                        outcome.expect("finalize_send_and_flush always sends the response")
+                    },
+                    |outcome| {
+                        emit_access_telemetry_after_send(
+                            &access_http_client,
+                            &settings,
+                            &outcome,
+                            &timings,
+                        )
+                    },
+                );
+                return;
+            }
+            Err(e) => {
+                log::warn!("EdgeZero EC finalize skipped: failed to reload settings: {e:?}");
             }
         }
     }
 
-    send_edgezero_response(response, request_filter_effects.as_ref(), counters.as_ref());
+    let outcome = send_edgezero_response(
+        response,
+        request_filter_effects.as_ref(),
+        &send_context,
+        counters.as_ref(),
+    );
+    // The asset/admin/error fallback path: no `EcFinalizeState` (or the ec
+    // finalize branch above failed), so there is no pull-sync dispatch here
+    // at all — telemetry is the only post-send step. When `app_state` never
+    // built there is nothing to emit either: `access_telemetry_enabled` was
+    // necessarily false without a settings snapshot, so the outcome carries
+    // no access snapshot, and reloading settings here could not change that.
+    if let Some(settings) = settings_snapshot.as_deref() {
+        emit_access_telemetry_after_send(&access_http_client, settings, &outcome, &timings);
+    }
 }
 
 fn edge_error_response(error: EdgeError) -> HttpResponse {
@@ -619,6 +763,8 @@ fn apply_entry_point_finalize_headers(
     settings: &Settings,
     response: &mut HttpResponse,
     client_ip: Option<std::net::IpAddr>,
+    geo_state: &GeoLookupState,
+    timings: &RequestTimings,
 ) {
     if response
         .extensions()
@@ -627,23 +773,100 @@ fn apply_entry_point_finalize_headers(
     {
         return;
     }
-    let geo_info = resolve_geo_for_response(response, client_ip, |client_ip| {
+    let geo_info = resolve_geo_for_response(response, geo_state, client_ip, |client_ip| {
+        let _span = timings.span(Phase::Geo);
         FastlyPlatformGeo.lookup(client_ip).unwrap_or_else(|e| {
             log::warn!("entry-point geo lookup failed: {e}");
             None
         })
     });
     apply_finalize_headers(settings, geo_info.as_ref(), response);
+
+    // This path runs only when the middleware chain was bypassed (e.g. a
+    // router-level 404/405 for an unregistered method), so `geo_state` may
+    // still be `NotAttempted` even after a fresh lookup just ran above.
+    // Write the resolved outcome back so the access-telemetry snapshot built
+    // later in `send_edgezero_response` sees what was actually looked up;
+    // 401 handling lives in the shared helper.
+    middleware::write_back_geo_lookup_state(response, geo_info.as_ref());
 }
 
-fn apply_edgezero_ec_finalize(
-    settings: &Settings,
-    ec_state: &mut EcFinalizeState,
-    response: &mut HttpResponse,
-) -> Result<PartnerRegistry, Report<TrustedServerError>> {
-    let partner_registry = PartnerRegistry::from_config(&settings.ec.partners)?;
+/// What the post-route work reads. It takes the runtime and settings rather
+/// than [`AppState`], because the settings-reload branch has none.
+struct PostRouteInput<'a> {
+    /// `None` when the runtime could not be built: finalize and the
+    /// withdrawal retry still run, and phase 4 is skipped.
+    runtime: Option<&'a IdentityRuntime>,
+    settings: &'a Settings,
+    ec_state: &'a mut EcFinalizeState,
+    /// Builds the identity graph. Called only when finalize or the after-send
+    /// work needs one, and at most once.
+    graph: &'a dyn Fn() -> Option<KvIdentityGraph>,
+    rate_limiter: &'a dyn RateLimiter,
+    /// Only pre-send finalization contributes to request KV timing.
+    timings: Option<&'a RequestTimings>,
+}
+
+/// Finalizes the response, hands it to `send`, then runs the after-send work:
+/// the withdrawal retry first, then phase 4's one flush (spec 5.2), and logs
+/// the request's `identity request measurement` line.
+///
+/// `send` is a callback so phase 4 runs only after the response is sent.
+/// Returns phase 4's outcome, or `None` when finalize could not run.
+fn finalize_send_and_flush(
+    input: PostRouteInput<'_>,
+    response: HttpResponse,
+    send: &mut dyn FnMut(HttpResponse),
+) -> Option<FlushOutcome> {
+    let (outcome, measurement) = finalize_send_and_flush_measured(input, response, send);
+    if let Some(measurement) = measurement {
+        measurement.log();
+    }
+    outcome
+}
+
+/// As [`finalize_send_and_flush`], returning the measurement instead of
+/// logging it. The measurement is `None` when finalize could not run.
+fn finalize_send_and_flush_measured(
+    input: PostRouteInput<'_>,
+    mut response: HttpResponse,
+    send: &mut dyn FnMut(HttpResponse),
+) -> (Option<FlushOutcome>, Option<IdentityMeasurement>) {
+    let PostRouteInput {
+        runtime,
+        settings,
+        ec_state,
+        graph,
+        rate_limiter,
+        timings,
+    } = input;
+    let partner_registry = match PartnerRegistry::from_config(&settings.ec.partners) {
+        Ok(registry) => registry,
+        Err(e) => {
+            log::error!("EdgeZero EC finalize skipped: failed to build partner registry: {e:?}");
+            send(response);
+            return (None, None);
+        }
+    };
+    // Every KV operation from here on counts into this; phase 1's read is
+    // known from the snapshot the route left.
+    let kv_counts = KvOperationCounts::default();
+    let phase_one_read = !matches!(ec_state.ec_context.kv_snapshot(), EcKvSnapshot::NotRead);
+    let mut built: Option<Option<KvIdentityGraph>> = None;
+    let mut graph_once = || {
+        built
+            .get_or_insert_with(|| graph().map(|graph| graph.with_operation_counts(&kv_counts)))
+            .clone()
+    };
+
     let finalize_kv_graph = if ec_state.use_finalize_kv {
-        maybe_identity_graph(settings)
+        graph_once().map(|graph| {
+            if let Some(timings) = timings {
+                graph.with_request_timings(timings)
+            } else {
+                graph
+            }
+        })
     } else {
         None
     };
@@ -654,54 +877,301 @@ fn apply_edgezero_ec_finalize(
         &partner_registry,
         ec_state.eids_cookie.as_deref(),
         ec_state.sharedid_cookie.as_deref(),
-        response,
+        &mut response,
+    );
+    let status = response.status();
+    send(response);
+
+    // A retry skipped because the graph is unavailable leaves the ID failed, so
+    // it counts as a failed run.
+    let withdrawal_after_send = ec_state.ec_context.has_failed_withdrawals();
+    if withdrawal_after_send {
+        match graph_once() {
+            Some(graph) => retry_failed_withdrawals(&mut ec_state.ec_context, &graph),
+            None => log::warn!("withdrawal retry skipped: identity graph unavailable"),
+        }
+    }
+    let withdrawal_after_send_failed = ec_state.ec_context.has_failed_withdrawals();
+
+    // A capture removal write that failed before send gets one more attempt.
+    if ec_state.ec_context.has_pending_removals() {
+        match graph_once() {
+            Some(graph) => retry_pending_removals(&mut ec_state.ec_context, &graph),
+            None => {
+                log::warn!("capture removal retry skipped: identity graph unavailable");
+                lose_pending_removals(&mut ec_state.ec_context);
+            }
+        }
+    }
+
+    // Positive capture IDs from a request that is not the writer wait in the
+    // pending key for the next writer.
+    if ec_state.ec_context.has_capture_writes() {
+        match graph_once() {
+            Some(graph) => defer_capture_writes(&mut ec_state.ec_context, &graph),
+            None => log::warn!("capture writes dropped: identity graph unavailable"),
+        }
+    }
+
+    let outcome = flush_after_send(
+        runtime,
+        settings,
+        ec_state,
+        &mut graph_once,
+        status,
+        rate_limiter,
     );
-    Ok(partner_registry)
+    let measurement = ec_state.ec_context.identity_measurement(&MeasurementInput {
+        phase_one_read,
+        kv_reads: kv_counts.reads(),
+        kv_writes: kv_counts.writes(),
+        flush: Some(&outcome),
+        withdrawal_after_send,
+        withdrawal_after_send_failed,
+    });
+    (Some(outcome), Some(measurement))
+}
+
+/// Phase 4's one flush, or [`FlushOutcome::Skipped`] when it cannot run.
+fn flush_after_send(
+    runtime: Option<&IdentityRuntime>,
+    settings: &Settings,
+    ec_state: &mut EcFinalizeState,
+    graph_once: &mut dyn FnMut() -> Option<KvIdentityGraph>,
+    status: edgezero_core::http::StatusCode,
+    rate_limiter: &dyn RateLimiter,
+) -> FlushOutcome {
+    let Some(runtime) = runtime else {
+        return FlushOutcome::Skipped;
+    };
+    if !ec_state.is_real_browser || !may_flush(&ec_state.ec_context) {
+        return FlushOutcome::Skipped;
+    }
+    let Some(graph) = graph_once() else {
+        log::debug!("identity flush skipped: identity graph unavailable");
+        return FlushOutcome::Skipped;
+    };
+    run_after_send(AfterSendInput {
+        runtime,
+        settings,
+        services: &ec_state.services,
+        graph: &graph,
+        context: &mut ec_state.ec_context,
+        status,
+        rate_limiter,
+    })
+}
+
+/// Completes the identity lifecycle, including send and persistence, before
+/// access-telemetry emission.
+///
+/// Every `edgezero_main` site that has both steps routes through this
+/// function, so the ordering is owned in exactly one place and the
+/// sequence test can instrument it; `request_elapsed` is already stamped
+/// before identity persistence because `send_edgezero_response` stamps it
+/// before returning.
+fn run_post_send_steps<T>(identity: impl FnOnce() -> T, emit_access_telemetry: impl FnOnce(T)) {
+    let outcome = identity();
+    emit_access_telemetry(outcome);
 }
 
-fn run_edgezero_pull_sync_after_send(
+/// Builds and dispatches the access row after a response's transport attempt,
+/// when access telemetry is enabled and this request is sampled in.
+///
+/// Called last at every `send_edgezero_response` call site in
+/// [`edgezero_main`] — after `finalize_send_and_flush` on the two
+/// EC-finalized paths, and directly after send on the asset/admin/error
+/// fallback path, which never builds an [`EcFinalizeState`] or route-scoped
+/// `RuntimeServices` at all. The Tinybird transport context is therefore
+/// constructed fresh from `settings` here rather than threaded through
+/// either of those per-route types, so every response class can emit.
+///
+/// Sampling happens before snapshot construction, using the same configured
+/// rate stored in the row. Disabled and sampled-out requests have no snapshot
+/// and return silently. Row construction, setup and request-start failures log
+/// one warning. The host-owned ingest request continues after this callback;
+/// later transport errors, HTTP status and remote acceptance are unobserved.
+/// Credentials were resolved during settings load.
+fn emit_access_telemetry_after_send(
+    http_client: &dyn PlatformHttpClient,
     settings: &Settings,
-    partner_registry: &PartnerRegistry,
-    ec_state: &EcFinalizeState,
+    outcome: &DeliveryOutcome,
+    timings: &RequestTimings,
 ) {
-    if !ec_state.is_real_browser {
+    if !settings.tinybird.enabled || !settings.tinybird.access_enabled {
         return;
     }
 
-    let prepared_context = build_pull_sync_context(&ec_state.ec_context, partner_registry);
-    let Some((context, kv)) =
-        prepare_pull_sync_after_send(prepared_context, || require_identity_graph(settings))
-    else {
+    // No snapshot means access telemetry was disabled or sampled out before
+    // the response was sent; there is nothing to emit.
+    let Some(snapshot) = &outcome.snapshot else {
         return;
     };
 
-    let limiter = FastlyRateLimiter::new(RATE_COUNTER_NAME);
-    dispatch_pull_sync(
-        settings,
-        &kv,
-        partner_registry,
-        &limiter,
-        &context,
-        &ec_state.services,
-    );
+    let since_epoch = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default();
+    let epoch_ms = u64::try_from(since_epoch.as_millis()).unwrap_or(u64::MAX);
+    let row = access_event_row(snapshot, &timings.snapshot(), outcome.result, epoch_ms);
+    let result = futures::executor::block_on(async {
+        let target = tinybird::TinybirdEventsTarget::from_access_config(&settings.tinybird)?;
+        tinybird::emit_access_event(http_client, &target, row).await
+    });
+    if let Err(error) = result {
+        log::warn!("access telemetry emission dropped: {error:?}");
+    }
+}
+
+/// Per-response context threaded into [`send_edgezero_response`] so the
+/// function stays at or under seven parameters.
+struct SendContext<'a> {
+    /// The request's phase-timing collector.
+    timings: RequestTimings,
+    /// Whether `observability.server_timing_enabled` is set.
+    server_timing_enabled: bool,
+    /// The request's HTTP method, captured before the request was consumed
+    /// by dispatch.
+    method: &'a str,
+    /// The configured publisher domain, borrowed from the settings snapshot.
+    publisher_domain: &'a str,
+    /// The configured access-telemetry sample rate.
+    access_sample_rate: f64,
+    /// Whether `tinybird.enabled` and `tinybird.access_enabled` were both
+    /// set when settings were first read. Gates building the
+    /// [`AccessTelemetrySnapshot`] at all: the snapshot costs env reads and
+    /// `String` allocations on the pre-send path, which a disabled
+    /// deployment (the default) should not pay.
+    access_telemetry_enabled: bool,
+}
+
+/// Outcome of handing a finalized response to the client.
+pub(crate) struct DeliveryOutcome {
+    /// Outcome of the local body handoff, emitted as `delivery_result`.
+    /// This does not establish confirmed client receipt.
+    pub result: DeliveryResult,
+    /// Access-telemetry dimensions captured for this response at the
+    /// freeze point. `None` when access telemetry was disabled or sampled out;
+    /// the emitter treats that as nothing to send.
+    pub snapshot: Option<AccessTelemetrySnapshot>,
+}
+
+/// Thin Fastly-adapter wrapper around
+/// [`append_server_timing_if_private`], the freeze point shared with the
+/// Axum adapter's terminal timing layer. See that function's doc for the
+/// emission rules (always stamps `mark_headers_ready`; appends rather than
+/// overwrites; never promotes a response to shared-cacheable).
+pub(crate) fn apply_server_timing_header(
+    response: &mut HttpResponse,
+    timings: &RequestTimings,
+    server_timing_enabled: bool,
+) {
+    append_server_timing_if_private(response, timings, server_timing_enabled);
+}
+
+/// A [`Write`](std::io::Write) wrapper that tallies bytes successfully written
+/// to the inner writer.
+///
+/// Wraps the client transport during a streaming drive so a truncated or
+/// failed drive still reports how many bytes actually reached it, instead of
+/// the placeholder `0` a failed/aborted drive would otherwise report.
+struct CountingWriter<W> {
+    inner: W,
+    bytes: u64,
+}
+
+impl<W> CountingWriter<W> {
+    fn new(inner: W) -> Self {
+        Self { inner, bytes: 0 }
+    }
+
+    /// Bytes successfully written to the inner writer so far.
+    fn bytes(&self) -> u64 {
+        self.bytes
+    }
+
+    fn into_inner(self) -> W {
+        self.inner
+    }
+}
+
+impl<W: std::io::Write> std::io::Write for CountingWriter<W> {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        let written = self.inner.write(buf)?;
+        self.bytes = self.bytes.saturating_add(written as u64);
+        Ok(written)
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        self.inner.flush()
+    }
+}
+
+/// Drives a streaming `EdgeZero` body through `output`, tallying bytes written
+/// and timing the drive into `timings`.
+///
+/// Stamps `resp_bytes` and `request_elapsed` immediately once the drive
+/// returns — before the caller does anything transport-specific (finishing
+/// the streaming body, logging) — so `request_elapsed` never includes that
+/// work. Returns the counting writer (so the caller can recover both the
+/// tallied byte count and the wrapped transport) alongside the drive's
+/// result.
+fn drive_streaming_body<W: std::io::Write>(
+    body: EdgeBody,
+    output: W,
+    timings: &RequestTimings,
+) -> (CountingWriter<W>, Result<(), Report<TrustedServerError>>) {
+    let mut counting = CountingWriter::new(output);
+    let drive_started = Instant::now();
+    let result = futures::executor::block_on(stream_asset_body(body, &mut counting));
+    timings.record(Phase::Stream, drive_started.elapsed());
+    timings.set_resp_bytes(counting.bytes());
+    timings.mark_request_elapsed();
+    (counting, result)
+}
+
+/// Classifies a completed streaming drive into a [`DeliveryResult`].
+///
+/// A drive that failed after writing at least one byte delivered a truncated
+/// response rather than nothing at all, so it is [`DeliveryResult::Partial`],
+/// not [`DeliveryResult::Error`].
+///
+/// The `Ok(())` arm exists for the classifier's totality, not for the
+/// production caller: `send_edgezero_response` consumes this value only in
+/// its `Err` branch and re-derives the success outcome from
+/// `streaming_body.finish()`.
+fn classify_stream_delivery(
+    drive_result: &Result<(), Report<TrustedServerError>>,
+    bytes: u64,
+) -> DeliveryResult {
+    match drive_result {
+        Ok(()) => DeliveryResult::Complete,
+        Err(_) if bytes > 0 => DeliveryResult::Partial,
+        Err(_) => DeliveryResult::Error,
+    }
 }
 
-fn prepare_pull_sync_after_send<F>(
-    context: Option<PullSyncContext>,
-    graph_factory: F,
-) -> Option<(PullSyncContext, KvIdentityGraph)>
-where
-    F: FnOnce() -> Result<KvIdentityGraph, Report<TrustedServerError>>,
-{
-    let context = context?;
-    let kv = match graph_factory() {
-        Ok(kv) => kv,
-        Err(err) => {
-            log::debug!("Pull sync: identity graph unavailable, skipping: {err:?}");
-            return None;
+/// Classifies the transport's finish result after a successful body drive.
+fn classify_stream_finish(
+    finish_result: std::io::Result<()>,
+    counter_context: &str,
+) -> DeliveryResult {
+    match finish_result {
+        Ok(()) => DeliveryResult::Complete,
+        Err(error) => {
+            log::error!("failed to finish EdgeZero streaming body{counter_context}: {error}");
+            DeliveryResult::Partial
         }
-    };
-    Some((context, kv))
+    }
+}
+
+/// Stamps `resp_bytes`/`request_elapsed` for an already-materialized body,
+/// immediately before it is handed to the Fastly client transport, and
+/// returns its byte length.
+fn record_buffered_delivery(body: &EdgeBody, timings: &RequestTimings) -> u64 {
+    let bytes = u64::try_from(body.as_bytes().map(<[u8]>::len).unwrap_or(0)).unwrap_or(u64::MAX);
+    timings.set_resp_bytes(bytes);
+    timings.mark_request_elapsed();
+    bytes
 }
 
 /// Sends a finalized `EdgeZero` response to the client.
@@ -712,15 +1182,38 @@ where
 fn send_edgezero_response(
     mut response: HttpResponse,
     request_filter_effects: Option<&RequestFilterEffects>,
+    context: &SendContext,
     counters: Option<&SandboxCounters>,
-) {
-    apply_terminal_response_effects(&mut response, request_filter_effects);
+) -> DeliveryOutcome {
+    finalize_send_response_headers(
+        &mut response,
+        request_filter_effects,
+        &context.timings,
+        context.server_timing_enabled,
+    );
+
+    // Built right after the freeze point and before `into_parts()`
+    // consumes `response`: nothing else survives to post-send on every
+    // path (the request was consumed by dispatch, and `EcFinalizeState`
+    // is absent on asset, admin, and error paths). Skipped entirely when
+    // access telemetry is disabled, so the default configuration pays no
+    // env reads or allocations here.
+    let snapshot = sampled_access_snapshot(
+        context,
+        || rand::thread_rng().r#gen::<f64>(),
+        || build_access_telemetry_snapshot(&response, context),
+    );
 
-    send_response_to_client(response, counters);
+    send_response_to_client(response, counters, &context.timings, snapshot)
 }
 
 /// Sends a response, attaching sandbox counters first when supplied.
-fn send_response_to_client(mut response: HttpResponse, counters: Option<&SandboxCounters>) {
+fn send_response_to_client(
+    mut response: HttpResponse,
+    counters: Option<&SandboxCounters>,
+    timings: &RequestTimings,
+    snapshot: Option<AccessTelemetrySnapshot>,
+) -> DeliveryOutcome {
     // Captured before the body is consumed so post-commitment failures can be
     // matched back to the response that carried these counters.
     let counter_context = counters.map_or_else(String::new, |counters| {
@@ -745,17 +1238,18 @@ fn send_response_to_client(mut response: HttpResponse, counters: Option<&Sandbox
                 parts,
                 EdgeBody::empty(),
             ));
-            let mut streaming_body = skeleton.stream_to_client();
-            match futures::executor::block_on(stream_asset_body(body, &mut streaming_body)) {
-                Ok(()) => {
-                    if let Err(e) = streaming_body.finish() {
-                        // Also post-commitment: same attribution as the
-                        // streaming failure below.
-                        log::error!(
-                            "failed to finish EdgeZero streaming body{counter_context}: {e}"
-                        );
-                    }
-                }
+            let (counting, drive_result) =
+                drive_streaming_body(body, skeleton.stream_to_client(), timings);
+            let bytes = counting.bytes();
+            let streaming_body = counting.into_inner();
+            // Computed before `drive_result` is matched by value below, since
+            // the `Err` arm there moves its `Report` out.
+            let result = classify_stream_delivery(&drive_result, bytes);
+            match drive_result {
+                Ok(()) => DeliveryOutcome {
+                    result: classify_stream_finish(streaming_body.finish(), &counter_context),
+                    snapshot,
+                },
                 Err(e) => {
                     // After commitment: log and stop. Returning an error here
                     // would let the SDK attempt a second response. Counters
@@ -763,16 +1257,124 @@ fn send_response_to_client(mut response: HttpResponse, counters: Option<&Sandbox
                     // tagged with the same identity for reconciliation.
                     log::error!("EdgeZero streaming failed{counter_context}: {e:?}");
                     drop(streaming_body);
+                    DeliveryOutcome { result, snapshot }
                 }
             }
         }
         once => {
+            record_buffered_delivery(&once, timings);
             compat::to_fastly_response(HttpResponse::from_parts(parts, once)).send_to_client();
+            DeliveryOutcome {
+                result: DeliveryResult::Complete,
+                snapshot,
+            }
+        }
+    }
+}
+
+/// Samples once before doing snapshot work. Neither closure runs when disabled,
+/// and sampled-out requests never build dimensions or read environment values.
+fn sampled_access_snapshot(
+    context: &SendContext<'_>,
+    roll: impl FnOnce() -> f64,
+    build: impl FnOnce() -> AccessTelemetrySnapshot,
+) -> Option<AccessTelemetrySnapshot> {
+    if !context.access_telemetry_enabled
+        || !tinybird::sampled_in(context.access_sample_rate, roll())
+    {
+        return None;
+    }
+    Some(build())
+}
+
+/// Builds the [`AccessTelemetrySnapshot`] for `response` at the
+/// `Server-Timing` freeze point.
+///
+/// Reads route identity, geo country, and template-cache state from typed
+/// response extensions rather than the headers those extensions back —
+/// operator-configured response headers can override a managed header, so
+/// reading a header here could silently drift from what actually happened.
+/// Falls back to `"unknown"`/[`RouteClass::Other`] sentinels when an
+/// extension was never attached (router-generated, asset, and other
+/// responses that never passed through a `RouteMetadata`-attaching
+/// wrapper).
+fn build_access_telemetry_snapshot(
+    response: &HttpResponse,
+    context: &SendContext,
+) -> AccessTelemetrySnapshot {
+    let (route_class, route_template) = match response.extensions().get::<RouteMetadata>() {
+        Some(metadata) => (metadata.route_class, metadata.route_template.clone()),
+        None => (RouteClass::Other, "unknown".to_owned()),
+    };
+
+    let country = match response.extensions().get::<GeoLookupState>() {
+        Some(GeoLookupState::Resolved(info)) => info.country.clone(),
+        Some(GeoLookupState::Attempted | GeoLookupState::NotAttempted) | None => {
+            "unknown".to_owned()
         }
+    };
+
+    let template_cache_state = response
+        .extensions()
+        .get::<TemplateCacheResponseState>()
+        .map_or_else(|| "unknown".to_owned(), |state| state.as_str().to_owned());
+
+    let body_mode = if matches!(response.body(), EdgeBody::Stream(_)) {
+        "streamed"
+    } else {
+        "buffered"
+    };
+
+    AccessTelemetrySnapshot {
+        method: context.method.to_owned(),
+        status: response.status().as_u16(),
+        route_class,
+        route_template,
+        publisher_domain: context.publisher_domain.to_owned(),
+        env: resolve_env_dimension(),
+        service_id: env_var_or_unknown(ENV_FASTLY_SERVICE_ID),
+        pop: env_var_or_unknown(ENV_FASTLY_POP),
+        country,
+        template_cache_state,
+        body_mode,
+        sample_rate: context.access_sample_rate,
+    }
+}
+
+/// Derives the `env` access-telemetry dimension from the same
+/// `FASTLY_IS_STAGING` input that drives the `x-ts-env` response header
+/// (see [`apply_finalize_headers`]), never from [`Settings`] — `Settings`
+/// has no environment field and does not gain one for this.
+///
+/// `"unknown"` covers contexts where the variable is entirely absent (for
+/// example native unit tests run outside Fastly Compute); on the Fastly
+/// platform the variable is always present, as either `"1"` or not.
+fn resolve_env_dimension() -> String {
+    match std::env::var(ENV_FASTLY_IS_STAGING) {
+        Ok(value) if value == "1" => "staging".to_owned(),
+        Ok(_) => "production".to_owned(),
+        Err(_) => "unknown".to_owned(),
     }
 }
 
-/// Apply every late response mutation, then restore privacy invariants before headers commit.
+/// Reads a Fastly-provided environment variable, defaulting to `"unknown"`
+/// when unset.
+fn env_var_or_unknown(name: &str) -> String {
+    std::env::var(name).unwrap_or_else(|_| "unknown".to_owned())
+}
+
+/// Apply terminal response effects before evaluating Server-Timing at the send freeze point.
+fn finalize_send_response_headers(
+    response: &mut HttpResponse,
+    request_filter_effects: Option<&RequestFilterEffects>,
+    timings: &RequestTimings,
+    server_timing_enabled: bool,
+) {
+    apply_terminal_response_effects(response, request_filter_effects);
+    apply_server_timing_header(response, timings, server_timing_enabled);
+}
+
+/// Apply late response effects and restore cache-privacy invariants before headers commit.
 fn apply_terminal_response_effects(
     response: &mut HttpResponse,
     request_filter_effects: Option<&RequestFilterEffects>,
@@ -850,16 +1452,17 @@ fn build_ja4_debug_response(req: &FastlyRequest) -> FastlyResponse {
         .with_body(body)
 }
 
+/// Builds the shared graph over the configured identity store.
 pub(crate) fn maybe_identity_graph(settings: &Settings) -> Option<KvIdentityGraph> {
-    settings
-        .ec
-        .ec_store
-        .as_ref()
-        .map(|store_name| KvIdentityGraph::new(FastlyEcKvStore::new(store_name)))
+    require_identity_graph(settings).ok()
 }
 
 /// Constructs a `KvIdentityGraph` from settings, or returns an error if the
 /// `ec_store` config is not set.
+///
+/// Deliberately untimed for retained application state. Request-path callers
+/// wrap a clone with `with_request_timings`, or use
+/// [`require_identity_graph_with_timing`] when rebuilding from settings.
 pub(crate) fn require_identity_graph(
     settings: &Settings,
 ) -> Result<KvIdentityGraph, Report<TrustedServerError>> {
@@ -872,6 +1475,17 @@ pub(crate) fn require_identity_graph(
     Ok(KvIdentityGraph::new(FastlyEcKvStore::new(store_name)))
 }
 
+/// Constructs a `KvIdentityGraph` wrapped in the [`Phase::EcKv`] timing
+/// decorator, or returns an error if the `ec_store` config is not set.
+///
+/// Request-path sibling of [`require_identity_graph`].
+pub(crate) fn require_identity_graph_with_timing(
+    settings: &Settings,
+    timings: &RequestTimings,
+) -> Result<KvIdentityGraph, Report<TrustedServerError>> {
+    require_identity_graph(settings).map(|graph| graph.with_request_timings(timings))
+}
+
 /// Extracts a named cookie value from the request's `Cookie` header.
 pub(crate) fn extract_cookie_value(req: &HttpRequest, name: &str) -> Option<String> {
     let cookie_header = req.headers().get("cookie").and_then(|v| v.to_str().ok())?;
@@ -900,7 +1514,10 @@ pub(crate) fn derive_device_signals(req: &FastlyRequest) -> DeviceSignals {
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Mutex;
+
     use super::*;
+    use crate::app::TrustedServerApp;
     use base64::Engine as _;
     use edgezero_core::body::Body as EdgeBody;
     use edgezero_core::http::response_builder;
@@ -910,11 +1527,53 @@ mod tests {
         TargetUnavailable,
     };
     use fastly::mime;
+    use std::time::Duration;
+    use trusted_server_core::ec::identity::measurement::RouteKind;
     use trusted_server_core::integrations::HeaderMutation;
+    use trusted_server_core::platform::{
+        PlatformError, PlatformHttpRequest, PlatformPendingRequest, PlatformResponse,
+        PlatformSelectResult, RuntimeServices,
+    };
+    use trusted_server_core::request_timing::AuctionWaitPlacement;
 
-    fn test_settings() -> Settings {
-        Settings::from_toml(
-            r#"
+    #[derive(Default)]
+    struct RecordingAccessHttpClient {
+        requests: Mutex<Vec<String>>,
+    }
+
+    #[async_trait::async_trait(?Send)]
+    impl PlatformHttpClient for RecordingAccessHttpClient {
+        async fn send(
+            &self,
+            request: PlatformHttpRequest,
+        ) -> Result<PlatformResponse, Report<PlatformError>> {
+            self.requests
+                .lock()
+                .expect("should lock recorded requests")
+                .push(request.request.uri().to_string());
+            Err(Report::new(PlatformError::Unsupported))
+        }
+
+        async fn send_async(
+            &self,
+            request: PlatformHttpRequest,
+        ) -> Result<PlatformPendingRequest, Report<PlatformError>> {
+            self.requests
+                .lock()
+                .expect("should lock recorded requests")
+                .push(request.request.uri().to_string());
+            Err(Report::new(PlatformError::Unsupported))
+        }
+
+        async fn select(
+            &self,
+            _pending_requests: Vec<PlatformPendingRequest>,
+        ) -> Result<PlatformSelectResult, Report<PlatformError>> {
+            Err(Report::new(PlatformError::Unsupported))
+        }
+    }
+
+    const TEST_SETTINGS_TOML: &str = r#"
             [[handlers]]
             path = "^/_ts/admin"
             username = "admin"
@@ -933,9 +1592,189 @@ mod tests {
             enabled = false
             config_store_id = "test-config-store-id"
             secret_store_id = "test-secret-store-id"
-            "#,
+            "#;
+
+    fn test_settings() -> Settings {
+        Settings::from_toml(TEST_SETTINGS_TOML).expect("should parse test settings")
+    }
+
+    const EC_ID: &str = "0000000000000000000000000000000000000000000000000000000000000000.ABC123";
+
+    /// Allows every call.
+    struct AllowAll;
+
+    impl RateLimiter for AllowAll {
+        fn exceeded(&self, _key: &str, _limit: u32) -> Result<bool, Report<TrustedServerError>> {
+            Ok(false)
+        }
+
+        fn record(&self, _key: &str) -> Result<(), Report<TrustedServerError>> {
+            Ok(())
+        }
+
+        fn count(&self, _key: &str) -> Result<u32, Report<TrustedServerError>> {
+            Ok(0)
+        }
+    }
+
+    /// Marks `request` as sent by a real browser at a client address.
+    fn as_browser(request: &mut HttpRequest) {
+        request.extensions_mut().insert(DeviceSignals::derive(
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 \
+             (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
+            Some("t13d1516h2_8daaf6152771_b186095e22b6"),
+            Some("1:65536;2:0;4:6291456;6:262144"),
+        ));
+        request
+            .extensions_mut()
+            .insert(trusted_server_core::platform::ClientInfo {
+                client_ip: Some("192.0.2.10".parse().expect("should parse the client IP")),
+                ..trusted_server_core::platform::ClientInfo::default()
+            });
+    }
+
+    /// A browser document navigation carrying `cookie`.
+    fn navigation(cookie: Option<&str>) -> HttpRequest {
+        let mut builder = edgezero_core::http::request_builder()
+            .method(edgezero_core::http::Method::GET)
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/some-page") // allow-domain: test-publisher.com
+            .header("sec-fetch-dest", "document");
+        if let Some(cookie) = cookie {
+            builder = builder.header("cookie", cookie);
+        }
+        let mut request = builder
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        as_browser(&mut request);
+        request
+    }
+
+    /// Polls `future` to completion on this thread without entering an
+    /// executor, so code under test that blocks on its own futures, such as
+    /// the hold dispatch of an auction navigation, can run inside it. The
+    /// scripted network is ready at once, so a future that stays pending is a
+    /// test bug.
+    fn poll_ready<F: core::future::Future>(future: F) -> F::Output {
+        let waker = futures::task::noop_waker();
+        let mut context = core::task::Context::from_waker(&waker);
+        let mut future = core::pin::pin!(future);
+        for _ in 0..10_000 {
+            if let core::task::Poll::Ready(output) = future.as_mut().poll(&mut context) {
+                return output;
+            }
+        }
+        unreachable!("the future should complete against the scripted network")
+    }
+
+    /// Routes `request`, then finalizes, sends and flushes it as
+    /// `edgezero_main` does, keeping the sent response.
+    fn drive_request_for_test(
+        state: &Arc<AppState>,
+        request: HttpRequest,
+    ) -> (HttpResponse, Option<FlushOutcome>) {
+        drive_with_runtime(state, request, Some(&state.identity), |_| {})
+    }
+
+    /// As [`drive_request_for_test`], with the runtime the post-route work
+    /// gets: `None` is the settings-reload branch without a runtime.
+    fn drive_with_runtime(
+        state: &Arc<AppState>,
+        request: HttpRequest,
+        runtime: Option<&IdentityRuntime>,
+        prepare: impl FnOnce(&mut EcFinalizeState),
+    ) -> (HttpResponse, Option<FlushOutcome>) {
+        let router = TrustedServerApp::routes_for_state(state);
+        let mut response = poll_ready(router.oneshot(request)).expect("should route the request");
+        let Some(mut ec_state) = response.extensions_mut().remove::<EcFinalizeState>() else {
+            return (response, None);
+        };
+        prepare(&mut ec_state);
+        let mut sent = None;
+        let graph = || state.identity_graph.clone();
+        let outcome = finalize_send_and_flush(
+            PostRouteInput {
+                runtime,
+                settings: &state.settings,
+                ec_state: &mut ec_state,
+                graph: &graph,
+                rate_limiter: &AllowAll,
+                timings: None,
+            },
+            response,
+            &mut |response| sent = Some(response),
+        );
+        (sent.expect("should send the response"), outcome)
+    }
+
+    /// As [`drive_request_for_test`], keeping the request's measurement.
+    fn drive_measured_for_test(
+        state: &Arc<AppState>,
+        request: HttpRequest,
+    ) -> (Option<FlushOutcome>, IdentityMeasurement) {
+        let router = TrustedServerApp::routes_for_state(state);
+        let mut response =
+            futures::executor::block_on(router.oneshot(request)).expect("should route the request");
+        let mut ec_state = response
+            .extensions_mut()
+            .remove::<EcFinalizeState>()
+            .expect("should leave EC state on the response");
+        let graph = || state.identity_graph.clone();
+        let (outcome, measurement) = finalize_send_and_flush_measured(
+            PostRouteInput {
+                runtime: Some(&state.identity),
+                settings: &state.settings,
+                ec_state: &mut ec_state,
+                graph: &graph,
+                rate_limiter: &AllowAll,
+                timings: None,
+            },
+            response,
+            &mut |_| {},
+        );
+        (
+            outcome,
+            measurement.expect("should measure a finalized request"),
         )
-        .expect("should parse test settings")
+    }
+
+    /// A returning visitor's live row, without a cluster size so the flush
+    /// has one change to write.
+    fn seeded_state() -> (
+        Arc<AppState>,
+        Arc<trusted_server_core::ec::identity::test_support::WriteCountingEcKv>,
+    ) {
+        let (graph, store) = KvIdentityGraph::write_counting("drive-store");
+        let consent = trusted_server_core::ec::identity::test_support::allowing_consent();
+        let entry = trusted_server_core::ec::kv_types::KvEntry::new(
+            &consent,
+            None,
+            1_000,
+            "test-publisher.com",
+        );
+        graph.create(EC_ID, &entry).expect("should seed the row");
+        store.reset_counts();
+        let state = crate::app::app_state_with_graph_for_test(test_settings(), graph);
+        (state, store)
+    }
+
+    /// A minimal [`AccessTelemetrySnapshot`] fixture for tests that only
+    /// need a `DeliveryOutcome` to exist, not its telemetry content.
+    fn sample_access_snapshot() -> AccessTelemetrySnapshot {
+        AccessTelemetrySnapshot {
+            method: "GET".to_owned(),
+            status: 200,
+            route_class: RouteClass::Other,
+            route_template: "/other/*".to_owned(),
+            publisher_domain: "unknown".to_owned(),
+            env: "unknown".to_owned(),
+            service_id: "unknown".to_owned(),
+            pop: "unknown".to_owned(),
+            country: "unknown".to_owned(),
+            template_cache_state: "unknown".to_owned(),
+            body_mode: "buffered",
+            sample_rate: 0.0,
+        }
     }
 
     #[test]
@@ -978,7 +1817,13 @@ mod tests {
                 HeaderMutation::set("cache-control", "public, max-age=3600"),
             ],
         };
-        apply_entry_point_finalize_headers(&settings, &mut response, None);
+        apply_entry_point_finalize_headers(
+            &settings,
+            &mut response,
+            None,
+            &GeoLookupState::NotAttempted,
+            &RequestTimings::new(),
+        );
         apply_terminal_response_effects(&mut response, Some(&effects));
         assert_eq!(
             response.headers(),
@@ -1114,7 +1959,13 @@ mod tests {
                 "should preserve action and preflight status"
             );
             let original = response.headers().clone();
-            apply_entry_point_finalize_headers(&settings, &mut response, None);
+            apply_entry_point_finalize_headers(
+                &settings,
+                &mut response,
+                None,
+                &GeoLookupState::NotAttempted,
+                &RequestTimings::new(),
+            );
             apply_terminal_response_effects(&mut response, Some(&effects));
             assert_eq!(
                 response.headers(),
@@ -1147,25 +1998,253 @@ mod tests {
     }
 
     #[test]
-    fn pull_sync_noop_states_skip_post_send_graph_factory() {
-        let calls = std::cell::Cell::new(0);
-        let result = prepare_pull_sync_after_send(None, || {
-            calls.set(calls.get() + 1);
-            Err(Report::new(TrustedServerError::KvStore {
-                store_name: "unexpected".to_owned(),
-                message: "graph factory should not run".to_owned(),
-            }))
-        });
+    fn identity_measurement_records_counts_for_a_writer_navigation() {
+        let (state, _store) = seeded_state();
+        let cookie = format!("ts-ec={EC_ID}");
+
+        let (outcome, measurement) = drive_measured_for_test(&state, navigation(Some(&cookie)));
+
+        assert_eq!(outcome, Some(FlushOutcome::Written), "should flush once");
+        assert_eq!(
+            measurement.cookie_header_bytes(),
+            cookie.len(),
+            "should hold the inbound Cookie header size"
+        );
+        assert_eq!(
+            measurement.kv_reads(),
+            2,
+            "should count the phase 1 read and the pending-key read"
+        );
+        assert_eq!(measurement.kv_writes(), 1, "should count the one write");
+        assert_eq!(
+            measurement.route(),
+            RouteKind::Writer,
+            "should label a returning navigation as the writer"
+        );
+        assert_eq!(
+            measurement.flush(),
+            Some(FlushOutcome::Written),
+            "should hold the phase 4 outcome"
+        );
+        assert_eq!(measurement.removal_lost(), 0, "should lose no removal");
         assert!(
-            result.is_none(),
-            "a skipped pull-sync plan should return none"
+            !measurement.withdrawal_after_send() && !measurement.withdrawal_after_send_failed(),
+            "should need no after-send withdrawal run"
         );
-        assert_eq!(calls.get(), 0, "should not invoke the graph factory");
     }
 
     #[test]
-    fn trace_path_classification_survives_core_request_conversion() {
-        // `main` skips client-IP sanitization when the native path is a trace
+    fn identity_measurement_holds_no_identifier() {
+        let (state, _store) = seeded_state();
+        let cookie = format!("ts-ec={EC_ID}; ts-eids=secret-uid-value");
+
+        let (_, measurement) = drive_measured_for_test(&state, navigation(Some(&cookie)));
+        let line = measurement.to_string();
+
+        assert!(
+            line.contains(&format!("cookie_header_bytes={}", cookie.len())),
+            "should still carry the cookie size: {line}"
+        );
+        assert!(!line.contains(EC_ID), "should not hold the EC ID: {line}");
+        assert!(
+            !line.contains("secret-uid-value"),
+            "should not hold a cookie value: {line}"
+        );
+    }
+
+    #[test]
+    fn drive_request_for_test_counts_routing_finalize_and_flush_against_one_store() {
+        let (state, store) = seeded_state();
+
+        let (_, outcome) =
+            drive_request_for_test(&state, navigation(Some(&format!("ts-ec={EC_ID}"))));
+
+        assert_eq!(outcome, Some(FlushOutcome::Written), "should flush once");
+        let writes = store.writes();
+        assert_eq!(writes.lookups, 1, "should read the row once, in phase 1");
+        assert_eq!(
+            writes.if_generation_match, 1,
+            "should write once with a CAS"
+        );
+        assert_eq!(writes.total(), 1, "should make no other write");
+    }
+
+    #[test]
+    fn finalize_send_and_flush_sends_before_it_flushes() {
+        let (state, store) = seeded_state();
+        let router = TrustedServerApp::routes_for_state(&state);
+        let mut response = futures::executor::block_on(
+            router.oneshot(navigation(Some(&format!("ts-ec={EC_ID}")))),
+        )
+        .expect("should route the request");
+        let mut ec_state = response
+            .extensions_mut()
+            .remove::<EcFinalizeState>()
+            .expect("should carry EC state");
+        let writes_at_send = std::cell::Cell::new(None);
+        let timings = RequestTimings::new();
+        let graph = || state.identity_graph.clone();
+
+        let outcome = finalize_send_and_flush(
+            PostRouteInput {
+                runtime: Some(&state.identity),
+                settings: &state.settings,
+                ec_state: &mut ec_state,
+                graph: &graph,
+                rate_limiter: &AllowAll,
+                timings: Some(&timings),
+            },
+            response,
+            &mut |_| writes_at_send.set(Some(store.writes().total())),
+        );
+
+        assert_eq!(
+            writes_at_send.get(),
+            Some(0),
+            "should send before any write"
+        );
+        assert_eq!(outcome, Some(FlushOutcome::Written), "should then flush");
+        assert_eq!(store.writes().total(), 1, "should write once");
+        assert!(
+            timings.snapshot().kv_ms.is_none(),
+            "the after-send flush must not add request-path KV timing"
+        );
+    }
+
+    #[test]
+    fn after_send_noop_states_skip_post_send_graph_factory() {
+        let (state, _) = seeded_state();
+        let router = TrustedServerApp::routes_for_state(&state);
+        // A named route is never the writer, so phase 4 has nothing to do.
+        let request = edgezero_core::http::request_builder()
+            .method(edgezero_core::http::Method::GET)
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/.well-known/trusted-server.json") // allow-domain: test-publisher.com
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        let mut response =
+            futures::executor::block_on(router.oneshot(request)).expect("should route");
+        let mut ec_state = response
+            .extensions_mut()
+            .remove::<EcFinalizeState>()
+            .expect("should carry EC state");
+        ec_state.use_finalize_kv = false;
+        let calls = std::cell::Cell::new(0);
+        let graph = || {
+            calls.set(calls.get() + 1);
+            None
+        };
+
+        let outcome = finalize_send_and_flush(
+            PostRouteInput {
+                runtime: Some(&state.identity),
+                settings: &state.settings,
+                ec_state: &mut ec_state,
+                graph: &graph,
+                rate_limiter: &AllowAll,
+                timings: None,
+            },
+            response,
+            &mut drop,
+        );
+
+        assert_eq!(outcome, Some(FlushOutcome::Skipped), "should skip phase 4");
+        assert_eq!(calls.get(), 0, "should not build the graph");
+    }
+
+    #[test]
+    fn no_response_sets_or_reads_the_pull_complete_cookie() {
+        let (state, store) = seeded_state();
+        let cookie = format!("ts-ec={EC_ID}; ts-ec-pull-complete=v1.example");
+
+        let (response, _) = drive_request_for_test(&state, navigation(Some(&cookie)));
+
+        assert!(
+            response
+                .headers()
+                .get_all("set-cookie")
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .all(|value| !value.starts_with("ts-ec-pull-complete")),
+            "should set no pull-complete cookie"
+        );
+        assert_eq!(
+            store.writes().lookups,
+            1,
+            "should read the row whatever the old marker cookie says"
+        );
+
+        let (withdrawn, _) = drive_with_runtime(
+            &state,
+            navigation(Some(&cookie)),
+            Some(&state.identity),
+            withdraw,
+        );
+        let cookies = set_cookies(&withdrawn);
+        assert!(
+            cookies
+                .iter()
+                .any(|value| value.starts_with("ts-ec=;") && value.contains("Max-Age=0")),
+            "control: finalize should still expire ts-ec on a withdrawal: {cookies:?}"
+        );
+        assert!(
+            cookies
+                .iter()
+                .all(|value| !value.starts_with("ts-ec-pull-complete")),
+            "should not expire a pull-complete cookie either: {cookies:?}"
+        );
+    }
+
+    /// Turns the request's consent into an explicit withdrawal (GPC in a US
+    /// state). Viceroy has no geo, so routing alone cannot produce one.
+    fn withdraw(ec_state: &mut EcFinalizeState) {
+        let consent = ec_state.ec_context.consent_mut();
+        consent.jurisdiction =
+            trusted_server_core::consent::jurisdiction::Jurisdiction::UsState("CA".to_owned());
+        consent.gpc = true;
+    }
+
+    fn set_cookies(response: &HttpResponse) -> Vec<String> {
+        response
+            .headers()
+            .get_all("set-cookie")
+            .iter()
+            .filter_map(|value| value.to_str().ok().map(str::to_owned))
+            .collect()
+    }
+
+    #[test]
+    fn reload_without_identity_runtime_still_finalizes() {
+        let (state, _) = seeded_state();
+
+        let (response, outcome) = drive_with_runtime(
+            &state,
+            navigation(Some(&format!("ts-ec={EC_ID}"))),
+            None,
+            withdraw,
+        );
+
+        let cookies = set_cookies(&response);
+        assert!(
+            cookies
+                .iter()
+                .any(|value| value.starts_with("ts-ec=;") && value.contains("Max-Age=0")),
+            "should still finalize and expire ts-ec without a runtime: {cookies:?}"
+        );
+        let (row, _) = state
+            .identity_graph
+            .as_ref()
+            .expect("should hold the graph")
+            .get(EC_ID)
+            .expect("should read the row")
+            .expect("should keep the tombstone");
+        assert!(!row.consent.ok, "should still tombstone the row");
+        assert_eq!(outcome, Some(FlushOutcome::Skipped), "should skip phase 4");
+    }
+
+    #[test]
+    fn trace_path_classification_survives_core_request_conversion() {
+        // `main` skips client-IP sanitization when the native path is a trace
         // path; the router hook later classifies the converted URI. Both must
         // agree, or unsanitized forwarded headers could reach ordinary dispatch.
         for url in [
@@ -1215,6 +2294,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn health_short_circuit_is_get_only_and_ignores_query() {
+        for path in ["/health", "/health?probe=1"] {
+            let url = format!("https://example.com{path}");
+            assert!(
+                health_response(&FastlyRequest::get(&url)).is_some(),
+                "should bypass GET health"
+            );
+            assert!(
+                health_response(&FastlyRequest::post(&url)).is_none(),
+                "should time non-GET health normally"
+            );
+        }
+    }
+
     #[test]
     fn health_response_reports_git_version_only() {
         let req = FastlyRequest::get("https://example.com/health");
@@ -1357,6 +2451,31 @@ mod tests {
         assert!(response.headers().get("etag").is_none());
     }
 
+    #[test]
+    fn send_freeze_applies_filter_effects_before_server_timing_privacy_gate() {
+        let mut response = response_builder()
+            .header("cache-control", "private, no-store")
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        let effects = RequestFilterEffects {
+            request_headers: Vec::new(),
+            response_headers: vec![HeaderMutation::set(
+                "cache-control",
+                "public, s-maxage=3600",
+            )],
+        };
+        let context = send_context_fixture();
+        drop(context.timings.span(Phase::Origin));
+
+        finalize_send_response_headers(&mut response, Some(&effects), &context.timings, true);
+
+        assert_eq!(response.headers()["cache-control"], "public, s-maxage=3600");
+        assert!(
+            response.headers().get("server-timing").is_none(),
+            "late public cache policy must be visible to the Server-Timing privacy gate"
+        );
+    }
+
     #[test]
     fn late_filter_effects_cannot_make_a_page_bids_response_public() {
         let mut response = trusted_server_core::publisher::page_bids_preflight_denied();
@@ -1516,9 +2635,10 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build response");
 
-        let geo_info = resolve_geo_for_response(&response, None, |_| {
-            panic!("should skip entry-point geo lookup for 401 responses");
-        });
+        let geo_info =
+            resolve_geo_for_response(&response, &GeoLookupState::NotAttempted, None, |_| {
+                panic!("should skip entry-point geo lookup for 401 responses");
+            });
         apply_finalize_headers(&settings, geo_info.as_ref(), &mut response);
 
         assert_eq!(
@@ -1584,4 +2704,4373 @@ mod tests {
             "should include sec-ch-ua-platform fallback"
         );
     }
+
+    fn ec_finalize_settings() -> Settings {
+        Settings::from_toml(
+            r#"
+            [[handlers]]
+            path = "^/_ts/admin"
+            username = "admin"
+            password = "admin-pass"
+
+            [publisher]
+            domain = "test-publisher.com"
+            cookie_domain = ".test-publisher.com"
+            # Keep the host aligned with the shared settings fixture.
+            origin_url = "https://origin.test-publisher.com" # allow-domain: origin.test-publisher.com
+            proxy_secret = "unit-test-proxy-secret"
+
+            [ec]
+            passphrase = "test-secret-key-32-bytes-minimum"
+            ec_store = "ec_identity_store"
+
+            [[ec.partners]]
+            name = "Example Partner"
+            source_domain = "example.com"
+            api_token = "test-vendor-token-32-bytes-minimum"
+
+            [request_signing]
+            enabled = false
+            config_store_id = "test-config-store-id"
+            secret_store_id = "test-secret-store-id"
+            "#,
+        )
+        .expect("should parse EC finalize test settings")
+    }
+
+    /// Minimal `RuntimeServices` for `EcFinalizeState.services`. Real
+    /// `FastlyPlatform*` handles are used as inert placeholders: EC
+    /// finalization never calls through them, it only satisfies the field.
+    fn inert_runtime_services() -> RuntimeServices {
+        RuntimeServices::builder()
+            .config_store(Arc::new(crate::platform::FastlyPlatformConfigStore))
+            .secret_store(Arc::new(crate::platform::FastlyPlatformSecretStore))
+            .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore)
+                as Arc<dyn trusted_server_core::platform::PlatformKvStore>)
+            .backend(Arc::new(crate::platform::FastlyPlatformBackend))
+            .http_client(Arc::new(
+                crate::platform::FastlyPlatformHttpClient::default(),
+            ))
+            .geo(Arc::new(crate::platform::FastlyPlatformGeo))
+            .client_info(trusted_server_core::platform::ClientInfo::default())
+            .build()
+    }
+
+    #[test]
+    fn ec_finalize_kv_lands_before_freeze() {
+        // A pre-seeded EC entry (see fastly.toml's ec_identity_store fixture)
+        // for a returning user carrying an eids cookie. Finalize confirms a
+        // stale pre-route miss before headers freeze. Ordinary browser ingest
+        // now queues for the after-send flush instead of writing here.
+        let settings = ec_finalize_settings();
+        let ec_id = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01";
+        let eids = serde_json::json!([{
+            "source": "example.com",
+            "uids": [{ "id": "example-uid", "atype": 1 }]
+        }]);
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(eids.to_string());
+        let request = edgezero_core::http::request_builder()
+            .method(fastly::http::Method::GET)
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/article") // allow-domain: test-publisher.com
+            .header("cookie", format!("ts-ec={ec_id}; ts-eids={eids_cookie}"))
+            .body(EdgeBody::empty())
+            .expect("should build EC finalize test request");
+
+        let services = inert_runtime_services();
+        let geo_info = trusted_server_core::platform::GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        };
+        let mut ec_context = trusted_server_core::ec::EcContext::read_from_request_with_geo(
+            &settings,
+            &request,
+            &services,
+            Some(&geo_info),
+        )
+        .expect("should read EC context from a non-regulated request");
+        assert!(
+            ec_context.ec_was_present(),
+            "the pre-seeded ts-ec cookie should be recognized"
+        );
+        ec_context.set_eid_sync_source(trusted_server_core::ec::EidSyncSource::Navigation);
+        ec_context.set_recovery_eligible(true);
+        ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
+            ec_id: ec_id.to_owned(),
+        });
+
+        let mut ec_state = EcFinalizeState {
+            ec_context,
+            use_finalize_kv: true,
+            eids_cookie: Some(eids_cookie),
+            sharedid_cookie: None,
+            is_real_browser: true,
+            services,
+        };
+        let response = response_builder()
+            .header("cache-control", "private, no-store")
+            .body(EdgeBody::empty())
+            .expect("should build EC finalize response fixture");
+        let timings = RequestTimings::new();
+
+        // Exercise the production finalize/send/flush boundary without a
+        // live client connection. Header timing freezes in the send callback.
+        let graph = || require_identity_graph(&settings).ok();
+        let mut sent = None;
+        finalize_send_and_flush(
+            PostRouteInput {
+                runtime: None,
+                settings: &settings,
+                ec_state: &mut ec_state,
+                graph: &graph,
+                rate_limiter: &AllowAll,
+                timings: Some(&timings),
+            },
+            response,
+            &mut |mut response| {
+                apply_server_timing_header(&mut response, &timings, true);
+                sent = Some(response);
+            },
+        );
+        let response = sent.expect("should send the finalized response");
+        let header = response
+            .headers()
+            .get("server-timing")
+            .and_then(|v| v.to_str().ok())
+            .expect("should emit a Server-Timing header");
+        assert!(
+            header.contains("ts-kv"),
+            "the freeze point must run after EC finalization recorded KV time: {header}"
+        );
+    }
+
+    #[test]
+    fn streamed_delivery_row_reports_bytes_and_request_elapsed() {
+        let timings = RequestTimings::new();
+        let body = EdgeBody::stream(futures::stream::iter(vec![
+            bytes::Bytes::from_static(b"hello "),
+            bytes::Bytes::from_static(b"world"),
+        ]));
+
+        let (counting, drive_result) = drive_streaming_body(body, Vec::new(), &timings);
+        drive_result.expect("streaming a well-formed body should not fail");
+        let bytes = counting.bytes();
+        let outcome = DeliveryOutcome {
+            result: DeliveryResult::Complete,
+            snapshot: Some(AccessTelemetrySnapshot {
+                body_mode: "streamed",
+                ..sample_access_snapshot()
+            }),
+        };
+
+        assert_eq!(
+            counting.into_inner(),
+            b"hello world",
+            "should write every byte to the underlying transport"
+        );
+        assert_eq!(
+            bytes,
+            "hello world".len() as u64,
+            "should count bytes accepted by the underlying transport"
+        );
+
+        let snapshot = timings.snapshot();
+        let row: serde_json::Value = serde_json::from_str(&access_event_row(
+            outcome
+                .snapshot
+                .as_ref()
+                .expect("should capture access dimensions"),
+            &snapshot,
+            outcome.result,
+            0,
+        ))
+        .expect("should parse the emitted delivery row");
+        assert_eq!(row["delivery_result"], "complete");
+        assert_eq!(row["resp_bytes"], bytes);
+        assert_eq!(
+            snapshot.resp_bytes,
+            Some("hello world".len() as u64),
+            "should stamp resp_bytes to the tallied byte count"
+        );
+        assert!(
+            snapshot.request_elapsed_ms.is_some(),
+            "should stamp request_elapsed once the drive returns"
+        );
+    }
+
+    #[test]
+    fn buffered_delivery_stamps_bytes_and_request_elapsed() {
+        let timings = RequestTimings::new();
+        let body = EdgeBody::from(b"a buffered body".to_vec());
+
+        let bytes = record_buffered_delivery(&body, &timings);
+
+        assert_eq!(
+            bytes,
+            "a buffered body".len() as u64,
+            "should report the buffered body length"
+        );
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.resp_bytes,
+            Some("a buffered body".len() as u64),
+            "should stamp resp_bytes for the buffered path too"
+        );
+        assert!(
+            snapshot.request_elapsed_ms.is_some(),
+            "should stamp request_elapsed for the buffered path too"
+        );
+    }
+
+    fn send_context_fixture() -> SendContext<'static> {
+        SendContext {
+            timings: RequestTimings::new(),
+            server_timing_enabled: false,
+            method: "GET",
+            publisher_domain: "publisher.example.com",
+            access_sample_rate: 0.25,
+            access_telemetry_enabled: true,
+        }
+    }
+
+    #[test]
+    fn disabled_access_telemetry_skips_entropy_and_snapshot_work() {
+        let mut context = send_context_fixture();
+        context.access_telemetry_enabled = false;
+
+        let snapshot = sampled_access_snapshot(
+            &context,
+            || panic!("disabled telemetry should not draw entropy"),
+            || panic!("disabled telemetry should not construct dimensions"),
+        );
+
+        assert!(snapshot.is_none(), "should not build a disabled snapshot");
+    }
+
+    #[test]
+    fn sampled_out_access_telemetry_skips_snapshot_and_transport() {
+        let context = send_context_fixture();
+        let snapshot = sampled_access_snapshot(
+            &context,
+            || context.access_sample_rate,
+            || panic!("sampled-out telemetry should not construct dimensions"),
+        );
+        assert!(snapshot.is_none(), "should exclude the sampling boundary");
+        let mut settings = test_settings();
+        settings.tinybird.api_host = "ingest.example.com".to_owned();
+        settings.tinybird.enabled = true;
+        settings.tinybird.access_enabled = true;
+        settings.tinybird.access_token_secret = Some(trusted_server_core::redacted::Redacted::new(
+            "access-append-token".to_owned(),
+        ));
+        let http_client = RecordingAccessHttpClient::default();
+        emit_access_telemetry_after_send(
+            &http_client,
+            &settings,
+            &DeliveryOutcome {
+                result: DeliveryResult::Complete,
+                snapshot,
+            },
+            &context.timings,
+        );
+
+        assert!(
+            http_client
+                .requests
+                .lock()
+                .expect("should lock recorded requests")
+                .is_empty(),
+            "should not dispatch access telemetry for a sampled-out response"
+        );
+    }
+
+    #[test]
+    fn access_telemetry_setup_error_skips_transport_without_panicking() {
+        let mut settings = test_settings();
+        settings.tinybird.api_host = "ingest.example.com".to_owned();
+        settings.tinybird.enabled = true;
+        settings.tinybird.access_enabled = true;
+        settings.tinybird.access_token_secret = None;
+        let http_client = RecordingAccessHttpClient::default();
+
+        emit_access_telemetry_after_send(
+            &http_client,
+            &settings,
+            &DeliveryOutcome {
+                result: DeliveryResult::Complete,
+                snapshot: Some(sample_access_snapshot()),
+            },
+            &RequestTimings::new(),
+        );
+
+        assert!(
+            http_client
+                .requests
+                .lock()
+                .expect("should lock recorded requests")
+                .is_empty(),
+            "should not dispatch access telemetry without a resolved token"
+        );
+    }
+
+    #[test]
+    fn access_telemetry_dispatch_is_gated_and_best_effort() {
+        for (enabled, access_enabled) in [(false, true), (true, false), (true, true)] {
+            let mut settings = test_settings();
+            settings.tinybird.api_host = "ingest.example.com".to_owned();
+            settings.tinybird.enabled = enabled;
+            settings.tinybird.access_enabled = access_enabled;
+            settings.tinybird.access_token_secret = Some(
+                trusted_server_core::redacted::Redacted::new("access-append-token".to_owned()),
+            );
+            let http_client = RecordingAccessHttpClient::default();
+
+            emit_access_telemetry_after_send(
+                &http_client,
+                &settings,
+                &DeliveryOutcome {
+                    result: DeliveryResult::Complete,
+                    snapshot: Some(sample_access_snapshot()),
+                },
+                &RequestTimings::new(),
+            );
+
+            assert_eq!(
+                http_client
+                    .requests
+                    .lock()
+                    .expect("should lock recorded requests")
+                    .len(),
+                usize::from(enabled && access_enabled),
+                "should dispatch once only when both toggles are enabled, without retrying errors"
+            );
+        }
+    }
+
+    #[test]
+    fn sampled_in_snapshot_records_the_exact_rate_and_draws_once() {
+        let context = send_context_fixture();
+        let response = response_builder()
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        let draws = std::cell::Cell::new(0);
+        let builds = std::cell::Cell::new(0);
+
+        let snapshot = sampled_access_snapshot(
+            &context,
+            || {
+                draws.set(draws.get() + 1);
+                0.0
+            },
+            || {
+                builds.set(builds.get() + 1);
+                build_access_telemetry_snapshot(&response, &context)
+            },
+        )
+        .expect("should include zero entropy at a positive rate");
+
+        assert_eq!(draws.get(), 1, "should sample exactly once");
+        assert_eq!(builds.get(), 1, "should build one sampled snapshot");
+        assert_eq!(snapshot.sample_rate, context.access_sample_rate);
+    }
+
+    #[test]
+    fn access_snapshot_defaults_when_no_extensions_are_attached() {
+        // Router-generated 404/405 responses and other paths that never pass
+        // through a RouteMetadata-attaching wrapper must still produce a
+        // usable snapshot: RouteClass::Other and "unknown" sentinels, never
+        // a missing/panicking build.
+        let response = response_builder()
+            .status(404)
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        let context = send_context_fixture();
+
+        let snapshot = build_access_telemetry_snapshot(&response, &context);
+
+        assert_eq!(snapshot.status, 404);
+        assert_eq!(snapshot.method, "GET");
+        assert!(matches!(snapshot.route_class, RouteClass::Other));
+        assert_eq!(snapshot.route_template, "unknown");
+        assert_eq!(snapshot.country, "unknown");
+        assert_eq!(snapshot.template_cache_state, "unknown");
+        assert_eq!(snapshot.body_mode, "buffered");
+        assert_eq!(snapshot.publisher_domain, "publisher.example.com");
+        assert_eq!(snapshot.sample_rate, 0.25);
+    }
+
+    #[test]
+    fn access_snapshot_reads_route_geo_and_template_cache_extensions() {
+        let mut response = response_builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        response.extensions_mut().insert(RouteMetadata {
+            route_class: RouteClass::AuctionApi,
+            route_template: "/auction".to_owned(),
+        });
+        response.extensions_mut().insert(GeoLookupState::Resolved(
+            trusted_server_core::platform::GeoInfo {
+                city: String::new(),
+                country: "US".to_owned(),
+                continent: "NorthAmerica".to_owned(),
+                latitude: 0.0,
+                longitude: 0.0,
+                metro_code: 0,
+                region: None,
+                asn: None,
+            },
+        ));
+        response
+            .extensions_mut()
+            .insert(TemplateCacheResponseState::Hit);
+        let context = send_context_fixture();
+
+        let snapshot = build_access_telemetry_snapshot(&response, &context);
+
+        assert!(matches!(snapshot.route_class, RouteClass::AuctionApi));
+        assert_eq!(snapshot.route_template, "/auction");
+        assert_eq!(snapshot.country, "US");
+        assert_eq!(snapshot.template_cache_state, "hit");
+    }
+
+    #[test]
+    fn entry_point_404_finalization_writes_geo_state_before_access_snapshot() {
+        let settings = Settings::default();
+        let timings = RequestTimings::new();
+        let resolved_geo = trusted_server_core::platform::GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        };
+
+        for (geo_state, expected_country) in [
+            (GeoLookupState::NotAttempted, "unknown"),
+            (GeoLookupState::Resolved(resolved_geo), "US"),
+        ] {
+            let mut response = response_builder()
+                .status(404)
+                .body(EdgeBody::empty())
+                .expect("should build router 404");
+
+            apply_entry_point_finalize_headers(
+                &settings,
+                &mut response,
+                None,
+                &geo_state,
+                &timings,
+            );
+
+            match (geo_state, response.extensions().get::<GeoLookupState>()) {
+                (GeoLookupState::NotAttempted, Some(GeoLookupState::Attempted)) => {}
+                (GeoLookupState::Resolved(expected), Some(GeoLookupState::Resolved(actual))) => {
+                    assert_eq!(actual.country, expected.country)
+                }
+                (_, actual) => {
+                    panic!("should write back the entry-point geo result, got {actual:?}")
+                }
+            }
+            let snapshot = build_access_telemetry_snapshot(&response, &send_context_fixture());
+            assert_eq!(
+                snapshot.status, 404,
+                "should preserve the router 404 status"
+            );
+            assert_eq!(snapshot.country, expected_country);
+        }
+    }
+
+    #[test]
+    fn access_snapshot_treats_attempted_geo_lookup_as_unknown_country() {
+        let mut response = response_builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        response.extensions_mut().insert(GeoLookupState::Attempted);
+        let context = send_context_fixture();
+
+        let snapshot = build_access_telemetry_snapshot(&response, &context);
+
+        assert_eq!(
+            snapshot.country, "unknown",
+            "an attempted-but-unresolved lookup must not surface a stale country"
+        );
+    }
+
+    #[test]
+    fn access_snapshot_body_mode_reflects_the_response_body_variant() {
+        let streamed = response_builder()
+            .status(200)
+            .body(EdgeBody::stream(futures::stream::empty()))
+            .expect("should build streaming response");
+        let buffered = response_builder()
+            .status(200)
+            .body(EdgeBody::from(b"hi".to_vec()))
+            .expect("should build buffered response");
+        let context = send_context_fixture();
+
+        assert_eq!(
+            build_access_telemetry_snapshot(&streamed, &context).body_mode,
+            "streamed"
+        );
+        assert_eq!(
+            build_access_telemetry_snapshot(&buffered, &context).body_mode,
+            "buffered"
+        );
+    }
+
+    #[test]
+    fn stream_drive_records_stream_ms_covering_the_in_stream_auction_wait() {
+        // A streaming seam wait (Task 6, publisher.rs) records into the same
+        // `RequestTimings` handle the adapter drives with. `Phase::Stream`
+        // wraps the entire drive, so it must cover — and therefore be at
+        // least as large as — any `AuctionWait` recorded while the body was
+        // being polled.
+        let timings = RequestTimings::new();
+        let wait_timings = timings.clone();
+        let stream = futures::stream::once(async move {
+            let waited = Duration::from_millis(5);
+            std::thread::sleep(waited);
+            wait_timings.record_auction_wait(AuctionWaitPlacement::InStream, waited);
+            bytes::Bytes::from_static(b"<html></html>")
+        });
+        let body = EdgeBody::stream(stream);
+
+        let (_counting, drive_result) = drive_streaming_body(body, Vec::new(), &timings);
+        drive_result.expect("streaming a well-formed body should not fail");
+
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::InStream),
+            "should preserve the placement recorded from inside the polled body"
+        );
+        let auction_wait_ms = snapshot
+            .auction_wait_ms
+            .expect("should record the auction wait");
+        let stream_ms = snapshot.stream_ms.expect("should record the stream drive");
+        assert!(
+            stream_ms >= auction_wait_ms,
+            "the drive's Phase::Stream span must cover the in-stream auction wait: \
+             stream_ms={stream_ms} auction_wait_ms={auction_wait_ms}"
+        );
+    }
+
+    #[test]
+    fn failed_stream_drives_emit_partial_or_error_rows_with_actual_bytes() {
+        for (prefix, expected) in [(&b"example"[..], "partial"), (&b""[..], "error")] {
+            let mut chunks = Vec::new();
+            if !prefix.is_empty() {
+                chunks.push(Ok(bytes::Bytes::copy_from_slice(prefix)));
+            }
+            chunks.push(Err(std::io::Error::other("example stream failure")));
+            let body = EdgeBody::from_stream(futures::stream::iter(chunks));
+            let timings = RequestTimings::new();
+            let (writer, drive_result) = drive_streaming_body(body, Vec::new(), &timings);
+            assert!(drive_result.is_err(), "should observe the stream failure");
+            let result = classify_stream_delivery(&drive_result, writer.bytes());
+            let snapshot = AccessTelemetrySnapshot {
+                body_mode: "streamed",
+                ..sample_access_snapshot()
+            };
+            let row: serde_json::Value =
+                serde_json::from_str(&access_event_row(&snapshot, &timings.snapshot(), result, 0))
+                    .expect("should parse the failed delivery row");
+            assert_eq!(row["delivery_result"], expected);
+            assert_eq!(row["resp_bytes"], prefix.len());
+            assert_eq!(row["status"], 200, "should retain the already-sent status");
+        }
+    }
+
+    #[test]
+    fn stream_finish_results_reach_the_access_row() {
+        for (finish_result, expected) in [
+            (Ok(()), "complete"),
+            (
+                Err(std::io::Error::other("example finish failure")),
+                "partial",
+            ),
+        ] {
+            let result = classify_stream_finish(finish_result, "");
+            let row: serde_json::Value = serde_json::from_str(&access_event_row(
+                &sample_access_snapshot(),
+                &Default::default(),
+                result,
+                0,
+            ))
+            .expect("should parse the transport finish row");
+            assert_eq!(row["delivery_result"], expected);
+        }
+    }
+
+    #[test]
+    fn classify_stream_delivery_treats_bytes_written_before_an_error_as_partial() {
+        let err = Report::new(TrustedServerError::Proxy {
+            message: "boom".to_string(),
+        });
+        assert_eq!(
+            classify_stream_delivery(&Err(err), 42),
+            DeliveryResult::Partial,
+            "bytes already on the wire before a stream error is a truncated delivery"
+        );
+    }
+
+    #[test]
+    fn classify_stream_delivery_treats_an_error_with_no_bytes_as_error() {
+        let err = Report::new(TrustedServerError::Proxy {
+            message: "boom".to_string(),
+        });
+        assert_eq!(
+            classify_stream_delivery(&Err(err), 0),
+            DeliveryResult::Error,
+            "a failure before any byte reached the client is a clean failure, not a truncation"
+        );
+    }
+
+    #[test]
+    fn classify_stream_delivery_treats_ok_as_complete() {
+        assert_eq!(
+            classify_stream_delivery(&Ok(()), 123),
+            DeliveryResult::Complete
+        );
+    }
+
+    #[test]
+    fn post_send_order_is_elapsed_then_pull_sync_then_telemetry() {
+        // The full contract sequence, instrumented through the real seams:
+        // `send_edgezero_response` stamps `request_elapsed` before
+        // returning, and `run_post_send_steps` (which every production
+        // site with both steps routes through) owns pull-sync-then-
+        // telemetry ordering.
+        let log: Arc<Mutex<Vec<&'static str>>> = Arc::new(Mutex::new(Vec::new()));
+        let timings = RequestTimings::new();
+        let response = response_builder()
+            .body(EdgeBody::from("ok"))
+            .expect("should build response");
+
+        let outcome = send_edgezero_response(
+            response,
+            None,
+            &SendContext {
+                timings: timings.clone(),
+                server_timing_enabled: false,
+                method: "GET",
+                publisher_domain: "publisher.example.com",
+                access_sample_rate: 1.0,
+                access_telemetry_enabled: true,
+            },
+            None,
+        );
+        assert!(
+            timings.snapshot().request_elapsed_ms.is_some(),
+            "request_elapsed should be stamped before any post-send step runs"
+        );
+        assert!(
+            outcome.snapshot.is_some(),
+            "the access snapshot should exist for the enabled context"
+        );
+
+        let pull_log = Arc::clone(&log);
+        let emit_log = Arc::clone(&log);
+        run_post_send_steps(
+            move || {
+                pull_log
+                    .lock()
+                    .expect("should lock order log")
+                    .push("pull_sync")
+            },
+            move |_| {
+                emit_log
+                    .lock()
+                    .expect("should lock order log")
+                    .push("telemetry")
+            },
+        );
+
+        assert_eq!(
+            *log.lock().expect("should lock order log"),
+            vec!["pull_sync", "telemetry"],
+            "pull-sync must dispatch before telemetry emits"
+        );
+    }
+    /// End-to-end proof of the one-write invariant, the reads and G10 and
+    /// G13 (spec 13). Every test routes a request through the real router,
+    /// finalizes and sends it, and runs phase 4, against one counting store.
+    mod identity_writes {
+        use super::*;
+        use std::collections::BTreeMap;
+        use std::sync::Mutex;
+
+        use trusted_server_core::ec::identity::IdentityProviderError;
+        use trusted_server_core::ec::identity::test_support::{
+            MULTI_ENTRY_SOURCE, MultiEntryTestProvider, WriteCountingEcKv, allowing_consent,
+        };
+        use trusted_server_core::ec::kv_backend::EcKvStore as _;
+        use trusted_server_core::ec::kv_types::{
+            KvEid, KvEntry, KvNetwork, KvOptOut, KvPartnerId, KvProviderState, KvUid,
+        };
+        use trusted_server_core::integrations::IntegrationRegistration;
+        use trusted_server_core::platform::{
+            GeoInfo, PlatformError, PlatformGeo, PlatformHttpClient, PlatformHttpRequest,
+            PlatformPendingRequest, PlatformResponse, PlatformSelectResult,
+        };
+        use trusted_server_core::settings::{EcPartner, ProviderMode, ProviderSettings};
+
+        /// The host the publisher origin answers on.
+        const ORIGIN_HOST: &str = "origin.test-publisher.com";
+
+        /// A cookie value no test treats as a real ID.
+        const SHARED_ID: &str = "shared-id-1";
+
+        /// One answer of the scripted network.
+        #[derive(Clone)]
+        struct Reply {
+            status: u16,
+            headers: Vec<(String, String)>,
+            body: Vec<u8>,
+        }
+
+        /// One request the scripted network received.
+        #[derive(Clone)]
+        struct Seen {
+            host: String,
+            headers: edgezero_core::http::HeaderMap,
+            body: Vec<u8>,
+        }
+
+        struct Pending {
+            reply: Reply,
+            backend_name: String,
+        }
+
+        /// A network that answers per host and records what it was sent. It
+        /// stands in for the publisher origin, the bidders and the pull
+        /// partners.
+        struct ScriptedNetwork {
+            replies: Mutex<BTreeMap<String, Reply>>,
+            seen: Mutex<Vec<Seen>>,
+        }
+
+        impl ScriptedNetwork {
+            fn new() -> Self {
+                Self {
+                    replies: Mutex::new(BTreeMap::new()),
+                    seen: Mutex::new(Vec::new()),
+                }
+            }
+
+            fn respond(&self, host: &str, status: u16, content_type: &str, body: &str) {
+                self.respond_with_headers(host, status, &[("content-type", content_type)], body);
+            }
+
+            fn respond_with_headers(
+                &self,
+                host: &str,
+                status: u16,
+                headers: &[(&str, &str)],
+                body: &str,
+            ) {
+                self.replies
+                    .lock()
+                    .expect("should lock the replies")
+                    .insert(
+                        host.to_owned(),
+                        Reply {
+                            status,
+                            headers: headers
+                                .iter()
+                                .map(|(name, value)| ((*name).to_owned(), (*value).to_owned()))
+                                .collect(),
+                            body: body.as_bytes().to_vec(),
+                        },
+                    );
+            }
+
+            /// Forgets the answer for `host`, so a call to it fails in transport.
+            fn clear_reply(&self, host: &str) {
+                self.replies
+                    .lock()
+                    .expect("should lock the replies")
+                    .remove(host);
+            }
+
+            /// Every request that went to `host`, in order.
+            fn requests_to(&self, host: &str) -> Vec<Seen> {
+                self.seen
+                    .lock()
+                    .expect("should lock the requests")
+                    .iter()
+                    .filter(|seen| seen.host == host)
+                    .cloned()
+                    .collect()
+            }
+
+            /// Records `request` and returns its answer with the backend it named.
+            fn record(
+                &self,
+                request: PlatformHttpRequest,
+            ) -> Result<(Reply, String), Report<PlatformError>> {
+                let backend_name = request.backend_name;
+                let (parts, body) = request.request.into_parts();
+                let host = parts.uri.host().unwrap_or_default().to_owned();
+                self.seen
+                    .lock()
+                    .expect("should lock the requests")
+                    .push(Seen {
+                        host: host.clone(),
+                        headers: parts.headers,
+                        body: body
+                            .into_bytes()
+                            .map(|bytes| bytes.to_vec())
+                            .unwrap_or_default(),
+                    });
+                self.replies
+                    .lock()
+                    .expect("should lock the replies")
+                    .get(&host)
+                    .cloned()
+                    .map(|reply| (reply, backend_name))
+                    .ok_or_else(|| Report::new(PlatformError::HttpClient))
+            }
+        }
+
+        fn platform_response(
+            reply: Reply,
+            backend_name: String,
+        ) -> Result<PlatformResponse, Report<PlatformError>> {
+            let mut builder = edgezero_core::http::response_builder().status(reply.status);
+            for (name, value) in reply.headers {
+                builder = builder.header(name, value);
+            }
+            builder
+                .body(EdgeBody::from(reply.body))
+                .map(|response| PlatformResponse::new(response).with_backend_name(backend_name))
+                .map_err(|_| Report::new(PlatformError::HttpClient))
+        }
+
+        #[async_trait::async_trait(?Send)]
+        impl PlatformHttpClient for ScriptedNetwork {
+            async fn send(
+                &self,
+                request: PlatformHttpRequest,
+            ) -> Result<PlatformResponse, Report<PlatformError>> {
+                let (reply, backend_name) = self.record(request)?;
+                platform_response(reply, backend_name)
+            }
+
+            async fn send_async(
+                &self,
+                request: PlatformHttpRequest,
+            ) -> Result<PlatformPendingRequest, Report<PlatformError>> {
+                let (reply, backend_name) = self.record(request)?;
+                Ok(PlatformPendingRequest::new(Pending {
+                    reply,
+                    backend_name: backend_name.clone(),
+                })
+                .with_backend_name(backend_name))
+            }
+
+            async fn select(
+                &self,
+                mut pending_requests: Vec<PlatformPendingRequest>,
+            ) -> Result<PlatformSelectResult, Report<PlatformError>> {
+                if pending_requests.is_empty() {
+                    return Err(Report::new(PlatformError::HttpClient));
+                }
+                let first = pending_requests.remove(0);
+                let ready = match first.downcast::<Pending>() {
+                    Ok(pending) => platform_response(pending.reply, pending.backend_name),
+                    Err(_) => Err(Report::new(PlatformError::HttpClient)),
+                };
+                Ok(PlatformSelectResult {
+                    ready,
+                    remaining: pending_requests,
+                    failed_backend_name: None,
+                })
+            }
+        }
+
+        /// Locates every client in a country no privacy law of the default
+        /// consent config covers, so EC and EID consent is granted.
+        struct NonRegulatedGeo;
+
+        impl PlatformGeo for NonRegulatedGeo {
+            fn lookup(
+                &self,
+                _client_ip: Option<std::net::IpAddr>,
+            ) -> Result<Option<GeoInfo>, Report<PlatformError>> {
+                Ok(Some(GeoInfo {
+                    city: "Example City".to_owned(),
+                    country: "CA".to_owned(),
+                    continent: "NA".to_owned(),
+                    latitude: 0.0,
+                    longitude: 0.0,
+                    metro_code: 0,
+                    region: None,
+                    asn: None,
+                }))
+            }
+        }
+
+        /// What every scenario shares: the router state, the counting store
+        /// behind its identity graph and the scripted network.
+        struct Scenario {
+            state: Arc<AppState>,
+            store: Arc<WriteCountingEcKv>,
+            network: Arc<ScriptedNetwork>,
+        }
+
+        /// The partner of `source`, registered for the bidstream with no pull.
+        fn partner_toml(source: &str) -> String {
+            format!(
+                r#"
+                [[ec.partners]]
+                name = "Partner {source}"
+                source_domain = "{source}"
+                bidstream_enabled = true
+                api_token = "token-for-{source}-0123456789abcdef"
+                "#
+            )
+        }
+
+        impl Scenario {
+            /// A scenario whose settings are the test settings plus `extra`
+            /// TOML, with `sharedid.org` and `id5-sync.com` registered.
+            fn with_settings(extra: &str) -> Self {
+                let toml = format!(
+                    "{TEST_SETTINGS_TOML}{}{}{extra}",
+                    partner_toml("sharedid.org"),
+                    partner_toml("id5-sync.com"),
+                );
+                Self::from_toml(&toml)
+            }
+
+            fn new() -> Self {
+                Self::with_settings("")
+            }
+
+            fn from_toml(toml: &str) -> Self {
+                let (graph, store) = KvIdentityGraph::write_counting("identity-writes-store");
+                Self::from_parts(toml, graph, store)
+            }
+
+            /// A scenario over `graph`, which must count into `store`.
+            fn from_parts(
+                toml: &str,
+                graph: KvIdentityGraph,
+                store: Arc<WriteCountingEcKv>,
+            ) -> Self {
+                let mut settings = Settings::from_toml(toml).expect("should parse the settings");
+                // These scenarios exercise the mirror; its default-off gate
+                // has its own test.
+                settings.ec.identity.mirror_enabled = true;
+                let network = Arc::new(ScriptedNetwork::new());
+                network.respond(
+                    ORIGIN_HOST,
+                    200,
+                    "text/html",
+                    "<html><head></head><body>page</body></html>",
+                );
+                let state = crate::app::app_state_with_network_for_test(
+                    settings,
+                    graph,
+                    Arc::clone(&network) as Arc<dyn PlatformHttpClient>,
+                    Arc::new(NonRegulatedGeo),
+                );
+                Self {
+                    state,
+                    store,
+                    network,
+                }
+            }
+
+            fn graph(&self) -> &KvIdentityGraph {
+                self.state
+                    .identity_graph
+                    .as_ref()
+                    .expect("should hold the graph")
+            }
+
+            /// Stores `entry` under [`EC_ID`] and zeroes the counts.
+            fn seed(&self, entry: &KvEntry) {
+                self.graph()
+                    .create(EC_ID, entry)
+                    .expect("should seed the row");
+                self.store.reset_counts();
+            }
+
+            /// Seeds a live row that already holds its cluster size, so the
+            /// flush has no change of its own to write (C2).
+            fn seed_live(&self) -> KvEntry {
+                let entry = live_entry();
+                self.seed(&entry);
+                entry
+            }
+
+            /// Drives `request`, and checks that no response of any scenario
+            /// sets a server identity cookie (spec 13).
+            fn drive(&self, request: HttpRequest) -> (HttpResponse, Option<FlushOutcome>) {
+                let (response, outcome) = drive_request_for_test(&self.state, request);
+                assert_no_server_identity_cookie(&response);
+                (response, outcome)
+            }
+
+            /// The row under `ec_id`.
+            fn row_of(&self, ec_id: &str) -> KvEntry {
+                self.graph()
+                    .get(ec_id)
+                    .expect("should read the row")
+                    .expect("should hold the row")
+                    .0
+            }
+
+            /// The row under [`EC_ID`].
+            fn row(&self) -> KvEntry {
+                self.row_of(EC_ID)
+            }
+        }
+
+        /// A live row for [`EC_ID`] with its cluster size present.
+        fn live_entry() -> KvEntry {
+            let mut entry = KvEntry::new(&allowing_consent(), None, 1_000, "test-publisher.com");
+            entry.network = Some(KvNetwork {
+                cluster_size: Some(1),
+            });
+            entry
+        }
+
+        fn with_header(mut request: HttpRequest, name: &'static str, value: &str) -> HttpRequest {
+            request.headers_mut().insert(
+                name,
+                HeaderValue::from_str(value).expect("should encode the header"),
+            );
+            request
+        }
+
+        fn without_header(mut request: HttpRequest, name: &'static str) -> HttpRequest {
+            request.headers_mut().remove(name);
+            request
+        }
+
+        /// The cookies every response of every scenario must leave unset:
+        /// the server sets `ts-ec` and no other identity cookie.
+        fn is_server_identity_cookie(name: &str) -> bool {
+            name == "ts-eids"
+                || name == "__Host-ts-eids-s"
+                || name.starts_with("ts-eids-r")
+                || name == "ts-ec-pull-complete"
+        }
+
+        fn cookie_name(set_cookie: &str) -> &str {
+            set_cookie.split('=').next().unwrap_or_default().trim()
+        }
+
+        fn assert_no_server_identity_cookie(response: &HttpResponse) {
+            for cookie in set_cookies(response) {
+                assert!(
+                    !is_server_identity_cookie(cookie_name(&cookie)),
+                    "should set no identity cookie but ts-ec: {cookie}"
+                );
+            }
+        }
+
+        /// The value of the `name` cookie the response sets.
+        fn set_cookie_value(response: &HttpResponse, name: &str) -> Option<String> {
+            set_cookies(response).into_iter().find_map(|cookie| {
+                let pair = cookie.split(';').next()?;
+                let (found, value) = pair.split_once('=')?;
+                (found.trim() == name).then(|| value.trim().to_owned())
+            })
+        }
+
+        /// The cookie of a returning visitor whose browser holds a sharedId.
+        fn returning_with_shared_id() -> String {
+            format!("ts-ec={EC_ID}; sharedId={SHARED_ID}")
+        }
+
+        /// Asserts every write mode count, so no mode hides behind another.
+        fn assert_writes(store: &WriteCountingEcKv, expected: (usize, usize, usize), what: &str) {
+            let writes = store.writes();
+            assert_eq!(
+                (writes.add, writes.if_generation_match, writes.overwrite),
+                expected,
+                "should make exactly (Add, IfGenerationMatch, Overwrite) writes: {what}"
+            );
+        }
+
+        fn assert_no_writes(store: &WriteCountingEcKv, what: &str) {
+            assert_writes(store, (0, 0, 0), what);
+        }
+
+        /// The UID the row holds for `source`.
+        fn stored_uid(row: &KvEntry, source: &str) -> Option<String> {
+            row.ids
+                .get(source)
+                .and_then(KvPartnerId::first_uid)
+                .map(str::to_owned)
+        }
+
+        #[test]
+        fn returning_visitor_with_changes_writes_once() {
+            let scenario = Scenario::new();
+            scenario.seed_live();
+
+            let (response, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(response.status(), 200, "should serve the origin page");
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_writes(&scenario.store, (0, 1, 0), "one CAS write");
+            assert_eq!(
+                stored_uid(&scenario.row(), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should hold the browser's sharedId in KV after the one write"
+            );
+        }
+
+        /// A store that refuses its first `collisions` `Add` writes without
+        /// storing them, as a minted ID that is already taken does.
+        struct CollidingStore {
+            inner: Arc<WriteCountingEcKv>,
+            collisions: Mutex<u32>,
+            refused: Arc<std::sync::atomic::AtomicUsize>,
+        }
+
+        impl trusted_server_core::ec::kv_backend::EcKvStore for CollidingStore {
+            fn store_name(&self) -> &str {
+                self.inner.store_name()
+            }
+
+            fn lookup(
+                &self,
+                key: &str,
+            ) -> Result<
+                Option<trusted_server_core::ec::kv_backend::EcKvLookup>,
+                Report<TrustedServerError>,
+            > {
+                self.inner.lookup(key)
+            }
+
+            fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+                self.inner.key_exists(key)
+            }
+
+            fn insert(
+                &self,
+                key: &str,
+                write: trusted_server_core::ec::kv_backend::EcKvWrite<'_>,
+            ) -> Result<
+                trusted_server_core::ec::kv_backend::EcKvWriteOutcome,
+                Report<TrustedServerError>,
+            > {
+                if matches!(
+                    write.mode,
+                    trusted_server_core::ec::kv_backend::EcKvWriteMode::Add
+                ) {
+                    let mut remaining = self.collisions.lock().expect("should lock the count");
+                    if *remaining > 0 {
+                        *remaining -= 1;
+                        self.refused
+                            .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                        return Ok(
+                            trusted_server_core::ec::kv_backend::EcKvWriteOutcome::PreconditionFailed,
+                        );
+                    }
+                }
+                self.inner.insert(key, write)
+            }
+
+            fn list_keys_with_prefix(
+                &self,
+                prefix: &str,
+                limit: u32,
+            ) -> Result<Vec<String>, Report<TrustedServerError>> {
+                self.inner.list_keys_with_prefix(prefix, limit)
+            }
+
+            fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+                self.inner.delete(key)
+            }
+        }
+
+        /// The same navigation with one header replaced.
+        fn navigation_with_header(
+            cookie: Option<&str>,
+            name: &'static str,
+            value: &str,
+        ) -> HttpRequest {
+            with_header(navigation(cookie), name, value)
+        }
+
+        #[test]
+        fn identity_measurement_counts_the_create_write_of_a_new_ec_navigation() {
+            let scenario = Scenario::new();
+            let cookie = format!("sharedId={SHARED_ID}");
+
+            let (outcome, measurement) =
+                drive_measured_for_test(&scenario.state, navigation(Some(&cookie)));
+
+            assert_eq!(
+                measurement.route(),
+                RouteKind::NewEc,
+                "should label a first visit as a new EC"
+            );
+            assert_eq!(
+                measurement.kv_writes(),
+                1,
+                "should count the create write and no other"
+            );
+            assert_eq!(
+                measurement.kv_reads(),
+                0,
+                "should count no read: the create reads nothing"
+            );
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Skipped),
+                "should not flush a new visitor"
+            );
+        }
+
+        #[test]
+        fn new_visitor_navigation_writes_once() {
+            let scenario = Scenario::new();
+            let cookie = format!("sharedId={SHARED_ID}");
+
+            let (response, outcome) = scenario.drive(navigation(Some(&cookie)));
+
+            assert_eq!(response.status(), 200, "should serve the origin page");
+            let minted = set_cookie_value(&response, "ts-ec").expect("should mint an EC");
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Skipped),
+                "should leave a new visitor nothing to flush"
+            );
+            assert_writes(&scenario.store, (1, 0, 0), "one Add and no flush");
+            assert_eq!(
+                stored_uid(&scenario.row_of(&minted), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should carry the browser ingest in the create"
+            );
+        }
+
+        #[test]
+        fn new_visitor_collision_remints_and_writes_once() {
+            let (_, counting) = KvIdentityGraph::write_counting("collision-store");
+            let refused = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+            let graph = KvIdentityGraph::new(CollidingStore {
+                inner: Arc::clone(&counting),
+                collisions: Mutex::new(1),
+                refused: Arc::clone(&refused),
+            });
+            let toml = format!("{TEST_SETTINGS_TOML}{}", partner_toml("sharedid.org"));
+            let scenario = Scenario::from_parts(&toml, graph, counting);
+            let cookie = format!("sharedId={SHARED_ID}");
+
+            let (response, _) = scenario.drive(navigation(Some(&cookie)));
+
+            assert_eq!(
+                refused.load(std::sync::atomic::Ordering::SeqCst),
+                1,
+                "control: should have met one taken ID first"
+            );
+            assert_writes(
+                &scenario.store,
+                (1, 0, 0),
+                "one Add lands after the collision",
+            );
+            let minted: Vec<String> = set_cookies(&response)
+                .into_iter()
+                .filter(|cookie| cookie_name(cookie) == "ts-ec")
+                .collect();
+            assert_eq!(
+                minted.len(),
+                1,
+                "should set one ts-ec, for the ID that landed"
+            );
+            let id = set_cookie_value(&response, "ts-ec").expect("should mint an EC");
+            assert_eq!(
+                stored_uid(&scenario.row_of(&id), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should hold the ingest under the re-minted ID"
+            );
+        }
+
+        #[test]
+        fn returning_visitor_without_changes_writes_nothing() {
+            let scenario = Scenario::new();
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "sharedid.org".to_owned(),
+                KvPartnerId::browser(SHARED_ID, Some(1_500)),
+            );
+            scenario.seed(&entry);
+
+            let (response, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(response.status(), 200, "should serve the origin page");
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::NoChange),
+                "should find the row already holds the ID"
+            );
+            assert_no_writes(&scenario.store, "the browser's ID is already stored");
+
+            let (_, nothing) = scenario.drive(navigation(Some(&format!("ts-ec={EC_ID}"))));
+            assert_eq!(
+                nothing,
+                Some(FlushOutcome::Skipped),
+                "should skip a navigation that carries nothing"
+            );
+            assert_no_writes(&scenario.store, "nothing to ingest");
+
+            let control = Scenario::new();
+            control.seed_live();
+            control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &control.store,
+                (0, 1, 0),
+                "control: the same request writes when the row lacks the ID",
+            );
+        }
+
+        #[test]
+        fn revalidation_304_with_changes_writes_once() {
+            let scenario = Scenario::new();
+            scenario.seed_live();
+            scenario
+                .network
+                .respond_with_headers(ORIGIN_HOST, 304, &[("etag", "\"page-1\"")], "");
+            let request = navigation_with_header(
+                Some(&returning_with_shared_id()),
+                "if-none-match",
+                "\"page-1\"",
+            );
+
+            let (response, outcome) = scenario.drive(request);
+
+            assert_eq!(response.status(), 304, "should answer the revalidation");
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_writes(&scenario.store, (0, 1, 0), "one CAS write");
+            assert_eq!(
+                stored_uid(&scenario.row(), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should hold the sharedId"
+            );
+        }
+
+        #[test]
+        fn returning_navigation_answered_3xx_4xx_5xx_writes_nothing() {
+            let control = Scenario::new();
+            control.seed_live();
+            control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_writes(&control.store, (0, 1, 0), "control: a 200 writes once");
+
+            for status in [301_u16, 302, 400, 404, 410, 500, 502, 503] {
+                let scenario = Scenario::new();
+                scenario.seed_live();
+                scenario.network.respond_with_headers(
+                    ORIGIN_HOST,
+                    status,
+                    &[
+                        ("content-type", "text/html"),
+                        // Keep the host aligned with the shared settings fixture.
+                        ("location", "https://origin.test-publisher.com/next"), // allow-domain: origin.test-publisher.com
+                    ],
+                    "<html><head></head><body>answer</body></html>",
+                );
+
+                let (response, outcome) =
+                    scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+                assert_eq!(
+                    response.status().as_u16(),
+                    status,
+                    "should pass the origin status through: {status}"
+                );
+                assert_eq!(
+                    outcome,
+                    Some(FlushOutcome::Skipped),
+                    "should have nothing to flush after {status}"
+                );
+                assert_no_writes(&scenario.store, &format!("origin answered {status}"));
+                assert_eq!(
+                    stored_uid(&scenario.row(), "sharedid.org"),
+                    None,
+                    "should not store the ID the browser sent, after {status}"
+                );
+            }
+        }
+
+        #[test]
+        fn new_visitor_prefetch_writes_once() {
+            let scenario = Scenario::new();
+
+            let (response, _) = scenario.drive(navigation_with_header(
+                Some(&format!("sharedId={SHARED_ID}")),
+                "sec-purpose",
+                "prefetch",
+            ));
+
+            assert!(
+                set_cookie_value(&response, "ts-ec").is_some(),
+                "should mint an EC for a prefetched navigation"
+            );
+            assert_writes(&scenario.store, (1, 0, 0), "one Add");
+        }
+
+        #[test]
+        fn returning_prefetch_writes_nothing() {
+            for header in ["sec-purpose", "purpose"] {
+                let scenario = Scenario::new();
+                scenario.seed_live();
+
+                let (_, outcome) = scenario.drive(navigation_with_header(
+                    Some(&returning_with_shared_id()),
+                    header,
+                    "prefetch",
+                ));
+
+                assert_eq!(
+                    outcome,
+                    Some(FlushOutcome::Skipped),
+                    "should not be the writer: {header}"
+                );
+                assert_no_writes(&scenario.store, header);
+            }
+
+            let control = Scenario::new();
+            control.seed_live();
+            control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &control.store,
+                (0, 1, 0),
+                "control: the same navigation without prefetch writes once",
+            );
+        }
+
+        #[test]
+        fn new_visitor_without_sec_fetch_dest_writes_once() {
+            let scenario = Scenario::new();
+            let request = with_header(
+                without_header(
+                    navigation(Some(&format!("sharedId={SHARED_ID}"))),
+                    "sec-fetch-dest",
+                ),
+                "accept",
+                "text/html,application/xhtml+xml",
+            );
+
+            let (response, _) = scenario.drive(request);
+
+            assert!(
+                set_cookie_value(&response, "ts-ec").is_some(),
+                "should mint an EC"
+            );
+            assert_writes(&scenario.store, (1, 0, 0), "one Add");
+        }
+
+        #[test]
+        fn returning_iframe_or_no_sec_fetch_dest_writes_nothing() {
+            let requests = [
+                (
+                    "iframe",
+                    navigation_with_header(
+                        Some(&returning_with_shared_id()),
+                        "sec-fetch-dest",
+                        "iframe",
+                    ),
+                ),
+                (
+                    "no Sec-Fetch-Dest",
+                    with_header(
+                        without_header(
+                            navigation(Some(&returning_with_shared_id())),
+                            "sec-fetch-dest",
+                        ),
+                        "accept",
+                        "text/html",
+                    ),
+                ),
+            ];
+            for (name, request) in requests {
+                let scenario = Scenario::new();
+                scenario.seed_live();
+
+                let (_, outcome) = scenario.drive(request);
+
+                assert_eq!(
+                    outcome,
+                    Some(FlushOutcome::Skipped),
+                    "should not be the writer: {name}"
+                );
+                assert_no_writes(&scenario.store, name);
+            }
+
+            let control = Scenario::new();
+            control.seed_live();
+            control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &control.store,
+                (0, 1, 0),
+                "control: a document navigation writes once",
+            );
+        }
+
+        /// The settings of an enabled Didomi proxy, whose upstream answers on
+        /// `sdk.example.com`.
+        const DIDOMI_TOML: &str = r#"
+            [integrations.didomi]
+            enabled = true
+            sdk_origin = "https://sdk.example.com"
+            api_origin = "https://api.example.com"
+            "#;
+
+        fn didomi_scenario() -> Scenario {
+            let scenario = Scenario::with_settings(DIDOMI_TOML);
+            scenario
+                .network
+                .respond("sdk.example.com", 200, "application/javascript", "loader()");
+            scenario
+        }
+
+        fn didomi_navigation(cookie: Option<&str>) -> HttpRequest {
+            let mut request = navigation(cookie);
+            // Keep the host aligned with the shared settings fixture.
+            *request.uri_mut() = "https://test-publisher.com/integrations/didomi/consent/loader.js" // allow-domain: test-publisher.com
+                .parse()
+                .expect("should parse the proxy URI");
+            request
+        }
+
+        #[test]
+        fn integration_proxy_navigation_minting_ec_writes_once() {
+            let scenario = didomi_scenario();
+
+            let (response, _) =
+                scenario.drive(didomi_navigation(Some(&format!("sharedId={SHARED_ID}"))));
+
+            assert_eq!(response.status(), 200, "should serve the proxied answer");
+            assert_eq!(
+                scenario.network.requests_to("sdk.example.com").len(),
+                1,
+                "control: should have reached the integration, not the publisher"
+            );
+            assert!(
+                scenario.network.requests_to(ORIGIN_HOST).is_empty(),
+                "should not reach the publisher origin"
+            );
+            let minted = set_cookie_value(&response, "ts-ec").expect("should mint an EC");
+            assert_writes(&scenario.store, (1, 0, 0), "one Add");
+            assert_eq!(
+                stored_uid(&scenario.row_of(&minted), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should carry the ingest in the create"
+            );
+        }
+
+        /// An enabled auction with one bidder, and one slot for page bids.
+        const AUCTION_TOML: &str = r#"
+            [auction]
+            enabled = true
+            timeout_ms = 2000
+
+            [auction.providers.bidder-main]
+            protocol = "openrtb-2.6"
+            profile = "standard"
+            endpoint = "https://bidder.example.com/auction"
+            routing = "all_eligible"
+
+            [creative_opportunities]
+            enabled = true
+            gam_network_id = "123456789"
+
+            [[creative_opportunities.slot]]
+            id = "leaderboard"
+            gam_unit_path = "/123456789/leaderboard"
+            div_id = "div-gpt-ad-leaderboard"
+            page_patterns = ["/"]
+            formats = [{ width = 728, height = 90 }]
+            "#;
+
+        /// A first-party asset route to a scripted origin.
+        const ASSET_TOML: &str = r#"
+            [[proxy.asset_routes]]
+            prefix = "/assets/"
+            origin_url = "https://assets.example.com"
+            "#;
+
+        /// A pull partner whose answers the scripted network serves.
+        const PULL_PARTNER_TOML: &str = r#"
+            [[ec.partners]]
+            name = "Pull SSP"
+            source_domain = "ssp.example.com"
+            bidstream_enabled = true
+            pull_sync_enabled = true
+            pull_sync_url = "https://sync.ssp.example.com/pull"
+            pull_sync_allowed_domains = ["sync.ssp.example.com"]
+            ts_pull_token = "example-token-value-0123456789abcdef"
+            "#;
+
+        /// The provider the pull partner becomes.
+        const PULL_PROVIDER: &str = "pull-ssp-example-com";
+
+        const BIDDER_HOST: &str = "bidder.example.com";
+        const PULL_HOST: &str = "sync.ssp.example.com";
+
+        /// A scenario with the auction, the Didomi proxy, an asset route and
+        /// the pull partner, and a network that answers all of them.
+        fn full_scenario() -> Scenario {
+            let scenario = Scenario::with_settings(&format!(
+                "{AUCTION_TOML}{DIDOMI_TOML}{ASSET_TOML}{PULL_PARTNER_TOML}"
+            ));
+            scenario.network.respond(
+                BIDDER_HOST,
+                200,
+                "application/json",
+                r#"{"id":"response","seatbid":[]}"#,
+            );
+            scenario
+                .network
+                .respond("sdk.example.com", 200, "application/javascript", "loader()");
+            scenario.network.respond(
+                "assets.example.com",
+                200,
+                "application/javascript",
+                "asset()",
+            );
+            scenario.network.respond(
+                PULL_HOST,
+                200,
+                "application/json",
+                r#"{"uid":"pull-uid-1"}"#,
+            );
+            scenario
+        }
+
+        /// A scenario with the auction and no pull partner.
+        fn auction_scenario() -> Scenario {
+            let scenario = Scenario::with_settings(AUCTION_TOML);
+            scenario.network.respond(
+                BIDDER_HOST,
+                200,
+                "application/json",
+                r#"{"id":"response","seatbid":[]}"#,
+            );
+            scenario
+        }
+
+        fn auction_body(eids: Option<&serde_json::Value>) -> serde_json::Value {
+            let mut body = serde_json::json!({
+                "adUnits": [{
+                    "code": "div-1",
+                    "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+                }]
+            });
+            if let Some(eids) = eids {
+                body["eids"] = eids.clone();
+            }
+            body
+        }
+
+        /// A `/auction` request from a real browser.
+        fn auction_request(cookie: Option<&str>, body: &serde_json::Value) -> HttpRequest {
+            let mut builder = edgezero_core::http::request_builder()
+                .method(edgezero_core::http::Method::POST)
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+                .header("content-type", "application/json");
+            if let Some(cookie) = cookie {
+                builder = builder.header("cookie", cookie);
+            }
+            let mut request = builder
+                .body(EdgeBody::from(
+                    serde_json::to_vec(body).expect("should serialize the body"),
+                ))
+                .expect("should build request");
+            as_browser(&mut request);
+            request
+        }
+
+        /// A browser's `/_ts/page-bids` call for the home page.
+        fn page_bids_request(cookie: &str) -> HttpRequest {
+            let mut request = edgezero_core::http::request_builder()
+                .method(edgezero_core::http::Method::GET)
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/_ts/page-bids?path=%2F") // allow-domain: test-publisher.com
+                .header("x-tsjs-page-bids", "1")
+                .header("cookie", cookie)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            as_browser(&mut request);
+            request
+        }
+
+        /// The partner `source` asking who the visitor is.
+        fn identify_request(cookie: &str, source: &str) -> HttpRequest {
+            let mut request = edgezero_core::http::request_builder()
+                .method(edgezero_core::http::Method::GET)
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/_ts/api/v1/identify") // allow-domain: test-publisher.com
+                .header(
+                    "authorization",
+                    format!("Bearer token-for-{source}-0123456789abcdef"),
+                )
+                .header("cookie", cookie)
+                // Keep the host aligned with the shared settings fixture.
+                .header("origin", "https://www.test-publisher.com") // allow-domain: www.test-publisher.com
+                .header("sec-fetch-site", "same-site")
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            as_browser(&mut request);
+            request
+        }
+
+        fn asset_request(cookie: &str) -> HttpRequest {
+            let mut request = edgezero_core::http::request_builder()
+                .method(edgezero_core::http::Method::GET)
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/assets/app.js") // allow-domain: test-publisher.com
+                .header("sec-fetch-dest", "script")
+                .header("cookie", cookie)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            as_browser(&mut request);
+            request
+        }
+
+        fn json_of(response: HttpResponse) -> serde_json::Value {
+            let bytes = response
+                .into_body()
+                .into_bytes()
+                .expect("should buffer the body");
+            serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null)
+        }
+
+        /// The last request body the bidder received.
+        fn bidder_body(scenario: &Scenario) -> serde_json::Value {
+            let seen = scenario
+                .network
+                .requests_to(BIDDER_HOST)
+                .pop()
+                .expect("should have called the bidder");
+            serde_json::from_slice(&seen.body).expect("should parse the bidder request")
+        }
+
+        /// The EIDs of a bidder request, from `user.ext.eids`.
+        fn bidder_eids(body: &serde_json::Value) -> serde_json::Value {
+            body["user"]["ext"]["eids"].clone()
+        }
+
+        /// What `x-ts-eids` carries.
+        fn header_eids(response: &HttpResponse) -> serde_json::Value {
+            use base64::Engine as _;
+            let value = response
+                .headers()
+                .get("x-ts-eids")
+                .and_then(|value| value.to_str().ok())
+                .expect("should carry x-ts-eids");
+            let bytes = base64::engine::general_purpose::STANDARD
+                .decode(value)
+                .expect("should decode x-ts-eids");
+            serde_json::from_slice(&bytes).expect("should parse x-ts-eids")
+        }
+
+        /// The decoded `ts-eids-s` payload of an `/auction` body, or its
+        /// `clear` marker.
+        fn mirror_of(body: &serde_json::Value) -> serde_json::Value {
+            use base64::Engine as _;
+            let member = &body["ext"]["ts_eids_s"];
+            match member["value"].as_str() {
+                Some(value) => {
+                    let bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD
+                        .decode(value)
+                        .expect("should decode the mirror");
+                    serde_json::from_slice(&bytes).expect("should parse the mirror")
+                }
+                None => member.clone(),
+            }
+        }
+
+        #[test]
+        fn auction_page_bids_identify_proxy_and_assets_write_nothing() {
+            let scenario = full_scenario();
+            scenario.seed_live();
+            let cookie = returning_with_shared_id();
+            let body = auction_body(None);
+
+            let requests = [
+                ("auction", auction_request(Some(&cookie), &body)),
+                ("page bids", page_bids_request(&cookie)),
+                ("identify", identify_request(&cookie, "sharedid.org")),
+                ("integration proxy subresource", {
+                    let mut request = didomi_navigation(Some(&cookie));
+                    request
+                        .headers_mut()
+                        .insert("sec-fetch-dest", HeaderValue::from_static("script"));
+                    request
+                }),
+                ("asset", asset_request(&cookie)),
+            ];
+            for (name, request) in requests {
+                let (response, _) = scenario.drive(request);
+
+                assert!(
+                    response.status().is_success(),
+                    "should answer {name} with a success, got {}",
+                    response.status()
+                );
+                assert_no_writes(&scenario.store, name);
+            }
+            assert_eq!(
+                scenario.network.requests_to(BIDDER_HOST).len(),
+                2,
+                "control: the auction and the page bids should both have reached the bidder"
+            );
+            for host in ["sdk.example.com", "assets.example.com"] {
+                assert_eq!(
+                    scenario.network.requests_to(host).len(),
+                    1,
+                    "control: the proxy and the asset route should each have reached {host}"
+                );
+            }
+
+            let control = full_scenario();
+            control.seed_live();
+            control.drive(navigation(Some(&cookie)));
+            assert_writes(
+                &control.store,
+                (0, 1, 0),
+                "control: a navigation with the same cookies writes once",
+            );
+        }
+
+        #[test]
+        fn returning_writer_navigation_reads_once() {
+            let changed = Scenario::new();
+            changed.seed_live();
+
+            changed.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                changed.store.writes().lookups,
+                1,
+                "should read once, with a write"
+            );
+            assert_writes(&changed.store, (0, 1, 0), "one CAS write");
+
+            let unchanged = Scenario::new();
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "sharedid.org".to_owned(),
+                KvPartnerId::browser(SHARED_ID, Some(1_500)),
+            );
+            unchanged.seed(&entry);
+
+            unchanged.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                unchanged.store.writes().lookups,
+                1,
+                "should read once, with nothing to write"
+            );
+            assert_no_writes(&unchanged.store, "the row already holds the ID");
+
+            unchanged.drive(navigation(Some(&returning_with_shared_id())));
+            assert_eq!(
+                unchanged.store.writes().lookups,
+                2,
+                "control: the counter should count each navigation's read"
+            );
+        }
+
+        #[test]
+        fn due_after_send_provider_adds_one_reread() {
+            let scenario = full_scenario();
+            scenario.seed_live();
+
+            let (_, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_eq!(
+                scenario.network.requests_to(PULL_HOST).len(),
+                1,
+                "should call the due pull provider after send"
+            );
+            assert_eq!(
+                scenario.store.writes().lookups,
+                2,
+                "should read in phase 1 and once more before dispatching"
+            );
+            assert_writes(
+                &scenario.store,
+                (0, 1, 0),
+                "the browser ingest and the pull in one write",
+            );
+            let row = scenario.row();
+            assert_eq!(
+                stored_uid(&row, "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should hold the browser ID"
+            );
+            assert_eq!(
+                stored_uid(&row, "ssp.example.com").as_deref(),
+                Some("pull-uid-1"),
+                "should hold the pulled ID"
+            );
+
+            let idle = full_scenario();
+            let mut entry = live_entry();
+            entry.ps.insert(
+                PULL_PROVIDER.to_owned(),
+                trusted_server_core::ec::kv_types::KvProviderState {
+                    n: Some(4_000_000_000),
+                    ..Default::default()
+                },
+            );
+            idle.seed(&entry);
+
+            idle.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert!(
+                idle.network.requests_to(PULL_HOST).is_empty(),
+                "control: should not call a provider that is not due"
+            );
+            assert_eq!(
+                idle.store.writes().lookups,
+                1,
+                "control: should read once when no provider is due"
+            );
+        }
+
+        #[test]
+        fn auction_and_page_bids_keep_one_read() {
+            let cookie = returning_with_shared_id();
+            let auction = full_scenario();
+            auction.seed_live();
+
+            auction.drive(auction_request(Some(&cookie), &auction_body(None)));
+
+            assert_eq!(
+                auction.store.writes().lookups,
+                1,
+                "/auction should read once"
+            );
+            assert_no_writes(&auction.store, "/auction");
+            assert_eq!(
+                auction.network.requests_to(BIDDER_HOST).len(),
+                1,
+                "control: the auction should have run"
+            );
+
+            let page_bids = full_scenario();
+            page_bids.seed_live();
+
+            page_bids.drive(page_bids_request(&cookie));
+
+            assert_eq!(
+                page_bids.store.writes().lookups,
+                1,
+                "/_ts/page-bids should read once"
+            );
+            assert_no_writes(&page_bids.store, "/_ts/page-bids");
+            assert_eq!(
+                page_bids.network.requests_to(BIDDER_HOST).len(),
+                1,
+                "control: the page-bids auction should have run"
+            );
+        }
+
+        #[test]
+        fn same_origin_page_bids_is_the_spa_writer_once_the_interval_passes() {
+            let spa_request = || {
+                let mut request = page_bids_request(&returning_with_shared_id());
+                request.headers_mut().insert(
+                    "sec-fetch-site",
+                    edgezero_core::http::HeaderValue::from_static("same-origin"),
+                );
+                request
+            };
+
+            let due = full_scenario();
+            due.seed_live();
+            let (_, outcome) = due.drive(spa_request());
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should write once as the SPA writer"
+            );
+            assert_eq!(
+                stored_uid(&due.row(), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should ingest the browser's sharedId"
+            );
+            assert_eq!(
+                due.network.requests_to(PULL_HOST).len(),
+                1,
+                "should run the due after-send provider"
+            );
+
+            let recent = full_scenario();
+            let mut row = live_entry();
+            row.wa = Some(
+                std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .expect("should read the clock")
+                    .as_secs(),
+            );
+            recent.seed(&row);
+            let (_, outcome) = recent.drive(spa_request());
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Skipped),
+                "should wait out the interval since the last writer flush"
+            );
+            assert_no_writes(&recent.store, "an SPA call within the interval");
+        }
+
+        #[test]
+        fn no_response_sets_an_identity_cookie_other_than_ts_ec() {
+            assert!(
+                is_server_identity_cookie("ts-eids")
+                    && is_server_identity_cookie("__Host-ts-eids-s")
+                    && is_server_identity_cookie("ts-eids-r1")
+                    && is_server_identity_cookie("ts-ec-pull-complete")
+                    && !is_server_identity_cookie("ts-ec"),
+                "control: the check should name exactly the cookies the server never sets"
+            );
+            let browser_cookies = format!(
+                "{}; ts-eids=ignored; __Host-ts-eids-s=ignored; ts-eids-r1=ignored; \
+                 ts-ec-pull-complete=v1.example",
+                returning_with_shared_id()
+            );
+
+            let new_visitor = full_scenario();
+            let (minted, _) = new_visitor.drive(navigation(Some("sharedId=shared-id-1")));
+            assert!(
+                set_cookie_value(&minted, "ts-ec").is_some(),
+                "control: a new visitor's response should set ts-ec"
+            );
+
+            let returning = full_scenario();
+            returning.seed_live();
+            let body = auction_body(None);
+            for request in [
+                navigation(Some(&browser_cookies)),
+                auction_request(Some(&browser_cookies), &body),
+                page_bids_request(&browser_cookies),
+                identify_request(&browser_cookies, "sharedid.org"),
+            ] {
+                let (response, _) = returning.drive(request);
+                let names: Vec<String> = set_cookies(&response)
+                    .iter()
+                    .map(|cookie| cookie_name(cookie).to_owned())
+                    .collect();
+                assert!(
+                    names.iter().all(|name| name == "ts-ec"),
+                    "should set at most ts-ec: {names:?}"
+                );
+            }
+        }
+
+        /// A source `id5-sync.com` entry set with two entries, three UIDs and
+        /// every UID-level and EID-level field.
+        fn full_entry_set() -> Vec<trusted_server_core::ec::kv_types::KvEid> {
+            use trusted_server_core::ec::kv_types::{KvEid, KvUid};
+            vec![
+                KvEid {
+                    uids: vec![
+                        KvUid {
+                            id: "set-uid-a".to_owned(),
+                            atype: Some(1),
+                            ext: Some(serde_json::json!({ "rtiPartner": "A" })),
+                        },
+                        KvUid {
+                            id: "set-uid-b".to_owned(),
+                            atype: Some(3),
+                            ext: Some(serde_json::json!({ "stype": "ppuid" })),
+                        },
+                    ],
+                    inserter: Some("inserter-a.example.com".to_owned()),
+                    matcher: Some("matcher-a.example.com".to_owned()),
+                    mm: Some(3),
+                    ext: Some(serde_json::json!({ "segments": ["s1", "s2"] })),
+                },
+                KvEid {
+                    uids: vec![KvUid {
+                        id: "set-uid-c".to_owned(),
+                        atype: Some(1),
+                        ext: Some(serde_json::json!({ "label": "c" })),
+                    }],
+                    inserter: Some("inserter-b.example.com".to_owned()),
+                    matcher: Some("matcher-b.example.com".to_owned()),
+                    mm: Some(1),
+                    ext: Some(serde_json::json!({ "tier": "gold" })),
+                },
+            ]
+        }
+
+        /// What bidders receive for [`full_entry_set`].
+        fn full_entry_set_eids() -> serde_json::Value {
+            serde_json::json!([
+                {
+                    "source": "id5-sync.com",
+                    "inserter": "inserter-a.example.com",
+                    "matcher": "matcher-a.example.com",
+                    "mm": 3,
+                    "ext": { "segments": ["s1", "s2"] },
+                    "uids": [
+                        { "id": "set-uid-a", "atype": 1, "ext": { "rtiPartner": "A" } },
+                        { "id": "set-uid-b", "atype": 3, "ext": { "stype": "ppuid" } }
+                    ]
+                },
+                {
+                    "source": "id5-sync.com",
+                    "inserter": "inserter-b.example.com",
+                    "matcher": "matcher-b.example.com",
+                    "mm": 1,
+                    "ext": { "tier": "gold" },
+                    "uids": [{ "id": "set-uid-c", "atype": 1, "ext": { "label": "c" } }]
+                }
+            ])
+        }
+
+        /// A live row holding `eids` for `id5-sync.com`, with no writer.
+        fn row_with_set(exp: Option<u64>) -> KvEntry {
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "id5-sync.com".to_owned(),
+                KvPartnerId {
+                    at: Some(1_500),
+                    exp,
+                    eids: full_entry_set(),
+                    ..KvPartnerId::default()
+                },
+            );
+            entry
+        }
+
+        /// A browser entry of a source no partner registers.
+        fn browser_entry() -> serde_json::Value {
+            serde_json::json!({
+                "source": "browser.example.com",
+                "uids": [{ "id": "browser-uid", "atype": 1 }]
+            })
+        }
+
+        const FAR_FUTURE: u64 = 4_000_000_000;
+
+        fn ec_cookie() -> String {
+            format!("ts-ec={EC_ID}")
+        }
+
+        #[test]
+        fn entry_set_round_trips_from_kv_to_bidders() {
+            let scenario = auction_scenario();
+            scenario.seed(&row_with_set(Some(FAR_FUTURE)));
+            let body = auction_body(Some(&serde_json::json!([browser_entry()])));
+
+            let (response, _) = scenario.drive(auction_request(Some(&ec_cookie()), &body));
+
+            let mut expected = vec![browser_entry()];
+            expected.extend(
+                full_entry_set_eids()
+                    .as_array()
+                    .expect("should be a list")
+                    .clone(),
+            );
+            let expected = serde_json::Value::Array(expected);
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                expected,
+                "should send the browser entry, then both stored entries in order, every field intact"
+            );
+            assert_eq!(
+                header_eids(&response),
+                expected,
+                "x-ts-eids should carry what was sent"
+            );
+            let mirror = mirror_of(&json_of(response));
+            assert_eq!(
+                mirror,
+                serde_json::json!({ "v": 1, "eids": full_entry_set_eids() }),
+                "the mirror should hold the same stored entries and no browser entry"
+            );
+            assert_no_writes(&scenario.store, "/auction");
+        }
+
+        #[test]
+        fn entry_set_survives_an_unrelated_flush() {
+            let scenario = Scenario::new();
+            let seeded = row_with_set(Some(FAR_FUTURE));
+            scenario.seed(&seeded);
+
+            let (_, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should flush the sharedId"
+            );
+            assert_writes(&scenario.store, (0, 1, 0), "one CAS write");
+            let row = scenario.row();
+            assert_eq!(
+                stored_uid(&row, "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "control: the flush should have written the sharedId fill"
+            );
+            assert_eq!(
+                row.ids.get("id5-sync.com"),
+                seeded.ids.get("id5-sync.com"),
+                "should leave the stored entry set exactly as it was"
+            );
+        }
+
+        #[test]
+        fn expired_entry_set_is_never_served_or_mirrored() {
+            let live = auction_scenario();
+            live.seed(&row_with_set(Some(FAR_FUTURE)));
+            let (live_response, _) =
+                live.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+            assert_eq!(
+                bidder_eids(&bidder_body(&live)),
+                full_entry_set_eids(),
+                "control: an unexpired set should be served"
+            );
+            assert_ne!(
+                mirror_of(&json_of(live_response)),
+                serde_json::json!({ "clear": true }),
+                "control: an unexpired set should be mirrored"
+            );
+
+            let expired = auction_scenario();
+            expired.seed(&row_with_set(Some(1_500)));
+            let (response, _) =
+                expired.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            assert_eq!(
+                bidder_eids(&bidder_body(&expired)),
+                serde_json::Value::Null,
+                "should send no EIDs from an expired set"
+            );
+            assert_eq!(
+                mirror_of(&json_of(response)),
+                serde_json::json!({ "clear": true }),
+                "should mirror nothing for an expired set"
+            );
+        }
+
+        /// A version 1 row: `uid` records and no entry sets.
+        fn seed_version_1_row(scenario: &Scenario) {
+            scenario.seed(&live_entry());
+            let lookup = scenario
+                .store
+                .lookup(EC_ID)
+                .expect("should read the row")
+                .expect("should hold the row");
+            let body = serde_json::json!({
+                "v": 1,
+                "created": 1_000,
+                "consent": { "ok": true, "updated": 1_000 },
+                "geo": { "country": "CA" },
+                "network": { "cluster_size": 1 },
+                "ids": { "id5-sync.com": { "uid": "version-1-uid", "at": 1_500 } }
+            })
+            .to_string();
+            let metadata = lookup
+                .metadata
+                .map(|bytes| String::from_utf8(bytes).expect("should be UTF-8"))
+                .unwrap_or_else(|| "{}".to_owned());
+            scenario
+                .store
+                .insert(
+                    EC_ID,
+                    trusted_server_core::ec::kv_backend::EcKvWrite {
+                        body: &body,
+                        metadata: &metadata,
+                        ttl: std::time::Duration::from_secs(3_600),
+                        mode: trusted_server_core::ec::kv_backend::EcKvWriteMode::Overwrite,
+                    },
+                )
+                .expect("should store the version 1 row");
+            scenario.store.reset_counts();
+        }
+
+        fn stored_body(scenario: &Scenario) -> serde_json::Value {
+            let lookup = scenario
+                .store
+                .lookup(EC_ID)
+                .expect("should read the row")
+                .expect("should hold the row");
+            serde_json::from_slice(&lookup.body).expect("should parse the stored row")
+        }
+
+        #[test]
+        fn version_1_row_is_served_and_upgraded_by_the_next_write() {
+            let scenario = auction_scenario();
+            seed_version_1_row(&scenario);
+
+            scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                serde_json::json!([{
+                    "source": "id5-sync.com",
+                    "uids": [{
+                        "id": "version-1-uid",
+                        "atype": trusted_server_core::settings::EcPartner::default_openrtb_atype()
+                    }]
+                }]),
+                "should serve the version 1 record as one entry with one UID"
+            );
+            assert_no_writes(&scenario.store, "/auction");
+            assert_eq!(
+                stored_body(&scenario)["v"],
+                1,
+                "control: the auction should leave the row at version 1"
+            );
+
+            let (_, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should flush the sharedId"
+            );
+            assert_writes(&scenario.store, (0, 1, 0), "one CAS write");
+            let written = stored_body(&scenario);
+            assert_eq!(written["v"], 2, "should write version 2");
+            let record = &written["ids"]["id5-sync.com"];
+            assert!(
+                record.get("uid").is_none(),
+                "should drop the version 1 uid field: {record}"
+            );
+            assert_eq!(
+                record["eids"][0]["uids"][0]["id"], "version-1-uid",
+                "should keep the UID as an entry"
+            );
+        }
+
+        #[test]
+        fn generic_pull_uid_written_after_send_is_served_on_the_next_auction() {
+            let scenario = full_scenario();
+            scenario.seed_live();
+
+            let (_, outcome) = scenario.drive(navigation(Some(&ec_cookie())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should flush the pull"
+            );
+            let record = scenario.row().ids.get("ssp.example.com").cloned();
+            assert_eq!(
+                record.as_ref().and_then(|record| record.w.as_deref()),
+                Some(PULL_PROVIDER),
+                "should record the pull provider as the writer"
+            );
+
+            let (response, _) =
+                scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            let atype = trusted_server_core::settings::EcPartner::default_openrtb_atype();
+            let served = serde_json::json!([{
+                "source": "ssp.example.com",
+                "uids": [{ "id": "pull-uid-1", "atype": atype }]
+            }]);
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                served,
+                "should serve the pulled UID to bidders"
+            );
+            assert_eq!(
+                mirror_of(&json_of(response)),
+                serde_json::json!({ "v": 1, "eids": served }),
+                "should mirror the pulled UID"
+            );
+        }
+
+        /// As [`drive_with_runtime`], running `after_send` between the send
+        /// and phase 4, where another request can land.
+        fn drive_with_send_hook(
+            state: &Arc<AppState>,
+            request: HttpRequest,
+            after_send: &mut dyn FnMut(),
+        ) -> Option<FlushOutcome> {
+            let router = TrustedServerApp::routes_for_state(state);
+            let mut response = futures::executor::block_on(router.oneshot(request))
+                .expect("should route the request");
+            let mut ec_state = response
+                .extensions_mut()
+                .remove::<EcFinalizeState>()
+                .expect("should carry EC state");
+            let graph = || state.identity_graph.clone();
+            finalize_send_and_flush(
+                PostRouteInput {
+                    runtime: Some(&state.identity),
+                    settings: &state.settings,
+                    ec_state: &mut ec_state,
+                    graph: &graph,
+                    rate_limiter: &AllowAll,
+                    timings: None,
+                },
+                response,
+                &mut |_| after_send(),
+            )
+        }
+
+        /// Withdraws consent on an `/auction` call, as a second tab can.
+        fn withdraw_on_auction(state: &Arc<AppState>) {
+            let (response, _) = drive_with_runtime(
+                state,
+                auction_request(Some(&ec_cookie()), &auction_body(None)),
+                Some(&state.identity),
+                withdraw,
+            );
+            assert_no_server_identity_cookie(&response);
+            assert!(
+                set_cookies(&response)
+                    .iter()
+                    .any(|cookie| cookie.starts_with("ts-ec=;") && cookie.contains("Max-Age=0")),
+                "control: the withdrawal should expire ts-ec: {:?}",
+                set_cookies(&response)
+            );
+        }
+
+        #[test]
+        fn withdrawal_on_auction_after_navigation_send_makes_phase_four_drop_and_call_nothing() {
+            let control = full_scenario();
+            control.seed_live();
+            let (_, outcome) = control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "control: should flush"
+            );
+            assert_eq!(
+                control.network.requests_to(PULL_HOST).len(),
+                1,
+                "control: should call the due provider"
+            );
+
+            let scenario = full_scenario();
+            scenario.seed_live();
+            let state = Arc::clone(&scenario.state);
+
+            let outcome = drive_with_send_hook(
+                &state,
+                navigation(Some(&returning_with_shared_id())),
+                &mut || withdraw_on_auction(&state),
+            );
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Dropped("tombstone")),
+                "should drop the navigation's mutation"
+            );
+            assert!(
+                scenario.network.requests_to(PULL_HOST).is_empty(),
+                "should call no provider after the tombstone"
+            );
+            assert_writes(
+                &scenario.store,
+                (1, 1, 0),
+                "the withdrawal's marker and tombstone only, nothing from phase 4",
+            );
+            let row = scenario.row();
+            assert!(!row.consent.ok, "should leave the tombstone");
+            assert!(row.ids.is_empty(), "should hold no ID after the tombstone");
+        }
+
+        #[test]
+        fn withdrawal_returns_clear_for_the_mirror() {
+            let scenario = auction_scenario();
+            scenario.seed(&row_with_set(Some(FAR_FUTURE)));
+            let (before, _) =
+                scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+            assert_eq!(
+                mirror_of(&json_of(before)),
+                serde_json::json!({ "v": 1, "eids": full_entry_set_eids() }),
+                "control: a live row should be mirrored"
+            );
+
+            withdraw_on_auction(&scenario.state);
+            let (after, _) =
+                scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            assert_eq!(
+                mirror_of(&json_of(after)),
+                serde_json::json!({ "clear": true }),
+                "should tell the shim to expire the mirror"
+            );
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                serde_json::Value::Null,
+                "should send bidders no ID from a tombstoned row"
+            );
+        }
+
+        #[test]
+        fn consent_withdrawal_writes_tombstone_and_marker() {
+            // (refused conditional writes, tombstone CAS attempts, marker
+            // writes, whether the row ends tombstoned)
+            let cases = [
+                (0_usize, 1_usize, 1_usize, true),
+                (5, 6, 1, true),
+                (10, 10, 0, false),
+            ];
+            for (refused, tombstone_attempts, markers, tombstoned) in cases {
+                let scenario = Scenario::new();
+                scenario.seed_live();
+                if refused > 0 {
+                    scenario.store.refuse_conditional_writes(EC_ID, refused);
+                }
+
+                let (response, outcome) = drive_with_runtime(
+                    &scenario.state,
+                    navigation(Some(&ec_cookie())),
+                    Some(&scenario.state.identity),
+                    withdraw,
+                );
+
+                assert_no_server_identity_cookie(&response);
+                assert_eq!(
+                    outcome,
+                    Some(FlushOutcome::Skipped),
+                    "should flush nothing after a withdrawal: {refused} refused"
+                );
+                assert_writes(
+                    &scenario.store,
+                    (markers, tombstone_attempts, 0),
+                    &format!("{refused} refused writes: the marker, then every tombstone attempt"),
+                );
+                assert_eq!(
+                    !scenario.row().consent.ok,
+                    tombstoned,
+                    "should end tombstoned only when an attempt landed: {refused} refused"
+                );
+            }
+        }
+
+        #[test]
+        fn cas_conflict_on_flush_is_one_attempt() {
+            let scenario = Scenario::new();
+            scenario.seed_live();
+            scenario.store.refuse_conditional_writes(EC_ID, 5);
+
+            let (_, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::WriteFailed {
+                    removals: trusted_server_core::ec::identity::flush::RemovalWriteOutcome::NothingToWrite
+                }),
+                "should fail the flush with no removal to write"
+            );
+            assert_writes(
+                &scenario.store,
+                (0, 1, 0),
+                "one refused attempt, and no retry although four more would be refused",
+            );
+
+            let control = Scenario::new();
+            control.seed_live();
+            control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_writes(&control.store, (0, 1, 0), "control: one attempt that lands");
+        }
+
+        #[test]
+        fn refused_flush_is_rederived_by_the_next_navigation() {
+            let scenario = Scenario::new();
+            scenario.seed_live();
+            scenario.store.refuse_conditional_writes(EC_ID, 1);
+
+            scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                stored_uid(&scenario.row(), "sharedid.org"),
+                None,
+                "should not hold the ID after the refused write"
+            );
+            assert_writes(&scenario.store, (0, 1, 0), "the refused attempt");
+
+            let (_, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should write the second time"
+            );
+            assert_writes(&scenario.store, (0, 2, 0), "one attempt per navigation");
+            assert_eq!(
+                stored_uid(&scenario.row(), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should hold the ingest the second navigation re-derived from the same cookies"
+            );
+        }
+
+        #[test]
+        fn deleted_row_is_found_by_the_next_writer_and_rotated() {
+            let scenario = Scenario::new();
+            scenario.seed_live();
+            scenario
+                .graph()
+                .delete(EC_ID)
+                .expect("should delete the row out of band");
+            scenario.store.reset_counts();
+
+            let (response, _) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            let rotated = set_cookie_value(&response, "ts-ec").expect("should set the new EC");
+            assert_ne!(rotated, EC_ID, "should rotate to a new ID");
+            assert_writes(
+                &scenario.store,
+                (1, 0, 0),
+                "one Add creates the replacement",
+            );
+            assert_eq!(
+                stored_uid(&scenario.row_of(&rotated), "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should carry the ingest in the replacement row"
+            );
+            assert!(
+                scenario.graph().get(EC_ID).expect("should read").is_none(),
+                "should not resurrect the deleted ID"
+            );
+        }
+
+        #[test]
+        fn stager_that_sees_missing_row_returns_clear_and_next_writer_recovers() {
+            let live = auction_scenario();
+            live.seed(&row_with_set(Some(FAR_FUTURE)));
+            let (served, _) = live.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+            assert_ne!(
+                mirror_of(&json_of(served)),
+                serde_json::json!({ "clear": true }),
+                "control: a live row should be mirrored"
+            );
+
+            let scenario = auction_scenario();
+            let (response, _) =
+                scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            assert_eq!(
+                mirror_of(&json_of(response)),
+                serde_json::json!({ "clear": true }),
+                "should return clear for a missing row"
+            );
+            assert_no_writes(&scenario.store, "the stager stores nothing");
+            assert!(
+                scenario.graph().get(EC_ID).expect("should read").is_none(),
+                "should not create the row"
+            );
+
+            let (navigated, _) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            let rotated = set_cookie_value(&navigated, "ts-ec").expect("should set the new EC");
+            assert_ne!(rotated, EC_ID, "the next writer should recover by rotating");
+            assert_writes(&scenario.store, (1, 0, 0), "one Add by the writer");
+        }
+
+        const REGISTERED_ONLY_COOKIE: &str =
+            include_str!("../../trusted-server-js/lib/test/fixtures/ts-eids-registered-only.txt");
+        const ORTB2_ONLY_COOKIE: &str =
+            include_str!("../../trusted-server-js/lib/test/fixtures/ts-eids-ortb2-only.txt");
+
+        /// A provider that answers every call by invalidating the ID of its
+        /// one source, so the flush carries a removal.
+        struct InvalidatingProvider {
+            descriptor: trusted_server_core::ec::identity::ProviderDescriptor,
+            source: trusted_server_core::ec::identity::SourceDomain,
+        }
+
+        impl InvalidatingProvider {
+            fn new(id: &str, source: &str) -> Self {
+                use trusted_server_core::ec::identity::{ProviderDescriptor, Resolves};
+                let source: trusted_server_core::ec::identity::SourceDomain =
+                    source.parse().expect("should parse the source");
+                let descriptor =
+                    ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+                        .with_source(source.clone())
+                        .with_resolves(
+                            Resolves::new().with_endpoint("https://probe.example.com/resolve"),
+                        )
+                        .with_consent_policy(
+                            trusted_server_core::ec::identity::test_support::resolver_policy(),
+                        )
+                        .build()
+                        .expect("should build the descriptor");
+                Self { descriptor, source }
+            }
+        }
+
+        impl trusted_server_core::ec::identity::IdentityProvider for InvalidatingProvider {
+            fn descriptor(&self) -> &trusted_server_core::ec::identity::ProviderDescriptor {
+                &self.descriptor
+            }
+
+            fn request(
+                &self,
+                input: &trusted_server_core::ec::identity::ResolveInput<'_>,
+            ) -> Result<
+                Option<trusted_server_core::ec::identity::ProviderRequest>,
+                Report<trusted_server_core::ec::identity::IdentityProviderError>,
+            > {
+                Ok(Some(
+                    trusted_server_core::ec::identity::ProviderRequest::get(input.endpoint()?),
+                ))
+            }
+
+            fn response(
+                &self,
+                response: &trusted_server_core::ec::identity::ProviderResponse,
+                _input: &trusted_server_core::ec::identity::ResolveInput<'_>,
+            ) -> Result<
+                trusted_server_core::ec::identity::Resolution,
+                Report<trusted_server_core::ec::identity::IdentityProviderError>,
+            > {
+                response.success_text()?;
+                Ok(trusted_server_core::ec::identity::Resolution::invalidate(
+                    &self.source,
+                ))
+            }
+        }
+
+        /// A scenario whose one provider invalidates the ID it wrote for
+        /// `ssp.example.com`, which the seeded row holds and is due to refresh.
+        fn invalidating_scenario() -> Scenario {
+            let Scenario {
+                state,
+                store,
+                network,
+            } = Scenario::new();
+            let provider: Arc<dyn trusted_server_core::ec::identity::IdentityProvider> = Arc::new(
+                InvalidatingProvider::new("removal-probe", "ssp.example.com"),
+            );
+            let runtime = IdentityRuntime::from_settings_with_providers(
+                &state.settings,
+                vec![provider],
+                BTreeMap::from([(
+                    "ssp.example.com".parse().expect("should parse the source"),
+                    "removal-probe"
+                        .parse()
+                        .expect("should parse the provider ID"),
+                )]),
+            )
+            .expect("should build the identity runtime");
+            let scenario = Scenario {
+                state: crate::app::app_state_with_identity_for_test(state, runtime),
+                store,
+                network,
+            };
+            scenario
+                .network
+                .respond("probe.example.com", 200, "text/plain", "ok");
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "ssp.example.com".to_owned(),
+                KvPartnerId {
+                    w: Some("removal-probe".to_owned()),
+                    rv: Some("0123456789abcdef".to_owned()),
+                    at: Some(1_000),
+                    ra: Some(1_500),
+                    ..KvPartnerId::new("probe-uid")
+                },
+            );
+            scenario.seed(&entry);
+            scenario
+        }
+
+        #[test]
+        fn refused_flush_writes_its_removals_alone() {
+            let control = invalidating_scenario();
+            control.drive(navigation(Some(&returning_with_shared_id())));
+            assert_writes(&control.store, (0, 1, 0), "control: one write holds both");
+            let row = control.row();
+            assert_eq!(
+                stored_uid(&row, "ssp.example.com"),
+                None,
+                "control: the removal should be in the one write"
+            );
+            assert_eq!(
+                stored_uid(&row, "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "control: so should the ingest"
+            );
+
+            let refused_once = invalidating_scenario();
+            refused_once.store.refuse_conditional_writes(EC_ID, 1);
+
+            let (_, outcome) = refused_once.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::WriteFailed {
+                    removals:
+                        trusted_server_core::ec::identity::flush::RemovalWriteOutcome::Written
+                }),
+                "should write the removals after the flush is refused"
+            );
+            assert_writes(
+                &refused_once.store,
+                (0, 2, 0),
+                "the refused flush, then the removals alone",
+            );
+            let row = refused_once.row();
+            assert_eq!(
+                stored_uid(&row, "ssp.example.com"),
+                None,
+                "should have removed the invalidated ID"
+            );
+            assert_eq!(
+                stored_uid(&row, "sharedid.org"),
+                None,
+                "should not write the refused ingest with the removals"
+            );
+
+            let refused_always = invalidating_scenario();
+            refused_always.store.refuse_conditional_writes(EC_ID, 6);
+
+            let (_, outcome) = refused_always.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::WriteFailed {
+                    removals: trusted_server_core::ec::identity::flush::RemovalWriteOutcome::Failed
+                }),
+                "should report the removal write failed when every attempt is refused"
+            );
+            assert_writes(
+                &refused_always.store,
+                (1, 6, 0),
+                "the flush once, the removals up to five times, then the pending key",
+            );
+            assert_eq!(
+                stored_uid(&refused_always.row(), "ssp.example.com").as_deref(),
+                Some("probe-uid"),
+                "should leave the row as it was"
+            );
+
+            let (_, next) = refused_always.drive(navigation(Some(&format!("ts-ec={EC_ID}"))));
+
+            assert_eq!(
+                next,
+                Some(FlushOutcome::Written),
+                "should merge the pending key on the next writer"
+            );
+            assert_eq!(
+                stored_uid(&refused_always.row(), "ssp.example.com"),
+                None,
+                "should apply the removal the earlier flush missed"
+            );
+        }
+
+        /// A scenario whose Didomi proxy answers `body`, with a capture-only
+        /// provider listening on that proxy's path and a row holding a
+        /// browser-written `ssp.example.com` ID for it to invalidate.
+        fn capture_scenario(body: &str) -> Scenario {
+            capture_scenario_with(body, false)
+        }
+
+        /// As [`capture_scenario`], with the provider's `revoke_scope` set to
+        /// `"global"` when `global`. The settings are changed after the app
+        /// state is built, as config validation knows no capture-only
+        /// provider.
+        fn capture_scenario_with(body: &str, global: bool) -> Scenario {
+            let Scenario {
+                mut state,
+                store,
+                network,
+            } = Scenario::with_settings(DIDOMI_TOML);
+            if global {
+                let owned = Arc::get_mut(&mut state).expect("should own the fresh state");
+                Arc::make_mut(&mut owned.settings)
+                    .ec
+                    .identity
+                    .providers
+                    .insert(
+                        "didomi".to_owned(),
+                        trusted_server_core::settings::ProviderSettings {
+                            revoke_scope: Some(trusted_server_core::settings::RevokeScope::Global),
+                            ..trusted_server_core::settings::ProviderSettings::default()
+                        },
+                    );
+            }
+            let provider =
+                trusted_server_core::ec::identity::test_support::answering_capture_provider(
+                    "didomi",
+                    &["ssp.example.com"],
+                    None,
+                );
+            let runtime = IdentityRuntime::from_settings_with_providers(
+                &state.settings,
+                vec![provider],
+                BTreeMap::new(),
+            )
+            .expect("should build the identity runtime");
+            let scenario = Scenario {
+                state: crate::app::app_state_with_identity_for_test(state, runtime),
+                store,
+                network,
+            };
+            scenario
+                .network
+                .respond("sdk.example.com", 200, "application/json", body);
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "ssp.example.com".to_owned(),
+                KvPartnerId {
+                    rv: Some("0123456789abcdef".to_owned()),
+                    at: Some(1_000),
+                    ..KvPartnerId::new("probe-uid")
+                },
+            );
+            scenario.seed(&entry);
+            scenario
+        }
+
+        const CAPTURE_INVALIDATION: &str = r#"{"invalidate":["ssp.example.com"]}"#;
+
+        #[test]
+        fn capture_removal_is_a_separate_write_beside_the_one_flush() {
+            let control = capture_scenario(r#"{}"#);
+            control.drive(didomi_navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &control.store,
+                (0, 1, 0),
+                "control: a proxied navigation with nothing to capture flushes once",
+            );
+
+            let scenario = capture_scenario(CAPTURE_INVALIDATION);
+
+            let (response, outcome) =
+                scenario.drive(didomi_navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(response.status(), 200, "should serve the proxied answer");
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should still flush the writer's ingest"
+            );
+            assert_writes(
+                &scenario.store,
+                (0, 2, 0),
+                "the capture removal write, then the writer's one flush",
+            );
+            let row = scenario.row();
+            assert_eq!(
+                stored_uid(&row, "ssp.example.com"),
+                None,
+                "should have removed the captured invalidation"
+            );
+            assert_eq!(
+                stored_uid(&row, "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "should keep the writer's own ingest in its flush"
+            );
+        }
+
+        #[test]
+        fn capture_global_revoke_tombstones_the_row_and_expires_the_ec_cookie() {
+            let scenario = capture_scenario_with(r#"{"opted_out":true}"#, true);
+
+            let (response, _) =
+                scenario.drive(didomi_navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(response.status(), 200, "should serve the proxied answer");
+            let row = scenario.row();
+            assert!(!row.consent.ok, "should tombstone the row");
+            assert!(row.ids.is_empty(), "should remove every ID");
+            assert!(
+                set_cookies(&response).iter().any(|cookie| {
+                    cookie_name(cookie) == "ts-ec" && cookie.contains("Max-Age=0")
+                }),
+                "should expire the EC cookie"
+            );
+            let writes = scenario.store.writes();
+            assert_eq!(
+                (writes.if_generation_match, writes.overwrite),
+                (1, 0),
+                "should write one tombstone and no flush"
+            );
+        }
+
+        #[test]
+        fn failed_capture_removal_write_runs_once_more_after_send() {
+            let scenario = capture_scenario(CAPTURE_INVALIDATION);
+            scenario.store.refuse_conditional_writes(EC_ID, 5);
+
+            let (outcome, measurement) = drive_measured_for_test(
+                &scenario.state,
+                didomi_navigation(Some(&returning_with_shared_id())),
+            );
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should flush the ingest too"
+            );
+            assert_writes(
+                &scenario.store,
+                (0, 7, 0),
+                "five refused attempts before send, the retry after send, the flush",
+            );
+            assert_eq!(
+                stored_uid(&scenario.row(), "ssp.example.com"),
+                None,
+                "should have written the removal after send"
+            );
+            assert_eq!(measurement.removal_lost(), 0, "should lose no removal");
+        }
+
+        #[test]
+        fn capture_removal_after_both_attempts_reaches_the_row_through_the_pending_key() {
+            let scenario = capture_scenario(CAPTURE_INVALIDATION);
+            scenario.store.refuse_conditional_writes(EC_ID, 10);
+
+            let (outcome, measurement) = drive_measured_for_test(
+                &scenario.state,
+                didomi_navigation(Some(&returning_with_shared_id())),
+            );
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Written),
+                "should flush the merge"
+            );
+            assert_eq!(measurement.removal_lost(), 0, "should lose no removal");
+            assert!(
+                measurement.to_string().contains("removal_deferred=1"),
+                "should print the deferral on the measurement line"
+            );
+            assert_eq!(
+                stored_uid(&scenario.row(), "ssp.example.com"),
+                None,
+                "should apply the removal in the writer's flush"
+            );
+        }
+
+        #[test]
+        fn capture_removal_lost_after_both_attempts_is_counted() {
+            let scenario = capture_scenario(CAPTURE_INVALIDATION);
+            scenario.store.refuse_conditional_writes(EC_ID, 10);
+            scenario.store.fail_all_writes(&format!("pending:{EC_ID}"));
+
+            let (_, measurement) = drive_measured_for_test(
+                &scenario.state,
+                didomi_navigation(Some(&returning_with_shared_id())),
+            );
+
+            assert_eq!(
+                measurement.removal_lost(),
+                1,
+                "should count the removal lost after both attempts"
+            );
+            assert!(
+                measurement.to_string().contains("removal_lost=1"),
+                "should print the count on the measurement line"
+            );
+        }
+
+        #[test]
+        fn capture_positive_ids_are_counted_on_the_measurement_line_and_not_stored() {
+            let scenario = capture_scenario(
+                r#"{"tokens":[{"source":"ssp.example.com","value":"captured-secret-uid"}]}"#,
+            );
+
+            let (_, measurement) = drive_measured_for_test(
+                &scenario.state,
+                didomi_navigation(Some(&returning_with_shared_id())),
+            );
+
+            let line = measurement.to_string();
+            assert!(
+                line.contains("capture_unpersisted=didomi/ssp.example.com:1"),
+                "should count the positive ID: {line}"
+            );
+            assert!(
+                !line.contains("captured-secret-uid"),
+                "should print no value: {line}"
+            );
+            assert_eq!(
+                stored_uid(&scenario.row(), "ssp.example.com").as_deref(),
+                Some("probe-uid"),
+                "should not store the captured ID"
+            );
+        }
+
+        #[test]
+        fn registered_source_beyond_todays_trim_reaches_kv_on_next_navigation() {
+            use base64::Engine as _;
+            let cookie_value = REGISTERED_ONLY_COOKIE.trim_end();
+            let decoded: serde_json::Value = serde_json::from_slice(
+                &base64::engine::general_purpose::STANDARD
+                    .decode(cookie_value)
+                    .expect("should decode the shim's cookie"),
+            )
+            .expect("should parse the shim's cookie");
+            let sources: Vec<&str> = decoded
+                .as_array()
+                .expect("should be a list")
+                .iter()
+                .filter_map(|entry| entry["source"].as_str())
+                .collect();
+            assert_eq!(
+                sources,
+                ["registered.example.com"],
+                "control: the shim should keep only the registered source"
+            );
+            let scenario = Scenario::with_settings(&partner_toml("registered.example.com"));
+            scenario.seed_live();
+
+            let (_, outcome) = scenario.drive(navigation(Some(&format!(
+                "ts-ec={EC_ID}; ts-eids={cookie_value}"
+            ))));
+
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_writes(&scenario.store, (0, 1, 0), "one write");
+            let row = scenario.row();
+            assert_eq!(
+                stored_uid(&row, "registered.example.com"),
+                Some("x".repeat(400)),
+                "should hold the registered source the old trim would have dropped"
+            );
+            assert!(
+                (0..7).all(|index| !row.ids.contains_key(&format!("u{index}.example.com"))),
+                "should hold no unregistered source: {:?}",
+                row.ids.keys().collect::<Vec<_>>()
+            );
+        }
+
+        #[test]
+        fn ortb2_only_eid_reaches_kv() {
+            let scenario = Scenario::new();
+            scenario.seed_live();
+            assert_eq!(
+                stored_uid(&scenario.row(), "id5-sync.com"),
+                None,
+                "control: id5-sync.com should be absent from KV before the navigation"
+            );
+            let cookie = format!("ts-ec={EC_ID}; ts-eids={}", ORTB2_ONLY_COOKIE.trim_end());
+
+            let (_, outcome) = scenario.drive(navigation(Some(&cookie)));
+
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_writes(&scenario.store, (0, 1, 0), "one write");
+            assert_eq!(
+                stored_uid(&scenario.row(), "id5-sync.com").as_deref(),
+                Some("fictional-id5"),
+                "should hold the ID5 UID the shim copied from the ortb2 config"
+            );
+        }
+
+        /// Everything a visitor's navigation, `/auction` and `/identify`
+        /// produce, for comparing runs.
+        #[derive(Debug, PartialEq)]
+        struct Observed {
+            navigation: (u16, Option<FlushOutcome>),
+            origin_cookie: Option<String>,
+            row_uids: BTreeMap<String, Option<String>>,
+            bidder_request: serde_json::Value,
+            auction_header_eids: serde_json::Value,
+            auction_mirror: serde_json::Value,
+            identify: (u16, serde_json::Value),
+            writes: (usize, usize, usize),
+        }
+
+        fn observe_with_mirror_cookie(mirror: Option<&str>) -> Observed {
+            let scenario = auction_scenario();
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "id5-sync.com".to_owned(),
+                KvPartnerId::browser("server-id5", Some(1_500)),
+            );
+            scenario.seed(&entry);
+            let mut cookie = returning_with_shared_id();
+            if let Some(mirror) = mirror {
+                cookie.push_str(&format!("; __Host-ts-eids-s={mirror}"));
+            }
+
+            let (nav, nav_outcome) = scenario.drive(navigation(Some(&cookie)));
+            let (auction, _) = scenario.drive(auction_request(Some(&cookie), &auction_body(None)));
+            let (identify, _) = scenario.drive(identify_request(&cookie, "sharedid.org"));
+
+            let mut bidder_request = bidder_body(&scenario);
+            bidder_request
+                .as_object_mut()
+                .expect("should be an object")
+                .remove("id");
+            let row = scenario.row();
+            let writes = scenario.store.writes();
+            let origin_cookie = scenario
+                .network
+                .requests_to(ORIGIN_HOST)
+                .first()
+                .and_then(|seen| seen.headers.get("cookie"))
+                .and_then(|value| value.to_str().ok())
+                .map(str::to_owned);
+            Observed {
+                navigation: (nav.status().as_u16(), nav_outcome),
+                origin_cookie,
+                row_uids: row
+                    .ids
+                    .keys()
+                    .map(|source| (source.clone(), stored_uid(&row, source)))
+                    .collect(),
+                bidder_request,
+                auction_header_eids: header_eids(&auction),
+                auction_mirror: mirror_of(&json_of(auction)),
+                identify: (identify.status().as_u16(), json_of(identify)),
+                writes: (writes.add, writes.if_generation_match, writes.overwrite),
+            }
+        }
+
+        #[test]
+        fn forged_mirror_cookie_changes_nothing() {
+            use base64::Engine as _;
+            let encode = |value: &serde_json::Value| {
+                base64::engine::general_purpose::URL_SAFE_NO_PAD
+                    .encode(serde_json::to_vec(value).expect("should serialize the mirror"))
+            };
+            let forged = encode(&serde_json::json!({
+                "v": 1,
+                "eids": [
+                    { "source": "sharedid.org", "uids": [{ "id": "forged-uid", "atype": 1 }] },
+                    { "source": "forged.example.com", "uids": [{ "id": "forged-uid", "atype": 1 }] }
+                ]
+            }));
+            let stale = encode(&serde_json::json!({
+                "v": 1,
+                "eids": [{ "source": "id5-sync.com", "uids": [{ "id": "stale-id5", "atype": 1 }] }]
+            }));
+            let baseline = observe_with_mirror_cookie(None);
+            let shown = format!("{baseline:?}");
+            assert!(
+                shown.contains("server-id5") && shown.contains(SHARED_ID),
+                "control: the baseline should hold the server and browser IDs: {shown}"
+            );
+            assert_eq!(
+                baseline.writes,
+                (0, 1, 0),
+                "control: the navigation should write once"
+            );
+
+            for (name, value) in [
+                ("forged", forged.as_str()),
+                ("stale", stale.as_str()),
+                ("malformed", "%%%not-base64"),
+                ("empty", ""),
+            ] {
+                let observed = observe_with_mirror_cookie(Some(value));
+
+                assert_eq!(
+                    observed, baseline,
+                    "should change no bidder request, answer or write: {name}"
+                );
+                let shown = format!("{observed:?}");
+                assert!(
+                    !shown.contains("forged-uid") && !shown.contains("stale-id5"),
+                    "should carry nothing from the {name} mirror: {shown}"
+                );
+            }
+        }
+
+        /// What the code before the identity work, run on this input,
+        /// stores: the first UID of the last entry of each registered
+        /// source, with the sharedId cookie last, and nothing for an
+        /// unregistered source.
+        const GOLDEN_INGEST_COOKIE: &str = "W3siZXh0Ijp7InNlZ21lbnRzIjpbInMxIl19LCJpbnNlcnRlciI6Imluc2VydGVyLmV4YW1wbGUuY29tIiwibW0iOjIsInNvdXJjZSI6ImlkNS1zeW5jLmNvbSIsInVpZHMiOlt7ImF0eXBlIjoxLCJpZCI6ImlkNS1maXJzdCJ9LHsiYXR5cGUiOjEsImlkIjoiaWQ1LXNlY29uZCJ9XX0seyJzb3VyY2UiOiJ1bnJlZ2lzdGVyZWQuZXhhbXBsZS5jb20iLCJ1aWRzIjpbeyJhdHlwZSI6MSwiaWQiOiJ1bnJlZy0xIn1dfSx7InNvdXJjZSI6InNoYXJlZGlkLm9yZyIsInVpZHMiOlt7ImF0eXBlIjoxLCJpZCI6InByZWJpZC1zaGFyZWQifV19LHsiaW5zZXJ0ZXIiOiJsYXRlci5leGFtcGxlLmNvbSIsIm1tIjoxLCJzb3VyY2UiOiJpZDUtc3luYy5jb20iLCJ1aWRzIjpbeyJhdHlwZSI6MSwiaWQiOiJpZDUtbGFzdC1maXJzdCJ9LHsiYXR5cGUiOjEsImlkIjoiaWQ1LWxhc3Qtc2Vjb25kIn1dfV0=";
+
+        /// The `x-ts-eids` value the code before the identity work builds
+        /// for [`GOLDEN_ROW_EIDS`].
+        const GOLDEN_ROW_HEADER: &str = "W3sic291cmNlIjoiaWQ1LXN5bmMuY29tIiwidWlkcyI6W3siaWQiOiJpZDUtdWlkIiwiYXR5cGUiOjN9XX0seyJzb3VyY2UiOiJzaGFyZWRpZC5vcmciLCJ1aWRzIjpbeyJpZCI6InNoYXJlZC11aWQiLCJhdHlwZSI6M31dfV0=";
+
+        /// A body with repeated sources and EID-level fields.
+        const GOLDEN_BODY_EIDS: &str = r#"[
+            {"inserter":"adserver.org","matcher":"adserver.org","mm":4,"source":"adserver.org","uids":[{"atype":1,"ext":{"rtiPartner":"TDID"},"id":"body-tdid"}]},
+            {"ext":{"segments":["s1"]},"inserter":"other.example.com","mm":1,"source":"adserver.org","uids":[{"atype":1,"id":"body-tdid-2"}]},
+            {"source":"ids.example.com","uids":[{"atype":3,"id":"ids-uid"}]}
+        ]"#;
+
+        /// What the code before the identity work forwards for
+        /// [`GOLDEN_BODY_EIDS`] and an empty row.
+        const GOLDEN_BODY_FORWARDED: &str = r#"[
+            {"source":"adserver.org","uids":[{"id":"body-tdid","atype":1,"ext":{"rtiPartner":"TDID"}}],"inserter":"adserver.org","matcher":"adserver.org","mm":4},
+            {"source":"adserver.org","uids":[{"id":"body-tdid-2","atype":1}],"inserter":"other.example.com","mm":1,"ext":{"segments":["s1"]}},
+            {"source":"ids.example.com","uids":[{"id":"ids-uid","atype":3}]}
+        ]"#;
+
+        fn golden_expected_ingest() -> BTreeMap<String, String> {
+            BTreeMap::from([
+                ("id5-sync.com".to_owned(), "id5-last-first".to_owned()),
+                ("sharedid.org".to_owned(), "shared-1".to_owned()),
+            ])
+        }
+
+        /// Each source's first UID, with a check that the record is one
+        /// entry holding one UID and nothing else.
+        fn assert_one_uid_records(row: &KvEntry) -> BTreeMap<String, String> {
+            row.ids
+                .iter()
+                .map(|(source, record)| {
+                    assert_eq!(record.w, None, "should write no provider: {source}");
+                    assert_eq!(record.eids.len(), 1, "should hold one entry: {source}");
+                    let entry = &record.eids[0];
+                    assert_eq!(entry.uids.len(), 1, "should hold one UID: {source}");
+                    assert_eq!(
+                        (&entry.inserter, &entry.matcher, entry.mm, &entry.ext),
+                        (&None, &None, None, &None),
+                        "should hold no EID-level field: {source}"
+                    );
+                    assert_eq!(
+                        (entry.uids[0].atype, &entry.uids[0].ext),
+                        (None, &None),
+                        "should hold no UID-level field: {source}"
+                    );
+                    (source.clone(), entry.uids[0].id.clone())
+                })
+                .collect()
+        }
+
+        #[test]
+        fn golden_browser_ingest_writes_the_first_uid() {
+            let cookie = format!("ts-eids={GOLDEN_INGEST_COOKIE}; sharedId=shared-1");
+
+            let returning = Scenario::new();
+            returning.seed_live();
+            let (_, outcome) =
+                returning.drive(navigation(Some(&format!("ts-ec={EC_ID}; {cookie}"))));
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_writes(&returning.store, (0, 1, 0), "one flush");
+            assert_eq!(
+                assert_one_uid_records(&returning.row()),
+                golden_expected_ingest(),
+                "the flushed row should hold the UIDs the code before this spec stored"
+            );
+
+            let new_visitor = Scenario::new();
+            let (response, _) = new_visitor.drive(navigation(Some(&cookie)));
+            let minted = set_cookie_value(&response, "ts-ec").expect("should mint an EC");
+            assert_writes(&new_visitor.store, (1, 0, 0), "one create");
+            assert_eq!(
+                assert_one_uid_records(&new_visitor.row_of(&minted)),
+                golden_expected_ingest(),
+                "the created row should hold the same UIDs"
+            );
+        }
+
+        #[test]
+        fn golden_one_uid_row_goes_out_unchanged() {
+            let scenario = auction_scenario();
+            let mut entry = live_entry();
+            for (source, uid) in [("id5-sync.com", "id5-uid"), ("sharedid.org", "shared-uid")] {
+                entry
+                    .ids
+                    .insert(source.to_owned(), KvPartnerId::browser(uid, Some(1_500)));
+            }
+            scenario.seed(&entry);
+
+            let (response, _) =
+                scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            let expected: serde_json::Value = serde_json::json!([
+                { "source": "id5-sync.com", "uids": [{ "id": "id5-uid", "atype": 3 }] },
+                { "source": "sharedid.org", "uids": [{ "id": "shared-uid", "atype": 3 }] }
+            ]);
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                expected,
+                "user.ext.eids should equal what the code before this spec sent"
+            );
+            assert_eq!(
+                response
+                    .headers()
+                    .get("x-ts-eids")
+                    .and_then(|value| value.to_str().ok()),
+                Some(GOLDEN_ROW_HEADER),
+                "x-ts-eids should equal what the code before this spec built, byte for byte"
+            );
+        }
+
+        #[test]
+        fn golden_auction_body_forwarding_is_unchanged() {
+            let scenario = auction_scenario();
+            scenario.seed_live();
+            let eids: serde_json::Value =
+                serde_json::from_str(GOLDEN_BODY_EIDS).expect("should parse the body EIDs");
+            let forwarded: serde_json::Value = serde_json::from_str(GOLDEN_BODY_FORWARDED)
+                .expect("should parse the forwarded EIDs");
+            assert!(
+                forwarded.to_string().contains("rtiPartner")
+                    && forwarded.to_string().contains("other.example.com"),
+                "control: the golden should hold UID-level and EID-level fields"
+            );
+
+            scenario.drive(auction_request(
+                Some(&ec_cookie()),
+                &auction_body(Some(&eids)),
+            ));
+
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                forwarded,
+                "user.ext.eids should equal what the code before this spec forwarded"
+            );
+            assert_no_writes(&scenario.store, "/auction");
+        }
+
+        // ---- A registered provider's complete set, end to end (Task 39b) ----
+
+        /// The provider `MultiEntryTestProvider` registers as.
+        const MULTI_PROVIDER: &str = "exampleid";
+
+        /// The host `MultiEntryTestProvider` calls.
+        const MULTI_HOST: &str = "api.exampleid.example.com";
+
+        /// The registration `exampleid` makes for `provider`.
+        fn multi_registration(provider: MultiEntryTestProvider) -> IntegrationRegistration {
+            IntegrationRegistration::builder("exampleid")
+                .try_with_identity_provider(Ok::<_, Report<IdentityProviderError>>(provider))
+                .expect("should register the provider")
+                .build()
+        }
+
+        /// A scenario with the auction, the `exampleid` source registered for
+        /// the bidstream, and `registrations` contributing providers.
+        /// `exampleid` owns [`MULTI_ENTRY_SOURCE`] and runs in `mode`.
+        fn registered_scenario(
+            registrations: Vec<IntegrationRegistration>,
+            mode: ProviderMode,
+        ) -> Scenario {
+            let Scenario {
+                mut state,
+                store,
+                network,
+            } = Scenario::with_settings(&format!(
+                "{AUCTION_TOML}{}",
+                partner_toml(MULTI_ENTRY_SOURCE)
+            ));
+            let owned = Arc::get_mut(&mut state).expect("should own the fresh state");
+            Arc::make_mut(&mut owned.settings)
+                .ec
+                .identity
+                .providers
+                .insert(
+                    MULTI_PROVIDER.to_owned(),
+                    ProviderSettings {
+                        mode,
+                        ..ProviderSettings::default()
+                    },
+                );
+            let providers = registrations
+                .into_iter()
+                .flat_map(|registration| registration.identity_providers)
+                .collect();
+            let runtime = IdentityRuntime::from_settings_with_providers(
+                &state.settings,
+                providers,
+                BTreeMap::from([(
+                    MULTI_ENTRY_SOURCE.parse().expect("should parse the source"),
+                    MULTI_PROVIDER
+                        .parse()
+                        .expect("should parse the provider ID"),
+                )]),
+            )
+            .expect("should build the identity runtime");
+            let scenario = Scenario {
+                state: crate::app::app_state_with_identity_for_test(state, runtime),
+                store,
+                network,
+            };
+            scenario.network.respond(
+                BIDDER_HOST,
+                200,
+                "application/json",
+                r#"{"id":"response","seatbid":[]}"#,
+            );
+            answer_with(&scenario, "full");
+            scenario
+        }
+
+        /// A scenario whose one provider is `MultiEntryTestProvider`.
+        fn multi_scenario(provider: MultiEntryTestProvider, mode: ProviderMode) -> Scenario {
+            registered_scenario(vec![multi_registration(provider)], mode)
+        }
+
+        /// Makes the provider's endpoint answer with the `entries` shape.
+        fn answer_with(scenario: &Scenario, entries: &str) {
+            scenario.network.respond(
+                MULTI_HOST,
+                200,
+                "application/json",
+                &serde_json::json!({ "entries": entries }).to_string(),
+            );
+        }
+
+        fn kv_uid(id: &str, atype: Option<i32>, ext: Option<serde_json::Value>) -> KvUid {
+            KvUid {
+                id: id.to_owned(),
+                atype,
+                ext,
+            }
+        }
+
+        /// What the provider's `full` answer stores.
+        fn multi_full_set() -> Vec<KvEid> {
+            vec![
+                KvEid {
+                    uids: vec![
+                        kv_uid(
+                            "uid-a",
+                            Some(1),
+                            Some(serde_json::json!({ "rtiPartner": "example" })),
+                        ),
+                        kv_uid("uid-b", None, None),
+                    ],
+                    inserter: Some("inserter-a.example.com".to_owned()),
+                    matcher: Some("matcher-a.example.com".to_owned()),
+                    mm: Some(2),
+                    ext: None,
+                },
+                KvEid {
+                    uids: vec![kv_uid("uid-c", None, None)],
+                    inserter: None,
+                    matcher: None,
+                    mm: None,
+                    ext: Some(serde_json::json!({ "segments": ["example"] })),
+                },
+            ]
+        }
+
+        /// The first entry of the `full` answer, which the `first` answer
+        /// returns alone.
+        fn multi_first_set() -> Vec<KvEid> {
+            multi_full_set().into_iter().take(1).collect()
+        }
+
+        /// The first entry as bidders see it.
+        fn multi_first_eid() -> serde_json::Value {
+            serde_json::json!({
+                "source": MULTI_ENTRY_SOURCE,
+                "inserter": "inserter-a.example.com",
+                "matcher": "matcher-a.example.com",
+                "mm": 2,
+                "uids": [
+                    { "id": "uid-a", "atype": 1, "ext": { "rtiPartner": "example" } },
+                    { "id": "uid-b", "atype": EcPartner::default_openrtb_atype() }
+                ]
+            })
+        }
+
+        /// The second entry as bidders see it, with the provenance default.
+        fn multi_second_eid() -> serde_json::Value {
+            serde_json::json!({
+                "source": MULTI_ENTRY_SOURCE,
+                "inserter": "default-inserter.example.com",
+                "matcher": "default-matcher.example.com",
+                "ext": { "segments": ["example"] },
+                "uids": [{ "id": "uid-c", "atype": EcPartner::default_openrtb_atype() }]
+            })
+        }
+
+        /// A row holding `eids` for [`MULTI_ENTRY_SOURCE`], written by the
+        /// provider and due for a refresh.
+        fn multi_row(eids: Vec<KvEid>) -> KvEntry {
+            let mut entry = live_entry();
+            entry.ids.insert(
+                MULTI_ENTRY_SOURCE.to_owned(),
+                KvPartnerId {
+                    w: Some(MULTI_PROVIDER.to_owned()),
+                    rv: Some("0123456789abcdef".to_owned()),
+                    at: Some(1_000),
+                    ra: Some(1_500),
+                    eids,
+                    ..KvPartnerId::default()
+                },
+            );
+            entry
+        }
+
+        /// The record under [`MULTI_ENTRY_SOURCE`], with its fresh `rv` and `at`
+        /// checked and copied into the expectation of the caller.
+        fn fresh_record(row: &KvEntry) -> KvPartnerId {
+            let record = row
+                .ids
+                .get(MULTI_ENTRY_SOURCE)
+                .expect("should hold the provider's record")
+                .clone();
+            let revision = record.rv.as_deref().expect("should carry a revision");
+            assert!(
+                revision.len() == 16
+                    && revision
+                        .bytes()
+                        .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)),
+                "should carry a 16 digit lowercase hex rv"
+            );
+            assert_ne!(
+                revision, "0123456789abcdef",
+                "should carry a fresh rv, not the seeded one"
+            );
+            assert!(record.at.is_some(), "should record when it was acquired");
+            record
+        }
+
+        #[test]
+        fn registered_provider_full_set_reaches_kv_mirror_and_bidstream_in_order() {
+            let scenario = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            scenario.seed_live();
+
+            let (_, outcome) = scenario.drive(navigation(Some(&ec_cookie())));
+
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_eq!(
+                scenario.network.requests_to(MULTI_HOST).len(),
+                1,
+                "should call the registered provider once"
+            );
+            assert_writes(&scenario.store, (0, 1, 0), "one flush holds the whole set");
+            let record = fresh_record(&scenario.row());
+            assert_eq!(
+                record,
+                KvPartnerId {
+                    w: Some(MULTI_PROVIDER.to_owned()),
+                    rv: record.rv.clone(),
+                    at: record.at,
+                    exp: None,
+                    ra: None,
+                    ru: None,
+                    eids: multi_full_set(),
+                },
+                "should store both entries as returned, written by the provider"
+            );
+
+            scenario.store.reset_counts();
+            let body = auction_body(Some(&serde_json::json!([browser_entry()])));
+            let (response, _) = scenario.drive(auction_request(Some(&ec_cookie()), &body));
+
+            let expected =
+                serde_json::json!([browser_entry(), multi_first_eid(), multi_second_eid()]);
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                expected,
+                "user.ext.eids should carry the browser entry, then both entries in order"
+            );
+            assert_eq!(
+                header_eids(&response),
+                expected,
+                "x-ts-eids should carry the same"
+            );
+            assert_eq!(
+                mirror_of(&json_of(response)),
+                serde_json::json!({ "v": 1, "eids": [multi_first_eid(), multi_second_eid()] }),
+                "the mirror should decode to the same two entries, defaults included"
+            );
+            assert_eq!(
+                scenario.network.requests_to(MULTI_HOST).len(),
+                1,
+                "control: the /auction should serve from KV without calling the provider"
+            );
+            assert_no_writes(&scenario.store, "/auction");
+        }
+
+        #[test]
+        fn new_visitor_hold_answer_is_created_with_the_row_in_one_write() {
+            let scenario = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            let mut request = navigation(None);
+            // Keep the host aligned with the shared settings fixture.
+            *request.uri_mut() = "https://test-publisher.com/" // allow-domain: test-publisher.com
+                .parse()
+                .expect("should parse the home page URI");
+
+            let (response, outcome) = scenario.drive(request);
+
+            assert_eq!(
+                outcome,
+                Some(FlushOutcome::Skipped),
+                "should leave nothing for a flush"
+            );
+            assert_eq!(
+                scenario.network.requests_to(MULTI_HOST).len(),
+                1,
+                "should call the hold-mode provider on the first navigation"
+            );
+            assert_writes(&scenario.store, (1, 0, 0), "one create holds the answer");
+            let ec_id = set_cookie_value(&response, "ts-ec").expect("should set the EC cookie");
+            let (row, _) = scenario
+                .graph()
+                .get(&ec_id)
+                .expect("should read the row")
+                .expect("should create the row");
+            assert_eq!(
+                row.ids
+                    .values()
+                    .find(|record| record.w.as_deref() == Some(MULTI_PROVIDER))
+                    .map(|record| record.eids.clone()),
+                Some(multi_full_set()),
+                "should create the row with the provider's answer"
+            );
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                serde_json::json!([multi_first_eid(), multi_second_eid()]),
+                "should hand this navigation's auction the answer"
+            );
+        }
+
+        #[test]
+        fn one_entry_one_uid_result_is_written_as_one_entry() {
+            let scenario = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            scenario.seed_live();
+            answer_with(&scenario, "single");
+
+            scenario.drive(navigation(Some(&ec_cookie())));
+
+            assert_writes(&scenario.store, (0, 1, 0), "one flush");
+            let record = fresh_record(&scenario.row());
+            assert_eq!(
+                record,
+                KvPartnerId {
+                    w: Some(MULTI_PROVIDER.to_owned()),
+                    rv: record.rv.clone(),
+                    at: record.at,
+                    exp: None,
+                    ra: None,
+                    ru: None,
+                    eids: vec![KvEid {
+                        uids: vec![kv_uid(
+                            "uid-a",
+                            Some(1),
+                            Some(serde_json::json!({ "rtiPartner": "example" }))
+                        )],
+                        inserter: None,
+                        matcher: None,
+                        mm: None,
+                        ext: None,
+                    }],
+                },
+                "should store one entry holding one UID"
+            );
+            let stored = stored_body(&scenario);
+            assert_eq!(
+                stored["ids"][MULTI_ENTRY_SOURCE],
+                serde_json::json!({
+                    "w": MULTI_PROVIDER,
+                    "rv": record.rv,
+                    "at": record.at,
+                    "eids": [{
+                        "uids": [{
+                            "id": "uid-a",
+                            "atype": 1,
+                            "ext": { "rtiPartner": "example" }
+                        }]
+                    }]
+                }),
+                "should write the one shape of spec 6.1"
+            );
+        }
+
+        #[test]
+        fn later_result_without_an_entry_removes_it() {
+            let scenario = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            let mut row = multi_row(multi_full_set());
+            row.ids.insert(
+                "id5-sync.com".to_owned(),
+                KvPartnerId::browser("id5-uid", Some(1_500)),
+            );
+            scenario.seed(&row);
+            answer_with(&scenario, "first");
+
+            let (_, outcome) = scenario.drive(navigation(Some(&ec_cookie())));
+
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_eq!(
+                scenario.network.requests_to(MULTI_HOST).len(),
+                1,
+                "control: the due record should have been refreshed"
+            );
+            let after = scenario.row();
+            let record = fresh_record(&after);
+            assert_eq!(
+                record,
+                KvPartnerId {
+                    w: Some(MULTI_PROVIDER.to_owned()),
+                    rv: record.rv.clone(),
+                    at: record.at,
+                    exp: None,
+                    ra: None,
+                    ru: None,
+                    eids: multi_first_set(),
+                },
+                "should leave exactly the returned entry in KV"
+            );
+            assert_eq!(
+                after.ids.get("id5-sync.com"),
+                row.ids.get("id5-sync.com"),
+                "should keep the record of a source the result does not name"
+            );
+
+            let (_, _) = scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                serde_json::json!([
+                    multi_first_eid(),
+                    { "source": "id5-sync.com", "uids": [{ "id": "id5-uid", "atype": 3 }] }
+                ]),
+                "should serve exactly the remaining entry, and the other source's record"
+            );
+        }
+
+        #[test]
+        fn stateful_result_with_an_oversized_set_keeps_only_its_removals() {
+            let scenario = multi_scenario(MultiEntryTestProvider::stateful(), ProviderMode::Hold);
+            let mut row = multi_row(multi_first_set());
+            row.ps.insert(
+                MULTI_PROVIDER.to_owned(),
+                KvProviderState {
+                    st: Some(serde_json::json!({ "seen": false })),
+                    ..KvProviderState::default()
+                },
+            );
+            scenario.seed(&row);
+            answer_with(&scenario, "oversized");
+
+            scenario.drive(navigation(Some(&ec_cookie())));
+
+            assert_eq!(
+                scenario.network.requests_to(MULTI_HOST).len(),
+                1,
+                "control: the provider should have been called"
+            );
+            let after = scenario.row();
+            assert!(
+                !after.ids.contains_key(MULTI_ENTRY_SOURCE),
+                "should apply the also_invalidate removal and store none of the oversized set"
+            );
+            let state = after
+                .ps
+                .get(MULTI_PROVIDER)
+                .expect("should keep the provider's row state");
+            assert!(
+                state.n.is_some_and(|wait_until| wait_until > 1_700_000_000),
+                "should back off the rejected answer"
+            );
+            assert_eq!(
+                state,
+                &KvProviderState {
+                    n: state.n,
+                    f: 1,
+                    o: None,
+                    oc: None,
+                    iv: state.iv.clone(),
+                    ov: Vec::new(),
+                    st: Some(serde_json::json!({ "seen": false })),
+                },
+                "should keep the old state, not the rejected replacement, and count one failure"
+            );
+            assert_eq!(
+                state.iv.len(),
+                2,
+                "should record the two invalidated UIDs, so the removal is not undone"
+            );
+        }
+
+        #[test]
+        fn identify_returns_the_first_uid_of_a_full_record() {
+            let scenario = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            let mut row = multi_row(multi_full_set());
+            row.ids
+                .get_mut(MULTI_ENTRY_SOURCE)
+                .expect("should hold the record")
+                .ra = None;
+            row.ids.insert(
+                "id5-sync.com".to_owned(),
+                KvPartnerId::browser("id5-uid", Some(1_500)),
+            );
+            scenario.seed(&row);
+            let atype = EcPartner::default_openrtb_atype();
+
+            let full = json_of(
+                scenario
+                    .drive(identify_request(&ec_cookie(), MULTI_ENTRY_SOURCE))
+                    .0,
+            );
+            let one_uid = json_of(
+                scenario
+                    .drive(identify_request(&ec_cookie(), "id5-sync.com"))
+                    .0,
+            );
+
+            assert_eq!(full["uid"], "uid-a", "should return the first UID");
+            assert_eq!(
+                full["eid"],
+                serde_json::json!({
+                    "source": MULTI_ENTRY_SOURCE,
+                    "uids": [{ "id": "uid-a", "atype": atype }]
+                }),
+                "should return the first UID with the partner's openrtb_atype"
+            );
+            assert_eq!(
+                one_uid["eid"],
+                serde_json::json!({
+                    "source": "id5-sync.com",
+                    "uids": [{ "id": "id5-uid", "atype": atype }]
+                }),
+                "control: a one-UID record should have the same shape"
+            );
+            let keys = |body: &serde_json::Value| {
+                body.as_object()
+                    .expect("should be an object")
+                    .keys()
+                    .cloned()
+                    .collect::<Vec<_>>()
+            };
+            assert_eq!(
+                keys(&full),
+                keys(&one_uid),
+                "should answer in the same shape"
+            );
+        }
+
+        #[test]
+        fn rollback_to_part_1_config_keeps_the_owners_opt_out() {
+            let scenario = Scenario::with_settings(&format!(
+                "{AUCTION_TOML}{}",
+                partner_toml(MULTI_ENTRY_SOURCE)
+            ));
+            scenario.network.respond(
+                BIDDER_HOST,
+                200,
+                "application/json",
+                r#"{"id":"response","seatbid":[]}"#,
+            );
+            let mut row = multi_row(multi_full_set());
+            row.ps.insert(
+                MULTI_PROVIDER.to_owned(),
+                KvProviderState {
+                    n: Some(FAR_FUTURE),
+                    f: 2,
+                    o: Some(KvOptOut {
+                        at: 1_200,
+                        fp: "0".to_owned(),
+                    }),
+                    oc: Some(1_100),
+                    iv: vec!["00112233445566ff".to_owned()],
+                    ov: vec!["8899aabbccddeeff".to_owned()],
+                    st: Some(serde_json::json!({ "seen": true })),
+                },
+            );
+            scenario.seed(&row);
+
+            let (_, outcome) = scenario.drive(navigation(Some(&returning_with_shared_id())));
+
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            let after = scenario.row();
+            assert_eq!(
+                after.ps.get(MULTI_PROVIDER),
+                Some(&KvProviderState {
+                    n: None,
+                    f: 0,
+                    o: Some(KvOptOut {
+                        at: 1_200,
+                        fp: "0".to_owned(),
+                    }),
+                    oc: Some(1_100),
+                    iv: Vec::new(),
+                    ov: vec!["8899aabbccddeeff".to_owned()],
+                    st: None,
+                }),
+                "should keep o, oc and ov and lose n, f, iv and st"
+            );
+            assert_eq!(
+                after.ids.get(MULTI_ENTRY_SOURCE),
+                row.ids.get(MULTI_ENTRY_SOURCE),
+                "should keep the multi-entry record readable"
+            );
+            assert_eq!(
+                stored_uid(&after, "sharedid.org").as_deref(),
+                Some(SHARED_ID),
+                "control: the flush should have written the ingest"
+            );
+
+            scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+            let sent = bidder_eids(&bidder_body(&scenario));
+            assert!(
+                !sent.to_string().contains(MULTI_ENTRY_SOURCE),
+                "should not serve a record whose provider the catalog no longer has: {sent}"
+            );
+            assert!(
+                sent.to_string().contains("sharedid.org"),
+                "control: should still serve the browser record: {sent}"
+            );
+        }
+
+        /// A scenario whose Didomi proxy answers `body`, with a capture-only
+        /// provider registered through an `IntegrationRegistration`, and a
+        /// row holding a browser-written `ssp.example.com` ID.
+        fn registered_capture_scenario(body: &str, global: bool) -> Scenario {
+            let Scenario {
+                mut state,
+                store,
+                network,
+            } = Scenario::with_settings(DIDOMI_TOML);
+            if global {
+                let owned = Arc::get_mut(&mut state).expect("should own the fresh state");
+                Arc::make_mut(&mut owned.settings)
+                    .ec
+                    .identity
+                    .providers
+                    .insert(
+                        "didomi".to_owned(),
+                        ProviderSettings {
+                            revoke_scope: Some(trusted_server_core::settings::RevokeScope::Global),
+                            ..ProviderSettings::default()
+                        },
+                    );
+            }
+            let registration = IntegrationRegistration::builder("didomi")
+                .with_identity_provider(
+                    trusted_server_core::ec::identity::test_support::answering_capture_provider(
+                        "didomi",
+                        &["ssp.example.com"],
+                        None,
+                    ),
+                )
+                .build();
+            let runtime = IdentityRuntime::from_settings_with_providers(
+                &state.settings,
+                registration.identity_providers,
+                BTreeMap::new(),
+            )
+            .expect("should build the identity runtime");
+            let scenario = Scenario {
+                state: crate::app::app_state_with_identity_for_test(state, runtime),
+                store,
+                network,
+            };
+            scenario
+                .network
+                .respond("sdk.example.com", 200, "application/json", body);
+            let mut entry = live_entry();
+            entry.ids.insert(
+                "ssp.example.com".to_owned(),
+                KvPartnerId {
+                    rv: Some("0123456789abcdef".to_owned()),
+                    at: Some(1_000),
+                    ..KvPartnerId::new("probe-uid")
+                },
+            );
+            scenario.seed(&entry);
+            scenario
+        }
+
+        #[test]
+        fn captured_revocation_writes_with_cas() {
+            let clean = registered_capture_scenario(CAPTURE_INVALIDATION, false);
+            clean.drive(didomi_navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &clean.store,
+                (0, 2, 0),
+                "one CAS write for the removal before send, then the writer's flush",
+            );
+            assert_eq!(
+                stored_uid(&clean.row(), "ssp.example.com"),
+                None,
+                "should remove the captured ID"
+            );
+
+            let fifth = registered_capture_scenario(CAPTURE_INVALIDATION, false);
+            fifth.store.refuse_conditional_writes(EC_ID, 4);
+            fifth.drive(didomi_navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &fifth.store,
+                (0, 6, 0),
+                "four refused attempts and the fifth before send, no retry after send, the flush",
+            );
+            assert_eq!(
+                stored_uid(&fifth.row(), "ssp.example.com"),
+                None,
+                "should remove the ID on the fifth attempt"
+            );
+
+            let retried = registered_capture_scenario(CAPTURE_INVALIDATION, false);
+            retried.store.refuse_conditional_writes(EC_ID, 5);
+            retried.drive(didomi_navigation(Some(&returning_with_shared_id())));
+            assert_writes(
+                &retried.store,
+                (0, 7, 0),
+                "five refused attempts before send, one more after send, the flush",
+            );
+            assert_eq!(
+                stored_uid(&retried.row(), "ssp.example.com"),
+                None,
+                "should remove the ID on the attempt after send"
+            );
+        }
+
+        #[test]
+        fn global_revoke_from_real_browser_writes_as_withdrawal() {
+            let withdrawn = Scenario::new();
+            withdrawn.seed_live();
+            drive_with_runtime(
+                &withdrawn.state,
+                navigation(Some(&ec_cookie())),
+                Some(&withdrawn.state.identity),
+                withdraw,
+            );
+            let withdrawal_writes = withdrawn.store.writes();
+
+            let scenario = registered_capture_scenario(r#"{"opted_out":true}"#, true);
+
+            let (response, _) =
+                scenario.drive(didomi_navigation(Some(&returning_with_shared_id())));
+
+            let row = scenario.row();
+            assert!(!row.consent.ok, "should tombstone the row");
+            assert!(row.ids.is_empty(), "should remove every ID");
+            assert_eq!(
+                scenario.row().consent.ok,
+                withdrawn.row().consent.ok,
+                "should end as a consent withdrawal does"
+            );
+            let writes = scenario.store.writes();
+            assert_eq!(
+                (writes.add, writes.if_generation_match, writes.overwrite),
+                (
+                    withdrawal_writes.add,
+                    withdrawal_writes.if_generation_match,
+                    withdrawal_writes.overwrite
+                ),
+                "should write the tombstone and its marker as a withdrawal does"
+            );
+            assert!(
+                set_cookies(&response).iter().any(|cookie| {
+                    cookie_name(cookie) == "ts-ec" && cookie.contains("Max-Age=0")
+                }),
+                "should expire the EC cookie"
+            );
+        }
+
+        /// A proxied navigation from a client that fails the real-browser
+        /// check: no `Sec-Fetch-Dest`, a non-browser user agent.
+        fn non_browser_didomi_navigation() -> HttpRequest {
+            let mut request = didomi_navigation(Some(&returning_with_shared_id()));
+            request.extensions_mut().clear();
+            request.headers_mut().remove("sec-fetch-dest");
+            request
+                .headers_mut()
+                .insert("user-agent", HeaderValue::from_static("curl/8.0"));
+            request
+        }
+
+        #[test]
+        fn non_browser_capture_writes_its_removal() {
+            let scenario = registered_capture_scenario(CAPTURE_INVALIDATION, false);
+            assert!(
+                scenario.row().ids.contains_key("ssp.example.com"),
+                "control: the seeded row holds the record"
+            );
+
+            let (response, _) = scenario.drive(non_browser_didomi_navigation());
+
+            assert_eq!(response.status(), 200, "should serve the proxied answer");
+            assert!(
+                !scenario.row().ids.contains_key("ssp.example.com"),
+                "should apply the removal whatever the client"
+            );
+            assert!(
+                !set_cookies(&response)
+                    .iter()
+                    .any(|cookie| cookie_name(cookie) == "ts-ec" && cookie.contains("Max-Age=0")),
+                "should not expire the EC cookie"
+            );
+        }
+
+        #[test]
+        fn non_browser_global_revoke_writes_as_withdrawal() {
+            let scenario = registered_capture_scenario(r#"{"opted_out":true}"#, true);
+
+            let (response, _) = scenario.drive(non_browser_didomi_navigation());
+
+            assert!(!scenario.row().consent.ok, "should tombstone the row");
+            assert!(
+                set_cookies(&response).iter().any(|cookie| {
+                    cookie_name(cookie) == "ts-ec" && cookie.contains("Max-Age=0")
+                }),
+                "should expire the EC cookie"
+            );
+        }
+
+        #[test]
+        fn returning_navigation_answered_404_flushes_only_hold_removals_and_backoff() {
+            let removal_row = || multi_row(multi_first_set());
+            let drive_home = |scenario: &Scenario, status: u16| {
+                scenario.network.respond(
+                    ORIGIN_HOST,
+                    status,
+                    "text/html",
+                    "<html><head></head><body>page</body></html>",
+                );
+                let mut request = navigation(Some(&ec_cookie()));
+                // Keep the host aligned with the shared settings fixture.
+                *request.uri_mut() = "https://test-publisher.com/" // allow-domain: test-publisher.com
+                    .parse()
+                    .expect("should parse the home page URI");
+                scenario.drive(request)
+            };
+
+            let ok = multi_scenario(MultiEntryTestProvider::stateful(), ProviderMode::Hold);
+            ok.seed(&removal_row());
+            answer_with(&ok, "oversized");
+            drive_home(&ok, 200);
+            assert!(
+                !ok.row().ids.contains_key(MULTI_ENTRY_SOURCE),
+                "control: a 200 should flush the removal"
+            );
+
+            let not_found = multi_scenario(MultiEntryTestProvider::stateful(), ProviderMode::Hold);
+            not_found.seed(&removal_row());
+            answer_with(&not_found, "oversized");
+            drive_home(&not_found, 404);
+
+            assert_eq!(
+                not_found.network.requests_to(MULTI_HOST).len(),
+                1,
+                "should still have run the hold call"
+            );
+            let after = not_found.row();
+            assert!(
+                !after.ids.contains_key(MULTI_ENTRY_SOURCE),
+                "should flush the hold answer's removal on a 404"
+            );
+            assert_eq!(
+                after.ps.get(MULTI_PROVIDER).map(|state| state.iv.len()),
+                Some(2),
+                "should flush the removal's record of the two invalidated UIDs"
+            );
+
+            let backoff = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            backoff.seed_live();
+            answer_with(&backoff, "none");
+            drive_home(&backoff, 404);
+            assert!(
+                backoff
+                    .row()
+                    .ps
+                    .get(MULTI_PROVIDER)
+                    .and_then(|state| state.n)
+                    .is_some_and(|wait_until| wait_until > 1_700_000_000),
+                "should flush the no_match backoff on a 404"
+            );
+
+            let positive = multi_scenario(MultiEntryTestProvider::new(), ProviderMode::Hold);
+            positive.seed_live();
+            answer_with(&positive, "full");
+            drive_home(&positive, 404);
+            assert!(
+                !positive.row().ids.contains_key(MULTI_ENTRY_SOURCE),
+                "should store no positive hold answer on a 404"
+            );
+        }
+
+        /// A scenario like [`Scenario::new`] with `MultiEntryTestProvider`
+        /// registered on its own source, and its endpoint left unanswered so
+        /// the provider writes nothing the golden tests would see.
+        fn golden_registered_scenario() -> Scenario {
+            let scenario = registered_scenario(
+                vec![multi_registration(MultiEntryTestProvider::new())],
+                ProviderMode::AfterSend,
+            );
+            scenario.network.clear_reply(MULTI_HOST);
+            scenario
+        }
+
+        #[test]
+        fn golden_browser_ingest_with_a_registered_provider_writes_the_first_uid() {
+            let cookie = format!("ts-eids={GOLDEN_INGEST_COOKIE}; sharedId=shared-1");
+
+            let returning = golden_registered_scenario();
+            returning.seed_live();
+            let (_, outcome) =
+                returning.drive(navigation(Some(&format!("ts-ec={EC_ID}; {cookie}"))));
+            assert_eq!(outcome, Some(FlushOutcome::Written), "should flush");
+            assert_writes(&returning.store, (0, 1, 0), "one flush");
+            assert_eq!(
+                assert_one_uid_records(&returning.row()),
+                golden_expected_ingest(),
+                "the flushed row should hold the UIDs the code before this spec stored"
+            );
+
+            let new_visitor = golden_registered_scenario();
+            let (response, _) = new_visitor.drive(navigation(Some(&cookie)));
+            let minted = set_cookie_value(&response, "ts-ec").expect("should mint an EC");
+            assert_writes(&new_visitor.store, (1, 0, 0), "one create");
+            assert_eq!(
+                assert_one_uid_records(&new_visitor.row_of(&minted)),
+                golden_expected_ingest(),
+                "the created row should hold the same UIDs"
+            );
+        }
+
+        #[test]
+        fn golden_one_uid_row_with_a_registered_provider_goes_out_unchanged() {
+            let scenario = golden_registered_scenario();
+            let mut entry = live_entry();
+            for (source, uid) in [("id5-sync.com", "id5-uid"), ("sharedid.org", "shared-uid")] {
+                entry
+                    .ids
+                    .insert(source.to_owned(), KvPartnerId::browser(uid, Some(1_500)));
+            }
+            scenario.seed(&entry);
+
+            let (response, _) =
+                scenario.drive(auction_request(Some(&ec_cookie()), &auction_body(None)));
+
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                serde_json::json!([
+                    { "source": "id5-sync.com", "uids": [{ "id": "id5-uid", "atype": 3 }] },
+                    { "source": "sharedid.org", "uids": [{ "id": "shared-uid", "atype": 3 }] }
+                ]),
+                "user.ext.eids should equal what the code before this spec sent"
+            );
+            assert_eq!(
+                response
+                    .headers()
+                    .get("x-ts-eids")
+                    .and_then(|value| value.to_str().ok()),
+                Some(GOLDEN_ROW_HEADER),
+                "x-ts-eids should equal what the code before this spec built, byte for byte"
+            );
+        }
+
+        #[test]
+        fn golden_auction_body_forwarding_with_a_registered_provider_is_unchanged() {
+            let scenario = golden_registered_scenario();
+            scenario.seed_live();
+            let eids: serde_json::Value =
+                serde_json::from_str(GOLDEN_BODY_EIDS).expect("should parse the body EIDs");
+            let forwarded: serde_json::Value = serde_json::from_str(GOLDEN_BODY_FORWARDED)
+                .expect("should parse the forwarded EIDs");
+
+            scenario.drive(auction_request(
+                Some(&ec_cookie()),
+                &auction_body(Some(&eids)),
+            ));
+
+            assert_eq!(
+                bidder_eids(&bidder_body(&scenario)),
+                forwarded,
+                "user.ext.eids should equal what the code before this spec forwarded"
+            );
+            assert_no_writes(&scenario.store, "/auction");
+        }
+    }
 }
diff --git a/crates/trusted-server-adapter-fastly/src/middleware.rs b/crates/trusted-server-adapter-fastly/src/middleware.rs
index 9bbc25d7ba..4188d01e73 100644
--- a/crates/trusted-server-adapter-fastly/src/middleware.rs
+++ b/crates/trusted-server-adapter-fastly/src/middleware.rs
@@ -24,8 +24,9 @@ use trusted_server_core::constants::{
     ENV_FASTLY_IS_STAGING, ENV_FASTLY_SERVICE_VERSION, HEADER_X_GEO_INFO_AVAILABLE,
     HEADER_X_TS_ENV, HEADER_X_TS_FASTLY_VERSION,
 };
-use trusted_server_core::geo::GeoInfo;
+use trusted_server_core::geo::{GeoInfo, GeoLookupState};
 use trusted_server_core::platform::{ClientInfo, PlatformGeo};
+use trusted_server_core::request_timing::{Phase, RequestTimings};
 use trusted_server_core::settings::Settings;
 use trusted_server_core::version_header::apply_git_version_header;
 
@@ -74,6 +75,8 @@ impl Middleware for FinalizeResponseMiddleware {
             || FastlyRequestContext::get(ctx.request()).and_then(|c| c.client_ip),
             |info| info.client_ip,
         );
+        let timings =
+            RequestTimings::from_extensions(ctx.request().extensions()).unwrap_or_default();
 
         let mut response = match next.run(ctx).await {
             Ok(r) => r,
@@ -83,13 +86,24 @@ impl Middleware for FinalizeResponseMiddleware {
             }
         };
 
-        let geo_info = resolve_geo_for_response(&response, client_ip, |ip| {
+        let carried = response
+            .extensions()
+            .get::<GeoLookupState>()
+            .cloned()
+            .unwrap_or(GeoLookupState::NotAttempted);
+        let geo_info = resolve_geo_for_response(&response, &carried, client_ip, |ip| {
+            let _span = timings.span(Phase::Geo);
             self.geo.lookup(ip).unwrap_or_else(|e| {
                 log::warn!("geo lookup failed: {e}");
                 None
             })
         });
 
+        // Mirrors the entry-point finalize site in `main.rs`
+        // (`apply_entry_point_finalize_headers`); 401 handling lives in the
+        // shared helper.
+        write_back_geo_lookup_state(&mut response, geo_info.as_ref());
+
         apply_finalize_headers(&self.settings, geo_info.as_ref(), &mut response);
         response
             .headers_mut()
@@ -148,14 +162,40 @@ impl Middleware for AuthMiddleware {
 // Shared geo resolution helper
 // ---------------------------------------------------------------------------
 
-/// Resolves geo for a response, skipping the lookup for 401 responses.
+/// Writes the resolved geo outcome back onto the response as a
+/// [`GeoLookupState`] extension, so a downstream access-telemetry snapshot
+/// sees what was actually looked up rather than the stale carried-in state.
+///
+/// Skips the write on a 401: [`resolve_geo_for_response`] returns `None`
+/// for unauthorized responses before consulting the carried state, so
+/// writing `Attempted` there would overwrite a carried `Resolved` with a
+/// value that was never looked up, and the row would lose a country it
+/// legitimately had.
+pub(crate) fn write_back_geo_lookup_state(response: &mut Response, geo_info: Option<&GeoInfo>) {
+    if response.status() == StatusCode::UNAUTHORIZED {
+        return;
+    }
+    let resolved_state = match geo_info {
+        Some(geo) => GeoLookupState::Resolved(geo.clone()),
+        None => GeoLookupState::Attempted,
+    };
+    response.extensions_mut().insert(resolved_state);
+}
+
+/// Resolves geo for a response, skipping the lookup for 401 responses and
+/// reusing a request-phase lookup when one was already carried.
 ///
-/// Returns `None` for authentication rejections (401) without calling `lookup_geo`
-/// to avoid unnecessary work and exposing geo data to unauthenticated callers.
-/// All other responses call `lookup_geo` and return its result.
+/// Returns `None` for authentication rejections (401) without consulting
+/// `carried` or calling `lookup_geo`, to avoid unnecessary work and exposing
+/// geo data to unauthenticated callers. Otherwise dispatches on `carried`:
+/// a [`GeoLookupState::Resolved`] value is reused as-is, a
+/// [`GeoLookupState::Attempted`] value is treated as no geo info without
+/// retrying the lookup, and [`GeoLookupState::NotAttempted`] falls back to
+/// calling `lookup_geo`.
 ///
 /// Used by both [`FinalizeResponseMiddleware`] and the entry-point finalization
-/// in `main.rs` so the 401-skip rule is defined in one place.
+/// in `main.rs` so the 401-skip rule and the dedupe rule are each defined in
+/// one place.
 ///
 /// # Parity note
 ///
@@ -167,6 +207,7 @@ impl Middleware for AuthMiddleware {
 /// server or the upstream origin.
 pub(crate) fn resolve_geo_for_response<F>(
     response: &Response,
+    carried: &GeoLookupState,
     client_ip: Option<IpAddr>,
     lookup_geo: F,
 ) -> Option<GeoInfo>
@@ -174,9 +215,12 @@ where
     F: FnOnce(Option<IpAddr>) -> Option<GeoInfo>,
 {
     if response.status() == StatusCode::UNAUTHORIZED {
-        None
-    } else {
-        lookup_geo(client_ip)
+        return None;
+    }
+    match carried {
+        GeoLookupState::Resolved(geo) => Some(geo.clone()),
+        GeoLookupState::Attempted => None,
+        GeoLookupState::NotAttempted => lookup_geo(client_ip),
     }
 }
 
@@ -273,6 +317,51 @@ fn apply_fastly_version_header(service_version: Option<&str>, response: &mut Res
 mod tests {
     use super::*;
 
+    #[test]
+    fn geo_write_back_preserves_resolved_state_on_401() {
+        // A 401 short-circuits geo resolution before the carried state is
+        // consulted, so the write-back must not downgrade a carried
+        // Resolved to Attempted (which would cost the row its country).
+        let mut response = response_builder()
+            .status(StatusCode::UNAUTHORIZED)
+            .body(Body::empty())
+            .expect("should build a 401 response");
+        response
+            .extensions_mut()
+            .insert(GeoLookupState::Resolved(sample_geo_info()));
+
+        write_back_geo_lookup_state(&mut response, None);
+
+        match response.extensions().get::<GeoLookupState>() {
+            Some(GeoLookupState::Resolved(geo)) => {
+                assert_eq!(
+                    geo.country,
+                    sample_geo_info().country,
+                    "should keep the carried country"
+                );
+            }
+            other => panic!("should keep the Resolved state on a 401, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn geo_write_back_records_attempted_on_non_401_miss() {
+        let mut response = response_builder()
+            .status(StatusCode::OK)
+            .body(Body::empty())
+            .expect("should build a 200 response");
+
+        write_back_geo_lookup_state(&mut response, None);
+
+        assert!(
+            matches!(
+                response.extensions().get::<GeoLookupState>(),
+                Some(GeoLookupState::Attempted)
+            ),
+            "should record an attempted-but-missed lookup on ordinary responses"
+        );
+    }
+
     use std::collections::HashMap;
     use std::net::IpAddr;
     use std::sync::{Arc, Mutex};
@@ -303,6 +392,19 @@ mod tests {
         RequestContext::new(req, PathParams::new(HashMap::new()))
     }
 
+    fn sample_geo_info() -> GeoInfo {
+        GeoInfo {
+            city: "Testville".to_string(),
+            country: "US".to_string(),
+            continent: "NorthAmerica".to_string(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        }
+    }
+
     struct FixedGeo(Option<GeoInfo>);
 
     impl PlatformGeo for FixedGeo {
@@ -705,6 +807,67 @@ mod tests {
         );
     }
 
+    #[test]
+    fn finalize_handle_writes_back_resolved_geo_state_after_fallback_lookup() {
+        // The request phase never attempted a geo lookup (no GeoLookupState
+        // extension on the handler's response), so the middleware resolves
+        // one via the fallback closure. That resolved outcome must be
+        // written back into response extensions -- mirroring
+        // apply_entry_point_finalize_headers in main.rs -- so a downstream
+        // access-telemetry snapshot sees the freshly resolved country
+        // instead of a stale/missing GeoLookupState.
+        let settings = settings_with_response_headers(vec![]);
+        let middleware = FinalizeResponseMiddleware::new(
+            Arc::new(settings),
+            Arc::new(FixedGeo(Some(sample_geo_info()))),
+        );
+        let handler =
+            Arc::new(
+                |_ctx: RequestContext| async move { Ok::<Response, EdgeError>(empty_response()) },
+            );
+
+        let response = block_on(middleware.handle(empty_ctx(), Next::new(&[], &*handler)))
+            .expect("should succeed");
+
+        match response.extensions().get::<GeoLookupState>() {
+            Some(GeoLookupState::Resolved(info)) => {
+                assert_eq!(
+                    info.country, "US",
+                    "should carry the fallback-resolved geo info"
+                );
+            }
+            other => {
+                panic!("expected GeoLookupState::Resolved after a fallback lookup, got {other:?}")
+            }
+        }
+    }
+
+    #[test]
+    fn finalize_handle_writes_back_attempted_geo_state_when_fallback_finds_nothing() {
+        // The fallback lookup ran but resolved no geo info. The middleware
+        // must still record that the lookup was attempted, so a later
+        // consumer of the extension does not mistake this for
+        // GeoLookupState::NotAttempted and retry the lookup.
+        let settings = settings_with_response_headers(vec![]);
+        let middleware =
+            FinalizeResponseMiddleware::new(Arc::new(settings), Arc::new(FixedGeo(None)));
+        let handler =
+            Arc::new(
+                |_ctx: RequestContext| async move { Ok::<Response, EdgeError>(empty_response()) },
+            );
+
+        let response = block_on(middleware.handle(empty_ctx(), Next::new(&[], &*handler)))
+            .expect("should succeed");
+
+        assert!(
+            matches!(
+                response.extensions().get::<GeoLookupState>(),
+                Some(GeoLookupState::Attempted)
+            ),
+            "should write back Attempted when the fallback lookup finds no geo info"
+        );
+    }
+
     #[test]
     fn finalize_handle_marks_response_as_finalized() {
         let settings = settings_with_response_headers(vec![]);
@@ -786,6 +949,30 @@ mod tests {
         );
     }
 
+    #[test]
+    #[allow(clippy::panic)]
+    fn geo_lookup_skipped_for_unauthorized_responses() {
+        // The 401 short-circuit in resolve_geo_for_response must win
+        // regardless of what state the request phase carried in, and must
+        // never invoke the fallback lookup closure.
+        let mut response = empty_response();
+        *response.status_mut() = StatusCode::UNAUTHORIZED;
+
+        for carried in [
+            GeoLookupState::NotAttempted,
+            GeoLookupState::Attempted,
+            GeoLookupState::Resolved(sample_geo_info()),
+        ] {
+            let geo_info = resolve_geo_for_response(&response, &carried, None, |_| {
+                panic!("401 responses must never trigger a geo lookup");
+            });
+            assert!(
+                geo_info.is_none(),
+                "401 responses should never resolve geo info, regardless of carried state"
+            );
+        }
+    }
+
     // ---------------------------------------------------------------------------
     // AuthMiddleware::handle tests
     // ---------------------------------------------------------------------------
diff --git a/crates/trusted-server-adapter-fastly/src/platform.rs b/crates/trusted-server-adapter-fastly/src/platform.rs
index ea2193d090..5bff76d2b6 100644
--- a/crates/trusted-server-adapter-fastly/src/platform.rs
+++ b/crates/trusted-server-adapter-fastly/src/platform.rs
@@ -9,6 +9,7 @@ use fastly::geo::{Geo, geo_lookup};
 use fastly::{ConfigStore, Request, SecretStore};
 use std::io::Read as _;
 use std::net::IpAddr;
+use std::sync::atomic::{AtomicUsize, Ordering};
 
 use crate::backend::BackendConfig;
 pub(crate) use trusted_server_core::platform::UnavailableKvStore;
@@ -174,6 +175,7 @@ fn backend_config_from_spec(spec: &PlatformBackendSpec) -> BackendConfig<'_> {
         .certificate_check(spec.certificate_check)
         .first_byte_timeout(spec.first_byte_timeout)
         .between_bytes_timeout(spec.between_bytes_timeout)
+        .connect_timeout(spec.connect_timeout)
         .discriminator(spec.discriminator.as_deref())
 }
 
@@ -527,7 +529,13 @@ fn apply_fastly_cache_intent(request: &mut fastly::Request, intent: &PlatformCac
 /// auction requests use. This guarantees a direct SDK pending handle that can
 /// join body handles in one timed host wait. Shared-cache requests retain the
 /// SDK caching state machine through the unbounded send/select/wait APIs.
-pub struct FastlyPlatformHttpClient;
+///
+/// One client is built per request, so it counts the backend requests the
+/// execution has started, for Fastly's per-execution backend request limit.
+#[derive(Default)]
+pub struct FastlyPlatformHttpClient {
+    started: AtomicUsize,
+}
 
 #[async_trait::async_trait(?Send)]
 impl PlatformHttpClient for FastlyPlatformHttpClient {
@@ -539,10 +547,15 @@ impl PlatformHttpClient for FastlyPlatformHttpClient {
         true
     }
 
+    fn requests_started(&self) -> Option<usize> {
+        Some(self.started.load(Ordering::Relaxed))
+    }
+
     async fn send(
         &self,
         request: PlatformHttpRequest,
     ) -> Result<PlatformResponse, Report<PlatformError>> {
+        self.started.fetch_add(1, Ordering::Relaxed);
         let backend_name = request.backend_name.clone();
         let image_optimizer = request.image_optimizer;
         let stream_response = request.stream_response;
@@ -563,6 +576,7 @@ impl PlatformHttpClient for FastlyPlatformHttpClient {
         &self,
         request: PlatformHttpRequest,
     ) -> Result<PlatformPendingRequest, Report<PlatformError>> {
+        self.started.fetch_add(1, Ordering::Relaxed);
         let backend_name = request.backend_name.clone();
         if request.image_optimizer.is_some() {
             return Err(Report::new(PlatformError::HttpClient)
@@ -1059,6 +1073,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
+            connect_timeout: None,
             discriminator: None,
         };
 
@@ -1083,6 +1098,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
+            connect_timeout: None,
             discriminator: None,
         };
 
@@ -1109,6 +1125,7 @@ mod tests {
             certificate_check: false,
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
+            connect_timeout: None,
             discriminator: None,
         };
 
@@ -1133,6 +1150,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
             between_bytes_timeout: Duration::from_secs(15),
+            connect_timeout: None,
             discriminator: None,
         };
 
@@ -1152,6 +1170,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_millis(2000),
             between_bytes_timeout: Duration::from_millis(2000),
+            connect_timeout: None,
             discriminator: None,
         };
 
@@ -1181,6 +1200,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_millis(750),
             between_bytes_timeout: Duration::from_millis(750),
+            connect_timeout: None,
             discriminator: None,
         };
 
@@ -1208,6 +1228,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_millis(750),
             between_bytes_timeout: Duration::from_millis(750),
+            connect_timeout: None,
             discriminator: Some("ipv6-provider".to_string()),
         };
         let mut bare = bracketed.clone();
@@ -1231,7 +1252,7 @@ mod tests {
 
     #[test]
     fn auction_http_capabilities_are_explicit() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let capabilities = trusted_server_core::platform::AuctionTargetId::Fastly
             .descriptor()
             .capabilities();
@@ -1396,7 +1417,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_send_returns_error_for_unregistered_backend() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let request = request_builder()
             .method("GET")
             .uri("https://example.com/")
@@ -1416,7 +1437,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_send_async_returns_error_for_unregistered_backend() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let request = request_builder()
             .method("GET")
             .uri("https://example.com/")
@@ -1436,7 +1457,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_select_returns_error_for_empty_list() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let err = futures::executor::block_on(client.select(vec![]))
             .expect_err("should return error for empty pending list");
 
@@ -1449,7 +1470,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_select_returns_error_for_wrong_inner_type() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         // Wrap a non-PendingRequest type to trigger the downcast failure.
         let wrong = PlatformPendingRequest::new(42u32).with_backend_name("origin-a");
         let err = futures::executor::block_on(client.select(vec![wrong]))
@@ -1468,7 +1489,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_rejects_stream_marked_pending_from_select() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let pending = PlatformPendingRequest::new(42_u32)
             .with_backend_name("origin-a")
             .with_response_handling(true, edgezero_core::http::Method::GET);
@@ -1483,7 +1504,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_send_returns_error_for_streaming_body() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let request = request_builder()
             .method("POST")
             .uri("https://example.com/")
@@ -1510,7 +1531,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_send_async_rejects_image_optimizer_metadata() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let request = request_builder()
             .method("GET")
             .uri("https://example.com/image.jpg")
@@ -1533,7 +1554,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_supports_pending_streaming_responses() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         assert!(
             client.supports_pending_streaming_responses(),
             "should advertise direct pending-response streaming"
@@ -1558,7 +1579,7 @@ mod tests {
 
     #[test]
     fn fastly_platform_http_client_send_async_returns_error_for_streaming_body() {
-        let client = FastlyPlatformHttpClient;
+        let client = FastlyPlatformHttpClient::default();
         let request = request_builder()
             .method("POST")
             .uri("https://example.com/")
@@ -1744,6 +1765,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_millis(750),
             between_bytes_timeout: Duration::from_millis(750),
+            connect_timeout: None,
             discriminator: Some("prebid".to_string()),
         };
         let prebid_name = backend
diff --git a/crates/trusted-server-adapter-fastly/src/platform/deadline.rs b/crates/trusted-server-adapter-fastly/src/platform/deadline.rs
index 6a8842d180..0eadbab577 100644
--- a/crates/trusted-server-adapter-fastly/src/platform/deadline.rs
+++ b/crates/trusted-server-adapter-fastly/src/platform/deadline.rs
@@ -450,7 +450,7 @@ mod tests {
 
     #[test]
     fn expired_deadline_attributes_an_invalid_pending_handle() {
-        let result = futures::executor::block_on(FastlyPlatformHttpClient.select_until(
+        let result = futures::executor::block_on(FastlyPlatformHttpClient::default().select_until(
             vec![PlatformPendingRequest::new(42_u32).with_backend_name("example")],
             Instant::now(),
         ))
@@ -475,7 +475,7 @@ mod tests {
 
     #[test]
     fn deadline_collection_rejects_malformed_handles_with_backend_context() {
-        let result = futures::executor::block_on(FastlyPlatformHttpClient.select_until(
+        let result = futures::executor::block_on(FastlyPlatformHttpClient::default().select_until(
             vec![PlatformPendingRequest::new(42_u32).with_backend_name("example")],
             Instant::now() + Duration::from_secs(1),
         ));
@@ -517,7 +517,7 @@ mod tests {
         let failed = PlatformPendingRequest::new(42_u32).with_backend_name("unsupported");
         let healthy = buffered_pending(b"healthy".to_vec(), "healthy");
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(vec![failed, healthy], deadline),
+            FastlyPlatformHttpClient::default().select_until(vec![failed, healthy], deadline),
         )
         .expect("should isolate a provider with an unsupported pending handle")
         .expect("should report the failed provider");
@@ -531,7 +531,7 @@ mod tests {
             "should report the unsupported handle"
         );
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(result.remaining, deadline),
+            FastlyPlatformHttpClient::default().select_until(result.remaining, deadline),
         )
         .expect("should continue collecting the healthy sibling")
         .expect("should complete the healthy sibling");
@@ -547,7 +547,7 @@ mod tests {
     fn expired_deadline_preserves_an_already_ready_body() {
         let pending = buffered_pending(b"ready".to_vec(), "example");
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(vec![pending], Instant::now()),
+            FastlyPlatformHttpClient::default().select_until(vec![pending], Instant::now()),
         )
         .expect("should snapshot an expired ready response")
         .expect("should preserve an already complete response without waiting");
@@ -646,10 +646,11 @@ mod tests {
             buffered_pending(b"fast".to_vec(), "fast"),
         ];
         let deadline = Instant::now() + Duration::from_secs(10);
-        let result =
-            futures::executor::block_on(FastlyPlatformHttpClient.select_until(pending, deadline))
-                .expect("should collect one response")
-                .expect("should complete before deadline");
+        let result = futures::executor::block_on(
+            FastlyPlatformHttpClient::default().select_until(pending, deadline),
+        )
+        .expect("should collect one response")
+        .expect("should complete before deadline");
         let response = result
             .ready
             .expect("should collect the short response first");
@@ -664,7 +665,7 @@ mod tests {
             "should retain the partial response"
         );
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(result.remaining, deadline),
+            FastlyPlatformHttpClient::default().select_until(result.remaining, deadline),
         )
         .expect("should resume body collection")
         .expect("should finish the remaining body");
@@ -684,7 +685,7 @@ mod tests {
     fn body_at_the_exact_limit_remains_eligible() {
         let pending = buffered_pending(vec![b'x'; MAX_PLATFORM_RESPONSE_BODY_BYTES], "exact");
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient
+            FastlyPlatformHttpClient::default()
                 .select_until(vec![pending], Instant::now() + Duration::from_secs(10)),
         )
         .expect("should collect an exactly sized body")
@@ -708,7 +709,7 @@ mod tests {
     fn incremental_body_limit_reports_the_failed_backend() {
         let pending = buffered_pending(vec![b'x'; MAX_PLATFORM_RESPONSE_BODY_BYTES + 1], "large");
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient
+            FastlyPlatformHttpClient::default()
                 .select_until(vec![pending], Instant::now() + Duration::from_secs(30)),
         )
         .expect("should return a provider failure")
@@ -737,10 +738,11 @@ mod tests {
             large.into_platform(),
         ];
         let deadline = Instant::now() + Duration::from_secs(10);
-        let result =
-            futures::executor::block_on(FastlyPlatformHttpClient.select_until(pending, deadline))
-                .expect("should return a capacity result")
-                .expect("should reject excess growth");
+        let result = futures::executor::block_on(
+            FastlyPlatformHttpClient::default().select_until(pending, deadline),
+        )
+        .expect("should return a capacity result")
+        .expect("should reject excess growth");
         assert!(
             result.ready.is_err(),
             "should reject excess aggregate buffering"
@@ -751,7 +753,7 @@ mod tests {
             "should attribute capacity pressure to the largest partial response"
         );
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(result.remaining, deadline),
+            FastlyPlatformHttpClient::default().select_until(result.remaining, deadline),
         )
         .expect("should retain the healthy provider")
         .expect("should complete the healthy provider");
@@ -773,16 +775,17 @@ mod tests {
             buffered_pending(b"two".to_vec(), "two"),
         ];
         let deadline = Instant::now();
-        let result =
-            futures::executor::block_on(FastlyPlatformHttpClient.select_until(pending, deadline))
-                .expect("should snapshot ready results")
-                .expect("should return first ready result");
+        let result = futures::executor::block_on(
+            FastlyPlatformHttpClient::default().select_until(pending, deadline),
+        )
+        .expect("should snapshot ready results")
+        .expect("should return first ready result");
         assert!(
             result.ready.is_ok(),
             "should preserve a complete ready response"
         );
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(result.remaining, deadline),
+            FastlyPlatformHttpClient::default().select_until(result.remaining, deadline),
         )
         .expect("should use cached ready results")
         .expect("should return second ready result");
@@ -799,7 +802,7 @@ mod tests {
             .body(Body::empty())
             .expect("should build fixture request");
         futures::executor::block_on(
-            FastlyPlatformHttpClient.send_async(
+            FastlyPlatformHttpClient::default().send_async(
                 PlatformHttpRequest::new(request, "deadline_origin").with_cache_bypass(),
             ),
         )
@@ -815,7 +818,7 @@ mod tests {
         std::thread::sleep(Duration::from_millis(100));
         let started = Instant::now();
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(vec![stalled, fast], deadline),
+            FastlyPlatformHttpClient::default().select_until(vec![stalled, fast], deadline),
         )
         .expect("should snapshot already ready bids")
         .expect("should retain the complete fast response");
@@ -839,7 +842,7 @@ mod tests {
         let pending = network_pending("stalled", "GET");
         let started = Instant::now();
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient
+            FastlyPlatformHttpClient::default()
                 .select_until(vec![pending], started + Duration::from_millis(80)),
         )
         .expect("should stop waiting for stalled headers");
@@ -859,7 +862,7 @@ mod tests {
         let pending = network_pending("trickle", "GET");
         let started = Instant::now();
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient
+            FastlyPlatformHttpClient::default()
                 .select_until(vec![pending], started + Duration::from_millis(80)),
         )
         .expect("should stop buffering a trickling body");
@@ -883,14 +886,15 @@ mod tests {
             .body(Body::empty())
             .expect("should build the request missing cache bypass");
         let unsupported = futures::executor::block_on(
-            FastlyPlatformHttpClient
+            FastlyPlatformHttpClient::default()
                 .send_async(PlatformHttpRequest::new(request, "deadline_origin")),
         )
         .expect("should dispatch the request missing cache bypass");
         let started = Instant::now();
         let deadline = started + Duration::from_millis(200);
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(vec![unsupported, slow, fast], deadline),
+            FastlyPlatformHttpClient::default()
+                .select_until(vec![unsupported, slow, fast], deadline),
         )
         .expect("should isolate a request missing cache bypass")
         .expect("should return the unsupported provider's failure");
@@ -910,7 +914,7 @@ mod tests {
             "should reject SDK guest-caching handles before direct handle conversion"
         );
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient.select_until(result.remaining, deadline),
+            FastlyPlatformHttpClient::default().select_until(result.remaining, deadline),
         )
         .expect("should collect the completed sibling")
         .expect("should finish before deadline");
@@ -934,7 +938,7 @@ mod tests {
     fn network_head_skips_the_body_and_its_declared_length_limit() {
         let pending = network_pending("head", "HEAD");
         let result = futures::executor::block_on(
-            FastlyPlatformHttpClient
+            FastlyPlatformHttpClient::default()
                 .select_until(vec![pending], Instant::now() + Duration::from_secs(1)),
         )
         .expect("should collect HEAD response")
diff --git a/crates/trusted-server-adapter-fastly/src/rate_limiter.rs b/crates/trusted-server-adapter-fastly/src/rate_limiter.rs
index 67520925ed..44431e907c 100644
--- a/crates/trusted-server-adapter-fastly/src/rate_limiter.rs
+++ b/crates/trusted-server-adapter-fastly/src/rate_limiter.rs
@@ -22,6 +22,31 @@ fn effective_hourly_limit(hourly_limit: u32) -> u32 {
     hourly_limit_to_per_minute_limit(hourly_limit).saturating_mul(60)
 }
 
+/// The two counter calls the breaker uses, so tests can fake them.
+trait CounterOps {
+    fn increment(&self, key: &str) -> Result<(), String>;
+    fn lookup_count(&self, key: &str) -> Result<u32, String>;
+}
+
+fn counter_error(action: &str, message: &str) -> Report<TrustedServerError> {
+    Report::new(TrustedServerError::KvStore {
+        store_name: RATE_COUNTER_NAME.to_owned(),
+        message: format!("Failed to {action} sync rate counter: {message}"),
+    })
+}
+
+fn record_with(counter: &dyn CounterOps, key: &str) -> Result<(), Report<TrustedServerError>> {
+    counter
+        .increment(key)
+        .map_err(|message| counter_error("increment", &message))
+}
+
+fn count_with(counter: &dyn CounterOps, key: &str) -> Result<u32, Report<TrustedServerError>> {
+    counter
+        .lookup_count(key)
+        .map_err(|message| counter_error("read", &message))
+}
+
 /// Fastly Edge Rate Limiting implementation of [`RateLimiter`].
 pub struct FastlyRateLimiter {
     counter: RateCounter,
@@ -72,12 +97,126 @@ impl RateLimiter for FastlyRateLimiter {
 
         Ok(false)
     }
+
+    fn record(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+        record_with(&self.counter, key)
+    }
+
+    fn count(&self, key: &str) -> Result<u32, Report<TrustedServerError>> {
+        count_with(&self.counter, key)
+    }
+}
+
+impl CounterOps for RateCounter {
+    fn increment(&self, key: &str) -> Result<(), String> {
+        RateCounter::increment(self, key, 1).map_err(|error| error.to_string())
+    }
+
+    fn lookup_count(&self, key: &str) -> Result<u32, String> {
+        RateCounter::lookup_count(self, key, CounterDuration::SixtySecs)
+            .map_err(|error| error.to_string())
+    }
 }
 
 #[cfg(test)]
 mod tests {
+    use std::cell::RefCell;
+
     use super::*;
 
+    struct FakeCounter {
+        increments: RefCell<Vec<String>>,
+        lookups: RefCell<Vec<String>>,
+        count: u32,
+        fail: bool,
+    }
+
+    impl FakeCounter {
+        fn new(count: u32, fail: bool) -> Self {
+            Self {
+                increments: RefCell::new(Vec::new()),
+                lookups: RefCell::new(Vec::new()),
+                count,
+                fail,
+            }
+        }
+    }
+
+    impl CounterOps for FakeCounter {
+        fn increment(&self, key: &str) -> Result<(), String> {
+            self.increments.borrow_mut().push(key.to_owned());
+            if self.fail {
+                return Err("counter unavailable".to_owned());
+            }
+            Ok(())
+        }
+
+        fn lookup_count(&self, key: &str) -> Result<u32, String> {
+            self.lookups.borrow_mut().push(key.to_owned());
+            if self.fail {
+                return Err("counter unavailable".to_owned());
+            }
+            Ok(self.count)
+        }
+    }
+
+    #[test]
+    fn record_increments_once() {
+        let counter = FakeCounter::new(0, false);
+
+        record_with(&counter, "identity-fail:example")
+            .expect("should record against a working counter");
+
+        assert_eq!(
+            *counter.increments.borrow(),
+            vec!["identity-fail:example".to_owned()],
+            "should increment the key exactly once"
+        );
+        assert!(
+            counter.lookups.borrow().is_empty(),
+            "should not read the count while recording"
+        );
+    }
+
+    #[test]
+    fn count_reads_the_sixty_second_window() {
+        let counter = FakeCounter::new(7, false);
+
+        let count = count_with(&counter, "identity-fail:example")
+            .expect("should count against a working counter");
+
+        assert_eq!(count, 7, "should return the counter's value");
+        assert_eq!(
+            *counter.lookups.borrow(),
+            vec!["identity-fail:example".to_owned()],
+            "should look the key up once"
+        );
+        assert!(
+            counter.increments.borrow().is_empty(),
+            "should not change the count while reading it"
+        );
+    }
+
+    #[test]
+    fn counter_errors_map_to_kv_store_errors() {
+        let counter = FakeCounter::new(0, true);
+
+        let record_error = record_with(&counter, "identity-fail:example")
+            .expect_err("should fail when the increment fails");
+        let count_error = count_with(&counter, "identity-fail:example")
+            .expect_err("should fail when the lookup fails");
+
+        for error in [record_error, count_error] {
+            assert!(
+                matches!(
+                    error.current_context(),
+                    TrustedServerError::KvStore { store_name, .. } if store_name == RATE_COUNTER_NAME
+                ),
+                "should map the failure to a KV store error naming the counter"
+            );
+        }
+    }
+
     #[test]
     fn zero_hourly_limit_denies_all() {
         assert_eq!(
diff --git a/crates/trusted-server-adapter-fastly/src/tinybird.rs b/crates/trusted-server-adapter-fastly/src/tinybird.rs
index 504dbd9fba..5180984988 100644
--- a/crates/trusted-server-adapter-fastly/src/tinybird.rs
+++ b/crates/trusted-server-adapter-fastly/src/tinybird.rs
@@ -10,10 +10,15 @@ use trusted_server_core::auction::telemetry::{
     AuctionEventBatch, AuctionTelemetrySink, NoopAuctionTelemetrySink,
 };
 use trusted_server_core::error::TrustedServerError;
-use trusted_server_core::platform::{PlatformBackendSpec, PlatformHttpRequest, RuntimeServices};
+use trusted_server_core::platform::{
+    PlatformBackend as _, PlatformBackendSpec, PlatformHttpClient, PlatformHttpRequest,
+    RuntimeServices,
+};
 use trusted_server_core::redacted::Redacted;
 use trusted_server_core::settings::{Settings, TinybirdSettings};
 
+use crate::platform::FastlyPlatformBackend;
+
 const TINYBIRD_EVENTS_PATH: &str = "/v0/events";
 const TINYBIRD_NDJSON_CONTENT_TYPE: &str = "application/x-ndjson";
 const TINYBIRD_FIRST_BYTE_TIMEOUT: Duration = Duration::from_secs(2);
@@ -21,9 +26,14 @@ const TINYBIRD_BETWEEN_BYTES_TIMEOUT: Duration = Duration::from_secs(2);
 const TINYBIRD_MAX_ROWS_PER_AUCTION_BATCH: usize = 512;
 
 /// Build the configured auction telemetry sink.
+///
+/// Auction emission requires both the Tinybird master toggle
+/// (`tinybird.enabled`) and the auction-specific toggle
+/// (`tinybird.auction_enabled`), so access-log telemetry can be enabled
+/// independently without also emitting auction events.
 #[must_use]
 pub(crate) fn auction_sink_from_settings(settings: &Settings) -> Arc<dyn AuctionTelemetrySink> {
-    if settings.tinybird.enabled {
+    if settings.tinybird.enabled && settings.tinybird.auction_enabled {
         Arc::new(FastlyTinybirdAuctionTelemetrySink::new(
             settings.tinybird.clone(),
         ))
@@ -39,7 +49,7 @@ struct FastlyTinybirdAuctionTelemetrySink {
 }
 
 #[derive(Debug, Clone)]
-struct TinybirdEventsTarget {
+pub(crate) struct TinybirdEventsTarget {
     api_host: String,
     dataset: String,
     append_token: Redacted<String>,
@@ -63,6 +73,37 @@ impl TinybirdEventsTarget {
             max_body_bytes: config.max_body_bytes,
         }
     }
+
+    /// Builds the Events API target for the access-log datasource.
+    ///
+    /// Shares [`from_config`](Self::from_config)'s host and body-size-limit
+    /// derivation, but points at `access_dataset` and
+    /// `access_token_secret` instead of the auction pair, so access-log
+    /// emission never shares a datasource or token with auction telemetry
+    /// even though both configs come from the same [`TinybirdSettings`].
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the access token has not been resolved.
+    pub(crate) fn from_access_config(
+        config: &TinybirdSettings,
+    ) -> Result<Self, Report<TrustedServerError>> {
+        let append_token = config.access_token_secret.clone().ok_or_else(|| {
+            Report::new(TrustedServerError::Configuration {
+                message: "Tinybird access token is not resolved".to_owned(),
+            })
+        })?;
+        let uri = tinybird_events_uri(&config.api_host, &config.access_dataset);
+        let backend_spec = tinybird_backend_spec(&config.api_host);
+        Ok(Self {
+            api_host: config.api_host.clone(),
+            dataset: config.access_dataset.clone(),
+            append_token,
+            uri,
+            backend_spec,
+            max_body_bytes: config.max_body_bytes,
+        })
+    }
 }
 
 impl FastlyTinybirdAuctionTelemetrySink {
@@ -182,6 +223,111 @@ impl AuctionTelemetrySink for FastlyTinybirdAuctionTelemetrySink {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Access telemetry: post-send emitter
+// ---------------------------------------------------------------------------
+
+/// Decides whether one request's access-telemetry row should be emitted.
+///
+/// `roll` is a uniform draw from `[0, 1)`; callers pass
+/// `rand::thread_rng().r#gen::<f64>()`, which the wasm32-wasip1 guest backs with
+/// real WASI randomness (the EC generation path already relies on this and
+/// the CI wasm release build verifies it). Comparing the draw directly
+/// against `rate` keeps the sampling probability exactly `rate` for every
+/// positive value: there is no bucket quantization, so rates below one in a
+/// million sample proportionally instead of never, and emitted rows'
+/// `sample_rate` matches the probability they were sampled at, which the
+/// `sum(1.0 / sample_rate)` volume estimator depends on.
+///
+/// `rate <= 0.0` never samples and `rate >= 1.0` always samples, for any
+/// `roll` in `[0, 1)`. `0.0` cannot actually occur while `access_enabled`
+/// is `true` (`Settings` validation requires `access_sample_rate > 0.0` in
+/// that case), but this function stays total rather than leaning on that
+/// invariant.
+#[must_use]
+pub(crate) fn sampled_in(rate: f64, roll: f64) -> bool {
+    roll < rate
+}
+
+/// Builds the Events API POST request for one access-log row.
+fn build_access_events_request(
+    target: &TinybirdEventsTarget,
+    body: String,
+    auth_header: HeaderValue,
+) -> Result<edgezero_core::http::Request, Report<TrustedServerError>> {
+    request_builder()
+        .method(Method::POST)
+        .uri(target.uri.as_str())
+        .header(header::AUTHORIZATION, auth_header)
+        .header(header::CONTENT_TYPE, TINYBIRD_NDJSON_CONTENT_TYPE)
+        .body(Body::from(body))
+        .change_context(TrustedServerError::Proxy {
+            message: "failed to build Tinybird Events API request".to_owned(),
+        })
+}
+
+/// Starts a best-effort POST of one post-send access-log row to Tinybird.
+///
+/// The pending handle is dropped without waiting for the ingest reply or
+/// retrying. Fastly SDK 0.12.1 documents that `Request::send_async` continues
+/// transmitting headers and body in the background even after the initiating
+/// Compute program exits, and permits discarding `PendingRequest` for side
+/// effects. This avoids holding a reused sandbox until the ingest reply.
+/// Dispatch success does not confirm remote ingest acceptance: later transport
+/// failures and non-2xx statuses are not observable here. Likewise, the earlier
+/// client-response transport handoff does not confirm client receipt.
+///
+/// `client` is the adapter's stateless platform HTTP client in production
+/// ([`crate::platform::FastlyPlatformHttpClient`]); accepting it as `&dyn
+/// PlatformHttpClient` lets tests substitute a recording double.
+/// `target` is derived from settings once at the post-send call site.
+///
+/// # Errors
+///
+/// Returns `Err` when the row exceeds the configured request-body limit, the
+/// authorization header is invalid, the backend cannot be registered, or the
+/// request cannot be built or started.
+pub(crate) async fn emit_access_event(
+    client: &dyn PlatformHttpClient,
+    target: &TinybirdEventsTarget,
+    mut row: String,
+) -> Result<(), Report<TrustedServerError>> {
+    // Match the auction sink's NDJSON framing: every row is
+    // newline-terminated, and the terminator counts toward the body limit.
+    if !row.ends_with('\n') {
+        row.push('\n');
+    }
+    let body_len = row.len();
+    if body_len > target.max_body_bytes {
+        return Err(Report::new(TrustedServerError::Proxy {
+            message: format!(
+                "Tinybird access telemetry request body has {body_len} bytes, exceeding {} byte limit",
+                target.max_body_bytes
+            ),
+        }));
+    }
+
+    let auth_header =
+        FastlyTinybirdAuctionTelemetrySink::authorization_header(target.append_token.expose())?;
+    let backend_name = FastlyPlatformBackend
+        .ensure(&target.backend_spec)
+        .change_context(TrustedServerError::Proxy {
+            message: "Tinybird backend registration failed".to_owned(),
+        })?;
+    let request = build_access_events_request(target, row, auth_header)?;
+
+    log::debug!("sending access telemetry to Tinybird");
+
+    let pending = client
+        .send_async(PlatformHttpRequest::new(request, backend_name))
+        .await
+        .change_context(TrustedServerError::Proxy {
+            message: "failed to start Tinybird access telemetry request".to_owned(),
+        })?;
+    drop(pending);
+    Ok(())
+}
+
 fn tinybird_backend_spec(api_host: &str) -> PlatformBackendSpec {
     PlatformBackendSpec {
         scheme: "https".to_owned(),
@@ -191,6 +337,7 @@ fn tinybird_backend_spec(api_host: &str) -> PlatformBackendSpec {
         certificate_check: true,
         first_byte_timeout: TINYBIRD_FIRST_BYTE_TIMEOUT,
         between_bytes_timeout: TINYBIRD_BETWEEN_BYTES_TIMEOUT,
+        connect_timeout: None,
         discriminator: None,
     }
 }
@@ -205,6 +352,7 @@ fn tinybird_events_uri(api_host: &str, dataset: &str) -> String {
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;
+    use std::sync::atomic::{AtomicUsize, Ordering};
     use std::sync::{Arc, Mutex};
 
     use error_stack::Report;
@@ -308,25 +456,45 @@ mod tests {
         body: Vec<u8>,
     }
 
+    struct RecordedPending(Arc<AtomicUsize>);
+
+    impl Drop for RecordedPending {
+        fn drop(&mut self) {
+            self.0.fetch_add(1, Ordering::SeqCst);
+        }
+    }
+
     #[derive(Default)]
     struct RecordingHttpClient {
         requests: Mutex<Vec<RecordedRequest>>,
+        send_calls: AtomicUsize,
+        send_async_calls: AtomicUsize,
+        wait_calls: AtomicUsize,
         select_calls: Mutex<usize>,
+        fail_async_start: bool,
+        pending_drops: Arc<AtomicUsize>,
     }
 
-    #[async_trait::async_trait(?Send)]
-    impl PlatformHttpClient for RecordingHttpClient {
-        async fn send(
-            &self,
-            _request: PlatformHttpRequest,
-        ) -> Result<PlatformResponse, Report<PlatformError>> {
-            Err(Report::new(PlatformError::Unsupported))
+    impl RecordingHttpClient {
+        fn assert_no_response_wait(&self) {
+            assert_eq!(
+                self.send_calls.load(Ordering::SeqCst),
+                0,
+                "must not send synchronously"
+            );
+            assert_eq!(
+                self.wait_calls.load(Ordering::SeqCst),
+                0,
+                "must not wait on a pending request"
+            );
+            assert_eq!(
+                *self.select_calls.lock().expect("should lock select calls"),
+                0,
+                "must not select a response"
+            );
         }
 
-        async fn send_async(
-            &self,
-            request: PlatformHttpRequest,
-        ) -> Result<PlatformPendingRequest, Report<PlatformError>> {
+        fn record(&self, request: PlatformHttpRequest) {
             let backend_name = request.backend_name;
             let (parts, body) = request.request.into_parts();
             let headers = parts
@@ -350,7 +518,40 @@ mod tests {
                 .lock()
                 .expect("should lock recorded requests")
                 .push(recorded);
-            Ok(PlatformPendingRequest::new(()).with_backend_name("tinybird-backend"))
+        }
+    }
+
+    #[async_trait::async_trait(?Send)]
+    impl PlatformHttpClient for RecordingHttpClient {
+        async fn send(
+            &self,
+            _request: PlatformHttpRequest,
+        ) -> Result<PlatformResponse, Report<PlatformError>> {
+            self.send_calls.fetch_add(1, Ordering::SeqCst);
+            Err(Report::new(PlatformError::Unsupported))
+        }
+
+        async fn send_async(
+            &self,
+            request: PlatformHttpRequest,
+        ) -> Result<PlatformPendingRequest, Report<PlatformError>> {
+            self.send_async_calls.fetch_add(1, Ordering::SeqCst);
+            self.record(request);
+            if self.fail_async_start {
+                return Err(Report::new(PlatformError::HttpClient));
+            }
+            Ok(
+                PlatformPendingRequest::new(RecordedPending(Arc::clone(&self.pending_drops)))
+                    .with_backend_name("tinybird-backend"),
+            )
+        }
+
+        async fn wait(
+            &self,
+            _pending: PlatformPendingRequest,
+        ) -> Result<PlatformResponse, Report<PlatformError>> {
+            self.wait_calls.fetch_add(1, Ordering::SeqCst);
+            Err(Report::new(PlatformError::Unsupported))
         }
 
         async fn select(
@@ -431,18 +632,52 @@ mod tests {
     fn enabled_config() -> TinybirdSettings {
         TinybirdSettings {
             enabled: true,
+            auction_enabled: true,
             api_host: "api.us-east.aws.tinybird.co".to_owned(),
             secret_store: None,
             auction_dataset: "auction_events_raw".to_owned(),
             auction_token_secret: Some(Redacted::new("append-token".to_owned())),
             access_enabled: false,
-            access_dataset: "access_logs_raw".to_owned(),
-            access_token_secret: None,
+            access_dataset: "access_logs_v2".to_owned(),
+            access_token_secret: Some(Redacted::new("access-append-token".to_owned())),
             access_sample_rate: 0.0,
             max_body_bytes: 1024 * 1024,
         }
     }
 
+    #[test]
+    fn sink_from_settings_disables_when_auction_enabled_is_false() {
+        let settings = Settings {
+            tinybird: TinybirdSettings {
+                auction_enabled: false,
+                ..enabled_config()
+            },
+            ..Settings::default()
+        };
+
+        let sink = auction_sink_from_settings(&settings);
+
+        assert!(
+            !sink.is_enabled(),
+            "auction telemetry should stay off when auction_enabled is false, even if tinybird.enabled is true"
+        );
+    }
+
+    #[test]
+    fn sink_from_settings_enables_when_both_toggles_are_true() {
+        let settings = Settings {
+            tinybird: enabled_config(),
+            ..Settings::default()
+        };
+
+        let sink = auction_sink_from_settings(&settings);
+
+        assert!(
+            sink.is_enabled(),
+            "auction telemetry should be on when both tinybird.enabled and tinybird.auction_enabled are true"
+        );
+    }
+
     #[test]
     fn events_uri_targets_dataset_on_region_host() {
         assert_eq!(
@@ -619,6 +854,282 @@ mod tests {
         );
     }
 
+    #[test]
+    fn access_target_rejects_unresolved_token_without_panicking() {
+        let mut config = enabled_config();
+        config.access_token_secret = None;
+
+        let error = TinybirdEventsTarget::from_access_config(&config)
+            .expect_err("should reject an unresolved access token");
+
+        assert!(
+            matches!(
+                error.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should report a configuration error"
+        );
+        assert!(
+            error
+                .to_string()
+                .contains("Tinybird access token is not resolved"),
+            "should explain the missing resolved access token"
+        );
+    }
+
+    #[test]
+    fn access_target_borrows_settings_and_uses_only_access_fields() {
+        let mut config = enabled_config();
+        config.auction_token_secret = None;
+        config.max_body_bytes = 2048;
+
+        let target = TinybirdEventsTarget::from_access_config(&config)
+            .expect("should build access telemetry target");
+
+        assert_eq!(target.api_host, config.api_host);
+        assert_eq!(target.dataset, config.access_dataset);
+        assert_eq!(target.append_token.expose(), "access-append-token");
+        assert_eq!(target.max_body_bytes, config.max_body_bytes);
+        assert_eq!(
+            config
+                .access_token_secret
+                .as_ref()
+                .expect("should retain the access token in settings")
+                .expose(),
+            "access-append-token"
+        );
+    }
+
+    #[test]
+    fn access_emitter_rejects_oversized_row_before_sending() {
+        let mut config = enabled_config();
+        config.max_body_bytes = 1024;
+        let target = TinybirdEventsTarget::from_access_config(&config)
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient::default();
+        let row = "x".repeat(1025);
+
+        let result = futures::executor::block_on(emit_access_event(&http_client, &target, row));
+
+        let error = result.expect_err("should reject a row above the configured body limit");
+        assert!(
+            error.to_string().contains("1024"),
+            "error should name the configured body limit: {error}"
+        );
+        assert!(
+            http_client
+                .requests
+                .lock()
+                .expect("should lock recorded requests")
+                .is_empty(),
+            "should not send an oversized access row"
+        );
+    }
+
+    #[test]
+    fn access_emitter_accepts_row_exactly_at_body_limit_including_newline() {
+        let mut config = enabled_config();
+        config.max_body_bytes = 1024;
+        let target = TinybirdEventsTarget::from_access_config(&config)
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient::default();
+        let row = "x".repeat(1023);
+
+        futures::executor::block_on(emit_access_event(&http_client, &target, row.clone()))
+            .expect("a newline-terminated row exactly at the limit should send");
+
+        let requests = http_client
+            .requests
+            .lock()
+            .expect("should lock recorded requests");
+        assert_eq!(requests.len(), 1, "should send the boundary-sized row");
+        assert_eq!(requests[0].body.len(), 1024, "newline counts toward limit");
+        assert_eq!(requests[0].body.last(), Some(&b'\n'));
+    }
+
+    #[test]
+    fn access_emitter_posts_ndjson_and_drops_pending_without_waiting() {
+        let target = TinybirdEventsTarget::from_access_config(&enabled_config())
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient::default();
+        let row = r#"{"status":200}"#.to_owned();
+
+        futures::executor::block_on(emit_access_event(&http_client, &target, row.clone()))
+            .expect("should start the access telemetry request");
+
+        let requests = http_client
+            .requests
+            .lock()
+            .expect("should lock recorded requests");
+        assert_eq!(requests.len(), 1, "should send exactly one request");
+        assert_eq!(
+            requests[0].uri,
+            // Assert the default Tinybird endpoint without sending a real request.
+            "https://api.us-east.aws.tinybird.co/v0/events?name=access_logs_v2" // allow-domain: api.us-east.aws.tinybird.co
+        );
+        assert_eq!(requests[0].method, Method::POST.to_string());
+        assert_eq!(
+            header_value(&requests[0].headers, header::CONTENT_TYPE.as_str()),
+            Some(TINYBIRD_NDJSON_CONTENT_TYPE)
+        );
+        assert_eq!(
+            header_value(&requests[0].headers, header::AUTHORIZATION.as_str()),
+            Some("Bearer access-append-token")
+        );
+        let body = std::str::from_utf8(&requests[0].body).expect("should record utf8 body");
+        assert_eq!(
+            body,
+            format!("{row}\n"),
+            "should send newline-delimited JSON, matching the auction sink's framing"
+        );
+        http_client.assert_no_response_wait();
+        assert_eq!(http_client.send_async_calls.load(Ordering::SeqCst), 1);
+        assert_eq!(
+            http_client.pending_drops.load(Ordering::SeqCst),
+            1,
+            "should drop the pending handle before returning"
+        );
+    }
+
+    #[test]
+    fn access_emitter_surfaces_async_start_failure_without_retrying() {
+        let target = TinybirdEventsTarget::from_access_config(&enabled_config())
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient {
+            fail_async_start: true,
+            ..RecordingHttpClient::default()
+        };
+
+        let error = futures::executor::block_on(emit_access_event(
+            &http_client,
+            &target,
+            r#"{"status":200}"#.to_owned(),
+        ))
+        .expect_err("should surface the dispatch failure");
+
+        assert!(
+            error
+                .to_string()
+                .contains("failed to start Tinybird access telemetry request")
+        );
+        assert_eq!(
+            http_client.send_async_calls.load(Ordering::SeqCst),
+            1,
+            "must not retry"
+        );
+        assert_eq!(
+            http_client.pending_drops.load(Ordering::SeqCst),
+            0,
+            "failed dispatch must not create a pending handle"
+        );
+        http_client.assert_no_response_wait();
+    }
+
+    #[test]
+    fn access_emitter_preserves_existing_newline() {
+        let target = TinybirdEventsTarget::from_access_config(&enabled_config())
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient::default();
+        let row = "{\"status\":200}\n".to_owned();
+
+        futures::executor::block_on(emit_access_event(&http_client, &target, row.clone()))
+            .expect("should start the access telemetry request");
+
+        let requests = http_client
+            .requests
+            .lock()
+            .expect("should lock recorded requests");
+        assert_eq!(requests[0].body, row.as_bytes());
+    }
+
+    #[test]
+    fn access_emitter_counts_added_newline_against_body_limit() {
+        let mut config = enabled_config();
+        config.max_body_bytes = 1024;
+        let target = TinybirdEventsTarget::from_access_config(&config)
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient::default();
+
+        let error =
+            futures::executor::block_on(emit_access_event(&http_client, &target, "x".repeat(1024)))
+                .expect_err("should count the added newline toward the body limit");
+
+        assert!(
+            error
+                .to_string()
+                .contains("1025 bytes, exceeding 1024 byte limit"),
+            "error should count the added newline: {error}"
+        );
+        assert_eq!(http_client.send_async_calls.load(Ordering::SeqCst), 0);
+        http_client.assert_no_response_wait();
+    }
+
+    #[test]
+    fn access_emitter_rejects_invalid_authorization_before_dispatch() {
+        let mut config = enabled_config();
+        config.access_token_secret = Some(Redacted::new("invalid\ntoken".to_owned()));
+        let target = TinybirdEventsTarget::from_access_config(&config)
+            .expect("should build access telemetry target");
+        let http_client = RecordingHttpClient::default();
+
+        let error =
+            futures::executor::block_on(emit_access_event(&http_client, &target, "{}".to_owned()))
+                .expect_err("should reject an invalid authorization header");
+
+        assert!(
+            error
+                .to_string()
+                .contains("invalid Tinybird authorization header"),
+            "error should name the invalid authorization header: {error}"
+        );
+        assert_eq!(http_client.send_async_calls.load(Ordering::SeqCst), 0);
+        http_client.assert_no_response_wait();
+    }
+
+    #[test]
+    fn sampled_in_boundary_rates_are_unconditional() {
+        assert!(
+            sampled_in(1.0, 0.0),
+            "a 1.0 sample rate should always sample in"
+        );
+        assert!(
+            sampled_in(1.0, 0.999_999),
+            "a 1.0 sample rate should sample in for the largest roll"
+        );
+        assert!(
+            !sampled_in(0.0, 0.0),
+            "a 0.0 sample rate should never sample in, even on a zero roll"
+        );
+        assert!(
+            !sampled_in(-1.0, 0.0),
+            "a negative rate should never sample in"
+        );
+    }
+
+    #[test]
+    fn sampled_in_keeps_exact_probability_for_tiny_rates() {
+        // The previous bucket-quantized sampler truncated rates below one
+        // in a million to a zero threshold, silently emitting nothing.
+        // Direct comparison keeps every positive rate proportional.
+        let rate = 0.000_000_1;
+        assert!(
+            sampled_in(rate, rate / 2.0),
+            "a roll below a tiny positive rate should sample in"
+        );
+        assert!(
+            !sampled_in(rate, rate * 2.0),
+            "a roll above a tiny positive rate should sample out"
+        );
+        assert!(
+            !sampled_in(0.000_001_9, 0.000_001_95),
+            "no downward quantization: the boundary sits exactly at the rate"
+        );
+        assert!(
+            sampled_in(0.000_001_9, 0.000_001_85),
+            "rolls just under the rate should sample in"
+        );
+    }
+
     fn header_value<'a>(headers: &'a [(String, String)], name: &str) -> Option<&'a str> {
         headers
             .iter()
diff --git a/crates/trusted-server-adapter-spin/src/app.rs b/crates/trusted-server-adapter-spin/src/app.rs
index 9edce69fa3..202a537500 100644
--- a/crates/trusted-server-adapter-spin/src/app.rs
+++ b/crates/trusted-server-adapter-spin/src/app.rs
@@ -25,6 +25,7 @@ use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported as core_admin_ec_lookup_not_supported,
     deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::finalize::BrowserSeed;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::http_util::{RuntimeRequestOrigin, sanitize_forwarded_headers};
@@ -44,6 +45,7 @@ use trusted_server_core::publisher::{
 use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
 };
+use trusted_server_core::request_timing::RequestTimingMiddleware;
 use trusted_server_core::settings::Settings;
 #[cfg(all(feature = "spin", target_arch = "wasm32"))]
 use trusted_server_core::settings_data::{default_config_key, default_secret_store_name};
@@ -223,7 +225,7 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
     Method::DELETE,
 ];
 
-fn named_fallback_paths() -> [(&'static str, &'static [Method]); 17] {
+fn named_fallback_paths() -> [(&'static str, &'static [Method]); 18] {
     [
         ("/.well-known/trusted-server.json", &[Method::GET]),
         ("/verify-signature", &[Method::POST]),
@@ -231,6 +233,10 @@ fn named_fallback_paths() -> [(&'static str, &'static [Method]); 17] {
         ("/_ts/admin/keys/deactivate", &[Method::POST]),
         ("/_ts/admin/ec", &[Method::GET]),
         ("/_ts/admin/ec/{id}", &[Method::GET]),
+        (
+            "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
+            &[Method::DELETE],
+        ),
         ("/_ts/admin/eids", &[Method::GET]),
         ("/_ts/admin/cache/purge", LEGACY_ADMIN_DENY_METHODS),
         ("/admin/keys/rotate", LEGACY_ADMIN_DENY_METHODS),
@@ -827,6 +833,8 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         kv: None,
                         ec_context: &mut ec_context,
                         services: &services,
+                        is_real_browser: false,
+                        seed: &BrowserSeed::empty(),
                         req,
                     })
                     .await
@@ -894,6 +902,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // any middleware registered ahead of it would observe the
             // shared-secret authentication header.
             .middleware(SanitizeRequestMiddleware::new(Arc::clone(&state.settings)))
+            .middleware(RequestTimingMiddleware::default().with_excluded_paths(&["/health"]))
             .middleware(FinalizeResponseMiddleware::new(Arc::clone(&state.settings)))
             .middleware(AuthMiddleware::new(Arc::clone(&state.settings)))
             // Innermost middleware: normalize every routed request (strip
@@ -927,6 +936,12 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // adapter has no store to read.
             .get("/_ts/admin/ec", admin_ec_not_supported_handler)
             .get("/_ts/admin/ec/{id}", admin_ec_not_supported_handler)
+            // The provider opt-out clear writes the EC identity graph, so it
+            // answers like the lookup.
+            .delete(
+                "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
+                admin_ec_not_supported_handler,
+            )
             .get("/_ts/admin/eids", admin_eids_handler)
             .post("/auction", auction_handler)
             .get(PAGE_BIDS_PATH, page_bids_handler.clone())
diff --git a/crates/trusted-server-adapter-spin/src/middleware.rs b/crates/trusted-server-adapter-spin/src/middleware.rs
index 4dc3cbee47..0dd9ba45fa 100644
--- a/crates/trusted-server-adapter-spin/src/middleware.rs
+++ b/crates/trusted-server-adapter-spin/src/middleware.rs
@@ -55,9 +55,9 @@ impl Middleware for SanitizeRequestMiddleware {
 /// Spin does not expose geo headers to the application, so
 /// `X-Geo-Info-Available: false` is emitted for every response.
 ///
-/// Registered directly inside [`SanitizeRequestMiddleware`] and ahead of
-/// [`AuthMiddleware`] so that every outgoing response — including auth-rejected
-/// ones — carries a consistent set of headers.
+/// Registered inside [`RequestTimingMiddleware`](trusted_server_core::request_timing::RequestTimingMiddleware) and ahead of [`AuthMiddleware`]
+/// so that every outgoing response — including auth-rejected ones — carries a
+/// consistent set of headers.
 pub struct FinalizeResponseMiddleware {
     settings: Arc<Settings>,
 }
@@ -190,6 +190,8 @@ pub(crate) fn apply_finalize_headers(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use edgezero_core::router::RouterService;
+    use trusted_server_core::request_timing::{RequestTimingMiddleware, RequestTimings};
 
     use std::collections::HashMap;
     use std::sync::Mutex;
@@ -209,10 +211,10 @@ mod tests {
             .expect("should build empty test response")
     }
 
-    fn empty_ctx() -> RequestContext {
+    fn ctx_for_path(path: &str) -> RequestContext {
         let req = request_builder()
             .method(Method::GET)
-            .uri("/test")
+            .uri(path)
             .header("x-reader-ip", "198.51.100.7")
             .header("x-reader-ip-auth", "fictional-shared-secret-0123456789")
             .body(Body::empty())
@@ -220,6 +222,10 @@ mod tests {
         RequestContext::new(req, PathParams::new(HashMap::new()))
     }
 
+    fn empty_ctx() -> RequestContext {
+        ctx_for_path("/test")
+    }
+
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
         // Build from explicit test settings: the settings baked into the
         // binary contain placeholder secrets that `get_settings()` rejects
@@ -318,6 +324,77 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_timing_middleware_preserves_shared_handle_and_health_policy() {
+        for method in [Method::GET, Method::POST] {
+            for path in ["/test", "/health", "/health?probe=1", "/health/child"] {
+                for preinstalled in [false, true] {
+                    let route_path = path.split('?').next().expect("should have path");
+                    let expected = preinstalled || route_path != "/health";
+                    let timings = RequestTimings::new();
+                    timings.record(
+                        trusted_server_core::request_timing::Phase::Filter,
+                        std::time::Duration::from_millis(7),
+                    );
+                    std::thread::sleep(std::time::Duration::from_millis(2));
+                    let router = RouterService::builder()
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .route(route_path, method.clone(), move |ctx: RequestContext| async move {
+                            let installed = RequestTimings::from_extensions(ctx.request().extensions());
+                            assert_eq!(installed.is_some(), expected, "should preserve exact health policy");
+                            if let Some(installed) = installed {
+                                if preinstalled {
+                                    assert_eq!(installed.snapshot().filter_ms, Some(7), "should retain upstream facts");
+                                    installed.mark_auction_dispatched();
+                                    assert!(installed.snapshot().auction_dispatched_ms.expect("should mark dispatch") >= 2,
+                                        "should retain upstream origin");
+                                } else {
+                                    assert_eq!(installed.snapshot(), trusted_server_core::request_timing::TimingSnapshot::default(),
+                                        "should install independent empty facts");
+                                }
+                                installed.record_auction_wait(
+                                    trusted_server_core::request_timing::AuctionWaitPlacement::PreHeader,
+                                    std::time::Duration::from_millis(3));
+                            }
+                            Ok::<Response, EdgeError>(empty_response())
+                        })
+                        .build();
+                    let mut request = request_builder()
+                        .method(method.clone())
+                        .uri(path)
+                        .body(Body::empty())
+                        .expect("should build request");
+                    if preinstalled {
+                        request.extensions_mut().insert(timings.handle().clone());
+                    }
+                    let response =
+                        block_on(router.oneshot(request)).expect("should dispatch request");
+                    assert!(
+                        response.headers().get("server-timing").is_none(),
+                        "attachment should not expose timing"
+                    );
+                    if preinstalled {
+                        assert_eq!(
+                            timings.snapshot().auction_wait_ms,
+                            Some(3),
+                            "should share handler updates"
+                        );
+                        assert_eq!(
+                            timings.snapshot().request_elapsed_ms,
+                            None,
+                            "should not fabricate completion"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn sanitize_middleware_strips_configured_trust_headers_before_routing() {
         let mut settings = settings_with_response_headers(vec![]);
diff --git a/crates/trusted-server-adapter-spin/tests/routes.rs b/crates/trusted-server-adapter-spin/tests/routes.rs
index 613832b059..cb62546dec 100644
--- a/crates/trusted-server-adapter-spin/tests/routes.rs
+++ b/crates/trusted-server-adapter-spin/tests/routes.rs
@@ -151,6 +151,49 @@ async fn authenticated_admin_ec_routes_return_501() {
     }
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn authenticated_admin_opt_out_clear_route_returns_501() {
+    // The clear writes the EC identity graph, which is Fastly KV backed, so
+    // Spin answers the DELETE locally with 501 like the EC lookup.
+    let path = format!(
+        "/_ts/admin/ec/{}.abc123/providers/pull-ssp-example-com/opt-out",
+        "a".repeat(64)
+    );
+    let delete = request_builder()
+        .method("DELETE")
+        .uri(&path)
+        .header("authorization", "Basic YWRtaW46YWRtaW4tcGFzcw==")
+        .body(edgezero_core::body::Body::empty())
+        .expect("should build request");
+    let resp = route(test_router(), delete).await;
+
+    assert_eq!(
+        resp.status().as_u16(),
+        501,
+        "DELETE {path} should report that the opt-out clear is unsupported"
+    );
+    assert_eq!(
+        resp.headers()
+            .get("content-type")
+            .and_then(|v| v.to_str().ok()),
+        Some("application/json"),
+        "should answer with the same JSON as the EC lookup"
+    );
+
+    let get = request_builder()
+        .method("GET")
+        .uri(&path)
+        .header("authorization", "Basic YWRtaW46YWRtaW4tcGFzcw==")
+        .body(edgezero_core::body::Body::empty())
+        .expect("should build request");
+    let resp = route(test_router(), get).await;
+    assert_eq!(
+        resp.status().as_u16(),
+        404,
+        "control: GET {path} should be denied locally as an unknown admin route"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn admin_ec_route_without_credentials_returns_401() {
     let req = request_builder()
diff --git a/crates/trusted-server-cli/tests/proxy_trusted_server.rs b/crates/trusted-server-cli/tests/proxy_trusted_server.rs
index 39f0d3dd1b..a9dcccc15d 100644
--- a/crates/trusted-server-cli/tests/proxy_trusted_server.rs
+++ b/crates/trusted-server-cli/tests/proxy_trusted_server.rs
@@ -341,6 +341,8 @@ async fn send(
     request: Request<Full<Bytes>>,
 ) -> (StatusCode, HeaderMap, Bytes) {
     tokio::time::timeout(Duration::from_secs(5), async {
+        // Collecting the previous body can finish before Hyper's connection
+        // task makes the HTTP/1 dispatcher ready for another request.
         browser
             .ready()
             .await
diff --git a/crates/trusted-server-core/src/access_telemetry.rs b/crates/trusted-server-core/src/access_telemetry.rs
new file mode 100644
index 0000000000..a89162c2a8
--- /dev/null
+++ b/crates/trusted-server-core/src/access_telemetry.rs
@@ -0,0 +1,716 @@
+//! Access telemetry: route classification and the per-request access log row.
+//!
+//! Uses the versioned `access_logs_v2` Tinybird datasource with bounded,
+//! content-free route identity (see [`RouteClass`] and
+//! [`publisher_route_template`]) instead of the raw request path, which would
+//! otherwise carry identifiers, search terms, and other user-generated
+//! content into a 30-day dataset. See the design spec
+//! `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md`
+//! section 9.
+
+use serde_json::json;
+
+use crate::constants::TS_GIT_VERSION;
+use crate::request_timing::{AuctionWaitPlacement, TimingSnapshot};
+
+/// Normalizes an HTTP method token into the bounded set of values stored in
+/// the `method` `LowCardinality` column.
+///
+/// HTTP permits arbitrary extension-method tokens (`PROPFIND`, `MKCOL`, or
+/// any client-supplied garbage), and the token on an inbound request is
+/// entirely client controlled. Capturing one verbatim into a 30-day
+/// `LowCardinality(String)` column would let a single caller inflate that
+/// column's cardinality without bound and would violate this dataset's
+/// bounded-dimension privacy rule (see the module doc). GET, HEAD, POST, PUT,
+/// DELETE, PATCH and OPTIONS map to their uppercase form; all other methods,
+/// including CONNECT and TRACE, map to `"other"`. Runs
+/// inside [`access_event_row`] rather than at each capture site, so every
+/// row-building path is covered regardless of how `method` was populated.
+///
+/// # Examples
+///
+/// ```
+/// use trusted_server_core::access_telemetry::normalize_method;
+///
+/// assert_eq!(normalize_method("get"), "GET");
+/// assert_eq!(normalize_method("PROPFIND"), "other");
+/// assert_eq!(normalize_method("<script>"), "other");
+/// ```
+#[must_use]
+pub fn normalize_method(method: &str) -> &'static str {
+    match method.to_ascii_uppercase().as_str() {
+        "GET" => "GET",
+        "HEAD" => "HEAD",
+        "POST" => "POST",
+        "PUT" => "PUT",
+        "DELETE" => "DELETE",
+        "PATCH" => "PATCH",
+        "OPTIONS" => "OPTIONS",
+        _ => "other",
+    }
+}
+
+/// Coarse traffic category for one response, used as a `LowCardinality`
+/// dimension in the access telemetry row.
+///
+/// Assigned per route by the adapter at dispatch time (see
+/// [`RouteMetadata`]) rather than reconstructed from a handler enum or a
+/// path regex at emission time, so the mapping lives in exactly one place.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RouteClass {
+    /// A publisher-origin page served through the assembly/auction pipeline.
+    PublisherHtml,
+    /// The unified `tsjs` static bundle.
+    Tsjs,
+    /// A request served by a registered [`crate::integrations::IntegrationProxy`].
+    IntegrationProxy,
+    /// An Edge Cookie identity endpoint (verify, rotate, identify, admin
+    /// lookups, batch sync).
+    Ec,
+    /// The server-side auction or SPA re-auction (`page-bids`) endpoint.
+    AuctionApi,
+    /// A response proxied through a configured asset route (the
+    /// non-document fallback for scripts, styles, images, and fonts).
+    Asset,
+    /// Everything else: discovery, tester-cookie toggles, denied legacy
+    /// aliases, and any response with no attached [`RouteMetadata`].
+    Other,
+}
+
+impl RouteClass {
+    /// Renders this variant as the `snake_case` string stored in the
+    /// `route_class` column.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::PublisherHtml => "publisher_html",
+            Self::Tsjs => "tsjs",
+            Self::IntegrationProxy => "integration_proxy",
+            Self::Ec => "ec",
+            Self::AuctionApi => "auction_api",
+            Self::Asset => "asset",
+            Self::Other => "other",
+        }
+    }
+}
+
+/// Route identity for one response, carried from dispatch to the freeze
+/// point as a response extension.
+///
+/// The matched route pattern does not otherwise survive dispatch: the
+/// request is consumed by the router, and nothing else records which
+/// route-table row (or coarse fallback bucket) produced the response. Each
+/// named-route handler wrapper attaches its matched route-table pattern
+/// verbatim; the publisher fallback and `tsjs` handlers attach their class
+/// plus a coarse template ([`publisher_route_template`] for the former).
+#[derive(Debug, Clone)]
+pub struct RouteMetadata {
+    /// Coarse traffic category for this response.
+    pub route_class: RouteClass,
+    /// Bounded, content-free route identifier. For named routes this is the
+    /// route-table pattern verbatim (e.g. `/_ts/admin/ec/{id}`); for
+    /// publisher-fallback traffic it is the output of
+    /// [`publisher_route_template`].
+    pub route_template: String,
+}
+
+/// Normalizes a publisher-fallback request path into a bounded,
+/// content-free route template using an operator-configured allowlist of
+/// section names.
+///
+/// The root path `/` maps to itself. A path whose first segment matches an
+/// entry in `sections` (ASCII case-insensitive) and that has at least one
+/// further segment maps to `/{section}/*`, emitting the lowercased
+/// allowlist entry rather than anything taken from the request. Every
+/// other path maps to `/other/*`.
+///
+/// This construction makes the template content-free by definition: the
+/// set of emitted values is exactly `{"/", "/other/*"}` plus one
+/// `/{section}/*` per configured entry, so no request-derived byte ever
+/// reaches the row and cardinality is bounded by operator configuration.
+/// With the default empty allowlist, every publisher path collapses to
+/// `/other/*`. Depth alone was rejected as a signal in review: under
+/// `/{username}/posts` shapes the first segment is user data, and under
+/// single-segment permalink structures it is the document itself.
+///
+/// # Examples
+///
+/// ```
+/// use trusted_server_core::access_telemetry::publisher_route_template;
+///
+/// let sections = vec!["news".to_owned()];
+/// assert_eq!(
+///     publisher_route_template("/news/some-article-slug", &sections),
+///     "/news/*"
+/// );
+/// assert_eq!(publisher_route_template("/", &sections), "/");
+/// assert_eq!(
+///     publisher_route_template("/alice/orders", &sections),
+///     "/other/*"
+/// );
+/// assert_eq!(publisher_route_template("/news/x", &[]), "/other/*");
+/// ```
+#[must_use]
+pub fn publisher_route_template(path: &str, sections: &[String]) -> String {
+    if path == "/" {
+        return "/".to_owned();
+    }
+
+    let trimmed = path.strip_prefix('/').unwrap_or(path);
+    let (first_segment, rest) = match trimmed.split_once('/') {
+        Some((first, rest)) => (first, rest),
+        None => (trimmed, ""),
+    };
+    let has_more_depth = !rest.is_empty();
+
+    let matched_section = sections
+        .iter()
+        .find(|section| section.eq_ignore_ascii_case(first_segment));
+    match matched_section {
+        Some(section) if has_more_depth => format!("/{}/*", section.to_ascii_lowercase()),
+        _ => "/other/*".to_owned(),
+    }
+}
+
+/// A point-in-time view of the access-log dimensions for one response,
+/// captured at the `Server-Timing` freeze point when access telemetry is
+/// enabled (a disabled deployment skips the build entirely).
+///
+/// Built from typed response extensions ([`RouteMetadata`], the geo
+/// lookup state, and the template-cache response state) plus adapter-owned
+/// environment values, never from the public response headers those
+/// extensions back — operator-configured response headers can override a
+/// managed header, so reading the header instead of the extension would let
+/// the row silently drift from the extension of record.
+#[derive(Debug, Clone)]
+pub struct AccessTelemetrySnapshot {
+    /// The request's HTTP method (e.g. `GET`).
+    pub method: String,
+    /// The response's HTTP status code.
+    pub status: u16,
+    /// Coarse traffic category (see [`RouteClass`]).
+    pub route_class: RouteClass,
+    /// Bounded, content-free route identifier (see
+    /// [`publisher_route_template`]).
+    pub route_template: String,
+    /// The configured publisher domain.
+    pub publisher_domain: String,
+    /// Adapter-derived deployment environment: `production`, `staging`, or
+    /// `unknown`.
+    pub env: String,
+    /// Fastly service ID, or `unknown` when unavailable.
+    pub service_id: String,
+    /// Fastly POP code, or `unknown` when unavailable.
+    pub pop: String,
+    /// Two-letter geo country code, or `unknown` when no geo lookup
+    /// resolved one.
+    pub country: String,
+    /// Template-cache outcome for this response, or `unknown` when the
+    /// response never passed through the assembly pipeline.
+    pub template_cache_state: String,
+    /// Whether the response body was streamed or buffered to the client.
+    pub body_mode: &'static str,
+    /// The configured access-telemetry sample rate at the time this
+    /// response was handled.
+    pub sample_rate: f64,
+}
+
+/// Outcome observed while handing a response body to the client transport.
+///
+/// This describes the local transport handoff, not confirmed client receipt.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DeliveryResult {
+    /// The body was handed to the transport without an observed error.
+    Complete,
+    /// Some body bytes were accepted before a drive failure, or the transport
+    /// failed to finish cleanly after the body was written.
+    Partial,
+    /// The body drive failed before any body bytes were accepted.
+    Error,
+}
+
+impl DeliveryResult {
+    /// Returns the bounded value stored in the access row.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Complete => "complete",
+            Self::Partial => "partial",
+            Self::Error => "error",
+        }
+    }
+}
+
+/// Renders one NDJSON access-log row for the Tinybird Events API.
+///
+/// Column names match spec section 9 exactly. Phase columns come from
+/// `timings` and serialize as JSON `null` for phases that were never
+/// recorded, as do the auction timeline columns (including `auction_id`,
+/// whose datasource column is `Nullable(UUID)` so it joins natively against
+/// `auction_events_raw.auction_id`). Request dimensions come from
+/// `snapshot` as non-nullable strings (callers are expected to
+/// substitute an `unknown` sentinel rather than leave a dimension empty).
+/// There is no `event_date` column: the datasource's sorting key derives the
+/// date via `toDate(event_ts)`. The `ts_version` dimension comes from the same
+/// compiled-in build identifier as `x-ts-version`, or `unknown` when absent.
+/// `delivery_result` is supplied after send or finish, not at the freeze point.
+#[must_use]
+pub fn access_event_row(
+    snapshot: &AccessTelemetrySnapshot,
+    timings: &TimingSnapshot,
+    delivery_result: DeliveryResult,
+    event_ts_epoch_ms: u64,
+) -> String {
+    let auction_wait_placement = match timings.auction_wait_placement {
+        Some(AuctionWaitPlacement::PreHeader) => "pre_header",
+        Some(AuctionWaitPlacement::InStream) => "in_stream",
+        None => "none",
+    };
+
+    let row = json!({
+        "event_ts": format_event_timestamp(event_ts_epoch_ms),
+        "method": normalize_method(&snapshot.method),
+        "status": snapshot.status,
+        "time_elapsed_ms": timings.time_elapsed_ms,
+        "sample_rate": snapshot.sample_rate,
+        "service_id": snapshot.service_id,
+        "publisher_domain": snapshot.publisher_domain,
+        "env": snapshot.env,
+        "route_class": snapshot.route_class.as_str(),
+        "route_template": snapshot.route_template,
+        "body_mode": snapshot.body_mode,
+        "delivery_result": delivery_result.as_str(),
+        "auction_wait_placement": auction_wait_placement,
+        "appbuild_ms": timings.appbuild_ms,
+        "filter_ms": timings.filter_ms,
+        "geo_ms": timings.geo_ms,
+        "kv_ms": timings.kv_ms,
+        "origin_ms": timings.origin_ms,
+        "template_cache_ms": timings.template_cache_ms,
+        "auction_wait_ms": timings.auction_wait_ms,
+        "stream_ms": timings.stream_ms,
+        "request_elapsed_ms": timings.request_elapsed_ms,
+        "resp_bytes": timings.resp_bytes,
+        "auction_dispatched_ms": timings.auction_dispatched_ms,
+        "auction_collected_ms": timings.auction_resolved_ms,
+        "auction_committed_ms": timings.auction_committed_ms,
+        "auction_id": timings.auction_id.map(|id| id.to_string()),
+        "template_cache_state": snapshot.template_cache_state,
+        "country": snapshot.country,
+        "ts_version": TS_GIT_VERSION.unwrap_or("unknown"),
+        "pop": snapshot.pop,
+    });
+    row.to_string()
+}
+
+/// Formats `epoch_ms` as a `ClickHouse` `DateTime64(3)`-compatible string
+/// (`%Y-%m-%d %H:%M:%S%.3f`), matching the format the auction telemetry
+/// sink already uses for `event_ts`.
+///
+/// Falls back to the Unix epoch when `epoch_ms` cannot be represented as a
+/// valid timestamp, which never happens for a real wall-clock reading.
+fn format_event_timestamp(epoch_ms: u64) -> String {
+    let epoch_ms = i64::try_from(epoch_ms).unwrap_or(i64::MAX);
+    let timestamp = chrono::DateTime::<chrono::Utc>::from_timestamp_millis(epoch_ms)
+        .unwrap_or(chrono::DateTime::<chrono::Utc>::UNIX_EPOCH);
+    timestamp.format("%Y-%m-%d %H:%M:%S%.3f").to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A 64-hex-plus-suffix EC identifier, matching the format the admin
+    /// EC lookup route (`/_ts/admin/ec/{id}`) accepts as a path parameter.
+    const SYNTHETIC_EC_ID: &str =
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01";
+
+    fn unknown_snapshot(route_class: RouteClass, route_template: &str) -> AccessTelemetrySnapshot {
+        AccessTelemetrySnapshot {
+            method: "GET".to_owned(),
+            status: 200,
+            route_class,
+            route_template: route_template.to_owned(),
+            publisher_domain: "unknown".to_owned(),
+            env: "unknown".to_owned(),
+            service_id: "unknown".to_owned(),
+            pop: "unknown".to_owned(),
+            country: "unknown".to_owned(),
+            template_cache_state: "unknown".to_owned(),
+            body_mode: "buffered",
+            sample_rate: 0.0,
+        }
+    }
+
+    #[test]
+    fn admin_ec_route_template_never_contains_the_identifier() {
+        // Named-route templates come from the route table verbatim, never
+        // from the matched request path, so a row built for this route can
+        // never carry the caller's actual EC id — even when a caller
+        // supplies one shaped exactly like a real one.
+        let snapshot = unknown_snapshot(RouteClass::Ec, "/_ts/admin/ec/{id}");
+        let row = access_event_row(
+            &snapshot,
+            &TimingSnapshot::default(),
+            DeliveryResult::Complete,
+            0,
+        );
+
+        assert!(
+            !row.contains(SYNTHETIC_EC_ID),
+            "row must never contain a literal EC identifier: {row}"
+        );
+        assert!(
+            row.contains("/_ts/admin/ec/{id}"),
+            "row should still carry the route-table pattern: {row}"
+        );
+    }
+
+    #[test]
+    fn publisher_route_template_emits_only_allowlisted_sections() {
+        let sections = vec!["news".to_owned(), "Sports".to_owned()];
+        assert_eq!(
+            publisher_route_template("/news/some-article-slug", &sections),
+            "/news/*"
+        );
+        assert_eq!(
+            publisher_route_template("/NEWS/some-article-slug", &sections),
+            "/news/*",
+            "matching should be case-insensitive on the request side"
+        );
+        assert_eq!(
+            publisher_route_template("/sports/scores/today", &sections),
+            "/sports/*",
+            "the emitted value should be the lowercased allowlist entry"
+        );
+        assert_eq!(publisher_route_template("/", &sections), "/");
+        assert_eq!(
+            publisher_route_template("/news", &sections),
+            "/other/*",
+            "an allowlisted section with no further depth is the document, not a section"
+        );
+        assert_eq!(
+            publisher_route_template("/opinion/some-slug", &sections),
+            "/other/*",
+            "a section absent from the allowlist should collapse"
+        );
+    }
+
+    #[test]
+    fn publisher_route_template_collapses_everything_by_default() {
+        // The default allowlist is empty, so no request-derived byte can
+        // reach the row: the only emitted values are `/` and `/other/*`.
+        let empty: Vec<String> = Vec::new();
+        for path in [
+            "/news/some-article-slug",
+            "/alice/orders",
+            "/jane-doe/posts",
+            "/johnsmith1985/settings",
+            "/how-to-treat-my-hiv-today/comments",
+            "/abcdefabcdefabcdefabcdefabcdefab/x",
+            "/8f3a9c2b/x",
+            "/my-post-title",
+            "/user@example.com/profile",
+            "/search terms here",
+            "//double-slash",
+            "/550e8400-e29b-41d4-a716-446655440000/profile",
+        ] {
+            assert_eq!(
+                publisher_route_template(path, &empty),
+                "/other/*",
+                "should collapse with an empty allowlist: {path}"
+            );
+        }
+        assert_eq!(publisher_route_template("/", &empty), "/");
+    }
+
+    #[test]
+    fn publisher_route_template_never_emits_user_data_even_when_allowlisted() {
+        // Adversarial depth-2 shapes from review: even with sections
+        // configured, a first segment that is not an exact allowlist match
+        // collapses, and the emitted value on a match is the allowlist
+        // entry itself, never request bytes.
+        let sections = vec!["news".to_owned()];
+        for path in [
+            "/jane-doe/posts",
+            "/johnsmith1985/settings",
+            "/how-to-treat-my-hiv-today/comments",
+            "/abcdefabcdefabcdefabcdefabcdefab/x",
+            "/8f3a9c2b/x",
+            "/newsy/article",
+        ] {
+            assert_eq!(
+                publisher_route_template(path, &sections),
+                "/other/*",
+                "should collapse non-allowlisted first segments: {path}"
+            );
+        }
+    }
+
+    #[test]
+    fn row_serializes_nulls_for_missing_phases() {
+        let snapshot = unknown_snapshot(RouteClass::Other, "/other/*");
+        let row = access_event_row(
+            &snapshot,
+            &TimingSnapshot::default(),
+            DeliveryResult::Complete,
+            0,
+        );
+        let parsed: serde_json::Value =
+            serde_json::from_str(&row).expect("should serialize valid JSON");
+
+        for field in [
+            "time_elapsed_ms",
+            "appbuild_ms",
+            "filter_ms",
+            "geo_ms",
+            "kv_ms",
+            "origin_ms",
+            "template_cache_ms",
+            "auction_wait_ms",
+            "stream_ms",
+            "request_elapsed_ms",
+            "resp_bytes",
+            "auction_dispatched_ms",
+            "auction_collected_ms",
+            "auction_committed_ms",
+            "auction_id",
+        ] {
+            assert!(
+                parsed[field].is_null(),
+                "unrecorded phase `{field}` should serialize as null: {row}"
+            );
+        }
+
+        for field in [
+            "service_id",
+            "publisher_domain",
+            "env",
+            "route_class",
+            "route_template",
+            "body_mode",
+            "template_cache_state",
+            "country",
+            "ts_version",
+            "pop",
+        ] {
+            assert!(
+                parsed[field].is_string(),
+                "dimension `{field}` must never be null: {row}"
+            );
+        }
+        assert_eq!(parsed["auction_wait_placement"], "none");
+        assert!(
+            row.contains("\"auction_id\":null"),
+            "auction_id should serialize as an explicit null key, not be omitted: {row}"
+        );
+    }
+
+    #[test]
+    fn row_serializes_recorded_phases_as_numbers() {
+        let snapshot = unknown_snapshot(RouteClass::AuctionApi, "/auction");
+        let timings = TimingSnapshot {
+            time_elapsed_ms: Some(12),
+            request_elapsed_ms: Some(15),
+            appbuild_ms: Some(1),
+            filter_ms: Some(2),
+            geo_ms: Some(3),
+            kv_ms: Some(4),
+            origin_ms: Some(5),
+            template_cache_ms: Some(6),
+            auction_wait_ms: Some(7),
+            stream_ms: Some(8),
+            auction_wait_placement: Some(AuctionWaitPlacement::InStream),
+            resp_bytes: Some(1024),
+            auction_dispatched_ms: Some(9),
+            auction_resolved_ms: Some(10),
+            auction_committed_ms: Some(11),
+            auction_id: Some(uuid::uuid!("33333333-3333-3333-3333-333333333333")),
+        };
+        let row = access_event_row(
+            &snapshot,
+            &timings,
+            DeliveryResult::Complete,
+            1_700_000_000_000,
+        );
+        let parsed: serde_json::Value =
+            serde_json::from_str(&row).expect("should serialize valid JSON");
+
+        assert_eq!(parsed["appbuild_ms"], 1);
+        assert_eq!(parsed["stream_ms"], 8);
+        assert_eq!(parsed["resp_bytes"], 1024);
+        assert_eq!(parsed["auction_wait_placement"], "in_stream");
+        assert_eq!(parsed["auction_dispatched_ms"], 9);
+        assert_eq!(parsed["auction_collected_ms"], 10);
+        assert!(
+            parsed.get("auction_resolved_ms").is_none(),
+            "should not emit the superseded collection column name"
+        );
+        assert_eq!(parsed["auction_committed_ms"], 11);
+        assert_eq!(parsed["auction_id"], "33333333-3333-3333-3333-333333333333");
+    }
+
+    #[test]
+    fn row_reports_the_compiled_trusted_server_version() {
+        let snapshot = unknown_snapshot(RouteClass::Other, "/other/*");
+        let row = access_event_row(
+            &snapshot,
+            &TimingSnapshot::default(),
+            DeliveryResult::Complete,
+            0,
+        );
+        let parsed: serde_json::Value =
+            serde_json::from_str(&row).expect("should serialize valid JSON");
+        let header = crate::version_header::git_version_header_value();
+        assert_eq!(
+            parsed["ts_version"],
+            header
+                .as_ref()
+                .map(|value| value
+                    .to_str()
+                    .expect("should render the build version header"))
+                .unwrap_or("unknown"),
+            "should identify the same Trusted Server build as x-ts-version"
+        );
+    }
+
+    #[test]
+    fn producer_schema_and_fixtures_share_the_access_v2_contract() {
+        let schema = include_str!("../../../tinybird/datasources/access_logs_v2.datasource");
+        let columns: std::collections::BTreeSet<_> = schema
+            .lines()
+            .filter_map(|line| {
+                let column = line.trim().strip_prefix('`')?.split_once('`')?.0;
+                assert!(
+                    line.contains(&format!("`json:$.{column}`")),
+                    "should map {column} to the same JSON field"
+                );
+                Some(column.to_owned())
+            })
+            .collect();
+        assert_eq!(columns.len(), 31, "should match the versioned row contract");
+        let snapshot = unknown_snapshot(RouteClass::Other, "/other/*");
+        let row: serde_json::Value = serde_json::from_str(&access_event_row(
+            &snapshot,
+            &TimingSnapshot::default(),
+            DeliveryResult::Complete,
+            0,
+        ))
+        .expect("should parse the producer row");
+        let producer_fields = row
+            .as_object()
+            .expect("should produce a JSON object")
+            .keys()
+            .cloned()
+            .collect::<std::collections::BTreeSet<_>>();
+        assert_eq!(
+            producer_fields, columns,
+            "should emit exactly the schema fields"
+        );
+        for line in include_str!("../../../tinybird/fixtures/access_logs_v2.ndjson").lines() {
+            let fixture: serde_json::Value =
+                serde_json::from_str(line).expect("should parse the access fixture");
+            let fields = fixture
+                .as_object()
+                .expect("should provide a fixture object")
+                .keys()
+                .cloned()
+                .collect::<std::collections::BTreeSet<_>>();
+            assert_eq!(
+                fields, columns,
+                "should keep fixture fields in sync with the row"
+            );
+            assert!(
+                ["complete", "partial", "error"].contains(
+                    &fixture["delivery_result"]
+                        .as_str()
+                        .expect("should provide a bounded delivery result")
+                ),
+                "should use a producible transport outcome"
+            );
+        }
+    }
+
+    #[test]
+    fn row_preserves_each_transport_delivery_outcome() {
+        let snapshot = unknown_snapshot(RouteClass::PublisherHtml, "/other/*");
+        for (result, expected) in [
+            (DeliveryResult::Complete, "complete"),
+            (DeliveryResult::Partial, "partial"),
+            (DeliveryResult::Error, "error"),
+        ] {
+            let row = access_event_row(&snapshot, &TimingSnapshot::default(), result, 0);
+            let parsed: serde_json::Value =
+                serde_json::from_str(&row).expect("should serialize valid JSON");
+            assert_eq!(
+                parsed["delivery_result"], expected,
+                "should preserve the actual transport outcome instead of deriving it from status"
+            );
+            assert_eq!(parsed["status"], 200);
+        }
+    }
+
+    #[test]
+    fn route_class_renders_snake_case() {
+        assert_eq!(RouteClass::PublisherHtml.as_str(), "publisher_html");
+        assert_eq!(RouteClass::Tsjs.as_str(), "tsjs");
+        assert_eq!(RouteClass::IntegrationProxy.as_str(), "integration_proxy");
+        assert_eq!(RouteClass::Ec.as_str(), "ec");
+        assert_eq!(RouteClass::AuctionApi.as_str(), "auction_api");
+        assert_eq!(RouteClass::Asset.as_str(), "asset");
+        assert_eq!(RouteClass::Other.as_str(), "other");
+    }
+
+    #[test]
+    fn format_event_timestamp_matches_clickhouse_datetime64_shape() {
+        // 2023-11-14T22:13:20.000Z
+        let rendered = format_event_timestamp(1_700_000_000_000);
+        assert_eq!(rendered, "2023-11-14 22:13:20.000");
+    }
+
+    #[test]
+    fn normalize_method_uppercases_allowlisted_methods() {
+        assert_eq!(normalize_method("get"), "GET");
+        assert_eq!(normalize_method("Get"), "GET");
+        assert_eq!(normalize_method("POST"), "POST");
+        assert_eq!(normalize_method("head"), "HEAD");
+        assert_eq!(normalize_method("PUT"), "PUT");
+        assert_eq!(normalize_method("delete"), "DELETE");
+        assert_eq!(normalize_method("Patch"), "PATCH");
+        assert_eq!(normalize_method("options"), "OPTIONS");
+    }
+
+    #[test]
+    fn normalize_method_maps_extension_and_garbage_tokens_to_other() {
+        assert_eq!(
+            normalize_method("PROPFIND"),
+            "other",
+            "an HTTP extension method must not reach the row verbatim"
+        );
+        assert_eq!(
+            normalize_method("<script>alert(1)</script>"),
+            "other",
+            "an unbounded client-controlled token must not reach the row verbatim"
+        );
+    }
+
+    #[test]
+    fn row_normalizes_method_even_when_snapshot_carries_a_raw_token() {
+        // The normalizer runs inside `access_event_row` so every row-building
+        // path is covered, regardless of what the snapshot's `method` field
+        // holds — a caller-controlled extension method must never leak into
+        // the row unnormalized.
+        let mut snapshot = unknown_snapshot(RouteClass::Other, "/other/*");
+        snapshot.method = "PROPFIND".to_owned();
+        let row = access_event_row(
+            &snapshot,
+            &TimingSnapshot::default(),
+            DeliveryResult::Complete,
+            0,
+        );
+        let parsed: serde_json::Value =
+            serde_json::from_str(&row).expect("should serialize valid JSON");
+
+        assert_eq!(parsed["method"], "other");
+    }
+}
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index 086515fa20..e35e93151f 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -1,27 +1,42 @@
 //! HTTP endpoint handlers for auction requests.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
 use http::{Request, Response, StatusCode, header};
-use serde_json::Value as JsonValue;
+use serde_json::value::RawValue;
 
 use crate::auction::formats::AdRequest;
 use crate::auction::orchestrator::OrchestrationResult;
-use crate::consent::{consent_allows_server_side_auction, gate_eids_by_consent};
+use crate::consent::{
+    allows_eid_persistence, consent_allows_server_side_auction, gate_eids_by_consent,
+};
 use crate::constants::COOKIE_TS_EIDS;
 use crate::cookies::extract_cookie_value;
 use crate::ec::EcContext;
 use crate::ec::EcKvSnapshot;
-use crate::ec::eids::{resolve_partner_ids, to_eids};
+use crate::ec::checked_current_timestamp;
+use crate::ec::client_eids::parse_client_eids;
+use crate::ec::current_timestamp;
+use crate::ec::eids::{ServerSet, server_set};
+use crate::ec::identity::IdentityRuntime;
+use crate::ec::identity::UnixTime;
+use crate::ec::identity::catalog::ProviderCatalog;
+use crate::ec::identity::coordinator::HoldResults;
+use crate::ec::identity::denials::{Denials, denials, filter_browser_candidates};
+use crate::ec::identity::mirror::{MirrorPayload, MirrorRead, MirrorSource, mirror_payload};
+use crate::ec::identity::policy::PolicySignals;
+use crate::ec::identity::request::opted_out;
+use crate::ec::identity::servable::ServeContext;
 use crate::ec::kv::KvIdentityGraph;
-use crate::ec::kv_types::MAX_UID_LENGTH;
+use crate::ec::partner::normalize_partner_source_domain;
 use crate::ec::prebid_eids::parse_prebid_eids_cookie;
 use crate::ec::registry::PartnerRegistry;
 use crate::error::TrustedServerError;
-use crate::openrtb::{Eid, Uid};
+use crate::openrtb::Eid;
 use crate::platform::RuntimeServices;
+use crate::request_timing::RequestTimings;
 use crate::settings::Settings;
 use crate::trace::{
     TraceAuctionCarry, TraceAuctionSource, TraceAuctionTerminalReason, TraceAuctionTerminalStatus,
@@ -36,10 +51,6 @@ use super::telemetry::{
 };
 use super::types::{AuctionContext, AuctionRequest};
 
-const MAX_CLIENT_EID_SOURCES: usize = 64;
-const MAX_CLIENT_UIDS_PER_SOURCE: usize = 32;
-const MAX_CLIENT_EID_SOURCE_BYTES: usize = 255;
-
 /// Maximum accepted JSON body size for `/auction`. Picked to comfortably fit
 /// the largest realistic Prebid-derived auction request (hundreds of ad units
 /// with EID arrays) while preventing an authenticated client from consuming
@@ -150,6 +161,12 @@ pub async fn handle_auction(
     }
 
     let (parts, body) = req.into_parts();
+    // T0-anchored timeline (spec section 18). This route is the auction, so
+    // dispatch and resolve bracket `run_auction` rather than the origin
+    // fetch, and the commit mark lands once the OpenRTB response carrying the
+    // targeting has been built. A defaulted handle records into nothing that
+    // is ever read, so direct-handler tests are unaffected.
+    let timings = RequestTimings::from_extensions(&parts.extensions).unwrap_or_default();
     let body_bytes = body.into_bytes().unwrap_or_default();
     if body_bytes.len() > MAX_AUCTION_BODY_SIZE {
         return Response::builder()
@@ -243,6 +260,12 @@ pub async fn handle_auction(
             &auction_request,
             ec_context.ec_allowed(),
             trace.as_ref(),
+            mirror_member(
+                &EcKvSnapshot::NotRead,
+                None,
+                ec_context,
+                PolicySignals::from_headers(http_req.headers()),
+            ),
         )
         .map(|conversion| retain_private_trace(conversion.response, trace));
     }
@@ -281,6 +304,7 @@ pub async fn handle_auction(
             &auction_request,
             ec_context,
         );
+        timings.set_auction_id(observation.auction_id);
         emit_auction_events_best_effort_lazy(services, || {
             build_auction_events(
                 observation,
@@ -305,6 +329,7 @@ pub async fn handle_auction(
             &auction_request,
             ec_context.ec_allowed(),
             trace.as_ref(),
+            mirror_enabled(ec_context).then(|| MirrorPayload::Clear.to_json()),
         )
         .map(|conversion| retain_private_trace(conversion.response, trace));
     }
@@ -324,18 +349,14 @@ pub async fn handle_auction(
     // `ec_id.is_some()`.
     let client_eids = if ec_id.is_some() {
         resolve_client_auction_eids(
-            body.eids.as_ref(),
+            body.eids.as_deref(),
             extract_cookie_value(&http_req, COOKIE_TS_EIDS).as_deref(),
         )
     } else {
         None
     };
-    // Carry the full request-local EID set to response finalization so KV
-    // ingestion uses what this request actually sent, not just whatever fits
-    // in the size-capped `ts-eids` cookie (see `ec::finalize::ec_finalize_response`).
-    if let Some(eids) = &client_eids {
-        ec_context.set_client_eids(eids.clone());
-    }
+    // The browser's EIDs feed the merge below and nothing else: `/auction` is
+    // a stager, so they never reach KV (spec 5.3, G10).
 
     // Resolve partner EIDs from the KV identity graph when the user has a valid
     // EC and both KV and partner stores are available. Gate the read on a
@@ -345,14 +366,15 @@ pub async fn handle_auction(
         (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
         _ => EcKvSnapshot::NotRead,
     };
-    // Hand the loaded row to the request context so response finalization —
-    // which runs on an EC context the adapter owns, after this handler returns
-    // — ingests `ts-eids`/`sharedId` updates from this read instead of paying
-    // for a second lookup.
+    // Hand the loaded row to the request context so response finalization,
+    // which runs on an EC context the adapter owns after this handler
+    // returns, reuses this read instead of paying for a second lookup.
     if !matches!(auction_kv_snapshot, EcKvSnapshot::NotRead) {
         ec_context.set_kv_snapshot(auction_kv_snapshot.clone());
     }
-    let eids = resolve_auction_eids(&auction_kv_snapshot, registry, ec_context);
+    let signals = PolicySignals::from_headers(http_req.headers());
+    let identity = auction_identity(&auction_kv_snapshot, registry, ec_context, signals);
+    let mirror = identity.mirror_member(ec_context);
 
     // Look up geo for device info.
     let geo = services
@@ -374,9 +396,10 @@ pub async fn handle_auction(
         geo,
     )?;
 
-    // Merge current-request client EIDs with KV-resolved EIDs, then apply
-    // consent gating before attaching them to the auction request.
-    let merged_eids = merge_auction_eids(client_eids, eids);
+    // Forward the browser entries that pass the provider denials, append the
+    // server set for sources the browser did not send, then apply consent
+    // gating.
+    let merged_eids = identity.merge(client_eids.as_deref());
     let had_eids = merged_eids.as_ref().is_some_and(|v| !v.is_empty());
     auction_request.user.eids =
         gate_eids_by_consent(merged_eids, auction_request.user.consent.as_ref());
@@ -403,24 +426,27 @@ pub async fn handle_auction(
         ec_context,
     );
 
-    // Run the auction
-    let result = match orchestrator.run_auction(&auction_request, &context).await {
-        Ok(result) => result,
-        Err(err) => {
-            let elapsed_ms = observation.elapsed_ms();
+    timings.set_auction_id(observation.auction_id);
+
+    let (result, auction_work_started) = match orchestrator
+        .run_auction_with_timings(&auction_request, &context, &timings)
+        .await
+    {
+        Ok(completed) => completed,
+        Err(failure) => {
             emit_auction_events_best_effort_lazy(services, || {
                 build_auction_events(
                     observation,
                     AuctionTerminalOutcome::ExecutionFailed {
                         request: Some(&auction_request),
-                        provider_responses: &[],
+                        provider_responses: &failure.provider_responses,
                         reason: "execution_failed",
-                        elapsed_ms,
+                        elapsed_ms: failure.elapsed_ms,
                     },
                 )
             })
             .await;
-            return Err(err.change_context(TrustedServerError::Auction {
+            return Err(failure.error.change_context(TrustedServerError::Auction {
                 message: "Auction orchestration failed".to_string(),
             }));
         }
@@ -432,6 +458,7 @@ pub async fn handle_auction(
         &auction_request,
         ec_context.ec_allowed(),
         trace.as_ref(),
+        mirror,
     ) {
         Ok(conversion) => conversion,
         Err(error) => {
@@ -452,6 +479,12 @@ pub async fn handle_auction(
         }
     };
 
+    // For this route the response body is the commit, since there is no
+    // page state to write into. Routing-only results cannot commit an auction.
+    if auction_work_started {
+        timings.mark_auction_committed();
+    }
+
     emit_auction_events_best_effort_lazy(services, || {
         build_auction_events(
             observation,
@@ -509,41 +542,263 @@ fn retain_private_trace(
     response
 }
 
-/// Resolves partner EIDs from the KV identity graph for bidstream decoration.
+/// What the row a request read means for the `ts-eids-s` mirror (spec 6.2).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum MirrorState {
+    /// No KV read for this request's EC: no mirror member.
+    NotRead,
+    /// EC use is denied, or the row is missing, a tombstone or withdrawn.
+    Cleared,
+    /// A live row: the mirror carries the servable server set.
+    Live,
+}
+
+/// What one request's KV read gives the auction, resolved once (spec 7.1).
 ///
-/// Returns `None` when any prerequisite is missing (no KV store, no partner
-/// store, no EC, consent denied). On KV or partner-resolution errors, logs a
-/// warning and returns empty EIDs so the auction can proceed in degraded mode.
-pub(crate) fn resolve_auction_eids(
+/// Servability is decided once, at one clock read, and both the bidstream
+/// merge and the `ts-eids-s` mirror read the same [`ServerSet`].
+pub(crate) struct AuctionIdentity {
+    /// `None` when the request may not use KV IDs at all (no registry, no
+    /// EC, or EC use denied).
+    server: Option<ServerSet>,
+    denials: Denials,
+    mirror: MirrorState,
+    /// The clock read servability used, when there was one.
+    now: Option<u64>,
+}
+
+impl AuctionIdentity {
+    /// The server set's EIDs, before browser precedence.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn server_eids(&self) -> Option<Vec<Eid>> {
+        self.server.as_ref().map(ServerSet::eids)
+    }
+
+    /// Overlays the answers of the hold dispatch before this navigation's
+    /// auction onto the server set. A request that may not use KV IDs stays
+    /// without a set.
+    pub(crate) fn add_hold_results(
+        &mut self,
+        results: HoldResults,
+        registry: &PartnerRegistry,
+        catalog: &ProviderCatalog,
+    ) {
+        if let Some(server) = self.server.as_mut() {
+            server.with_hold_results(results, registry, catalog);
+        }
+    }
+
+    /// The request's bidstream EIDs before consent gating: the browser's
+    /// candidates after the denials, then the server set (spec 7.1).
+    #[must_use]
+    pub(crate) fn merge(&self, client_eids: Option<&[Eid]>) -> Option<Vec<Eid>> {
+        let empty = ServerSet::default();
+        let merged = merge_auction_eids(
+            client_eids.unwrap_or_default(),
+            self.server.as_ref().unwrap_or(&empty),
+            &self.denials,
+        );
+        if merged.is_empty() {
+            None
+        } else {
+            Some(merged)
+        }
+    }
+
+    /// The mirror member of an `/auction` or `/_ts/page-bids` response
+    /// (spec 6.2).
+    ///
+    /// The mirror carries the same server set as the bidstream, provenance
+    /// defaults included, and never an ID consent would strip.
+    ///
+    /// `None` while `[ec.identity] mirror_enabled` is off or the request has
+    /// no identity runtime: the response then carries no mirror member.
+    #[must_use]
+    pub(crate) fn mirror_member(&self, ec_context: &EcContext) -> Option<serde_json::Value> {
+        if !mirror_enabled(ec_context) {
+            return None;
+        }
+        let sources = match self.mirror {
+            MirrorState::NotRead | MirrorState::Cleared => Vec::new(),
+            MirrorState::Live if allows_eid_persistence(ec_context.consent()) => self
+                .server
+                .as_ref()
+                .map(|server| mirror_sources(server, ec_context))
+                .unwrap_or_default(),
+            MirrorState::Live => Vec::new(),
+        };
+        let read = if self.mirror == MirrorState::NotRead {
+            MirrorRead::NotRead
+        } else if sources.is_empty() {
+            MirrorRead::Cleared
+        } else {
+            MirrorRead::Servable(&sources)
+        };
+        let now = self.now.unwrap_or_else(current_timestamp);
+        mirror_payload(read, now).map(|payload| payload.to_json())
+    }
+}
+
+/// Whether the operator turned the `ts-eids-s` mirror on (spec 6.2, 15).
+pub(crate) fn mirror_enabled(ec_context: &EcContext) -> bool {
+    ec_context
+        .identity_runtime()
+        .is_some_and(|runtime| runtime.identity().mirror_enabled)
+}
+
+/// One [`MirrorSource`] per source of `server`, ranked by its writer's
+/// `cookie_priority`.
+fn mirror_sources(server: &ServerSet, ec_context: &EcContext) -> Vec<MirrorSource> {
+    let identity = ec_context.identity_runtime().map(IdentityRuntime::identity);
+    server
+        .sources()
+        .iter()
+        .map(|source| {
+            let priority = match (&source.writer, identity) {
+                (Some(writer), Some(identity)) => identity
+                    .providers
+                    .get(writer.as_str())
+                    .map_or(0, |settings| settings.cookie_priority),
+                _ => 0,
+            };
+            MirrorSource {
+                source: source.source_domain.clone(),
+                provider: source.writer.clone(),
+                priority,
+                expires_at: source.expires_at,
+                eids: source.eids.clone(),
+            }
+        })
+        .collect()
+}
+
+fn mirror_state(
     snapshot: &EcKvSnapshot,
     registry: Option<&PartnerRegistry>,
     ec_context: &EcContext,
-) -> Option<Vec<Eid>> {
-    let registry = registry?;
-
+) -> MirrorState {
     if !ec_context.ec_allowed() {
-        return None;
+        return MirrorState::Cleared;
     }
-
-    let ec_id = ec_context.ec_value()?;
-
-    let Some(entry) = snapshot.entry_for(ec_id) else {
-        return Some(Vec::new());
+    let (Some(ec_id), Some(_)) = (ec_context.ec_value(), registry) else {
+        return MirrorState::NotRead;
     };
+    match snapshot {
+        EcKvSnapshot::Missing { ec_id: read } if read == ec_id => MirrorState::Cleared,
+        EcKvSnapshot::Present {
+            ec_id: read, entry, ..
+        } if read == ec_id => {
+            if entry.consent.ok {
+                MirrorState::Live
+            } else {
+                MirrorState::Cleared
+            }
+        }
+        _ => MirrorState::NotRead,
+    }
+}
 
-    if !entry.consent.ok {
-        return Some(Vec::new());
+/// Resolves what the request's KV read gives the auction, once.
+///
+/// The server set is `None` when any prerequisite is missing (no partner
+/// store, no EC, consent denied), and empty on a KV miss, a failed read, a
+/// withdrawn row or a failed clock, so the auction proceeds in degraded
+/// mode. A stored record is in it only when the shared servability check
+/// passes under this request's consent and `signals`. The denials come from
+/// the row read, whatever its consent state.
+pub(crate) fn auction_identity(
+    snapshot: &EcKvSnapshot,
+    registry: Option<&PartnerRegistry>,
+    ec_context: &EcContext,
+    signals: PolicySignals,
+) -> AuctionIdentity {
+    let mut identity = AuctionIdentity {
+        server: None,
+        denials: Denials::default(),
+        mirror: mirror_state(snapshot, registry, ec_context),
+        now: None,
+    };
+    let Some(registry) = registry else {
+        return identity;
+    };
+    if !ec_context.ec_allowed() {
+        return identity;
+    }
+    let Some(ec_id) = ec_context.ec_value() else {
+        return identity;
+    };
+    let entry = snapshot.entry_for(ec_id);
+    // Without a runtime no provider is configured, so only unowned records
+    // without a writer are servable, and no provider denies anything.
+    let empty_catalog;
+    let catalog = match ec_context.identity_runtime() {
+        Some(runtime) => runtime.catalog(),
+        None => {
+            empty_catalog = ProviderCatalog::empty();
+            &empty_catalog
+        }
+    };
+    if let Some(entry) = entry {
+        identity.denials = denials(entry, catalog);
     }
+    // A zero time would make every expiry check pass (spec 4.4), so a failed
+    // clock resolves no KV IDs.
+    let Some(now) = checked_current_timestamp() else {
+        identity.server = Some(ServerSet::default());
+        return identity;
+    };
+    identity.now = Some(now);
+    let opted_out = entry.map(opted_out).unwrap_or_default();
+    let serve = ServeContext {
+        now: UnixTime::from_secs(now),
+        consent: ec_context.consent(),
+        signals,
+        catalog,
+        opted_out: &opted_out,
+    };
+    identity.server = Some(server_set(entry, registry, &serve));
+    identity
+}
+
+/// Resolves partner EIDs from the KV identity graph for bidstream decoration.
+///
+/// Returns `None` when any prerequisite is missing (no KV store, no partner
+/// store, no EC, consent denied), and empty EIDs on a KV miss or error so
+/// the auction can proceed in degraded mode. See [`auction_identity`].
+#[cfg(test)]
+pub(crate) fn resolve_auction_eids(
+    snapshot: &EcKvSnapshot,
+    registry: Option<&PartnerRegistry>,
+    ec_context: &EcContext,
+    signals: PolicySignals,
+) -> Option<Vec<Eid>> {
+    auction_identity(snapshot, registry, ec_context, signals).server_eids()
+}
 
-    let resolved = resolve_partner_ids(registry, entry);
-    Some(to_eids(&resolved))
+/// The mirror member of an `/auction` or `/_ts/page-bids` response, from the
+/// row this request read (spec 6.2). See [`AuctionIdentity::mirror_member`].
+pub(crate) fn mirror_member(
+    snapshot: &EcKvSnapshot,
+    registry: Option<&PartnerRegistry>,
+    ec_context: &EcContext,
+    signals: PolicySignals,
+) -> Option<serde_json::Value> {
+    auction_identity(snapshot, registry, ec_context, signals).mirror_member(ec_context)
 }
 
+/// Resolves the request's browser EIDs: the `/auction` body when it has a
+/// valid entry, else the `ts-eids` cookie.
+///
+/// Both go through the shared client EID parser, so the same rules and caps
+/// apply to each, and a malformed entry costs only itself.
 pub(crate) fn resolve_client_auction_eids(
-    raw: Option<&JsonValue>,
+    raw: Option<&RawValue>,
     cookie_value: Option<&str>,
 ) -> Option<Vec<Eid>> {
-    parse_client_auction_eids(raw).or_else(|| parse_cookie_auction_eids(cookie_value))
+    raw.map(parse_client_eids)
+        .filter(|eids| !eids.is_empty())
+        .or_else(|| parse_cookie_auction_eids(cookie_value))
 }
 
 fn parse_cookie_auction_eids(cookie_value: Option<&str>) -> Option<Vec<Eid>> {
@@ -558,148 +813,79 @@ fn parse_cookie_auction_eids(cookie_value: Option<&str>) -> Option<Vec<Eid>> {
     }
 }
 
-fn parse_client_auction_eids(raw: Option<&JsonValue>) -> Option<Vec<Eid>> {
-    let Some(JsonValue::Array(entries)) = raw else {
-        return None;
-    };
-
-    let mut eids = Vec::new();
-
-    for entry in entries {
-        if eids.len() >= MAX_CLIENT_EID_SOURCES {
-            log::debug!(
-                "Auction EIDs: reached max client EID source count ({MAX_CLIENT_EID_SOURCES})"
-            );
-            break;
-        }
-        let JsonValue::Object(entry) = entry else {
-            log::debug!("Auction EIDs: dropping malformed client EID entry");
-            continue;
-        };
-
-        let Some(source) = entry
-            .get("source")
-            .and_then(JsonValue::as_str)
-            .filter(|source| !source.trim().is_empty())
-            .filter(|source| source.len() <= MAX_CLIENT_EID_SOURCE_BYTES)
-            .map(str::to_owned)
-        else {
-            continue;
-        };
-
-        let Some(JsonValue::Array(raw_uids)) = entry.get("uids") else {
-            continue;
-        };
-
-        let uids: Vec<_> = raw_uids
-            .iter()
-            .filter_map(parse_client_auction_uid)
-            .take(MAX_CLIENT_UIDS_PER_SOURCE)
-            .collect();
-        if uids.is_empty() {
-            continue;
-        }
-
-        eids.push(Eid { source, uids });
-    }
-
-    if eids.is_empty() { None } else { Some(eids) }
-}
-
-fn parse_client_auction_uid(raw: &JsonValue) -> Option<Uid> {
-    let JsonValue::Object(uid) = raw else {
-        return None;
-    };
-
-    let id = uid
-        .get("id")
-        .and_then(JsonValue::as_str)
-        .filter(|id| !id.trim().is_empty())
-        .filter(|id| id.len() <= MAX_UID_LENGTH)?
-        .to_owned();
-
-    let atype = uid
-        .get("atype")
-        .and_then(JsonValue::as_u64)
-        .and_then(|atype| i32::try_from(atype).ok());
-
-    let ext = match uid.get("ext") {
-        Some(JsonValue::Object(_)) => uid.get("ext").cloned(),
-        _ => None,
-    };
-
-    Some(Uid { id, atype, ext })
-}
-
+/// Merges the request's browser EIDs with the server set (spec 7.1).
+///
+/// The browser's candidates first pass the provider `denials`. Those left
+/// are forwarded as parsed, in wire order, never altered beyond a denied
+/// UID: they are what Prebid sent the `trustedServer` adapter, and a source
+/// may repeat with different EID-level fields. A server source's whole entry
+/// set is appended after them, and the two are never mixed:
+///
+/// - For a source whose owner wrote a valid value, the owner's set replaces
+///   every browser entry of the source, however often the browser repeated
+///   it.
+/// - For any other source, the server's set goes out only when no browser
+///   entry carries the source, so the browser's current value wins over a
+///   browser-seeded record and over any unowned record.
+///
+/// Sources are compared as the partner registry normalizes them (lowercase,
+/// trailing dot removed). Entries without UIDs are dropped.
 pub(crate) fn merge_auction_eids(
-    client_eids: Option<Vec<Eid>>,
-    resolved_eids: Option<Vec<Eid>>,
-) -> Option<Vec<Eid>> {
-    let mut merged = Vec::new();
-
-    for eid in resolved_eids
+    client_eids: &[Eid],
+    server: &ServerSet,
+    denials: &Denials,
+) -> Vec<Eid> {
+    let owned_sources: HashSet<String> = server
+        .sources()
+        .iter()
+        .filter(|source| source.owned && source.eids.iter().any(|eid| !eid.uids.is_empty()))
+        .filter_map(|source| normalize_partner_source_domain(&source.source_domain).ok())
+        .collect();
+    let is_owned = |eid: &Eid| {
+        normalize_partner_source_domain(&eid.source)
+            .is_ok_and(|source| owned_sources.contains(&source))
+    };
+    let mut merged: Vec<Eid> = filter_browser_candidates(client_eids, denials)
         .into_iter()
-        .flatten()
-        .chain(client_eids.into_iter().flatten())
-    {
-        if eid.source.is_empty() {
-            continue;
-        }
-
-        let source_index = match merged
-            .iter()
-            .position(|existing: &Eid| existing.source == eid.source)
-        {
-            Some(index) => index,
-            None => {
-                merged.push(Eid {
-                    source: eid.source.clone(),
-                    uids: Vec::new(),
-                });
-                merged.len() - 1
-            }
-        };
-
-        for uid in eid.uids {
-            if uid.id.trim().is_empty() || uid.id.len() > MAX_UID_LENGTH {
+        .filter(|eid| !eid.uids.is_empty() && !is_owned(eid))
+        .collect();
+    let browser_sources: HashSet<String> = merged
+        .iter()
+        .filter_map(|eid| normalize_partner_source_domain(&eid.source).ok())
+        .collect();
+
+    for source in server.sources() {
+        for eid in &source.eids {
+            if eid.uids.is_empty() {
                 continue;
             }
-
-            if let Some(existing_uid) = merged[source_index]
-                .uids
-                .iter_mut()
-                .find(|existing| existing.id == uid.id)
-            {
-                if existing_uid.atype.is_none() {
-                    existing_uid.atype = uid.atype;
-                }
-                if existing_uid.ext.is_none() {
-                    existing_uid.ext = uid.ext;
-                }
-            } else {
-                merged[source_index].uids.push(uid);
+            let carried_by_browser = normalize_partner_source_domain(&eid.source)
+                .is_ok_and(|source| browser_sources.contains(&source));
+            if source.owned || !carried_by_browser {
+                merged.push(eid.clone());
             }
         }
     }
-
-    merged.retain(|eid| !eid.uids.is_empty());
-
-    if merged.is_empty() {
-        None
-    } else {
-        Some(merged)
-    }
+    merged
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::auction::config::AuctionConfig;
+    use crate::auction::provider::test_support::LaunchEvidenceProvider as Mediator;
     use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
     use crate::auction::telemetry::{AuctionEventBatch, AuctionTelemetrySink};
     use crate::auction::types::{AuctionRequest, AuctionResponse};
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::ConsentContext;
+    use crate::ec::identity::revision::uid_hash;
+    use crate::ec::identity::test_support::{
+        ec_partner, example_entry_set, full_record, pid, provider_from, source,
+    };
+    use crate::ec::kv_types::{
+        KvEid, KvEntry, KvPartnerId, KvProviderState, KvUid, MAX_UID_LENGTH,
+    };
     use crate::error::IntoHttpResponse as _;
     use crate::integrations::adserver_mock::{AdServerMockConfig, AdServerMockProvider};
     use crate::openrtb::Uid;
@@ -707,13 +893,18 @@ mod tests {
         NoopBackend, NoopConfigStore, NoopGeo, NoopHttpClient, NoopSecretStore, StubBackend,
         StubHttpClient, noop_services,
     };
-    use crate::platform::{ClientInfo, PlatformHttpClient, PlatformHttpRequest, PlatformResponse};
+    use crate::platform::{
+        ClientInfo, PlatformBackend, PlatformHttpClient, PlatformHttpRequest, PlatformResponse,
+    };
+    use crate::request_timing::AuctionWaitPlacement;
     use crate::test_support::tests::{crate_test_settings_str, create_test_settings};
     use crate::trace::TracePreDispatchHook;
     use base64::Engine as _;
     use base64::engine::general_purpose::STANDARD as BASE64;
     use edgezero_core::router::PreDispatchHook as _;
+    use serde_json::Value as JsonValue;
     use serde_json::json;
+    use std::collections::BTreeMap;
     use std::sync::{Arc, Mutex};
 
     #[derive(Default)]
@@ -737,13 +928,21 @@ mod tests {
     }
 
     fn services_with_telemetry(sink: Arc<RecordingTelemetrySink>) -> RuntimeServices {
+        services_with_http_and_telemetry(Arc::new(NoopHttpClient), Arc::new(NoopBackend), sink)
+    }
+
+    fn services_with_http_and_telemetry(
+        http: Arc<dyn PlatformHttpClient>,
+        backend: Arc<dyn PlatformBackend>,
+        sink: Arc<RecordingTelemetrySink>,
+    ) -> RuntimeServices {
         let telemetry_sink: Arc<dyn AuctionTelemetrySink> = sink;
         RuntimeServices::builder()
             .config_store(Arc::new(NoopConfigStore))
             .secret_store(Arc::new(NoopSecretStore))
             .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
-            .backend(Arc::new(NoopBackend))
-            .http_client(Arc::new(NoopHttpClient))
+            .backend(backend)
+            .http_client(http)
             .geo(Arc::new(NoopGeo))
             .auction_telemetry_sink(telemetry_sink)
             .client_info(ClientInfo::default())
@@ -773,8 +972,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: crate::settings::EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: crate::settings::EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -865,25 +1065,62 @@ mod tests {
             1,
             "finalization must reuse the endpoint snapshot instead of reading again"
         );
+        assert!(
+            stored_ids(&graph, &ec_id).is_empty(),
+            "/auction is a stager and must not write the sharedId"
+        );
+        assert!(
+            ec_context.identity().mutation().is_empty(),
+            "/auction is a stager and must not queue the sharedId"
+        );
+    }
+
+    const COOKIE_ONLY_SOURCE: &str = "cookie-only.example.com";
+
+    fn ingestion_registry(extra_source: &str) -> PartnerRegistry {
+        PartnerRegistry::from_config(&[
+            counting_test_partner(COOKIE_ONLY_SOURCE),
+            counting_test_partner(extra_source),
+        ])
+        .expect("should build partner registry")
+    }
+
+    fn cookie_only_ts_eids() -> String {
+        BASE64.encode(
+            serde_json::to_vec(&json!([
+                { "source": COOKIE_ONLY_SOURCE, "uids": [{ "id": "cookie-uid" }] }
+            ]))
+            .expect("should serialize cookie"),
+        )
+    }
+
+    fn seeded_graph(ec_id: &str) -> KvIdentityGraph {
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let mut live = crate::ec::kv_types::KvEntry::tombstone(1000);
+        live.consent.ok = true;
+        graph.create(ec_id, &live).expect("should seed live row");
+        graph
+    }
+
+    fn stored_ids(graph: &KvIdentityGraph, ec_id: &str) -> Vec<(String, String)> {
         let (stored, _) = graph
-            .get(&ec_id)
+            .get(ec_id)
             .expect("should read store")
             .expect("row should exist");
-        assert_eq!(
-            stored.ids.get("sharedid.org").map(|id| id.uid.as_str()),
-            Some("shared-cookie-id"),
-            "the sharedId update must still be ingested from the shared snapshot"
-        );
+        stored
+            .ids
+            .iter()
+            .map(|(source, id)| {
+                (
+                    source.clone(),
+                    id.first_uid().unwrap_or_default().to_owned(),
+                )
+            })
+            .collect()
     }
 
     #[tokio::test]
-    async fn auction_body_eids_reach_kv_even_when_the_ts_eids_cookie_is_absent() {
-        // Regression test for #1184: `/auction` sends every EID it has in the
-        // request body, but response finalization used to ingest identity
-        // graph updates only from the `ts-eids` cookie — which the browser
-        // caps in size and may not have sent at all. `handle_auction` must
-        // hand its parsed body EIDs to `ec_context` so finalization ingests
-        // them regardless of what the cookie carried.
+    async fn auction_ingests_nothing_from_its_body_or_the_cookie() {
         let settings = create_test_settings();
         let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
             enabled: true,
@@ -895,38 +1132,25 @@ mod tests {
         orchestrator.register_provider(Arc::new(EidCapturingProvider {
             had_eids: Arc::new(std::sync::Mutex::new(None)),
         }));
-        let registry = PartnerRegistry::from_config(&[counting_test_partner("id5-sync.com")])
-            .expect("should build partner registry");
-
-        let graph = KvIdentityGraph::in_memory("test_store");
-        let ec_id = format!("{}.eidbdy", "a".repeat(64));
-        let mut live = crate::ec::kv_types::KvEntry::tombstone(1000);
-        live.consent.ok = true;
-        graph.create(&ec_id, &live).expect("should seed live row");
-
+        let registry = ingestion_registry("body.example.com");
+        let ec_id = format!("{}.ingbdy", "a".repeat(64));
+        let graph = seeded_graph(&ec_id);
         let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
         ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Auction);
+        let cookie = cookie_only_ts_eids();
         let req = Request::builder()
             .method("POST")
             .uri("https://test-publisher.com/auction")
+            .header(header::COOKIE, format!("{COOKIE_TS_EIDS}={cookie}"))
             .body(EdgeBody::from(
                 serde_json::to_vec(&json!({
-                    "adUnits": [
-                        {
-                            "code": "div-gpt-ad-1",
-                            "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
-                        }
-                    ],
-                    "eids": [
-                        {"source": "id5-sync.com", "uids": [{"id": "ID5_from_body", "atype": 1}]}
-                    ]
+                    "adUnits": [{ "code": "div-gpt-ad-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+                    "eids": [{ "source": "body.example.com", "uids": [{ "id": "body-uid" }] }]
                 }))
                 .expect("should serialize body"),
             ))
             .expect("should build auction request");
 
-        // The capturing provider deliberately fails its launch; identity
-        // resolution — the subject of this test — completes before dispatch.
         let _ = handle_auction(
             &settings,
             &orchestrator,
@@ -937,55 +1161,224 @@ mod tests {
             req,
         )
         .await;
+        let mut response = http::Response::new(EdgeBody::empty());
+        crate::ec::finalize::ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            Some(&cookie),
+            None,
+            &mut response,
+        );
 
-        assert_eq!(
-            ec_context.client_eids().map(|eids| eids
-                .iter()
-                .map(|eid| eid.source.as_str())
-                .collect::<Vec<_>>()),
-            Some(vec!["id5-sync.com"]),
-            "the endpoint must hand its parsed body EIDs to the request context"
+        assert!(
+            stored_ids(&graph, &ec_id).is_empty(),
+            "KV should learn nothing from an /auction"
         );
+        assert!(
+            ec_context.identity().mutation().is_empty(),
+            "/auction should queue nothing"
+        );
+    }
+
+    #[tokio::test]
+    async fn disabled_auction_ingests_nothing() {
+        let settings = create_test_settings();
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: false,
+            ..Default::default()
+        });
+        let registry = ingestion_registry("sharedid.org");
+        let ec_id = format!("{}.ingdis", "a".repeat(64));
+        let graph = seeded_graph(&ec_id);
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Auction);
+        let cookie = cookie_only_ts_eids();
+        let req = Request::builder()
+            .method("POST")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+            .header(header::COOKIE, format!("{COOKIE_TS_EIDS}={cookie}"))
+            .body(EdgeBody::from(ad_units_only_body()))
+            .expect("should build auction request");
 
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
         let mut response = http::Response::new(EdgeBody::empty());
         crate::ec::finalize::ec_finalize_response(
             &settings,
             &mut ec_context,
             Some(&graph),
             &registry,
-            None, // No `ts-eids` cookie on this request at all.
-            None,
+            Some(&cookie),
+            Some("shared-cookie-id"),
             &mut response,
         );
 
-        let (stored, _) = graph
-            .get(&ec_id)
-            .expect("should read store")
-            .expect("row should exist");
-        assert_eq!(
-            stored.ids.get("id5-sync.com").map(|id| id.uid.as_str()),
-            Some("ID5_from_body"),
-            "the body's EID must be ingested into KV without a ts-eids cookie"
+        assert!(
+            stored_ids(&graph, &ec_id).is_empty(),
+            "a disabled /auction should ingest nothing"
+        );
+        assert!(
+            ec_context.identity().mutation().is_empty(),
+            "a disabled /auction should queue nothing"
         );
     }
 
-    /// Provider that fails the test if it is ever contacted. Used to prove the
-    /// `/auction` consent gate short-circuits before any outbound bid request.
-    struct PanicOnBidProvider;
+    #[test]
+    fn writer_navigation_queues_the_cookie_only_source() {
+        // Control for the two tests above: the registry does match the
+        // cookie-only source when the writer navigation reads the cookie.
+        let settings = create_test_settings();
+        let registry = ingestion_registry("body.example.com");
+        let ec_id = format!("{}.ingnav", "a".repeat(64));
+        let graph = seeded_graph(&ec_id);
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Navigation);
+        ec_context.identity_mut().set_writer_decision(
+            crate::ec::identity::request::WriterDecision {
+                writer: true,
+                is_real_browser: true,
+                user_agent: None,
+                dnt: false,
+                page_url: None,
+            },
+        );
+        let cookie = cookie_only_ts_eids();
+        let mut response = http::Response::new(EdgeBody::empty());
 
-    #[async_trait::async_trait(?Send)]
-    impl AuctionProvider for PanicOnBidProvider {
-        fn provider_name(&self) -> &str {
-            "panic_provider"
-        }
+        crate::ec::finalize::ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            Some(&cookie),
+            None,
+            &mut response,
+        );
 
-        async fn request_bids(
-            &self,
-            _request: &AuctionRequest,
-            _context: &AuctionContext<'_>,
-        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
-            panic!("provider must not be contacted when the consent gate denies the auction");
-        }
+        assert!(
+            stored_ids(&graph, &ec_id).is_empty(),
+            "a navigation should leave the write to phase 4"
+        );
+        let queued = ec_context.identity().mutation().positive_changes();
+        assert!(
+            matches!(
+                queued,
+                [crate::ec::identity::mutation::PartnerIdChange::FillMissing { source, record }]
+                    if source.as_str() == COOKIE_ONLY_SOURCE
+                        && record.first_uid() == Some("cookie-uid")
+            ),
+            "a navigation should queue the cookie's registered source"
+        );
+    }
+
+    #[tokio::test]
+    async fn auction_body_eids_never_reach_kv() {
+        // The `/auction` body reaches bidders but is not an ingest input
+        // (spec G10): finalization neither writes nor queues it.
+        let settings = create_test_settings();
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::new(std::sync::Mutex::new(None)),
+        }));
+        let registry = PartnerRegistry::from_config(&[counting_test_partner("id5-sync.com")])
+            .expect("should build partner registry");
+
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let ec_id = format!("{}.eidbdy", "a".repeat(64));
+        let mut live = crate::ec::kv_types::KvEntry::tombstone(1000);
+        live.consent.ok = true;
+        graph.create(&ec_id, &live).expect("should seed live row");
+
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Auction);
+        let req = Request::builder()
+            .method("POST")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+            .body(EdgeBody::from(
+                serde_json::to_vec(&json!({
+                    "adUnits": [
+                        {
+                            "code": "div-gpt-ad-1",
+                            "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+                        }
+                    ],
+                    "eids": [
+                        {"source": "id5-sync.com", "uids": [{"id": "ID5_from_body", "atype": 1}]}
+                    ]
+                }))
+                .expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        // The capturing provider deliberately fails its launch; identity
+        // resolution — the subject of this test — completes before dispatch.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        let mut response = http::Response::new(EdgeBody::empty());
+        crate::ec::finalize::ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            None, // No `ts-eids` cookie on this request at all.
+            None,
+            &mut response,
+        );
+
+        assert!(
+            stored_ids(&graph, &ec_id).is_empty(),
+            "the body's EID must not be ingested into KV"
+        );
+        assert!(
+            ec_context.identity().mutation().is_empty(),
+            "the body's EID must not be queued"
+        );
+    }
+
+    /// Provider that fails the test if it is ever contacted. Used to prove the
+    /// `/auction` consent gate short-circuits before any outbound bid request.
+    struct PanicOnBidProvider;
+
+    #[async_trait::async_trait(?Send)]
+    impl AuctionProvider for PanicOnBidProvider {
+        fn provider_name(&self) -> &str {
+            "panic_provider"
+        }
+
+        async fn request_bids(
+            &self,
+            _request: &AuctionRequest,
+            _context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            panic!("provider must not be contacted when the consent gate denies the auction");
+        }
 
         async fn parse_response(
             &self,
@@ -1143,13 +1536,15 @@ mod tests {
                 "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
             }]
         });
-        let request = Request::builder()
+        let mut request = Request::builder()
             .method("POST")
             .uri("https://test-publisher.example/auction")
             .body(EdgeBody::from(
                 serde_json::to_vec(&body).expect("should serialize disabled-auction body"),
             ))
             .expect("should build disabled-auction request");
+        let timings = RequestTimings::new();
+        request.extensions_mut().insert(timings.handle().clone());
 
         let response = handle_auction(
             &settings,
@@ -1168,6 +1563,10 @@ mod tests {
             StatusCode::OK,
             "disabled auction should return a 200 no-bid response"
         );
+        assert!(
+            timings.snapshot().auction_id.is_none(),
+            "should keep the disabled /auction access join key null"
+        );
         let batches = telemetry_sink
             .batches
             .lock()
@@ -1184,6 +1583,262 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn planned_endpoint_preserves_installed_collector_across_terminal_states() {
+        for (provider_configured, transport_failure, metadata_missing) in [
+            (true, false, false),
+            (true, true, false),
+            (false, false, false),
+            (true, false, true),
+        ] {
+            let provider = if provider_configured {
+                "[auction.providers.example]\nprotocol = \"openrtb-2.6\"\nprofile = \"standard\"\nendpoint = \"https://bidder.example.com/auction\"\nrouting = \"all_eligible\"\n"
+            } else {
+                ""
+            };
+            let settings = Settings::from_toml(&format!(
+                "{}\n[auction]\nenabled = true\n{provider}",
+                crate_test_settings_str()
+            ))
+            .expect("should parse planned endpoint settings");
+            let plan = Arc::new(
+                crate::auction::compile_auction_plan(&settings)
+                    .expect("should compile endpoint plan"),
+            );
+            let orchestrator = AuctionOrchestrator::from_plan(plan, None);
+            let http = Arc::new(StubHttpClient::new());
+            http.push_response(204, Vec::new());
+            if transport_failure {
+                http.push_select_error();
+            }
+            if metadata_missing {
+                http.push_pending_backend_name_override(None);
+            }
+            let sink = Arc::new(RecordingTelemetrySink::default());
+            let services =
+                services_with_http_and_telemetry(http.clone(), Arc::new(StubBackend), sink.clone());
+            let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+            let body = json!({ "adUnits": [{
+                "code": "example-slot",
+                "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+            }] });
+            let mut request = Request::builder()
+                .method("POST")
+                .uri("https://publisher.example.com/auction")
+                .body(EdgeBody::from(
+                    serde_json::to_vec(&body).expect("should serialize endpoint request"),
+                ))
+                .expect("should build endpoint request");
+            let timings = RequestTimings::new();
+            timings.record(
+                crate::request_timing::Phase::Filter,
+                std::time::Duration::from_millis(11),
+            );
+            request.extensions_mut().insert(timings.handle().clone());
+
+            let response = handle_auction(
+                &settings,
+                &orchestrator,
+                None,
+                None,
+                &mut ec_context,
+                &services,
+                request,
+            )
+            .await;
+
+            if metadata_missing {
+                assert_eq!(
+                    response
+                        .expect_err("should fail closed after losing pending metadata")
+                        .current_context()
+                        .status_code(),
+                    StatusCode::BAD_GATEWAY
+                );
+            } else {
+                assert_eq!(
+                    response
+                        .expect("should return a completed or no-bid response")
+                        .status(),
+                    StatusCode::OK,
+                    "should preserve the no-bid HTTP contract"
+                );
+            }
+            let snapshot = timings.snapshot();
+            let auction_id = snapshot
+                .auction_id
+                .expect("should record the attempted auction UUID");
+            let batches = sink.batches.lock().expect("should lock telemetry batches");
+            assert!(
+                batches[0]
+                    .rows()
+                    .iter()
+                    .all(|row| row.auction_id == auction_id.to_string()),
+                "should join the original collector to every emitted auction row"
+            );
+            assert_eq!(
+                snapshot.filter_ms,
+                Some(11),
+                "should retain adapter-recorded phases"
+            );
+            assert_eq!(
+                http.recorded_backend_names().len(),
+                usize::from(provider_configured),
+                "should distinguish a real request launch from the empty plan"
+            );
+            assert_eq!(
+                snapshot.auction_wait_ms.is_some(),
+                provider_configured && !metadata_missing
+            );
+            assert_eq!(
+                snapshot.auction_wait_placement,
+                (provider_configured && !metadata_missing)
+                    .then_some(crate::request_timing::AuctionWaitPlacement::PreHeader)
+            );
+            if metadata_missing {
+                assert!(
+                    snapshot.auction_dispatched_ms.is_some(),
+                    "should retain evidence of the request already launched"
+                );
+                assert!(
+                    snapshot.auction_resolved_ms.is_none(),
+                    "should not fabricate collection after dispatch failure"
+                );
+                assert!(
+                    snapshot.auction_committed_ms.is_none(),
+                    "should not commit a failed dispatch"
+                );
+            } else if provider_configured {
+                let dispatched = snapshot
+                    .auction_dispatched_ms
+                    .expect("should mark a real launch");
+                let resolved = snapshot
+                    .auction_resolved_ms
+                    .expect("should mark collection even after transport failure");
+                let committed = snapshot
+                    .auction_committed_ms
+                    .expect("should commit the no-bid response");
+                assert!(
+                    dispatched <= resolved && resolved <= committed,
+                    "should preserve milestone ordering"
+                );
+            } else {
+                assert!(
+                    snapshot.auction_dispatched_ms.is_none(),
+                    "should omit zero-launch dispatch"
+                );
+                assert!(
+                    snapshot.auction_resolved_ms.is_none(),
+                    "should omit zero-launch resolution"
+                );
+                assert!(
+                    snapshot.auction_committed_ms.is_none(),
+                    "should omit zero-launch commit"
+                );
+            }
+            timings.mark_headers_ready();
+            timings.mark_request_elapsed();
+            assert!(
+                timings
+                    .handle()
+                    .snapshot(
+                        |inner| inner.headers_ready.is_some() && inner.request_complete.is_some()
+                    )
+                    .expect("should snapshot original handle"),
+                "should retain the same collector through response commitment"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn endpoint_mediator_collection_requires_launch_evidence_and_preserves_not_started() {
+        for configured_provider in [false, true] {
+            for (mediator, wait_failure) in [
+                (Mediator::Immediate, false),
+                (Mediator::FailBeforeStart, false),
+                (Mediator::FailAfterStart, false),
+                (Mediator::Pending, false),
+                (Mediator::Pending, true),
+            ] {
+                // Explicit routing without bidders produces the existing routing-only
+                // Dispatched path. An empty provider set must remain NotStarted.
+                let provider = if configured_provider {
+                    "[auction.providers.example]\nprotocol = \"openrtb-2.6\"\nprofile = \"standard\"\nendpoint = \"https://bidder.example.com/auction\"\nrouting = \"explicit\"\n"
+                } else {
+                    ""
+                };
+                let settings = Settings::from_toml(&format!(
+                    "{}\n[auction]\nenabled = true\nmediator = \"adserver_mock\"\n{provider}",
+                    crate_test_settings_str()
+                ))
+                .expect("should parse mediator endpoint settings");
+                let orchestrator = AuctionOrchestrator::from_plan(
+                    Arc::new(
+                        crate::auction::compile_auction_plan(&settings)
+                            .expect("should compile mediator plan"),
+                    ),
+                    Some(Arc::new(mediator)),
+                );
+                let http = Arc::new(StubHttpClient::new());
+                http.push_response(204, Vec::new());
+                if wait_failure {
+                    http.push_wait_error();
+                }
+                let sink = Arc::new(RecordingTelemetrySink::default());
+                let services =
+                    services_with_http_and_telemetry(http.clone(), Arc::new(StubBackend), sink);
+                let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+                let mut request = Request::builder()
+                    .method("POST")
+                    .uri("https://publisher.example.com/auction")
+                    .body(EdgeBody::from(
+                        serde_json::to_vec(&json!({"adUnits": [{
+                            "code": "slot", "mediaTypes": {"banner": {"sizes": [[300, 250]]}}
+                        }]}))
+                        .expect("should serialize mediator endpoint request"),
+                    ))
+                    .expect("should construct mediator endpoint request");
+                let timings = RequestTimings::new();
+                request.extensions_mut().insert(timings.handle().clone());
+                let response = handle_auction(
+                    &settings,
+                    &orchestrator,
+                    None,
+                    None,
+                    &mut ec_context,
+                    &services,
+                    request,
+                )
+                .await
+                .expect("should return no-bid response");
+                assert_eq!(response.status(), StatusCode::OK);
+                let launched = configured_provider
+                    && matches!(mediator, Mediator::Pending | Mediator::FailAfterStart);
+                assert_eq!(
+                    http.recorded_backend_names().len(),
+                    usize::from(launched),
+                    "{configured_provider} {mediator:?}"
+                );
+                let snapshot = timings.snapshot();
+                assert!(
+                    snapshot.auction_dispatched_ms.is_none(),
+                    "mediator collection must not fabricate provider dispatch"
+                );
+                assert_eq!(
+                    snapshot.auction_wait_ms.is_some(),
+                    launched,
+                    "{configured_provider} {mediator:?}"
+                );
+                assert_eq!(
+                    snapshot.auction_wait_placement,
+                    launched.then_some(AuctionWaitPlacement::PreHeader)
+                );
+                assert_eq!(snapshot.auction_resolved_ms.is_some(), launched);
+                assert_eq!(snapshot.auction_committed_ms.is_some(), launched);
+            }
+        }
+    }
+
     #[tokio::test]
     async fn trace_slot_conversion_api_keeps_refs_out_of_actual_bidder_and_mediator_payloads() {
         const SLOT_REF: &str = "ts-slot-00000000-0000-4000-8000-000000000001";
@@ -1539,13 +2194,15 @@ mod tests {
                 "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
             }]
         });
-        let request = Request::builder()
+        let mut request = Request::builder()
             .method("POST")
             .uri("https://test-publisher.example/auction")
             .body(EdgeBody::from(
                 serde_json::to_vec(&body).expect("should serialize launch-failure body"),
             ))
             .expect("should build launch-failure request");
+        let timings = RequestTimings::new();
+        request.extensions_mut().insert(timings.handle().clone());
 
         let error = handle_auction(
             &settings,
@@ -1569,10 +2226,25 @@ mod tests {
             .expect("should lock telemetry batches");
         assert_eq!(batches.len(), 1, "should emit one telemetry batch");
         let rows = batches[0].rows();
-        assert_eq!(rows.len(), 1, "should emit one execution-failure summary");
-        assert_eq!(rows[0].event_kind, "summary");
-        assert_eq!(rows[0].terminal_status.as_deref(), Some("execution_failed"));
-        assert_eq!(rows[0].terminal_reason.as_deref(), Some("execution_failed"));
+        assert_eq!(
+            rows.len(),
+            2,
+            "should emit provider failure and summary rows"
+        );
+        let summary = rows
+            .iter()
+            .find(|row| row.event_kind == "summary")
+            .expect("should emit an execution-failure summary");
+        assert_eq!(summary.terminal_status.as_deref(), Some("execution_failed"));
+        assert_eq!(summary.terminal_reason.as_deref(), Some("execution_failed"));
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            Some(summary.auction_id.clone()),
+            snapshot.auction_id.map(|id| id.to_string())
+        );
+        assert!(snapshot.auction_dispatched_ms.is_none());
+        assert!(snapshot.auction_resolved_ms.is_none());
+        assert!(snapshot.auction_committed_ms.is_none());
     }
 
     #[tokio::test]
@@ -1604,13 +2276,15 @@ mod tests {
                 }
             ]
         });
-        let req = Request::builder()
+        let mut req = Request::builder()
             .method("POST")
             .uri("https://test-publisher.com/auction")
             .body(EdgeBody::from(
                 serde_json::to_vec(&body).expect("should serialize body"),
             ))
             .expect("should build auction request");
+        let timings = RequestTimings::new();
+        req.extensions_mut().insert(timings.handle().clone());
 
         let response = handle_auction(
             &settings,
@@ -1651,6 +2325,18 @@ mod tests {
         assert_eq!(rows[0].event_kind, "summary");
         assert_eq!(rows[0].terminal_status.as_deref(), Some("skipped"));
         assert_eq!(rows[0].terminal_reason.as_deref(), Some("consent_denied"));
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            rows[0].auction_id,
+            snapshot
+                .auction_id
+                .expect("should record the consent-denied auction UUID")
+                .to_string(),
+            "should retain the skipped-summary join key"
+        );
+        assert!(snapshot.auction_dispatched_ms.is_none());
+        assert!(snapshot.auction_resolved_ms.is_none());
+        assert!(snapshot.auction_committed_ms.is_none());
         let ndjson = batches[0]
             .to_ndjson(16 * 1024)
             .expect("should serialize telemetry");
@@ -1701,42 +2387,234 @@ mod tests {
         }
     }
 
-    #[tokio::test]
-    async fn auction_strips_client_eids_when_ec_identity_denied() {
-        // US-state opt-out via GPC: the server-side auction consent gate still
-        // allows a non-personalized auction, but EC identity use is denied
-        // (`ec_allowed()` is false) and `gate_eids_by_consent` does not strip
-        // because no TCF signal is present and GDPR does not apply. Client EIDs
-        // supplied in the request body/cookie must NOT be forwarded — the
-        // outgoing auction request must have `user.eids == None`.
+    const AUCTION_BODY_FIXTURE: &str =
+        include_str!("../../../trusted-server-js/lib/test/fixtures/auction-body-eids.txt");
+    const TS_EIDS_COOKIE_FIXTURE: &str =
+        include_str!("../../../trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt");
+
+    /// Provider that records the full EID set its auction request carried,
+    /// then fails its launch so no real transport handle is needed.
+    struct EidRecordingProvider {
+        eids: Arc<Mutex<Option<JsonValue>>>,
+    }
+
+    #[async_trait::async_trait(?Send)]
+    impl AuctionProvider for EidRecordingProvider {
+        fn provider_name(&self) -> &str {
+            "eid_recording_provider"
+        }
+
+        async fn request_bids(
+            &self,
+            request: &AuctionRequest,
+            _context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            *self.eids.lock().expect("should lock recorded eids") = Some(
+                serde_json::to_value(&request.user.eids).expect("should serialize recorded eids"),
+            );
+            Err(Report::new(TrustedServerError::Auction {
+                message: "record only".to_string(),
+            }))
+        }
+
+        async fn parse_response(
+            &self,
+            _response: PlatformResponse,
+            _response_time_ms: u64,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            panic!("parse_response must not run when the launch fails");
+        }
+
+        fn timeout_ms(&self) -> u32 {
+            100
+        }
+
+        fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
+            Some("record-backend".to_string())
+        }
+    }
+
+    /// Runs `/auction` with an allowed EC and returns the EIDs the provider
+    /// received: `None` when no provider was called (the request was
+    /// rejected), `Some(Value::Null)` when it carried no EIDs.
+    async fn recorded_auction_eids(
+        body: Vec<u8>,
+        ts_eids_cookie: Option<&str>,
+    ) -> Option<JsonValue> {
         let settings = create_test_settings();
-        let config = AuctionConfig {
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
             enabled: true,
-            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            providers: AuctionConfig::legacy_provider_map(&["eid_recording_provider"]),
             timeout_ms: 2000,
             mediator: None,
             ..Default::default()
-        };
-        let mut orchestrator = AuctionOrchestrator::new(config);
-        let had_eids = Arc::new(std::sync::Mutex::new(None));
-        orchestrator.register_provider(Arc::new(EidCapturingProvider {
-            had_eids: Arc::clone(&had_eids),
+        });
+        let recorded = Arc::new(Mutex::new(None));
+        orchestrator.register_provider(Arc::new(EidRecordingProvider {
+            eids: Arc::clone(&recorded),
         }));
-        let services = noop_services();
+        let ec_id = format!("{}.fixtur", "a".repeat(64));
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let mut builder = Request::builder()
+            .method("POST")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/auction"); // allow-domain: test-publisher.com
+        if let Some(cookie) = ts_eids_cookie {
+            builder = builder.header(header::COOKIE, format!("{COOKIE_TS_EIDS}={cookie}"));
+        }
+        let req = builder
+            .body(EdgeBody::from(body))
+            .expect("should build auction request");
 
-        // US-state jurisdiction with an explicit GPC opt-out: auction allowed,
-        // EC identity denied.
-        let mut ec_context = EcContext::new_for_test(
+        // The recording provider fails its launch; the assertion is on what
+        // it received, not on the auction result.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
             None,
-            ConsentContext {
-                jurisdiction: Jurisdiction::UsState("CA".to_owned()),
-                gpc: true,
-                ..ConsentContext::default()
-            },
-        );
-
-        // Persistent EIDs supplied in both the request body and the ts-eids cookie.
-        let cookie_payload = json!([
+            None,
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        recorded.lock().expect("should lock recorded eids").clone()
+    }
+
+    /// The two parsable entries of the fixture input, as providers receive
+    /// them. The cookie copy has no EID-level `ext` on the last entry.
+    fn fixture_good_entries(with_eid_ext: bool) -> JsonValue {
+        let mut last = json!({
+            "source": "last.example.com",
+            "uids": [{ "id": "last-uid", "atype": 3 }]
+        });
+        if with_eid_ext {
+            last["ext"] = json!({ "segments": ["s1"] });
+        }
+        json!([
+            {
+                "source": "first.example.com",
+                "inserter": "inserter-€.example.com",
+                "matcher": "first.example.com",
+                "mm": 3,
+                "uids": [{ "id": "first-uid", "atype": 1, "ext": { "label": "日本" } }]
+            },
+            last
+        ])
+    }
+
+    #[tokio::test]
+    async fn tsjs_auction_body_fixture_drops_only_the_unparsable_entry() {
+        let recorded =
+            recorded_auction_eids(AUCTION_BODY_FIXTURE.trim_end().as_bytes().to_vec(), None).await;
+
+        assert_eq!(
+            recorded,
+            Some(fixture_good_entries(true)),
+            "the request should be accepted and carry the two good entries unchanged"
+        );
+    }
+
+    #[tokio::test]
+    async fn tsjs_cookie_fixture_drops_only_the_unparsable_entry() {
+        let recorded = recorded_auction_eids(
+            ad_units_only_body(),
+            Some(TS_EIDS_COOKIE_FIXTURE.trim_end()),
+        )
+        .await;
+
+        assert_eq!(
+            recorded,
+            Some(fixture_good_entries(false)),
+            "the cookie's good entries should reach the provider without the bad one"
+        );
+    }
+
+    #[tokio::test]
+    async fn auction_body_eid_level_fields_reach_the_auction_request() {
+        let eids = json!([{
+            "source": "adserver.org",
+            "inserter": "adserver.org",
+            "matcher": "adserver.org",
+            "mm": 4,
+            "uids": [{ "id": "fictional-tdid", "atype": 1, "ext": { "rtiPartner": "TDID" } }]
+        }]);
+        let body = serde_json::to_vec(&json!({
+            "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+            "eids": eids
+        }))
+        .expect("should serialize body");
+
+        assert_eq!(
+            recorded_auction_eids(body, None).await,
+            Some(eids),
+            "EID-level fields from the body should reach the provider unchanged"
+        );
+    }
+
+    fn ad_units_only_body() -> Vec<u8> {
+        serde_json::to_vec(&json!({
+            "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }]
+        }))
+        .expect("should serialize body")
+    }
+
+    #[tokio::test]
+    async fn auction_uses_the_cookie_when_no_body_entry_is_valid() {
+        let cookie_entries =
+            json!([{ "source": "cookie.example.com", "uids": [{ "id": "cookie-uid" }] }]);
+        let cookie =
+            BASE64.encode(serde_json::to_vec(&cookie_entries).expect("should serialize cookie"));
+        let body = serde_json::to_vec(&json!({
+            "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+            "eids": [{ "source": "", "uids": [{ "id": "body-uid" }] }]
+        }))
+        .expect("should serialize body");
+
+        assert_eq!(
+            recorded_auction_eids(body, Some(&cookie)).await,
+            Some(cookie_entries),
+            "a body whose entries are all invalid should count as absent"
+        );
+    }
+
+    #[tokio::test]
+    async fn auction_strips_client_eids_when_ec_identity_denied() {
+        // US-state opt-out via GPC: the server-side auction consent gate still
+        // allows a non-personalized auction, but EC identity use is denied
+        // (`ec_allowed()` is false) and `gate_eids_by_consent` does not strip
+        // because no TCF signal is present and GDPR does not apply. Client EIDs
+        // supplied in the request body/cookie must NOT be forwarded — the
+        // outgoing auction request must have `user.eids == None`.
+        let settings = create_test_settings();
+        let config = AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        };
+        let mut orchestrator = AuctionOrchestrator::new(config);
+        let had_eids = Arc::new(std::sync::Mutex::new(None));
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::clone(&had_eids),
+        }));
+        let services = noop_services();
+
+        // US-state jurisdiction with an explicit GPC opt-out: auction allowed,
+        // EC identity denied.
+        let mut ec_context = EcContext::new_for_test(
+            None,
+            ConsentContext {
+                jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+                gpc: true,
+                ..ConsentContext::default()
+            },
+        );
+
+        // Persistent EIDs supplied in both the request body and the ts-eids cookie.
+        let cookie_payload = json!([
             {
                 "source": "sharedid.org",
                 "uids": [{ "id": "cookie_uid", "atype": 3 }]
@@ -1793,7 +2671,12 @@ mod tests {
         let ec_id = format!("{}.ABC123", "a".repeat(64));
         let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
 
-        let result = resolve_auction_eids(&EcKvSnapshot::NotRead, Some(&registry), &ec_context);
+        let result = resolve_auction_eids(
+            &EcKvSnapshot::NotRead,
+            Some(&registry),
+            &ec_context,
+            PolicySignals::default(),
+        );
         assert!(
             result.is_some_and(|eids| eids.is_empty()),
             "should degrade to empty EIDs without a snapshot"
@@ -1805,7 +2688,12 @@ mod tests {
         let ec_id = format!("{}.ABC123", "a".repeat(64));
         let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
 
-        let result = resolve_auction_eids(&EcKvSnapshot::NotRead, None, &ec_context);
+        let result = resolve_auction_eids(
+            &EcKvSnapshot::NotRead,
+            None,
+            &ec_context,
+            PolicySignals::default(),
+        );
         assert!(
             result.is_none(),
             "should return None when registry is missing"
@@ -1818,7 +2706,12 @@ mod tests {
         let ec_id = format!("{}.ABC123", "a".repeat(64));
         let ec_context = make_ec_context(Jurisdiction::Unknown, Some(&ec_id));
 
-        let result = resolve_auction_eids(&EcKvSnapshot::NotRead, Some(&registry), &ec_context);
+        let result = resolve_auction_eids(
+            &EcKvSnapshot::NotRead,
+            Some(&registry),
+            &ec_context,
+            PolicySignals::default(),
+        );
         assert!(
             result.is_none(),
             "should return None when consent is denied"
@@ -1830,7 +2723,12 @@ mod tests {
         let registry = PartnerRegistry::empty();
         let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
 
-        let result = resolve_auction_eids(&EcKvSnapshot::NotRead, Some(&registry), &ec_context);
+        let result = resolve_auction_eids(
+            &EcKvSnapshot::NotRead,
+            Some(&registry),
+            &ec_context,
+            PolicySignals::default(),
+        );
         assert!(
             result.is_none(),
             "should return None when no EC value is present"
@@ -1846,7 +2744,12 @@ mod tests {
         let snapshot = EcKvSnapshot::Failed {
             ec_id: ec_id.clone(),
         };
-        let result = resolve_auction_eids(&snapshot, Some(&registry), &ec_context);
+        let result = resolve_auction_eids(
+            &snapshot,
+            Some(&registry),
+            &ec_context,
+            PolicySignals::default(),
+        );
         let eids = result.expect("should return Some on KV error (degraded mode)");
         assert!(
             eids.is_empty(),
@@ -1854,6 +2757,131 @@ mod tests {
         );
     }
 
+    #[test]
+    fn generic_pull_record_with_writer_is_served_after_flush() {
+        use crate::ec::identity::IdentityRuntime;
+        use crate::ec::identity::test_support::{ec_partner, record_for_test};
+        use crate::test_support::tests::create_test_settings;
+
+        let mut partner = ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        );
+        partner.api_token = Some(crate::redacted::Redacted::new(
+            "token-ssp-example-com-32-bytes-minimum".to_owned(),
+        ));
+        let registry = PartnerRegistry::from_config(std::slice::from_ref(&partner))
+            .expect("should build registry");
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![partner];
+        let with_provider = std::sync::Arc::new(
+            IdentityRuntime::from_settings(
+                &settings,
+                &crate::integrations::IntegrationRegistry::default(),
+            )
+            .expect("should build the runtime"),
+        );
+        settings.ec.partners = Vec::new();
+        let without_provider = std::sync::Arc::new(
+            IdentityRuntime::from_settings(
+                &settings,
+                &crate::integrations::IntegrationRegistry::default(),
+            )
+            .expect("should build the runtime"),
+        );
+
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let mut entry = crate::ec::kv_types::KvEntry::minimal("other.example.com", "other", 1);
+        entry.ids.insert(
+            "ssp.example.com".to_owned(),
+            record_for_test("pulled-uid", Some("pull-ssp-example-com"), 1),
+        );
+        let snapshot = EcKvSnapshot::Present {
+            ec_id: ec_id.clone(),
+            entry: Box::new(entry),
+            generation: None,
+        };
+        let resolve = |runtime: Option<std::sync::Arc<IdentityRuntime>>| {
+            let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+            if let Some(runtime) = runtime {
+                ec_context.set_identity_runtime(runtime);
+            }
+            resolve_auction_eids(
+                &snapshot,
+                Some(&registry),
+                &ec_context,
+                PolicySignals::default(),
+            )
+            .expect("should resolve EIDs")
+        };
+
+        let served = resolve(Some(with_provider));
+        let dropped = resolve(Some(without_provider));
+        let no_runtime = resolve(None);
+
+        assert!(
+            served.iter().any(|eid| eid.source == "ssp.example.com"),
+            "should send the pulled UID when the runtime's catalog holds its writer"
+        );
+        assert!(
+            dropped.iter().all(|eid| eid.source != "ssp.example.com"),
+            "control: should drop the record when the catalog lacks its writer"
+        );
+        assert!(
+            no_runtime.iter().all(|eid| eid.source != "ssp.example.com"),
+            "control: should drop the record without a runtime"
+        );
+    }
+
+    #[test]
+    fn resolve_auction_eids_without_providers_matches_pre_identity_output() {
+        let partners = vec![
+            counting_test_partner("a.example.com"),
+            counting_test_partner("b.example.com"),
+        ];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let mut entry = crate::ec::kv_types::KvEntry::minimal("a.example.com", "ua", 1);
+        entry.ids.insert(
+            "b.example.com".to_owned(),
+            crate::ec::kv_types::KvPartnerId::new("ub"),
+        );
+        let snapshot = EcKvSnapshot::Present {
+            ec_id: ec_id.clone(),
+            entry: Box::new(entry),
+            generation: None,
+        };
+
+        let eids = resolve_auction_eids(
+            &snapshot,
+            Some(&registry),
+            &ec_context,
+            PolicySignals::default(),
+        )
+        .expect("should resolve EIDs");
+
+        let atype = crate::settings::EcPartner::default_openrtb_atype();
+        let expected: Vec<Eid> = [("a.example.com", "ua"), ("b.example.com", "ub")]
+            .into_iter()
+            .map(|(source, uid)| {
+                Eid::new(
+                    source.to_owned(),
+                    vec![crate::openrtb::Uid {
+                        id: uid.to_owned(),
+                        atype: Some(atype),
+                        ext: None,
+                    }],
+                )
+            })
+            .collect();
+        assert_eq!(
+            eids, expected,
+            "should send exactly the EIDs sent before identity providers existed"
+        );
+    }
+
     #[test]
     fn resolve_client_auction_eids_falls_back_to_ts_eids_cookie() {
         let cookie_payload = json!([
@@ -1888,12 +2916,13 @@ mod tests {
 
     #[test]
     fn resolve_client_auction_eids_prefers_request_body_over_cookie() {
-        let raw = json!([
+        let raw = serde_json::value::to_raw_value(&json!([
             {
                 "source": "id5-sync.com",
                 "uids": [{ "id": "body_uid", "atype": 1 }]
             }
-        ]);
+        ]))
+        .expect("should capture raw EIDs");
         let cookie_payload = json!([
             {
                 "source": "sharedid.org",
@@ -1903,258 +2932,1059 @@ mod tests {
         let encoded = BASE64
             .encode(serde_json::to_vec(&cookie_payload).expect("should serialize cookie payload"));
 
-        let resolved = resolve_client_auction_eids(Some(&raw), Some(&encoded))
+        let resolved = resolve_client_auction_eids(Some(raw.as_ref()), Some(&encoded))
             .expect("should prefer request body EIDs");
 
-        assert_eq!(resolved.len(), 1, "should use request body when present");
-        assert_eq!(resolved[0].source, "id5-sync.com");
-        assert_eq!(resolved[0].uids[0].id, "body_uid");
+        assert_eq!(
+            serde_json::to_value(&resolved).expect("should serialize resolved EIDs"),
+            json!([{ "source": "id5-sync.com", "uids": [{ "id": "body_uid", "atype": 1 }] }]),
+            "should use the request body when it has valid entries"
+        );
     }
 
-    #[test]
-    fn parse_client_auction_eids_ignores_malformed_entries() {
-        let raw = json!([
-            {
-                "source": "id5-sync.com",
-                "uids": [{ "id": "ID5_abc", "atype": 1 }]
-            },
-            {
-                "source": "broken.example",
-                "uids": "not-an-array"
-            },
-            {
-                "source": "sharedid.org",
-                "uids": [{ "id": "shared_123" }, { "id": "" }]
-            }
-        ]);
+    const SOURCE_S: &str = "ids.example.com";
+    const SOURCE_T: &str = "other.example.com";
 
-        let parsed = parse_client_auction_eids(Some(&raw)).expect("should parse valid EIDs");
+    fn kv_eid(source: &str, id: &str, atype: i32) -> Eid {
+        Eid::new(
+            source.to_owned(),
+            vec![Uid {
+                id: id.to_owned(),
+                atype: Some(atype),
+                ext: None,
+            }],
+        )
+    }
 
-        assert_eq!(parsed.len(), 2, "should keep only valid EID entries");
-        assert_eq!(parsed[0].source, "id5-sync.com");
-        assert_eq!(parsed[0].uids.len(), 1, "should keep valid UID");
-        assert_eq!(parsed[1].source, "sharedid.org");
-        assert_eq!(parsed[1].uids.len(), 1, "should drop empty UID values");
+    /// A browser entry, every field spelled out (spec 7.1 rule 9).
+    fn browser_eid(
+        source: &str,
+        id: &str,
+        atype: Option<i32>,
+        inserter: Option<&str>,
+        mm: Option<i32>,
+    ) -> Eid {
+        Eid {
+            source: source.to_owned(),
+            uids: vec![Uid {
+                id: id.to_owned(),
+                atype,
+                ext: None,
+            }],
+            inserter: inserter.map(str::to_owned),
+            matcher: None,
+            mm,
+            ext: None,
+        }
     }
 
-    #[test]
-    fn parse_client_auction_eids_caps_sources_and_uids() {
-        let entries: Vec<_> = (0..(MAX_CLIENT_EID_SOURCES + 5))
-            .map(|source_index| {
-                let uids: Vec<_> = (0..(MAX_CLIENT_UIDS_PER_SOURCE + 5))
-                    .map(|uid_index| json!({ "id": format!("uid-{source_index}-{uid_index}") }))
-                    .collect();
-                json!({
-                    "source": format!("source-{source_index}.example.com"),
-                    "uids": uids,
-                })
-            })
-            .collect();
-        let raw = JsonValue::Array(entries);
+    fn merged_json(client: Option<Vec<Eid>>, kv: Option<Vec<Eid>>) -> JsonValue {
+        let merged = merge_auction_eids(
+            &client.unwrap_or_default(),
+            &ServerSet::from_eids(kv.unwrap_or_default()),
+            &Denials::default(),
+        );
+        let merged = (!merged.is_empty()).then_some(merged);
+        serde_json::to_value(merged).expect("should serialize merged EIDs")
+    }
 
-        let parsed = parse_client_auction_eids(Some(&raw)).expect("should parse capped EIDs");
+    const MERGE_EC_ID_PREFIX: &str = "merge";
 
-        assert_eq!(
-            parsed.len(),
-            MAX_CLIENT_EID_SOURCES,
-            "should cap client EID sources"
-        );
-        assert!(
-            parsed
-                .iter()
-                .all(|eid| eid.uids.len() == MAX_CLIENT_UIDS_PER_SOURCE),
-            "should cap UIDs per source"
-        );
+    fn merge_ec_id() -> String {
+        format!("{}.{MERGE_EC_ID_PREFIX}", "a".repeat(64))
     }
 
-    #[test]
-    fn parse_client_auction_eids_drops_whitespace_and_oversized_uids() {
-        let raw = json!([
-            {
-                "source": "id5-sync.com",
-                "uids": [
-                    { "id": "   " },
-                    { "id": "x".repeat(MAX_UID_LENGTH + 1) },
-                    { "id": "valid" }
-                ]
-            }
-        ]);
+    fn merge_registry(sources: &[&str]) -> PartnerRegistry {
+        let partners: Vec<_> = sources
+            .iter()
+            .map(|source| counting_test_partner(source))
+            .collect();
+        PartnerRegistry::from_config(&partners).expect("should build registry")
+    }
+
+    fn merge_entry(records: Vec<(&str, KvPartnerId)>) -> KvEntry {
+        let mut entry = KvEntry::minimal("unused.example.com", "unused", 1);
+        entry.ids.clear();
+        for (source, record) in records {
+            entry.ids.insert(source.to_owned(), record);
+        }
+        entry
+    }
+
+    /// The request's [`AuctionIdentity`] for `entry`, with no providers.
+    fn merge_identity(entry: KvEntry, registry: &PartnerRegistry) -> AuctionIdentity {
+        let ec_id = merge_ec_id();
+        let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let snapshot = EcKvSnapshot::Present {
+            ec_id,
+            entry: Box::new(entry),
+            generation: None,
+        };
+        auction_identity(
+            &snapshot,
+            Some(registry),
+            &ec_context,
+            PolicySignals::default(),
+        )
+    }
 
-        let parsed = parse_client_auction_eids(Some(&raw)).expect("should parse valid UID");
+    fn default_atype() -> i32 {
+        crate::settings::EcPartner::default_openrtb_atype()
+    }
 
-        assert_eq!(parsed.len(), 1, "should retain source with valid UID");
-        assert_eq!(parsed[0].uids.len(), 1, "should drop invalid UIDs");
-        assert_eq!(parsed[0].uids[0].id, "valid", "should keep valid UID");
+    fn plain_eid(source: &str, id: &str, atype: Option<i32>) -> Eid {
+        Eid {
+            source: source.to_owned(),
+            uids: vec![Uid {
+                id: id.to_owned(),
+                atype,
+                ext: None,
+            }],
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
     }
 
     #[test]
-    fn parse_client_auction_eids_preserves_pair_atype() {
-        let raw = json!([
-            {
-                "source": "google.com",
-                "uids": [{ "id": "pair-id", "atype": 571187 }]
-            }
-        ]);
+    fn merge_browser_value_wins_for_unowned_source() {
+        let registry = merge_registry(&[SOURCE_S]);
+        let identity = merge_identity(
+            merge_entry(vec![(SOURCE_S, KvPartnerId::new("server"))]),
+            &registry,
+        );
 
-        let parsed = parse_client_auction_eids(Some(&raw)).expect("should parse PAIR EID");
+        let merged = identity.merge(Some(&[plain_eid(SOURCE_S, "browser", Some(1))]));
 
         assert_eq!(
-            parsed[0].uids[0].atype,
-            Some(571187),
-            "should preserve PAIR's vendor-specific atype"
+            merged,
+            Some(vec![plain_eid(SOURCE_S, "browser", Some(1))]),
+            "the browser's value should win for an unowned source"
         );
     }
 
     #[test]
-    fn parse_client_auction_eids_preserves_uid_ext_and_sanitizes_invalid_atype() {
-        let raw = json!([
-            {
-                "source": "adserver.org",
-                "uids": [
-                    {
-                        "id": "uid-with-ext",
-                        "atype": 1,
-                        "ext": { "provider": "liveintent.com", "rtiPartner": "TDID" }
-                    },
-                    {
-                        "id": "uid-bad-atype",
-                        "atype": 2_147_483_648_u64,
-                        "ext": { "keep": true }
-                    },
-                    {
-                        "id": "uid-float-atype",
-                        "atype": 1.5
-                    }
-                ]
-            }
-        ]);
+    fn merge_server_value_goes_out_when_the_browser_did_not_send_the_source() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let identity = merge_identity(
+            merge_entry(vec![(SOURCE_T, KvPartnerId::new("server"))]),
+            &registry,
+        );
 
-        let parsed = parse_client_auction_eids(Some(&raw)).expect("should parse valid EIDs");
+        let merged = identity.merge(Some(&[plain_eid(SOURCE_S, "browser", Some(1))]));
 
-        assert_eq!(parsed.len(), 1, "should keep valid source");
-        assert_eq!(parsed[0].uids.len(), 3, "should keep valid UIDs");
         assert_eq!(
-            parsed[0].uids[0].atype,
-            Some(1),
-            "should preserve valid atype"
+            merged,
+            Some(vec![
+                plain_eid(SOURCE_S, "browser", Some(1)),
+                plain_eid(SOURCE_T, "server", Some(default_atype())),
+            ]),
+            "the server value should follow the browser entries"
         );
-        assert_eq!(
-            parsed[0].uids[0].ext,
-            Some(json!({ "provider": "liveintent.com", "rtiPartner": "TDID" })),
-            "should preserve uid ext"
+    }
+
+    #[test]
+    fn merge_expired_entry_is_not_sent() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let expired = KvPartnerId {
+            exp: Some(1),
+            ..KvPartnerId::new("expired")
+        };
+        let identity = merge_identity(
+            merge_entry(vec![
+                (SOURCE_S, expired),
+                (SOURCE_T, KvPartnerId::new("live")),
+            ]),
+            &registry,
         );
+
         assert_eq!(
-            parsed[0].uids[1].atype, None,
-            "should drop out-of-range atype without dropping uid"
+            identity.merge(None),
+            Some(vec![plain_eid(SOURCE_T, "live", Some(default_atype()))]),
+            "an expired record should not be sent"
         );
-        assert_eq!(
-            parsed[0].uids[1].ext,
-            Some(json!({ "keep": true })),
-            "should preserve ext when atype is invalid"
+    }
+
+    #[test]
+    fn merge_stored_atype_and_ext_are_emitted() {
+        let registry = merge_registry(&[SOURCE_S]);
+        let identity = merge_identity(
+            merge_entry(vec![(SOURCE_S, full_record(None, example_entry_set()))]),
+            &registry,
         );
+
         assert_eq!(
-            parsed[0].uids[2].atype, None,
-            "should drop non-integer atype without dropping uid"
+            identity.merge(None),
+            Some(vec![
+                Eid {
+                    source: SOURCE_S.to_owned(),
+                    uids: vec![
+                        Uid {
+                            id: "example-a".to_owned(),
+                            atype: Some(1),
+                            ext: None,
+                        },
+                        Uid {
+                            id: "example-b".to_owned(),
+                            atype: Some(3),
+                            ext: Some(json!({ "stype": "ppuid" })),
+                        },
+                    ],
+                    inserter: Some("example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(3),
+                    ext: None,
+                },
+                Eid {
+                    source: SOURCE_S.to_owned(),
+                    uids: vec![Uid {
+                        id: "example-c".to_owned(),
+                        atype: Some(1),
+                        ext: None,
+                    }],
+                    inserter: None,
+                    matcher: Some("partner.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ]),
+            "the stored atype, UID ext and EID-level fields should go out"
         );
     }
 
     #[test]
-    fn merge_auction_eids_deduplicates_client_and_resolved_ids() {
-        let client_eids = Some(vec![Eid {
-            source: "id5-sync.com".to_string(),
-            uids: vec![Uid {
-                id: "ID5_abc".to_string(),
-                atype: Some(1),
-                ext: None,
-            }],
-        }]);
-        let resolved_eids = Some(vec![
-            Eid {
-                source: "id5-sync.com".to_string(),
-                uids: vec![Uid {
-                    id: "ID5_abc".to_string(),
-                    atype: Some(1),
-                    ext: None,
-                }],
-            },
-            Eid {
-                source: "liveramp.com".to_string(),
-                uids: vec![Uid {
-                    id: "LR_xyz".to_string(),
-                    atype: Some(3),
-                    ext: None,
-                }],
-            },
-        ]);
+    fn merge_entry_set_goes_out_one_eid_per_entry_in_stored_order_after_browser_entries() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let identity = merge_identity(
+            merge_entry(vec![(SOURCE_S, full_record(None, example_entry_set()))]),
+            &registry,
+        );
 
-        let merged = merge_auction_eids(client_eids, resolved_eids).expect("should merge EIDs");
+        let merged = identity
+            .merge(Some(&[plain_eid(SOURCE_T, "browser", None)]))
+            .expect("should merge EIDs");
+
+        let shape: Vec<(String, Vec<String>)> = merged
+            .iter()
+            .map(|eid| {
+                (
+                    eid.source.clone(),
+                    eid.uids.iter().map(|uid| uid.id.clone()).collect(),
+                )
+            })
+            .collect();
+        assert_eq!(
+            shape,
+            vec![
+                (SOURCE_T.to_owned(), vec!["browser".to_owned()]),
+                (
+                    SOURCE_S.to_owned(),
+                    vec!["example-a".to_owned(), "example-b".to_owned()]
+                ),
+                (SOURCE_S.to_owned(), vec!["example-c".to_owned()]),
+            ],
+            "the stored set should go out one EID per entry, in order, after the browser"
+        );
+    }
 
-        assert_eq!(merged.len(), 2, "should retain distinct EID sources");
-        assert_eq!(merged[0].source, "id5-sync.com");
-        assert_eq!(merged[0].uids.len(), 1, "should deduplicate matching UIDs");
-        assert_eq!(merged[1].source, "liveramp.com");
-        assert_eq!(merged[1].uids[0].id, "LR_xyz");
+    fn decode_eids_header(value: &str) -> Vec<Eid> {
+        serde_json::from_slice(&BASE64.decode(value).expect("should be base64"))
+            .expect("should be EID JSON")
     }
 
     #[test]
-    fn merge_auction_eids_preserves_multiple_uids_per_source() {
-        let client_eids = Some(vec![Eid {
-            source: "sharedid.org".to_string(),
-            uids: vec![Uid {
-                id: "shared_client".to_string(),
-                atype: None,
-                ext: None,
-            }],
-        }]);
-        let resolved_eids = Some(vec![Eid {
-            source: "sharedid.org".to_string(),
-            uids: vec![Uid {
-                id: "shared_server".to_string(),
-                atype: Some(3),
+    fn merge_x_ts_eids_matches_what_was_sent() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let identity = merge_identity(
+            merge_entry(vec![(SOURCE_S, full_record(None, example_entry_set()))]),
+            &registry,
+        );
+        let merged = identity
+            .merge(Some(&[plain_eid(SOURCE_T, "browser", Some(1))]))
+            .expect("should merge EIDs");
+
+        let (header, truncated) =
+            crate::ec::eids::encode_eids_header(&merged).expect("should encode the header");
+
+        assert!(!truncated, "should fit without truncation");
+        assert_eq!(
+            decode_eids_header(&header),
+            merged,
+            "x-ts-eids should carry exactly what was sent"
+        );
+    }
+
+    #[test]
+    fn merge_header_still_truncates_per_entry() {
+        let registry = merge_registry(&[SOURCE_S]);
+        let entries: Vec<KvEid> = (0..40)
+            .map(|index| KvEid {
+                uids: vec![KvUid {
+                    id: format!("{index:03}-{}", "x".repeat(100)),
+                    atype: Some(1),
+                    ext: None,
+                }],
+                ..KvEid::default()
+            })
+            .collect();
+        let identity = merge_identity(
+            merge_entry(vec![(SOURCE_S, full_record(None, entries))]),
+            &registry,
+        );
+        let merged = identity.merge(None).expect("should merge EIDs");
+
+        let (header, truncated) =
+            crate::ec::eids::encode_eids_header(&merged).expect("should encode the header");
+
+        assert_eq!(merged.len(), 40, "user.eids should hold the whole set");
+        assert!(truncated, "x-ts-eids-truncated should be set");
+        let carried = decode_eids_header(&header);
+        assert!(
+            !carried.is_empty() && carried.len() < merged.len(),
+            "x-ts-eids should hold the entries that fit"
+        );
+        assert_eq!(
+            carried,
+            merged[..carried.len()].to_vec(),
+            "the header should hold a prefix of whole entries"
+        );
+    }
+
+    #[test]
+    fn merge_denials_apply_through_the_request_identity() {
+        let partner = ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        );
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![partner];
+        let runtime = std::sync::Arc::new(
+            IdentityRuntime::from_settings(
+                &settings,
+                &crate::integrations::IntegrationRegistry::default(),
+            )
+            .expect("should build the runtime"),
+        );
+        let registry = merge_registry(&["ssp.example.com"]);
+        let ec_id = merge_ec_id();
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_identity_runtime(runtime);
+        let mut entry = merge_entry(Vec::new());
+        entry.ps.insert(
+            "pull-ssp-example-com".to_owned(),
+            KvProviderState {
+                iv: vec![uid_hash("invalidated")],
+                ..KvProviderState::default()
+            },
+        );
+        let snapshot = EcKvSnapshot::Present {
+            ec_id,
+            entry: Box::new(entry),
+            generation: None,
+        };
+        let identity = auction_identity(
+            &snapshot,
+            Some(&registry),
+            &ec_context,
+            PolicySignals::default(),
+        );
+
+        let merged = identity.merge(Some(&[
+            plain_eid("ssp.example.com", "invalidated", Some(1)),
+            plain_eid(SOURCE_T, "kept", Some(1)),
+        ]));
+
+        assert_eq!(
+            merged,
+            Some(vec![plain_eid(SOURCE_T, "kept", Some(1))]),
+            "a browser UID the claiming provider invalidated should not be sent"
+        );
+    }
+
+    /// The request identity for `entry` when `provider` owns each of `owned`.
+    fn owned_identity(
+        entry: KvEntry,
+        registry: &PartnerRegistry,
+        provider: Arc<dyn crate::ec::identity::provider::IdentityProvider>,
+        owned: &[&str],
+        consent: ConsentContext,
+    ) -> (AuctionIdentity, EcContext) {
+        let owners = owned
+            .iter()
+            .map(|name| (source(name), provider.descriptor().id().clone()))
+            .collect();
+        let runtime = Arc::new(
+            IdentityRuntime::from_settings_with_providers(
+                &create_test_settings(),
+                vec![provider],
+                owners,
+            )
+            .expect("should build the runtime"),
+        );
+        let ec_id = merge_ec_id();
+        let mut ec_context = EcContext::new_for_test(Some(ec_id.clone()), consent);
+        ec_context.set_identity_runtime(runtime);
+        ec_context.enable_mirror_for_test();
+        let snapshot = EcKvSnapshot::Present {
+            ec_id,
+            entry: Box::new(entry),
+            generation: None,
+        };
+        let identity = auction_identity(
+            &snapshot,
+            Some(registry),
+            &ec_context,
+            PolicySignals::default(),
+        );
+        (identity, ec_context)
+    }
+
+    fn non_regulated_consent() -> ConsentContext {
+        ConsentContext {
+            jurisdiction: Jurisdiction::NonRegulated,
+            ..ConsentContext::default()
+        }
+    }
+
+    fn owner_provider(expiring: bool) -> Arc<dyn crate::ec::identity::provider::IdentityProvider> {
+        let mut builder =
+            crate::ec::identity::descriptor::ProviderDescriptor::builder(pid("owner"))
+                .with_source(source(SOURCE_S))
+                .with_resolves(
+                    crate::ec::identity::descriptor::Resolves::new()
+                        .with_endpoint("https://api.example.com/fetch"),
+                )
+                .with_consent_policy(crate::ec::identity::test_support::resolver_policy());
+        if expiring {
+            builder = builder.with_expiring_ids();
+        }
+        provider_from(builder.build().expect("should build the descriptor"))
+    }
+
+    fn owner_record(uid: &str) -> KvPartnerId {
+        KvPartnerId {
+            w: Some("owner".to_owned()),
+            ..KvPartnerId::new(uid)
+        }
+    }
+
+    #[test]
+    fn owner_valid_value_beats_browser_value() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let (identity, _) = owned_identity(
+            merge_entry(vec![(SOURCE_S, owner_record("owner-uid"))]),
+            &registry,
+            owner_provider(false),
+            &[SOURCE_S],
+            non_regulated_consent(),
+        );
+
+        let merged = identity.merge(Some(&[
+            plain_eid(SOURCE_S, "browser", Some(1)),
+            plain_eid(SOURCE_T, "other", Some(1)),
+        ]));
+
+        assert_eq!(
+            merged,
+            Some(vec![
+                plain_eid(SOURCE_T, "other", Some(1)),
+                plain_eid(SOURCE_S, "owner-uid", Some(default_atype())),
+            ]),
+            "the owner's value should replace the browser's, after the browser entries"
+        );
+    }
+
+    #[test]
+    fn owner_valid_set_replaces_every_repeated_browser_entry() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let (identity, _) = owned_identity(
+            merge_entry(vec![(
+                SOURCE_S,
+                full_record(Some("owner"), example_entry_set()),
+            )]),
+            &registry,
+            owner_provider(false),
+            &[SOURCE_S],
+            non_regulated_consent(),
+        );
+
+        let merged = identity.merge(Some(&[
+            plain_eid(SOURCE_S, "browser-one", Some(1)),
+            plain_eid(SOURCE_T, "other", Some(1)),
+            Eid {
+                inserter: Some("inserter.example.com".to_owned()),
+                ..plain_eid(SOURCE_S, "browser-two", Some(3))
+            },
+        ]));
+
+        assert_eq!(
+            merged,
+            Some(vec![
+                plain_eid(SOURCE_T, "other", Some(1)),
+                Eid {
+                    source: SOURCE_S.to_owned(),
+                    uids: vec![
+                        Uid {
+                            id: "example-a".to_owned(),
+                            atype: Some(1),
+                            ext: None,
+                        },
+                        Uid {
+                            id: "example-b".to_owned(),
+                            atype: Some(3),
+                            ext: Some(json!({ "stype": "ppuid" })),
+                        },
+                    ],
+                    inserter: Some("example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(3),
+                    ext: None,
+                },
+                Eid {
+                    source: SOURCE_S.to_owned(),
+                    uids: vec![Uid {
+                        id: "example-c".to_owned(),
+                        atype: Some(1),
+                        ext: None,
+                    }],
+                    inserter: None,
+                    matcher: Some("partner.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ]),
+            "exactly the owner's two entries should go out, in stored order, and no browser entry of the source"
+        );
+    }
+
+    #[test]
+    fn browser_seeded_value_never_beats_browser_current_value() {
+        let registry = merge_registry(&[SOURCE_S]);
+        let (identity, _) = owned_identity(
+            merge_entry(vec![(SOURCE_S, KvPartnerId::new("seeded"))]),
+            &registry,
+            owner_provider(false),
+            &[SOURCE_S],
+            non_regulated_consent(),
+        );
+
+        let sent = identity.merge(Some(&[plain_eid(SOURCE_S, "current", Some(1))]));
+        let silent = identity.merge(None);
+
+        assert_eq!(
+            sent,
+            Some(vec![plain_eid(SOURCE_S, "current", Some(1))]),
+            "the browser's current value should beat a browser-seeded record"
+        );
+        assert_eq!(
+            silent,
+            Some(vec![plain_eid(SOURCE_S, "seeded", Some(default_atype()))]),
+            "control: a seeded value of a source that does not expire should go out when the browser is silent"
+        );
+    }
+
+    #[test]
+    fn expiring_owned_source_never_serves_browser_seeded_value() {
+        let registry = merge_registry(&[SOURCE_S]);
+        let (expiring, _) = owned_identity(
+            merge_entry(vec![(SOURCE_S, KvPartnerId::new("seeded"))]),
+            &registry,
+            owner_provider(true),
+            &[SOURCE_S],
+            non_regulated_consent(),
+        );
+        let (owned_expiring, _) = owned_identity(
+            merge_entry(vec![(
+                SOURCE_S,
+                KvPartnerId {
+                    exp: Some(current_timestamp() + 1_000),
+                    ..owner_record("owner-uid")
+                },
+            )]),
+            &registry,
+            owner_provider(true),
+            &[SOURCE_S],
+            non_regulated_consent(),
+        );
+
+        assert_eq!(
+            expiring.merge(None),
+            None,
+            "should not serve a browser-seeded value of an expiring owned source"
+        );
+        assert_eq!(
+            owned_expiring.merge(None),
+            Some(vec![plain_eid(
+                SOURCE_S,
+                "owner-uid",
+                Some(default_atype())
+            )]),
+            "control: the owner's unexpired value should go out"
+        );
+    }
+
+    #[test]
+    fn unowned_source_keeps_the_browser_first_rule() {
+        let registry = merge_registry(&[SOURCE_S, SOURCE_T]);
+        let (identity, _) = owned_identity(
+            merge_entry(vec![
+                (SOURCE_S, owner_record("owner-uid")),
+                (SOURCE_T, owner_record("claimed-uid")),
+            ]),
+            &registry,
+            owner_provider(false),
+            &[SOURCE_S],
+            non_regulated_consent(),
+        );
+
+        let merged = identity.merge(Some(&[plain_eid(SOURCE_T, "browser", Some(1))]));
+
+        assert_eq!(
+            merged,
+            Some(vec![
+                plain_eid(SOURCE_T, "browser", Some(1)),
+                plain_eid(SOURCE_S, "owner-uid", Some(default_atype())),
+            ]),
+            "the browser should still win for a source with no owner"
+        );
+    }
+
+    #[test]
+    fn targeted_opt_out_blocks_server_ids_flush_and_mirror() {
+        let registry = merge_registry(&[SOURCE_S]);
+        let consent_with = |targeted: bool| ConsentContext {
+            jurisdiction: Jurisdiction::NonRegulated,
+            gpp: Some(crate::consent::types::GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: Some(targeted),
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
+            }),
+            ..ConsentContext::default()
+        };
+        let provider = owner_provider(false);
+        let entry = || merge_entry(vec![(SOURCE_S, owner_record("owner-uid"))]);
+        let (blocked, blocked_context) = owned_identity(
+            entry(),
+            &registry,
+            provider.clone(),
+            &[SOURCE_S],
+            consent_with(true),
+        );
+        let (allowed, allowed_context) = owned_identity(
+            entry(),
+            &registry,
+            provider.clone(),
+            &[SOURCE_S],
+            consent_with(false),
+        );
+
+        assert_eq!(
+            blocked.merge(None),
+            None,
+            "a targeted-advertising opt-out should leave no server-side ID in user.eids"
+        );
+        assert_eq!(
+            blocked.mirror_member(&blocked_context),
+            Some(json!({ "clear": true })),
+            "the ts-eids-s mirror should carry none of the provider's entries"
+        );
+        assert!(
+            allowed.merge(None).is_some()
+                && allowed
+                    .mirror_member(&allowed_context)
+                    .is_some_and(|member| member.get("value").is_some()),
+            "control: without the opt-out the ID should go out and be mirrored"
+        );
+
+        let catalog = ProviderCatalog::new(vec![provider.clone()], BTreeMap::new());
+        let settings = crate::settings::ProviderSettings::default();
+        let identity_settings = crate::settings::IdentitySettings::default();
+        let check = |consent: &ConsentContext| {
+            crate::ec::identity::coordinator::eligibility(
+                &crate::ec::identity::coordinator::EligibilityInput {
+                    provider: provider.as_ref(),
+                    settings: &settings,
+                    identity: &identity_settings,
+                    catalog: &catalog,
+                    consent,
+                },
+                &crate::ec::identity::coordinator::EligibilityView::empty(),
+                &crate::ec::identity::test_support::facts_for_writer(),
+                crate::ec::identity::coordinator::Phase::AfterSend,
+            )
+        };
+        assert!(
+            matches!(
+                check(&consent_with(true)),
+                crate::ec::identity::coordinator::Eligibility::Skip(
+                    crate::ec::identity::coordinator::SkipReason::ConsentPolicy
+                )
+            ),
+            "the provider should not be dispatched, so nothing of it is flushed"
+        );
+        assert!(
+            matches!(
+                check(&consent_with(false)),
+                crate::ec::identity::coordinator::Eligibility::Eligible { .. }
+            ),
+            "control: without the opt-out the provider should be eligible"
+        );
+    }
+
+    #[test]
+    fn golden_merge_one_uid_row_goes_out_as_on_main() {
+        let registry = merge_registry(&["a.example.com", "b.example.com"]);
+        let identity = merge_identity(
+            merge_entry(vec![
+                ("b.example.com", KvPartnerId::new("ub")),
+                ("a.example.com", KvPartnerId::new("ua")),
+            ]),
+            &registry,
+        );
+
+        // Written from `main`'s `merge_auction_eids(None, Some(to_eids(..)))`.
+        let expected = vec![
+            Eid {
+                source: "a.example.com".to_owned(),
+                uids: vec![Uid {
+                    id: "ua".to_owned(),
+                    atype: Some(3),
+                    ext: None,
+                }],
+                inserter: None,
+                matcher: None,
+                mm: None,
                 ext: None,
-            }],
-        }]);
+            },
+            Eid {
+                source: "b.example.com".to_owned(),
+                uids: vec![Uid {
+                    id: "ub".to_owned(),
+                    atype: Some(3),
+                    ext: None,
+                }],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            },
+        ];
+        assert_eq!(
+            identity.merge(None),
+            Some(expected),
+            "a one-UID row should go out exactly as on main"
+        );
+    }
 
-        let merged = merge_auction_eids(client_eids, resolved_eids).expect("should merge EIDs");
+    #[test]
+    fn golden_merge_browser_entries_are_forwarded_unchanged() {
+        let client = vec![
+            Eid {
+                source: SOURCE_S.to_owned(),
+                uids: vec![
+                    Uid {
+                        id: "s1".to_owned(),
+                        atype: Some(1),
+                        ext: Some(json!({ "stype": "ppuid" })),
+                    },
+                    Uid {
+                        id: "s2".to_owned(),
+                        atype: None,
+                        ext: None,
+                    },
+                ],
+                inserter: Some("inserter-1.example.com".to_owned()),
+                matcher: Some("matcher.example.com".to_owned()),
+                mm: Some(1),
+                ext: Some(json!({ "segments": ["a"] })),
+            },
+            Eid {
+                source: SOURCE_T.to_owned(),
+                uids: Vec::new(),
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            },
+            Eid {
+                source: SOURCE_S.to_owned(),
+                uids: vec![Uid {
+                    id: "s1".to_owned(),
+                    atype: Some(3),
+                    ext: None,
+                }],
+                inserter: Some("inserter-2.example.com".to_owned()),
+                matcher: None,
+                mm: Some(2),
+                ext: None,
+            },
+        ];
+
+        let merged = merge_auction_eids(&client, &ServerSet::default(), &Denials::default());
+
+        assert_eq!(
+            merged,
+            vec![client[0].clone(), client[2].clone()],
+            "browser entries should go out as today, minus entries without UIDs"
+        );
+    }
+
+    #[test]
+    fn merge_case_1_forwards_a_browser_entry_with_its_fields() {
+        let merged = merged_json(
+            Some(vec![browser_eid(
+                SOURCE_S,
+                "u1",
+                None,
+                Some("inserter-1.example.com"),
+                Some(1),
+            )]),
+            None,
+        );
 
-        assert_eq!(merged.len(), 1, "should merge same-source entries");
-        assert_eq!(merged[0].uids.len(), 2, "should preserve distinct UIDs");
-        assert_eq!(merged[0].uids[0].id, "shared_server");
-        assert_eq!(merged[0].uids[1].id, "shared_client");
+        assert_eq!(
+            merged,
+            json!([{ "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1" }] }]),
+            "a browser entry should go out with its EID-level fields"
+        );
     }
 
     #[test]
-    fn merge_auction_eids_prefers_server_resolved_metadata_on_conflict() {
-        let client_eids = Some(vec![Eid {
-            source: "adserver.org".to_string(),
-            uids: vec![Uid {
-                id: "shared_uid".to_string(),
+    fn merge_case_2_keeps_the_browser_atype_for_a_shared_uid() {
+        let merged = merged_json(
+            Some(vec![browser_eid(
+                SOURCE_S,
+                "u1",
+                Some(1),
+                Some("inserter-1.example.com"),
+                Some(1),
+            )]),
+            Some(vec![kv_eid(SOURCE_S, "u1", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1", "atype": 1 }] }]),
+            "KV's operator-configured atype should not override the browser's"
+        );
+    }
+
+    #[test]
+    fn merge_case_3_drops_the_stale_kv_uid_for_a_browser_source() {
+        let merged = merged_json(
+            Some(vec![browser_eid(
+                SOURCE_S,
+                "u1",
+                None,
+                Some("inserter-1.example.com"),
+                Some(1),
+            )]),
+            Some(vec![kv_eid(SOURCE_S, "u0", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1" }] }]),
+            "KV's value for a source the browser sends should not be forwarded"
+        );
+    }
+
+    #[test]
+    fn merge_case_4_appends_kv_sources_the_browser_did_not_send() {
+        let merged = merged_json(
+            Some(vec![browser_eid(SOURCE_S, "u1", None, None, None)]),
+            Some(vec![kv_eid(SOURCE_T, "t1", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": SOURCE_S, "uids": [{ "id": "u1" }] },
+                { "source": SOURCE_T, "uids": [{ "id": "t1", "atype": 3 }] }
+            ]),
+            "browser entries should come first and KV-only sources after"
+        );
+    }
+
+    #[test]
+    fn invalid_legacy_cookie_uids_neither_reach_providers_nor_displace_kv() {
+        for (case, invalid_id) in [
+            ("whitespace-only", "   ".to_owned()),
+            ("oversized", "x".repeat(MAX_UID_LENGTH + 1)),
+        ] {
+            let cookie_payload = json!([{ "source": SOURCE_S, "id": invalid_id, "atype": 1 }]);
+            let encoded = BASE64.encode(
+                serde_json::to_vec(&cookie_payload).expect("should serialize legacy cookie"),
+            );
+
+            let client = resolve_client_auction_eids(None, Some(&encoded));
+            let merged = merged_json(client.clone(), Some(vec![kv_eid(SOURCE_S, "kv-uid", 3)]));
+
+            assert_eq!(client, None, "should drop the {case} legacy cookie UID");
+            assert_eq!(
+                merged,
+                json!([{ "source": SOURCE_S, "uids": [{ "id": "kv-uid", "atype": 3 }] }]),
+                "should keep the KV identity when the {case} legacy UID is dropped"
+            );
+        }
+    }
+
+    #[test]
+    fn merge_case_5_keeps_same_source_entries_with_different_fields_apart() {
+        let merged = merged_json(
+            Some(vec![
+                browser_eid(
+                    SOURCE_S,
+                    "u1",
+                    None,
+                    Some("inserter-1.example.com"),
+                    Some(1),
+                ),
+                browser_eid(
+                    SOURCE_S,
+                    "u1",
+                    None,
+                    Some("inserter-2.example.com"),
+                    Some(2),
+                ),
+            ]),
+            None,
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1" }] },
+                { "source": SOURCE_S, "inserter": "inserter-2.example.com", "mm": 2, "uids": [{ "id": "u1" }] }
+            ]),
+            "two browser entries for one source should stay two entries"
+        );
+    }
+
+    #[test]
+    fn merge_case_6_matches_sources_as_the_registry_normalizes_them() {
+        let merged = merged_json(
+            Some(vec![browser_eid(
+                "IDS.Example.com.",
+                "u1",
+                None,
+                None,
+                None,
+            )]),
+            Some(vec![kv_eid(SOURCE_S, "u0", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": "IDS.Example.com.", "uids": [{ "id": "u1" }] }]),
+            "a browser source differing only in case or a trailing dot should suppress KV's"
+        );
+    }
+
+    #[test]
+    fn merge_case_7_forwards_kv_entries_when_the_browser_sent_none() {
+        let merged = merged_json(
+            None,
+            Some(vec![kv_eid(SOURCE_S, "u0", 3), kv_eid(SOURCE_T, "t1", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": SOURCE_S, "uids": [{ "id": "u0", "atype": 3 }] },
+                { "source": SOURCE_T, "uids": [{ "id": "t1", "atype": 3 }] }
+            ]),
+            "KV entries should be forwarded unchanged without browser EIDs"
+        );
+    }
+
+    #[test]
+    fn merge_drops_entries_without_uids() {
+        let empty_browser = Eid::new(SOURCE_S.to_owned(), Vec::new());
+        let empty_kv = Eid::new(SOURCE_T.to_owned(), Vec::new());
+
+        assert_eq!(
+            merged_json(Some(vec![empty_browser]), Some(vec![empty_kv])),
+            JsonValue::Null,
+            "entries without UIDs should be dropped, leaving no EIDs"
+        );
+    }
+
+    #[test]
+    fn merge_auction_eids_deduplicates_client_and_resolved_ids() {
+        let merged = merged_json(
+            Some(vec![kv_eid("id5-sync.com", "ID5_abc", 1)]),
+            Some(vec![
+                kv_eid("id5-sync.com", "ID5_abc", 1),
+                kv_eid("liveramp.com", "LR_xyz", 3),
+            ]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": "id5-sync.com", "uids": [{ "id": "ID5_abc", "atype": 1 }] },
+                { "source": "liveramp.com", "uids": [{ "id": "LR_xyz", "atype": 3 }] }
+            ]),
+            "the browser's id5 entry should go out once, followed by KV's liveramp"
+        );
+    }
+
+    #[test]
+    fn merge_auction_eids_does_not_union_kv_uids_into_a_browser_source() {
+        let merged = merged_json(
+            Some(vec![browser_eid(
+                "sharedid.org",
+                "shared_client",
+                None,
+                None,
+                None,
+            )]),
+            Some(vec![kv_eid("sharedid.org", "shared_server", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": "sharedid.org", "uids": [{ "id": "shared_client" }] }]),
+            "KV's UID for a source the browser sends should not be added to it"
+        );
+    }
+
+    #[test]
+    fn merge_auction_eids_keeps_browser_metadata_on_conflict() {
+        let client = Eid::new(
+            "adserver.org".to_owned(),
+            vec![Uid {
+                id: "shared_uid".to_owned(),
                 atype: Some(1),
                 ext: Some(json!({ "provider": "client" })),
             }],
-        }]);
-        let resolved_eids = Some(vec![Eid {
-            source: "adserver.org".to_string(),
-            uids: vec![Uid {
-                id: "shared_uid".to_string(),
+        );
+        let resolved = Eid::new(
+            "adserver.org".to_owned(),
+            vec![Uid {
+                id: "shared_uid".to_owned(),
                 atype: Some(3),
                 ext: Some(json!({ "provider": "server" })),
             }],
-        }]);
-
-        let merged = merge_auction_eids(client_eids, resolved_eids).expect("should merge EIDs");
-
-        assert_eq!(merged.len(), 1, "should merge duplicate source");
-        assert_eq!(merged[0].uids.len(), 1, "should deduplicate duplicate uid");
-        assert_eq!(
-            merged[0].uids[0].atype,
-            Some(3),
-            "should prefer resolved atype"
         );
+
         assert_eq!(
-            merged[0].uids[0].ext,
-            Some(json!({ "provider": "server" })),
-            "should prefer resolved ext"
+            merged_json(Some(vec![client]), Some(vec![resolved])),
+            json!([{
+                "source": "adserver.org",
+                "uids": [{ "id": "shared_uid", "atype": 1, "ext": { "provider": "client" } }]
+            }]),
+            "the browser's atype and ext should win over KV's"
         );
     }
 
@@ -2245,4 +4075,551 @@ mod tests {
             );
         });
     }
+
+    mod mirror {
+        use super::*;
+        use crate::ec::kv_types::{KvEntry, KvPartnerId};
+        use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+
+        const MIRROR_SOURCE_A: &str = "a.example.com";
+        const MIRROR_SOURCE_B: &str = "b.example.com";
+
+        fn mirror_registry() -> PartnerRegistry {
+            let mut disabled = counting_test_partner("off.example.com");
+            disabled.bidstream_enabled = false;
+            PartnerRegistry::from_config(&[
+                counting_test_partner(MIRROR_SOURCE_A),
+                counting_test_partner(MIRROR_SOURCE_B),
+                disabled,
+            ])
+            .expect("should build partner registry")
+        }
+
+        fn row_with(records: &[(&str, &str, Option<u64>)]) -> KvEntry {
+            let mut entry = KvEntry::minimal("unregistered.example.com", "x", 1);
+            entry.ids.clear();
+            for (source, uid, exp) in records {
+                entry.ids.insert(
+                    (*source).to_owned(),
+                    KvPartnerId {
+                        exp: *exp,
+                        ..KvPartnerId::browser(*uid, Some(1))
+                    },
+                );
+            }
+            entry
+        }
+
+        fn ec_id_for(tag: &str) -> String {
+            format!("{}.{tag}", "a".repeat(64))
+        }
+
+        /// Records the EIDs its request carried, then answers no-bid so the
+        /// auction completes and the response can be inspected.
+        struct NoBidRecordingProvider {
+            eids: Arc<Mutex<Option<JsonValue>>>,
+        }
+
+        #[async_trait::async_trait(?Send)]
+        impl AuctionProvider for NoBidRecordingProvider {
+            fn provider_name(&self) -> &str {
+                "eid_recording_provider"
+            }
+
+            async fn request_bids(
+                &self,
+                request: &AuctionRequest,
+                _context: &AuctionContext<'_>,
+            ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+                *self.eids.lock().expect("should lock recorded eids") = Some(
+                    serde_json::to_value(&request.user.eids)
+                        .expect("should serialize recorded eids"),
+                );
+                Ok(ProviderRequestOutcome::Immediate(AuctionResponse::no_bid(
+                    self.provider_name(),
+                    0,
+                )))
+            }
+
+            async fn parse_response(
+                &self,
+                _response: PlatformResponse,
+                _response_time_ms: u64,
+            ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+                panic!("parse_response must not run for an immediate answer");
+            }
+
+            fn timeout_ms(&self) -> u32 {
+                100
+            }
+
+            fn backend_name(
+                &self,
+                _services: &RuntimeServices,
+                _timeout_ms: u32,
+            ) -> Option<String> {
+                Some("record-backend".to_string())
+            }
+        }
+
+        fn recording_orchestrator(recorded: &Arc<Mutex<Option<JsonValue>>>) -> AuctionOrchestrator {
+            let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+                enabled: true,
+                providers: AuctionConfig::legacy_provider_map(&["eid_recording_provider"]),
+                timeout_ms: 2000,
+                mediator: None,
+                ..Default::default()
+            });
+            orchestrator.register_provider(Arc::new(NoBidRecordingProvider {
+                eids: Arc::clone(recorded),
+            }));
+            orchestrator
+        }
+
+        async fn run_auction(
+            ec_context: &mut EcContext,
+            graph: Option<&KvIdentityGraph>,
+            registry: Option<&PartnerRegistry>,
+            body: Vec<u8>,
+        ) -> JsonValue {
+            let recorded = Arc::new(Mutex::new(None));
+            let orchestrator = recording_orchestrator(&recorded);
+            let req = Request::builder()
+                .method("POST")
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+                .body(EdgeBody::from(body))
+                .expect("should build auction request");
+            let response = handle_auction(
+                &create_test_settings(),
+                &orchestrator,
+                graph,
+                registry,
+                ec_context,
+                &noop_services(),
+                req,
+            )
+            .await
+            .expect("should answer the auction");
+            let bytes = response
+                .into_body()
+                .into_bytes()
+                .expect("should buffer the body");
+            serde_json::from_slice(&bytes).expect("should parse the response")
+        }
+
+        fn mirror_of(response: &JsonValue) -> Option<&JsonValue> {
+            response.get("ext").and_then(|ext| ext.get("ts_eids_s"))
+        }
+
+        fn decoded(mirror: &JsonValue) -> JsonValue {
+            let value = mirror["value"].as_str().expect("should hold a value");
+            let bytes = URL_SAFE_NO_PAD
+                .decode(value)
+                .expect("should be unpadded base64url");
+            serde_json::from_slice(&bytes).expect("should be JSON")
+        }
+
+        fn live_context(ec_id: &str, graph: &KvIdentityGraph) -> EcContext {
+            let _ = graph;
+            let mut context = make_ec_context(Jurisdiction::NonRegulated, Some(ec_id));
+            context.enable_mirror_for_test();
+            context
+        }
+
+        #[tokio::test]
+        async fn auction_body_eids_are_not_written_to_kv() {
+            let (graph, store) = KvIdentityGraph::write_counting("test_store");
+            let ec_id = ec_id_for("nowrit");
+            graph
+                .create(&ec_id, &row_with(&[]))
+                .expect("should seed the live row");
+            store.reset_counts();
+            let registry = mirror_registry();
+            let recorded = Arc::new(Mutex::new(None));
+            let orchestrator = recording_orchestrator(&recorded);
+            let mut ec_context = live_context(&ec_id, &graph);
+            let req = Request::builder()
+                .method("POST")
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+                .body(EdgeBody::from(
+                    serde_json::to_vec(&json!({
+                        "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+                        "eids": [{ "source": MIRROR_SOURCE_A, "uids": [{ "id": "body-uid", "atype": 1 }] }]
+                    }))
+                    .expect("should serialize body"),
+                ))
+                .expect("should build auction request");
+
+            let _ = handle_auction(
+                &create_test_settings(),
+                &orchestrator,
+                Some(&graph),
+                Some(&registry),
+                &mut ec_context,
+                &noop_services(),
+                req,
+            )
+            .await;
+            let mut response = http::Response::new(EdgeBody::empty());
+            crate::ec::finalize::ec_finalize_response(
+                &create_test_settings(),
+                &mut ec_context,
+                Some(&graph),
+                &registry,
+                None,
+                None,
+                &mut response,
+            );
+
+            let writes = store.writes();
+            assert_eq!(
+                (writes.add, writes.if_generation_match, writes.overwrite),
+                (0, 0, 0),
+                "should write nothing to KV"
+            );
+            assert_eq!(
+                recorded.lock().expect("should lock recorded eids").clone(),
+                Some(
+                    json!([{ "source": MIRROR_SOURCE_A, "uids": [{ "id": "body-uid", "atype": 1 }] }])
+                ),
+                "should still send the body's UID to the bidder"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_omits_the_mirror_while_it_is_disabled() {
+            let ec_id = ec_id_for("mirror-off");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &row_with(&[(MIRROR_SOURCE_A, "uid-a", None)]))
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+
+            let response = run_auction(
+                &mut ec_context,
+                Some(&graph),
+                Some(&registry),
+                ad_units_only_body(),
+            )
+            .await;
+
+            assert_eq!(
+                mirror_of(&response),
+                None,
+                "should return no mirror member while [ec.identity] mirror_enabled is off"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_returns_the_mirror_of_its_servable_set() {
+            let ec_id = ec_id_for("mirror");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &row_with(&[(MIRROR_SOURCE_A, "uid-a", None)]))
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context = live_context(&ec_id, &graph);
+
+            let response = run_auction(
+                &mut ec_context,
+                Some(&graph),
+                Some(&registry),
+                ad_units_only_body(),
+            )
+            .await;
+
+            let mirror = mirror_of(&response).expect("should carry the mirror");
+            let atype = crate::settings::EcPartner::default_openrtb_atype();
+            assert_eq!(
+                decoded(mirror),
+                json!({ "v": 1, "eids": [{ "source": MIRROR_SOURCE_A, "uids": [{ "id": "uid-a", "atype": atype }] }] }),
+                "should hold exactly the servable record's EID"
+            );
+            assert_eq!(
+                mirror["max_age"], 86_400,
+                "should live a day without an exp"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_preserves_identity_mirror_alongside_trace() {
+            let mut settings = create_test_settings();
+            settings
+                .integrations
+                .insert_config(
+                    "gpt_diagnostics",
+                    &json!({"enabled": true, "trace_page_enabled": true}),
+                )
+                .expect("should enable trace capture");
+            let settings = Arc::new(settings);
+            let ec_id = ec_id_for("mirror-trace");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &row_with(&[(MIRROR_SOURCE_A, "uid-a", None)]))
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context = live_context(&ec_id, &graph);
+            let recorded = Arc::new(Mutex::new(None));
+            let orchestrator = recording_orchestrator(&recorded);
+            let mut req = Request::builder()
+                .method("POST")
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+                .header(header::COOKIE, "__Host-ts-console=1")
+                .body(EdgeBody::from(ad_units_only_body()))
+                .expect("should build auction request");
+            let hook = TracePreDispatchHook::new(
+                Arc::clone(&settings),
+                Arc::new(|_| panic!("should not load API setup metadata")),
+            );
+            hook.handle(&mut req)
+                .await
+                .expect("should freeze API trace gate");
+
+            let response = handle_auction(
+                &settings,
+                &orchestrator,
+                Some(&graph),
+                Some(&registry),
+                &mut ec_context,
+                &noop_services(),
+                req,
+            )
+            .await
+            .expect("should answer the auction");
+            assert!(
+                response.extensions().get::<TraceAuctionCarry>().is_some(),
+                "should retain private trace facts"
+            );
+            let body: JsonValue = serde_json::from_slice(
+                &response
+                    .into_body()
+                    .into_bytes()
+                    .expect("should buffer response"),
+            )
+            .expect("should parse response");
+
+            assert_eq!(
+                body["ext"]["trusted_server"]["trace_auction"]["evidence"]["source"], "auction_api",
+                "should serialize trace without displacing the identity mirror"
+            );
+            assert_eq!(
+                decoded(mirror_of(&body).expect("should carry the mirror"))["eids"][0]["uids"][0]["id"],
+                "uid-a",
+                "should serialize the same live identity alongside trace"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_mirror_max_age_follows_the_earliest_exp() {
+            let now = crate::ec::current_timestamp();
+            let ec_id = ec_id_for("maxage");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(
+                    &ec_id,
+                    &row_with(&[
+                        (MIRROR_SOURCE_A, "uid-a", Some(now + 600)),
+                        (MIRROR_SOURCE_B, "uid-b", Some(now + 999_999)),
+                    ]),
+                )
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context = live_context(&ec_id, &graph);
+
+            let response = run_auction(
+                &mut ec_context,
+                Some(&graph),
+                Some(&registry),
+                ad_units_only_body(),
+            )
+            .await;
+
+            let max_age = mirror_of(&response).expect("should carry the mirror")["max_age"]
+                .as_u64()
+                .expect("should hold a number");
+            assert!(
+                (595..=600).contains(&max_age),
+                "should take the earliest exp, got {max_age}"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_mirror_leaves_out_bidstream_disabled_sources() {
+            let ec_id = ec_id_for("bidoff");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(
+                    &ec_id,
+                    &row_with(&[
+                        (MIRROR_SOURCE_A, "uid-a", None),
+                        ("off.example.com", "uid-off", None),
+                    ]),
+                )
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context = live_context(&ec_id, &graph);
+
+            let response = run_auction(
+                &mut ec_context,
+                Some(&graph),
+                Some(&registry),
+                ad_units_only_body(),
+            )
+            .await;
+
+            let sources: Vec<String> =
+                decoded(mirror_of(&response).expect("should carry the mirror"))["eids"]
+                    .as_array()
+                    .expect("should hold EIDs")
+                    .iter()
+                    .map(|eid| eid["source"].as_str().unwrap_or_default().to_owned())
+                    .collect();
+            assert_eq!(
+                sources,
+                vec![MIRROR_SOURCE_A.to_owned()],
+                "should leave out the source bidstream disabled"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_mirror_leaves_out_ids_consent_filters_out() {
+            // TCF Purpose 1 granted, Purpose 4 refused: the auction runs, but
+            // `gate_eids_by_consent` strips every EID the bidder would get.
+            let ec_id = ec_id_for("gated");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &row_with(&[(MIRROR_SOURCE_A, "uid-a", None)]))
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context =
+                EcContext::new_for_test(Some(ec_id.clone()), gdpr_consent_with_purposes(&[1], 4));
+            ec_context.enable_mirror_for_test();
+
+            let response = run_auction(
+                &mut ec_context,
+                Some(&graph),
+                Some(&registry),
+                ad_units_only_body(),
+            )
+            .await;
+
+            assert_eq!(
+                mirror_of(&response),
+                Some(&json!({ "clear": true })),
+                "should not mirror an ID consent filtered out"
+            );
+        }
+
+        fn gdpr_consent_with_purposes(granted: &[usize], _refused: usize) -> ConsentContext {
+            let mut consent =
+                crate::ec::identity::test_support::test_consent_gdpr_without_vendor(9_999);
+            let tcf = consent.tcf.as_mut().expect("should hold a TCF string");
+            tcf.purpose_consents = (1..=24).map(|purpose| granted.contains(&purpose)).collect();
+            consent
+        }
+
+        #[tokio::test]
+        async fn auction_returns_clear_on_consent_denial_tombstone_and_missing_row() {
+            let registry = mirror_registry();
+            let live = row_with(&[(MIRROR_SOURCE_A, "uid-a", None)]);
+            let mut withdrawn = live.clone();
+            withdrawn.consent.ok = false;
+            let cases: [(&str, Option<KvEntry>, bool, JsonValue); 5] = [
+                ("live row", Some(live.clone()), false, json!("value")),
+                (
+                    "tombstone",
+                    Some(KvEntry::tombstone(1_000)),
+                    false,
+                    json!({ "clear": true }),
+                ),
+                (
+                    "consent.ok false",
+                    Some(withdrawn),
+                    false,
+                    json!({ "clear": true }),
+                ),
+                ("missing row", None, false, json!({ "clear": true })),
+                ("consent denial", Some(live), true, json!({ "clear": true })),
+            ];
+
+            for (label, row, deny_consent, expected) in cases {
+                let ec_id = ec_id_for("clears");
+                let graph = KvIdentityGraph::in_memory("test_store");
+                if let Some(row) = &row {
+                    graph.create(&ec_id, row).expect("should seed the row");
+                }
+                let mut ec_context = if deny_consent {
+                    // No TCF Purpose 1: the auction consent gate answers early.
+                    EcContext::new_for_test(Some(ec_id.clone()), gdpr_consent_with_purposes(&[], 4))
+                } else {
+                    live_context(&ec_id, &graph)
+                };
+                ec_context.enable_mirror_for_test();
+
+                let response = run_auction(
+                    &mut ec_context,
+                    Some(&graph),
+                    Some(&registry),
+                    ad_units_only_body(),
+                )
+                .await;
+
+                let mirror = mirror_of(&response)
+                    .unwrap_or_else(|| panic!("{label}: should carry a mirror"));
+                if expected == json!("value") {
+                    assert!(
+                        mirror.get("value").is_some(),
+                        "{label}: should carry a value"
+                    );
+                } else {
+                    assert_eq!(mirror, &expected, "{label}: should clear");
+                }
+            }
+        }
+
+        #[tokio::test]
+        async fn auction_returns_clear_when_the_servable_set_is_empty() {
+            let ec_id = ec_id_for("empty");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &row_with(&[("off.example.com", "uid-off", None)]))
+                .expect("should seed the live row");
+            let registry = mirror_registry();
+            let mut ec_context = live_context(&ec_id, &graph);
+
+            let response = run_auction(
+                &mut ec_context,
+                Some(&graph),
+                Some(&registry),
+                ad_units_only_body(),
+            )
+            .await;
+
+            assert_eq!(
+                mirror_of(&response),
+                Some(&json!({ "clear": true })),
+                "should clear an empty servable set"
+            );
+        }
+
+        #[tokio::test]
+        async fn auction_without_a_kv_read_omits_the_mirror() {
+            let ec_id = ec_id_for("noread");
+            let registry = mirror_registry();
+            let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+            ec_context.enable_mirror_for_test();
+
+            let response =
+                run_auction(&mut ec_context, None, Some(&registry), ad_units_only_body()).await;
+
+            assert!(
+                response["ext"].get("ts_eids_s").is_none(),
+                "should leave the mirror cookie as it is"
+            );
+        }
+    }
 }
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index b684c80dde..2a03303a93 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -9,6 +9,7 @@ use error_stack::{Report, ResultExt, ensure};
 use http::{HeaderValue, Request, Response, StatusCode, header};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
+use serde_json::value::RawValue;
 use std::collections::{BTreeMap, HashMap, HashSet};
 use url::Url;
 use uuid::Uuid;
@@ -45,7 +46,10 @@ use super::types::{
 pub struct AdRequest {
     pub ad_units: Vec<AdUnit>,
     pub config: Option<JsonValue>,
-    pub eids: Option<JsonValue>,
+    /// Browser EIDs, captured as raw JSON so a malformed entry (for example a
+    /// lone surrogate escape) cannot fail the whole body. Each entry is
+    /// validated on its own by the shared client EID parser.
+    pub eids: Option<Box<RawValue>>,
 }
 
 /// A single ad placement in an [`AdRequest`].
@@ -348,10 +352,30 @@ pub fn convert_to_openrtb_response(
     auction_request: &AuctionRequest,
     ec_allowed: bool,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    Ok(
-        convert_to_openrtb_response_with_report(result, settings, auction_request, ec_allowed)?
-            .response,
-    )
+    convert_to_openrtb_response_with_mirror(result, settings, auction_request, ec_allowed, None)
+}
+
+/// Like [`convert_to_openrtb_response`], carrying the `ts-eids-s` mirror
+/// payload as `ext.ts_eids_s` (spec 6.2).
+///
+/// # Errors
+///
+/// Returns an error if response serialization fails.
+pub(crate) fn convert_to_openrtb_response_with_mirror(
+    result: &OrchestrationResult,
+    settings: &Settings,
+    auction_request: &AuctionRequest,
+    ec_allowed: bool,
+    ts_eids_s: Option<serde_json::Value>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+    Ok(convert_to_openrtb_response_with_report(
+        result,
+        settings,
+        auction_request,
+        ec_allowed,
+        ts_eids_s,
+    )?
+    .response)
 }
 
 pub(crate) fn convert_to_openrtb_response_with_report(
@@ -359,8 +383,16 @@ pub(crate) fn convert_to_openrtb_response_with_report(
     settings: &Settings,
     auction_request: &AuctionRequest,
     ec_allowed: bool,
+    ts_eids_s: Option<serde_json::Value>,
 ) -> Result<OpenRtbResponseConversion, Report<TrustedServerError>> {
-    convert_to_openrtb_response_with_trace(result, settings, auction_request, ec_allowed, None)
+    convert_to_openrtb_response_with_trace(
+        result,
+        settings,
+        auction_request,
+        ec_allowed,
+        None,
+        ts_eids_s,
+    )
 }
 
 pub(crate) fn convert_to_openrtb_response_with_trace(
@@ -369,6 +401,7 @@ pub(crate) fn convert_to_openrtb_response_with_trace(
     auction_request: &AuctionRequest,
     ec_allowed: bool,
     trace: Option<&TraceAuctionCarry>,
+    ts_eids_s: Option<serde_json::Value>,
 ) -> Result<OpenRtbResponseConversion, Report<TrustedServerError>> {
     let mut seatbids = Vec::with_capacity(result.winning_bids.len());
     let rewrite_creatives = settings.auction.rewrite_creatives;
@@ -541,6 +574,7 @@ pub(crate) fn convert_to_openrtb_response_with_trace(
                 dropped_winner_count: delivery.dropped_winner_count,
                 dropped_winner_reasons: delivery.dropped_winner_reasons.clone(),
             },
+            ts_eids_s,
         }
         .to_ext(),
         ..Default::default()
@@ -595,12 +629,16 @@ mod tests {
         AuctionPlan, AuctionPlanConfig, NotificationConfig, ProviderConfig, ProviderId, RoutingMode,
     };
     use crate::auction::routing::route_auction;
+    use crate::auction::test_support::{
+        repeated_source_provenance_eids, repeated_source_provenance_eids_json,
+    };
     use crate::auction::types::{
         ApsRendererV1, ApsTagType, AuctionResponse, Bid, BidRenderer, BidStatus,
     };
     use crate::openrtb::{Eid, Uid};
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
+    use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
     use http::Method;
     use serde_json::json;
     use std::collections::{BTreeMap, BTreeSet, HashSet};
@@ -847,17 +885,44 @@ mod tests {
         );
     }
 
+    #[test]
+    fn eid_header_carries_provenance_fields_and_repeated_sources() {
+        let mut request = make_auction_request();
+        request.user.eids = Some(repeated_source_provenance_eids());
+
+        let response =
+            convert_to_openrtb_response(&make_empty_result(), &make_settings(), &request, true)
+                .expect("should build response");
+
+        let header = response
+            .headers()
+            .get(&HEADER_X_TS_EIDS)
+            .and_then(|value| value.to_str().ok())
+            .expect("should include x-ts-eids");
+        let decoded: serde_json::Value = serde_json::from_slice(
+            &BASE64
+                .decode(header)
+                .expect("should decode x-ts-eids base64"),
+        )
+        .expect("should parse x-ts-eids JSON");
+        assert_eq!(
+            decoded,
+            repeated_source_provenance_eids_json(),
+            "x-ts-eids should show both entries with their own EID-level fields"
+        );
+    }
+
     #[test]
     fn response_includes_eid_headers_when_eids_present() {
         let mut request = make_auction_request();
-        request.user.eids = Some(vec![Eid {
-            source: "ssp.com".to_owned(),
-            uids: vec![Uid {
+        request.user.eids = Some(vec![Eid::new(
+            "ssp.com".to_owned(),
+            vec![Uid {
                 id: "uid-1".to_owned(),
                 atype: Some(3),
                 ext: None,
             }],
-        }]);
+        )]);
 
         let settings = make_settings();
         let result = make_empty_result();
@@ -1634,9 +1699,14 @@ mod tests {
             metadata: HashMap::new(),
         };
 
-        let conversion =
-            convert_to_openrtb_response_with_report(&result, &settings, &auction_request, false)
-                .expect("should omit invalid winners and preserve valid slots");
+        let conversion = convert_to_openrtb_response_with_report(
+            &result,
+            &settings,
+            &auction_request,
+            false,
+            None,
+        )
+        .expect("should omit invalid winners and preserve valid slots");
         assert_eq!(
             conversion.delivery.delivered_winner_slots,
             HashSet::from(["ordinary".to_string(), "renderer".to_string()]),
@@ -1959,9 +2029,14 @@ mod tests {
         let auction_request = make_auction_request();
         let result = make_result(make_bid("div-gpt-top", "appnexus", None));
 
-        let conversion =
-            convert_to_openrtb_response_with_report(&result, &settings, &auction_request, false)
-                .expect("should omit a winner without a decoded price");
+        let conversion = convert_to_openrtb_response_with_report(
+            &result,
+            &settings,
+            &auction_request,
+            false,
+            None,
+        )
+        .expect("should omit a winner without a decoded price");
         assert!(conversion.delivery.delivered_winner_slots.is_empty());
         assert_eq!(conversion.delivery.dropped_winner_count, 1);
         assert_eq!(
@@ -2030,6 +2105,7 @@ mod tests {
                     &auction,
                     false,
                     Some(&carry),
+                    None,
                 )
                 .expect("should preserve ordinary response conversion");
 
@@ -2108,6 +2184,7 @@ mod tests {
                 &auction,
                 false,
                 Some(&carry),
+                None,
             )
             .expect("should not fail bids on trace projection failure");
 
@@ -2129,9 +2206,10 @@ mod tests {
             let auction = make_auction_request();
             let result = make_empty_result();
 
-            let conversion =
-                convert_to_openrtb_response_with_trace(&result, &settings, &auction, false, None)
-                    .expect("should preserve trace-off conversion");
+            let conversion = convert_to_openrtb_response_with_trace(
+                &result, &settings, &auction, false, None, None,
+            )
+            .expect("should preserve trace-off conversion");
 
             assert!(
                 !conversion
diff --git a/crates/trusted-server-core/src/auction/openrtb/tests.rs b/crates/trusted-server-core/src/auction/openrtb/tests.rs
index f47efa475e..1ed5683169 100644
--- a/crates/trusted-server-core/src/auction/openrtb/tests.rs
+++ b/crates/trusted-server-core/src/auction/openrtb/tests.rs
@@ -1569,3 +1569,18 @@ fn malformed_top_level_standard_response_is_error() {
     assert_eq!(response.status, BidStatus::Error);
     assert_eq!(response.metadata["error_type"], "parse_response");
 }
+
+#[test]
+fn standard_profile_forwards_eid_provenance_fields_and_repeated_sources() {
+    let mut request = canonical_parity_auction_request();
+    request.user.eids = Some(crate::auction::test_support::repeated_source_provenance_eids());
+
+    let built = build_with_request("standard", json!({}), request, None);
+
+    let serialized = serde_json::to_value(&built).expect("should serialize request");
+    assert_eq!(
+        serialized["user"]["ext"]["eids"],
+        crate::auction::test_support::repeated_source_provenance_eids_json(),
+        "config-first providers should receive both entries with their own EID-level fields"
+    );
+}
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index f665441723..81a7962db7 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -17,6 +17,7 @@ use super::openrtb::unused_bidder_params_count;
 use super::plan::AuctionPlan;
 use super::provider::{
     AuctionProvider, GenericOpenRtbProvider, ProviderParseState, ProviderRequestOutcome,
+    ProviderRequestStarted,
 };
 #[cfg(test)]
 use super::routing::RoutedAuction;
@@ -24,6 +25,7 @@ use super::routing::route_auction;
 use super::telemetry::AbandonedProviderCall;
 use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus};
 use crate::request_signing::RequestSigner;
+use crate::request_timing::{AuctionWaitPlacement, RequestTimings};
 use crate::trace::{
     TraceAuctionCarry, TraceAuctionTerminalReason, TraceAuctionTerminalStatus,
     TraceProviderObservation, TraceProviderRole,
@@ -38,6 +40,8 @@ use crate::trace::{
 /// the original auction budget.
 pub struct DispatchedAuction {
     pending_requests: Vec<PlatformPendingRequest>,
+    /// Whether dispatch started at least one provider request.
+    provider_launched: bool,
     backend_to_provider: HashMap<String, ProviderLaunchState>,
     planned_backend_to_provider: HashMap<String, PlannedLaunchState>,
     completed_responses: Vec<AuctionResponse>,
@@ -69,8 +73,10 @@ struct ProviderLaunchState {
 pub enum DispatchAuctionOutcome {
     /// No provider request was started and no provider failure was observed.
     NotStarted,
-    /// No provider request could be launched, but launch failures were observed.
+    /// Dispatch failed before collection, possibly after starting a request.
     DispatchFailed {
+        /// Whether any provider started a request before dispatch failed.
+        provider_launched: bool,
         /// Original auction request.
         request: AuctionRequest,
         /// Provider launch-failure responses.
@@ -89,7 +95,24 @@ pub enum DispatchAuctionOutcome {
     Dispatched(DispatchedAuction),
 }
 
+/// Synchronous execution failure, including outcomes needed by route telemetry.
+pub(crate) struct AuctionExecutionFailure {
+    /// Admission or dispatch error to propagate through the route's error boundary.
+    pub error: Report<TrustedServerError>,
+    /// Provider outcomes materialized before failure, for terminal telemetry.
+    pub provider_responses: Vec<AuctionResponse>,
+    /// Elapsed dispatch time, or execution time when dispatch returned `NotStarted`.
+    /// Excludes the caller's request parsing and targeting preparation.
+    pub elapsed_ms: u64,
+}
+
 impl DispatchedAuction {
+    /// Whether at least one provider request was started.
+    #[must_use]
+    pub fn has_provider_launch(&self) -> bool {
+        self.provider_launched
+    }
+
     /// Consume the dispatch token without collecting provider responses.
     #[must_use]
     pub fn abandon(
@@ -138,9 +161,20 @@ impl DispatchedAuction {
 
 #[cfg(test)]
 impl DispatchedAuction {
+    /// Creates a token modeling a started provider request that resolved to no bid.
+    pub(crate) fn launched_no_bid_for_test(request: AuctionRequest, timeout_ms: u32) -> Self {
+        let mut dispatched = Self::empty_for_test(request, timeout_ms);
+        dispatched.provider_launched = true;
+        dispatched
+            .completed_responses
+            .push(AuctionResponse::no_bid("example", 0));
+        dispatched
+    }
+
     pub(crate) fn empty_for_test(request: AuctionRequest, timeout_ms: u32) -> Self {
         Self {
             pending_requests: Vec::new(),
+            provider_launched: false,
             backend_to_provider: HashMap::new(),
             planned_backend_to_provider: HashMap::new(),
             completed_responses: Vec::new(),
@@ -909,41 +943,119 @@ impl AuctionOrchestrator {
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
     ) -> Result<OrchestrationResult, Report<TrustedServerError>> {
+        self.execute_auction(request, context, None)
+            .await
+            .map(|(result, _)| result)
+            .map_err(|failure| failure.error)
+    }
+
+    /// Execute a synchronous route auction with request-clock collection timing.
+    ///
+    /// Returns the result and whether any provider or mediator request started.
+    /// The bool stays false for Immediate, routing-only, and empty-plan results.
+    /// Only provider launches during dispatch stamp the dispatch offset; actual
+    /// upstream work during collection records wait and resolution timing.
+    ///
+    /// # Errors
+    /// Returns admission or dispatch failures with their provider outcomes and
+    /// elapsed time for route telemetry. Failed dispatch never records collection.
+    pub(crate) async fn run_auction_with_timings(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+        timings: &RequestTimings,
+    ) -> Result<(OrchestrationResult, bool), AuctionExecutionFailure> {
+        self.execute_auction(request, context, Some(timings)).await
+    }
+
+    async fn execute_auction(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+        timings: Option<&RequestTimings>,
+    ) -> Result<(OrchestrationResult, bool), AuctionExecutionFailure> {
         let trace = context.request.extensions().get::<TraceAuctionCarry>();
         let _trace_guard = trace.map(TraceAuctionCarry::cancellation_guard);
-        match self.dispatch_planned_auction(request, context).await {
-            DispatchAuctionOutcome::Dispatched(dispatched) => Ok(self
-                .collect_dispatched_auction(dispatched, context.services, context)
-                .await),
+        let started = Instant::now();
+        #[cfg(test)]
+        let outcome = if self.plan_backed {
+            self.dispatch_planned_auction(request, context).await
+        } else {
+            self.dispatch_auction(request, context).await
+        };
+        #[cfg(not(test))]
+        let outcome = self.dispatch_planned_auction(request, context).await;
+        match outcome {
+            DispatchAuctionOutcome::Dispatched(dispatched) => {
+                if dispatched.has_provider_launch()
+                    && let Some(timings) = timings
+                {
+                    timings.mark_auction_dispatched();
+                }
+                Ok(self
+                    .collect_with_timing(
+                        dispatched,
+                        context.services,
+                        context,
+                        timings.map(|timings| (timings, AuctionWaitPlacement::PreHeader)),
+                    )
+                    .await)
+            }
             DispatchAuctionOutcome::DispatchFailed {
+                provider_launched,
+                provider_responses,
                 fatal_admission_error,
+                elapsed_ms,
                 ..
             } => {
                 if let Some(trace) = trace {
                     trace.finish_dispatch_failed(false);
                 }
-                if let Some(error) = fatal_admission_error {
-                    return Err(error.change_context(TrustedServerError::Auction {
-                        message: "Planned auction admission failed".to_string(),
-                    }));
+                if provider_launched && let Some(timings) = timings {
+                    timings.mark_auction_dispatched();
                 }
-                Err(Report::new(TrustedServerError::Auction {
-                    message: "All eligible planned provider requests failed to launch".to_string(),
-                }))
+                Err(AuctionExecutionFailure {
+                    error: fatal_admission_error
+                        .map(|error| {
+                            error.change_context(TrustedServerError::Auction {
+                                message: "Planned auction admission failed".to_string(),
+                            })
+                        })
+                        .unwrap_or_else(|| {
+                            Report::new(TrustedServerError::Auction {
+                                message: "All eligible planned provider requests failed to launch"
+                                    .to_string(),
+                            })
+                        }),
+                    provider_responses,
+                    elapsed_ms,
+                })
             }
             DispatchAuctionOutcome::NotStarted => {
-                if self.planned_providers.is_empty() {
+                #[cfg(test)]
+                let has_providers = if self.plan_backed {
+                    !self.planned_providers.is_empty()
+                } else {
+                    !self.config.providers.is_empty()
+                };
+                #[cfg(not(test))]
+                let has_providers = !self.planned_providers.is_empty();
+                if has_providers {
                     if let Some(trace) = trace {
-                        trace.finish(TraceAuctionTerminalStatus::Completed, None);
+                        trace.finish_dispatch_failed(true);
                     }
-                    Ok(OrchestrationResult::no_bid())
+                    Err(AuctionExecutionFailure {
+                        error: Report::new(TrustedServerError::Auction {
+                            message: "No planned provider request was started".to_string(),
+                        }),
+                        provider_responses: Vec::new(),
+                        elapsed_ms: started.elapsed().as_millis() as u64,
+                    })
                 } else {
                     if let Some(trace) = trace {
-                        trace.finish_dispatch_failed(true);
+                        trace.finish(TraceAuctionTerminalStatus::Completed, None);
                     }
-                    Err(Report::new(TrustedServerError::Auction {
-                        message: "No planned provider request was started".to_string(),
-                    }))
+                    Ok((OrchestrationResult::no_bid(), false))
                 }
             }
         }
@@ -1775,6 +1887,7 @@ impl AuctionOrchestrator {
                         .unwrap_or(usize::MAX)
                 });
                 return DispatchAuctionOutcome::DispatchFailed {
+                    provider_launched: false,
                     request: request.clone(),
                     provider_responses,
                     fatal_admission_error: Some(error),
@@ -1798,6 +1911,7 @@ impl AuctionOrchestrator {
         let mut planned_backend_to_provider = HashMap::new();
         let mut reserved_backend_names = HashSet::new();
         let mut immediate_response_count = 0usize;
+        let mut provider_launch_count = 0usize;
         let mut launch_failure_count = 0usize;
 
         for input in routed.inputs() {
@@ -1856,6 +1970,7 @@ impl AuctionOrchestrator {
                     request: pending,
                     parse_state,
                 }) => {
+                    provider_launch_count += 1;
                     let Some(backend_name) = pending.backend_name().map(str::to_string) else {
                         if let (Some(trace), Some(observation)) = (&trace, trace_observation) {
                             trace.observe_failure(observation);
@@ -1893,6 +2008,8 @@ impl AuctionOrchestrator {
                     if let (Some(trace), Some(observation)) = (&trace, trace_observation) {
                         trace.observe_response(observation, &response);
                     }
+                    // Planned providers use Immediate for routing-only skips such
+                    // as NoImpressions; no request left the edge.
                     immediate_response_count += 1;
                     completed_responses.push(response);
                 }
@@ -1900,6 +2017,8 @@ impl AuctionOrchestrator {
                     if let (Some(trace), Some(observation)) = (&trace, trace_observation) {
                         trace.observe_failure(observation);
                     }
+                    provider_launch_count +=
+                        usize::from(error.contains::<ProviderRequestStarted>());
                     log::warn!(
                         "Planned provider '{}' failed to dispatch: {error:?}",
                         provider.provider_name()
@@ -1931,6 +2050,7 @@ impl AuctionOrchestrator {
                         .unwrap_or(usize::MAX)
                 });
                 return DispatchAuctionOutcome::DispatchFailed {
+                    provider_launched: provider_launch_count > 0,
                     request: request.clone(),
                     provider_responses: completed_responses,
                     fatal_admission_error: None,
@@ -1944,6 +2064,7 @@ impl AuctionOrchestrator {
         }
 
         DispatchAuctionOutcome::Dispatched(DispatchedAuction {
+            provider_launched: provider_launch_count > 0,
             pending_requests,
             backend_to_provider: HashMap::new(),
             planned_backend_to_provider,
@@ -1970,10 +2091,12 @@ impl AuctionOrchestrator {
     /// [`DispatchedAuction`] token. The Fastly host begins the SSP round-trips
     /// while WASM continues to `pending_origin.wait()`.
     ///
-    /// Returns [`DispatchAuctionOutcome::NotStarted`] when no providers are configured or
-    /// all providers are disabled / over budget. Returns
-    /// [`DispatchAuctionOutcome::DispatchFailed`] when provider launch attempts
-    /// happened but none could be started.
+    /// Returns [`DispatchAuctionOutcome::NotStarted`] when the auction is disabled
+    /// or has no providers to execute. Routing-only skips can instead yield a
+    /// [`DispatchAuctionOutcome::Dispatched`] token with immediate responses but
+    /// no provider launch. Admission or launch failures can yield
+    /// [`DispatchAuctionOutcome::DispatchFailed`]; its `provider_launched` flag
+    /// preserves evidence of requests that started before a later failure.
     #[must_use]
     pub async fn dispatch_auction(
         &self,
@@ -2054,8 +2177,12 @@ impl AuctionOrchestrator {
         let completed_responses: Vec<AuctionResponse> = Vec::new();
         #[cfg(test)]
         let mut immediate_response_count = 0usize;
+        #[cfg(test)]
+        let mut provider_launch_count = 0usize;
         #[cfg(not(test))]
         let immediate_response_count = 0usize;
+        #[cfg(not(test))]
+        let provider_launch_count = 0usize;
 
         #[cfg(test)]
         for provider_name in &provider_names {
@@ -2126,6 +2253,10 @@ impl AuctionOrchestrator {
                     request: pending,
                     parse_state,
                 }) => {
+                    #[cfg(test)]
+                    {
+                        provider_launch_count += 1;
+                    }
                     let backend_name = pending.backend_name().map(str::to_string).or_else(|| {
                         if let Some(backend_name) = predicted_backend_name.as_ref() {
                             log::warn!(
@@ -2183,6 +2314,7 @@ impl AuctionOrchestrator {
                     completed_responses.push(response);
                 }
                 Err(e) => {
+                    provider_launch_count += usize::from(e.contains::<ProviderRequestStarted>());
                     let response_time_ms = start_time.elapsed().as_millis() as u64;
                     log::warn!(
                         "Provider '{}' failed to dispatch request: {:?}",
@@ -2202,6 +2334,7 @@ impl AuctionOrchestrator {
                 DispatchAuctionOutcome::NotStarted
             } else {
                 DispatchAuctionOutcome::DispatchFailed {
+                    provider_launched: provider_launch_count > 0,
                     request: request.clone(),
                     provider_responses: completed_responses,
                     fatal_admission_error: None,
@@ -2220,6 +2353,7 @@ impl AuctionOrchestrator {
         );
 
         DispatchAuctionOutcome::Dispatched(DispatchedAuction {
+            provider_launched: provider_launch_count > 0,
             pending_requests,
             backend_to_provider,
             planned_backend_to_provider: HashMap::new(),
@@ -2255,9 +2389,64 @@ impl AuctionOrchestrator {
         dispatched: DispatchedAuction,
         services: &RuntimeServices,
         context: &AuctionContext<'_>,
+    ) -> OrchestrationResult {
+        self.collect_with_timing(dispatched, services, context, None)
+            .await
+            .0
+    }
+
+    /// Collect with measured wait placement and explicit provider/mediator launch evidence.
+    ///
+    /// Returns the result and whether a provider or mediator request started,
+    /// including post-start failures. The bool stays false for Immediate and
+    /// routing-only outcomes. Wait and resolution are recorded only when true;
+    /// mediator-only work does not fabricate a provider dispatch offset.
+    pub(crate) async fn collect_dispatched_auction_with_timings(
+        &self,
+        dispatched: DispatchedAuction,
+        services: &RuntimeServices,
+        context: &AuctionContext<'_>,
+        timings: &RequestTimings,
+        placement: AuctionWaitPlacement,
+    ) -> (OrchestrationResult, bool) {
+        self.collect_with_timing(dispatched, services, context, Some((timings, placement)))
+            .await
+    }
+
+    async fn collect_with_timing(
+        &self,
+        dispatched: DispatchedAuction,
+        services: &RuntimeServices,
+        context: &AuctionContext<'_>,
+        timing: Option<(&RequestTimings, AuctionWaitPlacement)>,
+    ) -> (OrchestrationResult, bool) {
+        let mut auction_work_started = dispatched.has_provider_launch();
+        let wait_started = Instant::now();
+        let result = self
+            .collect_dispatched_auction_inner(
+                dispatched,
+                services,
+                context,
+                &mut auction_work_started,
+            )
+            .await;
+        if auction_work_started && let Some((timings, placement)) = timing {
+            timings.record_auction_wait(placement, wait_started.elapsed());
+            timings.mark_auction_resolved();
+        }
+        (result, auction_work_started)
+    }
+
+    async fn collect_dispatched_auction_inner(
+        &self,
+        dispatched: DispatchedAuction,
+        services: &RuntimeServices,
+        context: &AuctionContext<'_>,
+        auction_work_started: &mut bool,
     ) -> OrchestrationResult {
         let DispatchedAuction {
             pending_requests,
+            provider_launched: _,
             mut backend_to_provider,
             mut planned_backend_to_provider,
             completed_responses,
@@ -2596,7 +2785,9 @@ impl AuctionOrchestrator {
                     .request_bids(&request, &mediator_context)
                     .await
                 {
-                    Ok(_) if Instant::now() >= mediator_deadline => {
+                    Ok(outcome) if Instant::now() >= mediator_deadline => {
+                        *auction_work_started |=
+                            matches!(outcome, ProviderRequestOutcome::Pending { .. });
                         log::debug!(
                             "Mediator '{}' exhausted its response budget during launch; using local ranking",
                             mediator.provider_name()
@@ -2613,66 +2804,70 @@ impl AuctionOrchestrator {
                     Ok(ProviderRequestOutcome::Pending {
                         request: pending,
                         parse_state,
-                    }) => match services
-                        .http_client()
-                        .wait_until(pending, mediator_deadline)
-                        .await
-                    {
-                        Ok(platform_resp) => {
-                            let response_time_ms = mediator_start.elapsed().as_millis() as u64;
-                            if Instant::now() >= mediator_deadline {
-                                log::debug!(
-                                    "Mediator '{}' completed after its response deadline; using local ranking ({}ms)",
-                                    mediator.provider_name(),
-                                    response_time_ms
-                                );
-                                None
-                            } else {
-                                match mediator
-                                    .parse_response_with_context_and_state(
-                                        platform_resp,
-                                        response_time_ms,
-                                        &request,
-                                        &mediator_context,
-                                        parse_state.as_deref(),
-                                    )
-                                    .await
-                                {
-                                    Ok(response) => {
-                                        if let (Some(trace), Some(observation)) =
-                                            (&trace, trace_observation.take())
-                                        {
-                                            trace.observe_response(observation, &response);
+                    }) => {
+                        *auction_work_started = true;
+                        match services
+                            .http_client()
+                            .wait_until(pending, mediator_deadline)
+                            .await
+                        {
+                            Ok(platform_resp) => {
+                                let response_time_ms = mediator_start.elapsed().as_millis() as u64;
+                                if Instant::now() >= mediator_deadline {
+                                    log::debug!(
+                                        "Mediator '{}' completed after its response deadline; using local ranking ({}ms)",
+                                        mediator.provider_name(),
+                                        response_time_ms
+                                    );
+                                    None
+                                } else {
+                                    match mediator
+                                        .parse_response_with_context_and_state(
+                                            platform_resp,
+                                            response_time_ms,
+                                            &request,
+                                            &mediator_context,
+                                            parse_state.as_deref(),
+                                        )
+                                        .await
+                                    {
+                                        Ok(response) => {
+                                            if let (Some(trace), Some(observation)) =
+                                                (&trace, trace_observation.take())
+                                            {
+                                                trace.observe_response(observation, &response);
+                                            }
+                                            Some(response)
+                                        }
+                                        Err(error) => {
+                                            log::warn!(
+                                                "Mediator '{}' parse failed: {:?}",
+                                                mediator.provider_name(),
+                                                error
+                                            );
+                                            None
                                         }
-                                        Some(response)
-                                    }
-                                    Err(error) => {
-                                        log::warn!(
-                                            "Mediator '{}' parse failed: {:?}",
-                                            mediator.provider_name(),
-                                            error
-                                        );
-                                        None
                                     }
                                 }
                             }
-                        }
-                        Err(error) => {
-                            if matches!(
-                                error.current_context(),
-                                crate::platform::PlatformError::DeadlineExceeded
-                            ) {
-                                log::debug!(
-                                    "Mediator '{}' exhausted its response budget; using local ranking",
-                                    mediator.provider_name()
-                                );
-                            } else {
-                                log::warn!("Mediator request failed: {:?}", error);
+                            Err(error) => {
+                                if matches!(
+                                    error.current_context(),
+                                    crate::platform::PlatformError::DeadlineExceeded
+                                ) {
+                                    log::debug!(
+                                        "Mediator '{}' exhausted its response budget; using local ranking",
+                                        mediator.provider_name()
+                                    );
+                                } else {
+                                    log::warn!("Mediator request failed: {:?}", error);
+                                }
+                                None
                             }
-                            None
                         }
-                    },
+                    }
                     Err(error) => {
+                        *auction_work_started |= error.contains::<ProviderRequestStarted>();
                         log::warn!(
                             "Mediator '{}' failed to dispatch: {:?}",
                             mediator.provider_name(),
@@ -2959,6 +3154,7 @@ mod tests {
 
     mod trace_auction_live_tests {
         use super::*;
+        use crate::request_timing::RequestTimings;
         use crate::trace::{TraceAuctionCarry, TraceAuctionSource};
         use edgezero_core::body::Body as EdgeBody;
         use http::Request;
@@ -2996,7 +3192,7 @@ mod tests {
             let services = build_services_with_http_client(Arc::clone(&http) as Arc<_>);
             let settings = create_test_settings();
             let request = planned_request();
-            for split in [false, true] {
+            for (split, timed) in [(false, false), (false, true), (true, false)] {
                 let (inbound, carry) = captured_request(&request);
                 let token = carry.token();
                 let context = AuctionContext {
@@ -3016,10 +3212,16 @@ mod tests {
                         "should preserve the ordinary split outcome"
                     );
                 } else {
-                    let result = orchestrator
-                        .run_auction(&request, &context)
-                        .await
-                        .expect("should preserve successful empty-plan execution");
+                    let result = if timed {
+                        orchestrator
+                            .run_auction_with_timings(&request, &context, &RequestTimings::new())
+                            .await
+                            .map(|(result, _)| result)
+                            .map_err(|failure| failure.error)
+                    } else {
+                        orchestrator.run_auction(&request, &context).await
+                    }
+                    .expect("should preserve successful empty-plan execution");
                     assert!(
                         result.winning_bids.is_empty(),
                         "should preserve an ordinary zero-bid result"
@@ -3617,6 +3819,10 @@ mod tests {
                 else {
                     panic!("all-skipped auction should produce a completed dispatch token");
                 };
+                assert!(
+                    !dispatched.has_provider_launch(),
+                    "routing-only skipped outcomes must not claim a provider launch"
+                );
                 orchestrator
                     .collect_dispatched_auction(dispatched, &services, &context)
                     .await
@@ -5199,6 +5405,10 @@ mod tests {
         else {
             panic!("enabled immediate provider should dispatch");
         };
+        assert!(
+            !dispatched.has_provider_launch(),
+            "should not count an immediate no-bid response as a provider request"
+        );
         let result = orchestrator
             .collect_dispatched_auction(dispatched, &services, &context)
             .await;
@@ -6247,6 +6457,108 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn planned_no_impressions_immediate_outcome_is_not_a_provider_launch() {
+        let http = Arc::new(StubHttpClient::new());
+        let backend = Arc::new(NamingBackend::new(BackendNamingPolicy::Axum));
+        let services = build_services_with_backend_and_http_client(
+            Arc::clone(&backend) as Arc<_>,
+            Arc::clone(&http) as Arc<_>,
+        );
+        let mut config = planned_prebid_config(&[(
+            "pbs-a",
+            serde_json::json!({}),
+            NotificationConfig::default(),
+        )]);
+        config.bidders.insert(
+            "alpha".parse().expect("should parse bidder ID"),
+            crate::auction::plan::BidderRouteConfig {
+                provider: "pbs-a".parse().expect("should parse provider ID"),
+            },
+        );
+        let orchestrator = AuctionOrchestrator::from_plan(
+            Arc::new(AuctionPlan::compile(config).expect("should compile PBS plan")),
+            None,
+        );
+        let mut request = planned_prebid_request();
+        request.slots[0].bidders.insert(
+            "trustedServer".to_string(),
+            serde_json::json!({"storedRequest":false,"bidderParams":{"alpha":{}}}),
+        );
+        let settings = create_test_settings();
+        let inbound = http::Request::new(edgezero_core::body::Body::empty());
+        let context = AuctionContext {
+            settings: &settings,
+            request: &inbound,
+            timeout_ms: 777,
+            transport_timeout_ms: 777,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let DispatchAuctionOutcome::Dispatched(dispatched) =
+            orchestrator.dispatch_auction(&request, &context).await
+        else {
+            panic!("should retain the routing-only provider response for collection");
+        };
+        assert_eq!(
+            http.recorded_backend_names().len(),
+            0,
+            "should not start an outbound request for NoImpressions"
+        );
+        assert!(
+            !dispatched.has_provider_launch(),
+            "should not establish launch evidence for a routing-only Immediate response"
+        );
+        assert_eq!(
+            dispatched.completed_responses[0].metadata["routing"]["skipped_no_usable_demand"], true,
+            "should retain the routing skip response for collection"
+        );
+    }
+
+    #[tokio::test]
+    async fn planned_started_request_keeps_launch_evidence_after_backend_bookkeeping_failure() {
+        let http = Arc::new(StubHttpClient::new());
+        http.push_response(204, Vec::new());
+        http.push_pending_backend_name_override(None);
+        let backend = Arc::new(NamingBackend::new(BackendNamingPolicy::Axum));
+        let services = build_services_with_backend_and_http_client(
+            Arc::clone(&backend) as Arc<_>,
+            Arc::clone(&http) as Arc<_>,
+        );
+        let plan = Arc::new(
+            AuctionPlan::compile(planned_config(
+                &[("provider-a", RoutingMode::AllEligible)],
+                false,
+            ))
+            .expect("should compile planned auction"),
+        );
+        let orchestrator = AuctionOrchestrator::from_plan(plan, None);
+        let request = planned_request();
+        let settings = create_test_settings();
+        let inbound = http::Request::new(edgezero_core::body::Body::empty());
+        let context = AuctionContext {
+            settings: &settings,
+            request: &inbound,
+            timeout_ms: 777,
+            transport_timeout_ms: 777,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let DispatchAuctionOutcome::DispatchFailed {
+            provider_launched, ..
+        } = orchestrator.dispatch_auction(&request, &context).await
+        else {
+            panic!("missing backend bookkeeping should fail dispatch");
+        };
+        assert_eq!(http.recorded_backend_names().len(), 1);
+        assert!(
+            provider_launched,
+            "should retain launch evidence for a started request when bookkeeping fails"
+        );
+    }
+
     #[tokio::test]
     async fn planned_dispatch_does_not_snapshot_inbound_headers() {
         let http = Arc::new(StubHttpClient::new());
diff --git a/crates/trusted-server-core/src/auction/plan.rs b/crates/trusted-server-core/src/auction/plan.rs
index df36fc09b7..9bd739fc5a 100644
--- a/crates/trusted-server-core/src/auction/plan.rs
+++ b/crates/trusted-server-core/src/auction/plan.rs
@@ -396,6 +396,7 @@ impl ProviderPlan {
             certificate_check: true,
             first_byte_timeout: timeout,
             between_bytes_timeout: timeout,
+            connect_timeout: None,
             discriminator: Some(self.id.as_str().to_owned()),
         }
     }
diff --git a/crates/trusted-server-core/src/auction/provider.rs b/crates/trusted-server-core/src/auction/provider.rs
index d68ebde4d8..b8782ec944 100644
--- a/crates/trusted-server-core/src/auction/provider.rs
+++ b/crates/trusted-server-core/src/auction/provider.rs
@@ -29,6 +29,89 @@ use super::types::{AuctionContext, AuctionRequest, AuctionResponse};
 
 const MAX_PLANNED_RESPONSE_BYTES: usize = 1024 * 1024;
 
+#[cfg(test)]
+pub(crate) mod test_support {
+    use super::*;
+
+    /// Exercises launch evidence through real route dispatch and collection.
+    #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+    pub(crate) enum LaunchEvidenceProvider {
+        Immediate,
+        FailBeforeStart,
+        FailAfterStart,
+        Pending,
+    }
+
+    #[async_trait(?Send)]
+    impl AuctionProvider for LaunchEvidenceProvider {
+        fn provider_name(&self) -> &str {
+            "launch-evidence"
+        }
+
+        async fn request_bids(
+            &self,
+            _request: &AuctionRequest,
+            context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            if *self == Self::Immediate {
+                return Ok(ProviderRequestOutcome::Immediate(AuctionResponse::no_bid(
+                    self.provider_name(),
+                    0,
+                )));
+            }
+            let failure = || {
+                Report::new(TrustedServerError::Auction {
+                    message: "Launch evidence test failure".to_string(),
+                })
+            };
+            if *self == Self::FailBeforeStart {
+                return Err(failure());
+            }
+            let outbound = Request::builder()
+                .uri("https://mediator.example.com/auction")
+                .body(EdgeBody::empty())
+                .expect("should construct mediator request");
+            let pending = context
+                .services
+                .http_client()
+                .send_async(PlatformHttpRequest::new(
+                    outbound,
+                    "launch-evidence-backend",
+                ))
+                .await
+                .change_context(TrustedServerError::Auction {
+                    message: "Launch evidence request failed".to_string(),
+                })?;
+            if *self == Self::FailAfterStart {
+                return Err(failure().attach_opaque(ProviderRequestStarted));
+            }
+            Ok(ProviderRequestOutcome::pending(pending))
+        }
+
+        async fn parse_response(
+            &self,
+            _response: PlatformResponse,
+            response_time_ms: u64,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            Ok(AuctionResponse::no_bid(
+                self.provider_name(),
+                response_time_ms,
+            ))
+        }
+
+        fn timeout_ms(&self) -> u32 {
+            1_000
+        }
+    }
+}
+
+/// Evidence attached to provider or mediator errors after a request started.
+///
+/// `Immediate` never proves launch. Implementations that fail after a successful
+/// `send_async` must attach this marker so collection retains that evidence.
+#[derive(Debug)]
+pub(crate) struct ProviderRequestStarted;
+
 fn attach_provider_routing_metadata(
     response: &mut AuctionResponse,
     profile: &CompiledOpenRtbProfile,
@@ -397,7 +480,8 @@ impl GenericOpenRtbProvider {
                     "Provider {} pending request backend did not match registered backend",
                     self.provider_name()
                 ),
-            }));
+            })
+            .attach_opaque(ProviderRequestStarted));
         }
         let parse_state = match &self.plan.profile {
             CompiledOpenRtbProfile::Standard(_) => GenericOpenRtbParseState::Standard {
diff --git a/crates/trusted-server-core/src/auction/test_support.rs b/crates/trusted-server-core/src/auction/test_support.rs
index a83f8899a8..5d44d906a1 100644
--- a/crates/trusted-server-core/src/auction/test_support.rs
+++ b/crates/trusted-server-core/src/auction/test_support.rs
@@ -92,14 +92,14 @@ pub(crate) fn canonical_parity_auction_request() -> AuctionRequest {
                 raw_ac_string: Some("fictional-ac".to_string()),
                 ..Default::default()
             }),
-            eids: Some(vec![Eid {
-                source: "identity.example".to_string(),
-                uids: vec![Uid {
+            eids: Some(vec![Eid::new(
+                "identity.example".to_string(),
+                vec![Uid {
                     id: "fictional-uid".to_string(),
                     atype: Some(1),
                     ext: None,
                 }],
-            }]),
+            )]),
         },
         device: Some(DeviceInfo {
             user_agent: Some("Fictional Browser".to_string()),
@@ -119,3 +119,56 @@ pub(crate) fn canonical_parity_auction_request() -> AuctionRequest {
         context: HashMap::new(),
     }
 }
+
+/// Two entries for one source with different EID-level fields, the way
+/// Prebid sends them (spec 3.2), for outbound serialization tests.
+pub(crate) fn repeated_source_provenance_eids() -> Vec<Eid> {
+    vec![
+        Eid {
+            source: "ids.example.com".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
+            }],
+            inserter: Some("inserter-a.example.com".to_string()),
+            matcher: Some("ids.example.com".to_string()),
+            mm: Some(4),
+            ext: None,
+        },
+        Eid {
+            source: "ids.example.com".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
+            }],
+            inserter: Some("inserter-b.example.com".to_string()),
+            matcher: Some("matcher-b.example.com".to_string()),
+            mm: Some(2),
+            ext: Some(json!({ "segments": ["s1"] })),
+        },
+    ]
+}
+
+/// [`repeated_source_provenance_eids`] as the JSON every outbound path must
+/// emit in `user.ext.eids`.
+pub(crate) fn repeated_source_provenance_eids_json() -> serde_json::Value {
+    json!([
+        {
+            "source": "ids.example.com",
+            "uids": [{ "id": "fictional-uid", "atype": 1 }],
+            "inserter": "inserter-a.example.com",
+            "matcher": "ids.example.com",
+            "mm": 4
+        },
+        {
+            "source": "ids.example.com",
+            "uids": [{ "id": "fictional-uid", "atype": 1 }],
+            "inserter": "inserter-b.example.com",
+            "matcher": "matcher-b.example.com",
+            "mm": 2,
+            "ext": { "segments": ["s1"] }
+        }
+    ])
+}
diff --git a/crates/trusted-server-core/src/cache_policy.rs b/crates/trusted-server-core/src/cache_policy.rs
index 4d920f54a6..cc1427beb3 100644
--- a/crates/trusted-server-core/src/cache_policy.rs
+++ b/crates/trusted-server-core/src/cache_policy.rs
@@ -289,15 +289,18 @@ pub fn is_edge_cache_header_name(name: &str) -> bool {
 /// as `not-private` or `no-storey` do not match `private` / `no-store`.
 #[must_use]
 pub fn cache_control_value_has_directive(value: &str, directive: &str) -> bool {
-    let part_has_directive = |part: &str| {
+    cache_control_value_matches(value, |part| {
         let part = part.trim();
         let directive_name = part
             .find(['=', ';'])
             .map_or(part, |end| &part[..end])
             .trim();
         directive_name.eq_ignore_ascii_case(directive)
-    };
+    })
+}
 
+/// Tests comma-delimited directives without splitting quoted values.
+fn cache_control_value_matches(value: &str, part_matches: impl Fn(&str) -> bool) -> bool {
     let mut quoted = false;
     let mut escaped = false;
     let mut part_start = 0;
@@ -313,14 +316,14 @@ pub fn cache_control_value_has_directive(value: &str, directive: &str) -> bool {
         } else if character == '"' {
             quoted = true;
         } else if character == ',' {
-            if part_has_directive(&value[part_start..index]) {
+            if part_matches(&value[part_start..index]) {
                 return true;
             }
             part_start = index + character.len_utf8();
         }
     }
 
-    part_has_directive(&value[part_start..])
+    part_matches(&value[part_start..])
 }
 
 /// Return true when any `Cache-Control` header value contains `directive`.
@@ -333,13 +336,33 @@ pub fn cache_control_headers_have_directive(headers: &HeaderMap, directive: &str
         .any(|value| cache_control_value_has_directive(value, directive))
 }
 
-/// Return true when response cache-control contains exact `private` or `no-store`.
+/// Return true when response cache-control contains `private` or `no-store`,
+/// including directives with arguments.
 #[must_use]
 pub fn cache_control_headers_are_private_or_no_store(headers: &HeaderMap) -> bool {
     cache_control_headers_have_directive(headers, "private")
         || cache_control_headers_have_directive(headers, "no-store")
 }
 
+/// Return true when response cache-control contains a bare `private` or `no-store`.
+///
+/// Field-qualified `private` restricts only named headers, not the whole response,
+/// so it is insufficient permission to append request-specific timing headers.
+/// Directive-shaped text inside quoted values is not a bare directive.
+#[must_use]
+pub(crate) fn cache_control_headers_have_bare_private_or_no_store(headers: &HeaderMap) -> bool {
+    headers
+        .get_all(header::CACHE_CONTROL)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .any(|value| {
+            cache_control_value_matches(value, |part| {
+                let part = part.trim();
+                part.eq_ignore_ascii_case("private") || part.eq_ignore_ascii_case("no-store")
+            })
+        })
+}
+
 /// Apply `Cache-Control: no-store, private` and strip all shared-cache headers.
 ///
 /// # Panics
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index 059d500092..24f84ff8a8 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -9,10 +9,13 @@
 use std::borrow::Cow;
 
 use edgezero_core::app_config::{SecretField, SecretKind, SecretPathSegment};
-use error_stack::Report;
+use error_stack::{Report, ResultExt as _};
+use serde::de::DeserializeOwned;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use validator::{Validate, ValidationError, ValidationErrors};
 
+use crate::ec::identity::ProviderDescriptor;
+use crate::ec::identity::provider::IdentityProviderConfig;
 use crate::ec::registry::PartnerRegistry;
 use crate::error::TrustedServerError;
 use crate::integrations::{
@@ -32,7 +35,15 @@ use crate::integrations::{
     sourcepoint::SourcepointConfig,
     testlight::TestlightConfig,
 };
-use crate::settings::{AssetOriginAuth, IntegrationConfig, Settings};
+use crate::settings::{
+    AssetOriginAuth, IdentitySettings, IntegrationConfig, ProviderMode, Settings,
+};
+
+/// Largest `[ec.identity].hold_budget_ms`.
+const MAX_HOLD_BUDGET_MS: u64 = 1000;
+
+/// Largest `after_send_timeout_ms` of a provider.
+const MAX_AFTER_SEND_TIMEOUT_MS: u64 = 10_000;
 
 const DEPLOY_VALIDATION_FIELD: &str = "trusted_server";
 #[cfg(test)]
@@ -193,6 +204,10 @@ impl edgezero_core::app_config::AppConfigMeta for TrustedServerAppConfig {
                 vec![optional_object("tinybird"), object("auction_token_secret")],
                 true,
             ),
+            field(
+                vec![optional_object("tinybird"), object("access_token_secret")],
+                true,
+            ),
             field(
                 vec![
                     optional_object("integrations"),
@@ -268,6 +283,13 @@ pub fn validate_settings_for_deploy(settings: &Settings) -> Result<(), Report<Tr
     let plan = crate::auction::compile_auction_plan(settings)?;
     validate_enabled_integrations(settings, &plan, false)?;
     PartnerRegistry::validate_config_for_deploy(&settings.ec.partners)?;
+    validate_identity_settings(&settings.ec.identity)?;
+    validate_removed_keys(settings)?;
+    crate::ec::identity::catalog::validate_identity_catalog(
+        &identity_descriptors_for_deploy(settings)?,
+        &settings.ec.partners,
+        &settings.ec.identity,
+    )?;
     Ok(())
 }
 
@@ -287,6 +309,153 @@ pub fn validate_settings_for_runtime(
     let plan = crate::auction::compile_auction_plan(settings)?;
     validate_enabled_integrations(settings, &plan, true)?;
     PartnerRegistry::from_config(&settings.ec.partners).map(|_| ())?;
+    validate_identity_settings(&settings.ec.identity)?;
+    validate_removed_keys(settings)?;
+    crate::ec::identity::catalog::validate_identity_catalog(
+        &identity_descriptors_for_deploy(settings)?,
+        &settings.ec.partners,
+        &settings.ec.identity,
+    )?;
+    Ok(())
+}
+
+/// Every identity provider descriptor a deploy declares, built from
+/// settings alone.
+///
+/// It holds the generic pull descriptors from `settings.ec.partners`, which
+/// carry no secret, then one line per identity integration. No production
+/// integration has a line yet. Tests list the fictional `exampleid`
+/// integration so the list's shape is exercised.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::Configuration`] when a pull partner or an
+/// enabled identity integration cannot be described.
+pub(crate) fn identity_descriptors_for_deploy(
+    settings: &Settings,
+) -> Result<Vec<ProviderDescriptor>, Report<TrustedServerError>> {
+    #[allow(unused_mut)]
+    let mut descriptors =
+        crate::ec::identity::generic_pull::generic_pull_descriptors(&settings.ec.partners)?;
+    #[cfg(test)]
+    descriptors.extend(validate_identity_integration::<
+        crate::ec::identity::examples::ExampleIdConfig,
+    >(
+        settings,
+        crate::ec::identity::examples::EXAMPLEID_INTEGRATION_ID,
+    )?);
+    Ok(descriptors)
+}
+
+/// Parses `[integrations.<id>]` as `T` and, when it is enabled, describes the
+/// provider it enables.
+///
+/// It never builds a provider and never reads a secret, so it runs at deploy
+/// time, when secret fields still hold secret-store key names.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::Configuration`] when the integration's
+/// config does not parse or validate, or its descriptor cannot be built.
+/// Returns `Ok(None)` when the integration is absent or disabled.
+// Temporary: the first production identity integration adds the first caller.
+#[allow(dead_code)]
+pub(crate) fn validate_identity_integration<T: IdentityProviderConfig + DeserializeOwned>(
+    settings: &Settings,
+    id: &str,
+) -> Result<Option<ProviderDescriptor>, Report<TrustedServerError>> {
+    let Some(config) = settings.integration_config::<T>(id)? else {
+        return Ok(None);
+    };
+    config
+        .build_descriptor()
+        .map(Some)
+        .change_context(TrustedServerError::Configuration {
+            message: format!("integrations.{id}: the identity provider cannot be described"),
+        })
+}
+
+fn identity_configuration_error(message: String) -> Report<TrustedServerError> {
+    Report::new(TrustedServerError::Configuration { message })
+}
+
+/// Validates the numeric rules of `[ec.identity]`.
+///
+/// Rules that need provider descriptors live in the identity catalog
+/// validation instead.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::Configuration`] naming the first key that is
+/// out of range.
+pub(crate) fn validate_identity_settings(
+    settings: &IdentitySettings,
+) -> Result<(), Report<TrustedServerError>> {
+    if settings.hold_budget_ms > MAX_HOLD_BUDGET_MS {
+        return Err(identity_configuration_error(format!(
+            "ec.identity.hold_budget_ms must be at most {MAX_HOLD_BUDGET_MS}, got {}",
+            settings.hold_budget_ms
+        )));
+    }
+    if settings.max_concurrency == 0 {
+        return Err(identity_configuration_error(
+            "ec.identity.max_concurrency must be at least 1".to_owned(),
+        ));
+    }
+    for (id, provider) in &settings.providers {
+        if provider.refresh_after_sec == 0 {
+            return Err(identity_configuration_error(format!(
+                "ec.identity.providers.{id}.refresh_after_sec must be greater than 0"
+            )));
+        }
+        if !(1..=MAX_AFTER_SEND_TIMEOUT_MS).contains(&provider.after_send_timeout_ms) {
+            return Err(identity_configuration_error(format!(
+                "ec.identity.providers.{id}.after_send_timeout_ms must be between 1 and {MAX_AFTER_SEND_TIMEOUT_MS}, got {}",
+                provider.after_send_timeout_ms
+            )));
+        }
+        if provider.mode == ProviderMode::Hold
+            && provider
+                .timeout_ms
+                .is_some_and(|timeout| timeout > settings.hold_budget_ms)
+        {
+            return Err(identity_configuration_error(format!(
+                "ec.identity.providers.{id}.timeout_ms must not exceed hold_budget_ms ({})",
+                settings.hold_budget_ms
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Rejects config keys that were removed instead of deprecated.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::Configuration`] naming the replacement of the
+/// first removed key that is set.
+pub(crate) fn validate_removed_keys(settings: &Settings) -> Result<(), Report<TrustedServerError>> {
+    if settings.ec.removed_pull_sync_concurrency.is_some() {
+        return Err(identity_configuration_error(
+            "ec.pull_sync_concurrency was removed; set [ec.identity].max_concurrency instead"
+                .to_owned(),
+        ));
+    }
+    for partner in &settings.ec.partners {
+        let id = crate::ec::identity::generic_pull::generic_pull_id(&partner.source_domain);
+        if partner.removed_pull_sync_ttl_sec.is_some() {
+            return Err(identity_configuration_error(format!(
+                "ec.partners `{}`: pull_sync_ttl_sec was removed; set refresh_after_sec in [ec.identity.providers.{id}] instead",
+                partner.source_domain
+            )));
+        }
+        if partner.removed_pull_sync_rate_limit.is_some() {
+            return Err(identity_configuration_error(format!(
+                "ec.partners `{}`: pull_sync_rate_limit was removed; set max_calls_per_minute = ceil(N / 60) in [ec.identity.providers.{id}] instead",
+                partner.source_domain
+            )));
+        }
+    }
     Ok(())
 }
 
@@ -468,7 +637,7 @@ fn validate_secret_key_references(settings: &Settings) -> Result<(), Report<Trus
         )?;
     }
 
-    if settings.tinybird.enabled {
+    if settings.tinybird.enabled && settings.tinybird.auction_enabled {
         let token = settings
             .tinybird
             .auction_token_secret
@@ -477,6 +646,15 @@ fn validate_secret_key_references(settings: &Settings) -> Result<(), Report<Trus
         validate_secret_key_reference("tinybird.auction_token_secret", token.expose())?;
     }
 
+    if settings.tinybird.enabled && settings.tinybird.access_enabled {
+        let token = settings
+            .tinybird
+            .access_token_secret
+            .as_ref()
+            .ok_or_else(|| missing_secret_key_reference("tinybird.access_token_secret"))?;
+        validate_secret_key_reference("tinybird.access_token_secret", token.expose())?;
+    }
+
     if let Some(datadome) = settings.integration_config::<DataDomeConfig>("datadome")? {
         if datadome.enable_protection {
             let key = datadome
@@ -563,8 +741,18 @@ mod tests {
 
     use super::*;
     use crate::auction_config_types::{NotificationConfig, ProviderConfig, RoutingMode};
+    use crate::ec::identity::catalog::validate_identity_catalog;
+    use crate::ec::identity::descriptor::Resolves;
+    use crate::ec::identity::examples::ExampleCaptureProvider;
+    use crate::ec::identity::provider::{IdentityProvider as _, IdentityProviderConfig};
+    use crate::ec::identity::resolution::IdentityProviderError;
+    use crate::ec::identity::runtime::IdentityRuntime;
+    use crate::ec::identity::test_support::ec_partner;
+    use crate::integrations::IntegrationRegistry;
     use crate::redacted::Redacted;
-    use crate::settings::{ProxyAssetRoute, S3SigV4AuthConfig, TrustedClientIpConfig};
+    use crate::settings::{
+        ProviderSettings, ProxyAssetRoute, RevokeScope, S3SigV4AuthConfig, TrustedClientIpConfig,
+    };
     use crate::test_support::tests::crate_test_settings_str;
     use edgezero_core::app_config::AppConfigMeta;
     use edgezero_core::blob_envelope::BlobEnvelope;
@@ -951,6 +1139,7 @@ formats = [{ width = 300, height = 250 }]
                 ("trusted_client_ip.shared_secret".to_owned(), false),
                 ("trusted_forwarder.shared_secret".to_owned(), false),
                 ("tinybird.auction_token_secret".to_owned(), true),
+                ("tinybird.access_token_secret".to_owned(), true),
                 (
                     "integrations.datadome.server_side_key_secret_name".to_owned(),
                     true,
@@ -1797,4 +1986,275 @@ password = "production-admin-password-32-bytes"
             "validation error should mention invalid provider"
         );
     }
+
+    #[test]
+    fn removed_pull_sync_concurrency_is_rejected_with_its_replacement() {
+        let toml = crate_test_settings_str().replace("[ec]\n", "[ec]\npull_sync_concurrency = 3\n");
+        let mut settings = Settings::from_toml(&toml).expect("should parse the removed key");
+        settings.proxy.allowed_domains = vec!["*.example".to_string(), "*.example.com".to_string()];
+
+        let deploy = validate_settings_for_deploy(&settings).expect_err("should reject at deploy");
+        assert!(
+            format!("{deploy:?}").contains("[ec.identity].max_concurrency"),
+            "should name the replacement at deploy, got: {deploy:?}"
+        );
+        let runtime =
+            validate_settings_for_runtime(&settings).expect_err("should reject at runtime");
+        assert!(
+            format!("{runtime:?}").contains("[ec.identity].max_concurrency"),
+            "should name the replacement at runtime, got: {runtime:?}"
+        );
+
+        let control = crate_test_settings_str()
+            .replace("[ec]\n", "[ec.identity]\nmax_concurrency = 3\n\n[ec]\n");
+        let mut control = Settings::from_toml(&control).expect("should parse the replacement key");
+        control.proxy.allowed_domains = vec!["*.example".to_string(), "*.example.com".to_string()];
+        validate_settings_for_deploy(&control).expect("control: should pass at deploy");
+    }
+
+    #[test]
+    fn removed_partner_pull_keys_are_rejected_with_their_replacements() {
+        let base = crate_test_settings_str();
+        let partner = |extra: &str| {
+            format!(
+                "{base}\n[[ec.partners]]\nname = \"Example SSP\"\nsource_domain = \"ssp.example.com\"\npull_sync_enabled = true\npull_sync_url = \"https://sync.ssp.example.com/pull\"\npull_sync_allowed_domains = [\"sync.ssp.example.com\"]\nts_pull_token = \"example-token-value-0123456789abcdef\"\n{extra}\n"
+            )
+        };
+        let parse = |toml: &str| {
+            let mut settings = Settings::from_toml(toml).expect("should parse the settings");
+            settings.proxy.allowed_domains =
+                vec!["*.example".to_string(), "*.example.com".to_string()];
+            settings
+        };
+
+        for (key, replacement) in [
+            ("pull_sync_ttl_sec = 3600", "refresh_after_sec"),
+            ("pull_sync_rate_limit = 20", "max_calls_per_minute"),
+        ] {
+            let settings = parse(&partner(key));
+            let deploy =
+                validate_settings_for_deploy(&settings).expect_err("should reject at deploy");
+            assert!(
+                format!("{deploy:?}").contains(replacement),
+                "should name {replacement} at deploy, got: {deploy:?}"
+            );
+            let runtime =
+                validate_settings_for_runtime(&settings).expect_err("should reject at runtime");
+            assert!(
+                format!("{runtime:?}").contains(replacement),
+                "should name {replacement} at runtime, got: {runtime:?}"
+            );
+        }
+
+        let control = parse(&partner(""));
+        validate_settings_for_deploy(&control).expect("control: should pass at deploy");
+    }
+
+    #[derive(Debug, Deserialize, Validate)]
+    struct SecretedExampleConfig {
+        enabled: bool,
+        // Held so the config has a secret field, which no descriptor reads.
+        #[allow(dead_code)]
+        api_key: Redacted<String>,
+    }
+
+    impl IntegrationConfig for SecretedExampleConfig {
+        fn is_enabled(&self) -> bool {
+            self.enabled
+        }
+    }
+
+    impl IdentityProviderConfig for SecretedExampleConfig {
+        fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+            ProviderDescriptor::builder("secreted".parse()?)
+                .with_source("secreted.example.com".parse()?)
+                .with_resolves(Resolves::new().with_endpoint("https://api.example.com/fetch"))
+                .with_consent_policy(crate::ec::identity::test_support::resolver_policy())
+                .build()
+        }
+    }
+
+    fn exampleid_settings(partner_owner: Option<&str>) -> Settings {
+        let mut settings = valid_settings();
+        settings.integrations.insert(
+            "exampleid".to_owned(),
+            serde_json::json!({
+                "enabled": true,
+                "endpoint": "https://api.example.com/fetch",
+                "partner_id": 7,
+                "gvl_id": 1,
+            }),
+        );
+        let mut partner = ec_partner(
+            "exampleid.example.com",
+            "https://sync.exampleid.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        );
+        partner.pull_sync_enabled = false;
+        partner.pull_sync_url = None;
+        partner.pull_sync_allowed_domains = Vec::new();
+        partner.owner = partner_owner.map(ToOwned::to_owned);
+        settings.ec.partners = vec![partner];
+        settings
+    }
+
+    #[test]
+    fn config_without_ec_identity_is_accepted() {
+        let settings = valid_settings();
+
+        assert!(
+            settings.ec.identity.providers.is_empty(),
+            "should hold no provider tables"
+        );
+        validate_settings_for_deploy(&settings).expect("should accept a config with no identity");
+    }
+
+    #[test]
+    fn identity_integration_descriptor_joins_deploy_validation() {
+        let settings = exampleid_settings(Some("exampleid"));
+
+        let descriptors =
+            identity_descriptors_for_deploy(&settings).expect("should describe the deploy");
+        assert_eq!(
+            descriptors
+                .iter()
+                .map(|descriptor| descriptor.id().as_str())
+                .collect::<Vec<_>>(),
+            ["exampleid"],
+            "should hold the integration's descriptor"
+        );
+        validate_settings_for_deploy(&settings).expect("should accept a declared owner");
+
+        let unknown_owner = exampleid_settings(Some("missing"));
+        let error = validate_settings_for_deploy(&unknown_owner)
+            .expect_err("should reject an owner no enabled provider matches");
+        assert!(
+            format!("{error}").contains("missing"),
+            "should name the owner: {error}"
+        );
+
+        let mut disabled = exampleid_settings(None);
+        disabled.integrations.insert(
+            "exampleid".to_owned(),
+            serde_json::json!({ "enabled": false }),
+        );
+        assert!(
+            identity_descriptors_for_deploy(&disabled)
+                .expect("should describe the deploy")
+                .is_empty(),
+            "control: a disabled integration declares no descriptor"
+        );
+    }
+
+    #[test]
+    fn build_descriptor_runs_in_deploy_validation_without_secrets() {
+        let mut settings = valid_settings();
+        settings.integrations.insert(
+            "secreted".to_owned(),
+            serde_json::json!({ "enabled": true, "api_key": "secret-store-key-name" }),
+        );
+
+        let descriptor =
+            validate_identity_integration::<SecretedExampleConfig>(&settings, "secreted")
+                .expect("should validate a config whose secret holds a key name")
+                .expect("should describe an enabled integration");
+        assert_eq!(
+            descriptor.id().as_str(),
+            "secreted",
+            "should return the descriptor"
+        );
+
+        settings.integrations.insert(
+            "secreted".to_owned(),
+            serde_json::json!({ "enabled": false, "api_key": "secret-store-key-name" }),
+        );
+        assert!(
+            validate_identity_integration::<SecretedExampleConfig>(&settings, "secreted")
+                .expect("should accept a disabled integration")
+                .is_none(),
+            "control: a disabled integration has no descriptor"
+        );
+        assert!(
+            validate_identity_integration::<SecretedExampleConfig>(&settings, "absent")
+                .expect("should accept an absent integration")
+                .is_none(),
+            "control: an absent integration has no descriptor"
+        );
+    }
+
+    #[test]
+    fn capture_settings_on_a_provider_without_captures_are_rejected_at_deploy() {
+        let mut settings = exampleid_settings(None);
+        settings.ec.identity.providers.insert(
+            "exampleid".to_owned(),
+            ProviderSettings {
+                revoke_scope: Some(RevokeScope::Global),
+                ..ProviderSettings::default()
+            },
+        );
+
+        let error = validate_settings_for_deploy(&settings)
+            .expect_err("should reject revoke_scope on a resolve-only provider");
+        assert!(
+            format!("{error}").contains("exampleid"),
+            "should name the provider: {error}"
+        );
+
+        let capturing = ExampleCaptureProvider::new().expect("should build the provider");
+        let partner = ec_partner(
+            "examplecapture.example.com",
+            "https://sync.examplecapture.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        );
+        let mut identity = IdentitySettings::default();
+        identity.providers.insert(
+            "examplecapture".to_owned(),
+            ProviderSettings {
+                revoke_scope: Some(RevokeScope::Global),
+                sources: Some(vec!["examplecapture.example.com".to_owned()]),
+                ..ProviderSettings::default()
+            },
+        );
+        validate_identity_catalog(&[capturing.descriptor().clone()], &[partner], &identity)
+            .expect("control: the same key on a capturing provider should pass");
+    }
+
+    #[test]
+    fn capture_enabled_has_no_effect() {
+        let base = format!(
+            "{}\n[[ec.partners]]\nname = \"Example SSP\"\nsource_domain = \"ssp.example.com\"\npull_sync_enabled = true\npull_sync_url = \"https://sync.ssp.example.com/pull\"\npull_sync_allowed_domains = [\"sync.ssp.example.com\"]\nts_pull_token = \"example-token-value-0123456789abcdef\"\n",
+            crate_test_settings_str()
+        );
+        let parse = |toml: &str| {
+            let mut settings = Settings::from_toml(toml).expect("should parse the settings");
+            settings.proxy.allowed_domains =
+                vec!["*.example".to_string(), "*.example.com".to_string()];
+            settings
+        };
+        let plain = parse(&base);
+        let flagged = parse(&format!(
+            "{base}\n[ec.identity.providers.pull-ssp-example-com]\ncapture_enabled = true\n"
+        ));
+
+        validate_settings_for_deploy(&flagged).expect("should accept the lenient key");
+        let plain_runtime = IdentityRuntime::from_settings(&plain, &IntegrationRegistry::default())
+            .expect("should build");
+        let flagged_runtime =
+            IdentityRuntime::from_settings(&flagged, &IntegrationRegistry::default())
+                .expect("should build");
+        let id = "pull-ssp-example-com".parse().expect("should parse the ID");
+        assert_eq!(
+            flagged_runtime.catalog().sources_of(&id),
+            plain_runtime.catalog().sources_of(&id),
+            "should change no provider source"
+        );
+        assert!(
+            !flagged_runtime.catalog().is_capture_only(&id)
+                && flagged_runtime
+                    .catalog()
+                    .owner_of(&"ssp.example.com".parse().expect("should parse"))
+                    .is_none(),
+            "should make no provider a capturer and give no source an owner"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/config_payload.rs b/crates/trusted-server-core/src/config_payload.rs
index 34a4143cf2..206f5be880 100644
--- a/crates/trusted-server-core/src/config_payload.rs
+++ b/crates/trusted-server-core/src/config_payload.rs
@@ -72,16 +72,26 @@ pub fn settings_from_config_blob(
 }
 
 fn remove_inactive_secret_references(data: &mut serde_json::Value) {
-    if data
-        .pointer("/tinybird/enabled")
-        .and_then(serde_json::Value::as_bool)
-        != Some(true)
-        && let Some(tinybird) = data
-            .get_mut("tinybird")
-            .and_then(serde_json::Value::as_object_mut)
+    if let Some(tinybird) = data
+        .get_mut("tinybird")
+        .and_then(serde_json::Value::as_object_mut)
     {
-        tinybird.remove("auction_token_secret");
-        tinybird.remove("access_token_secret");
+        let master_enabled =
+            tinybird.get("enabled").and_then(serde_json::Value::as_bool) == Some(true);
+        let auction_enabled = tinybird
+            .get("auction_enabled")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(true);
+        let access_enabled = tinybird
+            .get("access_enabled")
+            .and_then(serde_json::Value::as_bool)
+            == Some(true);
+        if !master_enabled || !auction_enabled {
+            tinybird.remove("auction_token_secret");
+        }
+        if !master_enabled || !access_enabled {
+            tinybird.remove("access_token_secret");
+        }
     }
 
     if let Some(partners) = data
@@ -292,7 +302,7 @@ mod tests {
             "should preserve publisher domain"
         );
         assert_eq!(
-            reconstructed.ec.pull_sync_concurrency, original.ec.pull_sync_concurrency,
+            reconstructed.ec.identity.max_concurrency, original.ec.identity.max_concurrency,
             "should preserve numeric fields"
         );
         assert_eq!(
@@ -677,6 +687,92 @@ mod tests {
         assert!(error.to_string().contains("ec.partners[0].ts_pull_token"));
     }
 
+    #[test]
+    fn inactive_tinybird_sinks_strip_stale_secret_references_before_resolution() {
+        let mut original = test_settings();
+        let mut data = serde_json::to_value(&original).expect("should serialize settings");
+        data["tinybird"] = serde_json::json!({
+            "enabled": false,
+            "auction_token_secret": "unused-auction-token",
+            "access_token_secret": "unused-access-token",
+        });
+        let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_owned());
+        let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
+
+        let loaded = settings_from_config_blob(
+            &envelope_json,
+            &UnifiedSecretStore,
+            &StoreName::from("ts_secrets"),
+        )
+        .expect("should ignore stale secrets for disabled sinks");
+        assert!(!loaded.tinybird.enabled);
+        assert!(loaded.tinybird.auction_enabled, "auction defaults on");
+        assert!(!loaded.tinybird.access_enabled, "access defaults off");
+        assert!(loaded.tinybird.auction_token_secret.is_none());
+        assert!(loaded.tinybird.access_token_secret.is_none());
+
+        let mut data = serde_json::to_value(&original).expect("should serialize settings");
+        data["tinybird"] = serde_json::json!({
+            "enabled": true,
+            "api_host": "api.example.com",
+            "auction_enabled": false,
+            "auction_token_secret": "unused-auction-token",
+            "access_enabled": true,
+            "access_token_secret": "tinybird-token-key",
+            "access_sample_rate": 1.0,
+        });
+        let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_owned());
+        let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
+        let loaded = settings_from_config_blob(
+            &envelope_json,
+            &UnifiedSecretStore,
+            &StoreName::from("ts_secrets"),
+        )
+        .expect("should load active access telemetry without the disabled auction token");
+        assert!(!loaded.tinybird.auction_enabled);
+        assert!(loaded.tinybird.auction_token_secret.is_none());
+        assert_eq!(
+            loaded
+                .tinybird
+                .access_token_secret
+                .as_ref()
+                .map(Redacted::expose)
+                .map(String::as_str),
+            Some("resolved-tinybird-token")
+        );
+
+        let mut data = serde_json::to_value(&original).expect("should serialize settings");
+        data["tinybird"] = serde_json::json!({
+            "enabled": true,
+            "api_host": "api.example.com",
+            "auction_token_secret": "tinybird-token-key",
+            "access_token_secret": "unused-access-token",
+        });
+        let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_owned());
+        let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
+        let loaded = settings_from_config_blob(
+            &envelope_json,
+            &UnifiedSecretStore,
+            &StoreName::from("ts_secrets"),
+        )
+        .expect("should load the default-on auction sink without the disabled access token");
+        assert!(loaded.tinybird.auction_enabled, "auction defaults on");
+        assert!(!loaded.tinybird.access_enabled, "access defaults off");
+        assert!(loaded.tinybird.access_token_secret.is_none());
+        assert!(loaded.tinybird.auction_token_secret.is_some());
+
+        original.tinybird.enabled = true;
+        original.tinybird.api_host = "api.example.com".to_owned();
+        original.tinybird.auction_token_secret = None;
+        let error = settings_from_config_blob(
+            &self::envelope_json(&original),
+            &UnifiedSecretStore,
+            &StoreName::from("ts_secrets"),
+        )
+        .expect_err("should reject a missing active default-on auction token");
+        assert!(error.to_string().contains("tinybird.auction_token_secret"));
+    }
+
     #[test]
     fn inactive_optional_features_do_not_resolve_stale_secret_references() {
         let mut original = test_settings();
diff --git a/crates/trusted-server-core/src/consent/gpp.rs b/crates/trusted-server-core/src/consent/gpp.rs
index 59e39613ab..e84069446f 100644
--- a/crates/trusted-server-core/src/consent/gpp.rs
+++ b/crates/trusted-server-core/src/consent/gpp.rs
@@ -23,7 +23,7 @@
 
 use error_stack::Report;
 
-use super::types::{ConsentDecodeError, GppConsent, TcfConsent};
+use super::types::{ConsentDecodeError, GppConsent, TcfConsent, UsPrivacy};
 
 /// Maximum length of a raw GPP string before parsing.
 ///
@@ -71,7 +71,9 @@ pub fn decode_gpp_string(gpp_string: &str) -> Result<GppConsent, Report<ConsentD
     // Section ID 2 = TcfEuV2 in the GPP spec.
     let eu_tcf = decode_tcf_from_gpp(&parsed);
 
-    let us_sale_opt_out = decode_us_sale_opt_out(&parsed);
+    let (us_sections, us_sections_failed) = decode_us_sections(&parsed);
+    let us_privacy_section = decode_us_privacy_section(&parsed);
+    let us_sale_opt_out = aggregate_us_signal(&us_sections, us_sale_opt_out_from_section);
 
     Ok(GppConsent {
         // The GPP header version is always 1 for current spec.
@@ -79,6 +81,15 @@ pub fn decode_gpp_string(gpp_string: &str) -> Result<GppConsent, Report<ConsentD
         section_ids,
         eu_tcf,
         us_sale_opt_out,
+        us_sharing_opt_out: aggregate_us_signal(&us_sections, us_sharing_opt_out_from_section),
+        us_targeted_advertising_opt_out: aggregate_us_signal(
+            &us_sections,
+            us_targeted_advertising_opt_out_from_section,
+        ),
+        us_gpc: aggregate_us_signal(&us_sections, us_gpc_from_section),
+        us_known_child: aggregate_us_signal(&us_sections, us_known_child_from_section),
+        us_privacy_section: us_privacy_section.clone().unwrap_or(None),
+        us_section_decode_failed: us_sections_failed || us_privacy_section.is_err(),
     })
 }
 
@@ -111,36 +122,48 @@ fn decode_tcf_from_gpp(parsed: &iab_gpp::v1::GPPString) -> Option<TcfConsent> {
 /// 21=UsNj, 22=UsTn, 23=UsMn.
 const US_SECTION_ID_RANGE: std::ops::RangeInclusive<u16> = 7..=23;
 
-/// Extracts the `sale_opt_out` signal across all US sections in a parsed GPP
-/// string.
+/// Decodes every US section (IDs 7–23) in a parsed GPP string.
 ///
-/// Iterates through section IDs looking for any in the US range (7–23),
-/// decodes each US section, and aggregates the result conservatively:
-///
-/// - `Some(true)` if any decodable US section says the user opted out of sale
-/// - `Some(false)` if at least one decodable US section says they did not opt
-///   out and none say they opted out
-/// - `None` if no US section is present or no decodable US section yields a
-///   usable `sale_opt_out` signal
-fn decode_us_sale_opt_out(parsed: &iab_gpp::v1::GPPString) -> Option<bool> {
-    let mut result = None;
-
-    for us_section_id in parsed
+/// A section that fails to decode is logged and skipped, so one malformed
+/// section never hides a valid one. The flag is `true` when any US section
+/// failed to decode, so its opt-outs are unknown.
+fn decode_us_sections(parsed: &iab_gpp::v1::GPPString) -> (Vec<iab_gpp::sections::Section>, bool) {
+    let mut failed = false;
+    let sections = parsed
         .section_ids()
         .filter(|id| US_SECTION_ID_RANGE.contains(&(**id as u16)))
-    {
-        match parsed.decode_section(*us_section_id) {
-            Ok(section) => match us_sale_opt_out_from_section(&section) {
-                Some(true) => return Some(true),
-                Some(false) => result = Some(false),
-                None => {}
+        .filter_map(
+            |us_section_id| match parsed.decode_section(*us_section_id) {
+                Ok(section) => Some(section),
+                Err(e) => {
+                    log::warn!("Failed to decode US GPP section {us_section_id}: {e}");
+                    failed = true;
+                    None
+                }
             },
-            Err(e) => {
-                log::warn!("Failed to decode US GPP section {us_section_id}: {e}");
-            }
+        )
+        .collect();
+    (sections, failed)
+}
+
+/// Aggregates one boolean signal across decoded US sections, conservatively:
+///
+/// - `Some(true)` if any section reports the signal set
+/// - `Some(false)` if at least one section reports it unset and none report
+///   it set
+/// - `None` if no section yields the signal
+fn aggregate_us_signal(
+    sections: &[iab_gpp::sections::Section],
+    extract: fn(&iab_gpp::sections::Section) -> Option<bool>,
+) -> Option<bool> {
+    let mut result = None;
+    for section in sections {
+        match extract(section) {
+            Some(true) => return Some(true),
+            Some(false) => result = Some(false),
+            None => {}
         }
     }
-
     result
 }
 
@@ -177,6 +200,110 @@ fn us_sale_opt_out_from_section(section: &iab_gpp::sections::Section) -> Option<
     Some(*sale_opt_out == OptOut::OptedOut)
 }
 
+/// Reads the sharing opt-out, defined by the US National and California
+/// sections only.
+fn us_sharing_opt_out_from_section(section: &iab_gpp::sections::Section) -> Option<bool> {
+    use iab_gpp::sections::Section;
+    use iab_gpp::sections::us_common::OptOut;
+
+    let sharing_opt_out = match section {
+        Section::UsNat(s) => match &s.core {
+            iab_gpp::sections::usnat::Core::V1(c) => &c.sharing_opt_out,
+            iab_gpp::sections::usnat::Core::V2(c) => &c.sharing_opt_out,
+            _ => return None,
+        },
+        Section::UsCa(s) => &s.core.sharing_opt_out,
+        _ => return None,
+    };
+
+    Some(*sharing_opt_out == OptOut::OptedOut)
+}
+
+/// Reads the targeted-advertising opt-out from the US National section and
+/// every state section that defines it (all but California).
+fn us_targeted_advertising_opt_out_from_section(
+    section: &iab_gpp::sections::Section,
+) -> Option<bool> {
+    use iab_gpp::sections::Section;
+    use iab_gpp::sections::us_common::OptOut;
+
+    // Keep this match in sync with new US-state variants added by `iab_gpp`.
+    let targeted_advertising_opt_out = match section {
+        Section::UsNat(s) => match &s.core {
+            iab_gpp::sections::usnat::Core::V1(c) => &c.targeted_advertising_opt_out,
+            iab_gpp::sections::usnat::Core::V2(c) => &c.targeted_advertising_opt_out,
+            _ => return None,
+        },
+        Section::UsVa(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsCo(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsUt(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsCt(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsFl(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsMt(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsOr(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsTx(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsDe(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsIa(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsNe(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsNh(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsNj(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsTn(s) => &s.core.targeted_advertising_opt_out,
+        Section::UsMn(s) => &s.core.targeted_advertising_opt_out,
+        _ => return None,
+    };
+
+    Some(*targeted_advertising_opt_out == OptOut::OptedOut)
+}
+
+/// Reads the Global Privacy Control segment of the US National section.
+fn us_gpc_from_section(section: &iab_gpp::sections::Section) -> Option<bool> {
+    match section {
+        iab_gpp::sections::Section::UsNat(s) => s.gpc,
+        _ => None,
+    }
+}
+
+/// Reads whether the US National section marks a known child without consent.
+fn us_known_child_from_section(section: &iab_gpp::sections::Section) -> Option<bool> {
+    use iab_gpp::sections::Section;
+    use iab_gpp::sections::us_common::Consent;
+
+    let Section::UsNat(s) = section else {
+        return None;
+    };
+    match &s.core {
+        iab_gpp::sections::usnat::Core::V1(c) => {
+            let child = &c.known_child_sensitive_data_consents;
+            Some(child.from_13_to_16 == Consent::NoConsent || child.under_13 == Consent::NoConsent)
+        }
+        iab_gpp::sections::usnat::Core::V2(c) => {
+            let child = &c.known_child_sensitive_data_consents;
+            Some(
+                child.process_sensitive_data_from_13_to_16 == Consent::NoConsent
+                    || child.process_sensitive_data_under_13 == Consent::NoConsent
+                    || child.process_personal_data_from_16_to_17 == Consent::NoConsent,
+            )
+        }
+        _ => None,
+    }
+}
+
+/// Reads GPP section 6, the US Privacy string, through the standalone
+/// decoder. Returns `None` when absent, and `Err` when present but
+/// undecodable.
+fn decode_us_privacy_section(parsed: &iab_gpp::v1::GPPString) -> Result<Option<UsPrivacy>, ()> {
+    let Some(raw) = parsed.section(iab_gpp::sections::SectionId::UspV1) else {
+        return Ok(None);
+    };
+    match super::us_privacy::decode_us_privacy(raw) {
+        Ok(us_privacy) => Ok(Some(us_privacy)),
+        Err(e) => {
+            log::warn!("GPP contains a US Privacy section but decoding failed: {e}");
+            Err(())
+        }
+    }
+}
+
 /// Parses a `__gpp_sid` cookie value into a vector of section IDs.
 ///
 /// The cookie is a comma-separated list of integer section IDs, e.g. `"2,6"`.
@@ -210,6 +337,8 @@ pub fn parse_gpp_sid_cookie(raw: &str) -> Option<Vec<u16>> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::consent::types::PrivacyFlag;
+    use crate::consent::us_privacy::decode_us_privacy;
 
     // A known-good GPP string with US Privacy section (section ID 6).
     // Header "DBABTA" encodes: version=1, section IDs=[6] (UspV1).
@@ -461,4 +590,309 @@ mod tests {
             "should return None when no decodable US section yields sale_opt_out"
         );
     }
+
+    // Encodes a US core segment: a 6-bit version, then 2-bit fields.
+    fn us_core_segment(version: u8, fields: &[u8]) -> String {
+        const BASE64_URL: &[u8; 64] =
+            b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+        let mut bits = format!("{version:06b}");
+        for field in fields {
+            bits.push_str(&format!("{field:02b}"));
+        }
+        while bits.len() % 6 != 0 {
+            bits.push('0');
+        }
+        bits.as_bytes()
+            .chunks(6)
+            .map(|chunk| {
+                let value = u8::from_str_radix(
+                    core::str::from_utf8(chunk).expect("should encode segment bits as utf8"),
+                    2,
+                )
+                .expect("should parse 6-bit chunk");
+                char::from(BASE64_URL[value as usize])
+            })
+            .collect()
+    }
+
+    // The US National core, version 1. `child` holds the two known-child
+    // consent fields. Opt-out values: 1 opted out, 2 did not.
+    fn us_nat_section(sale: u8, sharing: u8, targeted: u8, child: [u8; 2], gpc: bool) -> String {
+        let mut fields = vec![1, 1, 1, 1, 1, 1, sale, sharing, targeted];
+        fields.extend([2; 12]);
+        fields.extend(child);
+        // Personal data consent, MSPA covered transaction and the two modes.
+        fields.extend([2, 2, 1, 1]);
+        let core = us_core_segment(1, &fields);
+        let gpc_segment = if gpc { "YA" } else { "QA" };
+        format!("{core}.{gpc_segment}")
+    }
+
+    // The California core: sale, then sharing.
+    fn us_ca_section(sale: u8, sharing: u8) -> String {
+        let mut fields = vec![1, 1, 1, sale, sharing];
+        fields.extend([2; 9]);
+        fields.extend([2, 2]);
+        fields.extend([2, 2, 1, 1]);
+        format!("{}.QA", us_core_segment(1, &fields))
+    }
+
+    // The Virginia core: sale, then targeted advertising.
+    fn us_va_section(sale: u8, targeted: u8) -> String {
+        let mut fields = vec![1, 1, 1, sale, targeted];
+        fields.extend([2; 8]);
+        fields.push(2);
+        fields.extend([2, 1, 1]);
+        us_core_segment(1, &fields)
+    }
+
+    #[test]
+    fn decodes_the_sharing_opt_out_from_us_national_and_california() {
+        let nat = gpp_with_sections(&[(7, &us_nat_section(2, 1, 2, [2, 2], false))]);
+        let result = decode_gpp_string(&nat).expect("should decode US National");
+        assert_eq!(
+            result.us_sharing_opt_out,
+            Some(true),
+            "should read the US National sharing opt-out"
+        );
+        assert_eq!(
+            result.us_sale_opt_out,
+            Some(false),
+            "should keep the sale signal apart from the sharing signal"
+        );
+
+        let nat_control = gpp_with_sections(&[(7, &us_nat_section(2, 2, 2, [2, 2], false))]);
+        assert_eq!(
+            decode_gpp_string(&nat_control)
+                .expect("should decode US National control")
+                .us_sharing_opt_out,
+            Some(false),
+            "should read no sharing opt-out when it is not set"
+        );
+
+        let california = gpp_with_sections(&[(8, &us_ca_section(2, 1))]);
+        assert_eq!(
+            decode_gpp_string(&california)
+                .expect("should decode California")
+                .us_sharing_opt_out,
+            Some(true),
+            "should read the California sharing opt-out"
+        );
+        let california_control = gpp_with_sections(&[(8, &us_ca_section(2, 2))]);
+        assert_eq!(
+            decode_gpp_string(&california_control)
+                .expect("should decode California control")
+                .us_sharing_opt_out,
+            Some(false),
+            "should read no California sharing opt-out when it is not set"
+        );
+
+        let virginia = gpp_with_sections(&[(9, &us_va_section(2, 2))]);
+        assert_eq!(
+            decode_gpp_string(&virginia)
+                .expect("should decode Virginia")
+                .us_sharing_opt_out,
+            None,
+            "should leave sharing unset for a section that does not define it"
+        );
+    }
+
+    #[test]
+    fn decodes_the_targeted_advertising_opt_out_from_sections_that_define_it() {
+        let nat = gpp_with_sections(&[(7, &us_nat_section(2, 2, 1, [2, 2], false))]);
+        let result = decode_gpp_string(&nat).expect("should decode US National");
+        assert_eq!(
+            result.us_targeted_advertising_opt_out,
+            Some(true),
+            "should read the US National targeted-advertising opt-out"
+        );
+        assert_eq!(
+            result.us_sharing_opt_out,
+            Some(false),
+            "should keep the sharing signal apart from the targeted signal"
+        );
+
+        let virginia = gpp_with_sections(&[(9, &us_va_section(2, 1))]);
+        assert_eq!(
+            decode_gpp_string(&virginia)
+                .expect("should decode Virginia")
+                .us_targeted_advertising_opt_out,
+            Some(true),
+            "should read the Virginia targeted-advertising opt-out"
+        );
+        let virginia_control = gpp_with_sections(&[(9, &us_va_section(2, 2))]);
+        assert_eq!(
+            decode_gpp_string(&virginia_control)
+                .expect("should decode Virginia control")
+                .us_targeted_advertising_opt_out,
+            Some(false),
+            "should read no targeted-advertising opt-out when it is not set"
+        );
+
+        let california = gpp_with_sections(&[(8, &us_ca_section(2, 2))]);
+        assert_eq!(
+            decode_gpp_string(&california)
+                .expect("should decode California")
+                .us_targeted_advertising_opt_out,
+            None,
+            "should leave targeted advertising unset for a section that does not define it"
+        );
+    }
+
+    #[test]
+    fn any_section_opt_out_wins_for_the_new_opt_outs() {
+        let gpp = gpp_with_sections(&[
+            (7, &us_nat_section(2, 2, 2, [2, 2], false)),
+            (9, &us_va_section(2, 1)),
+        ]);
+        let result = decode_gpp_string(&gpp).expect("should decode both sections");
+        assert_eq!(
+            result.us_targeted_advertising_opt_out,
+            Some(true),
+            "should treat any decodable targeted opt-out as authoritative"
+        );
+    }
+
+    #[test]
+    fn decodes_the_us_national_gpc_field() {
+        let set = gpp_with_sections(&[(7, &us_nat_section(2, 2, 2, [2, 2], true))]);
+        assert_eq!(
+            decode_gpp_string(&set)
+                .expect("should decode US National with GPC")
+                .us_gpc,
+            Some(true),
+            "should read the GPC field when it is set"
+        );
+        let unset = gpp_with_sections(&[(7, &us_nat_section(2, 2, 2, [2, 2], false))]);
+        assert_eq!(
+            decode_gpp_string(&unset)
+                .expect("should decode US National without GPC")
+                .us_gpc,
+            Some(false),
+            "should read GPC false when the segment says so"
+        );
+        assert_eq!(
+            decode_gpp_string(GPP_USP_ONLY)
+                .expect("should decode USP only")
+                .us_gpc,
+            None,
+            "should leave GPC unset without a US National section"
+        );
+    }
+
+    #[test]
+    fn decodes_a_known_child_without_consent() {
+        // Known-child fields: 1 means no consent, 2 consent, 0 not applicable.
+        let no_consent = gpp_with_sections(&[(7, &us_nat_section(2, 2, 2, [2, 1], false))]);
+        assert_eq!(
+            decode_gpp_string(&no_consent)
+                .expect("should decode known child")
+                .us_known_child,
+            Some(true),
+            "should flag a known child without consent"
+        );
+        let consent = gpp_with_sections(&[(7, &us_nat_section(2, 2, 2, [2, 2], false))]);
+        assert_eq!(
+            decode_gpp_string(&consent)
+                .expect("should decode consenting child")
+                .us_known_child,
+            Some(false),
+            "should not flag a known child who has consent"
+        );
+        let not_applicable = gpp_with_sections(&[(7, &us_nat_section(2, 2, 2, [0, 0], false))]);
+        assert_eq!(
+            decode_gpp_string(&not_applicable)
+                .expect("should decode not-applicable child")
+                .us_known_child,
+            Some(false),
+            "should not flag a section that marks no known child"
+        );
+        assert_eq!(
+            decode_gpp_string(GPP_USP_ONLY)
+                .expect("should decode USP only")
+                .us_known_child,
+            None,
+            "should leave known child unset without a US National section"
+        );
+    }
+
+    #[test]
+    fn decodes_section_6_through_the_us_privacy_decoder() {
+        let result = decode_gpp_string(GPP_USP_ONLY).expect("should decode USP only");
+        assert_eq!(
+            result.us_privacy_section,
+            Some(decode_us_privacy("1YNN").expect("should decode 1YNN")),
+            "should read section 6 as a US Privacy string"
+        );
+        let opted_out = decode_gpp_string(&gpp_with_sections(&[(6, "1YYN")]))
+            .expect("should decode an opted-out section 6");
+        assert_eq!(
+            opted_out
+                .us_privacy_section
+                .expect("should carry section 6")
+                .opt_out_sale,
+            PrivacyFlag::Yes,
+            "should read the section 6 sale opt-out"
+        );
+        assert_eq!(
+            opted_out.us_sale_opt_out, None,
+            "should keep us_sale_opt_out to the US state sections"
+        );
+        let no_section = decode_gpp_string(&gpp_with_sections(&[(
+            7,
+            &us_nat_section(2, 2, 2, [2, 2], false),
+        )]))
+        .expect("should decode US National");
+        assert!(
+            no_section.us_privacy_section.is_none(),
+            "should leave section 6 unset when absent"
+        );
+    }
+
+    #[test]
+    fn header_only_gpp_decodes_with_no_section_fields() {
+        let result = decode_gpp_string("DBAA").expect("should decode a header-only GPP string");
+        assert!(result.section_ids.is_empty(), "should list no section IDs");
+        assert_eq!(result.us_sale_opt_out, None, "should leave sale unset");
+        assert_eq!(
+            result.us_sharing_opt_out, None,
+            "should leave sharing unset"
+        );
+        assert_eq!(
+            result.us_targeted_advertising_opt_out, None,
+            "should leave targeted advertising unset"
+        );
+        assert_eq!(result.us_gpc, None, "should leave GPC unset");
+        assert_eq!(
+            result.us_known_child, None,
+            "should leave known child unset"
+        );
+        assert!(
+            result.us_privacy_section.is_none(),
+            "should leave section 6 unset"
+        );
+        assert!(result.eu_tcf.is_none(), "should carry no TCF section");
+    }
+
+    #[test]
+    fn flags_a_us_section_or_section_6_that_fails_to_decode() {
+        let corrupt_us = decode_gpp_string(&gpp_with_sections(&[(7, "not-a-valid-usnat-section")]))
+            .expect("should decode the header");
+        assert!(
+            corrupt_us.us_section_decode_failed,
+            "should flag an undecodable US section"
+        );
+        let corrupt_usp = decode_gpp_string(&gpp_with_sections(&[(6, "garbage")]))
+            .expect("should decode the header");
+        assert!(
+            corrupt_usp.us_section_decode_failed,
+            "should flag an undecodable section 6"
+        );
+        let valid = decode_gpp_string(GPP_USP_ONLY).expect("should decode USP only");
+        assert!(
+            !valid.us_section_decode_failed,
+            "should not flag a decodable string"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/consent/mod.rs b/crates/trusted-server-core/src/consent/mod.rs
index 76aa6ad859..e78d3f4b12 100644
--- a/crates/trusted-server-core/src/consent/mod.rs
+++ b/crates/trusted-server-core/src/consent/mod.rs
@@ -280,13 +280,24 @@ fn has_eu_tcf_signal(raw_tc_present: bool, gpp_section_ids: Option<&[u16]>) -> b
 
 /// Returns the effective decoded TCF consent for enforcement decisions.
 #[must_use]
-fn effective_tcf(ctx: &ConsentContext) -> Option<&types::TcfConsent> {
+pub(crate) fn effective_tcf(ctx: &ConsentContext) -> Option<&types::TcfConsent> {
     ctx.tcf.as_ref().or_else(|| {
         let g = ctx.gpp.as_ref()?;
         g.eu_tcf.as_ref()
     })
 }
 
+/// Whether TCF applies to this request: `gdpr_applies`, or a jurisdiction of
+/// GDPR or unknown.
+#[must_use]
+pub(crate) fn tcf_applies(ctx: &ConsentContext) -> bool {
+    ctx.gdpr_applies
+        || matches!(
+            ctx.jurisdiction,
+            jurisdiction::Jurisdiction::Gdpr | jurisdiction::Jurisdiction::Unknown
+        )
+}
+
 /// Returns whether a server-side auction may be dispatched for this request.
 ///
 /// Fails closed for GDPR-relevant traffic: when an EU TCF signal is present
@@ -296,12 +307,7 @@ fn effective_tcf(ctx: &ConsentContext) -> Option<&types::TcfConsent> {
 /// non-GDPR jurisdiction with no EU TCF signal are freely allowed.
 #[must_use]
 pub fn consent_allows_server_side_auction(ctx: &ConsentContext) -> bool {
-    let requires_tcf_purpose1 = ctx.gdpr_applies
-        || matches!(
-            ctx.jurisdiction,
-            jurisdiction::Jurisdiction::Gdpr | jurisdiction::Jurisdiction::Unknown
-        );
-    if !requires_tcf_purpose1 {
+    if !tcf_applies(ctx) {
         return true;
     }
     effective_tcf(ctx).is_some_and(|tcf| tcf.has_purpose_consent(1))
@@ -780,6 +786,12 @@ mod tests {
                 section_ids: vec![2],
                 eu_tcf: Some(make_tcf(gpp_last_updated_ds, gpp_allows_eids)),
                 us_sale_opt_out: None,
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         }
@@ -792,6 +804,12 @@ mod tests {
             section_ids: vec![2],
             eu_tcf: Some(make_tcf(0, allows_eids)),
             us_sale_opt_out: None,
+            us_sharing_opt_out: None,
+            us_targeted_advertising_opt_out: None,
+            us_gpc: None,
+            us_known_child: None,
+            us_privacy_section: None,
+            us_section_decode_failed: false,
         };
         let cases = [
             (
@@ -952,6 +970,12 @@ mod tests {
                 section_ids: vec![2],
                 eu_tcf: Some(TcfBuilder::new().with_storage(true).build()),
                 us_sale_opt_out: None,
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         };
@@ -1113,6 +1137,12 @@ mod tests {
                 section_ids: vec![2],
                 eu_tcf: Some(make_tcf(0, true)),
                 us_sale_opt_out: None,
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         };
@@ -1226,6 +1256,12 @@ mod tests {
                 section_ids: vec![2],
                 eu_tcf: Some(make_tcf_with_storage(true)),
                 us_sale_opt_out: None,
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             gdpr_applies: true,
             ..ConsentContext::default()
@@ -1441,6 +1477,12 @@ mod tests {
                 section_ids: vec![7],
                 eu_tcf: None,
                 us_sale_opt_out: Some(false),
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         };
@@ -1459,6 +1501,12 @@ mod tests {
                 section_ids: vec![7],
                 eu_tcf: None,
                 us_sale_opt_out: Some(true),
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         };
@@ -1482,6 +1530,12 @@ mod tests {
                 section_ids: vec![7],
                 eu_tcf: None,
                 us_sale_opt_out: Some(false),
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         };
@@ -1501,6 +1555,12 @@ mod tests {
                 section_ids: vec![7],
                 eu_tcf: None,
                 us_sale_opt_out: Some(true),
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             ..ConsentContext::default()
         };
@@ -1523,6 +1583,12 @@ mod tests {
                 section_ids: vec![7],
                 eu_tcf: None,
                 us_sale_opt_out: Some(false),
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             us_privacy: Some(UsPrivacy {
                 version: 1,
@@ -1551,6 +1617,12 @@ mod tests {
                 section_ids: vec![2],
                 eu_tcf: None,
                 us_sale_opt_out: None,
+                us_sharing_opt_out: None,
+                us_targeted_advertising_opt_out: None,
+                us_gpc: None,
+                us_known_child: None,
+                us_privacy_section: None,
+                us_section_decode_failed: false,
             }),
             us_privacy: Some(UsPrivacy {
                 version: 1,
diff --git a/crates/trusted-server-core/src/consent/types.rs b/crates/trusted-server-core/src/consent/types.rs
index 7d1b1902aa..f9e0912e37 100644
--- a/crates/trusted-server-core/src/consent/types.rs
+++ b/crates/trusted-server-core/src/consent/types.rs
@@ -105,7 +105,7 @@ impl fmt::Display for RawConsentSignals {
 ///
 /// Built from [`RawConsentSignals`] by the decoding pipeline in
 /// [`super::build_consent_context`].
-#[derive(Debug, Clone, Default)]
+#[derive(Clone, Default)]
 pub struct ConsentContext {
     /// Raw TC String from `euconsent-v2` cookie, passed as-is in `user.consent`.
     pub raw_tc_string: Option<String>,
@@ -148,6 +148,33 @@ pub struct ConsentContext {
     pub source: ConsentSource,
 }
 
+/// Prints `[redacted]` in place of every raw consent string, so a stray
+/// `{:?}` never writes a consent string to a log.
+impl fmt::Debug for ConsentContext {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fn redacted(raw: &Option<String>) -> Option<&'static str> {
+            raw.as_ref().map(|_| "[redacted]")
+        }
+
+        formatter
+            .debug_struct("ConsentContext")
+            .field("raw_tc_string", &redacted(&self.raw_tc_string))
+            .field("raw_gpp_string", &redacted(&self.raw_gpp_string))
+            .field("gpp_section_ids", &self.gpp_section_ids)
+            .field("raw_us_privacy", &redacted(&self.raw_us_privacy))
+            .field("raw_ac_string", &redacted(&self.raw_ac_string))
+            .field("gdpr_applies", &self.gdpr_applies)
+            .field("tcf", &self.tcf)
+            .field("gpp", &self.gpp)
+            .field("us_privacy", &self.us_privacy)
+            .field("expired", &self.expired)
+            .field("gpc", &self.gpc)
+            .field("jurisdiction", &self.jurisdiction)
+            .field("source", &self.source)
+            .finish()
+    }
+}
+
 impl ConsentContext {
     /// Returns `true` when no consent signals are present.
     #[must_use]
@@ -308,6 +335,28 @@ pub struct GppConsent {
     /// - `Some(false)` — a US section is present and user did not opt out
     /// - `None` — no US section exists in the GPP string
     pub us_sale_opt_out: Option<bool>,
+    /// Whether the user opted out of sharing for cross-context behavioural
+    /// advertising via a US GPP section that defines it (US National,
+    /// California). `None` when no such section is present or decodable.
+    pub us_sharing_opt_out: Option<bool>,
+    /// Whether the user opted out of targeted advertising via a US GPP
+    /// section that defines it (US National and most state sections). `None`
+    /// when no such section is present or decodable.
+    pub us_targeted_advertising_opt_out: Option<bool>,
+    /// The Global Privacy Control field of the US National section. `None`
+    /// when that section or its GPC segment is absent.
+    pub us_gpc: Option<bool>,
+    /// Whether the US National section marks a known child without consent.
+    /// `Some(false)` when the section is present and marks none, `None` when
+    /// it is absent or undecodable.
+    pub us_known_child: Option<bool>,
+    /// The US Privacy string carried as GPP section 6, read through the
+    /// standalone US Privacy decoder. `None` when absent or undecodable.
+    pub us_privacy_section: Option<UsPrivacy>,
+    /// Whether a US section (IDs 7–23) or section 6 was present but failed to
+    /// decode, so its opt-outs are unknown. Strict identity policies fail
+    /// closed on it.
+    pub us_section_decode_failed: bool,
 }
 
 // ---------------------------------------------------------------------------
@@ -414,6 +463,45 @@ impl core::error::Error for ConsentDecodeError {}
 mod tests {
     use super::*;
 
+    #[test]
+    fn consent_context_debug_redacts_raw_strings() {
+        let context = ConsentContext {
+            raw_tc_string: Some("tc-string-example".to_owned()),
+            raw_gpp_string: Some("gpp-string-example".to_owned()),
+            raw_us_privacy: Some("usp-string-example".to_owned()),
+            raw_ac_string: Some("ac-string-example".to_owned()),
+            gdpr_applies: true,
+            gpc: true,
+            ..ConsentContext::default()
+        };
+
+        let rendered = format!("{context:?}");
+
+        for raw in [
+            "tc-string-example",
+            "gpp-string-example",
+            "usp-string-example",
+            "ac-string-example",
+        ] {
+            assert!(
+                !rendered.contains(raw),
+                "should not print the raw string {raw}"
+            );
+        }
+        assert!(
+            rendered.contains("[redacted]"),
+            "should mark the raw strings as redacted"
+        );
+        assert!(
+            rendered.contains("gdpr_applies: true") && rendered.contains("gpc: true"),
+            "should still print the non-secret fields"
+        );
+        assert!(
+            format!("{:?}", ConsentContext::default()).contains("raw_tc_string: None"),
+            "should print an absent raw string as None"
+        );
+    }
+
     #[test]
     fn empty_signals() {
         let signals = RawConsentSignals::default();
diff --git a/crates/trusted-server-core/src/constants.rs b/crates/trusted-server-core/src/constants.rs
index 1fd3c2382c..aa5f77f0be 100644
--- a/crates/trusted-server-core/src/constants.rs
+++ b/crates/trusted-server-core/src/constants.rs
@@ -1,11 +1,15 @@
 use http::header::HeaderName;
 
 pub const COOKIE_TS_EC: &str = "ts-ec";
-/// Short-lived signed proof that the current EC row has every pull-partner UID.
-pub const COOKIE_TS_EC_PULL_COMPLETE: &str = "ts-ec-pull-complete";
+/// Marks a global revoke: holds the consent fingerprint the revoke saw, and
+/// stops EC minting while the request's consent is unchanged.
+pub const COOKIE_TS_EC_REVOKED: &str = "ts-ec-revoked";
 /// Cookie written by the Trusted Server JS SDK containing a standard-base64-encoded
 /// JSON array of Extended User IDs (`[{ source, uids }]`) from identity providers.
 pub const COOKIE_TS_EIDS: &str = "ts-eids";
+/// Client-only mirror of the servable server-side EIDs, written by the shim
+/// and never read by the server (spec 6.2).
+pub const COOKIE_TS_EIDS_S: &str = "__Host-ts-eids-s";
 pub const COOKIE_TS_TESTER: &str = "ts-tester";
 pub const COOKIE_SHAREDID: &str = "sharedId";
 
@@ -48,6 +52,8 @@ pub const TS_GIT_VERSION: Option<&str> = match option_env!("TRUSTED_SERVER__GIT_
 // Fastly environment variables
 pub const ENV_FASTLY_SERVICE_VERSION: &str = "FASTLY_SERVICE_VERSION";
 pub const ENV_FASTLY_IS_STAGING: &str = "FASTLY_IS_STAGING";
+pub const ENV_FASTLY_SERVICE_ID: &str = "FASTLY_SERVICE_ID";
+pub const ENV_FASTLY_POP: &str = "FASTLY_POP";
 
 // Common standard header names used across modules
 pub const HEADER_USER_AGENT: HeaderName = HeaderName::from_static("user-agent");
diff --git a/crates/trusted-server-core/src/cookies.rs b/crates/trusted-server-core/src/cookies.rs
index 6cd7e913bb..e269045269 100644
--- a/crates/trusted-server-core/src/cookies.rs
+++ b/crates/trusted-server-core/src/cookies.rs
@@ -11,7 +11,10 @@ use error_stack::{Report, ResultExt as _};
 use http::Request;
 use http::header;
 
-use crate::constants::{COOKIE_EUCONSENT_V2, COOKIE_GPP, COOKIE_GPP_SID, COOKIE_US_PRIVACY};
+use crate::constants::{
+    COOKIE_EUCONSENT_V2, COOKIE_GPP, COOKIE_GPP_SID, COOKIE_TS_EC, COOKIE_TS_EIDS,
+    COOKIE_TS_EIDS_S, COOKIE_US_PRIVACY,
+};
 use crate::error::TrustedServerError;
 
 /// Cookie names carrying privacy consent signals.
@@ -25,6 +28,23 @@ pub const CONSENT_COOKIE_NAMES: &[&str] = &[
     COOKIE_US_PRIVACY,
 ];
 
+/// Trusted Server identity cookies that never reach a third party.
+///
+/// Stripped from Prebid Server requests and never added to proxy or provider
+/// requests.
+pub const TS_IDENTITY_COOKIE_NAMES: &[&str] = &[COOKIE_TS_EC, COOKIE_TS_EIDS, COOKIE_TS_EIDS_S];
+
+/// Identity cookies removed from publisher-origin requests by default.
+///
+/// `ts-ec` and `ts-eids` still reach the origin, as they did before the
+/// `ts-eids-s` mirror existed, so the origin's `Cookie` header stays at its
+/// earlier size. See [`TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS`].
+pub const TS_ORIGIN_STRIPPED_COOKIE_NAMES: &[&str] = &[COOKIE_TS_EIDS_S];
+
+/// Identity cookies removed from publisher-origin requests when the operator
+/// sets `ec.strip_eids_cookie_from_origin`: `ts-eids` as well as the mirror.
+pub const TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS: &[&str] = &[COOKIE_TS_EIDS, COOKIE_TS_EIDS_S];
+
 /// Parses a cookie string into a [`CookieJar`].
 ///
 /// Returns an empty jar if the cookie string is unparseable.
@@ -80,6 +100,52 @@ pub fn extract_cookie_value<B>(req: &Request<B>, name: &str) -> Option<String> {
     })
 }
 
+/// Strips cookies whose name is exactly one of `names` from a `Cookie` header
+/// value.
+///
+/// Returns an empty string when nothing is left.
+#[must_use]
+pub fn strip_cookie_pairs(cookie_header: &str, names: &[&str]) -> String {
+    cookie_header
+        .split(';')
+        .map(str::trim)
+        .filter(|pair| !pair.is_empty())
+        .filter(|pair| {
+            let name = pair.split('=').next().unwrap_or_default().trim();
+            !names.contains(&name)
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+/// Strips matching cookies from every `Cookie` field in `headers`.
+///
+/// All `Cookie` fields are read, matching pairs are removed, and the rest is
+/// written back as one field. A field that is not valid UTF-8 is dropped
+/// rather than forwarded, because it cannot be checked. The header is removed
+/// when nothing is left.
+pub fn strip_cookie_headers(headers: &mut http::HeaderMap, names: &[&str]) {
+    let retained = headers
+        .get_all(header::COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .map(|value| strip_cookie_pairs(value, names))
+        .filter(|value| !value.is_empty())
+        .collect::<Vec<_>>()
+        .join("; ");
+
+    headers.remove(header::COOKIE);
+    if retained.is_empty() {
+        return;
+    }
+    match http::HeaderValue::from_str(&retained) {
+        Ok(value) => {
+            headers.insert(header::COOKIE, value);
+        }
+        Err(_) => log::debug!("Dropping Cookie header that is invalid after stripping"),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use http::HeaderValue;
@@ -225,4 +291,69 @@ mod tests {
 
         assert_eq!(extract_cookie_value(&req, "session"), None);
     }
+    #[test]
+    fn strip_cookie_pairs_removes_exact_names_only() {
+        let header =
+            "ts-ec=abc; ts-eids=W10; __Host-ts-eids-s=eyJ2IjoxfQ; other=1; ts-eids-extra=keep";
+
+        let stripped = strip_cookie_pairs(header, TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS);
+
+        assert_eq!(
+            stripped, "ts-ec=abc; other=1; ts-eids-extra=keep",
+            "should drop the ID cookies and keep ts-ec and a cookie that only shares a prefix"
+        );
+
+        assert_eq!(
+            strip_cookie_pairs(header, TS_ORIGIN_STRIPPED_COOKIE_NAMES),
+            "ts-ec=abc; ts-eids=W10; other=1; ts-eids-extra=keep",
+            "should drop only the mirror by default"
+        );
+    }
+
+    #[test]
+    fn strip_cookie_headers_joins_every_cookie_field_and_drops_non_utf8() {
+        let mut headers = http::HeaderMap::new();
+        headers.append(
+            header::COOKIE,
+            http::HeaderValue::from_static("ts-ec=abc; ts-eids=W10"),
+        );
+        headers.append(
+            header::COOKIE,
+            http::HeaderValue::from_bytes(b"bad=\xff").expect("should build an opaque header"),
+        );
+        headers.append(header::COOKIE, http::HeaderValue::from_static("other=1"));
+
+        strip_cookie_headers(&mut headers, TS_IDENTITY_COOKIE_NAMES);
+
+        let values: Vec<_> = headers.get_all(header::COOKIE).iter().collect();
+        assert_eq!(values.len(), 1, "should collapse into one Cookie header");
+        assert_eq!(
+            values[0], "other=1",
+            "should keep only the unrelated cookie"
+        );
+    }
+
+    #[test]
+    fn strip_cookie_headers_removes_header_when_nothing_is_left() {
+        let mut headers = http::HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            http::HeaderValue::from_static("ts-ec=abc; __Host-ts-eids-s=eyJ2IjoxfQ"),
+        );
+        headers.insert(
+            header::USER_AGENT,
+            http::HeaderValue::from_static("ExampleBrowser/1.0"),
+        );
+
+        strip_cookie_headers(&mut headers, TS_IDENTITY_COOKIE_NAMES);
+
+        assert!(
+            headers.get(header::COOKIE).is_none(),
+            "should remove the empty Cookie header"
+        );
+        assert!(
+            headers.get(header::USER_AGENT).is_some(),
+            "should leave other headers alone"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/cookies/template_cache_policy.rs b/crates/trusted-server-core/src/cookies/template_cache_policy.rs
index 61c3b9139c..7c42a8d6f1 100644
--- a/crates/trusted-server-core/src/cookies/template_cache_policy.rs
+++ b/crates/trusted-server-core/src/cookies/template_cache_policy.rs
@@ -2,7 +2,7 @@
 
 use std::collections::{HashMap, HashSet};
 
-use crate::constants::{COOKIE_SHAREDID, COOKIE_TS_EC, COOKIE_TS_EIDS};
+use crate::constants::{COOKIE_SHAREDID, COOKIE_TS_EC, COOKIE_TS_EIDS, COOKIE_TS_EIDS_S};
 use crate::platform::TemplateCookieValue;
 
 /// Whether the request can share a template and its explicit cookie dimensions.
@@ -32,7 +32,13 @@ pub(crate) fn validate_cookie_names(
                 return Err(format!("{field} contains invalid cookie name `{name}`"));
             }
             if field == "template_cache_key_cookies"
-                && [COOKIE_TS_EC, COOKIE_TS_EIDS, COOKIE_SHAREDID].contains(&name.as_str())
+                && [
+                    COOKIE_TS_EC,
+                    COOKIE_TS_EIDS,
+                    COOKIE_TS_EIDS_S,
+                    COOKIE_SHAREDID,
+                ]
+                .contains(&name.as_str())
             {
                 return Err(format!(
                     "{field} must not key on Trusted Server identity cookie `{name}`"
@@ -246,6 +252,20 @@ mod tests {
         }
     }
 
+    #[test]
+    fn template_cache_key_rejects_the_mirror_cookie() {
+        let error = validate_cookie_names(&names(&["__Host-ts-eids-s"]), &[])
+            .expect_err("should reject the mirror cookie as a cache key");
+        assert!(
+            error.contains("must not key on Trusted Server identity cookie"),
+            "should explain the rejection, got {error}"
+        );
+        assert!(
+            validate_cookie_names(&names(&["session"]), &[]).is_ok(),
+            "should still accept an unrelated cookie"
+        );
+    }
+
     #[test]
     fn template_cookie_policy_allows_only_independent_unlisted_duplicates() {
         for fields in [
diff --git a/crates/trusted-server-core/src/ec/admin.rs b/crates/trusted-server-core/src/ec/admin.rs
index e21fab702c..c8b5df52f3 100644
--- a/crates/trusted-server-core/src/ec/admin.rs
+++ b/crates/trusted-server-core/src/ec/admin.rs
@@ -6,6 +6,9 @@
 //! attach, so operators can debug KV-to-auction propagation without KV
 //! console access.
 //!
+//! Also serves `DELETE /_ts/admin/ec/{id}/providers/{provider}/opt-out`,
+//! which clears a provider's sticky opt-out.
+//!
 //! Also serves `GET /_ts/admin/eids`, which echoes the request's `ts-eids`
 //! and `sharedId` cookies with an ingestion preview — the client-side half
 //! of EID propagation that is never stored server-side.
@@ -26,13 +29,26 @@ use serde_json::Value as JsonValue;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt as _};
 
+use crate::consent::ConsentContext;
+use crate::consent::jurisdiction::Jurisdiction;
 use crate::constants::{COOKIE_SHAREDID, COOKIE_TS_EIDS};
 use crate::cookies::extract_cookie_value;
 use crate::error::TrustedServerError;
 use crate::openrtb::Eid;
 
+use super::checked_current_timestamp;
 use super::eids::{resolve_partner_ids, to_eids};
 use super::generation::is_valid_ec_id;
+use super::identity::IdentityProviderId;
+use super::identity::IdentityRuntime;
+use super::identity::UnixTime;
+use super::identity::catalog::ProviderCatalog;
+use super::identity::input::ThreadRandom;
+use super::identity::mutation::{ApplyContext, IdentityMutation, ProviderStateChange};
+use super::identity::policy::PolicySignals;
+use super::identity::removal::{RemovalTiming, RemovalWriteOutcome, write_removals};
+use super::identity::request::opted_out;
+use super::identity::servable::ServeContext;
 use super::kv::KvIdentityGraph;
 use super::kv_backend::EcKvLookup;
 use super::kv_types::{KvEntry, KvMetadata};
@@ -276,6 +292,7 @@ struct SkippedPartnerId {
 pub fn handle_admin_ec_lookup(
     kv: Option<&KvIdentityGraph>,
     registry: &PartnerRegistry,
+    runtime: Option<&IdentityRuntime>,
     req: &Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let Some(kv) = kv else {
@@ -297,7 +314,7 @@ pub fn handle_admin_ec_lookup(
     };
 
     log::info!("Admin EC lookup: returning entry for '{}'", log_id(&ec_id));
-    let payload = build_lookup_response(registry, kv.store_name(), ec_id, &lookup);
+    let payload = build_lookup_response(registry, runtime, kv.store_name(), ec_id, &lookup);
     let body =
         serde_json::to_string(&payload).change_context(TrustedServerError::Configuration {
             message: "failed to serialize admin EC lookup response".to_owned(),
@@ -305,6 +322,104 @@ pub fn handle_admin_ec_lookup(
     Ok(json_response(StatusCode::OK, body))
 }
 
+/// Handles `DELETE /_ts/admin/ec/{id}/providers/{provider}/opt-out`.
+///
+/// Clears the provider's sticky opt-out `ps.o` by writing `oc = now`, which
+/// also empties `ps.ov` (spec 8). It runs the removal write's CAS loop and
+/// never reads the request's cookies or consent. Responds:
+///
+/// - `200 OK` with `{"cleared": true}` when the clear was written;
+/// - `400 Bad Request` for an invalid EC ID or provider ID;
+/// - `404 Not Found` when the row is missing or the provider holds no opt-out;
+/// - `405 Method Not Allowed` for any method but `DELETE`;
+/// - `501 Not Implemented` when no EC identity graph is configured;
+/// - `503 Service Unavailable` when the write did not land.
+#[must_use]
+pub fn handle_admin_opt_out_clear(
+    kv: Option<&KvIdentityGraph>,
+    req: &Request<EdgeBody>,
+) -> Response<EdgeBody> {
+    if req.method() != Method::DELETE {
+        let mut response = json_error(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+        response
+            .headers_mut()
+            .insert(header::ALLOW, HeaderValue::from_static("DELETE"));
+        return response;
+    }
+    let Some(kv) = kv else {
+        return admin_ec_lookup_not_supported();
+    };
+    let Some((ec_id, provider)) = opt_out_path_parts(req.uri().path()) else {
+        return json_error(StatusCode::NOT_FOUND, "admin diagnostic route not found");
+    };
+    if !is_valid_ec_id(ec_id) {
+        return json_error(
+            StatusCode::BAD_REQUEST,
+            "invalid EC ID format (expected {64hex}.{6alnum})",
+        );
+    }
+    let Ok(provider) = provider.parse::<IdentityProviderId>() else {
+        return json_error(StatusCode::BAD_REQUEST, "invalid identity provider ID");
+    };
+
+    let Some(now) = checked_current_timestamp() else {
+        return json_error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "the clock is unavailable, so the opt-out was not cleared",
+        );
+    };
+    let mut clear = IdentityMutation::default();
+    clear.merge_state(
+        provider.clone(),
+        ProviderStateChange {
+            opt_out_clear: Some(now),
+            ..ProviderStateChange::default()
+        },
+    );
+    let catalog = ProviderCatalog::empty();
+    let context = ApplyContext {
+        now,
+        random: &ThreadRandom,
+        catalog: &catalog,
+    };
+    match write_removals(kv, ec_id, &clear, &context, RemovalTiming::BeforeSend) {
+        RemovalWriteOutcome::Written => {
+            log::info!(
+                "Admin cleared the opt-out of identity provider '{provider}' for '{}'",
+                log_id(ec_id)
+            );
+            json_response(StatusCode::OK, r#"{"cleared":true}"#.to_owned())
+        }
+        RemovalWriteOutcome::NothingToWrite => json_error(
+            StatusCode::NOT_FOUND,
+            "no EC entry, or the provider holds no opt-out to clear",
+        ),
+        RemovalWriteOutcome::Failed => json_error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "the opt-out clear could not be written; retry",
+        ),
+    }
+}
+
+/// Splits `/_ts/admin/ec/{id}/providers/{provider}/opt-out` into its EC ID
+/// and provider ID, or `None` for any other shape.
+fn opt_out_path_parts(path: &str) -> Option<(&str, &str)> {
+    let mut segments = path
+        .strip_prefix(ADMIN_EC_PATH)?
+        .strip_prefix('/')?
+        .split('/');
+    let ec_id = segments.next()?;
+    let (Some("providers"), Some(provider), Some("opt-out"), None) = (
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+    ) else {
+        return None;
+    };
+    Some((ec_id, provider))
+}
+
 /// Returns the portable response used when an adapter has no EC KV backend.
 #[must_use]
 pub fn admin_ec_lookup_not_supported() -> Response<EdgeBody> {
@@ -368,12 +483,26 @@ fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeB
     Ok(ec_id)
 }
 
+/// Replaces every `ps.<provider>.st` with a marker. Provider state is never
+/// returned by the admin lookup (spec 6.1, 9.3).
+fn redact_provider_state(entry: &mut JsonValue) {
+    let Some(states) = entry.get_mut("ps").and_then(JsonValue::as_object_mut) else {
+        return;
+    };
+    for state in states.values_mut() {
+        if let Some(st) = state.get_mut("st") {
+            *st = JsonValue::String("[redacted]".to_owned());
+        }
+    }
+}
+
 /// Builds the success payload from a raw KV lookup.
 ///
 /// Parse failures are reported in the payload rather than propagated, so
 /// corrupt entries remain inspectable.
 fn build_lookup_response(
     registry: &PartnerRegistry,
+    runtime: Option<&IdentityRuntime>,
     store_name: &str,
     ec_id: String,
     lookup: &EcKvLookup,
@@ -393,14 +522,26 @@ fn build_lookup_response(
 
     match serde_json::from_slice::<JsonValue>(&lookup.body) {
         Ok(mut entry_json) => {
+            redact_provider_state(&mut entry_json);
             add_iso_timestamp_companions(&mut entry_json);
             payload.entry = Some(entry_json);
 
             match serde_json::from_slice::<KvEntry>(&lookup.body) {
-                Ok(entry) => {
+                Ok(mut entry) => {
                     payload.tombstone = Some(!entry.consent.ok);
-                    match entry.validate() {
-                        Ok(()) => payload.auction = Some(build_auction_view(registry, &entry)),
+                    // Upgrade first so the auction view matches what the read
+                    // path serves, with invalid records dropped.
+                    let upgraded = entry
+                        .upgrade_for_read()
+                        .and_then(|dropped| entry.validate().map(|()| dropped));
+                    match upgraded {
+                        Ok(dropped) => {
+                            payload.auction = Some(build_auction_view(registry, &entry, runtime));
+                            if !dropped.is_empty() {
+                                payload.entry_error =
+                                    Some(format!("dropped on read: {}", dropped.join("; ")));
+                            }
+                        }
                         Err(message) => {
                             payload.entry_error = Some(format!(
                                 "entry failed validation (auction reads fail closed \
@@ -481,19 +622,57 @@ fn iso_timestamp(unix_seconds: u64) -> Option<String> {
 
 /// Derives the auction EID view for a valid entry, mirroring the filters in
 /// [`resolve_partner_ids`] and reporting why each stored ID was skipped.
-fn build_auction_view(registry: &PartnerRegistry, entry: &KvEntry) -> AuctionEidsView {
-    let resolved = resolve_partner_ids(registry, entry);
+fn build_auction_view(
+    registry: &PartnerRegistry,
+    entry: &KvEntry,
+    runtime: Option<&IdentityRuntime>,
+) -> AuctionEidsView {
+    // The admin view has no request, so it reads with permissive consent. A
+    // failed clock resolves no KV IDs, as the auction does (spec 4.4).
+    let consent = ConsentContext {
+        jurisdiction: Jurisdiction::NonRegulated,
+        ..ConsentContext::default()
+    };
+    let empty_catalog;
+    let catalog = match runtime {
+        Some(runtime) => runtime.catalog(),
+        None => {
+            empty_catalog = ProviderCatalog::empty();
+            &empty_catalog
+        }
+    };
+    let opted_out = opted_out(entry);
+    let now = checked_current_timestamp();
+    let serve = ServeContext {
+        now: UnixTime::from_secs(now.unwrap_or(0)),
+        consent: &consent,
+        signals: PolicySignals::default(),
+        catalog,
+        opted_out: &opted_out,
+    };
+    let resolved = if now.is_some() {
+        resolve_partner_ids(registry, entry, &serve)
+    } else {
+        Vec::new()
+    };
     let eids = to_eids(&resolved);
 
     let mut skipped = Vec::new();
     for (source_domain, partner_uid) in &entry.ids {
-        let reason = if partner_uid.uid.is_empty() {
+        let reason = if partner_uid.first_uid().is_none_or(str::is_empty) {
             "empty_uid"
         } else {
             match registry.get(source_domain) {
                 None => "not_in_registry",
                 Some(partner) if !partner.bidstream_enabled => "bidstream_disabled",
-                Some(_) => continue,
+                Some(_)
+                    if resolved
+                        .iter()
+                        .any(|item| item.source_domain == *source_domain) =>
+                {
+                    continue;
+                }
+                Some(_) => "not_servable",
             }
         };
         skipped.push(SkippedPartnerId {
@@ -684,7 +863,7 @@ mod tests {
     use super::*;
     use crate::ec::kv_backend::test_support::InMemoryEcKv;
     use crate::ec::kv_backend::{EcKvStore as _, EcKvWrite, EcKvWriteMode};
-    use crate::ec::kv_types::KvPartnerId;
+    use crate::ec::kv_types::{KvPartnerId, KvProviderState};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
 
@@ -703,8 +882,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -778,15 +958,11 @@ mod tests {
         let mut entry = KvEntry::minimal("bidstream.example", "uid-live", 1_741_824_000);
         entry.ids.insert(
             "disabled.example".to_owned(),
-            KvPartnerId {
-                uid: "uid-disabled".to_owned(),
-            },
+            KvPartnerId::new("uid-disabled"),
         );
         entry.ids.insert(
             "unknown.example".to_owned(),
-            KvPartnerId {
-                uid: "uid-unknown".to_owned(),
-            },
+            KvPartnerId::new("uid-unknown"),
         );
         entry
     }
@@ -971,13 +1147,156 @@ mod tests {
         }
     }
 
+    fn admin_lookup_body_for_test(entry: &KvEntry) -> serde_json::Value {
+        let ec_id = test_ec_id();
+        let kv = kv_with_entry(&ec_id, entry);
+        let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
+
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
+            .expect("should handle lookup");
+        response_json(response)
+    }
+
+    #[test]
+    fn admin_lookup_redacts_provider_state() {
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1_760_000_000);
+        entry.ps.insert(
+            "id5".to_owned(),
+            KvProviderState {
+                n: Some(5),
+                st: Some(serde_json::json!({ "signature": "secret-state" })),
+                ..KvProviderState::default()
+            },
+        );
+        let body = admin_lookup_body_for_test(&entry);
+
+        assert_eq!(
+            body["entry"]["ps"]["id5"]["st"],
+            serde_json::json!("[redacted]"),
+            "should redact the state"
+        );
+        assert_eq!(
+            body["entry"]["ps"]["id5"]["n"],
+            serde_json::json!(5),
+            "should keep the rest of ps"
+        );
+        assert_eq!(
+            body["entry"]["ids"]["example.com"]["eids"][0]["uids"][0]["id"],
+            serde_json::json!("example-uid"),
+            "should keep the ids"
+        );
+        assert!(
+            !body.to_string().contains("secret-state"),
+            "should never return the provider state"
+        );
+    }
+
+    #[test]
+    fn admin_lookup_reports_records_dropped_on_read() {
+        let ec_id = test_ec_id();
+        let body = serde_json::json!({
+            "v": 2,
+            "created": 1_741_824_000_u64,
+            "consent": { "ok": true, "updated": 1_741_824_000_u64 },
+            "geo": { "country": "US" },
+            "ids": {
+                "bidstream.example": { "eids": [{ "uids": [{ "id": "uid-live" }] }] },
+                "blank.example": { "eids": [{ "uids": [{ "id": " " }] }] }
+            }
+        })
+        .to_string();
+        let kv = kv_with_raw_body(&ec_id, &body);
+        let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
+
+        let json = response_json(
+            handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
+                .expect("should handle lookup"),
+        );
+
+        let error = json["entry_error"].as_str().expect("should report a drop");
+        assert!(
+            error.starts_with("dropped on read: ") && error.contains("blank.example"),
+            "should name the dropped source, got {error}"
+        );
+        assert_eq!(
+            json["auction"]["eids"][0]["source"], "bidstream.example",
+            "should build the auction view from the surviving record"
+        );
+    }
+
+    #[test]
+    fn admin_view_serves_generic_pull_records_with_the_runtime_catalog() {
+        use crate::ec::identity::test_support::{ec_partner, record_for_test};
+        use crate::test_support::tests::create_test_settings;
+
+        let mut partner = ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        );
+        partner.api_token = Some(crate::redacted::Redacted::new(
+            "token-ssp-example-com-32-bytes-minimum".to_owned(),
+        ));
+        let registry = PartnerRegistry::from_config(std::slice::from_ref(&partner))
+            .expect("should build registry");
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![partner];
+        let runtime = IdentityRuntime::from_settings(
+            &settings,
+            &crate::integrations::IntegrationRegistry::default(),
+        )
+        .expect("should build the runtime");
+        let mut entry = KvEntry::minimal("other.example.com", "other", 1);
+        entry.ids.insert(
+            "ssp.example.com".to_owned(),
+            record_for_test("pulled-uid", Some("pull-ssp-example-com"), 1),
+        );
+
+        let with_runtime = build_auction_view(&registry, &entry, Some(&runtime));
+        let without_runtime = build_auction_view(&registry, &entry, None);
+
+        assert!(
+            with_runtime
+                .eids
+                .iter()
+                .any(|eid| eid.source == "ssp.example.com"),
+            "should serve the pulled record when the runtime's catalog holds its writer"
+        );
+        assert!(
+            without_runtime
+                .eids
+                .iter()
+                .all(|eid| eid.source != "ssp.example.com"),
+            "control: should not serve it without a runtime"
+        );
+    }
+
+    #[test]
+    fn auction_view_reports_an_expired_record_as_not_servable() {
+        let mut entry = KvEntry::minimal("bidstream.example", "uid-expired", 1_741_824_000);
+        entry
+            .ids
+            .get_mut("bidstream.example")
+            .expect("should hold the source")
+            .exp = Some(50);
+
+        let view = build_auction_view(&test_registry(), &entry, None);
+
+        assert!(view.eids.is_empty(), "should not resolve the expired ID");
+        assert_eq!(view.skipped.len(), 1, "should explain the dropped ID");
+        assert_eq!(
+            view.skipped[0].reason, "not_servable",
+            "should report the servability reason"
+        );
+    }
+
     #[test]
     fn returns_entry_with_auction_view() {
         let ec_id = test_ec_id();
         let kv = kv_with_entry(&ec_id, &sample_entry());
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -995,7 +1314,7 @@ mod tests {
         assert_eq!(json["store"], "test-store");
         assert_eq!(json["tombstone"], false);
         assert_eq!(
-            json["entry"]["ids"]["bidstream.example"]["uid"], "uid-live",
+            json["entry"]["ids"]["bidstream.example"]["eids"][0]["uids"][0]["id"], "uid-live",
             "should echo the stored entry verbatim"
         );
         assert_eq!(
@@ -1073,7 +1392,7 @@ mod tests {
         let kv = kv_with_raw_body_and_metadata(&ec_id, &body, &metadata);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
         let json = response_json(response);
 
@@ -1100,7 +1419,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, &body);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
         let json = response_json(response);
 
@@ -1132,7 +1451,7 @@ mod tests {
         );
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1152,7 +1471,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_FOUND);
@@ -1163,7 +1482,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request("/_ts/admin/ec/not-a-valid-id");
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
@@ -1175,7 +1494,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, "not json at all");
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(
@@ -1216,7 +1535,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, &body);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1241,7 +1560,7 @@ mod tests {
         let kv = kv_with_entry(&ec_id, &sample_entry());
         let req = get_request_with_cookie("/_ts/admin/ec", &format!("other=1; ts-ec={ec_id}; x=2"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1266,7 +1585,7 @@ mod tests {
             &format!("ts-ec={stale_ec_id}; ts-ec={live_ec_id}"),
         );
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1283,7 +1602,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request("/_ts/admin/ec");
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_FOUND);
@@ -1301,8 +1620,8 @@ mod tests {
     fn missing_identity_graph_returns_501() {
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let response =
-            handle_admin_ec_lookup(None, &test_registry(), &req).expect("should handle lookup");
+        let response = handle_admin_ec_lookup(None, &test_registry(), None, &req)
+            .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_IMPLEMENTED);
     }
@@ -1336,7 +1655,7 @@ mod tests {
         let kv = KvIdentityGraph::failing("broken-store");
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let result = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req);
+        let result = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req);
 
         assert!(result.is_err(), "should propagate KV read failures");
     }
@@ -1478,6 +1797,33 @@ mod tests {
         );
     }
 
+    #[test]
+    fn eids_lookup_reports_non_array_cookie_as_parse_error() {
+        let payload = BASE64.encode(br#"{"a":1}"#);
+        let req = get_request_with_cookie("/_ts/admin/eids", &format!("ts-eids={payload}"));
+
+        let response =
+            handle_admin_eids_lookup(&test_registry(), &req).expect("should handle eids lookup");
+
+        let json = response_json(response);
+        assert_eq!(json["cookie_present"], true);
+        assert!(
+            json["parse_error"]
+                .as_str()
+                .expect("should have parse_error")
+                .contains("ts-eids"),
+            "should describe the parse failure"
+        );
+        assert!(json.get("eids").is_none(), "should omit unparsed eids");
+        assert!(
+            json["ingest"]["matched"]
+                .as_array()
+                .expect("should have matched list")
+                .is_empty(),
+            "non-array cookie should preview no matches"
+        );
+    }
+
     #[test]
     fn eids_lookup_reports_parse_error() {
         let req = get_request_with_cookie("/_ts/admin/eids", "ts-eids=!!!not-base64!!!");
@@ -1533,4 +1879,137 @@ mod tests {
         assert_eq!(matched[0]["source_domain"], "sharedid.org");
         assert_eq!(matched[0]["uid"], "shared-uid-123");
     }
+
+    const OPT_OUT_PROVIDER: &str = "pull-ssp-example-com";
+
+    fn opt_out_path(ec_id: &str, provider: &str) -> String {
+        format!("/_ts/admin/ec/{ec_id}/providers/{provider}/opt-out")
+    }
+
+    fn opted_out_entry() -> KvEntry {
+        let mut entry = sample_entry();
+        entry.ps.insert(
+            OPT_OUT_PROVIDER.to_owned(),
+            KvProviderState {
+                o: Some(crate::ec::kv_types::KvOptOut {
+                    at: 1_000,
+                    fp: "800".to_owned(),
+                }),
+                ov: vec!["0123456789abcdef".to_owned()],
+                ..KvProviderState::default()
+            },
+        );
+        entry.ps.insert(
+            "other-provider".to_owned(),
+            KvProviderState {
+                ov: vec!["fedcba9876543210".to_owned()],
+                ..KvProviderState::default()
+            },
+        );
+        entry
+    }
+
+    #[test]
+    fn admin_clears_provider_opt_out() {
+        let ec_id = test_ec_id();
+        let kv = kv_with_entry(&ec_id, &opted_out_entry());
+
+        let response = handle_admin_opt_out_clear(
+            Some(&kv),
+            &request_with_method(
+                http::Method::DELETE,
+                &opt_out_path(&ec_id, OPT_OUT_PROVIDER),
+            ),
+        );
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "should clear the opt-out"
+        );
+        assert_eq!(
+            response_json(response),
+            serde_json::json!({ "cleared": true }),
+            "should report the clear"
+        );
+        let (stored, _) = kv
+            .get(&ec_id)
+            .expect("should read the row")
+            .expect("should hold the row");
+        let state = stored
+            .ps
+            .get(OPT_OUT_PROVIDER)
+            .expect("should keep the provider state");
+        assert!(
+            state.oc.is_some_and(|clear| clear > 1_000),
+            "should store the clear as oc"
+        );
+        assert!(state.ov.is_empty(), "should empty ps.ov");
+        assert_eq!(
+            stored
+                .ps
+                .get("other-provider")
+                .map(|other| other.ov.clone()),
+            Some(vec!["fedcba9876543210".to_owned()]),
+            "control: another provider's state should be untouched"
+        );
+    }
+
+    #[test]
+    fn admin_opt_out_clear_rejects_what_it_cannot_clear() {
+        let ec_id = test_ec_id();
+        let kv = kv_with_entry(&ec_id, &opted_out_entry());
+        let delete = |path: &str| {
+            handle_admin_opt_out_clear(Some(&kv), &request_with_method(http::Method::DELETE, path))
+                .status()
+        };
+
+        assert_eq!(
+            delete(&opt_out_path(&ec_id, "other-provider")),
+            StatusCode::NOT_FOUND,
+            "should not find an opt-out the provider does not hold"
+        );
+        assert_eq!(
+            delete(&opt_out_path("not-an-ec-id", OPT_OUT_PROVIDER)),
+            StatusCode::BAD_REQUEST,
+            "should reject an invalid EC ID"
+        );
+        assert_eq!(
+            delete(&opt_out_path(&ec_id, "Not_A_Provider")),
+            StatusCode::BAD_REQUEST,
+            "should reject an invalid provider ID"
+        );
+        let get = handle_admin_opt_out_clear(
+            Some(&kv),
+            &get_request(&opt_out_path(&ec_id, OPT_OUT_PROVIDER)),
+        );
+        assert_eq!(
+            get.status(),
+            StatusCode::METHOD_NOT_ALLOWED,
+            "should accept only DELETE"
+        );
+        let (stored, _) = kv
+            .get(&ec_id)
+            .expect("should read the row")
+            .expect("should hold the row");
+        assert!(
+            stored
+                .ps
+                .get(OPT_OUT_PROVIDER)
+                .is_some_and(|state| state.oc.is_none() && !state.ov.is_empty()),
+            "control: no rejected request should clear the opt-out"
+        );
+        assert_eq!(
+            handle_admin_opt_out_clear(
+                None,
+                &request_with_method(
+                    http::Method::DELETE,
+                    &opt_out_path(&ec_id, OPT_OUT_PROVIDER)
+                ),
+            )
+            .status(),
+            StatusCode::NOT_IMPLEMENTED,
+            "should report an unconfigured identity graph"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/auth.rs b/crates/trusted-server-core/src/ec/auth.rs
index b7db6f1fa8..eec58d9a2e 100644
--- a/crates/trusted-server-core/src/ec/auth.rs
+++ b/crates/trusted-server-core/src/ec/auth.rs
@@ -57,8 +57,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
diff --git a/crates/trusted-server-core/src/ec/batch_sync.rs b/crates/trusted-server-core/src/ec/batch_sync.rs
index 4903589b29..fce040af47 100644
--- a/crates/trusted-server-core/src/ec/batch_sync.rs
+++ b/crates/trusted-server-core/src/ec/batch_sync.rs
@@ -24,6 +24,8 @@ use crate::error::TrustedServerError;
 
 use super::auth::authenticate_bearer;
 use super::generation::{is_valid_ec_id, normalize_ec_id_for_kv};
+use super::identity::ids::SourceDomain;
+use super::identity::runtime::IdentityRuntime;
 use super::kv::{KvIdentityGraph, UpsertResult};
 use super::log_id;
 use super::rate_limiter::RateLimiter;
@@ -45,6 +47,7 @@ trait BatchSyncWriter {
         ec_id: &str,
         partner_id: &str,
         uid: &str,
+        only_when_absent: bool,
     ) -> Result<UpsertResult, Report<TrustedServerError>>;
 }
 
@@ -54,8 +57,15 @@ impl BatchSyncWriter for KvIdentityGraph {
         ec_id: &str,
         partner_id: &str,
         uid: &str,
+        only_when_absent: bool,
     ) -> Result<UpsertResult, Report<TrustedServerError>> {
-        KvIdentityGraph::upsert_partner_id_if_exists(self, ec_id, partner_id, uid)
+        KvIdentityGraph::upsert_partner_id_if_exists_policy(
+            self,
+            ec_id,
+            partner_id,
+            uid,
+            only_when_absent,
+        )
     }
 }
 
@@ -108,6 +118,10 @@ struct MappingGroup {
 
 /// Handles `POST /_ts/api/v1/batch-sync`.
 ///
+/// A source an identity provider owns is written only when the row holds no
+/// value for it; a stored value, including a provider's entry set, is never
+/// replaced.
+///
 /// # Errors
 ///
 /// Returns [`TrustedServerError`] on serialization or KV store failures.
@@ -115,15 +129,17 @@ pub fn handle_batch_sync(
     kv: &KvIdentityGraph,
     registry: &PartnerRegistry,
     rate_limiter: &dyn RateLimiter,
+    identity: &IdentityRuntime,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    handle_batch_sync_with_writer(kv, registry, rate_limiter, req)
+    handle_batch_sync_with_writer(kv, registry, rate_limiter, identity, req)
 }
 
 fn handle_batch_sync_with_writer(
     writer: &dyn BatchSyncWriter,
     registry: &PartnerRegistry,
     rate_limiter: &dyn RateLimiter,
+    identity: &IdentityRuntime,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     // 1. Authenticate
@@ -167,7 +183,13 @@ fn handle_batch_sync_with_writer(
     }
 
     // 4. Process mappings with per-item validation and rejection reasons.
-    let (accepted, errors) = process_mappings(writer, &partner.source_domain, &body.mappings);
+    let owned = partner
+        .source_domain
+        .parse::<SourceDomain>()
+        .ok()
+        .is_some_and(|source| identity.catalog().owner_of(&source).is_some());
+    let (accepted, errors) =
+        process_mappings(writer, &partner.source_domain, owned, &body.mappings);
 
     let rejected = errors.len();
     let status = if rejected > 0 {
@@ -202,6 +224,7 @@ fn content_length_exceeds_limit(req: &Request<EdgeBody>, max_body_size: usize) -
 fn process_mappings(
     writer: &dyn BatchSyncWriter,
     partner_id: &str,
+    owned: bool,
     mappings: &[SyncMapping],
 ) -> (usize, Vec<MappingError>) {
     let mut errors = Vec::new();
@@ -244,7 +267,12 @@ fn process_mappings(
 
     let mut accepted = 0;
     for (group_index, group) in groups.iter().enumerate() {
-        match writer.upsert_partner_id_if_exists(&group.ec_id, partner_id, &group.partner_uid) {
+        match writer.upsert_partner_id_if_exists(
+            &group.ec_id,
+            partner_id,
+            &group.partner_uid,
+            owned,
+        ) {
             Ok(UpsertResult::Written | UpsertResult::Unchanged) => {
                 accepted += group.indexes.len();
             }
@@ -308,6 +336,10 @@ mod tests {
     use super::*;
     use std::collections::VecDeque;
 
+    use crate::ec::identity::test_support::{
+        example_entry_set, fixed_provider, full_record, pid, source as source_domain,
+    };
+    use crate::ec::kv_types::{KvEntry, KvPartnerId};
     use crate::error::TrustedServerError;
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
@@ -341,6 +373,14 @@ mod tests {
         ) -> Result<bool, Report<TrustedServerError>> {
             Ok(self.should_exceed)
         }
+
+        fn record(&self, _key: &str) -> Result<(), Report<TrustedServerError>> {
+            Ok(())
+        }
+
+        fn count(&self, _key: &str) -> Result<u32, Report<TrustedServerError>> {
+            Ok(0)
+        }
     }
 
     #[derive(Clone, Debug, PartialEq, Eq)]
@@ -374,6 +414,7 @@ mod tests {
             ec_id: &str,
             partner_id: &str,
             uid: &str,
+            _only_when_absent: bool,
         ) -> Result<UpsertResult, Report<TrustedServerError>> {
             self.calls.borrow_mut().push(WriterCall {
                 ec_id: ec_id.to_owned(),
@@ -406,8 +447,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -429,6 +471,136 @@ mod tests {
         serde_json::from_slice(&body).expect("should deserialize batch-sync response")
     }
 
+    fn identity_with_owner(owned: &[(&str, &str)]) -> IdentityRuntime {
+        let settings = crate::test_support::tests::create_test_settings();
+        let providers = owned
+            .iter()
+            .map(|(id, source)| fixed_provider(id, &[source]))
+            .collect();
+        let owners = owned
+            .iter()
+            .map(|(id, source)| (source_domain(source), pid(id)))
+            .collect();
+        IdentityRuntime::from_settings_with_providers(&settings, providers, owners)
+            .expect("should build the identity runtime")
+    }
+
+    fn empty_identity() -> IdentityRuntime {
+        identity_with_owner(&[])
+    }
+
+    fn batch_body(ec_id: &str, uid: &str) -> String {
+        serde_json::json!({
+            "mappings": [{ "ec_id": ec_id, "partner_uid": uid, "timestamp": 1 }]
+        })
+        .to_string()
+    }
+
+    fn seeded_graph(ec_id: &str, record: Option<KvPartnerId>) -> KvIdentityGraph {
+        let graph = KvIdentityGraph::in_memory("batch-store");
+        let mut entry = KvEntry::tombstone(1000);
+        entry.consent.ok = true;
+        if let Some(record) = record {
+            entry.ids.insert("ssp.example.com".to_owned(), record);
+        }
+        graph.create(ec_id, &entry).expect("should seed the row");
+        graph
+    }
+
+    fn stored_record(graph: &KvIdentityGraph, ec_id: &str) -> Option<KvPartnerId> {
+        let (entry, _) = graph
+            .get(ec_id)
+            .expect("should read the row")
+            .expect("should hold the row");
+        entry.ids.get("ssp.example.com").cloned()
+    }
+
+    fn run_batch(
+        graph: &KvIdentityGraph,
+        identity: &IdentityRuntime,
+        ec_id: &str,
+        uid: &str,
+    ) -> serde_json::Value {
+        let limiter = MockRateLimiter {
+            should_exceed: false,
+        };
+        let response = handle_batch_sync(
+            graph,
+            &test_registry(),
+            &limiter,
+            identity,
+            authorized_batch_request(&batch_body(ec_id, uid)),
+        )
+        .expect("should handle the batch");
+        response_json(response)
+    }
+
+    #[test]
+    fn batch_sync_update_to_owned_source_applies_only_when_absent() {
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let owned = identity_with_owner(&[("example-provider", "ssp.example.com")]);
+
+        let absent = seeded_graph(&ec_id, None);
+        let summary = run_batch(&absent, &owned, &ec_id, "batch-uid");
+        assert_eq!(summary["accepted"], 1, "should accept the absent write");
+        assert_eq!(
+            stored_record(&absent, &ec_id),
+            Some(KvPartnerId::new("batch-uid")),
+            "should write an owned source that holds no value"
+        );
+
+        let present = seeded_graph(&ec_id, Some(KvPartnerId::new("existing-uid")));
+        let summary = run_batch(&present, &owned, &ec_id, "batch-uid");
+        assert_eq!(summary["accepted"], 1, "should report the skip as accepted");
+        assert_eq!(
+            stored_record(&present, &ec_id),
+            Some(KvPartnerId::new("existing-uid")),
+            "should keep the value an owned source already holds"
+        );
+
+        let control = seeded_graph(&ec_id, Some(KvPartnerId::new("existing-uid")));
+        let summary = run_batch(&control, &empty_identity(), &ec_id, "batch-uid");
+        assert_eq!(summary["accepted"], 1, "should accept the unowned update");
+        assert_eq!(
+            stored_record(&control, &ec_id),
+            Some(KvPartnerId::new("batch-uid")),
+            "should keep replacing the value of an unowned source"
+        );
+    }
+
+    #[test]
+    fn batch_sync_never_touches_an_owners_entry_set() {
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let owned = identity_with_owner(&[("example-provider", "ssp.example.com")]);
+        let owners_record = full_record(Some("example-provider"), example_entry_set());
+        let graph = seeded_graph(&ec_id, Some(owners_record.clone()));
+
+        let before = serde_json::to_vec(&owners_record.eids).expect("should serialize");
+        let summary = run_batch(&graph, &owned, &ec_id, "batch-uid");
+        let after = stored_record(&graph, &ec_id).expect("should keep the record");
+
+        assert_eq!(summary["accepted"], 1, "should report the skip as accepted");
+        assert_eq!(
+            serde_json::to_vec(&after.eids).expect("should serialize"),
+            before,
+            "should leave the owner's eids byte-equal"
+        );
+        assert_eq!(after.eids.len(), 2, "should keep both entries");
+        assert_eq!(
+            after.w.as_deref(),
+            Some("example-provider"),
+            "should keep the owner's writer"
+        );
+
+        let unowned = seeded_graph(&ec_id, Some(owners_record));
+        run_batch(&unowned, &empty_identity(), &ec_id, "batch-uid");
+        assert_eq!(
+            stored_record(&unowned, &ec_id),
+            Some(KvPartnerId::new("batch-uid")),
+            "should write a one-entry, one-UID record without w or rv for an unowned source"
+        );
+    }
+
     fn test_registry() -> PartnerRegistry {
         let partners = vec![make_test_partner(
             "ssp.example.com",
@@ -489,8 +661,9 @@ mod tests {
             .body(EdgeBody::from("not-json"))
             .expect("should build test request");
 
-        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, req)
-            .expect("should return oversized response");
+        let response =
+            handle_batch_sync_with_writer(&writer, &registry, &limiter, &empty_identity(), req)
+                .expect("should return oversized response");
 
         assert_eq!(
             response.status(),
@@ -515,8 +688,9 @@ mod tests {
             .body(EdgeBody::from(oversized_body))
             .expect("should build test request");
 
-        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, req)
-            .expect("should return oversized response");
+        let response =
+            handle_batch_sync_with_writer(&writer, &registry, &limiter, &empty_identity(), req)
+                .expect("should return oversized response");
 
         assert_eq!(
             response.status(),
@@ -534,7 +708,7 @@ mod tests {
             mapping(&format!("{}.ABC123", "a".repeat(64)), "u3", 1),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 1, "should count successful writes as accepted");
         assert_eq!(errors.len(), 2, "should reject invalid mappings only");
@@ -560,7 +734,7 @@ mod tests {
             mapping(&format!("{}.ABC123", "c".repeat(64)), "u3", 1),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 1, "should keep accepted count before failure");
         assert_eq!(
@@ -592,8 +766,8 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build test request");
 
-        let response =
-            handle_batch_sync(&kv, &registry, &limiter, req).expect("should return response");
+        let response = handle_batch_sync(&kv, &registry, &limiter, &empty_identity(), req)
+            .expect("should return response");
         assert_eq!(
             response.status(),
             StatusCode::UNAUTHORIZED,
@@ -657,7 +831,7 @@ mod tests {
             mapping(&withdrawn_ec_id, "uid-2", 101),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 0, "should not accept ineligible mappings");
         assert_eq!(errors.len(), 2, "should report both errors");
@@ -674,7 +848,7 @@ mod tests {
         let ec_id = format!("{}.ABC123", "a".repeat(64));
         let mappings = vec![mapping(&ec_id, "uid-1", 100), mapping(&ec_id, "uid-1", 101)];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 2, "should accept every unchanged group member");
         assert!(
@@ -693,7 +867,7 @@ mod tests {
             mapping(&ec_id, "uid-old", 100),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(
             accepted, 2,
@@ -723,7 +897,7 @@ mod tests {
             mapping(&ec_id_a_upper, "a-last", 3),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 3, "should accept every valid group member");
         assert!(errors.is_empty(), "should report no errors");
@@ -753,7 +927,7 @@ mod tests {
             .map(|index| mapping(&ec_id, &format!("uid-{index}"), index as u64))
             .collect::<Vec<_>>();
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(
             accepted, MAX_BATCH_SIZE,
@@ -781,7 +955,7 @@ mod tests {
             mapping(&mixed_suffix, "mixed", 2),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 2, "should accept both distinct EC IDs");
         assert!(errors.is_empty(), "should report no errors");
@@ -813,7 +987,7 @@ mod tests {
             mapping(&ec_id, "   ", 3),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 2, "should accept valid group members");
         assert_eq!(errors.len(), 1, "should retain the invalid UID error");
@@ -841,7 +1015,7 @@ mod tests {
             mapping(&ec_id_b, "b-2", 4),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(accepted, 0, "should reject all ineligible group members");
         assert_eq!(
@@ -882,7 +1056,7 @@ mod tests {
             mapping(&ec_id_c, "", 6),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(&writer, "partner", false, &mappings);
 
         assert_eq!(
             accepted, 2,
@@ -929,6 +1103,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            &empty_identity(),
             authorized_batch_request(&body),
         )
         .expect("should return success response");
@@ -959,6 +1134,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            &empty_identity(),
             authorized_batch_request(&body),
         )
         .expect("should return multi-status response");
@@ -997,6 +1173,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            &empty_identity(),
             authorized_batch_request(&body),
         )
         .expect("should return validation response");
@@ -1042,6 +1219,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            &empty_identity(),
             authorized_batch_request(&body),
         )
         .expect("should return infrastructure failure response");
diff --git a/crates/trusted-server-core/src/ec/client_eids.rs b/crates/trusted-server-core/src/ec/client_eids.rs
new file mode 100644
index 0000000000..cefa1acd59
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/client_eids.rs
@@ -0,0 +1,563 @@
+//! Parsing and validation of browser-supplied EIDs.
+//!
+//! The `/auction` request body and the `ts-eids` cookie carry the same
+//! OpenRTB-style EID array, which TSJS copies from the EIDs Prebid placed in
+//! the `trustedServer` bidder request. Both go through [`parse_client_eids`],
+//! so a malformed entry or field costs only itself, whichever transport or
+//! client sent it.
+//!
+//! Rules, per entry:
+//!
+//! - The entry parses on its own and is a JSON object, or it is dropped.
+//! - `source` is a string, not blank, at most [`MAX_CLIENT_EID_LABEL_BYTES`]
+//!   UTF-8 bytes, or the entry is dropped.
+//! - `uids` holds at least one valid UID, or the entry is dropped. The first
+//!   [`MAX_CLIENT_UIDS_PER_ENTRY`] valid UIDs are kept.
+//! - `uids[].id` is a string, not blank, at most `MAX_UID_LENGTH` bytes, or
+//!   the UID is dropped. `uids[].atype` is an integer from 0 to `i32::MAX`;
+//!   `uids[].ext` is an object of at most [`MAX_CLIENT_EID_EXT_BYTES`] as
+//!   compact JSON. An invalid `atype` or `ext` drops only that field.
+//! - `inserter` and `matcher` follow the `source` rule, `mm` the `atype` rule
+//!   and `ext` the UID `ext` rule. An invalid value drops only that field.
+//! - Unknown keys are ignored. Order is preserved and a source may repeat.
+//!
+//! An entry equal to an earlier kept entry is dropped, and then the first
+//! [`MAX_CLIENT_EID_ENTRIES`] entries are kept. "Blank" means empty or only
+//! whitespace by `str::trim`. "Integer" means a JSON number with no fractional
+//! part, so `4`, `4.0` and `4e0` are the same value.
+
+use serde_json::Value as JsonValue;
+use serde_json::value::RawValue;
+
+use crate::openrtb::{Eid, Uid};
+
+use super::kv_types::MAX_UID_LENGTH;
+
+/// Maximum number of entries kept from one browser EID array.
+pub(crate) const MAX_CLIENT_EID_ENTRIES: usize = 64;
+
+/// Maximum number of valid UIDs kept per entry.
+pub(crate) const MAX_CLIENT_UIDS_PER_ENTRY: usize = 32;
+
+/// Maximum UTF-8 length of `source`, `inserter` and `matcher`.
+pub(crate) const MAX_CLIENT_EID_LABEL_BYTES: usize = 255;
+
+/// Maximum compact-JSON length of an EID-level or UID-level `ext` object.
+pub(crate) const MAX_CLIENT_EID_EXT_BYTES: usize = 2048;
+
+/// Parses and validates browser-supplied EID entries from an `/auction` body
+/// or a `ts-eids` cookie.
+///
+/// See the module documentation for the rules. Anything other than a JSON
+/// array yields no entries.
+///
+/// # Performance
+///
+/// Parses each element into a [`JsonValue`] once. Duplicate detection is
+/// quadratic in the kept entries, which are capped at
+/// [`MAX_CLIENT_EID_ENTRIES`].
+#[must_use]
+pub(crate) fn parse_client_eids(raw: &RawValue) -> Vec<Eid> {
+    // Capturing elements as raw JSON does not validate string escapes, so an
+    // element holding a lone surrogate fails only its own parse below.
+    let Ok(elements) = serde_json::from_str::<Vec<&RawValue>>(raw.get()) else {
+        log::debug!("Client EIDs: payload is not a JSON array; ignoring it");
+        return Vec::new();
+    };
+
+    let mut eids: Vec<Eid> = Vec::new();
+    for element in &elements {
+        if eids.len() >= MAX_CLIENT_EID_ENTRIES {
+            log::debug!(
+                "Client EIDs: keeping the first {MAX_CLIENT_EID_ENTRIES} entries; dropping the rest"
+            );
+            break;
+        }
+        let Some(eid) = parse_client_eid(element) else {
+            continue;
+        };
+        if eids.contains(&eid) {
+            log::debug!(
+                "Client EIDs: dropping a duplicate entry for source '{}'",
+                eid.source
+            );
+            continue;
+        }
+        eids.push(eid);
+    }
+    eids
+}
+
+fn parse_client_eid(element: &RawValue) -> Option<Eid> {
+    let entry = match serde_json::from_str::<JsonValue>(element.get()) {
+        Ok(JsonValue::Object(entry)) => entry,
+        Ok(_) => {
+            log::debug!("Client EIDs: dropping an entry that is not a JSON object");
+            return None;
+        }
+        Err(_) => {
+            log::debug!("Client EIDs: dropping an entry that does not parse");
+            return None;
+        }
+    };
+
+    let Some(source) = entry.get("source").and_then(parse_client_eid_label) else {
+        log::debug!("Client EIDs: dropping an entry without a valid `source`");
+        return None;
+    };
+
+    let uids: Vec<Uid> = match entry.get("uids") {
+        Some(JsonValue::Array(raw_uids)) => raw_uids
+            .iter()
+            .filter_map(|raw_uid| parse_client_uid(raw_uid, &source))
+            .take(MAX_CLIENT_UIDS_PER_ENTRY)
+            .collect(),
+        _ => Vec::new(),
+    };
+    if uids.is_empty() {
+        log::debug!("Client EIDs: dropping source '{source}' without a valid UID");
+        return None;
+    }
+
+    let inserter = parse_optional_field(&entry, "EID", "inserter", &source, parse_client_eid_label);
+    let matcher = parse_optional_field(&entry, "EID", "matcher", &source, parse_client_eid_label);
+    let mm = parse_optional_field(&entry, "EID", "mm", &source, parse_client_eid_integer);
+    let ext = parse_optional_field(&entry, "EID", "ext", &source, parse_client_eid_ext);
+
+    Some(Eid {
+        source,
+        uids,
+        inserter,
+        matcher,
+        mm,
+        ext,
+    })
+}
+
+fn parse_client_uid(raw: &JsonValue, source: &str) -> Option<Uid> {
+    let JsonValue::Object(uid) = raw else {
+        log::debug!("Client EIDs: dropping a UID that is not an object for source '{source}'");
+        return None;
+    };
+
+    let Some(id) = uid
+        .get("id")
+        .and_then(JsonValue::as_str)
+        .filter(|id| !id.trim().is_empty())
+        .filter(|id| id.len() <= MAX_UID_LENGTH)
+    else {
+        log::debug!("Client EIDs: dropping a UID without a valid `id` for source '{source}'");
+        return None;
+    };
+
+    Some(Uid {
+        id: id.to_owned(),
+        atype: parse_optional_field(uid, "UID", "atype", source, parse_client_eid_integer),
+        ext: parse_optional_field(uid, "UID", "ext", source, parse_client_eid_ext),
+    })
+}
+
+/// Applies `parse` to `key` when it is present, logging the field name and
+/// source, never the value, when the value is invalid.
+fn parse_optional_field<T>(
+    object: &serde_json::Map<String, JsonValue>,
+    scope: &str,
+    key: &str,
+    source: &str,
+    parse: impl Fn(&JsonValue) -> Option<T>,
+) -> Option<T> {
+    let value = object.get(key)?;
+    let parsed = parse(value);
+    if parsed.is_none() {
+        log::debug!("Client EIDs: dropping invalid {scope} `{key}` for source '{source}'");
+    }
+    parsed
+}
+
+/// Reads `source`, `inserter` or `matcher`: a string that is not blank and at
+/// most [`MAX_CLIENT_EID_LABEL_BYTES`] long, kept as supplied.
+fn parse_client_eid_label(value: &JsonValue) -> Option<String> {
+    value
+        .as_str()
+        .filter(|label| !label.trim().is_empty())
+        .filter(|label| label.len() <= MAX_CLIENT_EID_LABEL_BYTES)
+        .map(str::to_owned)
+}
+
+/// Reads `atype` or `mm`: a JSON number with no fractional part, from 0 to
+/// `i32::MAX`.
+fn parse_client_eid_integer(value: &JsonValue) -> Option<i32> {
+    let number = value.as_number()?;
+    if let Some(integer) = number.as_i64() {
+        return i32::try_from(integer).ok().filter(|integer| *integer >= 0);
+    }
+    if number.is_u64() {
+        // Above `i64::MAX`, so above the accepted range.
+        return None;
+    }
+    // serde_json reads `4.0`, `4e0` and `-0` as floats.
+    let float = number.as_f64()?;
+    if float.fract() != 0.0 || !(0.0..=f64::from(i32::MAX)).contains(&float) {
+        return None;
+    }
+    // Integral and within `0..=i32::MAX`, so the conversion is exact.
+    Some(float as i32)
+}
+
+/// Reads an `ext`: a JSON object of at most [`MAX_CLIENT_EID_EXT_BYTES`] as
+/// compact JSON.
+fn parse_client_eid_ext(value: &JsonValue) -> Option<JsonValue> {
+    if !value.is_object() {
+        return None;
+    }
+    let compact_len = serde_json::to_vec(value).ok()?.len();
+    (compact_len <= MAX_CLIENT_EID_EXT_BYTES).then(|| value.clone())
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+    use crate::test_support::logs::{captured_logs, install_capturing_logger};
+
+    fn parse(text: &str) -> Vec<Eid> {
+        let raw = RawValue::from_string(text.to_owned()).expect("should capture raw JSON");
+        parse_client_eids(&raw)
+    }
+
+    fn parsed_json(text: &str) -> JsonValue {
+        serde_json::to_value(parse(text)).expect("should serialize parsed EIDs")
+    }
+
+    fn good(source: &str) -> String {
+        format!(r#"{{"source":"{source}","uids":[{{"id":"uid-{source}"}}]}}"#)
+    }
+
+    fn good_json(source: &str) -> JsonValue {
+        json!({ "source": source, "uids": [{ "id": format!("uid-{source}") }] })
+    }
+
+    /// An `ext` object whose compact JSON is exactly `bytes` long.
+    fn ext_of_len(bytes: usize) -> String {
+        // `{"k":""}` is 8 bytes.
+        format!(r#"{{"k":"{}"}}"#, "x".repeat(bytes - 8))
+    }
+
+    #[test]
+    fn keeps_a_valid_entry_with_every_field() {
+        let parsed = parsed_json(
+            r#"[{"source":"ids.example.com","inserter":"inserter.example.com","matcher":"matcher.example.com","mm":4,"ext":{"segments":["s1"]},"uids":[{"id":"uid-1","atype":1,"ext":{"rtiPartner":"TDID"}}]}]"#,
+        );
+
+        assert_eq!(
+            parsed,
+            json!([{
+                "source": "ids.example.com",
+                "inserter": "inserter.example.com",
+                "matcher": "matcher.example.com",
+                "mm": 4,
+                "ext": { "segments": ["s1"] },
+                "uids": [{ "id": "uid-1", "atype": 1, "ext": { "rtiPartner": "TDID" } }]
+            }]),
+            "should keep every valid field"
+        );
+    }
+
+    #[test]
+    fn yields_nothing_for_a_payload_that_is_not_an_array() {
+        for text in [
+            r#"{"source":"ids.example.com"}"#,
+            r#""text""#,
+            "null",
+            "1",
+            "true",
+        ] {
+            assert_eq!(
+                parsed_json(text),
+                json!([]),
+                "should ignore non-array payload {text}"
+            );
+        }
+    }
+
+    #[test]
+    fn drops_only_the_entry_that_does_not_parse() {
+        // `\ud800` is a lone surrogate escape: serde_json rejects it when the
+        // element is parsed on its own.
+        let bad_entries = [
+            r#"{"source":"bad-\ud800.example.com","uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","uids":[{"id":"u-\ud800"}]}"#,
+            r#"{"source":"bad.example.com","inserter":"i-\ud800","uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","matcher":"m-\ud800","uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","ext":{"k-\ud800":1},"uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","ext":{"k":"v-\ud800"},"uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","uids":[{"id":"u","ext":{"k-\ud800":1}}]}"#,
+            r#"{"source":"bad.example.com","uids":[{"id":"u","ext":{"k":"v-\ud800"}}]}"#,
+        ];
+        for bad in bad_entries {
+            let text = format!(
+                "[{},{bad},{}]",
+                good("a.example.com"),
+                good("b.example.com")
+            );
+
+            assert_eq!(
+                parsed_json(&text),
+                json!([good_json("a.example.com"), good_json("b.example.com")]),
+                "should drop only the unparsable entry {bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn drops_entries_that_are_not_objects() {
+        let text = format!(r#"[1,"text",null,[],true,{}]"#, good("a.example.com"));
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([good_json("a.example.com")]),
+            "should keep only the object entry"
+        );
+    }
+
+    #[test]
+    fn validates_source() {
+        let source_255 = format!("a{}", "é".repeat(127));
+        let source_256 = "é".repeat(128);
+        let text = format!(
+            r#"[{{"uids":[{{"id":"u"}}]}},{{"source":7,"uids":[{{"id":"u"}}]}},{{"source":"   ","uids":[{{"id":"u"}}]}},{{"source":"{source_256}","uids":[{{"id":"u"}}]}},{{"source":"{source_255}","uids":[{{"id":"u"}}]}}]"#
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([{ "source": source_255, "uids": [{ "id": "u" }] }]),
+            "should keep only a non-blank string source of at most 255 UTF-8 bytes"
+        );
+    }
+
+    #[test]
+    fn drops_an_entry_without_a_valid_uid() {
+        let text = format!(
+            r#"[{{"source":"no-uids.example.com"}},{{"source":"string-uids.example.com","uids":"u"}},{{"source":"empty-uids.example.com","uids":[]}},{{"source":"bad-uids.example.com","uids":[{{"id":""}},7]}},{}]"#,
+            good("a.example.com")
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([good_json("a.example.com")]),
+            "should drop entries whose uids hold no valid UID"
+        );
+    }
+
+    #[test]
+    fn validates_uid_ids() {
+        let id_512 = "x".repeat(512);
+        let id_513 = "x".repeat(513);
+        let text = format!(
+            r#"[{{"source":"ids.example.com","uids":[{{"id":7}},{{"id":"  "}},{{"id":"{id_513}"}},{{"atype":1}},{{"id":"{id_512}"}}]}}]"#
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([{ "source": "ids.example.com", "uids": [{ "id": id_512 }] }]),
+            "should keep only a non-blank string id of at most 512 bytes"
+        );
+    }
+
+    #[test]
+    fn keeps_the_first_32_valid_uids() {
+        let uids: Vec<String> = [r#"{"id":""}"#.to_owned(), r#"{"id":7}"#.to_owned()]
+            .into_iter()
+            .chain((0..33).map(|index| format!(r#"{{"id":"u{index}"}}"#)))
+            .collect();
+        let text = format!(
+            r#"[{{"source":"ids.example.com","uids":[{}]}}]"#,
+            uids.join(",")
+        );
+
+        let expected_uids: Vec<JsonValue> = (0..32)
+            .map(|index| json!({ "id": format!("u{index}") }))
+            .collect();
+        assert_eq!(
+            parsed_json(&text),
+            json!([{ "source": "ids.example.com", "uids": expected_uids }]),
+            "should keep the first 32 valid UIDs, not counting invalid ones"
+        );
+    }
+
+    #[test]
+    fn reads_atype_and_mm_as_integers_in_range() {
+        let accepted = [
+            ("4", 4),
+            ("4.0", 4),
+            ("4e0", 4),
+            ("-0", 0),
+            ("0", 0),
+            ("2147483647", 2_147_483_647),
+            ("2147483647.0", 2_147_483_647),
+            ("571187", 571_187),
+        ];
+        for (spelling, value) in accepted {
+            let text = format!(
+                r#"[{{"source":"ids.example.com","mm":{spelling},"uids":[{{"id":"u","atype":{spelling}}}]}}]"#
+            );
+
+            assert_eq!(
+                parsed_json(&text),
+                json!([{ "source": "ids.example.com", "mm": value, "uids": [{ "id": "u", "atype": value }] }]),
+                "should accept {spelling} as {value}"
+            );
+        }
+
+        let rejected = [
+            "2147483648",
+            "9007199254740993",
+            "18446744073709551616",
+            "1.5",
+            "-1",
+            "1e300",
+            r#""1""#,
+            "null",
+            "true",
+        ];
+        for spelling in rejected {
+            let text = format!(
+                r#"[{{"source":"ids.example.com","mm":{spelling},"uids":[{{"id":"u","atype":{spelling}}}]}}]"#
+            );
+
+            assert_eq!(
+                parsed_json(&text),
+                json!([{ "source": "ids.example.com", "uids": [{ "id": "u" }] }]),
+                "should drop only the fields for {spelling}"
+            );
+        }
+    }
+
+    #[test]
+    fn validates_ext_objects_and_their_size() {
+        let ext_2048 = ext_of_len(2048);
+        let ext_2049 = ext_of_len(2049);
+        let text = format!(
+            r#"[{{"source":"keep.example.com","ext":{ext_2048},"uids":[{{"id":"u","ext":{ext_2048}}}]}},{{"source":"big.example.com","ext":{ext_2049},"uids":[{{"id":"u","ext":{ext_2049}}}]}},{{"source":"shape.example.com","ext":[1],"uids":[{{"id":"u","ext":"text"}}]}}]"#
+        );
+        let kept_ext: JsonValue = serde_json::from_str(&ext_2048).expect("should parse ext");
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([
+                { "source": "keep.example.com", "ext": kept_ext, "uids": [{ "id": "u", "ext": kept_ext }] },
+                { "source": "big.example.com", "uids": [{ "id": "u" }] },
+                { "source": "shape.example.com", "uids": [{ "id": "u" }] }
+            ]),
+            "should keep objects of at most 2048 compact bytes and drop only the bad fields"
+        );
+    }
+
+    #[test]
+    fn validates_inserter_and_matcher() {
+        let label_255 = format!("a{}", "é".repeat(127));
+        let label_256 = "é".repeat(128);
+        let text = format!(
+            r#"[{{"source":"keep.example.com","inserter":"{label_255}","matcher":"{label_255}","uids":[{{"id":"u"}}]}},{{"source":"drop.example.com","inserter":"{label_256}","matcher":"  ","uids":[{{"id":"u"}}]}},{{"source":"type.example.com","inserter":7,"matcher":null,"uids":[{{"id":"u"}}]}}]"#
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([
+                { "source": "keep.example.com", "inserter": label_255, "matcher": label_255, "uids": [{ "id": "u" }] },
+                { "source": "drop.example.com", "uids": [{ "id": "u" }] },
+                { "source": "type.example.com", "uids": [{ "id": "u" }] }
+            ]),
+            "should keep non-blank strings of at most 255 bytes and drop only the bad fields"
+        );
+    }
+
+    #[test]
+    fn drops_duplicates_before_the_entry_cap() {
+        let mut entries: Vec<String> = (0..64)
+            .map(|index| good(&format!("s{index}.example.com")))
+            .collect();
+        // Equal to entry 0 once validated: unknown keys are ignored.
+        entries.insert(
+            1,
+            r#"{"source":"s0.example.com","uids":[{"id":"uid-s0.example.com"}],"unknown":true}"#
+                .to_owned(),
+        );
+        let text = format!("[{}]", entries.join(","));
+
+        let expected: Vec<JsonValue> = (0..64)
+            .map(|index| good_json(&format!("s{index}.example.com")))
+            .collect();
+        assert_eq!(
+            parsed_json(&text),
+            JsonValue::Array(expected),
+            "a duplicate should not take one of the 64 places"
+        );
+    }
+
+    #[test]
+    fn keeps_the_first_64_entries() {
+        let entries: Vec<String> = (0..70)
+            .map(|index| good(&format!("s{index}.example.com")))
+            .collect();
+        let text = format!("[{}]", entries.join(","));
+
+        let expected: Vec<JsonValue> = (0..64)
+            .map(|index| good_json(&format!("s{index}.example.com")))
+            .collect();
+        assert_eq!(
+            parsed_json(&text),
+            JsonValue::Array(expected),
+            "should keep the first 64 entries"
+        );
+    }
+
+    #[test]
+    fn keeps_order_and_repeated_sources_and_ignores_unknown_keys() {
+        let parsed = parsed_json(
+            r#"[{"source":"b.example.com","uids":[{"id":"u","unknown":1}],"unknown":2},{"source":"a.example.com","mm":1,"uids":[{"id":"u"}]},{"source":"a.example.com","mm":2,"uids":[{"id":"u"}]}]"#,
+        );
+
+        assert_eq!(
+            parsed,
+            json!([
+                { "source": "b.example.com", "uids": [{ "id": "u" }] },
+                { "source": "a.example.com", "mm": 1, "uids": [{ "id": "u" }] },
+                { "source": "a.example.com", "mm": 2, "uids": [{ "id": "u" }] }
+            ]),
+            "should keep wire order and both same-source entries"
+        );
+    }
+
+    #[test]
+    fn logs_dropped_entries_and_fields_by_name_and_source_without_values() {
+        install_capturing_logger();
+
+        let parsed = parsed_json(
+            r#"[{"source":"log-a.example.com","mm":-1,"uids":[{"id":"secret-uid-a","atype":"1"}]},{"source":"log-b.example.com","uids":[{"id":""}]}]"#,
+        );
+
+        assert_eq!(
+            parsed,
+            json!([{ "source": "log-a.example.com", "uids": [{ "id": "secret-uid-a" }] }]),
+            "should keep the entry and drop only its invalid fields"
+        );
+        let logs = captured_logs();
+        for (field, source) in [
+            ("`mm`", "log-a.example.com"),
+            ("`atype`", "log-a.example.com"),
+            ("without a valid UID", "log-b.example.com"),
+        ] {
+            assert!(
+                logs.iter()
+                    .any(|line| line.contains(field) && line.contains(source)),
+                "should log {field} for {source}; captured: {logs:?}"
+            );
+        }
+        assert!(
+            !logs.iter().any(|line| line.contains("secret-uid-a")),
+            "should never log a UID value"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/cookies.rs b/crates/trusted-server-core/src/ec/cookies.rs
index ac0e0c05ba..29cb0188b9 100644
--- a/crates/trusted-server-core/src/ec/cookies.rs
+++ b/crates/trusted-server-core/src/ec/cookies.rs
@@ -18,7 +18,10 @@ use std::borrow::Cow;
 use edgezero_core::body::Body as EdgeBody;
 use http::{HeaderValue, Response, header};
 
-use crate::constants::COOKIE_TS_EC;
+use crate::consent::ConsentContext;
+use crate::constants::{COOKIE_TS_EC, COOKIE_TS_EC_REVOKED};
+use crate::ec::identity::descriptor::ConsentPolicy;
+use crate::ec::identity::policy::{FP_PURPOSES, PolicySignals, fingerprint_bits};
 use crate::settings::Settings;
 
 /// Maximum age for the EC cookie (1 year in seconds).
@@ -153,6 +156,54 @@ pub fn set_ec_cookie(settings: &Settings, response: &mut Response<EdgeBody>, ec_
     }
 }
 
+/// The value of the global-revoke marker for `consent`: a consent
+/// fingerprint over every TCF purpose, the US opt-outs and GPC, hex. It
+/// changes when any of the visitor's purpose decisions changes, and not
+/// when a CMP re-saves the same decisions (spec 8).
+#[must_use]
+pub(crate) fn revoke_marker_value(consent: &ConsentContext) -> String {
+    let policy = ConsentPolicy::strict().with_tcf_purposes(1..=FP_PURPOSES);
+    fingerprint_bits(&policy, consent, PolicySignals::default())
+}
+
+fn append_revoke_marker(
+    settings: &Settings,
+    response: &mut Response<EdgeBody>,
+    value: &str,
+    max_age: i32,
+) {
+    let cookie = format!(
+        "{COOKIE_TS_EC_REVOKED}={value}; Domain={}; Path=/; Secure; SameSite=Lax; Max-Age={max_age}; HttpOnly",
+        settings.publisher.ec_cookie_domain()
+    );
+    match HeaderValue::from_str(&cookie) {
+        Ok(val) => {
+            response.headers_mut().append(header::SET_COOKIE, val);
+        }
+        Err(e) => log::warn!("Skipping revoke marker Set-Cookie: invalid header value: {e}"),
+    }
+}
+
+/// Sets the global-revoke marker to the fingerprint of `consent`, so no EC
+/// is minted until the visitor's consent changes (spec 8).
+pub(crate) fn set_revoke_marker(
+    settings: &Settings,
+    response: &mut Response<EdgeBody>,
+    consent: &ConsentContext,
+) {
+    append_revoke_marker(
+        settings,
+        response,
+        &revoke_marker_value(consent),
+        COOKIE_MAX_AGE,
+    );
+}
+
+/// Expires the global-revoke marker once a new EC has been minted.
+pub(crate) fn expire_revoke_marker(settings: &Settings, response: &mut Response<EdgeBody>) {
+    append_revoke_marker(settings, response, "", 0);
+}
+
 /// Expires the EC cookie by setting `Max-Age=0`.
 ///
 /// Used when a user revokes consent — the browser will delete the cookie
@@ -177,9 +228,32 @@ pub fn expire_ec_cookie(settings: &Settings, response: &mut Response<EdgeBody>)
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::ec::identity::test_support::test_consent_gdpr_without_vendor;
     use crate::test_support::tests::create_test_settings;
     use http::header;
 
+    #[test]
+    fn revoke_marker_changes_with_any_purpose_decision() {
+        let granted = test_consent_gdpr_without_vendor(5);
+        let mut withdrawn = granted.clone();
+        withdrawn
+            .tcf
+            .as_mut()
+            .expect("should carry a TC string")
+            .purpose_consents[1] = false;
+
+        assert_ne!(
+            revoke_marker_value(&granted),
+            revoke_marker_value(&withdrawn),
+            "should change when Purpose 2 alone changes"
+        );
+        assert_eq!(
+            revoke_marker_value(&granted),
+            revoke_marker_value(&granted.clone()),
+            "should not change when nothing changes"
+        );
+    }
+
     fn empty_response() -> Response<EdgeBody> {
         Response::builder()
             .status(200)
diff --git a/crates/trusted-server-core/src/ec/eids.rs b/crates/trusted-server-core/src/ec/eids.rs
index 1359f75091..5d7e763f73 100644
--- a/crates/trusted-server-core/src/ec/eids.rs
+++ b/crates/trusted-server-core/src/ec/eids.rs
@@ -2,7 +2,9 @@
 //!
 //! Used by both `/_ts/api/v1/identify` and `/auction` to resolve source-domain
 //! keyed IDs from KV entries, convert them to `OpenRTB` EID structures, and
-//! build base64-encoded response headers.
+//! build base64-encoded response headers. KV IDs are filtered by the shared
+//! servability check in [`super::identity::servable`], and a stored record
+//! goes out as one EID per stored entry.
 
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
 use error_stack::{Report, ResultExt as _};
@@ -10,36 +12,54 @@ use error_stack::{Report, ResultExt as _};
 use crate::error::TrustedServerError;
 use crate::openrtb::{Eid, Uid};
 
-use super::kv_types::KvEntry;
+use super::identity::catalog::ProviderCatalog;
+use super::identity::coordinator::HoldResults;
+use super::identity::servable::{ServeContext, is_servable};
+use super::identity::{IdentityProviderId, SourceDomain};
+use super::kv_types::{KvEid, KvEntry};
 use super::registry::PartnerRegistry;
 
 /// Maximum size (in bytes) for the base64-encoded `x-ts-eids` header value.
 pub const MAX_EIDS_HEADER_BYTES: usize = 4096;
 
-/// A source-domain keyed ID resolved from a KV entry against the partner registry.
+/// A source-domain keyed record resolved from a KV entry against the partner
+/// registry and the servability check.
 ///
-/// Only includes partners with `bidstream_enabled = true` and a non-empty UID.
+/// Only includes partners with `bidstream_enabled = true`, a non-empty UID and
+/// a servable record.
 pub struct ResolvedPartnerId {
     /// The partner's identity source domain and EC KV `ids` key.
     pub source_domain: String,
-    /// The synced user ID value.
+    /// The first UID of the first stored entry.
     pub uid: String,
-    /// `OpenRTB` agent type for this partner's identifiers.
+    /// `OpenRTB` agent type, used for a UID without a stored one.
     pub openrtb_atype: i32,
+    /// The source's stored entry set, in order. One entry for a one-UID record.
+    pub entries: Vec<KvEid>,
+    /// The provider that wrote the record. `None` for browser ingest and
+    /// version 1 rows.
+    pub writer: Option<IdentityProviderId>,
+    /// Unix seconds at which the record stops being servable, when it has an
+    /// `exp`.
+    pub expires_at: Option<u64>,
 }
 
 /// Resolves source-domain keyed IDs from a KV entry against the partner registry.
 ///
-/// Filters to partners with `bidstream_enabled = true` and non-empty UIDs,
-/// sorted deterministically by source domain.
+/// Filters to partners with `bidstream_enabled = true`, non-empty UIDs and
+/// servable records, sorted deterministically by source domain.
 #[must_use]
-pub fn resolve_partner_ids(registry: &PartnerRegistry, entry: &KvEntry) -> Vec<ResolvedPartnerId> {
+pub(crate) fn resolve_partner_ids(
+    registry: &PartnerRegistry,
+    entry: &KvEntry,
+    serve: &ServeContext<'_>,
+) -> Vec<ResolvedPartnerId> {
     let mut resolved = Vec::new();
 
     for (source_domain, partner_uid) in &entry.ids {
-        if partner_uid.uid.is_empty() {
+        let Some(uid) = partner_uid.first_uid().filter(|uid| !uid.is_empty()) else {
             continue;
-        }
+        };
 
         let Some(partner) = registry.get(source_domain) else {
             continue;
@@ -48,10 +68,23 @@ pub fn resolve_partner_ids(registry: &PartnerRegistry, entry: &KvEntry) -> Vec<R
             continue;
         }
 
+        let Ok(source) = source_domain.parse::<SourceDomain>() else {
+            continue;
+        };
+        if !is_servable(serve, &source, partner_uid) {
+            continue;
+        }
+
         resolved.push(ResolvedPartnerId {
             source_domain: partner.source_domain.clone(),
-            uid: partner_uid.uid.clone(),
+            uid: uid.to_owned(),
             openrtb_atype: partner.openrtb_atype,
+            entries: partner_uid.eids.clone(),
+            writer: partner_uid
+                .w
+                .as_deref()
+                .and_then(|writer| writer.parse().ok()),
+            expires_at: partner_uid.exp,
         });
     }
 
@@ -59,22 +92,230 @@ pub fn resolve_partner_ids(registry: &PartnerRegistry, entry: &KvEntry) -> Vec<R
     resolved
 }
 
-/// Converts resolved partner IDs to `OpenRTB` `Eid` entries.
+/// Converts resolved partner IDs to `OpenRTB` `Eid` entries: one per stored
+/// entry, in stored order.
 #[must_use]
 pub fn to_eids(resolved: &[ResolvedPartnerId]) -> Vec<Eid> {
     resolved
         .iter()
-        .map(|item| Eid {
-            source: item.source_domain.clone(),
-            uids: vec![Uid {
-                id: item.uid.clone(),
-                atype: Some(item.openrtb_atype),
-                ext: None,
-            }],
+        .flat_map(|item| {
+            item.entries
+                .iter()
+                .map(move |entry| stored_entry_to_eid(item, entry))
         })
         .collect()
 }
 
+fn stored_entry_to_eid(item: &ResolvedPartnerId, entry: &KvEid) -> Eid {
+    let uids = entry
+        .uids
+        .iter()
+        .map(|uid| Uid {
+            id: uid.id.clone(),
+            atype: Some(uid.atype.unwrap_or(item.openrtb_atype)),
+            ext: uid.ext.clone(),
+        })
+        .collect();
+    Eid {
+        source: item.source_domain.clone(),
+        uids,
+        inserter: entry.inserter.clone(),
+        matcher: entry.matcher.clone(),
+        mm: entry.mm,
+        ext: entry.ext.clone(),
+    }
+}
+
+/// One source of a [`ServerSet`]: a servable record and its outbound EIDs.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct ServerSource {
+    /// The partner's source domain, as the registry holds it.
+    pub(crate) source_domain: String,
+    /// The provider that wrote the record, if any.
+    pub(crate) writer: Option<IdentityProviderId>,
+    /// Unix seconds at which the record stops being servable.
+    pub(crate) expires_at: Option<u64>,
+    /// Whether the record is the source owner's valid value: the source has
+    /// an owner and the record's writer is that owner (spec 7.1).
+    pub(crate) owned: bool,
+    /// One EID per stored entry, in stored order, provenance defaults filled.
+    pub(crate) eids: Vec<Eid>,
+}
+
+/// The servable server set of the KV row a request read (spec 7.1).
+///
+/// Built once per request; the bidstream merge and the `ts-eids-s` mirror
+/// both read it. It never holds anything from `ts-eids-s`.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct ServerSet {
+    sources: Vec<ServerSource>,
+}
+
+impl ServerSet {
+    /// The set's sources, ordered by source domain.
+    #[must_use]
+    pub(crate) fn sources(&self) -> &[ServerSource] {
+        &self.sources
+    }
+
+    /// Every source's EIDs, in order.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn eids(&self) -> Vec<Eid> {
+        self.sources
+            .iter()
+            .flat_map(|source| source.eids.iter().cloned())
+            .collect()
+    }
+
+    /// A set of one source per EID, for tests that start from EIDs.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn from_eids(eids: Vec<Eid>) -> Self {
+        Self {
+            sources: eids
+                .into_iter()
+                .map(|eid| ServerSource {
+                    source_domain: eid.source.clone(),
+                    writer: None,
+                    expires_at: None,
+                    owned: false,
+                    eids: vec![eid],
+                })
+                .collect(),
+        }
+    }
+}
+
+impl ServerSet {
+    /// Overlays the answers of this navigation's hold dispatch (spec 4.7),
+    /// replacing the stored value of each source they name.
+    ///
+    /// Each source gets one `Eid` per entry, in the order the provider
+    /// returned them, with the writer's provenance default applied
+    /// ([`fill_provenance`]). A source the partner registry does not list for
+    /// the bidstream is left out, as a stored record would be.
+    pub(crate) fn with_hold_results(
+        &mut self,
+        results: HoldResults,
+        registry: &PartnerRegistry,
+        catalog: &ProviderCatalog,
+    ) {
+        let HoldResults {
+            additions,
+            mut writer,
+        } = results;
+        for (source, entries) in additions {
+            let Some(partner) = registry
+                .get(source.as_str())
+                .filter(|partner| partner.bidstream_enabled)
+            else {
+                continue;
+            };
+            let writer = writer.remove(&source);
+            let mut eids: Vec<Eid> = entries
+                .iter()
+                .map(|entry| Eid {
+                    source: partner.source_domain.clone(),
+                    uids: entry
+                        .uids
+                        .iter()
+                        .map(|uid| Uid {
+                            id: uid.id.clone(),
+                            atype: Some(uid.atype.unwrap_or(partner.openrtb_atype)),
+                            ext: uid.ext.clone(),
+                        })
+                        .collect(),
+                    inserter: entry.inserter.clone(),
+                    matcher: entry.matcher.clone(),
+                    mm: entry.mm,
+                    ext: entry.ext.clone(),
+                })
+                .collect();
+            fill_provenance(&mut eids, writer.as_ref(), &source, catalog);
+            let held = ServerSource {
+                source_domain: partner.source_domain.clone(),
+                owned: writer.is_some() && catalog.owner_of(&source) == writer.as_ref(),
+                writer,
+                expires_at: None,
+                eids,
+            };
+            match self
+                .sources
+                .binary_search_by(|stored| stored.source_domain.cmp(&held.source_domain))
+            {
+                Ok(index) => self.sources[index] = held,
+                Err(index) => self.sources.insert(index, held),
+            }
+        }
+    }
+}
+
+/// The servable server set of `entry` (spec 7.1).
+///
+/// Without a read row, or for a row that is not live and consenting, the set
+/// is empty. Each record goes through [`resolve_partner_ids`] and
+/// [`to_eids`], then [`fill_provenance`].
+#[must_use]
+pub(crate) fn server_set(
+    entry: Option<&KvEntry>,
+    registry: &PartnerRegistry,
+    serve: &ServeContext<'_>,
+) -> ServerSet {
+    let Some(entry) = entry.filter(|entry| entry.consent.ok) else {
+        return ServerSet::default();
+    };
+    let sources = resolve_partner_ids(registry, entry, serve)
+        .into_iter()
+        .map(|record| {
+            let mut eids = to_eids(core::slice::from_ref(&record));
+            let mut owned = false;
+            if let Ok(source) = record.source_domain.parse::<SourceDomain>() {
+                fill_provenance(&mut eids, record.writer.as_ref(), &source, serve.catalog);
+                owned = record.writer.is_some()
+                    && serve.catalog.owner_of(&source) == record.writer.as_ref();
+            }
+            ServerSource {
+                source_domain: record.source_domain,
+                writer: record.writer,
+                expires_at: record.expires_at,
+                owned,
+                eids,
+            }
+        })
+        .collect();
+    ServerSet { sources }
+}
+
+/// Applies the writer's `with_provenance` default for `source` to the EIDs
+/// of a record it wrote (spec 4.3, 7.1).
+///
+/// Only an entry that sets none of `inserter`, `matcher` and `mm` gets the
+/// default; an entry that sets any of them is the vendor's complete
+/// statement and is left as stored. A record without a configured writer
+/// gets nothing.
+pub(crate) fn fill_provenance(
+    eids: &mut [Eid],
+    writer: Option<&IdentityProviderId>,
+    source: &SourceDomain,
+    catalog: &ProviderCatalog,
+) {
+    let Some(default) = writer
+        .and_then(|writer| catalog.get(writer))
+        .and_then(|provider| provider.descriptor().provenance(source))
+    else {
+        return;
+    };
+    for eid in eids
+        .iter_mut()
+        .filter(|eid| eid.inserter.is_none() && eid.matcher.is_none() && eid.mm.is_none())
+    {
+        eid.inserter = default.inserter().map(str::to_owned);
+        eid.matcher = default.matcher().map(str::to_owned);
+        eid.mm = default.mm();
+    }
+}
+
 /// Builds a base64-encoded EID header value, truncating if needed.
 ///
 /// Returns `(encoded_value, was_truncated)`. If the full set of EIDs exceeds
@@ -144,9 +385,58 @@ pub fn encode_eids_header(eids: &[Eid]) -> Result<(String, bool), Report<Trusted
 
 #[cfg(test)]
 mod tests {
+    use std::collections::{BTreeMap, BTreeSet};
+
     use super::*;
+    use crate::consent::ConsentContext;
+    use crate::ec::identity::catalog::ProviderCatalog;
+    use crate::ec::identity::policy::PolicySignals;
+    use crate::ec::identity::test_support::{
+        example_entry_set, full_record, provenance_provider, test_consent_allowing_everything,
+    };
+    use crate::ec::identity::{EidProvenance, IdentityProviderId, UnixTime};
+    use crate::ec::kv_types::{KvEid, KvPartnerId, KvUid};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
+    use serde_json::json;
+
+    /// Owns what a [`ServeContext`] borrows: permissive consent and no providers.
+    struct ServeFixture {
+        consent: ConsentContext,
+        catalog: ProviderCatalog,
+        opted_out: BTreeSet<IdentityProviderId>,
+    }
+
+    impl ServeFixture {
+        fn new() -> Self {
+            Self {
+                consent: test_consent_allowing_everything(),
+                catalog: ProviderCatalog::empty(),
+                opted_out: BTreeSet::new(),
+            }
+        }
+
+        fn at(&self, now: u64) -> ServeContext<'_> {
+            ServeContext {
+                now: UnixTime::from_secs(now),
+                consent: &self.consent,
+                signals: PolicySignals::default(),
+                catalog: &self.catalog,
+                opted_out: &self.opted_out,
+            }
+        }
+    }
+
+    fn registry_with(sources: &[&str]) -> PartnerRegistry {
+        let partners: Vec<EcPartner> = sources
+            .iter()
+            .map(|source| EcPartner {
+                openrtb_atype: 99,
+                ..make_test_partner(source)
+            })
+            .collect();
+        PartnerRegistry::from_config(&partners).expect("should build registry")
+    }
 
     fn make_test_partner(source_domain: &str) -> EcPartner {
         EcPartner {
@@ -161,8 +451,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -177,20 +468,15 @@ mod tests {
 
         let mut entry = KvEntry::tombstone(1000);
         entry.consent.ok = true;
-        entry.ids.insert(
-            "zeta.example.com".to_owned(),
-            super::super::kv_types::KvPartnerId {
-                uid: "uid-z".to_owned(),
-            },
-        );
-        entry.ids.insert(
-            "alpha.example.com".to_owned(),
-            super::super::kv_types::KvPartnerId {
-                uid: "uid-a".to_owned(),
-            },
-        );
-
-        let resolved = resolve_partner_ids(&registry, &entry);
+        entry
+            .ids
+            .insert("zeta.example.com".to_owned(), KvPartnerId::new("uid-z"));
+        entry
+            .ids
+            .insert("alpha.example.com".to_owned(), KvPartnerId::new("uid-a"));
+
+        let fixture = ServeFixture::new();
+        let resolved = resolve_partner_ids(&registry, &entry, &fixture.at(100));
         let source_domains: Vec<&str> = resolved
             .iter()
             .map(|item| item.source_domain.as_str())
@@ -203,6 +489,111 @@ mod tests {
         );
     }
 
+    #[test]
+    fn resolve_partner_ids_skips_expired_records_and_uses_stored_atype() {
+        let registry = registry_with(&["a.example.com", "b.example.com"]);
+        let mut entry = KvEntry::minimal("a.example.com", "ua", 1);
+        entry.ids.insert(
+            "b.example.com".to_owned(),
+            KvPartnerId {
+                exp: Some(50),
+                ..KvPartnerId::new("ub")
+            },
+        );
+        entry
+            .ids
+            .get_mut("a.example.com")
+            .expect("should hold source a")
+            .eids[0]
+            .uids[0]
+            .atype = Some(3);
+        let fixture = ServeFixture::new();
+
+        let resolved = resolve_partner_ids(&registry, &entry, &fixture.at(100));
+
+        assert_eq!(resolved.len(), 1, "should drop the expired b");
+        assert_eq!(resolved[0].source_domain, "a.example.com", "should keep a");
+        assert_eq!(
+            to_eids(&resolved)[0].uids[0].atype,
+            Some(3),
+            "should prefer the stored atype"
+        );
+    }
+
+    #[test]
+    fn a_one_uid_record_goes_out_as_on_main() {
+        let registry = registry_with(&["a.example.com"]);
+        let entry = KvEntry::minimal("a.example.com", "ua", 1);
+        let fixture = ServeFixture::new();
+
+        let eids = to_eids(&resolve_partner_ids(&registry, &entry, &fixture.at(100)));
+
+        assert_eq!(
+            eids,
+            vec![Eid::new(
+                "a.example.com".to_owned(),
+                vec![Uid {
+                    id: "ua".to_owned(),
+                    atype: Some(99),
+                    ext: None
+                }],
+            )],
+            "should be the EID main sends"
+        );
+    }
+
+    #[test]
+    fn a_full_record_goes_out_as_one_eid_per_stored_entry() {
+        let registry = registry_with(&["a.example.com"]);
+        let mut set = example_entry_set();
+        set[1].uids[0].atype = None;
+        let mut entry = KvEntry::minimal("b.example.com", "unregistered", 1);
+        entry
+            .ids
+            .insert("a.example.com".to_owned(), full_record(None, set));
+        let fixture = ServeFixture::new();
+
+        let eids = to_eids(&resolve_partner_ids(&registry, &entry, &fixture.at(100)));
+
+        assert_eq!(
+            eids,
+            vec![
+                Eid {
+                    source: "a.example.com".to_owned(),
+                    uids: vec![
+                        Uid {
+                            id: "example-a".to_owned(),
+                            atype: Some(1),
+                            ext: None
+                        },
+                        Uid {
+                            id: "example-b".to_owned(),
+                            atype: Some(3),
+                            ext: Some(json!({ "stype": "ppuid" }))
+                        },
+                    ],
+                    inserter: Some("example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(3),
+                    ext: None,
+                },
+                Eid {
+                    source: "a.example.com".to_owned(),
+                    uids: vec![Uid {
+                        id: "example-c".to_owned(),
+                        atype: Some(99),
+                        ext: None
+                    }],
+                    inserter: None,
+                    matcher: Some("partner.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ],
+            "should send every entry in stored order, a UID without atype taking the partner's"
+        );
+    }
+
     #[test]
     fn to_eids_maps_resolved_ids_correctly() {
         let resolved = vec![
@@ -210,16 +601,25 @@ mod tests {
                 uid: "LR_xyz".to_owned(),
                 source_domain: "liveramp.com".to_owned(),
                 openrtb_atype: 3,
+                entries: KvPartnerId::new("LR_xyz".to_owned()).eids,
+                writer: None,
+                expires_at: None,
             },
             ResolvedPartnerId {
                 uid: "ID5_abc".to_owned(),
                 source_domain: "id5-sync.com".to_owned(),
                 openrtb_atype: 1,
+                entries: KvPartnerId::new("ID5_abc".to_owned()).eids,
+                writer: None,
+                expires_at: None,
             },
             ResolvedPartnerId {
                 uid: "pair-id".to_owned(),
                 source_domain: "google.com".to_owned(),
                 openrtb_atype: 571187,
+                entries: KvPartnerId::new("pair-id".to_owned()).eids,
+                writer: None,
+                expires_at: None,
             },
         ];
 
@@ -249,6 +649,9 @@ mod tests {
                 uid: format!("uid_{}", "x".repeat(100)),
                 source_domain: format!("partner-{idx}.example.com"),
                 openrtb_atype: 3,
+                entries: KvPartnerId::new(format!("uid_{}", "x".repeat(100))).eids,
+                writer: None,
+                expires_at: None,
             });
         }
 
@@ -268,6 +671,9 @@ mod tests {
             uid: "u1".to_owned(),
             source_domain: "ssp.com".to_owned(),
             openrtb_atype: 3,
+            entries: KvPartnerId::new("u1".to_owned()).eids,
+            writer: None,
+            expires_at: None,
         }];
 
         let (encoded, truncated) =
@@ -276,4 +682,120 @@ mod tests {
         assert!(!truncated, "should not truncate small payload");
         assert!(!encoded.is_empty(), "should produce non-empty value");
     }
+
+    fn provenance_catalog() -> ProviderCatalog {
+        ProviderCatalog::new(
+            vec![provenance_provider(
+                "pa",
+                &["a.example.com", "b.example.com"],
+                vec![
+                    (
+                        "a.example.com",
+                        EidProvenance::new()
+                            .with_inserter("default-inserter.example.com")
+                            .with_matcher("default-matcher.example.com")
+                            .with_mm(2),
+                    ),
+                    (
+                        "b.example.com",
+                        EidProvenance::new().with_inserter("default-inserter.example.com"),
+                    ),
+                ],
+            )],
+            BTreeMap::new(),
+        )
+    }
+
+    #[test]
+    fn merge_provenance_applies_only_to_an_entry_with_no_eid_level_fields() {
+        let registry = registry_with(&["a.example.com", "b.example.com"]);
+        let kv_uid = |id: &str| KvUid {
+            id: id.to_owned(),
+            atype: None,
+            ext: None,
+        };
+        let mut entry = KvEntry::minimal("unused.example.com", "unused", 1);
+        entry.ids.clear();
+        entry.ids.insert(
+            "a.example.com".to_owned(),
+            full_record(
+                Some("pa"),
+                vec![
+                    KvEid {
+                        uids: vec![kv_uid("bare")],
+                        ..KvEid::default()
+                    },
+                    KvEid {
+                        uids: vec![kv_uid("vendor")],
+                        inserter: Some("vendor.example.com".to_owned()),
+                        ..KvEid::default()
+                    },
+                ],
+            ),
+        );
+        entry
+            .ids
+            .insert("b.example.com".to_owned(), KvPartnerId::new("seeded"));
+        let fixture = ServeFixture {
+            catalog: provenance_catalog(),
+            ..ServeFixture::new()
+        };
+
+        let set = server_set(Some(&entry), &registry, &fixture.at(100));
+
+        let uid = |id: &str| Uid {
+            id: id.to_owned(),
+            atype: Some(99),
+            ext: None,
+        };
+        assert_eq!(
+            set.eids(),
+            vec![
+                Eid {
+                    source: "a.example.com".to_owned(),
+                    uids: vec![uid("bare")],
+                    inserter: Some("default-inserter.example.com".to_owned()),
+                    matcher: Some("default-matcher.example.com".to_owned()),
+                    mm: Some(2),
+                    ext: None,
+                },
+                Eid {
+                    source: "a.example.com".to_owned(),
+                    uids: vec![uid("vendor")],
+                    inserter: Some("vendor.example.com".to_owned()),
+                    matcher: None,
+                    mm: None,
+                    ext: None,
+                },
+                Eid {
+                    source: "b.example.com".to_owned(),
+                    uids: vec![uid("seeded")],
+                    inserter: None,
+                    matcher: None,
+                    mm: None,
+                    ext: None,
+                },
+            ],
+            "should fill the default only on the provider-written entry with no EID-level field"
+        );
+    }
+
+    #[test]
+    fn merge_server_set_is_empty_without_a_live_consenting_row() {
+        let registry = registry_with(&["a.example.com"]);
+        let fixture = ServeFixture::new();
+        let mut entry = KvEntry::minimal("a.example.com", "ua", 1);
+        entry.consent.ok = false;
+
+        assert_eq!(
+            server_set(None, &registry, &fixture.at(100)),
+            ServerSet::default(),
+            "should be empty without a KV read"
+        );
+        assert_eq!(
+            server_set(Some(&entry), &registry, &fixture.at(100)),
+            ServerSet::default(),
+            "should be empty for a withdrawn row"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/finalize.rs b/crates/trusted-server-core/src/ec/finalize.rs
index 019ef2aa40..0508b5a2b1 100644
--- a/crates/trusted-server-core/src/ec/finalize.rs
+++ b/crates/trusted-server-core/src/ec/finalize.rs
@@ -13,17 +13,18 @@ use crate::consent::{ConsentContext, allows_eid_persistence};
 use crate::settings::Settings;
 
 use super::EcContext;
-use super::cookies::{expire_ec_cookie, set_ec_cookie};
+use super::cookies::{expire_ec_cookie, expire_revoke_marker, set_ec_cookie, set_revoke_marker};
 use super::generation::{generate_ec_id, is_valid_ec_id};
+use super::identity::ids::SourceDomain;
+use super::identity::mutation::{IdentityMutation, PartnerIdChange};
 use super::kv::{
     CreateIfAbsentOutcome, EidCookieSyncOutcome, KvIdentityGraph, PartnerIdUpdate,
     apply_partner_id_updates,
 };
-use super::kv_types::KvEntry;
+use super::kv_types::{KvEntry, KvPartnerId};
 use super::prebid_eids::collect_eid_updates;
-use super::pull_sync_marker::{expire_marker, reconcile_marker};
 use super::registry::PartnerRegistry;
-use super::{EcKvSnapshot, EidSyncSource, current_timestamp, log_id};
+use super::{EcKvSnapshot, EidSyncSource, checked_current_timestamp, current_timestamp, log_id};
 
 /// TS-managed response headers tied to EC identity output.
 const EC_RESPONSE_HEADERS: &[&str] = &[
@@ -35,8 +36,13 @@ const EC_RESPONSE_HEADERS: &[&str] = &[
 
 /// Finalizes EC response behavior for all routes.
 ///
-/// Applies withdrawal handling, last-seen updates, cookie reconciliation,
-/// Prebid EID ingestion, and cookie writes for new EC generation.
+/// Applies withdrawal handling, cookie reconciliation, orphan recovery and the
+/// `ts-ec` cookie for a new EC.
+///
+/// A returning visitor's response writes no KV row. On the writer request the
+/// browser ingest from `ts-eids` and sharedId joins the request's identity
+/// mutation, which phase 4 flushes; every other request ingests nothing. A new
+/// EC's ingest rode in its create ([`BrowserSeed`]).
 ///
 /// On consent withdrawal, the browser response clears the EC cookie
 /// immediately and the EC identity-graph KV tombstone is the authoritative
@@ -53,17 +59,24 @@ pub fn ec_finalize_response(
     sharedid_cookie: Option<&str>,
     response: &mut Response<EdgeBody>,
 ) {
-    ec_context.validate_pull_sync_marker(settings, registry);
+    // A minted EC whose navigation never reached its create gets it here,
+    // before its cookie is set (spec 4.7).
+    if let Err(err) = ec_context.complete_deferred_create(settings, kv) {
+        log::warn!("Deferred EC create failed at finalize: {err:?}");
+    }
     let consent_allows_ec = ec_consent_granted(ec_context.consent());
-    let consent_withdrawn = ec_consent_withdrawn(ec_context.consent());
-
-    if !consent_allows_ec {
-        // Expire the request-local marker independently of the EC cookie: a
-        // withdrawal must stop any pending pull-sync disclosure window.
-        if consent_withdrawn && ec_context.pull_sync_marker().was_present() {
-            expire_marker(ec_context.pull_sync_marker_mut(), response);
+    // A global revoke captured from any client (spec 8) is a withdrawal:
+    // the same tombstone, cookie expiry and after-send run, with whatever the
+    // request staged dropped.
+    let global_revoke = ec_context.global_revoke_requested();
+    let consent_withdrawn = ec_consent_withdrawn(ec_context.consent()) || global_revoke;
+
+    if !consent_allows_ec || global_revoke {
+        if global_revoke {
+            *ec_context.identity_mut().mutation_mut() = IdentityMutation::default();
+            // No EC is minted until the visitor's consent changes (spec 8).
+            set_revoke_marker(settings, response, ec_context.consent());
         }
-
         finalize_unusable_consent(
             settings,
             ec_context,
@@ -78,25 +91,23 @@ pub fn ec_finalize_response(
     // Returning user: consent is granted and EC came from request.
     if ec_context.ec_was_present() && !ec_context.ec_generated() && consent_allows_ec {
         if let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) {
-            let source = ec_context.eid_sync_source();
-            let collected = source
-                .map(|_| {
-                    collect_eid_updates(
-                        eids_cookie,
-                        sharedid_cookie,
-                        ec_context.client_eids(),
-                        registry,
-                    )
-                })
-                .unwrap_or_default();
+            // Only the writer request ingests browser data (spec 5.3). Every
+            // other request leaves `ts-eids` and sharedId for the writer.
+            let writer = ec_context.identity().writer();
+            let collected = if writer {
+                collect_eid_updates(
+                    eids_cookie,
+                    sharedid_cookie,
+                    None,
+                    registry,
+                    checked_current_timestamp(),
+                )
+            } else {
+                Vec::new()
+            };
             let had_eid_updates = !collected.is_empty();
             let updates = gate_eid_updates_by_consent(collected, ec_context.consent());
-            // `sync_eid_cookie_updates` early-returns without refreshing the
-            // snapshot when `updates` is empty, which is correct when there
-            // was never anything to write (an unconfigured registry, no sync
-            // source, or no EID cookies/body this request — the case
-            // `finalize_not_read_snapshot_does_not_rotate` covers). But when
-            // consent gating (e.g. TCF Purpose 4 denial) is what emptied
+            // When consent gating (e.g. TCF Purpose 4 denial) is what emptied
             // `updates`, the request *did* have EID data, and orphan recovery
             // below still needs an actual `Missing` read to detect an
             // orphaned cookie. An unread `NotRead` snapshot proves nothing, so
@@ -109,8 +120,6 @@ pub fn ec_finalize_response(
             {
                 let snapshot = graph.load_snapshot(&ec_id);
                 ec_context.set_kv_snapshot(snapshot);
-            } else if let Some(source) = source {
-                sync_eid_cookie_updates(graph, ec_context, &ec_id, &updates, source);
             }
             if matches!(ec_context.kv_snapshot(), EcKvSnapshot::Missing { .. })
                 && ec_context.recovery_eligible()
@@ -118,11 +127,11 @@ pub fn ec_finalize_response(
                 confirm_then_recover_orphaned_ec(
                     settings, ec_context, graph, &ec_id, &updates, response,
                 );
+            } else {
+                queue_browser_ingest(ec_context, &ec_id, &updates);
             }
         }
 
-        reconcile_pull_sync_marker(settings, registry, ec_context, response);
-
         // Ordinary returning-user page views no longer refresh the browser
         // cookie, emit the EC header, or update KV TTL.
         return;
@@ -132,113 +141,132 @@ pub fn ec_finalize_response(
     // there is no KV graph: that would mint a browser cookie with no backing
     // identity-graph row, producing a phantom ID on later requests.
     if ec_context.ec_generated() {
-        let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) else {
+        let (Some(_), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) else {
             log::info!("Skipping generated EC response write because KV graph is unavailable");
-            reconcile_pull_sync_marker(settings, registry, ec_context, response);
             return;
         };
 
-        let updates = gate_eid_updates_by_consent(
-            collect_eid_updates(
-                eids_cookie,
-                sharedid_cookie,
-                ec_context.client_eids(),
-                registry,
-            ),
-            ec_context.consent(),
-        );
-        sync_eid_cookie_updates(graph, ec_context, &ec_id, &updates, EidSyncSource::NewEc);
-        if ec_context.kv_snapshot().entry_for(&ec_id).is_some() {
+        // The create in `generate_if_needed` (or the integration proxy's)
+        // already carried the browser ingest, so finalize writes nothing.
+        if let Some(entry) = ec_context.kv_snapshot().entry_for(&ec_id) {
+            let seeded = gate_eid_updates_by_consent(
+                collect_eid_updates(
+                    eids_cookie,
+                    sharedid_cookie,
+                    None,
+                    registry,
+                    checked_current_timestamp(),
+                ),
+                ec_context.consent(),
+            );
+            if !seeded.is_empty() && partner_id_updates_stored(entry, &seeded) {
+                record_eid_sync_terminal(EidSyncSource::NewEc, EidCookieSyncOutcome::Written);
+            }
             set_ec_cookie_on_response(settings, ec_context, response);
+            if ec_context.has_revoke_marker() {
+                expire_revoke_marker(settings, response);
+            }
         } else {
             log::warn!("Skipping generated EC cookie because backing row is not authoritative");
         }
     }
+}
+
+/// The browser ingest of one request, ready to seed a new identity row.
+///
+/// Opaque on purpose: it holds UIDs, so it prints only a count. Build it with
+/// [`browser_seed`], or use [`BrowserSeed::empty`] when there is nothing to seed.
+#[derive(Clone, Default)]
+pub struct BrowserSeed(Vec<PartnerIdUpdate>);
+
+impl BrowserSeed {
+    /// A seed that carries nothing.
+    #[must_use]
+    pub fn empty() -> Self {
+        Self::default()
+    }
 
-    reconcile_pull_sync_marker(settings, registry, ec_context, response);
+    /// The updates to apply to the new row.
+    pub(crate) fn updates(&self) -> &[PartnerIdUpdate] {
+        &self.0
+    }
 }
 
-fn sync_eid_cookie_updates(
-    graph: &KvIdentityGraph,
-    ec_context: &mut EcContext,
-    ec_id: &str,
-    updates: &[PartnerIdUpdate],
-    source: EidSyncSource,
-) {
-    if updates.is_empty() {
-        return;
+impl core::fmt::Debug for BrowserSeed {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("BrowserSeed")
+            .field("updates", &self.0.len())
+            .finish()
     }
+}
 
-    let (snapshot, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-        ec_id,
-        updates,
-        ec_context.kv_snapshot().clone(),
-    );
-    ec_context.set_kv_snapshot(snapshot);
-    record_eid_sync_terminal(source, outcome);
+/// Collects the consent-gated browser ingest from `ts-eids` and sharedId.
+///
+/// One UID per registered source: the `/auction` body is not an ingest input.
+/// `now` is the acquisition time stored on each record.
+#[must_use]
+pub fn browser_seed(
+    _settings: &Settings,
+    registry: &PartnerRegistry,
+    consent: &ConsentContext,
+    eids_cookie: Option<&str>,
+    sharedid_cookie: Option<&str>,
+    now: u64,
+) -> BrowserSeed {
+    BrowserSeed(gate_eid_updates_by_consent(
+        collect_eid_updates(eids_cookie, sharedid_cookie, None, registry, Some(now)),
+        consent,
+    ))
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-struct EidSyncMeasurement {
-    source: EidSyncSource,
-    outcome: EidCookieSyncOutcome,
-    already_matched: u8,
-    written: u8,
-    conflict_duplicate: u8,
-    deferred: u8,
+/// Whether `entry` already holds every update's UID.
+fn partner_id_updates_stored(entry: &KvEntry, updates: &[PartnerIdUpdate]) -> bool {
+    updates.iter().all(|update| {
+        entry
+            .ids
+            .get(&update.partner_id)
+            .is_some_and(|stored| stored.first_uid() == Some(update.uid.as_str()))
+    })
 }
 
-impl EidSyncMeasurement {
-    fn new(source: EidSyncSource, outcome: EidCookieSyncOutcome) -> Self {
-        Self {
+/// Adds the browser ingest to the writer's mutation, for phase 4 to flush.
+///
+/// Nothing is queued against a withdrawn, missing or failed row. A `NotRead`
+/// snapshot still queues: phase 4 re-reads before it writes.
+fn queue_browser_ingest(ec_context: &mut EcContext, ec_id: &str, updates: &[PartnerIdUpdate]) {
+    if updates.is_empty() || !ec_context.identity().writer() {
+        return;
+    }
+    let usable = match ec_context.kv_snapshot() {
+        EcKvSnapshot::NotRead => true,
+        snapshot => snapshot
+            .entry_for(ec_id)
+            .is_some_and(|entry| entry.consent.ok),
+    };
+    if !usable {
+        return;
+    }
+    let mutation = ec_context.identity_mut().mutation_mut();
+    for update in updates {
+        let Ok(source) = update.partner_id.parse::<SourceDomain>() else {
+            log::warn!("Browser ingest skipped a source that is not a valid domain");
+            continue;
+        };
+        mutation.add_change(PartnerIdChange::FillMissing {
             source,
-            outcome,
-            already_matched: u8::from(matches!(outcome, EidCookieSyncOutcome::AlreadyMatched)),
-            written: u8::from(matches!(
-                outcome,
-                EidCookieSyncOutcome::Written | EidCookieSyncOutcome::WrittenWithDeferredFreshness
-            )),
-            conflict_duplicate: u8::from(matches!(outcome, EidCookieSyncOutcome::ConflictMatched)),
-            deferred: u8::from(matches!(
-                outcome,
-                EidCookieSyncOutcome::WrittenWithDeferredFreshness
-                    | EidCookieSyncOutcome::DeferredConflict
-                    | EidCookieSyncOutcome::DeferredFreshness
-                    | EidCookieSyncOutcome::DeferredStaleRead
-            )),
-        }
+            record: KvPartnerId::browser(update.uid.as_str(), update.acquired_at),
+        });
     }
 }
 
+/// Logs the one remaining `EID sync measurement` line: a new EC whose
+/// create carried the browser ingest. Returning visitors log the
+/// `identity request measurement` line instead.
 fn record_eid_sync_terminal(source: EidSyncSource, outcome: EidCookieSyncOutcome) {
-    let measurement = EidSyncMeasurement::new(source, outcome);
     log::info!(
-        "EID sync measurement: source={} outcome={} attempted=1 already_matched={} written={} \
-         conflict_duplicate={} deferred={}",
-        measurement.source,
-        measurement.outcome,
-        measurement.already_matched,
-        measurement.written,
-        measurement.conflict_duplicate,
-        measurement.deferred,
-    );
-}
-
-fn reconcile_pull_sync_marker(
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_context: &mut EcContext,
-    response: &mut Response<EdgeBody>,
-) {
-    let ec_id = ec_context.ec_value().map(str::to_owned);
-    let snapshot = ec_context.kv_snapshot().clone();
-    reconcile_marker(
-        settings,
-        registry,
-        ec_id.as_deref(),
-        &snapshot,
-        ec_context.pull_sync_marker_mut(),
-        response,
+        "EID sync measurement: source={source} outcome={outcome} attempted=1 already_matched=0 \
+         written=1 conflict_duplicate=0 deferred=0",
     );
 }
 
@@ -319,6 +347,9 @@ fn recover_orphaned_ec(
                     generation: None,
                 };
                 ec_context.replace_with_generated(ec_id, snapshot);
+                // The create carried this request's ingest: it is the page
+                // load's one write, so phase 4 has nothing left to flush.
+                *ec_context.identity_mut().mutation_mut() = IdentityMutation::default();
                 set_ec_cookie_on_response(settings, ec_context, response);
                 return;
             }
@@ -369,9 +400,9 @@ fn confirm_then_recover_orphaned_ec(
     match confirmed {
         EcKvSnapshot::Present { .. } => {
             // The row became visible after the origin round trip: adopt it and
-            // merge any pending updates rather than rotating a valid identity.
+            // queue the ingest rather than rotating a valid identity.
             ec_context.set_kv_snapshot(confirmed);
-            sync_eid_cookie_updates(graph, ec_context, ec_id, updates, EidSyncSource::Navigation);
+            queue_browser_ingest(ec_context, ec_id, updates);
         }
         EcKvSnapshot::Missing { .. } => match graph.key_exists_confirmed(ec_id) {
             Ok(false) => recover_orphaned_ec(settings, ec_context, graph, updates, response),
@@ -466,35 +497,69 @@ fn finalize_unusable_consent(
     // for subsequent EC behavior.
     if let Some(graph) = kv {
         apply_withdrawal_tombstones(&ids_to_withdraw, |ec_id| {
-            // The graph hands back the post-withdrawal snapshot rather than
-            // leaving the caller to rebuild it, so post-send work that reads
-            // the context — pull sync discloses the raw EC ID to partners —
-            // sees the tombstone that was just written. Only the active ID has
-            // a snapshot in the context to correct.
-            let initial = if ec_context.kv_snapshot().belongs_to(ec_id) {
-                ec_context.kv_snapshot().clone()
-            } else {
-                EcKvSnapshot::NotRead
-            };
-            let outcome = graph.tombstone_existing_from_snapshot(ec_id, initial);
             // The browser cookie is already cleared, so a failed tombstone
             // leaves a live row that server-side consumers still read as
             // consented. Report every failure, including the non-active cookie
             // ID whose outcome is not retained on the request context.
-            if matches!(outcome, EcKvSnapshot::Failed { .. }) {
+            if !tombstone_withdrawn_id(ec_context, graph, ec_id) {
                 log::warn!(
                     "EC withdrawal tombstone failed for '{}': the identity-graph row may \
                      still be live with consent granted",
                     log_id(ec_id)
                 );
-            }
-            if ec_context.ec_value() == Some(ec_id) {
-                ec_context.set_kv_snapshot(outcome);
+                ec_context.record_failed_withdrawal(ec_id);
             }
         });
     }
 }
 
+/// Runs the tombstone path once for `ec_id` and returns whether it succeeded.
+///
+/// The graph hands back the post-withdrawal snapshot rather than leaving the
+/// caller to rebuild it, so post-send work that reads the context — pull sync
+/// discloses the raw EC ID to partners — sees the tombstone that was just
+/// written. Only the active ID has a snapshot in the context to correct.
+fn tombstone_withdrawn_id(
+    ec_context: &mut EcContext,
+    graph: &KvIdentityGraph,
+    ec_id: &str,
+) -> bool {
+    let initial = if ec_context.kv_snapshot().belongs_to(ec_id) {
+        ec_context.kv_snapshot().clone()
+    } else {
+        EcKvSnapshot::NotRead
+    };
+    let outcome = graph.tombstone_existing_from_snapshot(ec_id, initial);
+    let succeeded = !matches!(outcome, EcKvSnapshot::Failed { .. });
+    if ec_context.ec_value() == Some(ec_id) {
+        ec_context.set_kv_snapshot(outcome);
+    }
+    succeeded
+}
+
+/// Retries each withdrawal tombstone that failed before send, once, after send.
+///
+/// Each failed ID re-reads its row (a [`EcKvSnapshot::NotRead`] start) and runs
+/// the same tombstone path as before send, with its own CAS attempts and
+/// completion marker. This is the last attempt: a success clears the ID from
+/// the context's failed list, and a second failure is logged and leaves it
+/// there for the failure counters.
+/// An ID that was never recorded as failed is not touched.
+pub fn retry_failed_withdrawals(ec_context: &mut EcContext, graph: &KvIdentityGraph) {
+    let failed = ec_context.failed_withdrawals().to_vec();
+    for ec_id in &failed {
+        if tombstone_withdrawn_id(ec_context, graph, ec_id) {
+            ec_context.clear_failed_withdrawal(ec_id);
+        } else {
+            log::warn!(
+                "EC withdrawal tombstone failed again after send for '{}': the identity-graph \
+                 row may still be live with consent granted",
+                log_id(ec_id)
+            );
+        }
+    }
+}
+
 fn withdrawal_ec_ids(ec_context: &EcContext) -> HashSet<String> {
     let mut hashes = HashSet::new();
 
@@ -531,11 +596,48 @@ mod tests {
     use super::*;
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
-    use crate::openrtb::{Eid, Uid};
+    use crate::ec::identity::request::WriterDecision;
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
     use crate::test_support::tests::{create_test_settings, purpose_one_only_consent};
 
+    #[test]
+    fn finalize_creates_a_deferred_ec_its_navigation_did_not() {
+        let settings = create_test_settings();
+        let graph = KvIdentityGraph::in_memory("ec-store");
+        let mut context =
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()));
+        context
+            .mint_deferred(&settings, &BrowserSeed::empty())
+            .expect("should mint");
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let ec_id = context.ec_value().expect("should keep the EC").to_owned();
+        assert!(
+            graph.get(&ec_id).expect("should read").is_some(),
+            "should create the row"
+        );
+        assert!(
+            response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .any(|cookie| cookie.starts_with(&format!("ts-ec={ec_id};"))),
+            "should set the EC cookie once its row exists"
+        );
+    }
+
     fn empty_response() -> Response<EdgeBody> {
         Response::builder()
             .status(200)
@@ -614,8 +716,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -1114,18 +1217,16 @@ mod tests {
             Some("192.0.2.11".to_owned()),
         );
         ec_context.set_recovery_eligible(true);
-        ec_context.set_eid_sync_source(EidSyncSource::Navigation);
-        ec_context.set_client_eids(vec![Eid {
-            source: "id5-sync.com".to_owned(),
-            uids: vec![Uid {
-                id: "ID5_should_not_persist".to_owned(),
-                atype: Some(1),
-                ext: None,
-            }],
-        }]);
+        set_writer(&mut ec_context, true);
         let partners = vec![make_partner("id5-sync.com")];
         let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
         let graph = KvIdentityGraph::in_memory("test_store");
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::to_vec(&serde_json::json!([
+                { "source": "id5-sync.com", "uids": [{ "id": "ID5_should_not_persist", "atype": 1 }] }
+            ]))
+            .expect("should serialize test cookie payload"),
+        );
         let mut response = empty_response();
 
         ec_finalize_response(
@@ -1133,7 +1234,7 @@ mod tests {
             &mut ec_context,
             Some(&graph),
             &registry,
-            None,
+            Some(&eids_cookie),
             None,
             &mut response,
         );
@@ -1156,58 +1257,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn valid_marker_with_unread_snapshot_defers_orphan_recovery() {
-        let settings = create_test_settings();
-        let orphaned_ec = sample_ec_id("orphn2");
-        let consent = ConsentContext {
-            jurisdiction: Jurisdiction::NonRegulated,
-            source: ConsentSource::Cookie,
-            ..Default::default()
-        };
-        let mut ec_context = EcContext::new_for_test_with_ip(
-            Some(orphaned_ec.clone()),
-            consent,
-            Some("192.0.2.10".to_owned()),
-        );
-        ec_context.set_recovery_eligible(true);
-        ec_context.set_pull_sync_marker_for_test(
-            crate::ec::pull_sync_marker::PullSyncMarkerState::Valid { expires_at: 4_600 },
-        );
-        let mut partner = make_partner("pull.example.com");
-        partner.pull_sync_enabled = true;
-        partner.pull_sync_url = Some("https://sync.example.com/pull".to_owned());
-        partner.pull_sync_allowed_domains = vec!["sync.example.com".to_owned()];
-        partner.ts_pull_token = Some(Redacted::new("pull-token".to_owned()));
-        let registry = PartnerRegistry::from_config(&[partner]).expect("should build registry");
-        let graph = KvIdentityGraph::in_memory("test_store");
-        let mut response = empty_response();
-
-        ec_finalize_response(
-            &settings,
-            &mut ec_context,
-            Some(&graph),
-            &registry,
-            None,
-            None,
-            &mut response,
-        );
-
-        assert_eq!(
-            ec_context.ec_value(),
-            Some(orphaned_ec.as_str()),
-            "an unread snapshot should defer orphan rotation until marker expiry"
-        );
-        assert!(
-            matches!(ec_context.kv_snapshot(), EcKvSnapshot::NotRead),
-            "a marker-skipped request should leave the snapshot unread"
-        );
-        assert!(
-            response.headers().get(http::header::SET_COOKIE).is_none(),
-            "bounded orphan deferral should not rewrite browser identity state"
-        );
-    }
-
     #[test]
     fn finalize_returning_user_subresource_does_not_persist_eid_updates() {
         let settings = create_test_settings();
@@ -1248,7 +1297,7 @@ mod tests {
     }
 
     #[test]
-    fn finalize_navigation_routes_persist_returning_user_eid_updates() {
+    fn finalize_navigation_routes_never_write_returning_user_eid_updates_directly() {
         for (source, suffix, cookie_id) in [
             (EidSyncSource::Navigation, "naveid", "navigation-cookie-id"),
             (EidSyncSource::PageBids, "spaeid", "page-bids-cookie-id"),
@@ -1267,6 +1316,7 @@ mod tests {
                 .expect("should seed the live row");
             let mut ec_context = returning_user_context(&ec_id, graph.load_snapshot(&ec_id), true);
             ec_context.set_eid_sync_source(source);
+            set_writer(&mut ec_context, true);
             let partners = vec![make_partner("sharedid.org")];
             let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
             let mut response = empty_response();
@@ -1285,16 +1335,66 @@ mod tests {
                 .get(&ec_id)
                 .expect("should read store")
                 .expect("row should remain");
+            assert!(
+                !stored.ids.contains_key("sharedid.org"),
+                "{source} should leave the flush to phase 4"
+            );
             assert_eq!(
-                stored.ids.get("sharedid.org").map(|id| id.uid.as_str()),
-                Some(cookie_id),
-                "{source} should persist the returning-user EID cookie"
+                ec_context.identity().mutation().change_count(),
+                1,
+                "{source} should queue the returning-user EID cookie"
             );
         }
     }
 
     #[test]
-    fn finalize_generated_ec_persists_eid_updates() {
+    fn generate_if_needed_seeds_the_ts_eids_cookie() {
+        let settings = create_test_settings();
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let mut ec_context = EcContext::new_for_test_with_ip(
+            None,
+            granting_consent(),
+            Some("192.0.2.10".to_owned()),
+        );
+        let registry = PartnerRegistry::from_config(&[make_partner("ids.example.com")])
+            .expect("should build registry");
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::to_vec(&serde_json::json!([
+                { "source": "ids.example.com", "uids": [{ "id": "cookie-uid" }] }
+            ]))
+            .expect("should serialize test cookie payload"),
+        );
+        let seed = browser_seed(
+            &settings,
+            &registry,
+            ec_context.consent(),
+            Some(&eids_cookie),
+            None,
+            current_timestamp(),
+        );
+
+        ec_context
+            .generate_if_needed(&settings, Some(&graph), &seed)
+            .expect("should generate an EC");
+
+        let ec_id = ec_context.ec_value().expect("should hold the new EC");
+        let (stored, _) = graph
+            .get(ec_id)
+            .expect("should read store")
+            .expect("row should exist");
+        assert_eq!(
+            stored
+                .ids
+                .iter()
+                .map(|(source, id)| (source.as_str(), id.first_uid().unwrap_or_default()))
+                .collect::<Vec<_>>(),
+            vec![("ids.example.com", "cookie-uid")],
+            "a new EC should carry the ts-eids cookie in its create"
+        );
+    }
+
+    #[test]
+    fn finalize_generated_ec_writes_no_ingest_of_its_own() {
         let settings = create_test_settings();
         let ec_id = sample_ec_id("geneid");
         let graph = KvIdentityGraph::in_memory("test_store");
@@ -1328,9 +1428,13 @@ mod tests {
             .get(&ec_id)
             .expect("should read store")
             .expect("row should remain");
-        assert_eq!(
-            stored.ids.get("sharedid.org").map(|id| id.uid.as_str()),
-            Some("generated-cookie-id")
+        assert!(
+            !stored.ids.contains_key("sharedid.org"),
+            "finalize should leave a new EC's ingest to the create"
+        );
+        assert!(
+            get_header(&response, "set-cookie").is_some(),
+            "should still set the ts-ec cookie"
         );
     }
 
@@ -1342,99 +1446,23 @@ mod tests {
             EidSyncSource::PageBids,
             EidSyncSource::NewEc,
         ];
-        let outcomes = [
-            EidCookieSyncOutcome::AlreadyMatched,
-            EidCookieSyncOutcome::Written,
-            EidCookieSyncOutcome::WrittenWithDeferredFreshness,
-            EidCookieSyncOutcome::ConflictMatched,
-            EidCookieSyncOutcome::DeferredConflict,
-            EidCookieSyncOutcome::DeferredFreshness,
-            EidCookieSyncOutcome::DeferredStaleRead,
-            EidCookieSyncOutcome::Missing,
-            EidCookieSyncOutcome::ConsentWithdrawn,
-            EidCookieSyncOutcome::Failed,
-        ];
 
         assert_eq!(
             sources.map(|source| source.to_string()),
-            ["navigation", "auction", "page_bids", "new_ec"]
-        );
-        assert_eq!(
-            outcomes.map(|outcome| outcome.to_string()),
-            [
-                "already_matched",
-                "written",
-                "written_with_deferred_freshness",
-                "conflict_matched",
-                "deferred_conflict",
-                "deferred_freshness",
-                "deferred_stale_read",
-                "missing",
-                "consent_withdrawn",
-                "failed",
-            ]
-        );
-
-        assert_eq!(
-            EidSyncMeasurement::new(
-                EidSyncSource::Navigation,
-                EidCookieSyncOutcome::AlreadyMatched,
-            ),
-            EidSyncMeasurement {
-                source: EidSyncSource::Navigation,
-                outcome: EidCookieSyncOutcome::AlreadyMatched,
-                already_matched: 1,
-                written: 0,
-                conflict_duplicate: 0,
-                deferred: 0,
-            }
-        );
-        assert_eq!(
-            EidSyncMeasurement::new(
-                EidSyncSource::Auction,
-                EidCookieSyncOutcome::WrittenWithDeferredFreshness,
-            ),
-            EidSyncMeasurement {
-                source: EidSyncSource::Auction,
-                outcome: EidCookieSyncOutcome::WrittenWithDeferredFreshness,
-                already_matched: 0,
-                written: 1,
-                conflict_duplicate: 0,
-                deferred: 1,
-            }
+            ["navigation", "auction", "page_bids", "new_ec"],
+            "should label each source with a bounded name"
         );
         assert_eq!(
-            EidSyncMeasurement::new(EidSyncSource::NewEc, EidCookieSyncOutcome::ConflictMatched,),
-            EidSyncMeasurement {
-                source: EidSyncSource::NewEc,
-                outcome: EidCookieSyncOutcome::ConflictMatched,
-                already_matched: 0,
-                written: 0,
-                conflict_duplicate: 1,
-                deferred: 0,
-            }
-        );
-        assert_eq!(
-            EidSyncMeasurement::new(
-                EidSyncSource::PageBids,
-                EidCookieSyncOutcome::DeferredStaleRead,
-            ),
-            EidSyncMeasurement {
-                source: EidSyncSource::PageBids,
-                outcome: EidCookieSyncOutcome::DeferredStaleRead,
-                already_matched: 0,
-                written: 0,
-                conflict_duplicate: 0,
-                deferred: 1,
-            }
+            EidCookieSyncOutcome::Written.to_string(),
+            "written",
+            "should label the one outcome the new-EC line reports"
         );
     }
 
     #[test]
-    fn finalize_auction_transient_miss_still_persists_eid_updates() {
-        // `/auction` saves its first lookup into the context and is never
-        // recovery eligible, so a stale miss there has no later chance to
-        // retry. Finalization must revalidate before dropping collected IDs.
+    fn finalize_auction_stale_miss_neither_ingests_nor_writes() {
+        // `/auction` is a stager: even with a stale endpoint miss in its
+        // snapshot it does not re-read, ingest or write.
         let settings = create_test_settings();
         let ec_id = sample_ec_id("named1");
         let graph = KvIdentityGraph::in_memory("test_store");
@@ -1474,93 +1502,13 @@ mod tests {
             .get(&ec_id)
             .expect("should read store")
             .expect("row should remain");
-        assert_eq!(
-            stored.ids.get("sharedid.org").map(|id| id.uid.as_str()),
-            Some("shared-cookie-id"),
-            "a stale endpoint miss must not suppress EID persistence"
-        );
-    }
-
-    #[test]
-    fn finalize_persists_every_configured_partner_from_client_eids_over_a_trimmed_cookie() {
-        // Regression test for #1184: the `ts-eids` cookie only carries what
-        // the browser could fit under its size cap, but `/auction` also
-        // hands finalization the full EID set from the request body via
-        // `EcContext::set_client_eids`. That full set must land in KV even
-        // when the cookie alone would have dropped a configured partner.
-        let settings = create_test_settings();
-        let ec_id = sample_ec_id("cleids1");
-        let graph = KvIdentityGraph::in_memory("test_store");
-        let live = KvEntry::new(
-            &granting_consent(),
-            None,
-            current_timestamp(),
-            &settings.publisher.domain,
-        );
-        graph
-            .create(&ec_id, &live)
-            .expect("should seed the live row this request updates");
-        let mut ec_context = returning_user_context(
-            &ec_id,
-            EcKvSnapshot::Missing {
-                ec_id: ec_id.clone(),
-            },
-            false,
-        );
-        ec_context.set_eid_sync_source(EidSyncSource::Auction);
-        // Only `id5-sync.com` "fit" in the (simulated) trimmed cookie;
-        // `liveramp.com` was dropped by the browser's size cap.
-        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
-            serde_json::to_vec(&serde_json::json!([
-                {"source": "id5-sync.com", "uids": [{"id": "ID5_from_cookie", "atype": 1}]}
-            ]))
-            .expect("should serialize test cookie payload"),
-        );
-        ec_context.set_client_eids(vec![
-            Eid {
-                source: "id5-sync.com".to_owned(),
-                uids: vec![Uid {
-                    id: "ID5_from_body".to_owned(),
-                    atype: Some(1),
-                    ext: None,
-                }],
-            },
-            Eid {
-                source: "liveramp.com".to_owned(),
-                uids: vec![Uid {
-                    id: "LR_from_body".to_owned(),
-                    atype: Some(3),
-                    ext: None,
-                }],
-            },
-        ]);
-        let partners = vec![make_partner("id5-sync.com"), make_partner("liveramp.com")];
-        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
-        let mut response = empty_response();
-
-        ec_finalize_response(
-            &settings,
-            &mut ec_context,
-            Some(&graph),
-            &registry,
-            Some(&eids_cookie),
-            None,
-            &mut response,
-        );
-
-        let (stored, _) = graph
-            .get(&ec_id)
-            .expect("should read store")
-            .expect("row should exist after ingestion");
-        assert_eq!(
-            stored.ids.get("id5-sync.com").map(|id| id.uid.as_str()),
-            Some("ID5_from_body"),
-            "the request body's EID should win over the cookie's stale value"
+        assert!(
+            !stored.ids.contains_key("sharedid.org"),
+            "a stager must not write ingest"
         );
-        assert_eq!(
-            stored.ids.get("liveramp.com").map(|id| id.uid.as_str()),
-            Some("LR_from_body"),
-            "a partner the cookie trimmed must still be ingested from the body"
+        assert!(
+            ec_context.identity().mutation().is_empty(),
+            "a stager must not queue ingest"
         );
     }
 
@@ -1591,18 +1539,14 @@ mod tests {
             false,
             purpose1_only_consent,
         );
-        ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
-            ec_id: ec_id.clone(),
-        });
-        ec_context.set_eid_sync_source(EidSyncSource::Auction);
-        ec_context.set_client_eids(vec![Eid {
-            source: "id5-sync.com".to_owned(),
-            uids: vec![Uid {
-                id: "ID5_should_not_persist".to_owned(),
-                atype: Some(1),
-                ext: None,
-            }],
-        }]);
+        ec_context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+        set_writer(&mut ec_context, true);
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::to_vec(&serde_json::json!([
+                { "source": "id5-sync.com", "uids": [{ "id": "ID5_should_not_persist", "atype": 1 }] }
+            ]))
+            .expect("should serialize test cookie payload"),
+        );
         let partners = vec![make_partner("id5-sync.com")];
         let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
         let mut response = empty_response();
@@ -1612,7 +1556,7 @@ mod tests {
             &mut ec_context,
             Some(&graph),
             &registry,
-            None,
+            Some(&eids_cookie),
             None,
             &mut response,
         );
@@ -1626,6 +1570,10 @@ mod tests {
             "denying TCF Purpose 4 must keep the EID out of KV even though Purpose 1 \
              (EC) consent is granted"
         );
+        assert!(
+            ec_context.identity().mutation().is_empty(),
+            "denying TCF Purpose 4 must keep the EID out of the mutation"
+        );
     }
 
     #[test]
@@ -1982,6 +1930,18 @@ mod tests {
         ec
     }
 
+    fn set_writer(ec_context: &mut EcContext, writer: bool) {
+        ec_context
+            .identity_mut()
+            .set_writer_decision(WriterDecision {
+                writer,
+                is_real_browser: writer,
+                user_agent: None,
+                dnt: false,
+                page_url: None,
+            });
+    }
+
     fn assert_did_not_rotate(ec_context: &EcContext, orphan: &str, response: &Response<EdgeBody>) {
         assert_eq!(
             ec_context.ec_value(),
@@ -2254,9 +2214,6 @@ mod tests {
         };
         let mut ec_context =
             make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
-        ec_context.set_pull_sync_marker_for_test(
-            crate::ec::pull_sync_marker::PullSyncMarkerState::Invalid,
-        );
         let graph = KvIdentityGraph::failing("unavailable-store");
         let mut response = empty_response();
 
@@ -2287,71 +2244,10 @@ mod tests {
                 .any(|cookie| { cookie.starts_with("ts-ec=;") && cookie.contains("Max-Age=0") }),
             "KV failure should not prevent EC cookie deletion"
         );
-        assert!(
-            cookies.iter().any(|cookie| {
-                cookie.starts_with("ts-ec-pull-complete=;") && cookie.contains("Max-Age=0")
-            }),
-            "KV failure should not prevent marker deletion"
-        );
     }
 
     #[test]
-    fn finalize_sets_marker_for_complete_pull_partner_snapshot() {
-        let settings = create_test_settings();
-        let ec_id = sample_ec_id("compl1");
-        let mut partner = make_partner("ssp.example.com");
-        partner.pull_sync_enabled = true;
-        partner.pull_sync_url = Some("https://sync.example.com/pull".to_owned());
-        partner.pull_sync_allowed_domains = vec!["sync.example.com".to_owned()];
-        partner.ts_pull_token = Some(Redacted::new("pull-token".to_owned()));
-        let registry = PartnerRegistry::from_config(&[partner]).expect("should build registry");
-        let mut ec_context = make_context(
-            Some(&ec_id),
-            Some(&ec_id),
-            true,
-            false,
-            Jurisdiction::NonRegulated,
-        );
-        let mut entry = live_entry();
-        entry.ids.insert(
-            "ssp.example.com".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "partner-uid".to_owned(),
-            },
-        );
-        ec_context.set_kv_snapshot(EcKvSnapshot::Present {
-            ec_id,
-            entry: Box::new(entry),
-            generation: Some(1),
-        });
-        let mut response = empty_response();
-
-        ec_finalize_response(
-            &settings,
-            &mut ec_context,
-            None,
-            &registry,
-            None,
-            None,
-            &mut response,
-        );
-
-        let cookies = response
-            .headers()
-            .get_all(http::header::SET_COOKIE)
-            .iter()
-            .filter_map(|value| value.to_str().ok())
-            .collect::<Vec<_>>();
-        assert!(
-            cookies
-                .iter()
-                .any(|cookie| cookie.starts_with("ts-ec-pull-complete=v1.")),
-            "complete snapshot should issue the marker"
-        );
-    }
-
-    #[test]
-    fn explicit_withdrawal_without_marker_or_ec_cookie_does_not_set_cookie() {
+    fn explicit_withdrawal_without_ec_cookie_does_not_set_cookie() {
         let settings = create_test_settings();
         let consent = ConsentContext {
             jurisdiction: Jurisdiction::UsState("CA".to_owned()),
@@ -2378,47 +2274,992 @@ mod tests {
         );
     }
 
-    #[test]
-    fn explicit_withdrawal_expires_marker_without_ec_cookie() {
-        let settings = create_test_settings();
-        let consent = ConsentContext {
-            jurisdiction: Jurisdiction::UsState("CA".to_owned()),
-            gpc: true,
-            source: ConsentSource::Cookie,
-            ..Default::default()
+    mod identity_flow {
+        use serde_json::json;
+
+        use super::*;
+        use crate::ec::identity::catalog::ProviderCatalog;
+        use crate::ec::identity::ids::SourceDomain;
+        use crate::ec::identity::input::SeededRandom;
+        use crate::ec::identity::mutation::{
+            ApplyContext, IdentityMutation, PartnerIdChange, apply,
         };
-        let mut ec_context = make_context_with_consent(None, None, false, false, consent);
-        ec_context.set_pull_sync_marker_for_test(
-            crate::ec::pull_sync_marker::PullSyncMarkerState::Invalid,
-        );
-        let mut response = empty_response();
+        use crate::ec::kv_types::KvPartnerId;
 
-        ec_finalize_response(
-            &settings,
-            &mut ec_context,
-            None,
-            &PartnerRegistry::empty(),
-            None,
-            None,
-            &mut response,
-        );
+        const SHARED_ID_SOURCE: &str = "sharedid.org";
 
-        let cookies = response
-            .headers()
-            .get_all(http::header::SET_COOKIE)
-            .iter()
-            .filter_map(|value| value.to_str().ok())
-            .collect::<Vec<_>>();
-        assert!(
-            cookies.iter().any(|cookie| {
-                cookie.starts_with("ts-ec-pull-complete=;") && cookie.contains("Max-Age=0")
-            }),
-            "withdrawal should expire the marker independently of EC cookie state"
-        );
-        assert!(
-            cookies.iter().all(|cookie| !cookie.starts_with("ts-ec=;")),
-            "missing EC cookie should not add an EC-cookie expiry"
-        );
+        fn settings_with_partner(_source: &str) -> Settings {
+            create_test_settings()
+        }
+
+        fn registry_with_partner(source: &str) -> PartnerRegistry {
+            PartnerRegistry::from_config(&[make_partner(source)]).expect("should build registry")
+        }
+
+        fn ts_eids_cookie(value: &serde_json::Value) -> String {
+            base64::engine::general_purpose::STANDARD
+                .encode(serde_json::to_vec(value).expect("should serialize test cookie payload"))
+        }
+
+        fn queued_records(mutation: &IdentityMutation) -> Vec<(SourceDomain, KvPartnerId)> {
+            mutation
+                .positive_changes()
+                .iter()
+                .filter_map(|change| match change {
+                    PartnerIdChange::FillMissing { source, record }
+                    | PartnerIdChange::OwnerWrite { source, record, .. } => {
+                        Some((source.clone(), record.clone()))
+                    }
+                    PartnerIdChange::OwnerRemove { .. } | PartnerIdChange::WriterRemove { .. } => {
+                        None
+                    }
+                })
+                .collect()
+        }
+
+        fn set_cookie_names(response: &Response<EdgeBody>) -> Vec<String> {
+            response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .filter_map(|cookie| cookie.split('=').next())
+                .map(str::to_owned)
+                .collect()
+        }
+
+        fn html_response() -> Response<EdgeBody> {
+            Response::builder()
+                .status(200)
+                .header(http::header::CONTENT_TYPE, "text/html; charset=utf-8")
+                .body(EdgeBody::empty())
+                .expect("should build test response")
+        }
+
+        fn seed_live_row(graph: &KvIdentityGraph, entry: &KvEntry) -> String {
+            let ec_id = sample_ec_id("idflow");
+            graph
+                .create(&ec_id, entry)
+                .expect("should seed the live row");
+            ec_id
+        }
+
+        fn live_row() -> KvEntry {
+            KvEntry::minimal("other.example.com", "x", 1)
+        }
+
+        fn returning_context(ec_id: &str, writer: bool) -> EcContext {
+            let mut context = returning_user_context(ec_id, EcKvSnapshot::NotRead, false);
+            set_writer(&mut context, writer);
+            context
+        }
+
+        fn finalize_with_shared_id(
+            context: &mut EcContext,
+            graph: &KvIdentityGraph,
+            shared_id: Option<&str>,
+        ) -> Response<EdgeBody> {
+            let mut response = html_response();
+            ec_finalize_response(
+                &settings_with_partner(SHARED_ID_SOURCE),
+                context,
+                Some(graph),
+                &registry_with_partner(SHARED_ID_SOURCE),
+                None,
+                shared_id,
+                &mut response,
+            );
+            response
+        }
+
+        #[test]
+        fn returning_writer_navigation_adds_ingest_to_the_mutation_and_writes_nothing() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = seed_live_row(&graph, &live_row());
+            store.reset_counts();
+            let mut context = returning_context(&ec_id, true);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+
+            let response = finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+            assert_eq!(
+                store.writes().total(),
+                0,
+                "should not write in finalize for a returning writer"
+            );
+            let records = queued_records(context.identity().mutation());
+            assert_eq!(records.len(), 1, "should queue the sharedId fill");
+            assert_eq!(
+                records[0].1.first_uid(),
+                Some("example-shared-id"),
+                "should queue the cookie's UID"
+            );
+            assert!(
+                set_cookie_names(&response).is_empty(),
+                "should set no cookie on a returning HTML response"
+            );
+        }
+
+        #[test]
+        fn writer_ingest_applied_to_the_live_row_matches_the_old_direct_write() {
+            let (graph, _store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = seed_live_row(&graph, &live_row());
+            let mut context = returning_context(&ec_id, true);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            let eids_cookie = ts_eids_cookie(&json!([
+                { "source": SHARED_ID_SOURCE, "uids": [{ "id": "example-prebid" }] }
+            ]));
+            let mut response = html_response();
+            let now = checked_current_timestamp().expect("should read the clock");
+
+            ec_finalize_response(
+                &settings_with_partner(SHARED_ID_SOURCE),
+                &mut context,
+                Some(&graph),
+                &registry_with_partner(SHARED_ID_SOURCE),
+                Some(&eids_cookie),
+                Some("example-shared-id"),
+                &mut response,
+            );
+
+            let live = live_row();
+            let mut direct = live.clone();
+            apply_partner_id_updates(
+                &mut direct,
+                &[PartnerIdUpdate::new(SHARED_ID_SOURCE, "example-shared-id")
+                    .with_acquired_at(now)],
+            );
+            let catalog = ProviderCatalog::empty();
+            let random = SeededRandom::new(7);
+            let applied = apply(
+                context.identity().mutation(),
+                &live,
+                &ApplyContext {
+                    now,
+                    random: &random,
+                    catalog: &catalog,
+                },
+            )
+            .expect("should apply to a live row");
+            assert!(applied.changed, "should change the live row");
+            assert_eq!(
+                applied.entry.ids.keys().collect::<Vec<_>>(),
+                direct.ids.keys().collect::<Vec<_>>(),
+                "should store the same sources as the old direct write"
+            );
+            let staged = applied
+                .entry
+                .ids
+                .get(SHARED_ID_SOURCE)
+                .expect("should store the source");
+            let written = direct
+                .ids
+                .get(SHARED_ID_SOURCE)
+                .expect("should store the source");
+            assert_eq!(
+                staged.first_uid(),
+                written.first_uid(),
+                "should store the same UID"
+            );
+            assert_eq!(
+                staged.at, written.at,
+                "should store the same acquisition time"
+            );
+        }
+
+        #[test]
+        fn golden_browser_ingest_stays_one_uid_whatever_the_browser_sent() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = seed_live_row(&graph, &live_row());
+            store.reset_counts();
+            let mut context = returning_context(&ec_id, true);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            let eids_cookie = ts_eids_cookie(&json!([
+                {
+                    "source": "partner.example.com",
+                    "uids": [
+                        { "id": "example-a", "atype": 1, "ext": { "stype": "ppuid" } },
+                        { "id": "example-b", "atype": 3 }
+                    ],
+                    "inserter": "example.com",
+                    "mm": 3
+                },
+                { "source": "unregistered.example.com", "uids": [{ "id": "example-c", "atype": 1 }] }
+            ]));
+            let mut response = html_response();
+
+            ec_finalize_response(
+                &settings_with_partner("partner.example.com"),
+                &mut context,
+                Some(&graph),
+                &registry_with_partner("partner.example.com"),
+                Some(&eids_cookie),
+                None,
+                &mut response,
+            );
+
+            assert_eq!(store.writes().total(), 0, "should not write in finalize");
+            let records = queued_records(context.identity().mutation());
+            assert_eq!(
+                records.len(),
+                1,
+                "should queue only the registered source, as today"
+            );
+            let (source, record) = &records[0];
+            assert_eq!(
+                source.as_str(),
+                "partner.example.com",
+                "should queue the registered source"
+            );
+            assert_eq!(
+                serde_json::to_value(record).expect("should serialize the record"),
+                json!({ "at": record.at, "eids": [{ "uids": [{ "id": "example-a" }] }] }),
+                "should store the UID collect_eid_updates picks today, with no atype, ext or EID-level field"
+            );
+        }
+
+        #[test]
+        fn stagers_ingest_nothing_and_write_nothing() {
+            for source in [
+                Some(EidSyncSource::Auction),
+                Some(EidSyncSource::PageBids),
+                None,
+            ] {
+                let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+                let ec_id = seed_live_row(&graph, &live_row());
+                store.reset_counts();
+                let mut context = returning_context(&ec_id, false);
+                context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+                if let Some(source) = source {
+                    context.set_eid_sync_source(source);
+                }
+
+                let response =
+                    finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+                assert_eq!(
+                    store.writes().total(),
+                    0,
+                    "{source:?} should not write in finalize"
+                );
+                assert!(
+                    context.identity().mutation().is_empty(),
+                    "{source:?} should leave the mutation empty"
+                );
+                assert!(
+                    set_cookie_names(&response).is_empty(),
+                    "{source:?} should set no cookie"
+                );
+            }
+        }
+
+        #[test]
+        fn unusable_consent_writes_nothing_and_queues_nothing() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = seed_live_row(&graph, &live_row());
+            store.reset_counts();
+            let mut context = make_context(
+                Some(&ec_id),
+                Some(&ec_id),
+                true,
+                false,
+                Jurisdiction::Unknown,
+            );
+            set_writer(&mut context, true);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+
+            finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+            assert_eq!(store.writes().total(), 0, "should not write");
+            assert!(
+                context.identity().mutation().is_empty(),
+                "should queue nothing"
+            );
+        }
+
+        #[test]
+        fn withdrawal_still_writes_its_tombstone_on_any_request() {
+            for writer in [true, false] {
+                let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+                let ec_id = seed_live_row(&graph, &live_row());
+                store.reset_counts();
+                let consent = ConsentContext {
+                    jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+                    gpc: true,
+                    source: ConsentSource::Cookie,
+                    ..Default::default()
+                };
+                let mut context =
+                    make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+                set_writer(&mut context, writer);
+                context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+
+                finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+                assert!(
+                    store.writes().total() > 0,
+                    "writer={writer} should write the tombstone"
+                );
+                let (stored, _) = graph
+                    .get(&ec_id)
+                    .expect("should read store")
+                    .expect("row should remain");
+                assert!(
+                    !stored.consent.ok,
+                    "writer={writer} should tombstone the row"
+                );
+                assert!(
+                    context.identity().mutation().is_empty(),
+                    "writer={writer} should queue nothing"
+                );
+            }
+        }
+
+        #[test]
+        fn tombstone_read_leaves_the_mutation_empty() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = seed_live_row(&graph, &KvEntry::tombstone(1000));
+            store.reset_counts();
+            let mut context = returning_context(&ec_id, true);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+
+            finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+            assert_eq!(store.writes().total(), 0, "should not write");
+            assert!(
+                context.identity().mutation().is_empty(),
+                "should leave the mutation empty"
+            );
+        }
+
+        #[test]
+        fn orphan_rotation_carries_browser_ingest_in_one_create() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let orphan = sample_ec_id("orphn2");
+            let mut context = returning_context(&orphan, true);
+            context.set_recovery_eligible(true);
+            context.set_kv_snapshot(EcKvSnapshot::Missing {
+                ec_id: orphan.clone(),
+            });
+
+            let response = finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+            let replacement = context.ec_value().expect("should keep an EC ID").to_owned();
+            assert_ne!(replacement, orphan, "should rotate the orphan");
+            let writes = store.writes();
+            assert_eq!(writes.add, 1, "should write one create");
+            assert_eq!(writes.total(), 1, "should write nothing else");
+            let (stored, _) = graph
+                .get(&replacement)
+                .expect("should read store")
+                .expect("should hold the replacement row");
+            assert_eq!(
+                stored
+                    .ids
+                    .get(SHARED_ID_SOURCE)
+                    .and_then(KvPartnerId::first_uid),
+                Some("example-shared-id"),
+                "should carry the sharedId as a one-UID record"
+            );
+            assert!(
+                context.identity().mutation().is_empty(),
+                "should leave the mutation empty"
+            );
+            assert_eq!(
+                set_cookie_names(&response),
+                vec!["ts-ec".to_owned()],
+                "should set only the replacement cookie"
+            );
+        }
+
+        #[test]
+        fn confirm_read_that_finds_the_row_queues_ingest_instead_of_writing() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = seed_live_row(&graph, &live_row());
+            store.reset_counts();
+            let mut context = returning_context(&ec_id, true);
+            context.set_recovery_eligible(true);
+            context.set_kv_snapshot(EcKvSnapshot::Missing {
+                ec_id: ec_id.clone(),
+            });
+
+            let response = finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+            assert_eq!(store.writes().total(), 0, "should not write");
+            assert_eq!(
+                context.ec_value(),
+                Some(ec_id.as_str()),
+                "should not rotate"
+            );
+            assert_eq!(
+                queued_records(context.identity().mutation()).len(),
+                1,
+                "should queue the ingest"
+            );
+            assert!(
+                context.kv_snapshot().entry_for(&ec_id).is_some(),
+                "should adopt the confirmed row as the snapshot"
+            );
+            assert!(
+                set_cookie_names(&response).is_empty(),
+                "should set no cookie"
+            );
+        }
+
+        #[test]
+        fn integration_proxy_writer_never_rotates_on_missing_row() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let orphan = sample_ec_id("orphn3");
+            let mut context = returning_context(&orphan, true);
+            context.set_recovery_eligible(false);
+            context.set_kv_snapshot(EcKvSnapshot::Missing {
+                ec_id: orphan.clone(),
+            });
+
+            let response = finalize_with_shared_id(&mut context, &graph, Some("example-shared-id"));
+
+            assert_eq!(store.writes().total(), 0, "should not create");
+            assert_did_not_rotate(&context, &orphan, &response);
+            assert!(
+                context.identity().mutation().is_empty(),
+                "should queue nothing against a missing row"
+            );
+        }
+
+        #[test]
+        fn new_visitor_create_carries_browser_ingest_in_one_write() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let settings = create_test_settings();
+            let registry = registry_with_partner(SHARED_ID_SOURCE);
+            let mut context = EcContext::new_for_test_with_ip(
+                None,
+                granting_consent(),
+                Some("192.0.2.10".to_owned()),
+            );
+            let seed = browser_seed(
+                &settings,
+                &registry,
+                context.consent(),
+                None,
+                Some("example-shared-id"),
+                1_760_000_000,
+            );
+
+            context
+                .generate_if_needed(&settings, Some(&graph), &seed)
+                .expect("should generate an EC");
+            let mut response = html_response();
+            ec_finalize_response(
+                &settings,
+                &mut context,
+                Some(&graph),
+                &registry,
+                None,
+                Some("example-shared-id"),
+                &mut response,
+            );
+
+            let writes = store.writes();
+            assert_eq!(writes.add, 1, "should write one create");
+            assert_eq!(writes.total(), 1, "should write nothing else");
+            let ec_id = context.ec_value().expect("should hold the new EC");
+            let (stored, _) = graph
+                .get(ec_id)
+                .expect("should read store")
+                .expect("should hold the new row");
+            assert_eq!(
+                stored
+                    .ids
+                    .get(SHARED_ID_SOURCE)
+                    .and_then(KvPartnerId::first_uid),
+                Some("example-shared-id"),
+                "should carry the sharedId as a one-UID record"
+            );
+            assert_eq!(
+                set_cookie_names(&response),
+                vec!["ts-ec".to_owned()],
+                "should set the ts-ec cookie as today"
+            );
+        }
+    }
+
+    mod after_send_withdrawal_retry {
+        use super::*;
+        use crate::ec::kv::MAX_CAS_RETRIES;
+
+        fn withdrawn_context(active: &str, cookie: &str) -> EcContext {
+            let consent = ConsentContext {
+                jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+                gpc: true,
+                source: ConsentSource::Cookie,
+                ..Default::default()
+            };
+            make_context_with_consent(Some(active), Some(cookie), true, false, consent)
+        }
+
+        fn seed(graph: &KvIdentityGraph, ec_id: &str) {
+            graph
+                .create(ec_id, &KvEntry::minimal("p.example.com", "uid", 1_000))
+                .expect("should seed the row");
+        }
+
+        fn finalize(context: &mut EcContext, graph: &KvIdentityGraph) {
+            let mut response = empty_response();
+            ec_finalize_response(
+                &create_test_settings(),
+                context,
+                Some(graph),
+                &PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+        }
+
+        fn is_tombstone(graph: &KvIdentityGraph, ec_id: &str) -> bool {
+            graph
+                .get(ec_id)
+                .expect("should read the row")
+                .is_some_and(|(entry, _)| !entry.consent.ok)
+        }
+
+        #[test]
+        fn failed_withdrawal_is_recorded_for_after_send() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("fail01");
+            seed(&graph, &ec_id);
+            store.refuse_conditional_writes(&ec_id, usize::MAX);
+            let mut context = withdrawn_context(&ec_id, &ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+
+            finalize(&mut context, &graph);
+
+            assert_eq!(
+                context.failed_withdrawals(),
+                std::slice::from_ref(&ec_id),
+                "should record the active ID whose tombstone failed"
+            );
+            assert!(
+                !is_tombstone(&graph, &ec_id),
+                "the row should still be live"
+            );
+        }
+
+        #[test]
+        fn successful_withdrawal_records_nothing() {
+            let (graph, _store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("good01");
+            seed(&graph, &ec_id);
+            let mut context = withdrawn_context(&ec_id, &ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+
+            finalize(&mut context, &graph);
+
+            assert!(
+                context.failed_withdrawals().is_empty(),
+                "should record nothing for a tombstone that was written"
+            );
+            assert!(is_tombstone(&graph, &ec_id), "should tombstone the row");
+        }
+
+        #[test]
+        fn nothing_failed_means_the_retry_touches_nothing() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("none01");
+            seed(&graph, &ec_id);
+            store.reset_counts();
+            let mut context = withdrawn_context(&ec_id, &ec_id);
+
+            retry_failed_withdrawals(&mut context, &graph);
+
+            assert_eq!(
+                store.writes().total(),
+                0,
+                "should write nothing of any mode"
+            );
+            assert_eq!(store.writes().lookups, 0, "should read nothing");
+        }
+
+        #[test]
+        fn after_send_retry_writes_the_tombstone_once() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("retry1");
+            seed(&graph, &ec_id);
+            store.refuse_conditional_writes(&ec_id, MAX_CAS_RETRIES as usize);
+            let mut context = withdrawn_context(&ec_id, &ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            finalize(&mut context, &graph);
+            assert_eq!(
+                context.failed_withdrawals(),
+                std::slice::from_ref(&ec_id),
+                "should record the failure before send"
+            );
+            store.reset_counts();
+
+            retry_failed_withdrawals(&mut context, &graph);
+
+            assert!(is_tombstone(&graph, &ec_id), "should read as a tombstone");
+            assert!(
+                context.failed_withdrawals().is_empty(),
+                "should clear an ID whose retry succeeded"
+            );
+            let writes = store.writes();
+            assert_eq!(
+                writes.if_generation_match, 1,
+                "should write the tombstone once"
+            );
+            assert_eq!(writes.add, 1, "should write the completion marker once");
+            assert_eq!(writes.overwrite, 0, "should not overwrite");
+            assert!(
+                context
+                    .kv_snapshot()
+                    .entry_for(&ec_id)
+                    .is_some_and(|entry| !entry.consent.ok),
+                "should update the active snapshot to the tombstone"
+            );
+        }
+
+        #[test]
+        fn after_send_retry_is_the_last_attempt() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("last01");
+            seed(&graph, &ec_id);
+            store.refuse_conditional_writes(&ec_id, usize::MAX);
+            let mut context = withdrawn_context(&ec_id, &ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            finalize(&mut context, &graph);
+            store.reset_counts();
+
+            retry_failed_withdrawals(&mut context, &graph);
+
+            let writes = store.writes();
+            assert_eq!(
+                writes.if_generation_match, MAX_CAS_RETRIES as usize,
+                "should make one run of the CAS attempts, never a second retry"
+            );
+            assert_eq!(writes.add, 0, "should write no completion marker");
+            assert_eq!(writes.overwrite, 0, "should not overwrite");
+            assert_eq!(
+                context.failed_withdrawals(),
+                std::slice::from_ref(&ec_id),
+                "should leave the failure recorded for the counters"
+            );
+            assert!(
+                !is_tombstone(&graph, &ec_id),
+                "the row should still be live"
+            );
+        }
+
+        #[test]
+        fn only_the_id_that_fails_twice_remains_after_the_retry() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let active = sample_ec_id("activ5");
+            let cookie = sample_ec_id("cook5e");
+            seed(&graph, &active);
+            seed(&graph, &cookie);
+            store.refuse_conditional_writes(&cookie, MAX_CAS_RETRIES as usize);
+            store.refuse_conditional_writes(&active, usize::MAX);
+            let mut context = withdrawn_context(&active, &cookie);
+            context.set_kv_snapshot(graph.load_snapshot(&active));
+            finalize(&mut context, &graph);
+            assert_eq!(
+                context.failed_withdrawals().len(),
+                2,
+                "should record both IDs before send"
+            );
+
+            retry_failed_withdrawals(&mut context, &graph);
+
+            assert_eq!(
+                context.failed_withdrawals(),
+                std::slice::from_ref(&active),
+                "should keep only the ID that failed twice"
+            );
+            assert!(
+                is_tombstone(&graph, &cookie),
+                "should withdraw the cookie row"
+            );
+            assert!(
+                !is_tombstone(&graph, &active),
+                "the active row should be live"
+            );
+        }
+
+        #[test]
+        fn withdrawal_of_two_ids_retries_only_the_failed_one() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let active = sample_ec_id("activ4");
+            let cookie = sample_ec_id("cook4e");
+            seed(&graph, &active);
+            seed(&graph, &cookie);
+            store.refuse_conditional_writes(&cookie, MAX_CAS_RETRIES as usize);
+            let mut context = withdrawn_context(&active, &cookie);
+            context.set_kv_snapshot(graph.load_snapshot(&active));
+            finalize(&mut context, &graph);
+            assert_eq!(
+                context.failed_withdrawals(),
+                std::slice::from_ref(&cookie),
+                "should record only the cookie ID"
+            );
+            assert!(
+                is_tombstone(&graph, &active),
+                "the active row should be withdrawn"
+            );
+            let active_generation = graph.get(&active).expect("should read").map(|row| row.1);
+            store.reset_counts();
+
+            retry_failed_withdrawals(&mut context, &graph);
+
+            assert!(
+                is_tombstone(&graph, &cookie),
+                "should withdraw the cookie row"
+            );
+            assert!(
+                context.failed_withdrawals().is_empty(),
+                "should hold no ID once the only failed one succeeds"
+            );
+            assert_eq!(
+                graph.get(&active).expect("should read").map(|row| row.1),
+                active_generation,
+                "should not rewrite the active row"
+            );
+            assert_eq!(
+                store.writes().if_generation_match,
+                1,
+                "should write one tombstone, for the cookie ID only"
+            );
+        }
+    }
+
+    mod capture_revoke {
+        use super::*;
+        use crate::ec::identity::mutation::{IdentityMutation, PartnerIdChange};
+        use crate::ec::identity::revision::Revision;
+        use crate::ec::identity::test_support::{pid, source};
+
+        fn finalize(context: &mut EcContext, graph: &KvIdentityGraph) -> Response<EdgeBody> {
+            let mut response = empty_response();
+            ec_finalize_response(
+                &create_test_settings(),
+                context,
+                Some(graph),
+                &PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+            response
+        }
+
+        fn consenting_context(ec_id: &str) -> EcContext {
+            let mut context = make_context_with_consent(
+                Some(ec_id),
+                Some(ec_id),
+                true,
+                false,
+                granting_consent(),
+            );
+            context
+                .identity_mut()
+                .mutation_mut()
+                .add_change(PartnerIdChange::OwnerRemove {
+                    source: source("a.example.com"),
+                    provider: pid("lockr"),
+                    expected: Revision::Unset,
+                });
+            context
+        }
+
+        fn expires_the_ec_cookie(response: &Response<EdgeBody>) -> bool {
+            response
+                .headers()
+                .get_all("set-cookie")
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .any(|cookie| cookie.starts_with("ts-ec=") && cookie.contains("Max-Age=0"))
+        }
+
+        #[test]
+        fn capture_global_revoke_from_a_real_browser_tombstones_the_row_and_clears_the_ec_cookie() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("revoke");
+            graph
+                .create(&ec_id, &KvEntry::minimal("p.example.com", "uid", 1_000))
+                .expect("should seed the row");
+            store.reset_counts();
+            let mut context = consenting_context(&ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            context.request_global_revoke();
+
+            let response = finalize(&mut context, &graph);
+
+            let (stored, _) = graph
+                .get(&ec_id)
+                .expect("should read the row")
+                .expect("should keep the tombstone");
+            assert!(!stored.consent.ok, "should tombstone the row");
+            assert!(stored.ids.is_empty(), "should remove every ID");
+            assert_eq!(
+                store.writes().if_generation_match,
+                1,
+                "should write one tombstone"
+            );
+            assert!(
+                expires_the_ec_cookie(&response),
+                "should expire the EC cookie"
+            );
+            assert!(
+                context.failed_withdrawals().is_empty(),
+                "should record no failed tombstone"
+            );
+            assert_eq!(
+                context.identity().mutation(),
+                &IdentityMutation::default(),
+                "should drop the request's mutation"
+            );
+
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            graph
+                .create(&ec_id, &KvEntry::minimal("p.example.com", "uid", 1_000))
+                .expect("should seed the row");
+            store.reset_counts();
+            let mut control = consenting_context(&ec_id);
+            control.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            let response = finalize(&mut control, &graph);
+            assert!(
+                graph
+                    .get(&ec_id)
+                    .expect("should read the row")
+                    .is_some_and(|(row, _)| row.consent.ok),
+                "control: without a revoke the row stays live"
+            );
+            assert!(
+                !expires_the_ec_cookie(&response),
+                "control: without a revoke the cookie stays"
+            );
+            assert_eq!(store.writes().total(), 0, "control: writes nothing");
+        }
+
+        fn revoke_marker_cookie(response: &Response<EdgeBody>) -> Option<String> {
+            response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .find(|cookie| cookie.starts_with("ts-ec-revoked="))
+                .map(str::to_owned)
+        }
+
+        #[test]
+        fn capture_global_revoke_sets_the_minting_marker() {
+            let graph = KvIdentityGraph::in_memory("ec-store");
+            let ec_id = sample_ec_id("marker");
+            graph
+                .create(&ec_id, &KvEntry::minimal("p.example.com", "uid", 1_000))
+                .expect("should seed the row");
+            let mut context = consenting_context(&ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            context.request_global_revoke();
+
+            let response = finalize(&mut context, &graph);
+
+            let marker = revoke_marker_cookie(&response).expect("should set the marker");
+            assert!(
+                marker.starts_with(&format!(
+                    "ts-ec-revoked={};",
+                    crate::ec::cookies::revoke_marker_value(context.consent())
+                )),
+                "should hold the fingerprint of the consent the revoke saw"
+            );
+            assert!(
+                marker.contains("HttpOnly") && marker.contains("Secure"),
+                "should be HttpOnly and Secure"
+            );
+
+            let mut control = consenting_context(&ec_id);
+            control.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            assert!(
+                revoke_marker_cookie(&finalize(&mut control, &graph)).is_none(),
+                "control: without a revoke no marker is set"
+            );
+        }
+
+        #[test]
+        fn minting_under_changed_consent_expires_a_stale_marker() {
+            let graph = KvIdentityGraph::in_memory("ec-store");
+            let mut context = EcContext::new_for_test_with_ip(
+                None,
+                granting_consent(),
+                Some("192.0.2.5".to_owned()),
+            );
+            context.set_revoke_marker_for_test("ffff");
+            context
+                .generate_if_needed(&create_test_settings(), Some(&graph), &BrowserSeed::empty())
+                .expect("should mint");
+
+            let response = finalize(&mut context, &graph);
+
+            assert!(
+                revoke_marker_cookie(&response).is_some_and(|cookie| cookie.contains("Max-Age=0")),
+                "should expire the marker once a new EC is minted"
+            );
+        }
+
+        #[test]
+        fn capture_global_revoke_failed_tombstone_gets_the_after_send_run() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("rvfail");
+            graph
+                .create(&ec_id, &KvEntry::minimal("p.example.com", "uid", 1_000))
+                .expect("should seed the row");
+            store.refuse_conditional_writes(&ec_id, 5);
+            let mut context = consenting_context(&ec_id);
+            context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+            context.request_global_revoke();
+
+            let response = finalize(&mut context, &graph);
+
+            assert_eq!(
+                context.failed_withdrawals(),
+                std::slice::from_ref(&ec_id),
+                "should record the failed tombstone for the after-send run"
+            );
+            assert!(
+                expires_the_ec_cookie(&response),
+                "should still expire the cookie"
+            );
+
+            retry_failed_withdrawals(&mut context, &graph);
+
+            assert!(
+                graph
+                    .get(&ec_id)
+                    .expect("should read the row")
+                    .is_some_and(|(row, _)| !row.consent.ok),
+                "should tombstone the row after send"
+            );
+        }
+
+        #[test]
+        fn capture_global_revoke_without_an_ec_cookie_expires_nothing() {
+            let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+            let ec_id = sample_ec_id("nocook");
+            graph
+                .create(&ec_id, &KvEntry::minimal("p.example.com", "uid", 1_000))
+                .expect("should seed the row");
+            store.reset_counts();
+            let mut context =
+                make_context_with_consent(Some(&ec_id), None, false, true, granting_consent());
+            context.request_global_revoke();
+
+            let response = finalize(&mut context, &graph);
+
+            assert!(
+                !expires_the_ec_cookie(&response),
+                "should expire no cookie the request did not carry"
+            );
+            assert_eq!(store.writes().total(), 0, "should tombstone no row");
+        }
     }
 
     fn live_entry() -> KvEntry {
diff --git a/crates/trusted-server-core/src/ec/identify.rs b/crates/trusted-server-core/src/ec/identify.rs
index 94464d1a57..5c3d89e8ca 100644
--- a/crates/trusted-server-core/src/ec/identify.rs
+++ b/crates/trusted-server-core/src/ec/identify.rs
@@ -16,14 +16,33 @@ use crate::openrtb::{Eid, Uid};
 use crate::settings::Settings;
 
 use super::EcContext;
+use super::checked_current_timestamp;
+use super::identity::SourceDomain;
+use super::identity::UnixTime;
+use super::identity::catalog::ProviderCatalog;
+use super::identity::policy::PolicySignals;
+use super::identity::request::opted_out;
+use super::identity::servable::{ServeContext, is_servable};
 use super::kv::KvIdentityGraph;
+use super::kv_types::KvPartnerId;
 use super::log_id;
 use super::registry::PartnerRegistry;
 
+/// Whether the browser marked the request as a same-origin or same-site
+/// fetch. A missing `Sec-Fetch-Site` header fails closed.
+fn is_same_site_fetch(req: &Request<EdgeBody>) -> bool {
+    req.headers()
+        .get("sec-fetch-site")
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|site| matches!(site, "same-origin" | "same-site"))
+}
+
 /// Handles `GET /_ts/api/v1/identify`.
 ///
 /// Requires Bearer token authentication. Returns only the requesting
-/// partner's UID for the active EC ID.
+/// partner's UID for the active EC ID. A provider-written UID is returned only
+/// to a call with an allowed `Origin` and a same-origin or same-site
+/// `Sec-Fetch-Site`, because the EC ID is a bearer value servers hold too.
 ///
 /// # Errors
 ///
@@ -83,35 +102,79 @@ pub fn handle_identify(
         ));
     };
 
+    // The EC ID is a bearer value partners and the origin hold (spec 9.5).
+    // A provider-written ID goes only to a call the visitor's browser made
+    // from the publisher's site.
+    let browser_context = allowed_origin.is_some() && is_same_site_fetch(req);
     let mut degraded = false;
     let mut uid: Option<String> = None;
     let mut cluster_size: Option<u32> = None;
 
     match kv.get(ec_id) {
-        Ok(Some((entry, generation))) => {
+        Ok(Some((entry, _generation))) => {
             if !entry.consent.ok {
                 // Tombstone entries preserve the withdrawal signal for 24 hours.
-                // Do not extract IDs or evaluate cluster size because that would
-                // write back with the live-entry TTL.
+                // Do not extract IDs or evaluate cluster size.
                 log::trace!("Identify found tombstone for '{}'", log_id(ec_id));
             } else {
-                // Extract only this partner's UID.
-                if let Some(partner_uid) = entry.ids.get(&partner.source_domain)
-                    && !partner_uid.uid.is_empty()
-                {
-                    uid = Some(partner_uid.uid.clone());
-                }
-
-                // Evaluate cluster size lazily for identify responses. Existing
-                // stored cluster_size values are reused without a prefix-list call.
-                match kv.evaluate_cluster(ec_id, &entry, generation) {
-                    Ok(size) => {
-                        cluster_size = size;
-                    }
-                    Err(err) => {
-                        log::warn!("Cluster evaluation failed for '{}': {err:?}", log_id(ec_id));
+                // Extract only this partner's UID, and only when the shared
+                // servability check passes under this request's consent, never
+                // the row's stored snapshot. A failed clock serves nothing,
+                // because a zero time would make every expiry check pass.
+                if let Some(now) = checked_current_timestamp() {
+                    // Without a runtime no provider is configured.
+                    let empty_catalog;
+                    let catalog = match ec_context.identity_runtime() {
+                        Some(runtime) => runtime.catalog(),
+                        None => {
+                            empty_catalog = ProviderCatalog::empty();
+                            &empty_catalog
+                        }
+                    };
+                    let opted_out = opted_out(&entry);
+                    let serve = ServeContext {
+                        now: UnixTime::from_secs(now),
+                        consent: ec_context.consent(),
+                        signals: PolicySignals::from_headers(req.headers()),
+                        catalog,
+                        opted_out: &opted_out,
+                    };
+                    if let Some(partner_uid) = entry
+                        .ids
+                        .get(&partner.source_domain)
+                        .filter(|record| record.w.is_none() || browser_context)
+                        .filter(|record| {
+                            partner
+                                .source_domain
+                                .parse::<SourceDomain>()
+                                .is_ok_and(|source| is_servable(&serve, &source, record))
+                        })
+                        .and_then(KvPartnerId::first_uid)
+                        .filter(|partner_uid| !partner_uid.is_empty())
+                    {
+                        uid = Some(partner_uid.to_owned());
                     }
                 }
+
+                // Reuse a stored cluster_size; otherwise count without writing.
+                // The writer stores the size, never this read path.
+                cluster_size = match entry
+                    .network
+                    .as_ref()
+                    .and_then(|network| network.cluster_size)
+                {
+                    Some(size) => Some(size),
+                    None => match kv.compute_cluster_size(ec_id) {
+                        Ok(size) => Some(size),
+                        Err(err) => {
+                            log::warn!(
+                                "Cluster evaluation failed for '{}': {err:?}",
+                                log_id(ec_id)
+                            );
+                            None
+                        }
+                    },
+                };
             }
         }
         Ok(None) => {}
@@ -124,13 +187,15 @@ pub fn handle_identify(
         }
     }
 
-    let eid = uid.as_ref().map(|u| Eid {
-        source: partner.source_domain.clone(),
-        uids: vec![Uid {
-            id: u.clone(),
-            atype: Some(partner.openrtb_atype),
-            ext: None,
-        }],
+    let eid = uid.as_ref().map(|u| {
+        Eid::new(
+            partner.source_domain.clone(),
+            vec![Uid {
+                id: u.clone(),
+                atype: Some(partner.openrtb_atype),
+                ext: None,
+            }],
+        )
     });
 
     let body = IdentifyResponse {
@@ -334,6 +399,12 @@ mod tests {
     use super::*;
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
+    use std::collections::BTreeMap;
+    use std::sync::Arc;
+
+    use crate::ec::identity::runtime::IdentityRuntime;
+    use crate::ec::identity::test_support::{example_entry_set, fixed_provider, full_record};
+    use crate::ec::kv_types::{KvEid, KvEntry, KvUid};
     use crate::ec::registry::PartnerRegistry;
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
@@ -372,8 +443,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -639,6 +711,258 @@ mod tests {
         );
     }
 
+    fn identify_body(kv: &KvIdentityGraph, ec_id: &str) -> serde_json::Value {
+        identify_body_for(
+            kv,
+            ec_id,
+            make_test_partner("ssp.example.com", VALID_API_TOKEN),
+        )
+    }
+
+    fn identify_body_for(
+        kv: &KvIdentityGraph,
+        ec_id: &str,
+        partner: EcPartner,
+    ) -> serde_json::Value {
+        let settings = create_test_settings();
+        let partners = vec![partner];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let req = Request::builder()
+            .method("GET")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://edge.test-publisher.com/identify") // allow-domain: edge.test-publisher.com
+            .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(ec_id));
+
+        let response = handle_identify(&settings, kv, &registry, &req, &ec_context)
+            .expect("should construct identify response");
+        assert_eq!(response.status(), StatusCode::OK, "should answer 200");
+        serde_json::from_slice(&response.into_body().into_bytes().unwrap_or_default())
+            .expect("should decode identify response JSON")
+    }
+
+    #[test]
+    fn handle_identify_omits_an_expired_record_and_keeps_a_valid_one() {
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let mut entry = KvEntry::minimal("ssp.example.com", "expired-uid", 1);
+        entry
+            .ids
+            .get_mut("ssp.example.com")
+            .expect("should hold the partner source")
+            .exp = Some(50);
+        entry.ids.insert(
+            "other.example.com".to_owned(),
+            KvPartnerId::new("valid-uid"),
+        );
+        let kv = KvIdentityGraph::in_memory("identify-store");
+        kv.create(&ec_id, &entry).expect("should seed KV entry");
+
+        let body = identify_body(&kv, &ec_id);
+
+        assert!(
+            body.get("uid").is_none() && body.get("eid").is_none(),
+            "should not return the expired ID"
+        );
+
+        let mut live = KvEntry::minimal("ssp.example.com", "live-uid", 1);
+        live.ids
+            .get_mut("ssp.example.com")
+            .expect("should hold the partner source")
+            .exp = Some(u64::MAX);
+        let kv = KvIdentityGraph::in_memory("identify-store");
+        kv.create(&ec_id, &live).expect("should seed KV entry");
+
+        let body = identify_body(&kv, &ec_id);
+
+        assert_eq!(body["uid"], "live-uid", "should return the unexpired ID");
+    }
+
+    /// Calls `/identify` for a row whose `ssp.example.com` record `writer`
+    /// wrote, with the provider `prov` configured, and `headers` on the
+    /// request. Returns the `uid` the response carries.
+    fn identify_uid_with_headers(writer: Option<&str>, headers: &[(&str, &str)]) -> Option<String> {
+        let settings = create_test_settings();
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let mut entry = KvEntry::minimal("other.example.com", "other-uid", 1);
+        entry.ids.insert(
+            "ssp.example.com".to_owned(),
+            KvPartnerId {
+                w: writer.map(str::to_owned),
+                ..KvPartnerId::new("written-uid")
+            },
+        );
+        let kv = KvIdentityGraph::in_memory("identify-store");
+        kv.create(&ec_id, &entry).expect("should seed KV entry");
+        let partners = vec![make_test_partner("ssp.example.com", VALID_API_TOKEN)];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let mut builder = Request::builder()
+            .method("GET")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://edge.test-publisher.com/identify") // allow-domain: edge.test-publisher.com
+            .header("authorization", format!("Bearer {VALID_API_TOKEN}"));
+        for (name, value) in headers {
+            builder = builder.header(*name, *value);
+        }
+        let req = builder
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_identity_runtime(Arc::new(
+            IdentityRuntime::from_settings_with_providers(
+                &settings,
+                vec![fixed_provider("prov", &["ssp.example.com"])],
+                BTreeMap::new(),
+            )
+            .expect("should build the runtime"),
+        ));
+
+        let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
+            .expect("should construct identify response");
+        assert_eq!(response.status(), StatusCode::OK, "should answer 200");
+        let body: serde_json::Value =
+            serde_json::from_slice(&response.into_body().into_bytes().unwrap_or_default())
+                .expect("should decode identify response JSON");
+        body["uid"].as_str().map(str::to_owned)
+    }
+
+    #[test]
+    fn identify_returns_a_provider_written_id_only_with_browser_context() {
+        // Keep the host aligned with the shared settings fixture.
+        const ORIGIN: (&str, &str) = ("origin", "https://www.test-publisher.com"); // allow-domain: www.test-publisher.com
+
+        assert_eq!(
+            identify_uid_with_headers(Some("prov"), &[ORIGIN, ("sec-fetch-site", "same-site")])
+                .as_deref(),
+            Some("written-uid"),
+            "should return it to a same-site browser call"
+        );
+        assert_eq!(
+            identify_uid_with_headers(Some("prov"), &[ORIGIN, ("sec-fetch-site", "same-origin")])
+                .as_deref(),
+            Some("written-uid"),
+            "should return it to a same-origin browser call"
+        );
+        for (headers, case) in [
+            (&[][..], "no Origin"),
+            (&[ORIGIN][..], "no Sec-Fetch-Site"),
+            (
+                &[ORIGIN, ("sec-fetch-site", "cross-site")][..],
+                "a cross-site fetch",
+            ),
+            (
+                &[ORIGIN, ("sec-fetch-site", "none")][..],
+                "a user-initiated fetch",
+            ),
+        ] {
+            assert_eq!(
+                identify_uid_with_headers(Some("prov"), headers),
+                None,
+                "should withhold it for {case}"
+            );
+        }
+    }
+
+    #[test]
+    fn identify_returns_a_browser_seeded_id_without_browser_context() {
+        assert_eq!(
+            identify_uid_with_headers(None, &[]).as_deref(),
+            Some("written-uid"),
+            "should keep today's behaviour for an ID no provider wrote"
+        );
+    }
+
+    #[test]
+    fn identify_computes_cluster_size_without_writing() {
+        let (kv, store) = KvIdentityGraph::write_counting("identify-store");
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let entry = KvEntry::minimal("ssp.example.com", "example-uid", 1);
+        assert!(
+            entry.network.is_none(),
+            "should seed a row without a stored cluster size"
+        );
+        kv.create(&ec_id, &entry).expect("should seed KV entry");
+        store.reset_counts();
+
+        let body = identify_body(&kv, &ec_id);
+
+        assert!(body["cluster_size"].is_number(), "should report a size");
+        assert_eq!(store.writes().total(), 0, "should not write");
+    }
+
+    #[test]
+    fn identify_returns_the_first_uid_of_a_multi_entry_record_with_the_partner_atype() {
+        let (kv, _store) = KvIdentityGraph::write_counting("identify-store");
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let mut entry = KvEntry::minimal("other.example.com", "other-uid", 1);
+        let set = [&["example-a", "example-b"][..], &["example-c"][..]]
+            .iter()
+            .enumerate()
+            .map(|(index, ids)| KvEid {
+                uids: ids
+                    .iter()
+                    .map(|id| KvUid {
+                        id: (*id).to_owned(),
+                        atype: Some(1),
+                        ext: None,
+                    })
+                    .collect(),
+                inserter: (index == 0).then(|| "example.com".to_owned()),
+                ..KvEid::default()
+            })
+            .collect();
+        entry
+            .ids
+            .insert("partner.example.com".to_owned(), full_record(None, set));
+        kv.create(&ec_id, &entry).expect("should seed KV entry");
+        let mut partner = make_test_partner("partner.example.com", VALID_API_TOKEN);
+        partner.openrtb_atype = 3;
+        partner.bidstream_enabled = true;
+
+        let body = identify_body_for(&kv, &ec_id, partner);
+
+        assert_eq!(
+            body["uid"],
+            serde_json::json!("example-a"),
+            "should return the first UID of the first entry"
+        );
+        assert_eq!(
+            body["eid"],
+            serde_json::json!({ "source": "partner.example.com", "uids": [{ "id": "example-a", "atype": 3 }] }),
+            "should return one UID with the partner's openrtb_atype, as for a one-UID record"
+        );
+    }
+
+    #[test]
+    fn handle_identify_returns_one_uid_for_a_full_record() {
+        let ec_id = format!("{}.ABC123", "a".repeat(64));
+        let mut entry = KvEntry::minimal("other.example.com", "other-uid", 1);
+        entry.ids.insert(
+            "ssp.example.com".to_owned(),
+            full_record(None, example_entry_set()),
+        );
+        let kv = KvIdentityGraph::in_memory("identify-store");
+        kv.create(&ec_id, &entry).expect("should seed KV entry");
+
+        let body = identify_body(&kv, &ec_id);
+
+        assert_eq!(body["uid"], "example-a", "should return the first UID");
+        let expected = Eid::new(
+            "ssp.example.com".to_owned(),
+            vec![Uid {
+                id: "example-a".to_owned(),
+                atype: Some(EcPartner::default_openrtb_atype()),
+                ext: None,
+            }],
+        );
+        assert_eq!(
+            body["eid"],
+            serde_json::to_value(expected).expect("should serialize the expected EID"),
+            "should return the one-UID shape, never the full set"
+        );
+    }
+
     #[test]
     fn handle_identify_denies_mismatched_browser_origin() {
         let settings = create_test_settings();
diff --git a/crates/trusted-server-core/src/ec/identity/catalog.rs b/crates/trusted-server-core/src/ec/identity/catalog.rs
new file mode 100644
index 0000000000..9cc7610ae9
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/catalog.rs
@@ -0,0 +1,827 @@
+//! The enabled identity providers and source ownership.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::Arc;
+
+use error_stack::{Report, ResultExt as _};
+
+use super::descriptor::ProviderDescriptor;
+use super::generic_pull::{GenericPullProvider, generic_pull_id};
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::provider::IdentityProvider;
+use crate::error::TrustedServerError;
+use crate::settings::{EcPartner, IdentitySettings, Settings};
+
+/// Most providers one deployment may enable.
+const MAX_PROVIDERS: usize = 32;
+
+fn catalog_error(message: String) -> Report<TrustedServerError> {
+    Report::new(TrustedServerError::Configuration { message })
+}
+
+/// Validates the catalog rules of spec 10.2 against every provider
+/// descriptor.
+///
+/// It rejects a duplicate provider ID, more than 32 providers, an
+/// `[ec.identity.providers.<id>]` table that names no enabled provider, and
+/// `revoke_scope` on a provider whose descriptor declares no `captures`. It
+/// also checks source ownership, after each provider's `sources` narrowing: a
+/// `sources` list must name declared sources and keep at least one, a
+/// capture-only provider must list its `sources`, an `owner` must name an
+/// enabled provider that is not capture-only and keeps the source, every
+/// claimed source needs an `[[ec.partners]]` entry, and no second provider
+/// may claim an owned source. It is the one place these rules live. It reads
+/// descriptors only, so it runs on unresolved deploy-time settings.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::Configuration`] naming the first rule
+/// that fails.
+pub(crate) fn validate_identity_catalog(
+    descriptors: &[ProviderDescriptor],
+    partners: &[EcPartner],
+    identity: &IdentitySettings,
+) -> Result<(), Report<TrustedServerError>> {
+    let mut ids = BTreeSet::new();
+    for descriptor in descriptors {
+        if !ids.insert(descriptor.id().as_str()) {
+            return Err(catalog_error(format!(
+                "identity provider `{}` is declared more than once",
+                descriptor.id()
+            )));
+        }
+    }
+    if descriptors.len() > MAX_PROVIDERS {
+        return Err(catalog_error(format!(
+            "at most {MAX_PROVIDERS} identity providers may be enabled, got {}",
+            descriptors.len()
+        )));
+    }
+
+    for (id, settings) in &identity.providers {
+        let Some(descriptor) = descriptors
+            .iter()
+            .find(|descriptor| descriptor.id().as_str() == id)
+        else {
+            let configured = if ids.is_empty() {
+                "none".to_owned()
+            } else {
+                ids.iter().copied().collect::<Vec<_>>().join(", ")
+            };
+            let hint = partners
+                .iter()
+                .find(|partner| {
+                    !partner.pull_sync_enabled
+                        && generic_pull_id(&partner.source_domain).as_str() == id
+                })
+                .map_or_else(String::new, |partner| {
+                    format!(
+                        "; partner `{}` has pull_sync_enabled = false",
+                        partner.source_domain
+                    )
+                });
+            return Err(catalog_error(format!(
+                "ec.identity.providers.{id} names no enabled identity provider{hint}; \
+                 configured providers: {configured}"
+            )));
+        };
+        if settings.revoke_scope.is_some() && descriptor.captures().is_none() {
+            return Err(catalog_error(format!(
+                "ec.identity.providers.{id}.revoke_scope is set, but provider `{id}` declares no captures"
+            )));
+        }
+    }
+
+    validate_source_ownership(descriptors, partners, identity)
+}
+
+/// Whether `descriptor` captures and never resolves.
+fn is_capture_only(descriptor: &ProviderDescriptor) -> bool {
+    descriptor.captures().is_some() && descriptor.resolves().is_none()
+}
+
+/// Each descriptor's sources after its `sources` narrowing, rejecting a list
+/// that names an undeclared source or keeps none, and a capture-only
+/// provider that has no list.
+fn narrowed_sources<'a>(
+    descriptors: &'a [ProviderDescriptor],
+    identity: &IdentitySettings,
+) -> Result<BTreeMap<&'a str, Vec<SourceDomain>>, Report<TrustedServerError>> {
+    let mut narrowed = BTreeMap::new();
+    for descriptor in descriptors {
+        let id = descriptor.id().as_str();
+        let listed = identity
+            .providers
+            .get(id)
+            .and_then(|table| table.sources.as_ref());
+        let Some(listed) = listed else {
+            if is_capture_only(descriptor) {
+                return Err(catalog_error(format!(
+                    "provider `{id}` is capture-only, so ec.identity.providers.{id}.sources must \
+                     list the sources it is the delivery path for"
+                )));
+            }
+            narrowed.insert(id, descriptor.sources().to_vec());
+            continue;
+        };
+        let mut kept = Vec::with_capacity(listed.len());
+        for name in listed {
+            let declared = name
+                .parse::<SourceDomain>()
+                .ok()
+                .filter(|source| descriptor.sources().contains(source));
+            let Some(source) = declared else {
+                return Err(catalog_error(format!(
+                    "ec.identity.providers.{id}.sources names `{name}`, which provider `{id}` does not declare"
+                )));
+            };
+            kept.push(source);
+        }
+        if kept.is_empty() {
+            return Err(catalog_error(format!(
+                "ec.identity.providers.{id}.sources narrows provider `{id}` to no source"
+            )));
+        }
+        narrowed.insert(id, kept);
+    }
+    Ok(narrowed)
+}
+
+/// The ownership rules of spec 10.2, on narrowed sources.
+fn validate_source_ownership(
+    descriptors: &[ProviderDescriptor],
+    partners: &[EcPartner],
+    identity: &IdentitySettings,
+) -> Result<(), Report<TrustedServerError>> {
+    let narrowed = narrowed_sources(descriptors, identity)?;
+
+    // A partner whose source does not parse is reported by partner validation.
+    let partner_sources: BTreeMap<SourceDomain, Option<&str>> = partners
+        .iter()
+        .filter_map(|partner| {
+            Some((
+                partner.source_domain.parse().ok()?,
+                partner.owner.as_deref(),
+            ))
+        })
+        .collect();
+
+    for descriptor in descriptors {
+        let id = descriptor.id().as_str();
+        for source in &narrowed[id] {
+            if !partner_sources.contains_key(source) {
+                return Err(catalog_error(format!(
+                    "identity provider `{id}` claims source `{source}`, which has no [[ec.partners]] entry"
+                )));
+            }
+        }
+    }
+
+    for (source, owner) in &partner_sources {
+        let Some(owner) = owner else {
+            continue;
+        };
+        let Some(descriptor) = descriptors
+            .iter()
+            .find(|descriptor| descriptor.id().as_str() == *owner)
+        else {
+            return Err(catalog_error(format!(
+                "ec.partners source `{source}` names owner `{owner}`, which is not an enabled identity provider"
+            )));
+        };
+        if is_capture_only(descriptor) {
+            return Err(catalog_error(format!(
+                "ec.partners source `{source}` names owner `{owner}`, which is capture-only; \
+                 a capture-only provider stores no positive ID and cannot own a source"
+            )));
+        }
+        if !narrowed[*owner].contains(source) {
+            return Err(catalog_error(format!(
+                "ec.partners source `{source}` names owner `{owner}`, which does not claim that source"
+            )));
+        }
+        let other = descriptors
+            .iter()
+            .map(|other| other.id().as_str())
+            .find(|other| other != owner && narrowed[*other].contains(source));
+        if let Some(other) = other {
+            return Err(catalog_error(format!(
+                "identity provider `{other}` claims source `{source}`, which `{owner}` owns; \
+                 use ec.identity.providers.{other}.sources to narrow one of them"
+            )));
+        }
+    }
+    Ok(())
+}
+
+/// Enabled providers, their narrowed sources and source owners. Built once
+/// per settings load.
+#[derive(Clone)]
+pub(crate) struct ProviderCatalog {
+    providers: BTreeMap<IdentityProviderId, Arc<dyn IdentityProvider>>,
+    sources: BTreeMap<IdentityProviderId, Vec<SourceDomain>>,
+    owners: BTreeMap<SourceDomain, IdentityProviderId>,
+}
+
+impl ProviderCatalog {
+    /// Builds the catalog from settings, without resolving any secret.
+    ///
+    /// It reads `settings.ec.partners` directly and never builds a
+    /// `PartnerRegistry`, so a deploy-time `api_token` that holds a secret
+    /// store key name is fine. It holds the generic pull providers, then
+    /// the `registered` providers integrations contributed, with each
+    /// source owner from `[[ec.partners]].owner`. It validates every descriptor with
+    /// [`validate_identity_catalog`] before building, so a duplicate ID is
+    /// reported by that one validator.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when a pull partner
+    /// cannot be described or the catalog rules fail.
+    pub(crate) fn from_settings(
+        settings: &Settings,
+        registered: &[Arc<dyn IdentityProvider>],
+    ) -> Result<Self, Report<TrustedServerError>> {
+        let mut providers = settings
+            .ec
+            .partners
+            .iter()
+            .filter(|partner| partner.pull_sync_enabled)
+            .map(|partner| {
+                GenericPullProvider::from_partner(partner)
+                    .map(|provider| Arc::new(provider) as Arc<dyn IdentityProvider>)
+                    .change_context(TrustedServerError::Configuration {
+                        message: format!(
+                            "ec.partners: pull sync of '{}' cannot be described as an identity provider",
+                            partner.source_domain
+                        ),
+                    })
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        providers.extend(registered.iter().cloned());
+        let descriptors: Vec<_> = providers
+            .iter()
+            .map(|provider| provider.descriptor().clone())
+            .collect();
+        validate_identity_catalog(&descriptors, &settings.ec.partners, &settings.ec.identity)?;
+        let owners = settings
+            .ec
+            .partners
+            .iter()
+            .filter_map(|partner| {
+                let owner = partner.owner.as_deref()?;
+                Some((partner.source_domain.parse().ok()?, owner.parse().ok()?))
+            })
+            .collect();
+        Ok(Self::new(providers, owners))
+    }
+
+    /// A catalog with no providers.
+    #[must_use]
+    pub(crate) fn empty() -> Self {
+        Self::new(Vec::new(), BTreeMap::new())
+    }
+
+    /// Builds the catalog. Validation (ownership, duplicates) happens in
+    /// config validation before this is called.
+    #[must_use]
+    pub(crate) fn new(
+        providers: Vec<Arc<dyn IdentityProvider>>,
+        owners: BTreeMap<SourceDomain, IdentityProviderId>,
+    ) -> Self {
+        let providers: BTreeMap<_, _> = providers
+            .into_iter()
+            .map(|provider| (provider.descriptor().id().clone(), provider))
+            .collect();
+        let sources = providers
+            .iter()
+            .map(|(id, provider)| (id.clone(), provider.descriptor().sources().to_vec()))
+            .collect();
+        Self {
+            providers,
+            sources,
+            owners,
+        }
+    }
+
+    /// Narrows providers to the listed sources their descriptors declare
+    /// (spec 10.1). Config validation has rejected a source a descriptor
+    /// does not declare and a narrowing to nothing.
+    #[must_use]
+    pub(crate) fn with_narrowing(
+        mut self,
+        narrowing: BTreeMap<IdentityProviderId, Vec<SourceDomain>>,
+    ) -> Self {
+        for (id, listed) in narrowing {
+            if let Some(sources) = self.sources.get_mut(&id) {
+                sources.retain(|source| listed.contains(source));
+            }
+        }
+        self
+    }
+
+    /// A provider by ID.
+    #[must_use]
+    pub(crate) fn get(&self, id: &IdentityProviderId) -> Option<&Arc<dyn IdentityProvider>> {
+        self.providers.get(id)
+    }
+
+    /// Every provider, ordered by ID.
+    pub(crate) fn providers(&self) -> impl Iterator<Item = &Arc<dyn IdentityProvider>> {
+        self.providers.values()
+    }
+
+    /// Whether `id` is an enabled provider.
+    #[must_use]
+    pub(crate) fn is_configured(&self, id: &IdentityProviderId) -> bool {
+        self.providers.contains_key(id)
+    }
+
+    /// The owner of `source`, if any.
+    #[must_use]
+    pub(crate) fn owner_of(&self, source: &SourceDomain) -> Option<&IdentityProviderId> {
+        self.owners.get(source)
+    }
+
+    /// A provider's sources after narrowing. Empty for an unknown provider.
+    #[must_use]
+    pub(crate) fn sources_of(&self, id: &IdentityProviderId) -> &[SourceDomain] {
+        self.sources.get(id).map_or(&[], Vec::as_slice)
+    }
+
+    /// Every provider that claims `source` after narrowing, ordered by ID.
+    pub(crate) fn claimants<'a>(
+        &'a self,
+        source: &'a SourceDomain,
+    ) -> impl Iterator<Item = &'a IdentityProviderId> {
+        self.sources
+            .iter()
+            .filter(move |(_, sources)| sources.contains(source))
+            .map(|(id, _)| id)
+    }
+
+    /// Whether `id` captures and never resolves.
+    #[must_use]
+    pub(crate) fn is_capture_only(&self, id: &IdentityProviderId) -> bool {
+        self.get(id).is_some_and(|provider| {
+            let descriptor = provider.descriptor();
+            descriptor.captures().is_some() && descriptor.resolves().is_none()
+        })
+    }
+
+    /// The narrowed sources of a capture-only provider. Empty for any other.
+    #[must_use]
+    pub(crate) fn capture_only_sources(&self, id: &IdentityProviderId) -> &[SourceDomain] {
+        if self.is_capture_only(id) {
+            self.sources_of(id)
+        } else {
+            &[]
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ec::identity::descriptor::{Captures, Resolves};
+    use crate::ec::identity::examples::{ExampleIdProvider, example_config};
+    use crate::ec::identity::generic_pull::generic_pull_descriptors;
+    use crate::ec::identity::test_support::{ec_partner, fixed_capture_provider, resolver_policy};
+    use crate::settings::{ProviderSettings, RevokeScope};
+    use crate::test_support::tests::create_test_settings;
+
+    const TOKEN: &str = "example-token-value-0123456789abcdef";
+
+    fn partner() -> EcPartner {
+        ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            TOKEN,
+        )
+    }
+
+    fn owned_partner(source: &str, owner: Option<&str>) -> EcPartner {
+        // The interpolated suffix is a reserved fixture domain.
+        let mut partner = ec_partner(source, &format!("https://sync.{source}/pull"), TOKEN); // allow-domain: sync
+        partner.pull_sync_enabled = false;
+        partner.owner = owner.map(ToOwned::to_owned);
+        partner
+    }
+
+    fn resolving_descriptor(id: &str, sources: &[&str]) -> ProviderDescriptor {
+        let mut builder = ProviderDescriptor::builder(id.parse().expect("should parse the ID"))
+            .with_resolves(Resolves::new().with_endpoint("https://api.example.com/fetch"))
+            .with_consent_policy(resolver_policy());
+        for source in sources {
+            builder = builder.with_source(source.parse().expect("should parse the source"));
+        }
+        builder.build().expect("should build the descriptor")
+    }
+
+    fn capture_descriptor(id: &str, sources: &[&str]) -> ProviderDescriptor {
+        fixed_capture_provider(id, sources).descriptor().clone()
+    }
+
+    fn listing(sources: &[&str]) -> ProviderSettings {
+        ProviderSettings {
+            sources: Some(sources.iter().map(|source| (*source).to_owned()).collect()),
+            ..ProviderSettings::default()
+        }
+    }
+
+    fn identity_tables(tables: Vec<(&str, ProviderSettings)>) -> IdentitySettings {
+        let mut identity = IdentitySettings::default();
+        for (id, settings) in tables {
+            identity.providers.insert(id.to_owned(), settings);
+        }
+        identity
+    }
+
+    fn validate_with(
+        descriptors: &[ProviderDescriptor],
+        partners: &[EcPartner],
+        identity: &IdentitySettings,
+    ) -> Result<(), String> {
+        validate_identity_catalog(descriptors, partners, identity).map_err(|e| format!("{e}"))
+    }
+
+    fn identity_with(id: &str, settings: ProviderSettings) -> IdentitySettings {
+        let mut identity = IdentitySettings::default();
+        identity.providers.insert(id.to_owned(), settings);
+        identity
+    }
+
+    fn validate(partners: &[EcPartner], identity: &IdentitySettings) -> Result<(), String> {
+        let descriptors = generic_pull_descriptors(partners).expect("should describe");
+        validate_identity_catalog(&descriptors, partners, identity).map_err(|e| format!("{e:?}"))
+    }
+
+    #[test]
+    fn validate_identity_catalog_rejects_unknown_provider_tables() {
+        let partners = [partner()];
+
+        let error = validate(
+            &partners,
+            &identity_with("pull-other-example-com", ProviderSettings::default()),
+        )
+        .expect_err("should reject a table naming no provider");
+        assert!(
+            error.contains("pull-other-example-com") && error.contains("pull-ssp-example-com"),
+            "should name the table and list the configured IDs, got: {error}"
+        );
+
+        validate(
+            &partners,
+            &identity_with("pull-ssp-example-com", ProviderSettings::default()),
+        )
+        .expect("control: a table for the real pull ID should pass");
+    }
+
+    #[test]
+    fn validate_identity_catalog_rejects_revoke_scope_without_captures() {
+        let partners = [partner()];
+        let with_scope = ProviderSettings {
+            revoke_scope: Some(RevokeScope::Provider),
+            ..ProviderSettings::default()
+        };
+
+        validate(
+            &partners,
+            &identity_with("pull-ssp-example-com", with_scope.clone()),
+        )
+        .expect_err("should reject revoke_scope on a provider without captures");
+        validate(
+            &partners,
+            &identity_with("pull-ssp-example-com", ProviderSettings::default()),
+        )
+        .expect("control: the same table without revoke_scope should pass");
+
+        let capturing = fixed_capture_provider("capturer", &["capture.example.com"]);
+        assert!(
+            capturing
+                .descriptor()
+                .captures()
+                .is_some_and(|c| *c != Captures::new()),
+            "should hold a capturing descriptor for the control"
+        );
+        let capturing_scope = ProviderSettings {
+            sources: Some(vec!["capture.example.com".to_owned()]),
+            ..with_scope
+        };
+        validate_identity_catalog(
+            &[capturing.descriptor().clone()],
+            &[owned_partner("capture.example.com", None)],
+            &identity_with("capturer", capturing_scope),
+        )
+        .expect("control: revoke_scope on a capturing provider should pass");
+    }
+
+    #[test]
+    fn validate_identity_catalog_rejects_duplicate_ids_and_more_than_32_providers() {
+        let one = partner();
+        let descriptors =
+            generic_pull_descriptors(std::slice::from_ref(&one)).expect("should describe");
+        let duplicated = [descriptors[0].clone(), descriptors[0].clone()];
+        let _ = validate_identity_catalog(&duplicated, &[one], &IdentitySettings::default())
+            .expect_err("should reject a duplicate ID");
+
+        let many = |count: usize| -> Vec<EcPartner> {
+            (0..count)
+                .map(|n| {
+                    let source = format!("ssp{n}.example.com");
+                    // The interpolated suffix is a reserved fixture domain.
+                    ec_partner(&source, &format!("https://sync.{source}/pull"), TOKEN) // allow-domain: sync
+                })
+                .collect()
+        };
+        validate(&many(32), &IdentitySettings::default())
+            .expect("control: 32 providers should pass");
+        validate(&many(33), &IdentitySettings::default()).expect_err("should reject 33 providers");
+    }
+
+    #[test]
+    fn from_settings_builds_from_unresolved_settings() {
+        let mut settings = create_test_settings();
+        let mut unresolved = partner();
+        unresolved.api_token = Some(crate::redacted::Redacted::new("key-name".to_owned()));
+        settings.ec.partners = vec![unresolved];
+
+        assert!(
+            crate::ec::registry::PartnerRegistry::from_config(&settings.ec.partners).is_err(),
+            "should hold settings the registry rejects"
+        );
+        let catalog = ProviderCatalog::from_settings(&settings, &[]).expect("should build");
+
+        let id = "pull-ssp-example-com".parse().expect("should parse the ID");
+        assert!(catalog.is_configured(&id), "should hold the pull provider");
+        assert_eq!(catalog.sources_of(&id).len(), 1, "should claim its source");
+        assert!(
+            catalog
+                .owner_of(&"ssp.example.com".parse().expect("should parse"))
+                .is_none(),
+            "should have no owner for a partner that names none"
+        );
+    }
+
+    #[test]
+    fn registered_provider_with_a_generic_pull_id_is_rejected_by_the_shared_validator() {
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![partner()];
+
+        let duplicate = fixed_capture_provider("pull-ssp-example-com", &["other.example.com"]);
+        let error = ProviderCatalog::from_settings(&settings, &[duplicate])
+            .err()
+            .expect("should reject a registered ID that a pull partner already uses");
+        assert!(
+            format!("{error}")
+                .contains("identity provider `pull-ssp-example-com` is declared more than once"),
+            "should report the duplicate ID: {error}"
+        );
+
+        settings
+            .ec
+            .partners
+            .push(owned_partner("exampleid.example.com", None));
+        let registered =
+            ExampleIdProvider::new(&example_config()).expect("should build the example provider");
+        let catalog = ProviderCatalog::from_settings(&settings, &[Arc::new(registered)])
+            .expect("control: a distinct registered ID should build");
+        assert!(
+            catalog.is_configured(&"exampleid".parse().expect("should parse")),
+            "should hold the registered provider"
+        );
+        assert!(
+            catalog.is_configured(&"pull-ssp-example-com".parse().expect("should parse")),
+            "should keep the pull provider"
+        );
+    }
+
+    #[test]
+    fn owner_must_name_an_enabled_provider_that_declares_the_source() {
+        let descriptors = vec![resolving_descriptor(
+            "exampleid",
+            &["exampleid.example.com"],
+        )];
+        let ok = vec![owned_partner("exampleid.example.com", Some("exampleid"))];
+        validate_with(&descriptors, &ok, &IdentitySettings::default())
+            .expect("should accept an owner that declares the source");
+
+        let unknown = vec![owned_partner("exampleid.example.com", Some("missing"))];
+        let error = validate_with(&descriptors, &unknown, &IdentitySettings::default())
+            .expect_err("should reject an owner that is not enabled");
+        assert!(error.contains("missing"), "should name the owner: {error}");
+
+        let wrong_source = vec![
+            owned_partner("exampleid.example.com", None),
+            owned_partner("other.example.com", Some("exampleid")),
+        ];
+        let error = validate_with(&descriptors, &wrong_source, &IdentitySettings::default())
+            .expect_err("should reject an owner whose descriptor lacks the source");
+        assert!(
+            error.contains("other.example.com"),
+            "should name the source: {error}"
+        );
+    }
+
+    #[test]
+    fn owner_uses_the_narrowed_descriptor() {
+        let descriptors = vec![resolving_descriptor(
+            "exampleid",
+            &["a.example.com", "b.example.com"],
+        )];
+        let partners = vec![
+            owned_partner("a.example.com", Some("exampleid")),
+            owned_partner("b.example.com", None),
+        ];
+        validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("exampleid", listing(&["a.example.com"]))]),
+        )
+        .expect("control: an owner keeping its source should pass");
+
+        let error = validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("exampleid", listing(&["b.example.com"]))]),
+        )
+        .expect_err("should reject an owner narrowed away from its source");
+        assert!(
+            error.contains("a.example.com"),
+            "should name the source: {error}"
+        );
+    }
+
+    #[test]
+    fn provider_claiming_a_source_without_a_partner_entry_is_rejected() {
+        let descriptors = vec![resolving_descriptor(
+            "exampleid",
+            &["a.example.com", "b.example.com"],
+        )];
+        let partners = vec![owned_partner("a.example.com", None)];
+        let error = validate_with(&descriptors, &partners, &IdentitySettings::default())
+            .expect_err("should reject a claimed source with no partner entry");
+        assert!(
+            error.contains("b.example.com") && error.contains("exampleid"),
+            "should name the source and the provider: {error}"
+        );
+
+        validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("exampleid", listing(&["a.example.com"]))]),
+        )
+        .expect("control: narrowing to the declared partner should pass");
+        validate_with(
+            &descriptors,
+            &[
+                owned_partner("a.example.com", None),
+                owned_partner("b.example.com", None),
+            ],
+            &IdentitySettings::default(),
+        )
+        .expect("control: a partner entry per source should pass");
+    }
+
+    #[test]
+    fn two_providers_claiming_an_owned_source_are_rejected() {
+        let descriptors = vec![
+            resolving_descriptor("first", &["a.example.com"]),
+            resolving_descriptor("second", &["a.example.com", "b.example.com"]),
+        ];
+        let owned = vec![
+            owned_partner("a.example.com", Some("first")),
+            owned_partner("b.example.com", None),
+        ];
+        let error = validate_with(&descriptors, &owned, &IdentitySettings::default())
+            .expect_err("should reject a second claimant of an owned source");
+        assert!(
+            error.contains("a.example.com") && error.contains("second"),
+            "should name the source and the other claimant: {error}"
+        );
+
+        validate_with(
+            &descriptors,
+            &owned,
+            &identity_tables(vec![("second", listing(&["b.example.com"]))]),
+        )
+        .expect("control: narrowing the other claimant away should pass");
+
+        let unowned = vec![
+            owned_partner("a.example.com", None),
+            owned_partner("b.example.com", None),
+        ];
+        validate_with(&descriptors, &unowned, &IdentitySettings::default())
+            .expect("control: two claimants of an unowned source should pass");
+    }
+
+    #[test]
+    fn sources_must_name_declared_sources_and_not_narrow_to_nothing() {
+        let descriptors = vec![resolving_descriptor("exampleid", &["a.example.com"])];
+        let partners = vec![
+            owned_partner("a.example.com", None),
+            owned_partner("c.example.com", None),
+        ];
+        validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("exampleid", listing(&["a.example.com"]))]),
+        )
+        .expect("control: a declared source should pass");
+
+        let error = validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("exampleid", listing(&["c.example.com"]))]),
+        )
+        .expect_err("should reject an undeclared source");
+        assert!(
+            error.contains("c.example.com") && error.contains("exampleid"),
+            "should name the source and the provider: {error}"
+        );
+
+        let error = validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("exampleid", listing(&[]))]),
+        )
+        .expect_err("should reject narrowing to nothing");
+        assert!(
+            error.contains("exampleid") && error.contains("no source"),
+            "should name the provider: {error}"
+        );
+    }
+
+    #[test]
+    fn capture_only_provider_without_sources_is_rejected() {
+        let descriptors = vec![capture_descriptor("capturer", &["capture.example.com"])];
+        let partners = vec![owned_partner("capture.example.com", None)];
+        let error = validate_with(&descriptors, &partners, &IdentitySettings::default())
+            .expect_err("should reject a capture-only provider with no sources list");
+        assert!(
+            error.contains("capturer") && error.contains("sources"),
+            "should name the provider and the key: {error}"
+        );
+
+        validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("capturer", ProviderSettings::default())]),
+        )
+        .expect_err("should reject a provider table that lists no sources");
+
+        validate_with(
+            &descriptors,
+            &partners,
+            &identity_tables(vec![("capturer", listing(&["capture.example.com"]))]),
+        )
+        .expect("control: a sources list should pass");
+
+        let resolving = vec![resolving_descriptor("exampleid", &["capture.example.com"])];
+        validate_with(&resolving, &partners, &IdentitySettings::default())
+            .expect("control: a resolving provider needs no sources list");
+    }
+
+    #[test]
+    fn capture_only_provider_cannot_own_a_source() {
+        let descriptors = vec![capture_descriptor("capturer", &["capture.example.com"])];
+        let identity = identity_tables(vec![("capturer", listing(&["capture.example.com"]))]);
+        let owned = vec![owned_partner("capture.example.com", Some("capturer"))];
+        let error = validate_with(&descriptors, &owned, &identity)
+            .expect_err("should reject a capture-only owner");
+        assert!(
+            error.contains("capturer") && error.contains("capture-only"),
+            "should name the provider and the reason: {error}"
+        );
+
+        let unowned = vec![owned_partner("capture.example.com", None)];
+        validate_with(&descriptors, &unowned, &identity)
+            .expect("control: the same provider without ownership should pass");
+
+        let resolving = vec![resolving_descriptor("capturer", &["capture.example.com"])];
+        validate_with(&resolving, &owned, &IdentitySettings::default())
+            .expect("control: a resolving provider may own the source");
+    }
+
+    #[test]
+    fn from_settings_records_owners_from_partners() {
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![owned_partner("exampleid.example.com", Some("exampleid"))];
+        let registered =
+            ExampleIdProvider::new(&example_config()).expect("should build the example provider");
+        let catalog = ProviderCatalog::from_settings(&settings, &[Arc::new(registered)])
+            .expect("should build");
+
+        assert_eq!(
+            catalog.owner_of(&"exampleid.example.com".parse().expect("should parse")),
+            Some(&"exampleid".parse().expect("should parse the ID")),
+            "should record the partner's owner"
+        );
+        assert!(
+            catalog
+                .owner_of(&"other.example.com".parse().expect("should parse"))
+                .is_none(),
+            "control: an unowned source has no owner"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/coordinator.rs b/crates/trusted-server-core/src/ec/identity/coordinator.rs
new file mode 100644
index 0000000000..46bbb23a6e
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/coordinator.rs
@@ -0,0 +1,6980 @@
+//! Coordinator eligibility, dispatch and outcomes (spec 4.7 and 8).
+//!
+//! Which of a provider's sources need a call, how the calls are sent under
+//! the transport limits, and what stored changes a call's outcome becomes.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::time::Duration;
+
+use edgezero_core::body::Body as EdgeBody;
+use error_stack::Report;
+use http::{StatusCode, header};
+use web_time::Instant;
+
+use super::catalog::ProviderCatalog;
+use super::descriptor::{Input, ProviderDescriptor, ResolveKind, Resolves};
+use super::exchange::{ProviderRequest, ProviderResponse};
+use super::flush::{DispatchInput, DispatchRun, add_dispatch_results, may_flush, request_facts};
+use super::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use super::input::{
+    CaptureInput, ProviderConsent, RandomSource, ResolveInput, ResolveSignals, StoredId,
+    ThreadRandom,
+};
+use super::mutation::{
+    ApplyContext, IdentityMutation, PartnerIdChange, ProviderResult, ProviderStateChange,
+    StateUpdate, apply,
+};
+use super::policy::{
+    FP_PURPOSES, FP_TCF, FP_US_OPT_OUT_MASK, FP_VENDOR, PolicySignals, fingerprint_bits,
+    policy_allows,
+};
+use super::provider::IdentityProvider;
+use super::removal::{RemovalTiming, RemovalWriteOutcome, write_removals_counted};
+use super::resolution::{
+    EntrySet, EntrySets, IdentityProviderError, Resolution, ResolvedEid, StateChange, entry_sets,
+};
+use super::revision::{IdentityKeys, StateRevision, record_revision, uid_hash, visitor_key};
+use crate::consent::{ConsentContext, effective_tcf};
+use crate::ec::kv::KvIdentityGraph;
+use crate::ec::kv_types::{KvEid, KvEntry, KvOptOut, KvPartnerId};
+use crate::ec::rate_limiter::RateLimiter;
+use crate::ec::{EcContext, EcKvSnapshot, current_timestamp, log_id};
+use crate::platform::{
+    PlatformBackendSpec, PlatformHttpRequest, PlatformPendingRequest, PlatformResponse,
+    RuntimeServices,
+};
+use crate::settings::{IdentitySettings, ProviderMode, ProviderSettings, RevokeScope, Settings};
+use crate::streaming_processor::{BodyStreamDecoder, Compression};
+
+/// The longest connect timeout a hold call asks for: the adapters' default.
+const HOLD_CONNECT_TIMEOUT_CAP: Duration = Duration::from_secs(1);
+
+/// How long a burst-capped provider waits: one limiter window.
+const BURST_WAIT_SECS: u64 = 60;
+/// The wait after a `no_match` that gives no `retry_in`.
+const NO_MATCH_WAIT_SECS: u64 = 86_400;
+/// The longest `retry_in` the coordinator honours.
+const MAX_RETRY_SECS: u64 = 7 * 86_400;
+/// First wait after an input-caused failure.
+const INPUT_BACKOFF_BASE_SECS: u64 = 3_600;
+/// Longest wait after an input-caused failure.
+const INPUT_BACKOFF_CAP_SECS: u64 = 86_400;
+/// First wait after a transport failure.
+const TRANSPORT_BACKOFF_BASE_SECS: u64 = 300;
+/// Longest wait after a transport failure.
+const TRANSPORT_BACKOFF_CAP_SECS: u64 = 3_600;
+
+/// One provider's `ps` entry, as the request read it.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[derive(Debug, Clone, Default)]
+struct ProviderView {
+    n: Option<u64>,
+    f: u32,
+    o: Option<KvOptOut>,
+    oc: Option<u64>,
+    iv: Vec<String>,
+    ov: Vec<String>,
+    st: Option<serde_json::Value>,
+}
+
+/// What eligibility and outcomes read from the KV row the request read
+/// (spec 4.7), and nothing else. It never reads `ts-eids-s`: every removal is
+/// already in KV (spec 5.3).
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[derive(Debug, Clone, Default)]
+pub(crate) struct EligibilityView {
+    records: BTreeMap<SourceDomain, KvPartnerId>,
+    providers: BTreeMap<IdentityProviderId, ProviderView>,
+}
+
+impl EligibilityView {
+    /// The view of the row the request read. A key that is not a valid
+    /// source domain or provider ID cannot name a configured one and is
+    /// skipped.
+    #[must_use]
+    // Temporary: the request wiring, the first non-test caller, arrives in a later task.
+    #[allow(dead_code)]
+    pub(crate) fn from_kv(entry: &KvEntry) -> Self {
+        let records = entry
+            .ids
+            .iter()
+            .filter_map(|(source, record)| {
+                Some((source.parse::<SourceDomain>().ok()?, record.clone()))
+            })
+            .collect();
+        let providers = entry
+            .ps
+            .iter()
+            .filter_map(|(provider, state)| {
+                let view = ProviderView {
+                    n: state.n,
+                    f: state.f,
+                    o: state.o.clone(),
+                    oc: state.oc,
+                    iv: state.iv.clone(),
+                    ov: state.ov.clone(),
+                    st: state.st.clone(),
+                };
+                Some((provider.parse::<IdentityProviderId>().ok()?, view))
+            })
+            .collect();
+        Self { records, providers }
+    }
+
+    /// A view of a row with no records and no provider state.
+    #[must_use]
+    // Temporary: the request wiring, the first non-test caller, arrives in a later task.
+    #[allow(dead_code)]
+    pub(crate) fn empty() -> Self {
+        Self::default()
+    }
+
+    /// The whole record of `source`, if the row holds one.
+    #[must_use]
+    pub(crate) fn record(&self, source: &SourceDomain) -> Option<&KvPartnerId> {
+        self.records.get(source)
+    }
+
+    /// Every stored record.
+    pub(crate) fn records(&self) -> impl Iterator<Item = (&SourceDomain, &KvPartnerId)> {
+        self.records.iter()
+    }
+
+    /// The provider's consecutive failures, `f`.
+    #[must_use]
+    pub(crate) fn failures(&self, provider: &IdentityProviderId) -> u32 {
+        self.providers.get(provider).map_or(0, |view| view.f)
+    }
+
+    /// The provider's `n`: the earliest time it may be called.
+    #[must_use]
+    pub(crate) fn next_eligible(&self, provider: &IdentityProviderId) -> Option<u64> {
+        self.providers.get(provider).and_then(|view| view.n)
+    }
+
+    /// The provider's private state `st`, which a call reads.
+    #[must_use]
+    // Temporary: the request wiring, the first non-test caller, arrives in a later task.
+    #[allow(dead_code)]
+    pub(crate) fn state(&self, provider: &IdentityProviderId) -> Option<&serde_json::Value> {
+        self.providers
+            .get(provider)
+            .and_then(|view| view.st.as_ref())
+    }
+
+    /// Whether the provider's opt-out removed a UID with this hash, `ps.ov`.
+    #[must_use]
+    // Temporary: the request wiring, the first non-test caller, arrives in a later task.
+    #[allow(dead_code)]
+    pub(crate) fn has_opt_out_hash(&self, provider: &IdentityProviderId, hash: &str) -> bool {
+        self.providers
+            .get(provider)
+            .is_some_and(|view| view.ov.iter().any(|known| known == hash))
+    }
+
+    /// Whether the provider invalidated a UID with this hash, `ps.iv`.
+    fn has_invalidated_hash(&self, provider: &IdentityProviderId, hash: &str) -> bool {
+        self.providers
+            .get(provider)
+            .is_some_and(|view| view.iv.iter().any(|known| known == hash))
+    }
+
+    /// Whether `o` is set and no clear's watermark `oc` reaches `o.at`.
+    #[must_use]
+    pub(crate) fn is_opted_out(&self, provider: &IdentityProviderId) -> bool {
+        self.providers.get(provider).is_some_and(|view| {
+            view.o
+                .as_ref()
+                .is_some_and(|opt_out| view.oc.is_none_or(|clear| clear < opt_out.at))
+        })
+    }
+
+    #[cfg(test)]
+    fn provider_mut(&mut self, provider: &str) -> &mut ProviderView {
+        self.providers
+            .entry(provider.parse().expect("should parse the provider ID"))
+            .or_default()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_record_for_test(&mut self, source: &SourceDomain, record: KvPartnerId) {
+        self.records.insert(source.clone(), record);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_failures_for_test(&mut self, provider: &str, failures: u32) {
+        self.provider_mut(provider).f = failures;
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_next_for_test(&mut self, provider: &str, next: u64) {
+        self.provider_mut(provider).n = Some(next);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_invalidated_for_test(&mut self, provider: &str, hashes: Vec<String>) {
+        self.provider_mut(provider).iv = hashes;
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_opt_out_for_test(&mut self, provider: &str, at: u64, clear: Option<u64>) {
+        let view = self.provider_mut(provider);
+        view.o = Some(KvOptOut {
+            at,
+            fp: "0".to_owned(),
+        });
+        view.oc = clear;
+    }
+}
+
+/// What the request is, as eligibility reads it.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[derive(Debug, Clone)]
+pub(crate) struct RequestFacts {
+    /// The client looks like a real browser (step 1).
+    pub(crate) is_real_browser: bool,
+    /// Global consent allows EC and EID persistence (step 2).
+    pub(crate) ec_persistence_allowed: bool,
+    /// The signals the consent context does not carry (step 3).
+    pub(crate) policy_signals: PolicySignals,
+    /// This is the writer request, not a stager (step 7).
+    pub(crate) writer: bool,
+    /// This is a new visitor's first navigation (step 7).
+    pub(crate) new_visitor: bool,
+    /// The navigation runs an auction (step 7).
+    pub(crate) runs_auction: bool,
+    /// The request's time.
+    pub(crate) now: UnixTime,
+    /// The inputs this request can supply (step 4).
+    pub(crate) available_inputs: BTreeSet<Input>,
+}
+
+/// When a provider is dispatched, relative to the navigation response.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Phase {
+    /// Before the auction, within the hold budget.
+    Hold,
+    /// After the response is sent.
+    AfterSend,
+}
+
+/// Why a provider was not eligible. Each variant names the step of spec 4.7
+/// that stopped it. The breaker (step 6) and the burst cap (step 8) are
+/// checked in [`dispatch`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum SkipReason {
+    /// The provider declares no `resolves`, so it never makes a call.
+    NotAResolver,
+    /// Step 1: the client does not look like a real browser.
+    NotRealBrowser,
+    /// Step 2: global consent does not allow EID persistence.
+    EcPersistenceNotAllowed,
+    /// Step 3: the provider's consent policy is not met.
+    ConsentPolicy,
+    /// Step 4: no source needs a call this time.
+    NoSourceDue,
+    /// Step 5: `ps.n` has not passed.
+    NotYetEligible,
+    /// Step 5: the visitor opted out of the provider.
+    OptedOut,
+    /// Step 7: this is a new visitor's first navigation.
+    NewVisitor,
+    /// Step 7: this request is a stager.
+    NotWriter,
+    /// Step 7: the provider's mode runs it in the other phase.
+    WrongPhase,
+}
+
+/// Whether a provider is eligible.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum Eligibility {
+    /// It is, for these sources.
+    Eligible {
+        kinds: BTreeMap<SourceDomain, ResolveKind>,
+    },
+    /// It is not.
+    Skip(SkipReason),
+}
+
+/// What [`eligibility`] reads about one provider.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+pub(crate) struct EligibilityInput<'a> {
+    pub(crate) provider: &'a dyn IdentityProvider,
+    pub(crate) settings: &'a ProviderSettings,
+    pub(crate) identity: &'a IdentitySettings,
+    pub(crate) catalog: &'a ProviderCatalog,
+    pub(crate) consent: &'a ConsentContext,
+}
+
+/// Whether the provider is eligible for this request, steps 1 to 7 of spec
+/// 4.7 in order, and which sources need which kind of call.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[must_use]
+pub(crate) fn eligibility(
+    input: &EligibilityInput<'_>,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+    phase: Phase,
+) -> Eligibility {
+    let descriptor = input.provider.descriptor();
+    let id = descriptor.id();
+    if descriptor.resolves().is_none() {
+        return Eligibility::Skip(SkipReason::NotAResolver);
+    }
+    if !facts.is_real_browser {
+        return Eligibility::Skip(SkipReason::NotRealBrowser);
+    }
+    if !facts.ec_persistence_allowed {
+        return Eligibility::Skip(SkipReason::EcPersistenceNotAllowed);
+    }
+    if !policy_allows(
+        descriptor.consent_policy(),
+        input.consent,
+        facts.policy_signals,
+    ) {
+        return Eligibility::Skip(SkipReason::ConsentPolicy);
+    }
+    let kinds = source_kinds(input, view, facts);
+    if kinds.is_empty() {
+        log::debug!("Skipping identity provider '{id}': no source needs a call");
+        return Eligibility::Skip(SkipReason::NoSourceDue);
+    }
+    if view
+        .next_eligible(id)
+        .is_some_and(|next| facts.now.as_secs() < next)
+    {
+        return Eligibility::Skip(SkipReason::NotYetEligible);
+    }
+    if view.is_opted_out(id) {
+        return Eligibility::Skip(SkipReason::OptedOut);
+    }
+    if facts.new_visitor {
+        return Eligibility::Skip(SkipReason::NewVisitor);
+    }
+    if !facts.writer {
+        return Eligibility::Skip(SkipReason::NotWriter);
+    }
+    let runs_in_phase = match (phase, input.settings.mode) {
+        (Phase::Hold, ProviderMode::Hold) => facts.runs_auction,
+        (Phase::AfterSend, ProviderMode::AfterSend) => true,
+        (Phase::AfterSend, ProviderMode::Hold) => !facts.runs_auction,
+        (Phase::Hold, ProviderMode::AfterSend) => false,
+    };
+    if !runs_in_phase {
+        return Eligibility::Skip(SkipReason::WrongPhase);
+    }
+    Eligibility::Eligible { kinds }
+}
+
+/// Step 4: the kind each claimed source needs, leaving out a source whose
+/// kind the provider does not list or whose needs the request cannot meet.
+fn source_kinds(
+    input: &EligibilityInput<'_>,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+) -> BTreeMap<SourceDomain, ResolveKind> {
+    let descriptor = input.provider.descriptor();
+    let Some(resolves) = descriptor.resolves() else {
+        return BTreeMap::new();
+    };
+    input
+        .catalog
+        .sources_of(descriptor.id())
+        .iter()
+        .filter_map(|source| {
+            let kind = source_kind(input, view, facts, source)?;
+            let listed = resolves.kinds().contains(&kind);
+            let met = resolves.needs(kind).is_subset(&facts.available_inputs);
+            (listed && met).then(|| (source.clone(), kind))
+        })
+        .collect()
+}
+
+fn source_kind(
+    input: &EligibilityInput<'_>,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+    source: &SourceDomain,
+) -> Option<ResolveKind> {
+    let id = input.provider.descriptor().id();
+    let record = view.record(source);
+    match input.catalog.owner_of(source) {
+        Some(owner) if owner == id => match record {
+            None => Some(ResolveKind::Initial),
+            Some(record) => {
+                owned_record_is_due(input, view, facts, record).then_some(ResolveKind::Refresh)
+            }
+        },
+        // Config validation lets one provider own a source, so another
+        // owner means this provider may not resolve it.
+        Some(_) => None,
+        None => {
+            let present =
+                record.is_some_and(|record| has_unexpired_id(input.catalog, record, facts.now));
+            (!present).then_some(ResolveKind::Initial)
+        }
+    }
+}
+
+/// Whether a stored record of an owned source is due (spec 4.7 step 4).
+fn owned_record_is_due(
+    input: &EligibilityInput<'_>,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+    record: &KvPartnerId,
+) -> bool {
+    let id = input.provider.descriptor().id();
+    let now = facts.now.as_secs();
+    let invalidated = record.w.is_none()
+        && record
+            .eids
+            .iter()
+            .flat_map(|entry| &entry.uids)
+            .any(|uid| view.has_invalidated_hash(id, &uid_hash(&uid.id)));
+    if invalidated {
+        return false;
+    }
+    if record.exp.is_some_and(|exp| now >= exp) || record.w.as_deref() != Some(id.as_str()) {
+        return true;
+    }
+    match record.ra {
+        Some(refresh_at) => now >= refresh_at,
+        None => record.at.is_none_or(|acquired| {
+            acquired.saturating_add(input.settings.refresh_after_sec) <= now
+        }),
+    }
+}
+
+/// Whether KV holds an unexpired ID in this record for an unowned source. A
+/// record hidden only by consent or an opt-out still counts: `FillMissing`
+/// would not replace it.
+fn has_unexpired_id(catalog: &ProviderCatalog, record: &KvPartnerId, now: UnixTime) -> bool {
+    if record.eids.is_empty() || record.exp.is_some_and(|exp| now.as_secs() >= exp) {
+        return false;
+    }
+    record.w.as_deref().is_none_or(|writer| {
+        writer
+            .parse::<IdentityProviderId>()
+            .is_ok_and(|writer| catalog.is_configured(&writer))
+    })
+}
+
+/// What one provider call came to.
+#[derive(Debug)]
+pub(crate) enum CallOutcome {
+    /// The provider returned a resolution.
+    Resolved(Resolution),
+    /// `request` returned `None`.
+    Skipped,
+    /// A declared input was unavailable.
+    InputUnavailable,
+    /// The stored state did not decode, and the resolution the provider
+    /// still returned, if any.
+    InvalidState(Option<Resolution>),
+    /// The hold budget ran out before the answer.
+    HoldCutOff,
+    /// The call failed because of this visitor's input (a 4xx other than 429,
+    /// `Config`, `UndeclaredInput` or `Malformed`).
+    InputFailure,
+    /// A transport failure, timeout, 429 or 5xx.
+    TransportFailure,
+    /// The circuit breaker was open, so nothing was sent.
+    BreakerOpen,
+    /// The burst cap stopped the call.
+    BurstCapped,
+    /// A limiter error meant nothing was sent.
+    NotDispatched,
+    /// The request's backend budget had no room, so nothing was sent.
+    OverBackendBudget,
+}
+
+impl CallOutcome {
+    /// Whether the call produced a positive answer: a resolution that carries
+    /// at least one ID.
+    #[must_use]
+    pub(crate) fn is_found(&self) -> bool {
+        matches!(
+            self,
+            Self::Resolved(resolution) | Self::InvalidState(Some(resolution))
+                if !resolution.eids().is_empty()
+        )
+    }
+}
+
+/// What an outcome needs besides the provider and the view.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+pub(crate) struct OutcomeContext<'a> {
+    pub(crate) now: UnixTime,
+    pub(crate) catalog: &'a ProviderCatalog,
+    pub(crate) settings: &'a ProviderSettings,
+    pub(crate) identity: &'a IdentitySettings,
+    /// The state revision the call read, for a provider with private state.
+    pub(crate) expected_state: Option<StateRevision>,
+    /// The consent bits an opt-out records, from [`super::policy::fingerprint_bits`].
+    pub(crate) fingerprint: &'a str,
+}
+
+/// The stored changes of one outcome.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct OutcomeChanges {
+    /// Every removal, and the positive changes of a provider without private
+    /// state.
+    pub(crate) changes: Vec<PartnerIdChange>,
+    /// The positive changes, state change, `n` and `f` of a provider with
+    /// private state. They apply as one unit.
+    pub(crate) result: Option<ProviderResult>,
+    /// `n` and `f` of a provider without a result.
+    pub(crate) state: ProviderStateChange,
+}
+
+/// The stored changes of an outcome: the table of spec 8, row by row.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[must_use]
+pub(crate) fn outcome_to_changes(
+    provider: &dyn IdentityProvider,
+    outcome: CallOutcome,
+    view: &EligibilityView,
+    context: &OutcomeContext<'_>,
+) -> OutcomeChanges {
+    let id = provider.descriptor().id();
+    let now = context.now.as_secs();
+    match outcome {
+        CallOutcome::Resolved(resolution) => resolved_changes(provider, &resolution, view, context),
+        CallOutcome::Skipped | CallOutcome::InputUnavailable => {
+            wait_until(now.saturating_add(context.settings.refresh_after_sec))
+        }
+        CallOutcome::InvalidState(resolution) => {
+            let mut changes = resolution.map_or_else(OutcomeChanges::default, |resolution| {
+                resolved_changes(provider, &resolution, view, context)
+            });
+            let slot = state_slot(&mut changes);
+            slot.st = StateUpdate::Clear;
+            slot.f = None;
+            if slot.n.is_none() {
+                slot.n = Some(now.saturating_add(context.settings.refresh_after_sec));
+            }
+            changes
+        }
+        CallOutcome::HoldCutOff => wait_until(now.saturating_add(context.identity.hold_retry_sec)),
+        CallOutcome::InputFailure => failure(
+            view.failures(id),
+            now,
+            INPUT_BACKOFF_BASE_SECS,
+            INPUT_BACKOFF_CAP_SECS,
+        ),
+        CallOutcome::TransportFailure => failure(
+            view.failures(id),
+            now,
+            TRANSPORT_BACKOFF_BASE_SECS,
+            TRANSPORT_BACKOFF_CAP_SECS,
+        ),
+        CallOutcome::BurstCapped => wait_until(now.saturating_add(BURST_WAIT_SECS)),
+        CallOutcome::BreakerOpen | CallOutcome::NotDispatched | CallOutcome::OverBackendBudget => {
+            OutcomeChanges::default()
+        }
+    }
+}
+
+/// The state change the outcome's `st`, `n` and `f` belong to: the result's
+/// when there is one, the stand-alone one otherwise.
+fn state_slot(changes: &mut OutcomeChanges) -> &mut ProviderStateChange {
+    match changes.result.as_mut() {
+        Some(result) => &mut result.state,
+        None => &mut changes.state,
+    }
+}
+
+fn wait_until(next: u64) -> OutcomeChanges {
+    OutcomeChanges {
+        state: ProviderStateChange {
+            n: Some(next),
+            ..ProviderStateChange::default()
+        },
+        ..OutcomeChanges::default()
+    }
+}
+
+/// `base × 2^(failures-1)`, at most `cap`, in seconds.
+fn backoff_secs(failures: u32, base: u64, cap: u64) -> u64 {
+    base.saturating_mul(2_u64.saturating_pow(failures.saturating_sub(1)))
+        .min(cap)
+}
+
+fn failure(failures_before: u32, now: u64, base: u64, cap: u64) -> OutcomeChanges {
+    let failures = failures_before.saturating_add(1);
+    OutcomeChanges {
+        state: ProviderStateChange {
+            n: Some(now.saturating_add(backoff_secs(failures, base, cap))),
+            f: Some(failures),
+            ..ProviderStateChange::default()
+        },
+        ..OutcomeChanges::default()
+    }
+}
+
+/// Whether the provider declares private state.
+fn keeps_private_state(descriptor: &ProviderDescriptor) -> bool {
+    descriptor
+        .resolves()
+        .is_some_and(Resolves::has_private_state)
+}
+
+/// How `Resolved(resolution)` becomes changes (spec 4.5 and 8).
+fn resolved_changes(
+    provider: &dyn IdentityProvider,
+    resolution: &Resolution,
+    view: &EligibilityView,
+    context: &OutcomeContext<'_>,
+) -> OutcomeChanges {
+    let descriptor = provider.descriptor();
+    let id = descriptor.id();
+    let now = context.now.as_secs();
+    let stateful = keeps_private_state(descriptor);
+
+    let (kept, dropped_unclaimed) = drop_unclaimed(id, resolution.eids(), context.catalog);
+    let mut sets = entry_sets(&kept, context.now);
+    log_entry_sets(id, &sets);
+    let discarded = discarded_sets(descriptor, &mut sets, view);
+    let malformed = resolution.state_rejected()
+        || reject_positive_part(stateful, &discarded)
+        || all_sets_discarded(&sets, &discarded, dropped_unclaimed);
+    if malformed {
+        log::warn!("Identity provider '{id}' returned a result the coordinator rejects");
+    }
+
+    let positive = if malformed {
+        Vec::new()
+    } else {
+        positive_changes(provider, &sets, &discarded, view, context)
+    };
+    let mut removals = invalidations(id, resolution, view, context.catalog);
+    let removed_any = !removals.is_empty();
+    let mut state = ProviderStateChange::default();
+    if resolution.is_opted_out() {
+        removals.extend(opt_out_removals(id, view, context.catalog));
+        state.opt_out = Some(KvOptOut {
+            at: now,
+            fp: context.fingerprint.to_owned(),
+        });
+        state.st = StateUpdate::Clear;
+    }
+
+    let mut next = None;
+    if malformed {
+        let failures = view.failures(id).saturating_add(1);
+        state.f = Some(failures);
+        next = Some(now.saturating_add(backoff_secs(
+            failures,
+            INPUT_BACKOFF_BASE_SECS,
+            INPUT_BACKOFF_CAP_SECS,
+        )));
+    } else {
+        if !resolution.eids().is_empty() {
+            state.f = Some(0);
+        }
+        if stateful && state.st == StateUpdate::Keep {
+            state.st = state_update(id, resolution);
+        }
+        if resolution.is_no_match() {
+            let wait = resolution
+                .retry_in()
+                .map_or(NO_MATCH_WAIT_SECS, |delay| delay.as_secs())
+                .min(MAX_RETRY_SECS);
+            next = Some(now.saturating_add(wait));
+        } else if removed_any {
+            next = Some(now);
+        }
+    }
+    if let Some(delay) = resolution.retry_in() {
+        let earliest = now.saturating_add(delay.as_secs().min(MAX_RETRY_SECS));
+        next = Some(next.map_or(earliest, |current| current.max(earliest)));
+    }
+    state.n = next;
+
+    if stateful && !malformed {
+        let result = (!positive.is_empty() || state != ProviderStateChange::default()).then(|| {
+            ProviderResult {
+                provider: id.clone(),
+                ids: positive,
+                state,
+                expected_state: context.expected_state.clone(),
+            }
+        });
+        return OutcomeChanges {
+            changes: removals,
+            result,
+            state: ProviderStateChange::default(),
+        };
+    }
+    removals.extend(positive);
+    OutcomeChanges {
+        changes: removals,
+        result: None,
+        state,
+    }
+}
+
+/// Step 1: drops the entries of sources the provider does not claim after
+/// narrowing. Logs each source with the provider ID only. Also reports
+/// whether it dropped anything, which step 5 needs.
+fn drop_unclaimed(
+    provider: &IdentityProviderId,
+    eids: &[ResolvedEid],
+    catalog: &ProviderCatalog,
+) -> (Vec<ResolvedEid>, bool) {
+    let claimed = catalog.sources_of(provider);
+    let mut dropped = false;
+    let kept = eids
+        .iter()
+        .filter(|eid| {
+            let keep = claimed.contains(eid.source());
+            if !keep {
+                dropped = true;
+                log::debug!(
+                    "Dropping an entry of identity provider '{provider}' for unclaimed source '{}'",
+                    eid.source()
+                );
+            }
+            keep
+        })
+        .cloned()
+        .collect();
+    (kept, dropped)
+}
+
+/// Step 2: logs each dropped part and oversized source, never a value.
+fn log_entry_sets(provider: &IdentityProviderId, sets: &EntrySets) {
+    for drop in &sets.drops {
+        log::debug!(
+            "Identity provider '{provider}' source '{}': dropped {}",
+            drop.source,
+            drop.part
+        );
+    }
+    for source in &sets.oversized {
+        log::warn!(
+            "Identity provider '{provider}' source '{source}': discarded an oversized entry set"
+        );
+    }
+}
+
+/// Step 3: the sources whose set is discarded. An oversized set is. A set of
+/// an expiring source that carries no expiry keeps the stored `exp` when its
+/// entries equal the stored `eids`, and is discarded otherwise.
+fn discarded_sets(
+    descriptor: &ProviderDescriptor,
+    sets: &mut EntrySets,
+    view: &EligibilityView,
+) -> BTreeSet<SourceDomain> {
+    let mut discarded: BTreeSet<SourceDomain> = sets.oversized.iter().cloned().collect();
+    for (source, set) in &mut sets.sets {
+        if !descriptor.is_expiring(source) || set.expires_at.is_some() {
+            continue;
+        }
+        let stored_exp = view
+            .record(source)
+            .filter(|record| record.eids == set.entries)
+            .and_then(|record| record.exp);
+        match stored_exp {
+            Some(exp) => set.expires_at = Some(UnixTime::from_secs(exp)),
+            None => {
+                log::warn!(
+                    "Identity provider '{}' source '{source}': discarded a set that carries no expiry",
+                    descriptor.id()
+                );
+                discarded.insert(source.clone());
+            }
+        }
+    }
+    discarded
+}
+
+/// Step 4: whether a discarded set rejects the whole positive part. It does
+/// for a provider with private state, whose IDs and state apply as a unit.
+fn reject_positive_part(stateful: bool, discarded: &BTreeSet<SourceDomain>) -> bool {
+    stateful && !discarded.is_empty()
+}
+
+/// Step 5: whether the result named a source and every set is discarded,
+/// including by dropping entries of unclaimed sources (spec 4.5).
+fn all_sets_discarded(
+    sets: &EntrySets,
+    discarded: &BTreeSet<SourceDomain>,
+    dropped_unclaimed: bool,
+) -> bool {
+    sets.all_discarded()
+        || (sets.sets.is_empty() && dropped_unclaimed)
+        || (!sets.sets.is_empty() && sets.sets.keys().all(|source| discarded.contains(source)))
+}
+
+/// Steps 6 to 8: each kept set becomes one record, written whole.
+fn positive_changes(
+    provider: &dyn IdentityProvider,
+    sets: &EntrySets,
+    discarded: &BTreeSet<SourceDomain>,
+    view: &EligibilityView,
+    context: &OutcomeContext<'_>,
+) -> Vec<PartnerIdChange> {
+    let descriptor = provider.descriptor();
+    let id = descriptor.id();
+    let stateful = keeps_private_state(descriptor);
+    sets.sets
+        .iter()
+        .filter(|(source, _)| !discarded.contains(*source))
+        .map(|(source, set)| {
+            if set.refresh_until.is_some() && !stateful {
+                log::warn!(
+                    "Identity provider '{id}' source '{source}': ignoring refresh_until without private state"
+                );
+            }
+            let record = record_of(id, set, stateful, context.now);
+            if context.catalog.owner_of(source) == Some(id) {
+                PartnerIdChange::OwnerWrite {
+                    source: source.clone(),
+                    record,
+                    expected: view.record(source).map(record_revision),
+                }
+            } else {
+                PartnerIdChange::FillMissing {
+                    source: source.clone(),
+                    record,
+                }
+            }
+        })
+        .collect()
+}
+
+fn record_of(
+    provider: &IdentityProviderId,
+    set: &EntrySet,
+    stateful: bool,
+    now: UnixTime,
+) -> KvPartnerId {
+    KvPartnerId {
+        w: Some(provider.to_string()),
+        rv: None,
+        at: Some(now.as_secs()),
+        exp: set.expires_at.map(UnixTime::as_secs),
+        ra: set.refresh_at.map(UnixTime::as_secs),
+        ru: stateful
+            .then_some(set.refresh_until)
+            .flatten()
+            .map(UnixTime::as_secs),
+        eids: set.entries.clone(),
+    }
+}
+
+/// Step 9: an `OwnerRemove` for each claimed source the result invalidated
+/// that has a record. It carries no hash: applying it hashes the live record.
+fn invalidations(
+    provider: &IdentityProviderId,
+    resolution: &Resolution,
+    view: &EligibilityView,
+    catalog: &ProviderCatalog,
+) -> Vec<PartnerIdChange> {
+    let claimed = catalog.sources_of(provider);
+    resolution
+        .invalidated()
+        .iter()
+        .filter_map(|source| {
+            if !claimed.contains(source) {
+                log::debug!(
+                    "Ignoring invalidation by identity provider '{provider}' of unclaimed source '{source}'"
+                );
+                return None;
+            }
+            Some(PartnerIdChange::OwnerRemove {
+                source: source.clone(),
+                provider: provider.clone(),
+                expected: record_revision(view.record(source)?),
+            })
+        })
+        .collect()
+}
+
+/// Step 10: a `WriterRemove` for every record this provider wrote, and for a
+/// capture-only provider every record of its sources that has no writer.
+fn opt_out_removals(
+    provider: &IdentityProviderId,
+    view: &EligibilityView,
+    catalog: &ProviderCatalog,
+) -> Vec<PartnerIdChange> {
+    let capture_only = catalog.capture_only_sources(provider);
+    view.records()
+        .filter(|(source, record)| match record.w.as_deref() {
+            Some(writer) => writer == provider.as_str(),
+            None => capture_only.contains(source),
+        })
+        .map(|(source, _)| PartnerIdChange::WriterRemove {
+            source: source.clone(),
+            writer: provider.clone(),
+        })
+        .collect()
+}
+
+/// The private-state change the resolution asks for.
+fn state_update(provider: &IdentityProviderId, resolution: &Resolution) -> StateUpdate {
+    match resolution.state_change() {
+        StateChange::Keep => StateUpdate::Keep,
+        StateChange::Clear => StateUpdate::Clear,
+        StateChange::Replace(json) => match serde_json::from_str(json) {
+            Ok(value) => StateUpdate::Replace(value),
+            Err(_) => {
+                log::warn!("Identity provider '{provider}' returned state that is not JSON");
+                StateUpdate::Keep
+            }
+        },
+    }
+}
+
+/// Everything a dispatch reads that is not per call.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+pub(crate) struct IdentityDeps<'a> {
+    pub(crate) settings: &'a Settings,
+    pub(crate) catalog: &'a ProviderCatalog,
+    pub(crate) keys: &'a IdentityKeys,
+    /// Draws record revisions when a mutation applies.
+    // Temporary: first read when the mutations are applied.
+    #[allow(dead_code)]
+    pub(crate) random: &'a dyn RandomSource,
+    pub(crate) services: &'a RuntimeServices,
+    pub(crate) rate_limiter: Option<&'a dyn RateLimiter>,
+}
+
+/// One provider call to dispatch: the provider and the kind each of its
+/// sources needs.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+#[derive(Debug, Clone)]
+pub(crate) struct Call {
+    pub(crate) provider: IdentityProviderId,
+    pub(crate) kinds: BTreeMap<SourceDomain, ResolveKind>,
+    /// This provider's stored private state `ps.st`, as JSON. Only this
+    /// call's `ResolveInput` sees it.
+    pub(crate) state_json: Option<String>,
+}
+
+/// A call that was sent and is waiting for its answer.
+struct InFlightCall<'a> {
+    provider: &'a dyn IdentityProvider,
+    input: ResolveInput<'a>,
+    call_context: Option<String>,
+    /// When the request was sent.
+    sent_at: Instant,
+    /// How long the backend waits for the first byte.
+    timeout: Duration,
+    /// The remaining hold budget, not the provider's `timeout_ms`, set the
+    /// timeout.
+    budget_limited: bool,
+}
+
+/// What preparing one call came to.
+enum Prepared<'a> {
+    /// The call is settled without being sent.
+    Settled(CallOutcome),
+    /// The call was sent.
+    Sent(Box<InFlightCall<'a>>, PlatformPendingRequest),
+}
+
+/// Whether the provider is a generic pull provider, the only kind given the
+/// full EC ID.
+fn is_generic_pull(provider: &dyn IdentityProvider) -> bool {
+    provider
+        .descriptor()
+        .resolves()
+        .is_some_and(Resolves::gets_ec_id)
+}
+
+/// The order calls are dispatched in. Generic pull providers keep the
+/// fairness rule of spec 10.4: sorted by source domain, then rotated left by
+/// `(now / 3600) % len`, so the starting partner changes each hour when
+/// `max_concurrency` limits a batch. Every other provider follows, by ID.
+fn dispatch_order(calls: Vec<Call>, catalog: &ProviderCatalog, now: UnixTime) -> Vec<Call> {
+    let (mut generic, mut others): (Vec<Call>, Vec<Call>) = calls.into_iter().partition(|call| {
+        catalog
+            .get(&call.provider)
+            .is_some_and(|provider| is_generic_pull(provider.as_ref()))
+    });
+    generic.sort_by(|left, right| {
+        let source = |call: &Call| {
+            catalog
+                .get(&call.provider)
+                .map(|provider| provider.descriptor().primary_source().clone())
+        };
+        source(left)
+            .cmp(&source(right))
+            .then_with(|| left.provider.cmp(&right.provider))
+    });
+    if !generic.is_empty() {
+        let hour = usize::try_from(now.as_secs() / 3600).unwrap_or(0);
+        let offset = hour % generic.len();
+        generic.rotate_left(offset);
+    }
+    others.sort_by(|left, right| left.provider.cmp(&right.provider));
+    generic.extend(others);
+    generic
+}
+
+/// Allows an `https` request to a declared host, with no `Cookie` header.
+///
+/// # Errors
+///
+/// [`IdentityProviderError::Config`] for any other request.
+pub(crate) fn check_request(
+    request: &ProviderRequest,
+    descriptor: &ProviderDescriptor,
+) -> Result<(), Report<IdentityProviderError>> {
+    if request.url().scheme() != "https" {
+        return Err(IdentityProviderError::config(
+            "a provider request must use https",
+        ));
+    }
+    let host = request.url().host_str().unwrap_or_default();
+    let declared = descriptor.resolves().is_some_and(|resolves| {
+        resolves
+            .hosts()
+            .iter()
+            .any(|allowed| allowed.eq_ignore_ascii_case(host))
+    });
+    if !declared {
+        return Err(IdentityProviderError::config(
+            "a provider request must go to a declared host",
+        ));
+    }
+    if request.has_cookie_header() {
+        return Err(IdentityProviderError::config(
+            "a provider request must not set a Cookie header",
+        ));
+    }
+    Ok(())
+}
+
+/// Decodes a response body to at most `cap` bytes: identity, `gzip` or `br`.
+///
+/// `None` when the decoded body is over `cap`, does not decode, or the
+/// encoding is unknown. The cap applies while decoding, so a small body
+/// cannot expand past it.
+pub(crate) fn decode_body(encoding: Option<&str>, body: Vec<u8>, cap: usize) -> Option<Vec<u8>> {
+    let compression = match encoding.map(str::trim) {
+        None | Some("") => Compression::None,
+        Some(name) if name.eq_ignore_ascii_case("identity") => Compression::None,
+        Some(name) if name.eq_ignore_ascii_case("gzip") => Compression::Gzip,
+        Some(name) if name.eq_ignore_ascii_case("br") => Compression::Brotli,
+        Some(_) => return None,
+    };
+    if compression == Compression::None {
+        return (body.len() <= cap).then_some(body);
+    }
+    let mut decoder = BodyStreamDecoder::new(compression, cap);
+    let mut decoded = decoder
+        .decode_chunk(bytes::Bytes::from(body))
+        .ok()?
+        .to_vec();
+    decoded.extend(decoder.finish().ok()?);
+    (decoded.len() <= cap).then_some(decoded)
+}
+
+/// Whether the response declares a body over `cap`, or an unreadable length.
+pub(crate) fn content_length_exceeds_limit(
+    response: &PlatformResponse,
+    cap: usize,
+    label: &str,
+) -> bool {
+    let Some(value) = response.response.headers().get(header::CONTENT_LENGTH) else {
+        return false;
+    };
+    let Some(length) = value
+        .to_str()
+        .ok()
+        .and_then(|value| value.parse::<usize>().ok())
+    else {
+        log::warn!("'{label}' returned an unreadable Content-Length header, rejecting");
+        return true;
+    };
+    if length > cap {
+        log::warn!("'{label}' returned an oversized Content-Length ({length} bytes), rejecting");
+        return true;
+    }
+    false
+}
+
+/// Buffers a response body of at most `cap` bytes, as sent (still encoded).
+/// `None` when the declared or actual length is over `cap`.
+pub(crate) fn buffered_body(
+    response: PlatformResponse,
+    cap: usize,
+    label: &str,
+) -> Option<(http::response::Parts, bytes::Bytes)> {
+    if content_length_exceeds_limit(&response, cap, label) {
+        return None;
+    }
+    let (parts, body) = response.response.into_parts();
+    let body = body.into_bytes().unwrap_or_default();
+    if body.len() > cap {
+        log::warn!(
+            "'{label}' returned an oversized response ({} bytes), rejecting",
+            body.len()
+        );
+        return None;
+    }
+    Some((parts, body))
+}
+
+/// What waiting for one in-flight request came to.
+pub(crate) enum Waited {
+    /// The response arrived.
+    Response(PlatformResponse),
+    /// The request failed or timed out.
+    Failed,
+    /// The caller stopped waiting, so the request was dropped.
+    Dropped,
+}
+
+/// Waits for each in-flight request in turn and empties `in_flight`. All were
+/// sent up front, so waiting in turn does not change concurrency.
+///
+/// `keep_waiting` is asked before each wait. Once it returns `false`, every
+/// request still pending is dropped without waiting.
+pub(crate) async fn drain_in_flight<T: core::fmt::Display>(
+    in_flight: &mut Vec<(T, PlatformPendingRequest)>,
+    services: &RuntimeServices,
+    mut keep_waiting: impl FnMut() -> bool,
+) -> Vec<(T, Waited)> {
+    let mut waiting = true;
+    let mut waited = Vec::with_capacity(in_flight.len());
+    for (label, pending) in in_flight.drain(..) {
+        waiting = waiting && keep_waiting();
+        if !waiting {
+            waited.push((label, Waited::Dropped));
+            continue;
+        }
+        match services.http_client().wait(pending).await {
+            Ok(response) => waited.push((label, Waited::Response(response))),
+            Err(error) => {
+                log::warn!("Request failed for '{label}': {error:?}");
+                waited.push((label, Waited::Failed));
+            }
+        }
+    }
+    waited
+}
+
+/// Logs a provider `Config` failure. Only the error's own context is logged,
+/// never its attachments.
+fn log_config(provider: &IdentityProviderId, error: &Report<IdentityProviderError>) {
+    log::error!(
+        "Identity provider '{provider}' configuration error: {}",
+        error.current_context()
+    );
+}
+
+/// The outcome a `request` error becomes.
+fn request_error_outcome(
+    provider: &IdentityProviderId,
+    error: &Report<IdentityProviderError>,
+) -> CallOutcome {
+    if matches!(
+        error.current_context(),
+        IdentityProviderError::InputUnavailable { .. }
+    ) {
+        return CallOutcome::InputUnavailable;
+    }
+    log_config(provider, error);
+    CallOutcome::InputFailure
+}
+
+/// The outcome a `response` error becomes.
+fn response_error_outcome(error: &Report<IdentityProviderError>) -> CallOutcome {
+    match error.current_context() {
+        IdentityProviderError::Rejected { status }
+            if *status == StatusCode::TOO_MANY_REQUESTS || status.is_server_error() =>
+        {
+            CallOutcome::TransportFailure
+        }
+        IdentityProviderError::InvalidState => CallOutcome::InvalidState(None),
+        _ => CallOutcome::InputFailure,
+    }
+}
+
+/// The first-byte timeout of a call, or `None` when a hold dispatch has no
+/// budget left.
+fn call_timeout(
+    deps: &IdentityDeps<'_>,
+    settings: &ProviderSettings,
+    remaining: Option<Duration>,
+) -> Option<(Duration, bool)> {
+    let policy = deps.services.backend().naming_policy();
+    let millis = |value: u64| u32::try_from(value).unwrap_or(u32::MAX);
+    let mut budget_limited = false;
+    let timeout_ms = match remaining {
+        None => {
+            let configured = millis(settings.after_send_timeout_ms);
+            policy.canonicalize_transport_timeout_ms(configured, configured)
+        }
+        Some(remaining) => {
+            let configured = millis(
+                settings
+                    .timeout_ms
+                    .unwrap_or(deps.settings.ec.identity.hold_budget_ms),
+            );
+            let remaining_ms = u32::try_from(remaining.as_millis()).unwrap_or(u32::MAX);
+            budget_limited = remaining_ms < configured;
+            policy.canonicalize_transport_timeout_ms(remaining_ms, configured)
+        }
+    };
+    (timeout_ms > 0).then(|| (Duration::from_millis(u64::from(timeout_ms)), budget_limited))
+}
+
+/// The limiter key counting a provider's transport failures.
+fn breaker_key(provider: &IdentityProviderId) -> String {
+    format!("identity-fail:{provider}")
+}
+
+/// Whether the provider's circuit breaker is open: its failure count in the
+/// last minute has reached `breaker_failures_per_minute`. A count that cannot
+/// be read leaves the breaker closed.
+fn breaker_open(
+    deps: &IdentityDeps<'_>,
+    provider: &IdentityProviderId,
+    settings: &ProviderSettings,
+) -> bool {
+    let Some(limiter) = deps.rate_limiter else {
+        return false;
+    };
+    match limiter.count(&breaker_key(provider)) {
+        Ok(count) => count >= settings.breaker_failures_per_minute,
+        Err(error) => {
+            log::warn!(
+                "Identity provider '{provider}' breaker count unreadable, treating it as closed: {}",
+                error.current_context()
+            );
+            false
+        }
+    }
+}
+
+/// Feeds a transport failure to the circuit breaker. Nothing else is
+/// recorded: a hold cut-off is a budget decision, and an input failure only
+/// backs off its own visitor. A limiter error is logged and the outcome kept.
+fn record_failure(deps: &IdentityDeps<'_>, provider: &IdentityProviderId, outcome: &CallOutcome) {
+    if !matches!(outcome, CallOutcome::TransportFailure) {
+        return;
+    }
+    let Some(limiter) = deps.rate_limiter else {
+        return;
+    };
+    if let Err(error) = limiter.record(&breaker_key(provider)) {
+        log::warn!(
+            "Identity provider '{provider}' failure not recorded for the breaker: {}",
+            error.current_context()
+        );
+    }
+}
+
+/// Whether one more call would pass `[ec.identity] max_backend_requests`.
+/// A hold call runs before the origin fetch may have started and before
+/// the auction, so it leaves room for the origin and one call per auction
+/// provider. An adapter that does not count its requests is not budgeted.
+fn over_backend_budget(deps: &IdentityDeps<'_>, hold: bool) -> bool {
+    let Some(started) = deps.services.http_client().requests_started() else {
+        return false;
+    };
+    let auction = &deps.settings.auction;
+    let reserved = if hold {
+        1 + if auction.enabled {
+            auction.providers.len()
+        } else {
+            0
+        }
+    } else {
+        0
+    };
+    started + reserved >= deps.settings.ec.identity.max_backend_requests
+}
+
+/// Whether the burst cap stops the call. `Err` when it could not be read.
+fn burst_capped(
+    deps: &IdentityDeps<'_>,
+    provider: &IdentityProviderId,
+    ec_id: Option<&str>,
+    settings: &ProviderSettings,
+) -> Result<bool, ()> {
+    let Some(limiter) = deps.rate_limiter else {
+        return Ok(false);
+    };
+    let Some(ec_id) = ec_id else {
+        log::debug!("Identity provider '{provider}' not dispatched: the request has no EC ID");
+        return Err(());
+    };
+    let key = format!("identity:{provider}:{}", visitor_key(deps.keys, ec_id));
+    limiter
+        .exceeded_per_minute(&key, settings.max_calls_per_minute)
+        .map_err(|error| {
+            log::warn!(
+                "Identity provider '{provider}' not dispatched, burst cap unreadable: {error:?}"
+            );
+        })
+}
+
+/// Whether the per-IP ceiling stops the call: `max_calls_per_ip_per_minute`
+/// calls to one provider from one client address, across every visitor
+/// behind it, so minting a fresh EC per request cannot multiply calls. The
+/// key holds a keyed hash of the address, never the address. `Err` when it
+/// could not be read. A request without a client IP, or a ceiling of 0, is
+/// not capped here; the per-visitor cap still applies.
+fn ip_capped(
+    deps: &IdentityDeps<'_>,
+    provider: &IdentityProviderId,
+    settings: &ProviderSettings,
+) -> Result<bool, ()> {
+    let (Some(limiter), Some(ip)) = (deps.rate_limiter, deps.services.client_info().client_ip)
+    else {
+        return Ok(false);
+    };
+    if settings.max_calls_per_ip_per_minute == 0 {
+        return Ok(false);
+    }
+    let key = format!(
+        "identity-ip:{provider}:{}",
+        visitor_key(deps.keys, &format!("ip:{ip}"))
+    );
+    limiter
+        .exceeded_per_minute(&key, settings.max_calls_per_ip_per_minute)
+        .map_err(|error| {
+            log::warn!(
+                "Identity provider '{provider}' not dispatched, per-IP ceiling unreadable: {error:?}"
+            );
+        })
+}
+
+/// Builds, checks and sends one call.
+async fn prepare_call<'a>(
+    deps: &IdentityDeps<'a>,
+    call: &'a Call,
+    signals: &'a ResolveSignals<'a>,
+    started: Instant,
+    budget: Option<Duration>,
+) -> Prepared<'a> {
+    let Some(provider) = deps.catalog.get(&call.provider) else {
+        log::error!(
+            "Identity provider '{}' is not in the catalog, not dispatched",
+            call.provider
+        );
+        return Prepared::Settled(CallOutcome::InputFailure);
+    };
+    let provider: &dyn IdentityProvider = provider.as_ref();
+    let descriptor = provider.descriptor();
+    let id = descriptor.id();
+    let settings = deps.settings.ec.identity.provider(id);
+
+    if breaker_open(deps, id, &settings) {
+        log::debug!("Identity provider '{id}' not dispatched: its circuit breaker is open");
+        return Prepared::Settled(CallOutcome::BreakerOpen);
+    }
+
+    let input = ResolveInput::new(descriptor, call.kinds.clone(), signals)
+        .with_state_json(call.state_json.clone());
+    let request = provider.request(&input);
+    if !input.recorded_errors().is_empty() {
+        log::error!("Identity provider '{id}' read an input it did not declare");
+        return Prepared::Settled(CallOutcome::InputFailure);
+    }
+    let request = match request {
+        Ok(Some(request)) => request,
+        Ok(None) => return Prepared::Settled(CallOutcome::Skipped),
+        Err(error) => return Prepared::Settled(request_error_outcome(id, &error)),
+    };
+    if let Err(error) = check_request(&request, descriptor) {
+        log_config(id, &error);
+        return Prepared::Settled(CallOutcome::InputFailure);
+    }
+
+    let remaining = budget.map(|budget| budget.saturating_sub(started.elapsed()));
+    let Some((timeout, budget_limited)) = call_timeout(deps, &settings, remaining) else {
+        return Prepared::Settled(CallOutcome::HoldCutOff);
+    };
+    if over_backend_budget(deps, budget.is_some()) {
+        log::debug!(
+            "Identity provider '{id}' not dispatched: the request's backend budget is spent"
+        );
+        return Prepared::Settled(CallOutcome::OverBackendBudget);
+    }
+    match burst_capped(deps, id, signals.ec_id.as_deref(), &settings) {
+        Ok(true) => return Prepared::Settled(CallOutcome::BurstCapped),
+        Ok(false) => {}
+        Err(()) => return Prepared::Settled(CallOutcome::NotDispatched),
+    }
+    match ip_capped(deps, id, &settings) {
+        Ok(true) => {
+            log::debug!("Identity provider '{id}' not dispatched: the per-IP ceiling is reached");
+            return Prepared::Settled(CallOutcome::BurstCapped);
+        }
+        Ok(false) => {}
+        Err(()) => return Prepared::Settled(CallOutcome::NotDispatched),
+    }
+
+    let url = request.url();
+    let backend = deps.services.backend().ensure(&PlatformBackendSpec {
+        scheme: url.scheme().to_owned(),
+        host: url.host_str().unwrap_or_default().to_owned(),
+        port: url.port(),
+        host_header_override: None,
+        certificate_check: deps.settings.proxy.certificate_check,
+        first_byte_timeout: timeout,
+        between_bytes_timeout: timeout,
+        // A hold call must not wait past the budget to connect, so its
+        // connect timeout is capped at the call timeout (spec 3.4).
+        connect_timeout: budget.map(|_| timeout.min(HOLD_CONNECT_TIMEOUT_CAP)),
+        discriminator: Some(id.to_string()),
+    });
+    let backend = match backend {
+        Ok(name) => name,
+        Err(error) => {
+            log::warn!("Identity provider '{id}': failed to resolve the backend: {error:?}");
+            return Prepared::Settled(CallOutcome::TransportFailure);
+        }
+    };
+
+    let mut builder = http::Request::builder()
+        .method(request.method().clone())
+        .uri(url.as_str());
+    for (name, value) in request.headers() {
+        builder = builder.header(name, value);
+    }
+    let body = if request.body().is_empty() {
+        EdgeBody::empty()
+    } else {
+        EdgeBody::from(request.body().to_vec())
+    };
+    let Ok(outbound) = builder.body(body) else {
+        log::error!("Identity provider '{id}': the request could not be built");
+        return Prepared::Settled(CallOutcome::InputFailure);
+    };
+    let call_context = request.call_context_json().map(str::to_owned);
+
+    match deps
+        .services
+        .http_client()
+        .send_async(PlatformHttpRequest::new(outbound, backend))
+        .await
+    {
+        Ok(pending) => Prepared::Sent(
+            Box::new(InFlightCall {
+                provider,
+                input,
+                call_context,
+                sent_at: Instant::now(),
+                timeout,
+                budget_limited,
+            }),
+            pending,
+        ),
+        Err(error) => {
+            log::warn!("Identity provider '{id}': failed to send: {error:?}");
+            Prepared::Settled(CallOutcome::TransportFailure)
+        }
+    }
+}
+
+/// The outcome of a call whose response arrived.
+fn finish_call(
+    call: &InFlightCall<'_>,
+    response: PlatformResponse,
+    max_response_bytes: usize,
+) -> CallOutcome {
+    let id = call.provider.descriptor().id();
+    let Some((parts, raw)) = buffered_body(response, max_response_bytes, id.as_str()) else {
+        return CallOutcome::TransportFailure;
+    };
+    let encoding = parts
+        .headers
+        .get(header::CONTENT_ENCODING)
+        .and_then(|value| value.to_str().ok());
+    let Some(body) = decode_body(encoding, raw.to_vec(), max_response_bytes) else {
+        log::warn!("Identity provider '{id}' returned a body that is over the cap or undecodable");
+        return CallOutcome::TransportFailure;
+    };
+    let response =
+        ProviderResponse::new(parts.status, parts.headers, body, call.call_context.clone());
+    let result = call.provider.response(&response, &call.input);
+    if !call.input.recorded_errors().is_empty() {
+        log::error!("Identity provider '{id}' read an input it did not declare");
+        return CallOutcome::InputFailure;
+    }
+    match result {
+        Ok(resolution) if call.input.state_decode_failed() => {
+            CallOutcome::InvalidState(Some(resolution))
+        }
+        Ok(resolution) => CallOutcome::Resolved(resolution),
+        Err(error) => {
+            if matches!(
+                error.current_context(),
+                IdentityProviderError::Config { .. }
+            ) {
+                log_config(id, &error);
+            }
+            response_error_outcome(&error)
+        }
+    }
+}
+
+/// Dispatches `calls` and returns each provider's outcome (spec 4.7).
+///
+/// At most `max_concurrency` calls are in flight. `budget` is `Some(the
+/// remaining hold budget)` for a hold dispatch before the auction, and
+/// `None` after the response is sent: there, a call that misses its timeout is
+/// an ordinary transport failure.
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+pub(crate) async fn dispatch(
+    deps: &IdentityDeps<'_>,
+    calls: Vec<Call>,
+    signals: &ResolveSignals<'_>,
+    budget: Option<Duration>,
+) -> Vec<(IdentityProviderId, CallOutcome)> {
+    let started = Instant::now();
+    let max_concurrency = deps.settings.ec.identity.max_concurrency.max(1);
+    let calls = dispatch_order(calls, deps.catalog, signals.now);
+    let mut outcomes = Vec::with_capacity(calls.len());
+    let mut batch = InFlightBatch::default();
+    let clock = DispatchClock { started, budget };
+
+    for call in &calls {
+        match prepare_call(deps, call, signals, started, budget).await {
+            Prepared::Settled(outcome) => {
+                record_failure(deps, &call.provider, &outcome);
+                outcomes.push((call.provider.clone(), outcome));
+            }
+            Prepared::Sent(sent_call, pending) => {
+                batch.sent.insert(call.provider.clone(), sent_call);
+                batch.in_flight.push((call.provider.clone(), pending));
+                if batch.in_flight.len() >= max_concurrency {
+                    drain_batch(deps, &mut batch, clock, &mut outcomes).await;
+                }
+            }
+        }
+    }
+    drain_batch(deps, &mut batch, clock, &mut outcomes).await;
+    outcomes
+}
+
+/// The calls [`dispatch`] has sent and not yet waited for.
+#[derive(Default)]
+struct InFlightBatch<'a> {
+    in_flight: Vec<(IdentityProviderId, PlatformPendingRequest)>,
+    sent: BTreeMap<IdentityProviderId, Box<InFlightCall<'a>>>,
+}
+
+/// When a [`dispatch`] started and the hold budget it shares, if any.
+#[derive(Clone, Copy)]
+struct DispatchClock {
+    started: Instant,
+    budget: Option<Duration>,
+}
+
+/// Waits for every call in `batch` and adds each outcome to `outcomes`.
+async fn drain_batch(
+    deps: &IdentityDeps<'_>,
+    batch: &mut InFlightBatch<'_>,
+    clock: DispatchClock,
+    outcomes: &mut Vec<(IdentityProviderId, CallOutcome)>,
+) {
+    let DispatchClock { started, budget } = clock;
+    let max_response_bytes = deps.settings.ec.identity.max_response_bytes;
+    let within_budget = || budget.is_none_or(|budget| started.elapsed() < budget);
+    for (id, waited) in drain_in_flight(&mut batch.in_flight, deps.services, within_budget).await {
+        let Some(call) = batch.sent.remove(&id) else {
+            continue;
+        };
+        let outcome = match waited {
+            Waited::Response(response) => finish_call(&call, response, max_response_bytes),
+            // A failed wait is a cut off only when the hold budget was
+            // spent: the whole budget, or a timeout the remaining budget
+            // set. Any other failure counts against the provider.
+            Waited::Failed
+                if budget.is_some_and(|budget| started.elapsed() >= budget)
+                    || (budget.is_some()
+                        && call.budget_limited
+                        && call.sent_at.elapsed() >= call.timeout) =>
+            {
+                CallOutcome::HoldCutOff
+            }
+            Waited::Failed => CallOutcome::TransportFailure,
+            Waited::Dropped => CallOutcome::HoldCutOff,
+        };
+        record_failure(deps, &id, &outcome);
+        outcomes.push((id, outcome));
+    }
+}
+
+/// Whether the visitor's consent now re-grants `descriptor`'s provider after
+/// the sticky opt-out `opt_out` (spec 8). Each rule needs a denial the
+/// opt-out's `fp` recorded to turn into a grant, so a CMP re-save that was
+/// already granting never clears a vendor-reported opt-out.
+///
+/// - A provider with a GVL ID: `fp` records a decoded TC string that denied
+///   the vendor or a required purpose, and the current TC string grants the
+///   vendor and every required purpose. TCF timestamps are day-level, so
+///   `LastUpdated` is not compared.
+/// - Any provider, under a GPP string with a readable US section: `fp` records
+///   at least one US opt-out bit and the current fingerprint holds none of
+///   the US opt-out bits `fp` recorded. Other bits may differ.
+///
+/// A jurisdiction change, a newly present GPP string without a US section, a
+/// relaxed signal or an `fp` that does not parse never clears.
+#[must_use]
+pub(crate) fn regrant_clears_opt_out(
+    descriptor: &ProviderDescriptor,
+    opt_out: &KvOptOut,
+    consent: &ConsentContext,
+    signals: PolicySignals,
+) -> bool {
+    tcf_regrants(descriptor, opt_out, consent)
+        || gpp_regrants(descriptor, opt_out, consent, signals)
+}
+
+/// Whether the opt-out's `fp` recorded a TCF denial of the provider's GVL
+/// vendor or a purpose its policy requires, and the current TC string grants
+/// them all.
+fn tcf_regrants(
+    descriptor: &ProviderDescriptor,
+    opt_out: &KvOptOut,
+    consent: &ConsentContext,
+) -> bool {
+    let policy = descriptor.consent_policy();
+    let (Some(vendor), Some(tcf)) = (policy.tcf_vendor(), effective_tcf(consent)) else {
+        return false;
+    };
+    let Ok(recorded) = u64::from_str_radix(&opt_out.fp, 16) else {
+        return false;
+    };
+    let required = policy
+        .tcf_purposes()
+        .iter()
+        .filter(|purpose| (1..=FP_PURPOSES).contains(*purpose))
+        .fold(1_u64 << FP_VENDOR, |mask, purpose| {
+            mask | 1 << (purpose - 1)
+        });
+    let recorded_denial = recorded & (1 << FP_TCF) != 0 && recorded & required != required;
+    recorded_denial
+        && tcf.has_vendor_consent(vendor)
+        && policy
+            .tcf_purposes()
+            .iter()
+            .all(|purpose| tcf.has_purpose_consent(usize::from(*purpose)))
+}
+
+/// Whether the GPP US section now shows none of the US opt-outs `fp`
+/// recorded. GPP carries no creation time, so this is judged by section
+/// values; without a readable US section nothing is judged.
+fn gpp_regrants(
+    descriptor: &ProviderDescriptor,
+    opt_out: &KvOptOut,
+    consent: &ConsentContext,
+    signals: PolicySignals,
+) -> bool {
+    let Some(gpp) = consent.gpp.as_ref() else {
+        return false;
+    };
+    let has_us_section = gpp.us_sale_opt_out.is_some()
+        || gpp.us_sharing_opt_out.is_some()
+        || gpp.us_targeted_advertising_opt_out.is_some()
+        || gpp.us_privacy_section.is_some();
+    if gpp.us_section_decode_failed || !has_us_section {
+        return false;
+    }
+    let Ok(recorded) = u64::from_str_radix(&opt_out.fp, 16) else {
+        return false;
+    };
+    if recorded & FP_US_OPT_OUT_MASK == 0 {
+        return false;
+    }
+    let Ok(current) = u64::from_str_radix(
+        &fingerprint_bits(descriptor.consent_policy(), consent, signals),
+        16,
+    ) else {
+        return false;
+    };
+    current & recorded & FP_US_OPT_OUT_MASK == 0
+}
+
+/// The providers whose sticky opt-out the request's consent re-grants, each
+/// with its clear's watermark: the `at` of the opt-out the request read
+/// (spec 8). An opt-out written after that read is newer and stays.
+#[must_use]
+pub(crate) fn opt_out_clears(
+    view: &EligibilityView,
+    catalog: &ProviderCatalog,
+    consent: &ConsentContext,
+    signals: PolicySignals,
+) -> Vec<(IdentityProviderId, u64)> {
+    catalog
+        .providers()
+        .filter_map(|provider| {
+            let descriptor = provider.descriptor();
+            let state = view.providers.get(descriptor.id())?;
+            let opt_out = state.o.as_ref()?;
+            (view.is_opted_out(descriptor.id())
+                && regrant_clears_opt_out(descriptor, opt_out, consent, signals))
+            .then(|| (descriptor.id().clone(), opt_out.at))
+        })
+        .collect()
+}
+
+/// Runs [`run_hold`] with the request's runtime and limiter. `None` when the
+/// adapter set no identity runtime (no provider is configured) or no limiter
+/// (fails closed).
+pub(crate) async fn hold_before_auction(
+    settings: &Settings,
+    services: &RuntimeServices,
+    context: &mut EcContext,
+) -> Option<HoldResults> {
+    let runtime = context.identity().runtime().cloned()?;
+    let Some(limiter) = context.identity().rate_limiter() else {
+        // Without a limiter the burst cap and breaker cannot hold, so fail
+        // closed: dispatch nothing before the response.
+        log::warn!("Skipping the identity hold dispatch: no rate limiter is set for the request");
+        return None;
+    };
+    let random = ThreadRandom;
+    let deps = runtime.deps(
+        settings,
+        services,
+        &random,
+        Some(limiter.as_ref() as &dyn RateLimiter),
+    );
+    Some(run_hold(&deps, context).await)
+}
+
+/// What the hold dispatch before a navigation's auction learned (spec 4.7).
+///
+/// The answers this auction's server set adds, per source, and the provider
+/// that wrote each, so the output rules can apply that provider's provenance
+/// default. Nothing here is stored: the same answers ride the writer's one
+/// flush.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct HoldResults {
+    /// The entry set each source now holds, in the order the provider
+    /// returned it.
+    pub(crate) additions: BTreeMap<SourceDomain, Vec<KvEid>>,
+    /// The provider that wrote each source in `additions`.
+    pub(crate) writer: BTreeMap<SourceDomain, IdentityProviderId>,
+}
+
+/// Dispatches the hold-mode providers of a returning writer navigation that
+/// runs an auction (spec 4.7).
+///
+/// Every provider that [`eligibility`] passes in [`Phase::Hold`] on the phase 1
+/// view is called within `hold_budget_ms`, measured from the first dispatch,
+/// each waiting at most `min(hold_timeout_ms, remaining budget)`. The phase 1
+/// read has already confirmed a live, consenting row, so no EC ID is
+/// disclosed before consent is confirmed. Each outcome joins the writer's
+/// mutation, and every answer that mutation would store is returned for this
+/// auction. No answer goes into a cookie.
+///
+/// A new visitor's writer navigation, whose EC was minted with
+/// [`EcContext::mint_deferred`], dispatches on the row it will create,
+/// skipping every provider that reads the EC ID, since no row backs it yet.
+/// Its answers go into that row instead of a mutation, so the create is the
+/// one write (spec 4.7, new visitors).
+///
+/// A request that is neither, runs no auction, or whose phase 1 read is not a
+/// live, consenting row dispatches nothing.
+pub(crate) async fn run_hold(deps: &IdentityDeps<'_>, context: &mut EcContext) -> HoldResults {
+    let mut results = HoldResults::default();
+    let new_visitor = context.identity().writer() && context.deferred_entry().is_some();
+    if !context.identity().runs_auction() || !(new_visitor || may_flush(context)) {
+        return results;
+    }
+    let Some(ec_id) = context.ec_value().map(str::to_owned) else {
+        return results;
+    };
+    let entry = if new_visitor {
+        context.deferred_entry().cloned()
+    } else {
+        context
+            .kv_snapshot()
+            .entry_for(&ec_id)
+            .filter(|entry| entry.consent.ok)
+            .cloned()
+    };
+    let Some(entry) = entry else {
+        return results;
+    };
+
+    let now = current_timestamp();
+    let facts = request_facts(context, now, true);
+    context.identity_mut().set_hold_dispatched();
+    let view = EligibilityView::from_kv(&entry);
+    let calls: Vec<Call> = deps
+        .catalog
+        .providers()
+        .filter_map(|provider| {
+            let id = provider.descriptor().id();
+            let reads_ec_id = provider
+                .descriptor()
+                .resolves()
+                .is_some_and(Resolves::gets_ec_id);
+            if new_visitor && reads_ec_id {
+                return None;
+            }
+            let provider_settings = deps.settings.ec.identity.provider(id);
+            let Eligibility::Eligible { kinds } = eligibility(
+                &EligibilityInput {
+                    provider: provider.as_ref(),
+                    settings: &provider_settings,
+                    identity: &deps.settings.ec.identity,
+                    catalog: deps.catalog,
+                    consent: context.consent(),
+                },
+                &view,
+                &facts,
+                Phase::Hold,
+            ) else {
+                return None;
+            };
+            Some(Call {
+                provider: id.clone(),
+                kinds,
+                state_json: view
+                    .state(id)
+                    .and_then(|state| serde_json::to_string(state).ok()),
+            })
+        })
+        .collect();
+    if calls.is_empty() {
+        return results;
+    }
+
+    let mut held = IdentityMutation::default();
+    add_dispatch_results(
+        &mut held,
+        deps,
+        &DispatchInput {
+            context,
+            ec_id: &ec_id,
+            live: &entry,
+            view: &view,
+            facts: &facts,
+        },
+        DispatchRun {
+            calls,
+            budget: Some(Duration::from_millis(
+                deps.settings.ec.identity.hold_budget_ms,
+            )),
+        },
+    )
+    .await;
+
+    // Computed on the phase 1 row; the flush applies the same mutation to the
+    // phase 4 live row, which may differ.
+    let apply_context = ApplyContext {
+        now,
+        random: deps.random,
+        catalog: deps.catalog,
+    };
+    let applied = apply(&held, &entry, &apply_context);
+    if let Some(applied) = &applied {
+        for (source, record) in &applied.entry.ids {
+            if entry.ids.get(source) == Some(record) {
+                continue;
+            }
+            let (Ok(source), Some(writer)) = (
+                source.parse::<SourceDomain>(),
+                record.w.as_deref().and_then(|writer| writer.parse().ok()),
+            ) else {
+                log::debug!(
+                    "Skipping a hold answer for source '{source}': no parseable writer on the record"
+                );
+                continue;
+            };
+            results
+                .additions
+                .insert(source.clone(), record.eids.clone());
+            results.writer.insert(source, writer);
+        }
+    }
+    if new_visitor {
+        if let Some(applied) = applied {
+            context.set_deferred_entry(applied.entry);
+        }
+    } else {
+        context.identity_mut().mutation_mut().absorb(held);
+    }
+    results
+}
+
+/// One proxied response offered for capture (spec 4.7).
+///
+/// There is no request body here: capture never reads it.
+pub(crate) struct CaptureCall<'a> {
+    pub(crate) method: &'a http::Method,
+    pub(crate) path: &'a str,
+    pub(crate) status: StatusCode,
+    pub(crate) headers: &'a http::HeaderMap,
+    /// The decoded body, at most `max_response_bytes`.
+    pub(crate) body: &'a [u8],
+}
+
+/// Whether any enabled provider's capture rule matches the request.
+#[must_use]
+pub(crate) fn has_capture_rule(
+    catalog: &ProviderCatalog,
+    method: &http::Method,
+    path: &str,
+) -> bool {
+    catalog.providers().any(|provider| {
+        provider
+            .descriptor()
+            .captures()
+            .is_some_and(|captures| captures.matches(method, path))
+    })
+}
+
+/// What a capture reads of the row.
+struct CaptureView {
+    view: EligibilityView,
+    /// The row could not be read, so no removal can be built.
+    unreadable: bool,
+    /// Reads this view made.
+    reads: u32,
+}
+
+/// The row a capture reads its view from: the request's own snapshot when it
+/// holds one for this EC ID, else one read. Empty when the row is missing or
+/// not a live row.
+fn capture_view(
+    graph: Option<&KvIdentityGraph>,
+    context: &EcContext,
+    ec_id: Option<&str>,
+) -> CaptureView {
+    let empty = |unreadable, reads| CaptureView {
+        view: EligibilityView::empty(),
+        unreadable,
+        reads,
+    };
+    let (Some(graph), Some(ec_id)) = (graph, ec_id) else {
+        return empty(false, 0);
+    };
+    let (snapshot, reads) = if context.kv_snapshot().belongs_to(ec_id) {
+        (context.kv_snapshot().clone(), 0)
+    } else {
+        (graph.load_snapshot(ec_id), 1)
+    };
+    match snapshot {
+        EcKvSnapshot::Present { entry, .. } if entry.consent.ok => CaptureView {
+            view: EligibilityView::from_kv(&entry),
+            unreadable: false,
+            reads,
+        },
+        EcKvSnapshot::Failed { .. } => empty(true, reads),
+        _ => empty(false, reads),
+    }
+}
+
+/// Counts and logs the source invalidations a capture result asked for when
+/// the row could not be read: each needs the record's revision, so none can be
+/// built or retried (spec 5.3). An opt-out needs no view and is not counted
+/// here. Holds no value.
+fn lose_unbuildable_invalidations(
+    context: &mut EcContext,
+    ec_id: Option<&str>,
+    provider: &IdentityProviderId,
+    resolution: &Resolution,
+    catalog: &ProviderCatalog,
+) {
+    let claimed = catalog.sources_of(provider);
+    for source in resolution
+        .invalidated()
+        .iter()
+        .filter(|source| claimed.contains(source))
+    {
+        log::error!(
+            "Identity removal lost for '{}': provider '{provider}', source '{source}'",
+            log_id(ec_id.unwrap_or_default()),
+        );
+        context.identity_mut().record_removal_lost();
+    }
+}
+
+/// Whether eligibility steps 1 to 3 of spec 4.7 pass for the request.
+fn passes_consent_steps(descriptor: &ProviderDescriptor, context: &EcContext, now: u64) -> bool {
+    let facts = request_facts(context, now, false);
+    facts.is_real_browser
+        && facts.ec_persistence_allowed
+        && policy_allows(
+            descriptor.consent_policy(),
+            context.consent(),
+            facts.policy_signals,
+        )
+}
+
+/// What one capture result asks for, once the real-browser gate has passed.
+struct CaptureAsk {
+    removals: Vec<PartnerIdChange>,
+    state: ProviderStateChange,
+    /// Positive changes that pass the consent steps and differ from what KV
+    /// holds, for the writer's flush or the pending key (spec 5.3).
+    positives: Vec<PartnerIdChange>,
+}
+
+/// The source and record of a positive change.
+fn positive_record(change: &PartnerIdChange) -> Option<(&SourceDomain, &KvPartnerId)> {
+    match change {
+        PartnerIdChange::FillMissing { source, record }
+        | PartnerIdChange::OwnerWrite { source, record, .. } => Some((source, record)),
+        PartnerIdChange::OwnerRemove { .. } | PartnerIdChange::WriterRemove { .. } => None,
+    }
+}
+
+/// The sources the provider claims that a result carries IDs for, once each.
+fn positive_sources(
+    provider: &IdentityProviderId,
+    resolution: &Resolution,
+    catalog: &ProviderCatalog,
+) -> BTreeSet<SourceDomain> {
+    let claimed = catalog.sources_of(provider);
+    resolution
+        .eids()
+        .iter()
+        .map(|eid| eid.source().clone())
+        .filter(|source| claimed.contains(source))
+        .collect()
+}
+
+/// Reads one result for its removals, opt-out and clear, and for the
+/// positive changes worth keeping.
+fn capture_ask(
+    deps: &IdentityDeps<'_>,
+    context: &EcContext,
+    provider: &dyn IdentityProvider,
+    resolution: Resolution,
+    view: &EligibilityView,
+    positive: bool,
+) -> CaptureAsk {
+    let descriptor = provider.descriptor();
+    let id = descriptor.id();
+    let now = UnixTime::from_secs(current_timestamp());
+    if resolution.changes_state() {
+        log::warn!("Identity provider '{id}' returned a state change from capture, ignoring it");
+    }
+    let opted_out = resolution.is_opted_out();
+    let facts = request_facts(context, now.as_secs(), false);
+    let fingerprint = fingerprint_bits(
+        descriptor.consent_policy(),
+        context.consent(),
+        facts.policy_signals,
+    );
+    let provider_settings = deps.settings.ec.identity.provider(id);
+    let changes = outcome_to_changes(
+        provider,
+        CallOutcome::Resolved(resolution),
+        view,
+        &OutcomeContext {
+            now,
+            catalog: deps.catalog,
+            settings: &provider_settings,
+            identity: &deps.settings.ec.identity,
+            expected_state: None,
+            fingerprint: &fingerprint,
+        },
+    );
+    let OutcomeChanges {
+        changes,
+        result,
+        state,
+    } = changes;
+    let (resulting, result_ids) = match result {
+        Some(result) => (result.state, result.ids),
+        None => (state, Vec::new()),
+    };
+    let (removals, positives): (Vec<_>, Vec<_>) = changes
+        .into_iter()
+        .chain(result_ids)
+        .partition(PartnerIdChange::is_removal);
+    let keeps_positives = positive
+        && !opted_out
+        && !view.is_opted_out(id)
+        && passes_consent_steps(descriptor, context, now.as_secs());
+    let mut ask = CaptureAsk {
+        removals,
+        state: ProviderStateChange::default(),
+        positives: if keeps_positives {
+            positives
+                .into_iter()
+                .filter(|change| {
+                    positive_record(change).is_some_and(|(source, record)| {
+                        view.record(source)
+                            .is_none_or(|stored| stored.eids != record.eids)
+                    })
+                })
+                .collect()
+        } else {
+            Vec::new()
+        },
+    };
+    if let Some(opt_out) = resulting.opt_out.filter(|_| opted_out) {
+        ask.state.opt_out = Some(opt_out);
+        ask.state.st = StateUpdate::Clear;
+    }
+    // Only a capture-only provider without a GVL ID has no other way to clear:
+    // a vendor that issues again has been re-consented through (spec 8).
+    let only_capture_clears =
+        deps.catalog.is_capture_only(id) && descriptor.consent_policy().tcf_vendor().is_none();
+    if positive
+        && only_capture_clears
+        && view.is_opted_out(id)
+        && passes_consent_steps(descriptor, context, now.as_secs())
+    {
+        // Clear only the opt-out this request read (spec 8).
+        ask.state.opt_out_clear = view
+            .providers
+            .get(id)
+            .and_then(|state| state.o.as_ref())
+            .map(|opt_out| opt_out.at);
+    }
+    ask
+}
+
+/// Offers a proxied 2xx response to each provider whose capture rule matches
+/// (spec 4.7).
+///
+/// Capture is revoke-only. Removals and opt-outs are written at once with the
+/// removal write, whatever the consent and whatever the client, as a consent
+/// withdrawal is. A clear re-enables IDs, so only a real browser's clear is
+/// written ([`passes_consent_steps`]). A positive ID is counted and never
+/// stored. A `revoke_scope = "global"` opt-out asks finalize for the
+/// consent-withdrawal tombstone path instead.
+pub(crate) fn run_capture(
+    deps: &IdentityDeps<'_>,
+    graph: Option<&KvIdentityGraph>,
+    context: &mut EcContext,
+    call: &CaptureCall<'_>,
+) {
+    let matching: Vec<&std::sync::Arc<dyn IdentityProvider>> = deps
+        .catalog
+        .providers()
+        .filter(|provider| {
+            provider
+                .descriptor()
+                .captures()
+                .is_some_and(|captures| captures.matches(call.method, call.path))
+        })
+        .collect();
+    if matching.is_empty() {
+        return;
+    }
+    let ec_id = context.ec_value().map(str::to_owned);
+    let CaptureView {
+        view,
+        unreadable,
+        reads: view_reads,
+    } = capture_view(graph, context, ec_id.as_deref());
+    context.identity_mut().record_capture_kv(view_reads, 0);
+    let response =
+        ProviderResponse::new(call.status, call.headers.clone(), call.body.to_vec(), None);
+    let consent = ProviderConsent::from_context(context.consent());
+    let now = UnixTime::from_secs(current_timestamp());
+
+    let mut mutation = IdentityMutation::default();
+    for provider in matching {
+        let descriptor = provider.descriptor();
+        let id = descriptor.id();
+        let stored: BTreeMap<SourceDomain, StoredId> = view
+            .records()
+            .filter(|(source, _)| deps.catalog.sources_of(id).contains(source))
+            .filter_map(|(source, record)| {
+                StoredId::from_record(source, record).map(|stored| (source.clone(), stored))
+            })
+            .collect();
+        let input = CaptureInput::new(
+            descriptor,
+            call.path,
+            &response,
+            &stored,
+            &consent,
+            &deps.settings.publisher.domain,
+            now,
+        );
+        let resolution = match provider.capture(&input) {
+            Ok(resolution) => resolution,
+            Err(error) => {
+                if !error.current_context().is_not_implemented() {
+                    log::warn!(
+                        "Identity provider '{id}' failed to capture: {}",
+                        error.current_context()
+                    );
+                }
+                continue;
+            }
+        };
+
+        let positive_sources = positive_sources(id, &resolution, deps.catalog);
+        for source in &positive_sources {
+            context
+                .identity_mut()
+                .record_unpersisted(id.clone(), source.clone());
+        }
+        if resolution.is_opted_out()
+            && deps.settings.ec.identity.provider(id).revoke_scope() == RevokeScope::Global
+        {
+            context.request_global_revoke();
+            continue;
+        }
+
+        if unreadable {
+            lose_unbuildable_invalidations(
+                context,
+                ec_id.as_deref(),
+                id,
+                &resolution,
+                deps.catalog,
+            );
+        }
+        let ask = capture_ask(
+            deps,
+            context,
+            provider.as_ref(),
+            resolution,
+            &view,
+            !positive_sources.is_empty(),
+        );
+        for removal in ask.removals {
+            mutation.add_change(removal);
+        }
+        mutation.merge_state(id.clone(), ask.state);
+        // The writer's own flush stores them; any other request leaves them
+        // to the pending key after send (spec 5.3, Pending key).
+        if !unreadable {
+            for change in ask.positives {
+                if context.identity().writer() {
+                    context.identity_mut().mutation_mut().add_change(change);
+                } else {
+                    context
+                        .identity_mut()
+                        .capture_writes_mut()
+                        .add_change(change);
+                }
+            }
+        }
+    }
+
+    // The tombstone the finalize step writes supersedes every other removal.
+    if context.global_revoke_requested() || !mutation.has_removals() {
+        return;
+    }
+    let (Some(graph), Some(ec_id)) = (graph, ec_id.as_deref()) else {
+        log::debug!("Dropping capture removals: no identity graph or EC ID for the request");
+        return;
+    };
+    let apply_context = ApplyContext {
+        now: now.as_secs(),
+        random: deps.random,
+        catalog: deps.catalog,
+    };
+    let (outcome, cost) = write_removals_counted(
+        graph,
+        ec_id,
+        &mutation,
+        &apply_context,
+        RemovalTiming::BeforeSend,
+    );
+    context
+        .identity_mut()
+        .record_capture_kv(cost.reads, cost.writes);
+    if outcome == RemovalWriteOutcome::Failed {
+        if let Some(earlier) = context.identity().pending_removals().cloned() {
+            mutation.absorb(earlier);
+        }
+        context.identity_mut().set_pending_removals(Some(mutation));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+    use std::sync::Arc;
+    use std::time::Duration;
+
+    use std::io::Write as _;
+
+    use serde_json::json;
+
+    use super::*;
+    use crate::consent::types::GppConsent;
+    use crate::consent::us_privacy::decode_us_privacy;
+    use crate::ec::identity::descriptor::{
+        ConsentPolicy, Input, ProviderDescriptor, ResolveKind, Resolves, UsOptOut,
+    };
+    use crate::ec::identity::flush::defer_capture_writes;
+    use crate::ec::identity::input::{ProviderConsent, SeededRandom, ThreadRandom};
+    use crate::ec::identity::pending::{load_pending, pending_key};
+    use crate::ec::identity::policy::fingerprint_bits;
+    use crate::ec::identity::request::WriterDecision;
+    use crate::ec::identity::resolution::{ResolvedEid, ResolvedUid};
+    use crate::ec::identity::revision::{record_revision, uid_hash};
+    use crate::ec::identity::test_support::FakeRateLimiter;
+    use crate::ec::identity::test_support::fake_http::{
+        FakeBackend, FakeHttpClient, ScriptedProvider, fake_services, fake_services_from,
+    };
+    use crate::ec::identity::test_support::{
+        OutcomeFixture, allowing_consent, facts_for_writer, fixed_capture_provider, fixed_provider,
+        pid, provider_from, record_for_test, resolver_policy, source, stateful_fixed_provider,
+        test_consent_gdpr_without_vendor,
+    };
+    use crate::ec::kv_types::{KvEid, KvUid};
+    use crate::platform::ClientInfo;
+    use crate::settings::ProviderMode;
+    use crate::test_support::tests::create_test_settings;
+
+    /// The six lines every eligibility test repeats: one provider, its
+    /// catalog and the settings and consent the call reads.
+    struct EligibilityFixture {
+        provider: Arc<dyn IdentityProvider>,
+        catalog: ProviderCatalog,
+        settings: ProviderSettings,
+        identity: IdentitySettings,
+        consent: ConsentContext,
+    }
+
+    impl EligibilityFixture {
+        /// A catalog holding `provider` alone, with no source owners.
+        fn new(provider: &Arc<dyn IdentityProvider>) -> Self {
+            Self::with_catalog(
+                provider,
+                ProviderCatalog::new(vec![provider.clone()], BTreeMap::new()),
+            )
+        }
+
+        /// A catalog holding `provider` alone, owning each of `sources`.
+        fn owning(provider: &Arc<dyn IdentityProvider>, sources: &[&str]) -> Self {
+            let owners = sources
+                .iter()
+                .map(|name| (source(name), provider.descriptor().id().clone()))
+                .collect();
+            Self::with_catalog(
+                provider,
+                ProviderCatalog::new(vec![provider.clone()], owners),
+            )
+        }
+
+        fn with_catalog(provider: &Arc<dyn IdentityProvider>, catalog: ProviderCatalog) -> Self {
+            Self {
+                provider: provider.clone(),
+                catalog,
+                settings: ProviderSettings::default(),
+                identity: IdentitySettings::default(),
+                consent: allowing_consent(),
+            }
+        }
+
+        fn with_settings(mut self, settings: ProviderSettings) -> Self {
+            self.settings = settings;
+            self
+        }
+
+        fn with_consent(mut self, consent: ConsentContext) -> Self {
+            self.consent = consent;
+            self
+        }
+
+        fn check(&self, view: &EligibilityView, facts: &RequestFacts, phase: Phase) -> Eligibility {
+            let input = EligibilityInput {
+                provider: self.provider.as_ref(),
+                settings: &self.settings,
+                identity: &self.identity,
+                catalog: &self.catalog,
+                consent: &self.consent,
+            };
+            eligibility(&input, view, facts, phase)
+        }
+
+        fn is_eligible(&self, view: &EligibilityView, facts: &RequestFacts, phase: Phase) -> bool {
+            matches!(self.check(view, facts, phase), Eligibility::Eligible { .. })
+        }
+
+        /// The kinds of a writer navigation, after send.
+        fn kinds(&self, view: &EligibilityView) -> BTreeMap<SourceDomain, ResolveKind> {
+            match self.check(view, &facts_for_writer(), Phase::AfterSend) {
+                Eligibility::Eligible { kinds } => kinds,
+                Eligibility::Skip(reason) => panic!("should be eligible, skipped for {reason:?}"),
+            }
+        }
+
+        fn skip_reason(&self, view: &EligibilityView, facts: &RequestFacts) -> SkipReason {
+            match self.check(view, facts, Phase::AfterSend) {
+                Eligibility::Skip(reason) => reason,
+                Eligibility::Eligible { .. } => panic!("should be skipped"),
+            }
+        }
+    }
+
+    fn custom_provider(
+        id: &str,
+        sources: &[&str],
+        resolves: Resolves,
+        policy: ConsentPolicy,
+    ) -> Arc<dyn IdentityProvider> {
+        let mut builder = ProviderDescriptor::builder(pid(id))
+            .with_resolves(resolves.with_endpoint("https://api.example.com"))
+            .with_consent_policy(policy);
+        for name in sources {
+            builder = builder.with_source(source(name));
+        }
+        provider_from(builder.build().expect("should build the descriptor"))
+    }
+
+    fn expiring_provider(id: &str, sources: &[&str]) -> Arc<dyn IdentityProvider> {
+        let mut builder = ProviderDescriptor::builder(pid(id))
+            .with_resolves(Resolves::new().with_endpoint("https://api.example.com"))
+            .with_consent_policy(ConsentPolicy::eid_persistence_only())
+            .with_expiring_ids();
+        for name in sources {
+            builder = builder.with_source(source(name));
+        }
+        provider_from(builder.build().expect("should build the descriptor"))
+    }
+
+    fn positive_record(change: &PartnerIdChange) -> Option<&KvPartnerId> {
+        match change {
+            PartnerIdChange::FillMissing { record, .. }
+            | PartnerIdChange::OwnerWrite { record, .. } => Some(record),
+            PartnerIdChange::OwnerRemove { .. } | PartnerIdChange::WriterRemove { .. } => None,
+        }
+    }
+
+    fn kinds_of(entries: &[(&str, ResolveKind)]) -> BTreeMap<SourceDomain, ResolveKind> {
+        entries
+            .iter()
+            .map(|(name, kind)| (source(name), *kind))
+            .collect()
+    }
+
+    fn one_entry(uid: &str) -> KvEid {
+        KvEid {
+            uids: vec![KvUid {
+                id: uid.to_owned(),
+                atype: None,
+                ext: None,
+            }],
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
+    }
+
+    fn large_entries(source_domain: &SourceDomain) -> Vec<ResolvedEid> {
+        // Three entries of about 2 KB each: the set is over MAX_ENTRY_SET_BYTES.
+        let large_ext = json!({ "segments": "x".repeat(2_000) });
+        (0..3)
+            .map(|index| {
+                ResolvedEid::new(source_domain, ResolvedUid::new(format!("example-{index}")))
+                    .with_ext(large_ext.clone())
+            })
+            .collect()
+    }
+
+    // Eligibility
+
+    #[test]
+    fn skips_when_not_a_real_browser() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let facts = RequestFacts {
+            is_real_browser: false,
+            ..facts_for_writer()
+        };
+
+        assert_eq!(
+            fixture.skip_reason(&EligibilityView::empty(), &facts),
+            SkipReason::NotRealBrowser,
+            "should skip a client that does not look like a browser"
+        );
+        assert!(
+            fixture.is_eligible(
+                &EligibilityView::empty(),
+                &facts_for_writer(),
+                Phase::AfterSend
+            ),
+            "control: a real browser should be eligible"
+        );
+    }
+
+    #[test]
+    fn skips_when_ec_persistence_is_not_allowed() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let facts = RequestFacts {
+            ec_persistence_allowed: false,
+            ..facts_for_writer()
+        };
+
+        assert_eq!(
+            fixture.skip_reason(&EligibilityView::empty(), &facts),
+            SkipReason::EcPersistenceNotAllowed,
+            "should skip when global consent blocks EID persistence"
+        );
+    }
+
+    #[test]
+    fn skips_when_the_consent_policy_blocks() {
+        let provider = custom_provider(
+            "p",
+            &["a.example.com"],
+            Resolves::new(),
+            resolver_policy().with_tcf_vendor(5),
+        );
+        let blocked =
+            EligibilityFixture::new(&provider).with_consent(test_consent_gdpr_without_vendor(5));
+        let allowed =
+            EligibilityFixture::new(&provider).with_consent(test_consent_gdpr_without_vendor(6));
+        let view = EligibilityView::empty();
+
+        assert_eq!(
+            blocked.skip_reason(&view, &facts_for_writer()),
+            SkipReason::ConsentPolicy,
+            "should skip when the policy's vendor has no consent"
+        );
+        assert!(
+            allowed.is_eligible(&view, &facts_for_writer(), Phase::AfterSend),
+            "control: should run when the vendor has consent"
+        );
+    }
+
+    #[test]
+    fn skips_a_provider_that_does_not_resolve() {
+        let fixture = EligibilityFixture::new(&fixed_capture_provider("p", &["a.example.com"]));
+
+        assert_eq!(
+            fixture.skip_reason(&EligibilityView::empty(), &facts_for_writer()),
+            SkipReason::NotAResolver,
+            "should never run a capture-only provider"
+        );
+    }
+
+    #[test]
+    fn skips_new_visitor_in_every_mode() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let view = EligibilityView::empty();
+        for phase in [Phase::Hold, Phase::AfterSend] {
+            let facts = RequestFacts {
+                new_visitor: true,
+                ..facts_for_writer()
+            };
+            assert!(
+                matches!(
+                    fixture.check(&view, &facts, phase),
+                    Eligibility::Skip(SkipReason::NewVisitor)
+                ),
+                "should run no provider on a new visitor's first navigation ({phase:?})"
+            );
+        }
+        let returning = facts_for_writer();
+        assert!(
+            matches!(
+                fixture.check(&view, &returning, Phase::AfterSend),
+                Eligibility::Eligible { .. }
+            ),
+            "control: a returning writer should be eligible"
+        );
+    }
+
+    #[test]
+    fn stager_runs_no_provider_in_either_phase() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let view = EligibilityView::empty();
+        let stager = RequestFacts {
+            writer: false,
+            runs_auction: true,
+            ..facts_for_writer()
+        };
+        for mode in [ProviderMode::Hold, ProviderMode::AfterSend] {
+            let fixture = EligibilityFixture::new(&provider).with_settings(ProviderSettings {
+                mode,
+                ..ProviderSettings::default()
+            });
+            for phase in [Phase::Hold, Phase::AfterSend] {
+                assert!(
+                    matches!(
+                        fixture.check(&view, &stager, phase),
+                        Eligibility::Skip(SkipReason::NotWriter)
+                    ),
+                    "should run no provider on a stager ({mode:?}, {phase:?})"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn owned_record_written_by_someone_else_is_due_for_refresh() {
+        let fixture = EligibilityFixture::owning(
+            &fixed_provider("p", &["a.example.com", "b.example.com"]),
+            &["a.example.com", "b.example.com"],
+        );
+        let mut view = EligibilityView::empty();
+        // Written by the browser, and acquired recently.
+        view.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-a", None, 999),
+        );
+        // Written by this provider, acquired recently.
+        view.set_record_for_test(
+            &source("b.example.com"),
+            record_for_test("example-b", Some("p"), 999),
+        );
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("a.example.com", ResolveKind::Refresh)]),
+            "should refresh the browser-seeded record and leave the fresh owned one"
+        );
+    }
+
+    #[test]
+    fn owned_source_without_a_record_is_initial() {
+        let fixture = EligibilityFixture::owning(
+            &fixed_provider("p", &["a.example.com"]),
+            &["a.example.com"],
+        );
+
+        assert_eq!(
+            fixture.kinds(&EligibilityView::empty()),
+            kinds_of(&[("a.example.com", ResolveKind::Initial)]),
+            "should ask for an initial resolution when there is no record"
+        );
+    }
+
+    #[test]
+    fn owned_record_is_due_by_refresh_anchor_or_age() {
+        let fixture = EligibilityFixture::owning(
+            &fixed_provider("p", &["a.example.com", "b.example.com", "c.example.com"]),
+            &["a.example.com", "b.example.com", "c.example.com"],
+        )
+        .with_settings(ProviderSettings {
+            refresh_after_sec: 100,
+            ..ProviderSettings::default()
+        });
+        let mut view = EligibilityView::empty();
+        // `ra` has passed although `at` is recent.
+        let mut passed = record_for_test("example-a", Some("p"), 999);
+        passed.ra = Some(1_000);
+        view.set_record_for_test(&source("a.example.com"), passed);
+        // `ra` is ahead although `at` is old, so `ra` wins.
+        let mut ahead = record_for_test("example-b", Some("p"), 100);
+        ahead.ra = Some(5_000);
+        view.set_record_for_test(&source("b.example.com"), ahead);
+        // No `ra`, and `at + refresh_after_sec` has passed.
+        view.set_record_for_test(
+            &source("c.example.com"),
+            record_for_test("example-c", Some("p"), 900),
+        );
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[
+                ("a.example.com", ResolveKind::Refresh),
+                ("c.example.com", ResolveKind::Refresh)
+            ]),
+            "should refresh when ra passed, or when there is no ra and the age passed"
+        );
+    }
+
+    #[test]
+    fn owned_record_without_at_or_ra_is_due() {
+        let fixture = EligibilityFixture::owning(
+            &fixed_provider("p", &["a.example.com"]),
+            &["a.example.com"],
+        );
+        let mut view = EligibilityView::empty();
+        let mut record = record_for_test("example-a", Some("p"), 999);
+        record.at = None;
+        view.set_record_for_test(&source("a.example.com"), record);
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("a.example.com", ResolveKind::Refresh)]),
+            "should refresh a record with no acquisition time"
+        );
+    }
+
+    #[test]
+    fn browser_seeded_uid_in_iv_is_never_due() {
+        let fixture = EligibilityFixture::owning(
+            &fixed_provider("p", &["a.example.com"]),
+            &["a.example.com"],
+        );
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-bad", None, 10),
+        );
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("a.example.com", ResolveKind::Refresh)]),
+            "control: a browser-seeded record should be due"
+        );
+
+        view.set_invalidated_for_test("p", vec![uid_hash("example-bad")]);
+        assert!(
+            matches!(
+                fixture.check(&view, &facts_for_writer(), Phase::AfterSend),
+                Eligibility::Skip(SkipReason::NoSourceDue)
+            ),
+            "should never refresh a browser-seeded value the provider invalidated"
+        );
+    }
+
+    #[test]
+    fn expired_refresh_anchor_stays_refresh() {
+        let fixture = EligibilityFixture::owning(
+            &expiring_provider("p", &["a.example.com"]),
+            &["a.example.com"],
+        );
+        let mut view = EligibilityView::empty();
+        let mut anchor = record_for_test("example-a", Some("p"), 100);
+        anchor.exp = Some(500);
+        anchor.ru = Some(9_000);
+        view.set_record_for_test(&source("a.example.com"), anchor);
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("a.example.com", ResolveKind::Refresh)]),
+            "should keep the kind Refresh for an expired record that is still stored"
+        );
+    }
+
+    #[test]
+    fn unowned_source_with_unexpired_record_is_not_initial_even_when_consent_hides_it() {
+        let hiding = custom_provider(
+            "q",
+            &["a.example.com"],
+            Resolves::new(),
+            resolver_policy().with_tcf_vendor(5),
+        );
+        let asking = fixed_provider("p", &["a.example.com"]);
+        let catalog = ProviderCatalog::new(vec![hiding, asking.clone()], BTreeMap::new());
+        // Consent withholds vendor 5, so `q`'s record is not servable.
+        let fixture = EligibilityFixture::with_catalog(&asking, catalog)
+            .with_consent(test_consent_gdpr_without_vendor(5));
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-a", Some("q"), 900),
+        );
+
+        assert!(
+            matches!(
+                fixture.check(&view, &facts_for_writer(), Phase::AfterSend),
+                Eligibility::Skip(SkipReason::NoSourceDue)
+            ),
+            "should not call to fill a source that already holds an unexpired ID"
+        );
+        assert_eq!(
+            fixture.kinds(&EligibilityView::empty()),
+            kinds_of(&[("a.example.com", ResolveKind::Initial)]),
+            "control: an absent record should be Initial"
+        );
+    }
+
+    #[test]
+    fn expired_unowned_record_counts_as_absent() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let mut view = EligibilityView::empty();
+        let mut record = record_for_test("example-a", None, 100);
+        record.exp = Some(1_000);
+        view.set_record_for_test(&source("a.example.com"), record);
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("a.example.com", ResolveKind::Initial)]),
+            "should treat a record expired at now as absent"
+        );
+    }
+
+    #[test]
+    fn record_of_an_unconfigured_writer_counts_as_absent() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-a", Some("gone"), 900),
+        );
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("a.example.com", ResolveKind::Initial)]),
+            "should treat a record written by an unconfigured provider as absent"
+        );
+
+        let mut browser_view = EligibilityView::empty();
+        browser_view.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-a", None, 900),
+        );
+        assert!(
+            matches!(
+                fixture.check(&browser_view, &facts_for_writer(), Phase::AfterSend),
+                Eligibility::Skip(SkipReason::NoSourceDue)
+            ),
+            "control: a browser-seeded unexpired record should count as present"
+        );
+    }
+
+    #[test]
+    fn hold_provider_runs_before_the_auction_and_not_after_send() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]))
+            .with_settings(ProviderSettings {
+                mode: ProviderMode::Hold,
+                ..ProviderSettings::default()
+            });
+        let view = EligibilityView::empty();
+        let facts = RequestFacts {
+            runs_auction: true,
+            ..facts_for_writer()
+        };
+
+        assert!(
+            fixture.is_eligible(&view, &facts, Phase::Hold),
+            "should hold before the auction"
+        );
+        assert!(
+            !fixture.is_eligible(&view, &facts, Phase::AfterSend),
+            "should not run again after send"
+        );
+    }
+
+    #[test]
+    fn hold_provider_runs_after_send_when_the_navigation_runs_no_auction() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]))
+            .with_settings(ProviderSettings {
+                mode: ProviderMode::Hold,
+                ..ProviderSettings::default()
+            });
+        let view = EligibilityView::empty();
+
+        let no_auction = RequestFacts {
+            runs_auction: false,
+            ..facts_for_writer()
+        };
+        let auction = RequestFacts {
+            runs_auction: true,
+            ..facts_for_writer()
+        };
+        let stager = RequestFacts {
+            writer: false,
+            runs_auction: true,
+            ..facts_for_writer()
+        };
+
+        assert!(
+            fixture.is_eligible(&view, &no_auction, Phase::AfterSend),
+            "should move after send without an auction"
+        );
+        assert!(
+            !fixture.is_eligible(&view, &no_auction, Phase::Hold),
+            "should not hold without an auction"
+        );
+        assert!(
+            fixture.is_eligible(&view, &auction, Phase::Hold),
+            "control: should hold before an auction"
+        );
+        assert!(
+            !fixture.is_eligible(&view, &auction, Phase::AfterSend),
+            "should not also run after send"
+        );
+        assert!(
+            !fixture.is_eligible(&view, &stager, Phase::Hold),
+            "should never run on a stager"
+        );
+    }
+
+    #[test]
+    fn after_send_provider_never_runs_in_hold() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let view = EligibilityView::empty();
+        for runs_auction in [true, false] {
+            let facts = RequestFacts {
+                runs_auction,
+                ..facts_for_writer()
+            };
+            assert!(
+                !fixture.is_eligible(&view, &facts, Phase::Hold),
+                "should not hold an after-send provider (auction: {runs_auction})"
+            );
+            assert!(
+                fixture.is_eligible(&view, &facts, Phase::AfterSend),
+                "control: should run it after send (auction: {runs_auction})"
+            );
+        }
+    }
+
+    #[test]
+    fn narrowed_away_source_is_never_a_kind() {
+        let provider = fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let catalog = ProviderCatalog::new(vec![provider.clone()], BTreeMap::new())
+            .with_narrowing(BTreeMap::from([(pid("p"), vec![source("a.example.com")])]));
+        let fixture = EligibilityFixture::with_catalog(&provider, catalog);
+
+        assert_eq!(
+            fixture.kinds(&EligibilityView::empty()),
+            kinds_of(&[("a.example.com", ResolveKind::Initial)]),
+            "should leave out a source the operator narrowed away"
+        );
+    }
+
+    #[test]
+    fn kinds_the_provider_does_not_list_are_left_out() {
+        let provider = custom_provider(
+            "p",
+            &["a.example.com", "b.example.com"],
+            Resolves::new().with_kinds([ResolveKind::Initial]),
+            ConsentPolicy::eid_persistence_only(),
+        );
+        let fixture = EligibilityFixture::owning(&provider, &["a.example.com", "b.example.com"]);
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-a", None, 10),
+        );
+
+        assert_eq!(
+            fixture.kinds(&view),
+            kinds_of(&[("b.example.com", ResolveKind::Initial)]),
+            "should leave out the Refresh source of an Initial-only provider"
+        );
+    }
+
+    #[test]
+    fn source_whose_needs_are_unavailable_is_left_out() {
+        let provider = custom_provider(
+            "p",
+            &["a.example.com"],
+            Resolves::new()
+                .with_needs_for(ResolveKind::Initial, [Input::ClientIp])
+                .with_needs_for(ResolveKind::Refresh, [Input::HashedEmail]),
+            ConsentPolicy::eid_persistence_only(),
+        );
+        let fixture = EligibilityFixture::owning(&provider, &["a.example.com"]);
+        let initial = EligibilityView::empty();
+        let mut refresh = EligibilityView::empty();
+        refresh.set_record_for_test(
+            &source("a.example.com"),
+            record_for_test("example-a", None, 10),
+        );
+        let mut without_email = facts_for_writer();
+        without_email.available_inputs.remove(&Input::HashedEmail);
+        let mut without_address = facts_for_writer();
+        without_address.available_inputs.remove(&Input::ClientIp);
+
+        assert_eq!(
+            fixture.skip_reason(&refresh, &without_email),
+            SkipReason::NoSourceDue,
+            "should leave out a Refresh whose needs are missing"
+        );
+        assert_eq!(
+            fixture.skip_reason(&initial, &without_address),
+            SkipReason::NoSourceDue,
+            "should leave out an Initial whose needs are missing"
+        );
+        assert!(
+            fixture.is_eligible(&initial, &without_email, Phase::AfterSend),
+            "control: the Initial should not need the email"
+        );
+        assert!(
+            fixture.is_eligible(&refresh, &facts_for_writer(), Phase::AfterSend),
+            "control: should run when the inputs are available"
+        );
+    }
+
+    #[test]
+    fn future_n_and_sticky_opt_out_block() {
+        let fixture = EligibilityFixture::new(&fixed_provider("p", &["a.example.com"]));
+        let facts = facts_for_writer();
+
+        let mut waiting = EligibilityView::empty();
+        waiting.set_next_for_test("p", 1_001);
+        assert_eq!(
+            fixture.skip_reason(&waiting, &facts),
+            SkipReason::NotYetEligible,
+            "should wait for n"
+        );
+
+        let mut due = EligibilityView::empty();
+        due.set_next_for_test("p", 1_000);
+        assert!(
+            fixture.is_eligible(&due, &facts, Phase::AfterSend),
+            "control: should run once n has passed"
+        );
+
+        let mut opted_out = EligibilityView::empty();
+        opted_out.set_opt_out_for_test("p", 500, None);
+        assert_eq!(
+            fixture.skip_reason(&opted_out, &facts),
+            SkipReason::OptedOut,
+            "should not call a provider the visitor opted out of"
+        );
+    }
+
+    #[test]
+    fn a_clear_watermark_lifts_the_opt_out_it_saw() {
+        let mut view = EligibilityView::empty();
+        view.set_opt_out_for_test("p", 500, Some(600));
+        assert!(
+            !view.is_opted_out(&pid("p")),
+            "should lift the opt-out when oc is later than o.at"
+        );
+
+        view.set_opt_out_for_test("p", 500, Some(500));
+        assert!(
+            !view.is_opted_out(&pid("p")),
+            "should lift the opt-out when oc names it as the opt-out the clear saw"
+        );
+
+        view.set_opt_out_for_test("p", 500, Some(400));
+        assert!(
+            view.is_opted_out(&pid("p")),
+            "should keep the opt-out when oc is older"
+        );
+        assert!(
+            !view.is_opted_out(&pid("other")),
+            "should not opt out a provider with no state"
+        );
+    }
+
+    #[test]
+    fn view_reads_only_the_kv_row() {
+        let mut entry = KvEntry::new(&allowing_consent(), None, 10, "example.com");
+        entry.ids.insert(
+            "a.example.com".to_owned(),
+            record_for_test("example-a", Some("p"), 900),
+        );
+        entry.ps.insert(
+            "p".to_owned(),
+            crate::ec::kv_types::KvProviderState {
+                n: Some(2_000),
+                f: 2,
+                o: Some(KvOptOut {
+                    at: 5,
+                    fp: "1".to_owned(),
+                }),
+                oc: Some(4),
+                iv: vec!["0123456789abcdef".to_owned()],
+                ov: Vec::new(),
+                st: None,
+            },
+        );
+
+        let view = EligibilityView::from_kv(&entry);
+
+        assert!(
+            view.record(&source("a.example.com")).is_some(),
+            "should hold the source's whole record"
+        );
+        assert_eq!(view.failures(&pid("p")), 2, "should hold f");
+        assert_eq!(view.next_eligible(&pid("p")), Some(2_000), "should hold n");
+        assert!(view.is_opted_out(&pid("p")), "should hold o and oc");
+    }
+
+    // Fingerprint
+
+    #[test]
+    fn fingerprint_bits_is_a_plain_hex_bitmask_and_changes_with_each_signal() {
+        let policy = ConsentPolicy::strict()
+            .with_tcf_purposes([2, 4, 10])
+            .with_tcf_vendor(5);
+        let signals = PolicySignals::default();
+        let gdpr = test_consent_gdpr_without_vendor(6);
+        let bits = |consent: &ConsentContext, signals: PolicySignals| {
+            let value = fingerprint_bits(&policy, consent, signals);
+            assert!(
+                value.len() <= 16 && value == value.to_lowercase(),
+                "should be at most 16 lowercase hex digits"
+            );
+            u64::from_str_radix(&value, 16).expect("should parse as hex")
+        };
+
+        // Purposes 1, 2, 4 and 10 are read and granted: bits 0, 1, 3, 9.
+        // Vendor 5 is granted: bit 10. A TC string was decoded: bit 16.
+        let control = bits(&gdpr, signals);
+        assert_eq!(
+            control,
+            (1 << 0) | (1 << 1) | (1 << 3) | (1 << 9) | (1 << 10) | (1 << 16),
+            "should set one bit per granted purpose, the vendor bit and the TCF bit"
+        );
+
+        let mut without_purpose_two = gdpr.clone();
+        if let Some(tcf) = without_purpose_two.tcf.as_mut() {
+            tcf.purpose_consents[1] = false;
+        }
+        assert_eq!(
+            bits(&without_purpose_two, signals),
+            control & !(1 << 1),
+            "should clear only bit 1 when purpose 2 is not granted"
+        );
+
+        let without_vendor = test_consent_gdpr_without_vendor(5);
+        assert_eq!(
+            bits(&without_vendor, signals),
+            control & !(1 << 10),
+            "should clear only the vendor bit when the vendor is not granted"
+        );
+
+        let mut sale = gdpr.clone();
+        sale.us_privacy = Some(decode_us_privacy("1YYN").expect("should decode us_privacy"));
+        assert_eq!(
+            bits(&sale, signals),
+            control | (1 << 11),
+            "should set the sale bit for a US Privacy sale opt-out"
+        );
+
+        let mut gpp_sale = gdpr.clone();
+        gpp_sale.gpp = Some(GppConsent {
+            version: 1,
+            section_ids: vec![7],
+            eu_tcf: None,
+            us_sale_opt_out: Some(true),
+            us_sharing_opt_out: None,
+            us_targeted_advertising_opt_out: None,
+            us_gpc: None,
+            us_known_child: None,
+            us_privacy_section: None,
+            us_section_decode_failed: false,
+        });
+        assert_eq!(
+            bits(&gpp_sale, signals),
+            control | (1 << 11),
+            "should set the sale bit for a GPP sale opt-out"
+        );
+
+        let mut gpc = gdpr.clone();
+        gpc.gpc = true;
+        assert_eq!(
+            bits(&gpc, signals),
+            control | (1 << 12),
+            "should set the GPC bit"
+        );
+
+        assert_eq!(
+            bits(&gdpr, PolicySignals { dnt: true }),
+            control | (1 << 13),
+            "should set the DNT bit"
+        );
+    }
+
+    #[test]
+    fn fingerprint_bits_leaves_a_relaxed_signal_at_zero_and_never_moves_a_bit() {
+        let strict = resolver_policy();
+        let relaxed = resolver_policy()
+            .allowing_gpc()
+            .allowing_dnt()
+            .allowing_us_opt_out(UsOptOut::Sale);
+        let mut consent = allowing_consent();
+        consent.gpc = true;
+        let signals = PolicySignals { dnt: true };
+
+        assert_eq!(
+            fingerprint_bits(&strict, &consent, signals),
+            "3000",
+            "should set the GPC and DNT bits at positions 12 and 13"
+        );
+        assert_eq!(
+            fingerprint_bits(&relaxed, &consent, signals),
+            "0",
+            "should leave a relaxed signal at zero"
+        );
+        assert_eq!(
+            fingerprint_bits(
+                &resolver_policy().with_tcf_purposes([7]),
+                &consent,
+                PolicySignals::default()
+            ),
+            "1000",
+            "should keep GPC at bit 12 whatever purposes the policy reads"
+        );
+    }
+
+    // Section 8 rows
+
+    #[test]
+    fn no_match_waits_retry_in_capped_at_seven_days() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let fixture = OutcomeFixture::new();
+        let context = fixture.context_at(1_000);
+        let default = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::no_match()),
+            &EligibilityView::empty(),
+            &context,
+        );
+        assert_eq!(
+            default.state.n,
+            Some(1_000 + 86_400),
+            "should wait the 24 h default"
+        );
+        let long = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(
+                Resolution::no_match().with_retry_in(Duration::from_secs(30 * 86_400)),
+            ),
+            &EligibilityView::empty(),
+            &context,
+        );
+        assert_eq!(
+            long.state.n,
+            Some(1_000 + 7 * 86_400),
+            "should cap the wait at 7 days"
+        );
+    }
+
+    #[test]
+    fn found_resets_failures_and_retry_in_applies_to_every_resolution() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 3);
+        view.set_record_for_test(&a, record_for_test("example-old", Some("p"), 900));
+        let fixture = OutcomeFixture::new();
+        let context = fixture.context_at(1_000);
+
+        let found = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(
+                Resolution::found([ResolvedEid::new(&a, ResolvedUid::new("u"))])
+                    .with_retry_in(Duration::from_secs(600)),
+            ),
+            &view,
+            &context,
+        );
+        let invalidated = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(
+                Resolution::invalidate(&a).with_retry_in(Duration::from_secs(600)),
+            ),
+            &view,
+            &context,
+        );
+
+        assert_eq!(
+            found.state.f,
+            Some(0),
+            "should reset the failure count on found"
+        );
+        assert_eq!(
+            found.state.n,
+            Some(1_000 + 600),
+            "should wait at least retry_in after found"
+        );
+        assert_eq!(
+            invalidated.changes.len(),
+            1,
+            "control: should remove the stored record"
+        );
+        assert_eq!(
+            invalidated.state.n,
+            Some(1_000 + 600),
+            "should raise invalidate's n = now to retry_in"
+        );
+    }
+
+    #[test]
+    fn found_without_retry_in_sets_no_n() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("u"),
+            )])),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.state.n, None,
+            "should leave the refresh schedule to the record's own timing"
+        );
+    }
+
+    #[test]
+    fn input_failure_backs_off_exponentially_to_a_day() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let fixture = OutcomeFixture::new();
+        let context = fixture.context_at(1_000);
+        let cases = [
+            (0, 1, 3_600),
+            (1, 2, 7_200),
+            (4, 5, 57_600),
+            (5, 6, 86_400),
+            (u32::MAX, u32::MAX, 86_400),
+        ];
+        for (before, after, wait) in cases {
+            let mut view = EligibilityView::empty();
+            view.set_failures_for_test("p", before);
+            let changes = outcome_to_changes(
+                provider.as_ref(),
+                CallOutcome::InputFailure,
+                &view,
+                &context,
+            );
+            assert_eq!(
+                changes.state.f,
+                Some(after),
+                "should count the failure (f was {before})"
+            );
+            assert_eq!(
+                changes.state.n,
+                Some(1_000 + wait),
+                "should back off min(1 h x 2^(f-1), 24 h) (f was {before})"
+            );
+        }
+    }
+
+    #[test]
+    fn transport_failure_backs_off_to_an_hour() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 5);
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::TransportFailure,
+            &view,
+            &fixture.context_at(1_000),
+        );
+        assert_eq!(changes.state.f, Some(6), "should count the failure");
+        assert_eq!(
+            changes.state.n,
+            Some(1_000 + 3_600),
+            "should back off min(5 min x 2^5, 1 h) = 1 h"
+        );
+
+        let first = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::TransportFailure,
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+        assert_eq!(
+            first.state.n,
+            Some(1_000 + 300),
+            "should start at 5 minutes"
+        );
+    }
+
+    #[test]
+    fn hold_cut_off_waits_hold_retry_without_counting_a_failure() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 2);
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::HoldCutOff,
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.state.n,
+            Some(1_000 + 300),
+            "should wait hold_retry_sec"
+        );
+        assert_eq!(changes.state.f, None, "should not count a failure");
+        assert!(changes.changes.is_empty(), "should change no stored ID");
+    }
+
+    #[test]
+    fn skip_waits_refresh_after() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let fixture = OutcomeFixture::new().with_settings(ProviderSettings {
+            refresh_after_sec: 777,
+            ..ProviderSettings::default()
+        });
+        for outcome in [CallOutcome::Skipped, CallOutcome::InputUnavailable] {
+            let changes = outcome_to_changes(
+                provider.as_ref(),
+                outcome,
+                &EligibilityView::empty(),
+                &fixture.context_at(1_000),
+            );
+            assert_eq!(
+                changes.state.n,
+                Some(1_000 + 777),
+                "should wait refresh_after_sec"
+            );
+            assert_eq!(changes.state.f, None, "should not count a failure");
+        }
+    }
+
+    #[test]
+    fn burst_cap_waits_one_window_and_never_counts_a_failure() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 2);
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::BurstCapped,
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(changes.state.n, Some(1_060), "should wait one 60 s window");
+        assert_eq!(changes.state.f, None, "should never count a failure");
+    }
+
+    #[test]
+    fn breaker_open_and_not_dispatched_change_nothing() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let fixture = OutcomeFixture::new();
+        for outcome in [CallOutcome::BreakerOpen, CallOutcome::NotDispatched] {
+            let changes = outcome_to_changes(
+                provider.as_ref(),
+                outcome,
+                &EligibilityView::empty(),
+                &fixture.context_at(1_000),
+            );
+            assert_eq!(
+                changes,
+                OutcomeChanges::default(),
+                "should change nothing when the call was not made"
+            );
+        }
+    }
+
+    #[test]
+    fn invalid_state_clears_state_and_keeps_f() {
+        let provider = stateful_fixed_provider("p", &["a.example.com"]);
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 2);
+        let fixture = OutcomeFixture::new().with_settings(ProviderSettings {
+            refresh_after_sec: 777,
+            ..ProviderSettings::default()
+        });
+        let context = fixture.context_at(1_000);
+
+        let bare = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::InvalidState(None),
+            &view,
+            &context,
+        );
+        assert_eq!(bare.state.st, StateUpdate::Clear, "should clear st");
+        assert_eq!(bare.state.f, None, "should keep f");
+        assert_eq!(
+            bare.state.n,
+            Some(1_000 + 777),
+            "should wait refresh_after_sec"
+        );
+
+        let with_result = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::InvalidState(Some(
+                Resolution::no_match().with_retry_in(Duration::from_secs(60)),
+            )),
+            &view,
+            &context,
+        );
+        let result = with_result
+            .result
+            .expect("should carry the result's own state change");
+        assert_eq!(result.state.st, StateUpdate::Clear, "should clear st");
+        assert_eq!(result.state.f, None, "should keep f");
+        assert_eq!(
+            result.state.n,
+            Some(1_000 + 60),
+            "should keep the n the result set"
+        );
+    }
+
+    #[test]
+    fn oversized_state_rejects_positive_part_but_keeps_removals() {
+        let provider = stateful_fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&b, record_for_test("example-old", Some("p"), 900));
+        let resolution = Resolution::found([ResolvedEid::new(&a, ResolvedUid::new("example-a"))])
+            .also_invalidate(&b)
+            .replacing_state(&"x".repeat(2_000));
+
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(resolution),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert!(
+            changes.result.is_none(),
+            "should store no ID and no state change"
+        );
+        assert_eq!(
+            changes.changes.len(),
+            1,
+            "should keep only the invalidation"
+        );
+        assert!(
+            matches!(&changes.changes[0], PartnerIdChange::OwnerRemove { source, .. } if *source == b),
+            "should still apply the invalidation"
+        );
+        assert_eq!(
+            changes.state.st,
+            StateUpdate::Keep,
+            "should keep the old state"
+        );
+        assert_eq!(changes.state.f, Some(1), "should handle it as Malformed");
+        assert_eq!(
+            changes.state.n,
+            Some(1_000 + 3_600),
+            "should back off min(1 h x 2^0, 24 h)"
+        );
+    }
+
+    #[test]
+    fn opted_out_removes_what_it_wrote_and_clears_state() {
+        let provider = fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let c = source("c.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, record_for_test("example-a", Some("p"), 900));
+        view.set_record_for_test(&b, record_for_test("example-b", None, 900));
+        view.set_record_for_test(&c, record_for_test("example-c", Some("p"), 900));
+        let fixture = OutcomeFixture::new().with_fingerprint("5");
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::opted_out()),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes,
+            vec![
+                PartnerIdChange::WriterRemove {
+                    source: a,
+                    writer: pid("p"),
+                },
+                PartnerIdChange::WriterRemove {
+                    source: c,
+                    writer: pid("p"),
+                },
+            ],
+            "should remove every record the provider wrote, claimed or not, and no browser record"
+        );
+        assert_eq!(
+            changes.state.opt_out,
+            Some(KvOptOut {
+                at: 1_000,
+                fp: "5".to_owned()
+            }),
+            "should record the opt-out"
+        );
+        assert_eq!(changes.state.st, StateUpdate::Clear, "should clear st");
+    }
+
+    #[test]
+    fn capture_only_opt_out_also_removes_browser_records_of_its_sources() {
+        let provider = fixed_capture_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let c = source("c.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, record_for_test("example-a", None, 900));
+        view.set_record_for_test(&b, record_for_test("example-b", Some("q"), 900));
+        view.set_record_for_test(&c, record_for_test("example-c", None, 900));
+        let catalog = ProviderCatalog::new(vec![provider.clone()], BTreeMap::new());
+        let fixture = OutcomeFixture::new().with_catalog(catalog);
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::opted_out()),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes,
+            vec![PartnerIdChange::WriterRemove {
+                source: a,
+                writer: pid("p"),
+            }],
+            "should remove the browser record of its own source only"
+        );
+    }
+
+    #[test]
+    fn opted_out_records_the_fingerprint_of_the_current_consent() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let policy = resolver_policy();
+        let mut consent = allowing_consent();
+        consent.gpc = true;
+        let fingerprint = fingerprint_bits(&policy, &consent, PolicySignals::default());
+        let fixture = OutcomeFixture::new().with_fingerprint(&fingerprint);
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::opted_out()),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.state.opt_out,
+            Some(KvOptOut {
+                at: 1_000,
+                fp: "1000".to_owned()
+            }),
+            "should store the fingerprint of the consent in force"
+        );
+    }
+
+    #[test]
+    fn stateful_opt_out_goes_into_the_result_with_its_removals_outside() {
+        let provider = stateful_fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, record_for_test("example-a", Some("p"), 900));
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::opted_out()),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(changes.changes.len(), 1, "should list the removal");
+        let result = changes
+            .result
+            .expect("should carry the opt-out in one result");
+        assert!(result.ids.is_empty(), "should hold no positive change");
+        assert!(result.state.opt_out.is_some(), "should record the opt-out");
+        assert_eq!(result.state.st, StateUpdate::Clear, "should clear st");
+    }
+
+    #[test]
+    fn invalidate_removes_the_set_and_sets_n_now() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let record = record_for_test("example-a", Some("p"), 900);
+        let expected = record_revision(&record);
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, record);
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::invalidate(&a)),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes,
+            vec![PartnerIdChange::OwnerRemove {
+                source: a,
+                provider: pid("p"),
+                expected,
+            }],
+            "should remove the set at the revision read"
+        );
+        assert_eq!(changes.state.n, Some(1_000), "should set n = now");
+        assert_eq!(changes.state.f, None, "should not touch f");
+    }
+
+    #[test]
+    fn invalidating_a_source_without_a_record_makes_no_change() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::invalidate(&a)),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes,
+            OutcomeChanges::default(),
+            "should change nothing for a source with no record"
+        );
+    }
+
+    #[test]
+    fn invalidating_an_unclaimed_source_makes_no_change() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let c = source("c.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&c, record_for_test("example-c", Some("q"), 900));
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::invalidate(&c)),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert!(
+            changes.changes.is_empty(),
+            "should not let a provider remove a source it does not claim"
+        );
+    }
+
+    // Entry sets
+
+    #[test]
+    fn found_with_several_entries_becomes_one_whole_set_per_source() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let resolution = Resolution::found([
+            ResolvedEid::new(&a, ResolvedUid::new("example-a").with_atype(1))
+                .with_uid(
+                    ResolvedUid::new("example-b")
+                        .with_atype(3)
+                        .with_ext(json!({ "stype": "ppuid" })),
+                )
+                .with_inserter("example.com")
+                .with_mm(3),
+            ResolvedEid::new(&a, ResolvedUid::new("example-c")).with_matcher("partner.example.com"),
+        ]);
+
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(resolution),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes.len(),
+            1,
+            "should make one change for the one source"
+        );
+        let record = positive_record(&changes.changes[0]).expect("should be a positive change");
+        assert_eq!(record.w.as_deref(), Some("p"), "should name the writer");
+        assert_eq!(record.at, Some(1_000), "should stamp the write time");
+        assert_eq!(
+            record.eids,
+            vec![
+                KvEid {
+                    uids: vec![
+                        KvUid {
+                            id: "example-a".to_owned(),
+                            atype: Some(1),
+                            ext: None
+                        },
+                        KvUid {
+                            id: "example-b".to_owned(),
+                            atype: Some(3),
+                            ext: Some(json!({ "stype": "ppuid" }))
+                        },
+                    ],
+                    inserter: Some("example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(3),
+                    ext: None,
+                },
+                KvEid {
+                    uids: vec![KvUid {
+                        id: "example-c".to_owned(),
+                        atype: None,
+                        ext: None
+                    }],
+                    inserter: None,
+                    matcher: Some("partner.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ],
+            "should store the whole set, in the order the provider returned it"
+        );
+    }
+
+    #[test]
+    fn one_uid_result_without_eid_fields_becomes_a_one_entry_record() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-a"),
+            )])),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        let record = positive_record(&changes.changes[0]).expect("should be a positive change");
+        assert_eq!(
+            record.eids,
+            KvPartnerId::new("example-a").eids,
+            "should write the shape browser ingest writes"
+        );
+        assert_eq!(record.rv, None, "should leave the revision to the merge");
+    }
+
+    #[test]
+    fn owned_source_becomes_owner_write_and_unowned_becomes_fill_missing() {
+        let provider = fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let catalog = ProviderCatalog::new(
+            vec![provider.clone()],
+            BTreeMap::from([(a.clone(), pid("p"))]),
+        );
+        let stored = record_for_test("example-old", Some("p"), 900);
+        let expected = record_revision(&stored);
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, stored);
+        let fixture = OutcomeFixture::new().with_catalog(catalog);
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([
+                ResolvedEid::new(&a, ResolvedUid::new("example-a")),
+                ResolvedEid::new(&b, ResolvedUid::new("example-b")),
+            ])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert!(
+            changes.changes.iter().any(|change| matches!(
+                change,
+                PartnerIdChange::OwnerWrite { source, expected: Some(revision), .. }
+                    if *source == a && *revision == expected
+            )),
+            "should write the owned source at the revision read"
+        );
+        assert!(
+            changes.changes.iter().any(|change| matches!(
+                change,
+                PartnerIdChange::FillMissing { source, .. } if *source == b
+            )),
+            "should only fill the unowned source"
+        );
+
+        let fresh = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-a"),
+            )])),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+        assert!(
+            matches!(
+                &fresh.changes[0],
+                PartnerIdChange::OwnerWrite { expected: None, .. }
+            ),
+            "should expect no record when the owned source had none"
+        );
+    }
+
+    #[test]
+    fn stateful_found_goes_into_one_provider_result_with_expected_state() {
+        let provider = stateful_fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let expected_state = StateRevision::of(Some(&json!({ "token": "example-old" })));
+        let fixture = OutcomeFixture::new().with_expected_state(expected_state.clone());
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(
+                Resolution::found([ResolvedEid::new(&a, ResolvedUid::new("example-a"))])
+                    .replacing_state(&json!({ "token": "example-new" })),
+            ),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert!(
+            changes.changes.is_empty(),
+            "should hold no stand-alone change"
+        );
+        assert_eq!(
+            changes.state,
+            ProviderStateChange::default(),
+            "should hold no stand-alone state"
+        );
+        let result = changes.result.expect("should produce one result");
+        assert_eq!(result.provider, pid("p"), "should name the provider");
+        assert_eq!(result.ids.len(), 1, "should carry the positive change");
+        assert_eq!(
+            result.state.st,
+            StateUpdate::Replace(json!({ "token": "example-new" })),
+            "should replace st"
+        );
+        assert_eq!(result.state.f, Some(0), "should reset f in the result");
+        assert_eq!(
+            result.expected_state,
+            Some(expected_state),
+            "should expect the state revision the call read"
+        );
+    }
+
+    #[test]
+    fn unclaimed_source_entries_are_discarded() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let c = source("c.example.com");
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([
+                ResolvedEid::new(&a, ResolvedUid::new("example-a")),
+                ResolvedEid::new(&c, ResolvedUid::new("example-c")),
+            ])),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes.len(),
+            1,
+            "should keep only the claimed source"
+        );
+        assert!(
+            matches!(&changes.changes[0], PartnerIdChange::FillMissing { source, .. } if *source == a),
+            "should drop the source the provider does not claim"
+        );
+    }
+
+    #[test]
+    fn found_naming_only_unclaimed_sources_is_malformed() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let c = source("c.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 3);
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &c,
+                ResolvedUid::new("example-c"),
+            )])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert!(changes.changes.is_empty(), "should store nothing");
+        assert_eq!(changes.state.f, Some(4), "should count a failure");
+        assert_eq!(
+            changes.state.n,
+            Some(1_000 + 28_800),
+            "should back off min(1 h x 2^3, 24 h)"
+        );
+    }
+
+    #[test]
+    fn one_claimed_and_one_unclaimed_source_still_resets_failures() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let c = source("c.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 3);
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([
+                ResolvedEid::new(&a, ResolvedUid::new("example-a")),
+                ResolvedEid::new(&c, ResolvedUid::new("example-c")),
+            ])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(changes.changes.len(), 1, "should store the claimed source");
+        assert_eq!(changes.state.f, Some(0), "should reset f on found");
+    }
+
+    #[test]
+    fn oversized_set_from_a_stateless_provider_leaves_only_that_source_unchanged() {
+        let provider = fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let mut entries = large_entries(&a);
+        entries.push(ResolvedEid::new(&b, ResolvedUid::new("example-b")));
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found(entries)),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(changes.changes.len(), 1, "should keep the other source");
+        assert!(
+            matches!(&changes.changes[0], PartnerIdChange::FillMissing { source, .. } if *source == b),
+            "should leave the oversized source as it is"
+        );
+        assert_eq!(changes.state.f, Some(0), "should still count as found");
+    }
+
+    #[test]
+    fn oversized_set_from_a_stateful_provider_rejects_the_positive_part_and_keeps_removals() {
+        let provider = stateful_fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&b, record_for_test("example-old", Some("p"), 900));
+        let resolution = Resolution::found(large_entries(&a))
+            .also_invalidate(&b)
+            .replacing_state(&json!({ "token": "example-token" }));
+
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(resolution),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert!(
+            changes.result.is_none(),
+            "should store no ID and no state change"
+        );
+        assert!(
+            changes.changes.iter().any(
+                |change| matches!(change, PartnerIdChange::OwnerRemove { source, .. } if *source == b)
+            ),
+            "should still apply the invalidation"
+        );
+        assert!(
+            changes
+                .changes
+                .iter()
+                .all(|change| positive_record(change).is_none()),
+            "should store no positive change"
+        );
+        assert!(
+            matches!(changes.state.st, StateUpdate::Keep),
+            "should keep the old state"
+        );
+        assert_eq!(changes.state.f, Some(1), "should handle it as Malformed");
+        assert_eq!(
+            changes.state.n,
+            Some(1_000 + 3_600),
+            "should back off min(1 h x 2^0, 24 h)"
+        );
+    }
+
+    #[test]
+    fn result_whose_every_set_is_discarded_is_malformed() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 1);
+        view.set_record_for_test(
+            &source("b.example.com"),
+            record_for_test("example-b", Some("p"), 900),
+        );
+        let fixture = OutcomeFixture::new();
+
+        let oversized = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(
+                Resolution::found(large_entries(&a)).also_invalidate(&source("b.example.com")),
+            ),
+            &view,
+            &fixture.context_at(1_000),
+        );
+        let dropped = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("  "),
+            )])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        for (name, changes) in [("oversized", &oversized), ("dropped", &dropped)] {
+            assert_eq!(changes.state.f, Some(2), "should count a failure ({name})");
+            assert_eq!(
+                changes.state.n,
+                Some(1_000 + 7_200),
+                "should back off min(1 h x 2^1, 24 h) ({name})"
+            );
+            assert!(
+                changes
+                    .changes
+                    .iter()
+                    .all(|change| positive_record(change).is_none()),
+                "should store no positive change ({name})"
+            );
+        }
+        assert_eq!(
+            oversized.changes.len(),
+            1,
+            "should still apply the removal of an oversized result"
+        );
+    }
+
+    #[test]
+    fn invalidating_a_set_carries_no_hash_until_it_applies() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+        let mut record = record_for_test("example-0-0", Some("p"), 900);
+        record.eids = (0..4)
+            .map(|chunk| KvEid {
+                uids: (0..8)
+                    .map(|index| KvUid {
+                        id: format!("example-{chunk}-{index}"),
+                        atype: None,
+                        ext: None,
+                    })
+                    .collect(),
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            })
+            .collect();
+        let expected = record_revision(&record);
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, record);
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::invalidate(&a)),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes.len(),
+            1,
+            "should make one removal for the 32-UID set"
+        );
+        assert!(
+            matches!(
+                &changes.changes[0],
+                PartnerIdChange::OwnerRemove { source, provider, expected: revision }
+                    if *source == a && provider.as_str() == "p" && *revision == expected
+            ),
+            "should remove the whole set at the revision it read"
+        );
+        assert_eq!(changes.state.n, Some(1_000), "should set n = now");
+    }
+
+    #[test]
+    fn expiring_set_without_expiry_keeps_stored_exp_only_when_unchanged() {
+        let provider = expiring_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let catalog = ProviderCatalog::new(
+            vec![provider.clone()],
+            BTreeMap::from([(a.clone(), pid("p"))]),
+        );
+        let fixture = OutcomeFixture::new().with_catalog(catalog);
+        let mut stored = record_for_test("example-a", Some("p"), 900);
+        stored.exp = Some(5_000);
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, stored);
+
+        let unchanged = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-a"),
+            )])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+        let changed = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-other"),
+            )])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+        let with_expiry = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-other"),
+            )
+            .with_expires_in(Duration::from_secs(60))])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        let kept = positive_record(&unchanged.changes[0]).expect("should store the unchanged set");
+        assert_eq!(kept.exp, Some(5_000), "should keep the stored exp");
+        assert_eq!(unchanged.state.f, Some(0), "should count as found");
+
+        assert!(
+            changed.changes.is_empty(),
+            "should discard a changed set that carries no expiry"
+        );
+        assert_eq!(
+            changed.state.f,
+            Some(1),
+            "should handle a result whose every set is discarded as Malformed"
+        );
+
+        let fresh = positive_record(&with_expiry.changes[0]).expect("should store the set");
+        assert_eq!(fresh.exp, Some(1_060), "should use the result's own expiry");
+    }
+
+    #[test]
+    fn result_without_a_source_leaves_its_set_alone() {
+        let provider = fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&b, record_for_test("example-b", Some("p"), 900));
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-a"),
+            )])),
+            &view,
+            &fixture.context_at(1_000),
+        );
+
+        assert_eq!(
+            changes.changes.len(),
+            1,
+            "should change only the named source"
+        );
+        assert!(
+            matches!(&changes.changes[0], PartnerIdChange::FillMissing { source, .. } if *source == a),
+            "should leave the source the result did not name"
+        );
+    }
+
+    #[test]
+    fn record_carries_the_earliest_times_of_its_set() {
+        let provider = stateful_fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+        let resolution = Resolution::found([
+            ResolvedEid::new(&a, ResolvedUid::new("example-a"))
+                .with_expires_in(Duration::from_secs(600))
+                .with_refresh_in(Duration::from_secs(300))
+                .with_refresh_until(UnixTime::from_secs(9_000)),
+            ResolvedEid::new(&a, ResolvedUid::new("example-b"))
+                .with_expires_in(Duration::from_secs(60))
+                .with_refresh_in(Duration::from_secs(900))
+                .with_refresh_until(UnixTime::from_secs(8_000)),
+        ]);
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(resolution),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        let result = changes.result.expect("should produce one result");
+        let record = positive_record(&result.ids[0]).expect("should be a positive change");
+        assert_eq!(record.exp, Some(1_060), "should keep the earliest expiry");
+        assert_eq!(record.ra, Some(1_300), "should keep the earliest refresh");
+        assert_eq!(
+            record.ru,
+            Some(8_000),
+            "should keep the earliest refresh limit"
+        );
+    }
+
+    #[test]
+    fn refresh_until_is_ignored_for_a_stateless_provider() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(
+                &a,
+                ResolvedUid::new("example-a"),
+            )
+            .with_refresh_until(UnixTime::from_secs(9_000))])),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        let record = positive_record(&changes.changes[0]).expect("should be a positive change");
+        assert_eq!(
+            record.ru, None,
+            "should ignore refresh_until without private state"
+        );
+    }
+
+    #[test]
+    fn duplicate_entries_collapse_into_one_entry() {
+        // A duplicate entry is dropped, so the kept set has one entry.
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+
+        let changes = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([
+                ResolvedEid::new(&a, ResolvedUid::new("example-a")),
+                ResolvedEid::new(&a, ResolvedUid::new("example-a")),
+            ])),
+            &EligibilityView::empty(),
+            &fixture.context_at(1_000),
+        );
+
+        let record = positive_record(&changes.changes[0]).expect("should be a positive change");
+        assert_eq!(
+            record.eids,
+            vec![one_entry("example-a")],
+            "should drop the duplicate"
+        );
+    }
+
+    // Dispatch
+
+    struct RecordingLimiter {
+        exceeded: bool,
+        fail: bool,
+        keys: std::sync::Mutex<Vec<String>>,
+    }
+
+    impl RecordingLimiter {
+        fn new(exceeded: bool, fail: bool) -> Self {
+            Self {
+                exceeded,
+                fail,
+                keys: std::sync::Mutex::new(Vec::new()),
+            }
+        }
+    }
+
+    impl RateLimiter for RecordingLimiter {
+        fn exceeded(
+            &self,
+            key: &str,
+            _hourly_limit: u32,
+        ) -> Result<bool, Report<crate::error::TrustedServerError>> {
+            self.keys
+                .lock()
+                .expect("should lock the keys")
+                .push(key.to_owned());
+            if self.fail {
+                return Err(Report::new(crate::error::TrustedServerError::Proxy {
+                    message: "limiter unavailable".to_owned(),
+                }));
+            }
+            Ok(self.exceeded)
+        }
+
+        fn record(&self, _key: &str) -> Result<(), Report<crate::error::TrustedServerError>> {
+            Ok(())
+        }
+
+        fn count(&self, _key: &str) -> Result<u32, Report<crate::error::TrustedServerError>> {
+            Ok(0)
+        }
+    }
+
+    /// Providers, a fake client and everything `dispatch` reads.
+    struct DispatchFixture {
+        settings: Settings,
+        catalog: ProviderCatalog,
+        keys: IdentityKeys,
+        client: Arc<FakeHttpClient>,
+        backend: Arc<FakeBackend>,
+        services: RuntimeServices,
+    }
+
+    impl DispatchFixture {
+        fn new(providers: Vec<Arc<dyn IdentityProvider>>) -> Self {
+            let mut settings = create_test_settings();
+            // One fixture client counts the sends of every run, where a real
+            // request starts from zero, so the budget tests set their own.
+            settings.ec.identity.max_backend_requests = usize::MAX;
+            let client = Arc::new(FakeHttpClient::new());
+            let backend = Arc::new(FakeBackend::new());
+            let services = fake_services(&client, &backend);
+            Self {
+                keys: IdentityKeys::from_settings(&settings),
+                catalog: ProviderCatalog::new(providers, BTreeMap::new()),
+                settings,
+                client,
+                backend,
+                services,
+            }
+        }
+
+        fn run(
+            &self,
+            ids: &[&str],
+            now: u64,
+            budget: Option<Duration>,
+            limiter: Option<&dyn RateLimiter>,
+        ) -> Vec<(IdentityProviderId, CallOutcome)> {
+            self.run_with_state(ids, &[], now, budget, limiter)
+        }
+
+        fn run_with_state(
+            &self,
+            ids: &[&str],
+            states: &[(&str, &str)],
+            now: u64,
+            budget: Option<Duration>,
+            limiter: Option<&dyn RateLimiter>,
+        ) -> Vec<(IdentityProviderId, CallOutcome)> {
+            let deps = IdentityDeps {
+                settings: &self.settings,
+                catalog: &self.catalog,
+                keys: &self.keys,
+                random: &SeededRandom::new(1),
+                services: &self.services,
+                rate_limiter: limiter,
+            };
+            let calls = ids
+                .iter()
+                .map(|id| {
+                    let provider = self
+                        .catalog
+                        .get(&pid(id))
+                        .expect("should hold the provider");
+                    Call {
+                        state_json: states
+                            .iter()
+                            .find(|(owner, _)| owner == id)
+                            .map(|(_, state)| (*state).to_owned()),
+                        provider: pid(id),
+                        kinds: BTreeMap::from([(
+                            provider.descriptor().primary_source().clone(),
+                            ResolveKind::Initial,
+                        )]),
+                    }
+                })
+                .collect();
+            let signals = ResolveSignals {
+                client_ip: None,
+                user_agent: Some("ExampleBrowser/1.0"),
+                page_url: None,
+                region: None,
+                hashed_email: None,
+                consent: ProviderConsent::default(),
+                publisher_domain: "www.example.com",
+                now: UnixTime::from_secs(now),
+                random: &ThreadRandom,
+                ec_id: Some(format!("{}.ABC123", "a".repeat(64))),
+                stored: BTreeMap::new(),
+            };
+            futures::executor::block_on(dispatch(&deps, calls, &signals, budget))
+        }
+    }
+
+    fn outcome_of<'a>(
+        outcomes: &'a [(IdentityProviderId, CallOutcome)],
+        id: &str,
+    ) -> &'a CallOutcome {
+        &outcomes
+            .iter()
+            .find(|(provider, _)| *provider == pid(id))
+            .expect("should hold an outcome for the provider")
+            .1
+    }
+
+    fn scripted(id: &str, host: &str, source: &str) -> Arc<dyn IdentityProvider> {
+        ScriptedProvider::new(id, host, source, false).into_provider()
+    }
+
+    #[test]
+    fn check_request_enforces_https_host_and_no_cookie() {
+        let descriptor = fixed_provider("p", &["a.example.com"]).descriptor().clone();
+        let good = ProviderRequest::get(
+            &"https://api.example.com/x"
+                .parse()
+                .expect("should parse the URL"),
+        );
+        check_request(&good, &descriptor)
+            .expect("should allow an https request to a declared host (control)");
+        for (name, request) in [
+            (
+                "http",
+                ProviderRequest::get(
+                    &"http://api.example.com/x"
+                        .parse()
+                        .expect("should parse the URL"),
+                ),
+            ),
+            (
+                "host",
+                ProviderRequest::get(
+                    &"https://other.example.net/x"
+                        .parse()
+                        .expect("should parse the URL"),
+                ),
+            ),
+            (
+                "cookie",
+                good.clone()
+                    .try_with_header("cookie", "a=1")
+                    .expect("should add the header"),
+            ),
+        ] {
+            assert!(
+                check_request(&request, &descriptor).is_err(),
+                "should reject the {name} case"
+            );
+        }
+    }
+
+    #[test]
+    fn decode_body_caps_decoded_size() {
+        let mut encoder = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+        encoder
+            .write_all(&vec![b'a'; 10_000])
+            .expect("should write to the encoder");
+        let gzipped = encoder.finish().expect("should finish the gzip stream");
+        assert_eq!(
+            decode_body(Some("gzip"), gzipped.clone(), 10_000).map(|body| body.len()),
+            Some(10_000),
+            "should decode a body that fits"
+        );
+        assert!(
+            decode_body(Some("gzip"), gzipped, 9_999).is_none(),
+            "should reject a body over the cap after decoding"
+        );
+        assert!(
+            decode_body(Some("zstd"), vec![1], 10).is_none(),
+            "should reject an unknown encoding"
+        );
+        assert_eq!(
+            decode_body(None, b"ok".to_vec(), 10).as_deref(),
+            Some(&b"ok"[..]),
+            "should pass an identity body through"
+        );
+        assert!(
+            decode_body(None, vec![0; 11], 10).is_none(),
+            "should reject an identity body over the cap"
+        );
+    }
+
+    #[test]
+    fn dispatch_maps_status_codes_to_outcomes() {
+        let mut fixture = DispatchFixture::new(vec![
+            scripted("ok", "ok.example.com", "ok.example.com"),
+            scripted("busy", "busy.example.com", "busy.example.com"),
+            scripted("bad", "bad.example.com", "bad.example.com"),
+            scripted("big", "big.example.com", "big.example.com"),
+            scripted("long", "long.example.com", "long.example.com"),
+        ]);
+        fixture.settings.ec.identity.max_response_bytes = 8;
+        fixture.client.respond("ok.example.com", 200, b"{}");
+        fixture.client.respond("busy.example.com", 503, b"{}");
+        fixture.client.respond("bad.example.com", 400, b"{}");
+        fixture
+            .client
+            .respond("big.example.com", 200, b"0123456789");
+        fixture.client.respond_with_headers(
+            "long.example.com",
+            200,
+            b"{}",
+            &[("content-length", "9999")],
+        );
+
+        let outcomes = fixture.run(&["ok", "busy", "bad", "big", "long"], 1_000, None, None);
+
+        assert!(
+            matches!(outcome_of(&outcomes, "ok"), CallOutcome::Resolved(_)),
+            "should resolve a 200"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "busy"), CallOutcome::TransportFailure),
+            "should count a 503 as a transport failure"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "bad"), CallOutcome::InputFailure),
+            "should count a 400 as an input failure"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "big"), CallOutcome::TransportFailure),
+            "should count a body over the cap as a transport failure"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "long"), CallOutcome::TransportFailure),
+            "should count a Content-Length over the cap as a transport failure"
+        );
+    }
+
+    #[test]
+    fn dispatch_rejects_a_body_that_decodes_over_the_cap() {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.max_response_bytes = 4_096;
+        let mut encoder = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+        encoder
+            .write_all(&vec![b'a'; 100_000])
+            .expect("should write to the encoder");
+        let gzipped = encoder.finish().expect("should finish the gzip stream");
+        assert!(
+            gzipped.len() < 4_096,
+            "should compress under the cap (control)"
+        );
+        fixture.client.respond_with_headers(
+            "p.example.com",
+            200,
+            &gzipped,
+            &[("content-encoding", "gzip")],
+        );
+
+        let outcomes = fixture.run(&["p"], 1_000, None, None);
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::TransportFailure),
+            "should count a decompression bomb as a transport failure"
+        );
+    }
+
+    #[test]
+    fn after_send_timeout_is_a_transport_failure_not_a_cut_off() {
+        let fixture = DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.client.time_out("p.example.com");
+
+        let outcomes = fixture.run(&["p"], 1_000, None, None);
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::TransportFailure),
+            "should count a missed after-send timeout as a transport failure"
+        );
+        assert_eq!(
+            fixture.backend.first_byte_timeouts(),
+            vec![Duration::from_millis(
+                ProviderSettings::default_after_send_timeout_ms()
+            )],
+            "should wait the after-send timeout for the first byte"
+        );
+    }
+
+    #[test]
+    fn hold_dispatch_cuts_off_a_call_the_budget_ran_out_on() {
+        let fixture = DispatchFixture::new(vec![
+            scripted("a", "a.example.com", "a.example.com"),
+            scripted("b", "b.example.com", "b.example.com"),
+            scripted("c", "c.example.com", "c.example.com"),
+        ]);
+        fixture.client.respond("a.example.com", 200, b"{}");
+        fixture.client.respond("b.example.com", 200, b"{}");
+        fixture.client.respond("c.example.com", 200, b"{}");
+        fixture
+            .client
+            .delay("b.example.com", Duration::from_millis(60));
+        fixture.client.time_out("c.example.com");
+
+        let outcomes = fixture.run(
+            &["a", "b", "c"],
+            1_000,
+            Some(Duration::from_millis(20)),
+            None,
+        );
+
+        assert!(
+            matches!(outcome_of(&outcomes, "a"), CallOutcome::Resolved(_)),
+            "should keep a response that arrived in flight"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "b"), CallOutcome::HoldCutOff),
+            "should drop a call still pending when the budget ran out"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "c"), CallOutcome::HoldCutOff),
+            "should drop a call the budget ran out before waiting on"
+        );
+        assert_eq!(
+            fixture.backend.first_byte_timeouts().len(),
+            3,
+            "should have sent all three before the budget ran out"
+        );
+    }
+
+    #[test]
+    fn hold_failure_before_the_budget_is_spent_is_a_transport_failure() {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.providers.insert(
+            "p".to_owned(),
+            ProviderSettings {
+                timeout_ms: Some(10),
+                ..ProviderSettings::default()
+            },
+        );
+        fixture.client.time_out("p.example.com");
+
+        let outcomes = fixture.run(&["p"], 1_000, Some(Duration::from_secs(60)), None);
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::TransportFailure),
+            "should count a failure under timeout_ms as a transport failure, not a cut off"
+        );
+    }
+
+    #[test]
+    fn each_call_reads_only_its_own_providers_state() {
+        let fixture = DispatchFixture::new(vec![
+            ScriptedProvider::new("one", "one.example.com", "one.example.com", false)
+                .stateful()
+                .into_provider(),
+            ScriptedProvider::new("two", "two.example.com", "two.example.com", false)
+                .stateful()
+                .into_provider(),
+            ScriptedProvider::new("three", "three.example.com", "three.example.com", false)
+                .stateful()
+                .into_provider(),
+        ]);
+        for host in ["one", "two", "three"] {
+            fixture
+                .client
+                .respond(&format!("{host}.example.com"), 200, b"{}");
+        }
+
+        fixture.run_with_state(
+            &["one", "two", "three"],
+            &[
+                ("one", r#"{"token":"first-secret"}"#),
+                ("two", r#"{"token":"second-secret"}"#),
+            ],
+            1_000,
+            None,
+            None,
+        );
+
+        let uris = fixture.client.sent_uris();
+        let uri_for = |host: &str| {
+            uris.iter()
+                .find(|uri| uri.contains(host))
+                .expect("should have sent to the host")
+                .clone()
+        };
+        let first = uri_for("one.example.com");
+        assert!(
+            first.contains("first-secret") && !first.contains("second-secret"),
+            "should give the first provider only its own state"
+        );
+        let second = uri_for("two.example.com");
+        assert!(
+            second.contains("second-secret") && !second.contains("first-secret"),
+            "should give the second provider only its own state"
+        );
+        assert!(
+            uri_for("three.example.com").contains("state=none"),
+            "should give a provider with no stored state none"
+        );
+    }
+
+    #[test]
+    fn hold_dispatch_with_no_budget_sends_nothing() {
+        let fixture = DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.client.respond("p.example.com", 200, b"{}");
+
+        let outcomes = fixture.run(&["p"], 1_000, Some(Duration::ZERO), None);
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::HoldCutOff),
+            "should cut off a hold call with no budget left"
+        );
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should send nothing"
+        );
+    }
+
+    #[test]
+    fn hold_dispatch_waits_the_smaller_of_the_hold_timeout_and_the_budget() {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.hold_budget_ms = 80;
+        fixture.client.respond("p.example.com", 200, b"{}");
+
+        fixture.run(&["p"], 1_000, Some(Duration::from_secs(10)), None);
+        fixture.run(&["p"], 1_000, Some(Duration::from_millis(30)), None);
+
+        let timeouts = fixture.backend.first_byte_timeouts();
+        assert_eq!(
+            timeouts[0],
+            Duration::from_millis(80),
+            "should wait the hold timeout when the budget is larger"
+        );
+        assert!(
+            timeouts[1] <= Duration::from_millis(30),
+            "should wait no longer than the remaining budget"
+        );
+    }
+
+    #[test]
+    fn per_ip_ceiling_caps_calls_from_one_address() {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.providers.insert(
+            "p".to_owned(),
+            ProviderSettings {
+                max_calls_per_minute: 10_000,
+                max_calls_per_ip_per_minute: 2,
+                ..ProviderSettings::default()
+            },
+        );
+        fixture.client.respond("p.example.com", 200, b"{}");
+        let from = |ip: &str| ClientInfo {
+            client_ip: Some(ip.parse().expect("should parse the IP")),
+            ..ClientInfo::default()
+        };
+        let limiter = FakeRateLimiter::new();
+
+        fixture.services = fake_services_from(&fixture.client, &fixture.backend, from("192.0.2.1"));
+        let first_two: Vec<_> = (0..2)
+            .map(|_| fixture.run(&["p"], 1_000, None, Some(&limiter)))
+            .collect();
+        let third = fixture.run(&["p"], 1_000, None, Some(&limiter));
+        fixture.services =
+            fake_services_from(&fixture.client, &fixture.backend, from("198.51.100.1"));
+        let elsewhere = fixture.run(&["p"], 1_000, None, Some(&limiter));
+
+        assert!(
+            first_two
+                .iter()
+                .all(|outcomes| matches!(outcome_of(outcomes, "p"), CallOutcome::Resolved(_))),
+            "should send while the address is under its ceiling"
+        );
+        assert!(
+            matches!(outcome_of(&third, "p"), CallOutcome::BurstCapped),
+            "should cap a third call from the same address within the minute"
+        );
+        assert!(
+            matches!(outcome_of(&elsewhere, "p"), CallOutcome::Resolved(_)),
+            "control: another address has its own ceiling"
+        );
+        assert!(
+            limiter.keys().iter().all(|key| !key.contains("192.0.2.1")),
+            "should key the ceiling on a keyed hash, never the raw IP"
+        );
+    }
+
+    #[test]
+    fn after_send_dispatch_stops_at_the_backend_request_budget() {
+        let mut fixture = DispatchFixture::new(vec![
+            scripted("p", "p.example.com", "p.example.com"),
+            scripted("q", "q.example.com", "q.example.com"),
+        ]);
+        fixture.settings.ec.identity.max_backend_requests = 3;
+        fixture.client.started_earlier(2);
+        fixture.client.respond("p.example.com", 200, b"{}");
+        fixture.client.respond("q.example.com", 200, b"{}");
+        let limiter = FakeRateLimiter::new();
+
+        let outcomes = fixture.run(&["p", "q"], 1_000, None, Some(&limiter));
+
+        assert_eq!(
+            fixture.client.sent_hosts().len(),
+            1,
+            "should send only what the budget leaves after the origin and auction"
+        );
+        assert!(
+            outcomes
+                .iter()
+                .any(|(_, outcome)| matches!(outcome, CallOutcome::OverBackendBudget)),
+            "should report the call it did not send"
+        );
+        assert!(
+            limiter
+                .keys()
+                .iter()
+                .all(|key| !key.starts_with("identity-fail:")),
+            "should not count a skipped call as a breaker failure"
+        );
+    }
+
+    #[test]
+    fn hold_dispatch_reserves_the_origin_and_the_auction() {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.max_backend_requests = 3;
+        fixture.settings.auction.enabled = true;
+        fixture.settings.auction.mediator = None;
+        fixture.settings.auction.providers =
+            crate::auction_config_types::AuctionConfig::legacy_provider_map(&["one", "two"]);
+        fixture.client.respond("p.example.com", 200, b"{}");
+
+        let held = fixture.run(&["p"], 1_000, Some(Duration::from_secs(1)), None);
+        let after_send = fixture.run(&["p"], 1_000, None, None);
+
+        assert!(
+            matches!(outcome_of(&held, "p"), CallOutcome::OverBackendBudget),
+            "should not hold a call that would leave no room for the origin and two auction calls"
+        );
+        assert!(
+            !matches!(outcome_of(&after_send, "p"), CallOutcome::OverBackendBudget),
+            "control: after send nothing is reserved"
+        );
+    }
+
+    #[test]
+    fn hold_dispatch_caps_the_connect_timeout_at_the_call_timeout() {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.hold_budget_ms = 80;
+        fixture.client.respond("p.example.com", 200, b"{}");
+
+        fixture.run(&["p"], 1_000, Some(Duration::from_secs(10)), None);
+        fixture.run(&["p"], 1_000, None, None);
+
+        assert_eq!(
+            fixture.backend.connect_timeouts(),
+            vec![Some(Duration::from_millis(80)), None],
+            "should cap a hold call's connect timeout at its call timeout and leave an after-send call on the adapter default"
+        );
+    }
+
+    #[test]
+    fn burst_cap_skips_without_counting_a_failure() {
+        let fixture = DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.client.respond("p.example.com", 200, b"{}");
+        let capped = RecordingLimiter::new(true, false);
+        let broken = RecordingLimiter::new(false, true);
+
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&capped));
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::BurstCapped),
+            "should report a burst-capped call"
+        );
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should not send a burst-capped call"
+        );
+        let keys = capped.keys.lock().expect("should lock the keys");
+        assert!(
+            keys[0].starts_with("identity:p:") && !keys[0].contains(&"a".repeat(64)),
+            "should key the cap by provider and the keyed visitor hash, not the EC ID"
+        );
+        drop(keys);
+
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&broken));
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::NotDispatched),
+            "should not dispatch when the limiter cannot be read"
+        );
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should not send when the limiter cannot be read"
+        );
+
+        let allowing = RecordingLimiter::new(false, false);
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&allowing));
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::Resolved(_)),
+            "should dispatch under the cap (control)"
+        );
+    }
+
+    /// A fixture with provider `p` whose breaker opens at `threshold` and
+    /// whose burst cap never stops a test.
+    fn breaker_fixture(threshold: u32) -> DispatchFixture {
+        let mut fixture =
+            DispatchFixture::new(vec![scripted("p", "p.example.com", "p.example.com")]);
+        fixture.settings.ec.identity.providers.insert(
+            "p".to_owned(),
+            ProviderSettings {
+                breaker_failures_per_minute: threshold,
+                max_calls_per_minute: 10_000,
+                ..ProviderSettings::default()
+            },
+        );
+        fixture
+    }
+
+    #[test]
+    fn breaker_opens_at_threshold_and_skips_every_visitor() {
+        let fixture = breaker_fixture(3);
+        fixture.client.respond("p.example.com", 503, b"{}");
+        let limiter = FakeRateLimiter::new();
+
+        for call in 0..3 {
+            let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+            assert!(
+                matches!(outcome_of(&outcomes, "p"), CallOutcome::TransportFailure),
+                "should dispatch while the breaker is closed (call {call})"
+            );
+        }
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            3,
+            "should record each transport failure"
+        );
+        let sent_before = fixture.client.sent_hosts().len();
+        let burst_before = limiter.keys();
+
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::BreakerOpen),
+            "should skip the provider once the count reaches the threshold"
+        );
+        assert_eq!(
+            fixture.client.sent_hosts().len(),
+            sent_before,
+            "should send nothing while the breaker is open"
+        );
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            3,
+            "should not record a failure for a call it never made"
+        );
+        assert_eq!(
+            limiter.keys(),
+            burst_before,
+            "should not touch the burst counter of an open breaker"
+        );
+    }
+
+    #[test]
+    fn breaker_is_per_provider() {
+        let mut fixture = breaker_fixture(1);
+        fixture.catalog = ProviderCatalog::new(
+            vec![
+                scripted("p", "p.example.com", "p.example.com"),
+                scripted("q", "q.example.com", "q.example.com"),
+            ],
+            BTreeMap::new(),
+        );
+        fixture.client.respond("q.example.com", 200, b"{}");
+        let limiter = FakeRateLimiter::new().with_count("identity-fail:p", 1);
+
+        let outcomes = fixture.run(&["p", "q"], 1_000, None, Some(&limiter));
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::BreakerOpen),
+            "should open the breaker of the failing provider"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "q"), CallOutcome::Resolved(_)),
+            "should leave another provider's breaker closed (control)"
+        );
+    }
+
+    #[test]
+    fn four_xx_and_malformed_never_open_the_breaker() {
+        let fixture = breaker_fixture(50);
+        fixture.client.respond("p.example.com", 400, b"{}");
+        let limiter = FakeRateLimiter::new();
+
+        for _ in 0..1_000 {
+            let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+            assert!(
+                matches!(outcome_of(&outcomes, "p"), CallOutcome::InputFailure),
+                "should count a 400 as an input failure"
+            );
+        }
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            0,
+            "should never record an input failure"
+        );
+
+        fixture.client.respond("p.example.com", 503, b"{}");
+        fixture.run(&["p"], 1_000, None, Some(&limiter));
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            1,
+            "should record a 503 (control)"
+        );
+    }
+
+    #[test]
+    fn hold_cut_off_does_not_record_a_failure() {
+        let fixture = breaker_fixture(50);
+        fixture.client.respond("p.example.com", 200, b"{}");
+        let limiter = FakeRateLimiter::new();
+
+        let outcomes = fixture.run(&["p"], 1_000, Some(Duration::ZERO), Some(&limiter));
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::HoldCutOff),
+            "should cut off a hold call with no budget"
+        );
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            0,
+            "should not record a budget cut as a provider failure"
+        );
+
+        fixture.client.time_out("p.example.com");
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::TransportFailure),
+            "should count an after-send timeout as a transport failure"
+        );
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            1,
+            "should record a timeout (control)"
+        );
+    }
+
+    #[test]
+    fn burst_cap_is_checked_after_every_other_eligibility_step() {
+        let mut fixture = breaker_fixture(1);
+        fixture.catalog = ProviderCatalog::new(
+            vec![
+                scripted("p", "p.example.com", "p.example.com"),
+                ScriptedProvider::new("u", "u.example.com", "u.example.com", false)
+                    .reading_undeclared_user_agent()
+                    .into_provider(),
+            ],
+            BTreeMap::new(),
+        );
+        fixture.client.respond("p.example.com", 200, b"{}");
+        fixture.client.respond("u.example.com", 200, b"{}");
+        let limiter = FakeRateLimiter::new().with_count("identity-fail:p", 1);
+
+        // The breaker is open for `p`, and `u` fails its input check.
+        let outcomes = fixture.run(&["p", "u"], 1_000, None, Some(&limiter));
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::BreakerOpen),
+            "should stop `p` at the breaker"
+        );
+        assert!(
+            matches!(outcome_of(&outcomes, "u"), CallOutcome::InputFailure),
+            "should stop `u` at its input check"
+        );
+        // A hold call with no budget left is cut off.
+        fixture.run(&["u"], 1_000, Some(Duration::ZERO), Some(&limiter));
+        assert_eq!(
+            limiter.keys(),
+            vec!["identity-fail:p".to_owned()],
+            "should never touch the burst counter of a provider that stopped earlier"
+        );
+
+        let eligible = breaker_fixture(1);
+        eligible.client.respond("p.example.com", 200, b"{}");
+        let open_limiter = FakeRateLimiter::new();
+        eligible.run(&["p"], 1_000, None, Some(&open_limiter));
+        assert!(
+            open_limiter
+                .keys()
+                .iter()
+                .any(|key| key.starts_with("identity:p:")),
+            "should increment the burst counter of a provider that reaches dispatch (control)"
+        );
+    }
+
+    #[test]
+    fn breaker_count_error_treats_the_breaker_as_closed() {
+        let fixture = breaker_fixture(1);
+        fixture.client.respond("p.example.com", 200, b"{}");
+        let limiter = FakeRateLimiter::new()
+            .with_count("identity-fail:p", 100)
+            .failing_count();
+
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::Resolved(_)),
+            "should dispatch when the failure count cannot be read"
+        );
+        assert_eq!(fixture.client.sent_hosts().len(), 1, "should send the call");
+    }
+
+    #[test]
+    fn burst_cap_error_skips_the_dispatch() {
+        let fixture = breaker_fixture(50);
+        fixture.client.respond("p.example.com", 200, b"{}");
+        let limiter = FakeRateLimiter::new().failing_exceeded();
+
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::NotDispatched),
+            "should not dispatch when the burst cap cannot be read"
+        );
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should send nothing"
+        );
+    }
+
+    #[test]
+    fn record_error_keeps_the_outcome() {
+        let fixture = breaker_fixture(50);
+        fixture.client.respond("p.example.com", 503, b"{}");
+        let limiter = FakeRateLimiter::new().failing_record();
+
+        let outcomes = fixture.run(&["p"], 1_000, None, Some(&limiter));
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::TransportFailure),
+            "should keep the transport failure when recording it fails"
+        );
+        assert_eq!(
+            limiter.count_of("identity-fail:p"),
+            0,
+            "should not have recorded it"
+        );
+    }
+
+    #[test]
+    fn undeclared_read_is_an_input_failure_even_when_ignored() {
+        let fixture = DispatchFixture::new(vec![
+            ScriptedProvider::new("p", "p.example.com", "p.example.com", false)
+                .reading_undeclared_user_agent()
+                .into_provider(),
+        ]);
+        fixture.client.respond("p.example.com", 200, b"{}");
+
+        let outcomes = fixture.run(&["p"], 1_000, None, None);
+
+        assert!(
+            matches!(outcome_of(&outcomes, "p"), CallOutcome::InputFailure),
+            "should fail a provider that read an undeclared input, though it ignored the error"
+        );
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should not send the call"
+        );
+    }
+
+    #[test]
+    fn generic_pull_dispatch_order_rotates_hourly() {
+        let generic =
+            |id: &str, host: &str| ScriptedProvider::new(id, host, host, true).into_provider();
+        let mut fixture = DispatchFixture::new(vec![
+            generic("gamma", "gamma.example.com"),
+            generic("alpha", "alpha.example.com"),
+            generic("beta", "beta.example.com"),
+            scripted("other", "other.example.com", "other.example.com"),
+        ]);
+        fixture.settings.ec.identity.max_concurrency = 1;
+        for host in ["alpha", "beta", "gamma", "other"] {
+            fixture
+                .client
+                .respond(&format!("{host}.example.com"), 200, b"{}");
+        }
+        let ids = ["other", "gamma", "beta", "alpha"];
+
+        fixture.run(&ids, 100, None, None);
+        fixture.run(&ids, 3_600, None, None);
+        fixture.run(&ids, 7_200, None, None);
+
+        let sent = fixture.client.sent_hosts();
+        assert_eq!(
+            sent,
+            [
+                "alpha.example.com",
+                "beta.example.com",
+                "gamma.example.com",
+                "other.example.com",
+                "beta.example.com",
+                "gamma.example.com",
+                "alpha.example.com",
+                "other.example.com",
+                "gamma.example.com",
+                "alpha.example.com",
+                "beta.example.com",
+                "other.example.com",
+            ],
+            "should sort generic pull by source, rotate the start each hour, and send other providers after"
+        );
+    }
+
+    fn regrant_descriptor(policy: ConsentPolicy) -> ProviderDescriptor {
+        custom_provider("regrant", &["a.example.com"], Resolves::new(), policy)
+            .descriptor()
+            .clone()
+    }
+
+    fn stored_opt_out(at: u64, fp: &str) -> KvOptOut {
+        KvOptOut {
+            at,
+            fp: fp.to_owned(),
+        }
+    }
+
+    fn gpp_consent(sale: Option<bool>, targeted: Option<bool>) -> ConsentContext {
+        let mut consent = allowing_consent();
+        consent.gpp = Some(GppConsent {
+            version: 1,
+            section_ids: vec![7],
+            eu_tcf: None,
+            us_sale_opt_out: sale,
+            us_sharing_opt_out: None,
+            us_targeted_advertising_opt_out: targeted,
+            us_gpc: None,
+            us_known_child: None,
+            us_privacy_section: None,
+            us_section_decode_failed: false,
+        });
+        consent
+    }
+
+    #[test]
+    fn tcf_regrant_clears_only_a_denial_the_opt_out_recorded() {
+        let descriptor = regrant_descriptor(resolver_policy().with_tcf_vendor(5));
+        let signals = PolicySignals::default();
+        // `test_consent_gdpr_without_vendor(v)` grants every purpose and every
+        // vendor but `v`, so 99 grants vendor 5 and 5 denies it.
+        let tcf_with = |denied_vendor: u16, last_updated_ds: u64| {
+            let mut consent = test_consent_gdpr_without_vendor(denied_vendor);
+            consent
+                .tcf
+                .as_mut()
+                .expect("should carry a TC string")
+                .last_updated_ds = last_updated_ds;
+            consent
+        };
+        let recorded_under = |consent: &ConsentContext| {
+            stored_opt_out(
+                1_000,
+                &fingerprint_bits(descriptor.consent_policy(), consent, signals),
+            )
+        };
+        let denied = recorded_under(&tcf_with(5, 0));
+        let granted = recorded_under(&tcf_with(99, 0));
+
+        assert!(
+            regrant_clears_opt_out(&descriptor, &denied, &tcf_with(99, 0), signals),
+            "should clear when the vendor goes from denied to granted, even on a day-level LastUpdated before the opt-out"
+        );
+        assert!(
+            !regrant_clears_opt_out(&descriptor, &denied, &tcf_with(5, 20_000), signals),
+            "should not clear while the vendor stays denied"
+        );
+        assert!(
+            !regrant_clears_opt_out(&descriptor, &granted, &tcf_with(99, 20_000), signals),
+            "should not clear a vendor-reported opt-out on a later CMP re-save that was already granting"
+        );
+        assert!(
+            !regrant_clears_opt_out(
+                &descriptor,
+                &stored_opt_out(1_000, "0"),
+                &tcf_with(99, 20_000),
+                signals
+            ),
+            "should not clear an opt-out recorded where TCF did not apply"
+        );
+    }
+
+    #[test]
+    fn opt_out_clears_carry_the_opt_out_they_saw() {
+        let catalog = ProviderCatalog::new(
+            vec![custom_provider(
+                "regrant",
+                &["a.example.com"],
+                Resolves::new(),
+                resolver_policy(),
+            )],
+            BTreeMap::new(),
+        );
+        let mut view = EligibilityView::empty();
+        let sale = gpp_consent(Some(true), None);
+        let fp = fingerprint_bits(&resolver_policy(), &sale, PolicySignals::default());
+        view.set_opt_out_for_test("regrant", 700, None);
+        view.providers
+            .get_mut(&pid("regrant"))
+            .expect("should hold the provider")
+            .o = Some(stored_opt_out(700, &fp));
+
+        assert_eq!(
+            opt_out_clears(
+                &view,
+                &catalog,
+                &gpp_consent(Some(false), None),
+                PolicySignals::default()
+            ),
+            vec![(pid("regrant"), 700)],
+            "should clear up to the opt-out the request read, not to its own time"
+        );
+    }
+
+    #[test]
+    fn jurisdiction_change_never_clears_it() {
+        let descriptor = regrant_descriptor(resolver_policy());
+        let signals = PolicySignals::default();
+        let sale = stored_opt_out(1_000, "800");
+
+        let mut eu_without_gpp = allowing_consent();
+        eu_without_gpp.jurisdiction = crate::consent::jurisdiction::Jurisdiction::Gdpr;
+        let mut header_only = allowing_consent();
+        header_only.gpp = Some(GppConsent {
+            version: 1,
+            section_ids: vec![2],
+            eu_tcf: None,
+            us_sale_opt_out: None,
+            us_sharing_opt_out: None,
+            us_targeted_advertising_opt_out: None,
+            us_gpc: None,
+            us_known_child: None,
+            us_privacy_section: None,
+            us_section_decode_failed: false,
+        });
+
+        assert!(
+            !regrant_clears_opt_out(&descriptor, &sale, &eu_without_gpp, signals),
+            "should not clear when the visitor moved to a jurisdiction with no GPP string"
+        );
+        assert!(
+            !regrant_clears_opt_out(&descriptor, &sale, &header_only, signals),
+            "should not clear on a newly present GPP string with no US section"
+        );
+        assert!(
+            regrant_clears_opt_out(&descriptor, &sale, &gpp_consent(Some(false), None), signals),
+            "control: a US section showing no opt-out should clear"
+        );
+    }
+
+    #[test]
+    fn gpp_regrant_clears_when_none_of_the_recorded_opt_outs_remain() {
+        let descriptor = regrant_descriptor(resolver_policy());
+        let signals = PolicySignals::default();
+        let sale_opt_out = gpp_consent(Some(true), None);
+        let stored = fingerprint_bits(descriptor.consent_policy(), &sale_opt_out, signals);
+        assert_eq!(stored, "800", "should record the sale opt-out bit");
+        // Purpose 4 was also granted when the opt-out was stored (bit 3).
+        let with_purpose_four = format!("{:x}", 0x800_u64 | 0x8);
+        let opt_out = stored_opt_out(1_000, &with_purpose_four);
+
+        assert!(
+            regrant_clears_opt_out(
+                &descriptor,
+                &opt_out,
+                &gpp_consent(Some(false), None),
+                signals
+            ),
+            "should clear when the section shows no opt-out, even with purpose 4 changed"
+        );
+        assert!(
+            !regrant_clears_opt_out(&descriptor, &opt_out, &sale_opt_out, signals),
+            "control: a section that still shows the sale opt-out should not clear"
+        );
+        assert!(
+            !regrant_clears_opt_out(
+                &descriptor,
+                &stored_opt_out(1_000, "8"),
+                &gpp_consent(Some(false), None),
+                signals
+            ),
+            "control: an fp with no US opt-out bit should never clear by GPP"
+        );
+        assert!(
+            !regrant_clears_opt_out(
+                &descriptor,
+                &stored_opt_out(1_000, "not-hex"),
+                &gpp_consent(Some(false), None),
+                signals
+            ),
+            "control: an fp that does not parse should never clear"
+        );
+        assert!(
+            regrant_clears_opt_out(
+                &descriptor,
+                &opt_out,
+                &gpp_consent(Some(false), Some(true)),
+                signals
+            ),
+            "should judge only the opt-outs the fingerprint recorded, not a new one"
+        );
+    }
+
+    /// Hold dispatch before a writer navigation's auction (spec 4.7).
+    mod hold_mode {
+        use http::StatusCode;
+
+        use super::*;
+        use crate::ec::identity::flush::FlushOutcome;
+        use crate::ec::identity::request::WriterDecision;
+        use crate::ec::identity::test_support::TEST_EC_ID;
+        use crate::ec::identity::test_support::fake_http::AnsweringProvider;
+        use crate::ec::identity::test_support::hold_fixture::{HoldFixture, live_row};
+        use crate::ec::kv_types::{KvOptOut, KvProviderState, KvUid};
+
+        const HOLD_HOST: &str = "p.example.com";
+        const HOLD_SOURCE: &str = "ids.example.com";
+
+        fn hold_provider(
+            id: &str,
+            host: &str,
+            source: &str,
+        ) -> (Arc<dyn IdentityProvider>, ProviderMode) {
+            (
+                AnsweringProvider::new(id, host, source, None).into_provider(),
+                ProviderMode::Hold,
+            )
+        }
+
+        fn found_body(uid: &str) -> Vec<u8> {
+            serde_json::to_vec(&serde_json::json!({
+                "answer": "found",
+                "entries": [{ "uids": [{ "id": uid, "atype": 1 }] }],
+            }))
+            .expect("should serialize the answer")
+        }
+
+        fn single_entry(uid: &str) -> Vec<KvEid> {
+            vec![KvEid {
+                uids: vec![KvUid {
+                    id: uid.to_owned(),
+                    atype: Some(1),
+                    ext: None,
+                }],
+                ..KvEid::default()
+            }]
+        }
+
+        #[test]
+        fn new_visitor_hold_answer_feeds_the_auction_and_rides_the_create() {
+            let mut fixture = HoldFixture::new_visitor(vec![
+                hold_provider("p", HOLD_HOST, HOLD_SOURCE),
+                (
+                    AnsweringProvider::reading_ec_id(
+                        "pull",
+                        "pull.example.com",
+                        "pull.example.com",
+                    )
+                    .into_provider(),
+                    ProviderMode::Hold,
+                ),
+            ]);
+            fixture
+                .client
+                .respond(HOLD_HOST, 200, &found_body("held-uid"));
+            fixture
+                .client
+                .respond("pull.example.com", 200, &found_body("pulled-uid"));
+
+            let results = fixture.run_hold();
+
+            assert_eq!(
+                results.additions,
+                BTreeMap::from([(source(HOLD_SOURCE), single_entry("held-uid"))]),
+                "should hand this auction the answer"
+            );
+            assert_eq!(
+                fixture.client.sent_hosts(),
+                [HOLD_HOST],
+                "should call no provider that reads the EC ID before the row exists"
+            );
+            assert_eq!(fixture.store.writes().total(), 0, "should not create yet");
+            assert!(
+                fixture.context.identity().mutation().is_empty(),
+                "should stage nothing for a flush the new EC never runs"
+            );
+
+            fixture
+                .context
+                .complete_deferred_create(&fixture.settings, Some(&fixture.graph))
+                .expect("should create the row");
+
+            let ec_id = fixture
+                .context
+                .ec_value()
+                .expect("should keep the EC ID")
+                .to_owned();
+            let (row, _) = fixture
+                .graph
+                .get(&ec_id)
+                .expect("should read the row")
+                .expect("should hold the row");
+            assert_eq!(
+                row.ids.get(HOLD_SOURCE).map(|record| record.eids.clone()),
+                Some(single_entry("held-uid")),
+                "should create the row with the hold answer"
+            );
+            assert_eq!(
+                fixture.store.writes().add,
+                1,
+                "should create with one write"
+            );
+        }
+
+        #[test]
+        fn hold_answer_feeds_this_auction_and_joins_the_mutation() {
+            let mut fixture = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                true,
+            );
+            fixture
+                .client
+                .respond(HOLD_HOST, 200, &found_body("held-uid"));
+
+            let results = fixture.run_hold();
+
+            assert_eq!(
+                results,
+                HoldResults {
+                    additions: BTreeMap::from([(source(HOLD_SOURCE), single_entry("held-uid"))]),
+                    writer: BTreeMap::from([(source(HOLD_SOURCE), pid("p"))]),
+                },
+                "should hand this auction the answer and its writer"
+            );
+            let staged = fixture.context.identity().mutation().positive_changes();
+            assert!(
+                matches!(
+                    staged,
+                    [PartnerIdChange::FillMissing { source: staged_source, record }]
+                        if *staged_source == source(HOLD_SOURCE)
+                            && record.w.as_deref() == Some("p")
+                            && record.eids == single_entry("held-uid")
+                ),
+                "should stage the answer in the writer's mutation: {staged:?}"
+            );
+
+            let outcome = fixture.flush(StatusCode::OK);
+
+            assert_eq!(outcome, FlushOutcome::Written, "should write the answer");
+            assert_eq!(
+                fixture.row().ids[HOLD_SOURCE].eids,
+                single_entry("held-uid"),
+                "should store the answer"
+            );
+            assert_eq!(
+                fixture.client.sent_hosts(),
+                [HOLD_HOST],
+                "should not dispatch the provider again after send"
+            );
+            let writes = fixture.store.writes();
+            assert_eq!(
+                (writes.if_generation_match, writes.total()),
+                (1, 1),
+                "should make the one flush write and no other"
+            );
+        }
+
+        #[test]
+        fn auction_starts_at_the_hold_budget_when_a_provider_is_slow() {
+            let mut fixture = HoldFixture::new(
+                vec![
+                    hold_provider("a", "a.example.com", "a.example.com"),
+                    hold_provider("b", "b.example.com", "b.example.com"),
+                ],
+                &live_row(),
+                true,
+            );
+            fixture.settings.ec.identity.hold_budget_ms = 50;
+            fixture
+                .client
+                .respond("a.example.com", 200, &found_body("fast-uid"));
+            fixture
+                .client
+                .respond("b.example.com", 200, &found_body("late-uid"));
+            let delay = Duration::from_millis(400);
+            fixture.client.delay("b.example.com", delay);
+
+            let before = current_timestamp();
+            let started = Instant::now();
+            let results = fixture.run_hold();
+            let elapsed = started.elapsed();
+            let outcome = fixture.flush(StatusCode::OK);
+
+            assert!(
+                // The call's timeout is the budget left when it was sent.
+                elapsed >= Duration::from_millis(45) && elapsed < delay,
+                "should start the auction at the budget, not at the slow answer: {elapsed:?}"
+            );
+            assert_eq!(
+                results.additions.keys().collect::<Vec<_>>(),
+                [&source("a.example.com")],
+                "should keep the fast answer and drop the slow one"
+            );
+            assert_eq!(outcome, FlushOutcome::Written, "should write the flush");
+            let row = fixture.row();
+            let retry = fixture.settings.ec.identity.hold_retry_sec;
+            assert!(
+                row.ps["b"]
+                    .n
+                    .is_some_and(|n| n >= before + retry && n <= before + retry + 5),
+                "should wait hold_retry_sec after the cut-off: {:?}",
+                row.ps["b"]
+            );
+            assert_eq!(row.ps["b"].f, 0, "should count no failure for the cut-off");
+            assert_eq!(
+                fixture.limiter.count_of("identity-fail:b"),
+                0,
+                "should not feed the breaker"
+            );
+            assert!(
+                row.ids.contains_key("a.example.com") && !row.ids.contains_key("b.example.com"),
+                "should store the fast answer and not the slow one"
+            );
+        }
+
+        #[test]
+        fn hold_providers_still_run_after_send_when_hold_found_no_usable_row() {
+            let mut fixture = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                true,
+            );
+            fixture
+                .client
+                .respond(HOLD_HOST, 200, &found_body("late-uid"));
+            fixture
+                .context
+                .set_kv_snapshot(crate::ec::EcKvSnapshot::NotRead);
+
+            let held = fixture.run_hold();
+            let before_send = fixture.client.sent_hosts();
+            let outcome = fixture.flush(StatusCode::OK);
+
+            assert_eq!(
+                (held, before_send),
+                (HoldResults::default(), Vec::<String>::new()),
+                "should dispatch nothing in hold without a usable row"
+            );
+            assert_eq!(outcome, FlushOutcome::Written, "should write the answer");
+            assert_eq!(
+                fixture.client.sent_hosts(),
+                [HOLD_HOST],
+                "should run the hold-mode provider once, after send"
+            );
+            assert_eq!(
+                fixture.row().ids[HOLD_SOURCE].eids,
+                single_entry("late-uid"),
+                "should store the answer"
+            );
+        }
+
+        #[test]
+        fn cut_off_hold_call_sets_hold_retry_without_counting_a_failure() {
+            let mut row = live_row();
+            row.ps.insert(
+                "p".to_owned(),
+                KvProviderState {
+                    f: 2,
+                    ..KvProviderState::default()
+                },
+            );
+            let mut fixture =
+                HoldFixture::new(vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)], &row, true);
+            fixture.settings.ec.identity.hold_budget_ms = 0;
+            fixture.client.respond(HOLD_HOST, 200, &found_body("never"));
+
+            let before = current_timestamp();
+            let results = fixture.run_hold();
+            let outcome = fixture.flush(StatusCode::OK);
+
+            assert_eq!(results, HoldResults::default(), "should add nothing");
+            assert_eq!(
+                outcome,
+                FlushOutcome::Written,
+                "should write the retry wait"
+            );
+            let state = fixture.row().ps["p"].clone();
+            let retry = fixture.settings.ec.identity.hold_retry_sec;
+            assert!(
+                state
+                    .n
+                    .is_some_and(|n| n >= before + retry && n <= before + retry + 5),
+                "should wait hold_retry_sec: {state:?}"
+            );
+            assert_eq!(state.f, 2, "should leave the failure count as it was");
+            assert_eq!(
+                fixture.limiter.count_of("identity-fail:p"),
+                0,
+                "should not feed the breaker"
+            );
+        }
+
+        #[test]
+        fn hold_kv_opt_out_blocks_dispatch() {
+            let mut opted_out = live_row();
+            opted_out.ps.insert(
+                "p".to_owned(),
+                KvProviderState {
+                    o: Some(KvOptOut {
+                        at: 900,
+                        fp: "0".to_owned(),
+                    }),
+                    ..KvProviderState::default()
+                },
+            );
+            let mut blocked = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &opted_out,
+                true,
+            );
+            blocked
+                .client
+                .respond(HOLD_HOST, 200, &found_body("blocked"));
+            let mut control = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                true,
+            );
+            control
+                .client
+                .respond(HOLD_HOST, 200, &found_body("allowed"));
+
+            let blocked_results = blocked.run_hold();
+            let control_results = control.run_hold();
+
+            assert_eq!(
+                (blocked_results, blocked.client.sent_hosts()),
+                (HoldResults::default(), Vec::<String>::new()),
+                "should call no provider the row opted out of"
+            );
+            assert_eq!(
+                (control_results.additions.len(), control.client.sent_hosts()),
+                (1, vec![HOLD_HOST.to_owned()]),
+                "control: should call the provider with no opt-out"
+            );
+        }
+
+        #[test]
+        fn no_hold_on_a_stager() {
+            let mut stager = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                true,
+            );
+            stager.client.respond(HOLD_HOST, 200, &found_body("stager"));
+            stager
+                .context
+                .identity_mut()
+                .set_writer_decision(WriterDecision {
+                    writer: false,
+                    is_real_browser: true,
+                    user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                    dnt: false,
+                    page_url: None,
+                });
+            let mut writer = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                true,
+            );
+            writer.client.respond(HOLD_HOST, 200, &found_body("writer"));
+
+            let stager_results = stager.run_hold();
+            let writer_results = writer.run_hold();
+
+            assert_eq!(
+                (stager_results, stager.client.sent_hosts()),
+                (HoldResults::default(), Vec::<String>::new()),
+                "should make no provider call on a request that is not the writer"
+            );
+            assert_eq!(
+                (writer_results.additions.len(), writer.client.sent_hosts()),
+                (1, vec![HOLD_HOST.to_owned()]),
+                "control: should call the provider on the writer"
+            );
+        }
+
+        #[test]
+        fn hold_no_match_on_a_writer_stops_recalls_from_the_spa_session() {
+            let mut fixture = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                true,
+            );
+            fixture
+                .client
+                .respond(HOLD_HOST, 200, br#"{"answer":"no_match"}"#);
+            fixture.run_hold();
+            assert_eq!(
+                fixture.flush(StatusCode::OK),
+                FlushOutcome::Written,
+                "should write the no_match wait"
+            );
+            assert_eq!(
+                fixture.client.sent_hosts(),
+                [HOLD_HOST],
+                "control: the writer navigation called the provider once"
+            );
+            assert!(
+                fixture.row().ps["p"]
+                    .n
+                    .is_some_and(|n| n > current_timestamp()),
+                "should hold the provider back with ps.n"
+            );
+
+            // The SPA session's stagers (`/auction`, `/_ts/page-bids`) read
+            // the stored row and are never the writer.
+            for _ in 0..3 {
+                fixture
+                    .context
+                    .set_kv_snapshot(fixture.graph.load_snapshot(TEST_EC_ID));
+                fixture
+                    .context
+                    .identity_mut()
+                    .set_writer_decision(WriterDecision {
+                        writer: false,
+                        is_real_browser: true,
+                        user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                        dnt: false,
+                        page_url: None,
+                    });
+                fixture.run_hold();
+            }
+            // A second writer navigation inside ps.n is held back too.
+            fixture
+                .context
+                .identity_mut()
+                .set_writer_decision(WriterDecision {
+                    writer: true,
+                    is_real_browser: true,
+                    user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                    dnt: false,
+                    page_url: None,
+                });
+            fixture.run_hold();
+
+            assert_eq!(
+                fixture.client.sent_hosts(),
+                [HOLD_HOST],
+                "should never call the provider again before ps.n"
+            );
+        }
+
+        #[test]
+        fn hold_provider_moves_after_send_on_a_navigation_without_an_auction() {
+            let mut fixture = HoldFixture::new(
+                vec![hold_provider("p", HOLD_HOST, HOLD_SOURCE)],
+                &live_row(),
+                false,
+            );
+            fixture.client.time_out(HOLD_HOST);
+
+            let held = fixture.run_hold();
+            let before_send = fixture.client.sent_hosts();
+            let outcome = fixture.flush(StatusCode::OK);
+
+            assert_eq!(
+                (held, before_send),
+                (HoldResults::default(), Vec::<String>::new()),
+                "should dispatch nothing before the response"
+            );
+            assert_eq!(outcome, FlushOutcome::Written, "should write the failure");
+            assert_eq!(
+                fixture.client.sent_hosts(),
+                [HOLD_HOST],
+                "should dispatch after send"
+            );
+            assert_eq!(
+                fixture.backend.first_byte_timeouts(),
+                [Duration::from_millis(
+                    fixture
+                        .settings
+                        .ec
+                        .identity
+                        .provider(&pid("p"))
+                        .after_send_timeout_ms
+                )],
+                "should wait the after-send timeout, not the hold budget"
+            );
+            assert_eq!(
+                fixture.row().ps["p"].f,
+                1,
+                "should count a miss as a transport failure"
+            );
+            assert_eq!(
+                fixture.limiter.count_of("identity-fail:p"),
+                1,
+                "should feed the breaker, which a cut-off never does"
+            );
+        }
+
+        #[test]
+        fn stateful_hold_answer_flushes_its_state_with_its_ids() {
+            let mut fixture = HoldFixture::new(
+                vec![(
+                    AnsweringProvider::stateful("p", HOLD_HOST, HOLD_SOURCE).into_provider(),
+                    ProviderMode::Hold,
+                )],
+                &live_row(),
+                true,
+            );
+            fixture
+                .client
+                .respond(HOLD_HOST, 200, &found_body("stateful-uid"));
+
+            let results = fixture.run_hold();
+            let outcome = fixture.flush(StatusCode::OK);
+
+            assert_eq!(
+                results.additions.get(&source(HOLD_SOURCE)),
+                Some(&single_entry("stateful-uid")),
+                "should feed this auction"
+            );
+            assert_eq!(outcome, FlushOutcome::Written, "should write once");
+            let row = fixture.row();
+            assert_eq!(
+                row.ids[HOLD_SOURCE].eids,
+                single_entry("stateful-uid"),
+                "should store the IDs"
+            );
+            assert_eq!(
+                row.ps["p"].st,
+                Some(serde_json::json!({ "seen": true })),
+                "should store the state with its IDs"
+            );
+            assert_eq!(fixture.store.writes().total(), 1, "should make one write");
+        }
+
+        #[test]
+        fn writer_navigation_with_non_2xx_status_flushes_hold_removals_and_backoff_only() {
+            let mut row = live_row();
+            row.ids.insert(
+                "i.example.com".to_owned(),
+                KvPartnerId {
+                    exp: Some(600),
+                    ..record_for_test("old-uid", Some("i"), 500)
+                },
+            );
+            row.ps.insert(
+                "f".to_owned(),
+                KvProviderState {
+                    f: 2,
+                    ..KvProviderState::default()
+                },
+            );
+            let mut fixture = HoldFixture::new(
+                vec![
+                    hold_provider("f", "f.example.com", "f.example.com"),
+                    hold_provider("n", "n.example.com", "n.example.com"),
+                    hold_provider("i", "i.example.com", "i.example.com"),
+                ],
+                &row,
+                true,
+            );
+            fixture
+                .client
+                .respond("f.example.com", 200, &found_body("found-uid"));
+            fixture
+                .client
+                .respond("n.example.com", 200, br#"{"answer":"no_match"}"#);
+            fixture
+                .client
+                .respond("i.example.com", 200, br#"{"answer":"invalidate"}"#);
+
+            let results = fixture.run_hold();
+            let outcome = fixture.flush(StatusCode::NOT_FOUND);
+
+            assert_eq!(
+                results.additions.keys().collect::<Vec<_>>(),
+                [&source("f.example.com")],
+                "should still feed this auction the found answer"
+            );
+            assert_eq!(
+                outcome,
+                FlushOutcome::Written,
+                "should write the cut mutation"
+            );
+            let stored = fixture.row();
+            assert!(
+                !stored.ids.contains_key("f.example.com"),
+                "should store no ID from the found"
+            );
+            assert!(
+                !stored.ids.contains_key("i.example.com"),
+                "should store the invalidate's removal"
+            );
+            assert!(
+                stored.ps["n"].n.is_some_and(|n| n > current_timestamp()),
+                "should store the no_match backoff"
+            );
+            assert_eq!(
+                stored.ps["f"].f, 2,
+                "should leave the found's failure count alone"
+            );
+            assert_eq!(fixture.store.writes().total(), 1, "should make one write");
+        }
+    }
+
+    /// Revoke-only capture from proxied responses (spec 4.7).
+    mod capture_run {
+        use serde_json::json;
+
+        use super::*;
+        use crate::consent::jurisdiction::Jurisdiction;
+        use crate::ec::identity::revision::set_hashes;
+        use crate::ec::identity::test_support::capture_fixture::{CaptureFixture, capture_path};
+        use crate::ec::identity::test_support::hold_fixture::live_row;
+        use crate::ec::identity::test_support::{
+            TEST_EC_ID, answering_capture_provider, record_for_test,
+        };
+        use crate::ec::kv_types::KvProviderState;
+        use crate::test_support::logs::{captured_logs, install_capturing_logger};
+
+        const FIRST: &str = "a.example.com";
+        const SECOND: &str = "b.example.com";
+
+        fn lockr() -> Arc<dyn IdentityProvider> {
+            answering_capture_provider("lockr", &[FIRST, SECOND], None)
+        }
+
+        fn lockr_path() -> String {
+            capture_path("lockr")
+        }
+
+        fn row_with(records: &[(&str, &str, Option<&str>)]) -> KvEntry {
+            let mut row = live_row();
+            for (source, uid, writer) in records {
+                row.ids
+                    .insert((*source).to_owned(), record_for_test(uid, *writer, 500));
+            }
+            row
+        }
+
+        fn opted_out_row(at: u64) -> KvEntry {
+            let mut row = live_row();
+            row.ps.insert(
+                "lockr".to_owned(),
+                KvProviderState {
+                    o: Some(KvOptOut {
+                        at,
+                        fp: "0".to_owned(),
+                    }),
+                    ..KvProviderState::default()
+                },
+            );
+            row
+        }
+
+        fn denied_consent() -> ConsentContext {
+            ConsentContext {
+                gdpr_applies: true,
+                jurisdiction: Jurisdiction::Gdpr,
+                ..ConsentContext::default()
+            }
+        }
+
+        fn kept_sources(mutation: &IdentityMutation) -> Vec<&str> {
+            mutation
+                .stand_alone_changes()
+                .iter()
+                .filter_map(|change| {
+                    crate::ec::identity::coordinator::positive_record(change)
+                        .map(|(source, _)| source.as_str())
+                })
+                .collect()
+        }
+
+        #[test]
+        fn capture_positive_from_another_request_waits_in_the_pending_key() {
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&live_row()));
+
+            fixture.capture(
+                &lockr_path(),
+                &json!({"tokens": [{"source": FIRST, "value": "secret-uid-1"}]}),
+            );
+
+            assert_eq!(
+                kept_sources(fixture.context.identity().capture_writes()),
+                vec![FIRST],
+                "should keep the positive for after send"
+            );
+            assert_eq!(
+                fixture.store.writes().total(),
+                0,
+                "should write nothing before send"
+            );
+
+            defer_capture_writes(&mut fixture.context, &fixture.graph);
+
+            let merge = load_pending(&fixture.graph, TEST_EC_ID, 0).expect("should hold the write");
+            assert_eq!(
+                kept_sources(&merge.mutation),
+                vec![FIRST],
+                "should append the positive to the pending key"
+            );
+            assert_eq!(
+                fixture.row(),
+                live_row(),
+                "should leave the row to the next writer"
+            );
+        }
+
+        #[test]
+        fn capture_positive_from_the_writer_joins_its_flush() {
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&live_row()));
+            fixture
+                .context
+                .identity_mut()
+                .set_writer_decision(WriterDecision {
+                    writer: true,
+                    is_real_browser: true,
+                    user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                    dnt: false,
+                    page_url: None,
+                });
+
+            fixture.capture(
+                &lockr_path(),
+                &json!({"tokens": [{"source": FIRST, "value": "secret-uid-1"}]}),
+            );
+
+            assert_eq!(
+                kept_sources(fixture.context.identity().mutation()),
+                vec![FIRST],
+                "should stage the positive in the writer's mutation"
+            );
+            assert!(
+                fixture.context.identity().capture_writes().is_empty(),
+                "should keep nothing for the pending key"
+            );
+        }
+
+        #[test]
+        fn capture_positive_is_kept_only_from_a_browser_and_when_it_changes_kv() {
+            let body = json!({"tokens": [{"source": FIRST, "value": "secret-uid-1"}]});
+            let mut bot = CaptureFixture::new(vec![lockr()], Some(&live_row())).not_a_browser();
+            bot.capture(&lockr_path(), &body);
+            assert!(
+                bot.context.identity().capture_writes().is_empty(),
+                "should keep nothing from a client that is not a browser"
+            );
+
+            let mut first = CaptureFixture::new(vec![lockr()], Some(&live_row()));
+            first.capture(&lockr_path(), &body);
+            let (_, record) = first
+                .context
+                .identity()
+                .capture_writes()
+                .stand_alone_changes()
+                .iter()
+                .find_map(crate::ec::identity::coordinator::positive_record)
+                .expect("control: a first capture keeps the positive");
+            let mut stored = live_row();
+            stored.ids.insert(FIRST.to_owned(), record.clone());
+
+            let mut again = CaptureFixture::new(vec![lockr()], Some(&stored));
+            again.capture(&lockr_path(), &body);
+
+            assert!(
+                again.context.identity().capture_writes().is_empty(),
+                "should keep nothing KV already holds"
+            );
+        }
+
+        #[test]
+        fn capture_stores_no_positive_id_and_counts_it() {
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&live_row()));
+
+            fixture.capture(
+                &lockr_path(),
+                &json!({"tokens": [
+                    {"source": FIRST, "value": "secret-uid-1"},
+                    {"source": SECOND, "value": "secret-uid-2"},
+                ]}),
+            );
+
+            assert_eq!(
+                fixture.row(),
+                live_row(),
+                "should store neither positive ID"
+            );
+            assert_eq!(fixture.store.writes().total(), 0, "should make no KV write");
+            let counted = fixture.context.identity().capture_unpersisted();
+            assert_eq!(
+                counted,
+                &BTreeMap::from([
+                    ((pid("lockr"), source(FIRST)), 1),
+                    ((pid("lockr"), source(SECOND)), 1),
+                ]),
+                "should count one per source"
+            );
+            assert!(
+                !format!("{counted:?}").contains("secret-uid"),
+                "should hold no value"
+            );
+        }
+
+        #[test]
+        fn capture_removal_is_written_before_send() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+
+            fixture.capture(
+                &lockr_path(),
+                &json!({"tokens": [{"source": SECOND, "value": "secret-uid-b"}],
+                    "invalidate": [FIRST]}),
+            );
+
+            let writes = fixture.store.writes();
+            assert_eq!(
+                writes.if_generation_match, 1,
+                "should write once with a CAS"
+            );
+            assert_eq!(writes.total(), 1, "should make no other write");
+            let row = fixture.row();
+            assert!(!row.ids.contains_key(FIRST), "should remove the record");
+            assert!(
+                !row.ids.contains_key(SECOND),
+                "should store no positive ID alongside"
+            );
+            assert_eq!(
+                row.ps["lockr"].iv,
+                set_hashes(&seeded.ids[FIRST].eids),
+                "should hash the removed record into iv"
+            );
+            assert!(
+                fixture.context.identity().pending_removals().is_none(),
+                "should leave nothing to retry"
+            );
+        }
+
+        #[test]
+        fn capture_removal_applies_whatever_the_consent() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let body = json!({"invalidate": [FIRST]});
+
+            let mut granted = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            granted.capture(&lockr_path(), &body);
+            let mut denied =
+                CaptureFixture::new(vec![lockr()], Some(&seeded)).with_consent(denied_consent());
+            denied.capture(&lockr_path(), &body);
+
+            assert_eq!(
+                denied.row(),
+                granted.row(),
+                "should write the same removal under denied consent"
+            );
+            assert!(
+                !denied.row().ids.contains_key(FIRST),
+                "should remove the record"
+            );
+            assert_eq!(denied.store.writes().total(), 1, "should write once");
+        }
+
+        #[test]
+        fn capture_removal_write_retries_only_on_generation_mismatch() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let body = json!({"invalidate": [FIRST]});
+
+            let mut mismatched = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            mismatched.store.refuse_conditional_writes(TEST_EC_ID, 2);
+            mismatched.capture(&lockr_path(), &body);
+            assert_eq!(
+                mismatched.store.writes().if_generation_match,
+                3,
+                "should retry each generation mismatch"
+            );
+            assert!(
+                !mismatched.row().ids.contains_key(FIRST),
+                "should win on the third write"
+            );
+
+            let mut failing = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            failing.store.fail_conditional_writes(TEST_EC_ID);
+            failing.capture(&lockr_path(), &body);
+            assert_eq!(
+                failing.store.writes().if_generation_match,
+                1,
+                "should not retry a non-CAS error"
+            );
+        }
+
+        #[test]
+        fn failed_capture_removal_write_runs_once_more_after_send() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            fixture.store.refuse_conditional_writes(TEST_EC_ID, 5);
+
+            fixture.capture(&lockr_path(), &json!({"invalidate": [FIRST]}));
+
+            assert!(
+                fixture.row().ids.contains_key(FIRST),
+                "should leave the record after five refusals"
+            );
+            assert!(
+                fixture.context.identity().pending_removals().is_some(),
+                "should keep the removal for the retry"
+            );
+            assert_eq!(
+                fixture.context.identity().removal_lost(),
+                0,
+                "should not count a removal lost yet"
+            );
+
+            fixture.retry_after_send();
+
+            assert!(
+                !fixture.row().ids.contains_key(FIRST),
+                "should write the removal after send"
+            );
+            assert!(
+                fixture.context.identity().pending_removals().is_none(),
+                "should clear the pending removal"
+            );
+            assert_eq!(
+                fixture.context.identity().removal_lost(),
+                0,
+                "should count nothing lost"
+            );
+        }
+
+        #[test]
+        fn capture_removal_after_both_attempts_goes_to_the_pending_key() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            fixture.store.fail_conditional_writes(TEST_EC_ID);
+
+            fixture.capture(&lockr_path(), &json!({"invalidate": [FIRST]}));
+            fixture.retry_after_send();
+
+            assert_eq!(
+                fixture.context.identity().removal_lost(),
+                0,
+                "should lose nothing"
+            );
+            assert_eq!(
+                fixture.context.identity().removal_deferred(),
+                1,
+                "should defer the removal"
+            );
+            let merge =
+                load_pending(&fixture.graph, TEST_EC_ID, 0).expect("should hold the removal");
+            assert_eq!(
+                merge.mutation.removal_labels(),
+                vec![(pid("lockr"), Some(source(FIRST)))],
+                "should hold the capture's removal"
+            );
+        }
+
+        #[test]
+        fn capture_removal_lost_after_both_attempts_is_counted_and_logged_without_a_value() {
+            install_capturing_logger();
+            let provider = answering_capture_provider("lostcap", &[FIRST], None);
+            let seeded = row_with(&[(FIRST, "secret-uid-lost-9137", None)]);
+            let mut fixture = CaptureFixture::new(vec![provider], Some(&seeded));
+            fixture.store.fail_conditional_writes(TEST_EC_ID);
+            fixture.store.fail_all_writes(&pending_key(TEST_EC_ID));
+
+            fixture.capture(&capture_path("lostcap"), &json!({"invalidate": [FIRST]}));
+            fixture.retry_after_send();
+
+            assert_eq!(
+                fixture.context.identity().removal_lost(),
+                1,
+                "should count the lost removal"
+            );
+            assert!(
+                fixture.context.identity().pending_removals().is_none(),
+                "should keep nothing after the last attempt"
+            );
+            assert!(
+                fixture.row().ids.contains_key(FIRST),
+                "control: the record is still there"
+            );
+            let logs = captured_logs();
+            assert!(
+                logs.iter().any(|line| line.contains("removal lost")
+                    && line.contains("lostcap")
+                    && line.contains(FIRST)),
+                "should log the provider and source: {logs:?}"
+            );
+            assert!(
+                !logs
+                    .iter()
+                    .any(|line| line.contains("secret-uid-lost-9137")),
+                "should log no value"
+            );
+        }
+
+        #[test]
+        fn capture_removal_write_skips_a_tombstone_a_missing_row_and_an_applied_removal() {
+            let body = json!({"invalidate": [FIRST]});
+
+            let mut tombstone =
+                CaptureFixture::new(vec![lockr()], Some(&KvEntry::tombstone(1_000)));
+            tombstone.capture(&lockr_path(), &body);
+            let mut missing = CaptureFixture::new(vec![lockr()], None);
+            missing.capture(&lockr_path(), &body);
+            let mut applied = CaptureFixture::new(vec![lockr()], Some(&live_row()));
+            applied.capture(&lockr_path(), &body);
+
+            for (name, fixture) in [
+                ("a tombstone", &tombstone),
+                ("a missing row", &missing),
+                ("an applied removal", &applied),
+            ] {
+                assert_eq!(
+                    fixture.store.writes().total(),
+                    0,
+                    "should write nothing for {name}"
+                );
+                assert!(
+                    fixture.context.identity().pending_removals().is_none(),
+                    "should keep nothing to retry for {name}"
+                );
+            }
+            let mut control = CaptureFixture::new(
+                vec![lockr()],
+                Some(&row_with(&[(FIRST, "secret-uid-a", None)])),
+            );
+            control.capture(&lockr_path(), &body);
+            assert_eq!(
+                control.store.writes().total(),
+                1,
+                "control: a live record is written"
+            );
+        }
+
+        #[test]
+        fn capture_opt_out_removes_every_record_the_provider_wrote() {
+            let seeded = row_with(&[
+                (FIRST, "secret-uid-a", Some("lockr")),
+                (SECOND, "secret-uid-b", Some("other")),
+            ]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+
+            fixture.capture(&lockr_path(), &json!({"opted_out": true}));
+
+            let row = fixture.row();
+            assert!(
+                !row.ids.contains_key(FIRST),
+                "should remove the record the provider wrote"
+            );
+            assert!(
+                row.ids.contains_key(SECOND),
+                "control: should keep another writer's record"
+            );
+            assert!(row.ps["lockr"].o.is_some(), "should store the opt-out");
+            assert_eq!(
+                row.ps["lockr"].ov,
+                set_hashes(&seeded.ids[FIRST].eids),
+                "should hash the removed record into ov"
+            );
+            assert_eq!(fixture.store.writes().total(), 1, "should write once");
+        }
+
+        #[test]
+        fn capture_only_opt_out_also_removes_browser_records_of_its_sources() {
+            let seeded = row_with(&[
+                (FIRST, "secret-uid-a", None),
+                ("unrelated.example.com", "secret-uid-c", None),
+            ]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+
+            fixture.capture(&lockr_path(), &json!({"opted_out": true}));
+
+            let row = fixture.row();
+            assert!(
+                !row.ids.contains_key(FIRST),
+                "should remove the browser record of its source"
+            );
+            assert!(
+                row.ids.contains_key("unrelated.example.com"),
+                "control: should keep a browser record of another source"
+            );
+        }
+
+        #[test]
+        fn capture_only_provider_clears_its_opt_out_on_a_consenting_positive_result() {
+            let seeded = opted_out_row(100);
+            let positive = json!({"tokens": [{"source": FIRST, "value": "secret-uid-a"}]});
+
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            fixture.capture(&lockr_path(), &positive);
+            let row = fixture.row();
+            assert_eq!(
+                row.ps["lockr"].oc,
+                Some(100),
+                "should store the clear with the opt-out it saw as its watermark"
+            );
+            assert!(row.ids.is_empty(), "should store no ID");
+            assert_eq!(fixture.store.writes().total(), 1, "should write once");
+
+            let mut denied =
+                CaptureFixture::new(vec![lockr()], Some(&seeded)).with_consent(denied_consent());
+            denied.capture(&lockr_path(), &positive);
+            assert_eq!(
+                denied.row().ps["lockr"].oc,
+                None,
+                "control: should not clear under denied consent"
+            );
+            assert_eq!(denied.store.writes().total(), 0, "should not write");
+
+            let mut vendor = CaptureFixture::new(
+                vec![answering_capture_provider("lockr", &[FIRST], Some(7))],
+                Some(&seeded),
+            );
+            vendor.capture(&lockr_path(), &positive);
+            assert_eq!(
+                vendor.row().ps["lockr"].oc,
+                None,
+                "control: a provider with a GVL ID never clears by capture"
+            );
+
+            let mut empty = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            empty.capture(&lockr_path(), &json!({}));
+            assert_eq!(
+                empty.row().ps["lockr"].oc,
+                None,
+                "control: a result without IDs does not clear"
+            );
+        }
+
+        #[test]
+        fn capture_global_revoke_from_a_real_browser_requests_the_tombstone_and_writes_nothing() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", Some("lockr"))]);
+            let mut global = CaptureFixture::with_scopes(vec![lockr()], Some(&seeded), &["lockr"]);
+
+            global.capture(&lockr_path(), &json!({"opted_out": true}));
+
+            assert!(
+                global.context.global_revoke_requested(),
+                "should request the global revoke"
+            );
+            assert_eq!(global.row(), seeded, "should leave the row to finalize");
+            assert_eq!(global.store.writes().total(), 0, "should write nothing");
+
+            let mut provider = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            provider.capture(&lockr_path(), &json!({"opted_out": true}));
+            assert!(
+                !provider.context.global_revoke_requested(),
+                "control: the provider scope requests no global revoke"
+            );
+            assert!(
+                provider.row().ps["lockr"].o.is_some(),
+                "control: the provider scope stores the opt-out"
+            );
+        }
+
+        #[test]
+        fn capture_from_a_non_browser_applies_its_removals_and_opt_out() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", Some("lockr"))]);
+
+            let mut invalidated = CaptureFixture::new(vec![lockr()], Some(&seeded)).not_a_browser();
+            invalidated.capture(&lockr_path(), &json!({"invalidate": [FIRST]}));
+            assert!(
+                !invalidated.row().ids.contains_key(FIRST),
+                "should remove the invalidated record"
+            );
+            assert_eq!(
+                invalidated.store.writes().if_generation_match,
+                1,
+                "should write the removal at once"
+            );
+
+            let mut opted_out = CaptureFixture::new(vec![lockr()], Some(&seeded)).not_a_browser();
+            opted_out.capture(&lockr_path(), &json!({"opted_out": true}));
+            let row = opted_out.row();
+            assert!(row.ps["lockr"].o.is_some(), "should store the opt-out");
+            assert!(
+                !row.ids.contains_key(FIRST),
+                "should remove what the provider wrote"
+            );
+
+            let mut global = CaptureFixture::with_scopes(vec![lockr()], Some(&seeded), &["lockr"])
+                .not_a_browser();
+            global.capture(&lockr_path(), &json!({"opted_out": true}));
+            assert!(
+                global.context.global_revoke_requested(),
+                "should request the global revoke, as a withdrawal from any client does"
+            );
+        }
+
+        #[test]
+        fn capture_from_a_non_browser_never_clears_an_opt_out() {
+            let seeded = opted_out_row(100);
+            let positive = json!({"tokens": [{"source": FIRST, "value": "secret-uid-a"}]});
+
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded)).not_a_browser();
+            fixture.capture(&lockr_path(), &positive);
+
+            assert_eq!(
+                fixture.row().ps["lockr"].oc,
+                None,
+                "should not clear the opt-out"
+            );
+            assert_eq!(fixture.store.writes().total(), 0, "should write nothing");
+            assert_eq!(
+                fixture.context.identity().capture_unpersisted().len(),
+                1,
+                "should still count the positive ID"
+            );
+        }
+
+        #[test]
+        fn capture_on_a_proxy_writer_navigation_uses_the_removal_write_not_the_mutation() {
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            fixture.context.identity_mut().set_writer_decision(
+                crate::ec::identity::request::WriterDecision {
+                    writer: true,
+                    is_real_browser: true,
+                    user_agent: None,
+                    dnt: false,
+                    page_url: None,
+                },
+            );
+
+            fixture.capture(&lockr_path(), &json!({"invalidate": [FIRST]}));
+
+            assert!(
+                fixture.context.identity().mutation().is_empty(),
+                "should leave the writer's mutation alone"
+            );
+            assert_eq!(
+                fixture.store.writes().if_generation_match,
+                1,
+                "should write the removal at once"
+            );
+            assert!(
+                !fixture.row().ids.contains_key(FIRST),
+                "should remove the record"
+            );
+        }
+
+        #[test]
+        fn capture_never_touches_n_f_or_the_breaker() {
+            let mut seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            seeded.ps.insert(
+                "lockr".to_owned(),
+                KvProviderState {
+                    n: Some(9_999_999_999),
+                    f: 2,
+                    ..KvProviderState::default()
+                },
+            );
+            for body in [
+                json!({"invalidate": [FIRST]}),
+                json!({"opted_out": true}),
+                json!({}),
+            ] {
+                let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+
+                fixture.capture(&lockr_path(), &body);
+
+                let state = &fixture.row().ps["lockr"];
+                assert_eq!(state.n, Some(9_999_999_999), "should keep n for {body}");
+                assert_eq!(state.f, 2, "should keep f for {body}");
+            }
+        }
+
+        #[test]
+        fn capture_removal_lost_when_the_row_cannot_be_read() {
+            install_capturing_logger();
+            let provider = answering_capture_provider("unreadcap", &[FIRST], None);
+            let seeded = row_with(&[(FIRST, "secret-uid-unread-5521", None)]);
+            let unreadable = |fixture: &mut CaptureFixture| {
+                fixture.context.set_kv_snapshot(EcKvSnapshot::Failed {
+                    ec_id: TEST_EC_ID.to_owned(),
+                });
+            };
+
+            // An invalidation needs the row's revision, so it is lost.
+            let mut invalidating = CaptureFixture::new(vec![provider.clone()], Some(&seeded));
+            unreadable(&mut invalidating);
+            invalidating.capture(&capture_path("unreadcap"), &json!({"invalidate": [FIRST]}));
+            assert_eq!(
+                invalidating.context.identity().removal_lost(),
+                1,
+                "should count the invalidation it could not build"
+            );
+            assert_eq!(
+                invalidating.store.writes().total(),
+                0,
+                "should write nothing"
+            );
+
+            // An opt-out needs no view: the removal write re-reads and writes it.
+            let mut opting_out = CaptureFixture::new(vec![provider.clone()], Some(&seeded));
+            unreadable(&mut opting_out);
+            opting_out.capture(&capture_path("unreadcap"), &json!({"opted_out": true}));
+            assert_eq!(
+                opting_out.context.identity().removal_lost(),
+                0,
+                "should not count the opt-out lost"
+            );
+            let row = opting_out.row();
+            assert!(row.ps["unreadcap"].o.is_some(), "should store the opt-out");
+            assert!(
+                !row.ids.contains_key(FIRST),
+                "should remove the provider's source record"
+            );
+
+            // A failed opt-out write gets the after-send retry, then is lost
+            // when the pending key cannot take it either.
+            let mut failing = CaptureFixture::new(vec![provider.clone()], Some(&seeded));
+            unreadable(&mut failing);
+            failing.store.fail_conditional_writes(TEST_EC_ID);
+            failing.store.fail_all_writes(&pending_key(TEST_EC_ID));
+            failing.capture(&capture_path("unreadcap"), &json!({"opted_out": true}));
+            assert!(
+                failing.context.identity().pending_removals().is_some(),
+                "should stage the opt-out for the retry"
+            );
+            assert_eq!(failing.context.identity().removal_lost(), 0, "not lost yet");
+            failing.retry_after_send();
+            assert_eq!(
+                failing.context.identity().removal_lost(),
+                1,
+                "should count the opt-out lost once its retry fails"
+            );
+
+            let mut empty = CaptureFixture::new(vec![provider], Some(&seeded));
+            unreadable(&mut empty);
+            empty.capture(&capture_path("unreadcap"), &json!({}));
+            assert_eq!(
+                empty.context.identity().removal_lost(),
+                0,
+                "control: a result without removals loses nothing"
+            );
+
+            let logs = captured_logs();
+            assert!(
+                logs.iter().any(|line| line.contains("removal lost")
+                    && line.contains("unreadcap")
+                    && line.contains(FIRST)),
+                "should log the provider and source: {logs:?}"
+            );
+            assert!(
+                !logs
+                    .iter()
+                    .any(|line| line.contains("secret-uid-unread-5521")),
+                "should log no value"
+            );
+        }
+
+        #[test]
+        fn capture_counts_its_kv_operations_in_the_measurement() {
+            use crate::ec::identity::measurement::MeasurementInput;
+
+            let seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            let mut fixture = CaptureFixture::new(vec![lockr()], Some(&seeded));
+            fixture.context.set_kv_snapshot(EcKvSnapshot::NotRead);
+            fixture.store.refuse_conditional_writes(TEST_EC_ID, 2);
+
+            fixture.capture(&lockr_path(), &json!({"invalidate": [FIRST]}));
+
+            let measurement = fixture.context.identity_measurement(&MeasurementInput {
+                phase_one_read: false,
+                kv_reads: 0,
+                kv_writes: 0,
+                flush: None,
+                withdrawal_after_send: false,
+                withdrawal_after_send_failed: false,
+            });
+            assert_eq!(
+                measurement.kv_reads(),
+                4,
+                "should count the view read and three removal-write reads"
+            );
+            assert_eq!(
+                measurement.kv_writes(),
+                3,
+                "should count each removal-write attempt"
+            );
+            assert_eq!(
+                fixture.store.writes().if_generation_match,
+                3,
+                "control: the store saw the same writes"
+            );
+        }
+
+        #[test]
+        fn capture_global_revoke_skips_the_other_providers_removals() {
+            let shared = "/integrations/shared/";
+            let global = crate::ec::identity::test_support::answering_capture_provider_at(
+                "lockr",
+                &[FIRST],
+                None,
+                shared,
+            );
+            let local = crate::ec::identity::test_support::answering_capture_provider_at(
+                "localcap",
+                &[SECOND],
+                None,
+                shared,
+            );
+            let seeded = row_with(&[
+                (FIRST, "secret-uid-a", Some("lockr")),
+                (SECOND, "secret-uid-b", None),
+            ]);
+            let mut fixture =
+                CaptureFixture::with_scopes(vec![global, local], Some(&seeded), &["lockr"]);
+
+            fixture.capture(
+                "/integrations/shared/api",
+                &json!({"opted_out": true, "invalidate": [SECOND]}),
+            );
+
+            assert!(
+                fixture.context.global_revoke_requested(),
+                "should request the global revoke"
+            );
+            assert_eq!(
+                fixture.store.writes().total(),
+                0,
+                "should leave every removal to the tombstone"
+            );
+            assert!(
+                fixture.context.identity().pending_removals().is_none(),
+                "should keep nothing to retry"
+            );
+        }
+
+        #[test]
+        fn capture_state_change_is_ignored() {
+            let mut seeded = row_with(&[(FIRST, "secret-uid-a", None)]);
+            seeded.ps.insert(
+                "statecap".to_owned(),
+                KvProviderState {
+                    st: Some(json!("old-state")),
+                    ..KvProviderState::default()
+                },
+            );
+            install_capturing_logger();
+            let provider = answering_capture_provider("statecap", &[FIRST], None);
+            let mut fixture = CaptureFixture::new(vec![provider], Some(&seeded));
+
+            fixture.capture(
+                &capture_path("statecap"),
+                &json!({"invalidate": [FIRST], "state": "new-state"}),
+            );
+            assert!(
+                captured_logs()
+                    .iter()
+                    .any(|line| line.contains("'statecap'")
+                        && line.contains("state change from capture")),
+                "should warn about the ignored state change"
+            );
+
+            let row = fixture.row();
+            assert_eq!(
+                row.ps["statecap"].st,
+                Some(json!("old-state")),
+                "should keep the stored state"
+            );
+            assert!(
+                !row.ids.contains_key(FIRST),
+                "control: should still apply the removal"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/denials.rs b/crates/trusted-server-core/src/ec/identity/denials.rs
new file mode 100644
index 0000000000..1c4e10dc6c
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/denials.rs
@@ -0,0 +1,311 @@
+//! Provider denials of browser EID candidates, read from KV (spec 7.1,
+//! "Provider denials apply to browser candidates").
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use super::catalog::ProviderCatalog;
+use super::ids::SourceDomain;
+use super::request::opted_out;
+use super::revision::uid_hash;
+use crate::ec::kv_types::KvEntry;
+use crate::openrtb::Eid;
+
+/// What the providers that claim a source deny of the browser's candidates.
+///
+/// Empty without a KV read.
+#[derive(Debug, Default)]
+pub(crate) struct Denials {
+    /// Per source, the `ps.iv` and `ps.ov` hashes of every claiming provider.
+    hashes: BTreeMap<SourceDomain, BTreeSet<String>>,
+    /// Sources whose browser value is dropped whole: those of an opted-out
+    /// owner, and every source of an opted-out capture-only provider.
+    dropped: BTreeSet<SourceDomain>,
+}
+
+impl Denials {
+    fn is_empty(&self) -> bool {
+        self.hashes.is_empty() && self.dropped.is_empty()
+    }
+}
+
+/// The denials `entry` holds for the providers in `catalog` (spec 7.1).
+#[must_use]
+pub(crate) fn denials(entry: &KvEntry, catalog: &ProviderCatalog) -> Denials {
+    let mut result = Denials::default();
+    let sources: BTreeSet<&SourceDomain> = catalog
+        .providers()
+        .flat_map(|provider| catalog.sources_of(provider.descriptor().id()))
+        .collect();
+    for source in sources {
+        let hashes: BTreeSet<String> = catalog
+            .claimants(source)
+            .filter_map(|provider| entry.ps.get(provider.as_str()))
+            .flat_map(|state| state.iv.iter().chain(&state.ov).cloned())
+            .collect();
+        if !hashes.is_empty() {
+            result.hashes.insert(source.clone(), hashes);
+        }
+    }
+    for provider in opted_out(entry) {
+        let capture_only = catalog.is_capture_only(&provider);
+        for source in catalog.sources_of(&provider) {
+            if capture_only || catalog.owner_of(source) == Some(&provider) {
+                result.dropped.insert(source.clone());
+            }
+        }
+    }
+    result
+}
+
+/// The browser's candidates after `denials` (spec 7.1).
+///
+/// Drops each entry of a dropped-whole source; otherwise drops each UID whose
+/// hash a claiming provider holds, then each entry left with no UID. Every
+/// other entry goes through untouched, in order.
+#[must_use]
+pub(crate) fn filter_browser_candidates(client: &[Eid], denials: &Denials) -> Vec<Eid> {
+    if denials.is_empty() {
+        return client.to_vec();
+    }
+    let mut kept = Vec::with_capacity(client.len());
+    for eid in client {
+        let Ok(source) = eid.source.parse::<SourceDomain>() else {
+            kept.push(eid.clone());
+            continue;
+        };
+        if denials.dropped.contains(&source) {
+            continue;
+        }
+        let Some(hashes) = denials.hashes.get(&source) else {
+            kept.push(eid.clone());
+            continue;
+        };
+        let mut filtered = eid.clone();
+        filtered
+            .uids
+            .retain(|uid| !hashes.contains(&uid_hash(&uid.id)));
+        if !filtered.uids.is_empty() {
+            kept.push(filtered);
+        }
+    }
+    kept
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use super::*;
+    use crate::ec::identity::test_support::{fixed_capture_provider, fixed_provider, pid, source};
+    use crate::ec::kv_types::{KvOptOut, KvProviderState};
+    use crate::openrtb::Uid;
+
+    fn uid(id: &str) -> Uid {
+        Uid {
+            id: id.to_owned(),
+            atype: Some(1),
+            ext: None,
+        }
+    }
+
+    fn browser(source: &str, ids: &[&str]) -> Eid {
+        Eid {
+            source: source.to_owned(),
+            uids: ids.iter().map(|id| uid(id)).collect(),
+            inserter: Some("inserter.example.com".to_owned()),
+            matcher: None,
+            mm: Some(1),
+            ext: None,
+        }
+    }
+
+    fn entry_with(states: &[(&str, KvProviderState)]) -> KvEntry {
+        let mut entry = KvEntry::minimal("unused.example.com", "unused", 1);
+        for (provider, state) in states {
+            entry.ps.insert((*provider).to_owned(), state.clone());
+        }
+        entry
+    }
+
+    fn invalidated(uids: &[&str]) -> KvProviderState {
+        KvProviderState {
+            iv: uids.iter().map(|uid| uid_hash(uid)).collect(),
+            ..KvProviderState::default()
+        }
+    }
+
+    fn opted_out_state() -> KvProviderState {
+        KvProviderState {
+            o: Some(KvOptOut {
+                at: 10,
+                fp: "0".to_owned(),
+            }),
+            ..KvProviderState::default()
+        }
+    }
+
+    fn unowned_catalog() -> ProviderCatalog {
+        ProviderCatalog::new(
+            vec![
+                fixed_provider("pa", &["a.example.com"]),
+                fixed_provider("pb", &["b.example.com"]),
+            ],
+            BTreeMap::new(),
+        )
+    }
+
+    #[test]
+    fn denial_drops_a_browser_uid_in_a_claimants_iv_for_an_unowned_source() {
+        let entry = entry_with(&[("pa", invalidated(&["a-old"]))]);
+        let denials = denials(&entry, &unowned_catalog());
+
+        let kept = filter_browser_candidates(
+            &[
+                browser("a.example.com", &["a-old"]),
+                browser("b.example.com", &["b1"]),
+            ],
+            &denials,
+        );
+
+        assert_eq!(
+            kept,
+            vec![browser("b.example.com", &["b1"])],
+            "should drop the invalidated UID and its emptied entry"
+        );
+    }
+
+    #[test]
+    fn denial_drops_a_browser_uid_in_a_claimants_ov() {
+        let state = KvProviderState {
+            ov: vec![uid_hash("a-removed")],
+            ..KvProviderState::default()
+        };
+        let entry = entry_with(&[("pa", state)]);
+        let denials = denials(&entry, &unowned_catalog());
+
+        let kept = filter_browser_candidates(&[browser("a.example.com", &["a-removed"])], &denials);
+
+        assert_eq!(
+            kept,
+            Vec::<Eid>::new(),
+            "should drop a UID the opt-out removed"
+        );
+    }
+
+    #[test]
+    fn denial_filters_uid_by_uid_and_drops_an_emptied_entry() {
+        let entry = entry_with(&[("pa", invalidated(&["A"]))]);
+        let denials = denials(&entry, &unowned_catalog());
+
+        let kept = filter_browser_candidates(
+            &[
+                browser("a.example.com", &["A", "B"]),
+                browser("a.example.com", &["A"]),
+            ],
+            &denials,
+        );
+
+        assert_eq!(
+            kept,
+            vec![Eid {
+                source: "a.example.com".to_owned(),
+                uids: vec![uid("B")],
+                inserter: Some("inserter.example.com".to_owned()),
+                matcher: None,
+                mm: Some(1),
+                ext: None,
+            }],
+            "should keep B alone and drop the entry holding only A"
+        );
+    }
+
+    #[test]
+    fn denial_ignores_hashes_of_a_provider_that_does_not_claim_the_source() {
+        let entry = entry_with(&[("pb", invalidated(&["shared"]))]);
+        let denials = denials(&entry, &unowned_catalog());
+
+        let kept = filter_browser_candidates(&[browser("a.example.com", &["shared"])], &denials);
+
+        assert_eq!(
+            kept,
+            vec![browser("a.example.com", &["shared"])],
+            "should not apply another source's hashes"
+        );
+    }
+
+    #[test]
+    fn denial_drops_every_owned_source_while_the_owner_is_opted_out() {
+        let catalog = ProviderCatalog::new(
+            vec![fixed_provider("owner", &["a.example.com", "b.example.com"])],
+            BTreeMap::from([(source("a.example.com"), pid("owner"))]),
+        );
+        let entry = entry_with(&[("owner", opted_out_state())]);
+        let denials = denials(&entry, &catalog);
+
+        let kept = filter_browser_candidates(
+            &[
+                browser("a.example.com", &["a1"]),
+                browser("b.example.com", &["b1"]),
+            ],
+            &denials,
+        );
+
+        assert_eq!(
+            kept,
+            vec![browser("b.example.com", &["b1"])],
+            "should drop the owned source and keep the unowned one"
+        );
+    }
+
+    #[test]
+    fn denial_drops_every_source_of_an_opted_out_capture_only_provider() {
+        let catalog = ProviderCatalog::new(
+            vec![
+                fixed_capture_provider("cap", &["a.example.com", "b.example.com"]),
+                fixed_provider("other", &["c.example.com"]),
+            ],
+            BTreeMap::from([(source("a.example.com"), pid("cap"))]),
+        );
+        let client = [
+            browser("a.example.com", &["a1"]),
+            browser("b.example.com", &["b1"]),
+            browser("c.example.com", &["c1"]),
+        ];
+        let entry = entry_with(&[("cap", opted_out_state())]);
+
+        let kept = filter_browser_candidates(&client, &denials(&entry, &catalog));
+
+        assert_eq!(
+            kept,
+            vec![browser("c.example.com", &["c1"])],
+            "should drop owned and unowned sources of the capture-only provider"
+        );
+
+        let cleared = KvProviderState {
+            oc: Some(20),
+            ..opted_out_state()
+        };
+        let entry = entry_with(&[("cap", cleared)]);
+        let kept = filter_browser_candidates(&client, &denials(&entry, &catalog));
+        assert_eq!(
+            kept,
+            client.to_vec(),
+            "control: after a later oc the browser values go out again"
+        );
+    }
+
+    #[test]
+    fn denial_mirror_id_fed_back_through_the_body_is_filtered() {
+        let entry = entry_with(&[("pa", invalidated(&["mirror-only"]))]);
+        let denials = denials(&entry, &unowned_catalog());
+
+        let kept =
+            filter_browser_candidates(&[browser("a.example.com", &["mirror-only"])], &denials);
+
+        assert_eq!(
+            kept,
+            Vec::<Eid>::new(),
+            "a stale mirror ID fed back as a browser candidate should not be sent"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/descriptor.rs b/crates/trusted-server-core/src/ec/identity/descriptor.rs
new file mode 100644
index 0000000000..908ea9df39
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/descriptor.rs
@@ -0,0 +1,1176 @@
+//! What a provider is, may write, needs and must respect.
+
+use core::time::Duration;
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use http::Method;
+use url::Url;
+
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::resolution::IdentityProviderError;
+use crate::ec::kv_types::{MAX_EID_FIELD_BYTES, is_valid_eid_field};
+use crate::ec::partner::normalize_partner_source_domain;
+
+/// What a provider is, may write, needs and must respect.
+///
+/// Built from config with no secrets, so `ts config validate` and the running
+/// coordinator read the same value.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderDescriptor {
+    id: IdentityProviderId,
+    sources: Vec<SourceDomain>,
+    resolves: Option<Resolves>,
+    endpoint: Option<Url>,
+    captures: Option<Captures>,
+    consent_policy: ConsentPolicy,
+    provenance: BTreeMap<SourceDomain, EidProvenance>,
+    expiring: BTreeSet<SourceDomain>,
+}
+
+impl ProviderDescriptor {
+    /// Starts a descriptor for `id`.
+    #[must_use]
+    pub fn builder(id: IdentityProviderId) -> ProviderDescriptorBuilder {
+        ProviderDescriptorBuilder {
+            id,
+            sources: Vec::new(),
+            resolves: None,
+            captures: None,
+            consent_policy: ConsentPolicy::strict(),
+            provenance: BTreeMap::new(),
+            expiring_all: false,
+            expiring: BTreeSet::new(),
+        }
+    }
+
+    /// The provider's ID.
+    #[must_use]
+    pub fn id(&self) -> &IdentityProviderId {
+        &self.id
+    }
+
+    /// The sources this provider may write, in declaration order.
+    #[must_use]
+    pub fn sources(&self) -> &[SourceDomain] {
+        &self.sources
+    }
+
+    /// The first source added. Every built descriptor has one.
+    #[must_use]
+    pub fn primary_source(&self) -> &SourceDomain {
+        &self.sources[0]
+    }
+
+    /// Finds a declared source by a vendor's spelling of it, normalized.
+    #[must_use]
+    pub fn source_named(&self, name: &str) -> Option<&SourceDomain> {
+        self.sources.iter().find(|source| source.matches(name))
+    }
+
+    /// Active resolution, when declared.
+    #[must_use]
+    pub fn resolves(&self) -> Option<&Resolves> {
+        self.resolves.as_ref()
+    }
+
+    /// The endpoint declared with [`Resolves::with_endpoint`], if any.
+    #[must_use]
+    pub fn endpoint(&self) -> Option<&Url> {
+        self.endpoint.as_ref()
+    }
+
+    /// Passive capture, when declared.
+    #[must_use]
+    pub fn captures(&self) -> Option<&Captures> {
+        self.captures.as_ref()
+    }
+
+    /// The consent this provider requires.
+    #[must_use]
+    pub fn consent_policy(&self) -> &ConsentPolicy {
+        &self.consent_policy
+    }
+
+    /// Default EID-level fields for `source`, if declared.
+    #[must_use]
+    pub fn provenance(&self, source: &SourceDomain) -> Option<&EidProvenance> {
+        self.provenance.get(source)
+    }
+
+    /// Whether IDs of `source` are declared as expiring.
+    #[must_use]
+    pub fn is_expiring(&self, source: &SourceDomain) -> bool {
+        self.expiring.contains(source)
+    }
+}
+
+/// Builds a [`ProviderDescriptor`].
+#[derive(Debug, Clone)]
+pub struct ProviderDescriptorBuilder {
+    id: IdentityProviderId,
+    sources: Vec<SourceDomain>,
+    resolves: Option<Resolves>,
+    captures: Option<Captures>,
+    consent_policy: ConsentPolicy,
+    provenance: BTreeMap<SourceDomain, EidProvenance>,
+    expiring_all: bool,
+    expiring: BTreeSet<SourceDomain>,
+}
+
+impl ProviderDescriptorBuilder {
+    /// Adds a source this provider may write. Repeatable. A repeat is ignored.
+    #[must_use]
+    pub fn with_source(mut self, source: SourceDomain) -> Self {
+        if !self.sources.contains(&source) {
+            self.sources.push(source);
+        }
+        self
+    }
+
+    /// Declares active resolution.
+    #[must_use]
+    pub fn with_resolves(mut self, resolves: Resolves) -> Self {
+        self.resolves = Some(resolves);
+        self
+    }
+
+    /// Declares passive capture.
+    #[must_use]
+    pub fn with_captures(mut self, captures: Captures) -> Self {
+        self.captures = Some(captures);
+        self
+    }
+
+    /// Replaces the default policy, [`ConsentPolicy::strict`].
+    #[must_use]
+    pub fn with_consent_policy(mut self, policy: ConsentPolicy) -> Self {
+        self.consent_policy = policy;
+        self
+    }
+
+    /// Marks the IDs of every declared source as expiring (spec 6.1).
+    #[must_use]
+    pub fn with_expiring_ids(mut self) -> Self {
+        self.expiring_all = true;
+        self
+    }
+
+    /// Marks the IDs of one declared source as expiring.
+    #[must_use]
+    pub fn with_expiring_source(mut self, source: &SourceDomain) -> Self {
+        self.expiring.insert(source.clone());
+        self
+    }
+
+    /// Default EID-level fields for a declared source. At output, the
+    /// coordinator applies them to a stored entry of that source, written by
+    /// this provider, only when the entry sets none of `inserter`, `matcher`
+    /// and `mm`. An entry that sets any of them is the vendor's complete
+    /// statement, so vendor and config provenance never mix in one entry.
+    /// The defaults are not stored, so a config change applies at once.
+    #[must_use]
+    pub fn with_provenance(mut self, source: &SourceDomain, provenance: EidProvenance) -> Self {
+        self.provenance.insert(source.clone(), provenance);
+        self
+    }
+
+    /// Validates and builds the descriptor.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Config` when the descriptor has no source, no capability, a
+    /// resolver with no endpoint or host, an endpoint that is not an `https`
+    /// URL, a host that is not a bare hostname, provenance or an expiring
+    /// mark for a source it does not declare, a provenance `inserter` or
+    /// `matcher` that is blank or over 255 bytes, or a provenance `mm` below 0.
+    pub fn build(self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        let id = self.id;
+        let fail = |what: &str| IdentityProviderError::config(format!("provider `{id}`: {what}"));
+
+        if self.sources.is_empty() {
+            return Err(fail("declares no source"));
+        }
+        if self.resolves.is_none() && self.captures.is_none() {
+            return Err(fail("declares neither resolves nor captures"));
+        }
+        for source in self.provenance.keys().chain(self.expiring.iter()) {
+            if !self.sources.contains(source) {
+                return Err(fail(&format!("names undeclared source `{source}`")));
+            }
+        }
+        for (source, provenance) in &self.provenance {
+            let fields = [
+                ("inserter", provenance.inserter()),
+                ("matcher", provenance.matcher()),
+            ];
+            for (name, value) in fields {
+                if let Some(value) = value
+                    && !is_valid_eid_field(value)
+                {
+                    return Err(fail(&format!(
+                        "provenance `{name}` for `{source}` is blank or over {MAX_EID_FIELD_BYTES} bytes"
+                    )));
+                }
+            }
+            if provenance.mm().is_some_and(|mm| mm < 0) {
+                return Err(fail(&format!("provenance `mm` for `{source}` is below 0")));
+            }
+        }
+
+        let mut endpoint = None;
+        let mut resolves = self.resolves;
+        if let Some(resolves) = resolves.as_mut() {
+            if let Some(raw) = resolves.raw_endpoint.as_deref() {
+                let url = Url::parse(raw).map_err(|_| fail("endpoint is not a URL"))?;
+                if url.scheme() != "https" {
+                    return Err(fail("endpoint must use https"));
+                }
+                let host = url
+                    .host_str()
+                    .ok_or_else(|| fail("endpoint has no host"))?
+                    .to_owned();
+                if !resolves.hosts.contains(&host) {
+                    resolves.hosts.insert(0, host);
+                }
+                endpoint = Some(url);
+            }
+            if resolves.hosts.is_empty() {
+                return Err(fail("resolves declares no endpoint or host"));
+            }
+            if let Some(grace) = resolves.refresh_grace {
+                if !resolves.kinds.contains(&ResolveKind::Refresh) {
+                    return Err(fail("declares a refresh grace but not the refresh kind"));
+                }
+                if grace.is_zero() {
+                    return Err(fail("declares a zero refresh grace"));
+                }
+            }
+            for host in &resolves.hosts {
+                if normalize_partner_source_domain(host).ok().as_deref() != Some(host.as_str()) {
+                    return Err(fail(&format!(
+                        "host `{host}` is not a bare lowercase hostname"
+                    )));
+                }
+            }
+            if let Some(gap) = self.consent_policy.resolver_gap() {
+                return Err(fail(gap));
+            }
+        }
+
+        let expiring = if self.expiring_all {
+            self.sources.iter().cloned().collect()
+        } else {
+            self.expiring
+        };
+
+        Ok(ProviderDescriptor {
+            id,
+            sources: self.sources,
+            resolves,
+            endpoint,
+            captures: self.captures,
+            consent_policy: self.consent_policy,
+            provenance: self.provenance,
+            expiring,
+        })
+    }
+}
+
+/// The kind of resolution one source needs.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display)]
+#[non_exhaustive]
+pub enum ResolveKind {
+    /// No stored record for the source.
+    #[display("initial")]
+    Initial,
+    /// A stored record exists, valid or expired, and is due.
+    #[display("refresh")]
+    Refresh,
+}
+
+/// Active resolution: the provider calls an endpoint.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Resolves {
+    raw_endpoint: Option<String>,
+    hosts: Vec<String>,
+    needs: BTreeSet<Input>,
+    needs_for: BTreeMap<ResolveKind, BTreeSet<Input>>,
+    wants: BTreeSet<Input>,
+    kinds: Vec<ResolveKind>,
+    private_state: bool,
+    refresh_grace: Option<Duration>,
+    ec_id: bool,
+}
+
+impl Default for Resolves {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Resolves {
+    /// A resolver with no inputs, handling `Initial` and `Refresh`.
+    #[must_use]
+    pub fn new() -> Self {
+        Self {
+            raw_endpoint: None,
+            hosts: Vec::new(),
+            needs: BTreeSet::new(),
+            needs_for: BTreeMap::new(),
+            wants: BTreeSet::new(),
+            kinds: vec![ResolveKind::Initial, ResolveKind::Refresh],
+            private_state: false,
+            refresh_grace: None,
+            ec_id: false,
+        }
+    }
+
+    /// The endpoint the provider calls, as config spells it. `build()` parses
+    /// it and requires `https`. Its host becomes an allowed host.
+    #[must_use]
+    pub fn with_endpoint(mut self, endpoint: &str) -> Self {
+        self.raw_endpoint = Some(endpoint.to_owned());
+        self
+    }
+
+    /// Adds another host the provider may call. Repeatable.
+    #[must_use]
+    pub fn with_host(mut self, host: &str) -> Self {
+        if !self.hosts.iter().any(|known| known == host) {
+            self.hosts.push(host.to_owned());
+        }
+        self
+    }
+
+    /// Inputs required for every kind.
+    #[must_use]
+    pub fn with_needs(mut self, inputs: impl IntoIterator<Item = Input>) -> Self {
+        self.needs.extend(inputs);
+        self
+    }
+
+    /// Inputs required for one kind only.
+    #[must_use]
+    pub fn with_needs_for(
+        mut self,
+        kind: ResolveKind,
+        inputs: impl IntoIterator<Item = Input>,
+    ) -> Self {
+        self.needs_for.entry(kind).or_default().extend(inputs);
+        self
+    }
+
+    /// Inputs passed when available, never required.
+    #[must_use]
+    pub fn with_wants(mut self, inputs: impl IntoIterator<Item = Input>) -> Self {
+        self.wants.extend(inputs);
+        self
+    }
+
+    /// The kinds this provider handles. Default: `Initial` and `Refresh`.
+    #[must_use]
+    pub fn with_kinds(mut self, kinds: impl IntoIterator<Item = ResolveKind>) -> Self {
+        self.kinds = kinds.into_iter().collect();
+        self
+    }
+
+    /// This provider keeps private state in KV (`ps.st`, spec 6.1). It can
+    /// then read the stored state and return a state change.
+    #[must_use]
+    pub fn with_private_state(mut self) -> Self {
+        self.private_state = true;
+        self
+    }
+
+    /// Keeps an expired record this provider wrote for a source it owns as
+    /// a refresh anchor until `exp` plus `grace` (spec 5.4, step 4). The
+    /// record is never served, but the next eligible request still selects
+    /// `Refresh` for it rather than `Initial`. For providers whose refresh
+    /// call accepts an expired ID and that keep no private state, so cannot
+    /// set `refresh_until`. `build()` requires `Refresh` among the kinds and a
+    /// grace above zero.
+    #[must_use]
+    pub fn with_refresh_grace(mut self, grace: Duration) -> Self {
+        self.refresh_grace = Some(grace);
+        self
+    }
+
+    /// Gives the provider the full EC ID. Only generic pull may use this.
+    #[must_use]
+    pub(in crate::ec::identity) fn with_ec_id(mut self) -> Self {
+        self.ec_id = true;
+        self
+    }
+
+    /// Hosts the provider may call.
+    #[must_use]
+    pub(crate) fn hosts(&self) -> &[String] {
+        &self.hosts
+    }
+
+    /// Inputs required for `kind`: the common needs plus that kind's.
+    #[must_use]
+    pub(crate) fn needs(&self, kind: ResolveKind) -> BTreeSet<Input> {
+        let mut needs = self.needs.clone();
+        if let Some(extra) = self.needs_for.get(&kind) {
+            needs.extend(extra.iter().copied());
+        }
+        needs
+    }
+
+    /// Every input declared for any kind, needed or wanted.
+    #[must_use]
+    pub(crate) fn declared_inputs(&self) -> BTreeSet<Input> {
+        let mut all = self.needs.clone();
+        all.extend(self.wants.iter().copied());
+        for extra in self.needs_for.values() {
+            all.extend(extra.iter().copied());
+        }
+        all
+    }
+
+    /// Inputs passed when available.
+    #[must_use]
+    pub(crate) fn wants(&self) -> &BTreeSet<Input> {
+        &self.wants
+    }
+
+    /// The kinds this provider handles.
+    #[must_use]
+    pub(crate) fn kinds(&self) -> &[ResolveKind] {
+        &self.kinds
+    }
+
+    /// How long an expired record this provider wrote stays a refresh
+    /// anchor, if it declared a grace.
+    #[must_use]
+    pub(crate) fn refresh_grace(&self) -> Option<Duration> {
+        self.refresh_grace
+    }
+
+    /// Whether the provider keeps private state.
+    #[must_use]
+    pub(crate) fn has_private_state(&self) -> bool {
+        self.private_state
+    }
+
+    /// Whether the provider receives the full EC ID.
+    #[must_use]
+    pub(crate) fn gets_ec_id(&self) -> bool {
+        self.ec_id
+    }
+}
+
+/// Revoke-only capture from responses TS proxies for this provider: it
+/// can remove IDs, opt out or clear an opt-out, and never stores a positive
+/// ID (spec 4.7).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Captures {
+    paths: Vec<(Method, String)>,
+    prefixes: Vec<String>,
+}
+
+impl Captures {
+    /// No capture rules yet.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Offers proxied responses to exactly this method and path. Repeatable.
+    #[must_use]
+    pub fn with_path(mut self, method: Method, path: &str) -> Self {
+        self.paths.push((method, path.to_owned()));
+        self
+    }
+
+    /// Offers proxied responses whose path starts with `prefix`, for any
+    /// method. Repeatable.
+    #[must_use]
+    pub fn with_path_prefix(mut self, prefix: &str) -> Self {
+        self.prefixes.push(prefix.to_owned());
+        self
+    }
+
+    /// Whether a proxied request matches a rule.
+    #[must_use]
+    pub(crate) fn matches(&self, method: &Method, path: &str) -> bool {
+        self.paths
+            .iter()
+            .any(|(rule_method, rule_path)| rule_method == method && rule_path == path)
+            || self
+                .prefixes
+                .iter()
+                .any(|prefix| path.starts_with(prefix.as_str()))
+    }
+
+    /// Exact path rules.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn paths(&self) -> &[(Method, String)] {
+        &self.paths
+    }
+
+    /// Prefix rules.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn prefixes(&self) -> &[String] {
+        &self.prefixes
+    }
+}
+
+/// Default EID-level fields (`OpenRTB` 2.6 §3.2.27) that bidders read, such
+/// as who inserted an ID and how it was matched. They apply only to an entry
+/// that sets none of the three. A provider whose vendor returns these per
+/// response sets them on each `ResolvedEid` instead (spec 4.5).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct EidProvenance {
+    inserter: Option<String>,
+    matcher: Option<String>,
+    mm: Option<i32>,
+}
+
+impl EidProvenance {
+    /// No fields set.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Sets `inserter`.
+    #[must_use]
+    pub fn with_inserter(mut self, inserter: &str) -> Self {
+        self.inserter = Some(inserter.to_owned());
+        self
+    }
+
+    /// Sets `matcher`.
+    #[must_use]
+    pub fn with_matcher(mut self, matcher: &str) -> Self {
+        self.matcher = Some(matcher.to_owned());
+        self
+    }
+
+    /// Sets `mm`.
+    #[must_use]
+    pub fn with_mm(mut self, mm: i32) -> Self {
+        self.mm = Some(mm);
+        self
+    }
+
+    /// `inserter`, if set.
+    #[must_use]
+    pub fn inserter(&self) -> Option<&str> {
+        self.inserter.as_deref()
+    }
+
+    /// `matcher`, if set.
+    #[must_use]
+    pub fn matcher(&self) -> Option<&str> {
+        self.matcher.as_deref()
+    }
+
+    /// `mm`, if set.
+    #[must_use]
+    pub fn mm(&self) -> Option<i32> {
+        self.mm
+    }
+}
+
+/// A US opt-out a policy can relax.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display)]
+#[non_exhaustive]
+pub enum UsOptOut {
+    /// Sale of personal information.
+    #[display("sale")]
+    Sale,
+    /// Sharing for cross-context behavioural advertising.
+    #[display("sharing")]
+    Sharing,
+    /// Targeted advertising.
+    #[display("targeted_advertising")]
+    TargetedAdvertising,
+}
+
+/// The consent a provider requires. Evaluated by the coordinator (Task 12).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ConsentPolicy {
+    tcf_purposes: BTreeSet<u8>,
+    tcf_vendor: Option<u16>,
+    allow_dnt: bool,
+    allow_gpc: bool,
+    allowed_us_opt_outs: BTreeSet<UsOptOut>,
+    eid_persistence_only: bool,
+    purposes_declared: bool,
+    without_vendor: bool,
+}
+
+impl ConsentPolicy {
+    /// The default. Blocked when any consent signal present cannot be
+    /// decoded. Where TCF applies, requires Purpose 1 and whatever the
+    /// provider declares with [`with_tcf_purposes`](Self::with_tcf_purposes)
+    /// and [`with_tcf_vendor`](Self::with_tcf_vendor). Blocked by every US
+    /// opt-out TS decodes, by `Sec-GPC: 1` and by `DNT: 1`.
+    ///
+    /// A resolver's policy must declare its purposes and its vendor, or say
+    /// it has none with [`without_tcf_vendor`](Self::without_tcf_vendor);
+    /// [`ProviderDescriptorBuilder::build`] rejects it otherwise.
+    #[must_use]
+    pub fn strict() -> Self {
+        Self {
+            tcf_purposes: [1].into_iter().collect(),
+            tcf_vendor: None,
+            allow_dnt: false,
+            allow_gpc: false,
+            allowed_us_opt_outs: BTreeSet::new(),
+            eid_persistence_only: false,
+            purposes_declared: false,
+            without_vendor: false,
+        }
+    }
+
+    /// Declares the TCF purposes the provider processes under consent, as
+    /// its GVL entry lists them. Each is required where TCF applies, beside
+    /// Purpose 1, which is always required. An empty list declares Purpose 1
+    /// alone.
+    #[must_use]
+    pub fn with_tcf_purposes(mut self, purposes: impl IntoIterator<Item = u8>) -> Self {
+        self.tcf_purposes.extend(purposes);
+        self.purposes_declared = true;
+        self
+    }
+
+    /// Declares that the provider has no IAB Global Vendor List ID, so no
+    /// vendor consent is checked: purpose consent alone lets it run where
+    /// TCF applies. Needs a documented legal basis (TCF Policies, Chapter
+    /// III, Policy 14(3)).
+    #[must_use]
+    pub fn without_tcf_vendor(mut self) -> Self {
+        self.without_vendor = true;
+        self
+    }
+
+    /// Requires vendor consent for this IAB Global Vendor List ID.
+    #[must_use]
+    pub fn with_tcf_vendor(mut self, vendor_id: u16) -> Self {
+        self.tcf_vendor = Some(vendor_id);
+        self
+    }
+
+    /// Does not block on `DNT: 1`. Needs a documented legal basis.
+    #[must_use]
+    pub fn allowing_dnt(mut self) -> Self {
+        self.allow_dnt = true;
+        self
+    }
+
+    /// Does not block on GPC. Needs a documented legal basis.
+    #[must_use]
+    pub fn allowing_gpc(mut self) -> Self {
+        self.allow_gpc = true;
+        self
+    }
+
+    /// Does not block on one US opt-out. Needs a documented legal basis.
+    #[must_use]
+    pub fn allowing_us_opt_out(mut self, opt_out: UsOptOut) -> Self {
+        self.allowed_us_opt_outs.insert(opt_out);
+        self
+    }
+
+    /// Blocks exactly what pull sync blocks today: only the global EC and
+    /// EID-persistence gates. For generic pull's parity (spec 10.4).
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    #[must_use]
+    pub(in crate::ec::identity) fn eid_persistence_only() -> Self {
+        Self {
+            eid_persistence_only: true,
+            purposes_declared: true,
+            without_vendor: true,
+            ..Self::strict()
+        }
+    }
+
+    /// Required TCF purposes.
+    #[must_use]
+    pub fn tcf_purposes(&self) -> &BTreeSet<u8> {
+        &self.tcf_purposes
+    }
+
+    /// Required GVL vendor, if any.
+    #[must_use]
+    pub fn tcf_vendor(&self) -> Option<u16> {
+        self.tcf_vendor
+    }
+
+    /// Whether `DNT: 1` is allowed.
+    #[must_use]
+    pub fn allows_dnt(&self) -> bool {
+        self.allow_dnt
+    }
+
+    /// Whether GPC is allowed.
+    #[must_use]
+    pub fn allows_gpc(&self) -> bool {
+        self.allow_gpc
+    }
+
+    /// Whether a US opt-out is allowed.
+    #[must_use]
+    pub fn allows_us_opt_out(&self, opt_out: UsOptOut) -> bool {
+        self.allowed_us_opt_outs.contains(&opt_out)
+    }
+
+    /// Whether this is generic pull's parity policy.
+    #[must_use]
+    pub(crate) fn is_eid_persistence_only(&self) -> bool {
+        self.eid_persistence_only
+    }
+
+    /// Why a resolver may not use this policy, if it may not.
+    fn resolver_gap(&self) -> Option<&'static str> {
+        if !self.purposes_declared {
+            Some("consent policy declares no TCF purposes; call with_tcf_purposes")
+        } else if self.tcf_vendor.is_none() && !self.without_vendor {
+            Some(
+                "consent policy names no TCF vendor; call with_tcf_vendor, or without_tcf_vendor with a documented legal basis",
+            )
+        } else {
+            None
+        }
+    }
+}
+
+/// An input a provider can ask for.
+///
+/// Consent strings, the provider's stored IDs, the publisher domain, the
+/// time and the declared endpoint are always available. Private state is
+/// available to providers declared `with_private_state()`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display)]
+#[non_exhaustive]
+pub enum Input {
+    /// The platform's client address.
+    #[display("client_ip")]
+    ClientIp,
+    /// The request's `User-Agent`.
+    #[display("user_agent")]
+    UserAgent,
+    /// The top-level page URL without query string or fragment.
+    #[display("page_url")]
+    PageUrl,
+    /// Country and subdivision only.
+    #[display("region")]
+    Region,
+    /// A SHA-256 of a normalized email address. Never available in v1.
+    #[display("hashed_email")]
+    HashedEmail,
+}
+
+/// Something a provider read without declaring it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display)]
+#[non_exhaustive]
+pub enum Access {
+    /// An undeclared [`Input`].
+    #[display("{_0}")]
+    Input(Input),
+    /// The endpoint, when the descriptor declares no `resolves`.
+    #[display("endpoint")]
+    Endpoint,
+    /// Private state, without `with_private_state()`.
+    #[display("private_state")]
+    PrivateState,
+    /// The full EC ID, without `with_ec_id()`. Only generic pull declares it.
+    #[display("ec_id")]
+    EcId,
+}
+
+#[cfg(test)]
+mod tests {
+    use http::Method;
+
+    use super::*;
+    use crate::ec::kv_types::MAX_EID_FIELD_BYTES;
+
+    fn source(name: &str) -> SourceDomain {
+        name.parse().expect("should parse source")
+    }
+
+    fn id(name: &str) -> IdentityProviderId {
+        name.parse().expect("should parse id")
+    }
+
+    #[test]
+    fn builds_the_documented_example() {
+        let descriptor = ProviderDescriptor::builder(id("exampleid"))
+            .with_source(source("exampleid.example.com"))
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint("https://api.exampleid.example.com/v1/fetch")
+                    .with_needs([Input::ClientIp, Input::UserAgent])
+                    .with_wants([Input::PageUrl]),
+            )
+            .with_consent_policy(
+                ConsentPolicy::strict()
+                    .with_tcf_purposes([4])
+                    .with_tcf_vendor(9999),
+            )
+            .build()
+            .expect("should build");
+
+        assert_eq!(descriptor.id().as_str(), "exampleid", "should keep the id");
+        assert_eq!(
+            descriptor.primary_source(),
+            &source("exampleid.example.com"),
+            "should keep the source"
+        );
+        assert_eq!(
+            descriptor.endpoint().map(Url::as_str),
+            Some("https://api.exampleid.example.com/v1/fetch"),
+            "should parse the endpoint"
+        );
+        let resolves = descriptor.resolves().expect("should resolve");
+        assert_eq!(
+            resolves.hosts(),
+            &["api.exampleid.example.com".to_owned()],
+            "should allow the endpoint host"
+        );
+        assert_eq!(
+            resolves.kinds(),
+            &[ResolveKind::Initial, ResolveKind::Refresh],
+            "should default to Initial and Refresh"
+        );
+        assert!(descriptor.captures().is_none(), "should not capture");
+        assert!(
+            !descriptor.is_expiring(&source("exampleid.example.com")),
+            "should not expire by default"
+        );
+        assert_eq!(
+            descriptor.consent_policy().tcf_vendor(),
+            Some(9999),
+            "should keep the vendor"
+        );
+        assert_eq!(
+            descriptor
+                .consent_policy()
+                .tcf_purposes()
+                .iter()
+                .copied()
+                .collect::<Vec<_>>(),
+            vec![1, 4],
+            "should require Purpose 1 and the declared Purpose 4"
+        );
+    }
+
+    #[test]
+    fn strict_requires_only_purpose_one_until_purposes_are_declared() {
+        let policy = ConsentPolicy::strict();
+
+        assert_eq!(
+            policy.tcf_purposes().iter().copied().collect::<Vec<_>>(),
+            vec![1],
+            "should require Purpose 1 alone"
+        );
+        assert_eq!(
+            ConsentPolicy::strict()
+                .with_tcf_purposes([3, 5])
+                .tcf_purposes()
+                .iter()
+                .copied()
+                .collect::<Vec<_>>(),
+            vec![1, 3, 5],
+            "should add the declared purposes to Purpose 1"
+        );
+    }
+
+    #[test]
+    fn a_resolver_must_declare_its_purposes_and_vendor() {
+        let resolver = |policy: ConsentPolicy| {
+            ProviderDescriptor::builder(id("p"))
+                .with_source(source("example.com"))
+                .with_resolves(Resolves::new().with_endpoint("https://a.example.com"))
+                .with_consent_policy(policy)
+                .build()
+        };
+
+        let undeclared = resolver(ConsentPolicy::strict().with_tcf_vendor(5))
+            .expect_err("should reject a resolver that declares no purposes");
+        let no_vendor = resolver(ConsentPolicy::strict().with_tcf_purposes([4]))
+            .expect_err("should reject a resolver that names no vendor");
+        let relaxed = resolver(
+            ConsentPolicy::strict()
+                .with_tcf_purposes([])
+                .without_tcf_vendor(),
+        )
+        .expect("should build a resolver that opts out of vendor consent");
+        let capture = ProviderDescriptor::builder(id("p"))
+            .with_source(source("example.com"))
+            .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+            .build();
+
+        assert!(
+            format!("{undeclared:?}").contains("with_tcf_purposes"),
+            "should name the missing purposes"
+        );
+        assert!(
+            format!("{no_vendor:?}").contains("without_tcf_vendor"),
+            "should name the vendor relaxation"
+        );
+        assert_eq!(
+            relaxed.consent_policy().tcf_vendor(),
+            None,
+            "should check no vendor"
+        );
+        assert!(
+            capture.is_ok(),
+            "should not require a policy of a capture-only provider"
+        );
+    }
+
+    #[test]
+    fn build_rejects_invalid_descriptors() {
+        let cases: Vec<(&str, ProviderDescriptorBuilder)> = vec![
+            (
+                "no source",
+                ProviderDescriptor::builder(id("p"))
+                    .with_resolves(Resolves::new().with_endpoint("https://a.example.com")),
+            ),
+            (
+                "no capability",
+                ProviderDescriptor::builder(id("p")).with_source(source("example.com")),
+            ),
+            (
+                "no endpoint or host",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_resolves(Resolves::new()),
+            ),
+            (
+                "http endpoint",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_resolves(Resolves::new().with_endpoint("http://a.example.com")),
+            ),
+            (
+                "bad host",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_resolves(Resolves::new().with_host("a.example.com/path")),
+            ),
+            (
+                "provenance for undeclared source",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(
+                        &source("other.example.com"),
+                        EidProvenance::new().with_mm(2),
+                    ),
+            ),
+            (
+                "refresh grace without refresh",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_resolves(
+                        Resolves::new()
+                            .with_endpoint("https://a.example.com")
+                            .with_kinds([ResolveKind::Initial])
+                            .with_refresh_grace(core::time::Duration::from_secs(60)),
+                    ),
+            ),
+            (
+                "zero refresh grace",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_resolves(
+                        Resolves::new()
+                            .with_endpoint("https://a.example.com")
+                            .with_refresh_grace(core::time::Duration::ZERO),
+                    ),
+            ),
+            (
+                "expiring undeclared source",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_expiring_source(&source("other.example.com")),
+            ),
+            (
+                "blank provenance inserter",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(
+                        &source("example.com"),
+                        EidProvenance::new().with_inserter("  "),
+                    ),
+            ),
+            (
+                "blank provenance matcher",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(
+                        &source("example.com"),
+                        EidProvenance::new().with_matcher(""),
+                    ),
+            ),
+            (
+                "oversized provenance matcher",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(
+                        &source("example.com"),
+                        EidProvenance::new().with_matcher(&"m".repeat(MAX_EID_FIELD_BYTES + 1)),
+                    ),
+            ),
+            (
+                "negative provenance mm",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(&source("example.com"), EidProvenance::new().with_mm(-1)),
+            ),
+        ];
+        for (name, builder) in cases {
+            let error = builder
+                .build()
+                .expect_err(&format!("should reject a descriptor with {name}"));
+            assert!(
+                matches!(
+                    error.current_context(),
+                    IdentityProviderError::Config { .. }
+                ),
+                "should be a Config error: {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn expiring_and_provenance_are_per_source() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let descriptor = ProviderDescriptor::builder(id("p"))
+            .with_source(a.clone())
+            .with_source(b.clone())
+            .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+            .with_expiring_source(&b)
+            .with_provenance(
+                &a,
+                EidProvenance::new()
+                    .with_inserter("example-inserter")
+                    .with_mm(2),
+            )
+            .build()
+            .expect("should build");
+
+        assert!(!descriptor.is_expiring(&a), "should not mark a as expiring");
+        assert!(descriptor.is_expiring(&b), "should mark b as expiring");
+        let provenance = descriptor
+            .provenance(&a)
+            .expect("should have provenance for a");
+        assert_eq!(
+            provenance.inserter(),
+            Some("example-inserter"),
+            "should keep the inserter"
+        );
+        assert_eq!(provenance.matcher(), None, "should leave the matcher unset");
+        assert_eq!(provenance.mm(), Some(2), "should keep mm");
+        assert!(
+            descriptor.provenance(&b).is_none(),
+            "should have no provenance for b"
+        );
+        assert_eq!(
+            descriptor.source_named("A.EXAMPLE.COM"),
+            Some(&a),
+            "should find a by any spelling"
+        );
+    }
+
+    #[test]
+    fn expiring_ids_marks_every_source() {
+        let descriptor = ProviderDescriptor::builder(id("p"))
+            .with_source(source("a.example.com"))
+            .with_source(source("b.example.com"))
+            .with_expiring_ids()
+            .with_captures(Captures::new().with_path_prefix("/integrations/p/"))
+            .build()
+            .expect("should build");
+        assert!(
+            descriptor
+                .sources()
+                .iter()
+                .all(|s| descriptor.is_expiring(s)),
+            "should mark every source"
+        );
+    }
+
+    #[test]
+    fn captures_match_exact_paths_and_prefixes() {
+        let captures = Captures::new()
+            .with_path(Method::POST, "/integrations/p/api/token")
+            .with_path_prefix("/integrations/p/stream/");
+        assert!(
+            captures.matches(&Method::POST, "/integrations/p/api/token"),
+            "should match the exact path"
+        );
+        assert!(
+            !captures.matches(&Method::GET, "/integrations/p/api/token"),
+            "should require the method"
+        );
+        assert!(
+            !captures.matches(&Method::POST, "/integrations/p/api/token/x"),
+            "should not treat an exact path as a prefix"
+        );
+        assert!(
+            captures.matches(&Method::GET, "/integrations/p/stream/1"),
+            "should match a prefix for any method"
+        );
+        assert!(
+            !captures.matches(&Method::GET, "/integrations/p/settings"),
+            "should not match others"
+        );
+    }
+
+    #[test]
+    fn needs_differ_by_kind() {
+        let resolves = Resolves::new()
+            .with_endpoint("https://a.example.com")
+            .with_needs([Input::ClientIp])
+            .with_needs_for(ResolveKind::Initial, [Input::HashedEmail]);
+        assert_eq!(
+            resolves.needs(ResolveKind::Initial),
+            [Input::ClientIp, Input::HashedEmail].into_iter().collect(),
+            "should need both inputs for Initial"
+        );
+        assert_eq!(
+            resolves.needs(ResolveKind::Refresh),
+            [Input::ClientIp].into_iter().collect(),
+            "should need only the IP for Refresh"
+        );
+    }
+
+    #[test]
+    fn valid_provenance_builds() {
+        let descriptor = ProviderDescriptor::builder(id("p"))
+            .with_source(source("example.com"))
+            .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+            .with_provenance(
+                &source("example.com"),
+                EidProvenance::new()
+                    .with_inserter("example-inserter")
+                    .with_matcher("example-matcher")
+                    .with_mm(0),
+            )
+            .build()
+            .expect("should accept non-blank provenance and mm 0");
+        assert!(
+            descriptor.provenance(&source("example.com")).is_some(),
+            "should keep the provenance"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/examples.rs b/crates/trusted-server-core/src/ec/identity/examples.rs
new file mode 100644
index 0000000000..24363b873b
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/examples.rs
@@ -0,0 +1,1026 @@
+//! Fictional providers from spec 4.6, for tests of registration, coordination
+//! and capture.
+
+use std::time::Duration;
+
+use error_stack::Report;
+use http::Method;
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use url::Url;
+use validator::Validate;
+
+use super::descriptor::{Captures, ConsentPolicy, Input, ProviderDescriptor, Resolves};
+use super::exchange::{ProviderRequest, ProviderResponse};
+use super::ids::UnixTime;
+use super::input::{CaptureInput, ResolveInput, StoredId};
+use super::provider::{IdentityProvider, IdentityProviderConfig};
+use super::resolution::{IdentityProviderError, Resolution, ResolvedEid, ResolvedUid};
+use crate::settings::IntegrationConfig;
+
+/// Integration ID of [`ExampleIdProvider`].
+pub(crate) const EXAMPLEID_INTEGRATION_ID: &str = "exampleid";
+
+/// Integration ID of [`ExampleCaptureProvider`].
+pub(crate) const EXAMPLECAPTURE_INTEGRATION_ID: &str = "examplecapture";
+
+/// Config of the fictional `exampleid` integration.
+#[derive(Debug, Clone, Deserialize, Validate)]
+pub(crate) struct ExampleIdConfig {
+    pub enabled: bool,
+    #[validate(url)]
+    pub endpoint: String,
+    pub partner_id: u32,
+    pub gvl_id: u16,
+}
+
+impl IntegrationConfig for ExampleIdConfig {
+    fn is_enabled(&self) -> bool {
+        self.enabled
+    }
+}
+
+impl IdentityProviderConfig for ExampleIdConfig {
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        ProviderDescriptor::builder(EXAMPLEID_INTEGRATION_ID.parse()?)
+            .with_source("exampleid.example.com".parse()?)
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint(&self.endpoint)
+                    .with_needs([Input::ClientIp, Input::UserAgent])
+                    .with_wants([Input::PageUrl])
+                    .with_private_state(),
+            )
+            .with_consent_policy(
+                ConsentPolicy::strict()
+                    .with_tcf_purposes([4])
+                    .with_tcf_vendor(self.gvl_id),
+            )
+            .build()
+    }
+}
+
+/// A valid [`ExampleIdConfig`].
+pub(crate) fn example_config() -> ExampleIdConfig {
+    ExampleIdConfig {
+        enabled: true,
+        endpoint: "https://api.example.com/fetch".to_owned(),
+        partner_id: 7,
+        gvl_id: 1,
+    }
+}
+
+/// A resolving provider that round-trips private state.
+pub(crate) struct ExampleIdProvider {
+    descriptor: ProviderDescriptor,
+    partner_id: u32,
+}
+
+/// The private state [`ExampleIdProvider`] keeps between calls.
+#[derive(Serialize, Deserialize)]
+pub(crate) struct ExampleIdState {
+    signature: String,
+}
+
+#[derive(Serialize)]
+struct FetchBody<'a> {
+    partner: u32,
+    ip: String,
+    ua: &'a str,
+    page: Option<&'a str>,
+    gdpr: bool,
+    consent: Option<&'a str>,
+    signature: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct FetchReply {
+    uid: Option<String>,
+    signature: Option<String>,
+    link_type: Option<u8>,
+    max_age_sec: Option<u64>,
+}
+
+impl ExampleIdProvider {
+    /// Builds the provider from its validated config.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the config cannot
+    /// describe a valid provider.
+    pub(crate) fn new(config: &ExampleIdConfig) -> Result<Self, Report<IdentityProviderError>> {
+        Ok(Self {
+            descriptor: config.build_descriptor()?,
+            partner_id: config.partner_id,
+        })
+    }
+}
+
+impl IdentityProvider for ExampleIdProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let consent = input.consent();
+        let body = FetchBody {
+            partner: self.partner_id,
+            ip: input.client_ip()?.to_string(),
+            ua: input.user_agent()?,
+            page: input.page_url().ok().map(Url::as_str),
+            gdpr: consent.gdpr_applies(),
+            consent: consent.raw_tc_string(),
+            signature: input
+                .state::<ExampleIdState>()?
+                .map(|state| state.signature),
+        };
+        ProviderRequest::post_json(input.endpoint()?, &body).map(Some)
+    }
+
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let reply: FetchReply = response.success_json()?;
+        let Some(uid) = reply.uid else {
+            return Ok(Resolution::no_match());
+        };
+
+        let mut uid = ResolvedUid::new(uid).with_atype(1);
+        if let Some(link_type) = reply.link_type {
+            uid = uid.with_ext(json!({ "linkType": link_type }));
+        }
+        let mut eid = ResolvedEid::new(input.primary_source(), uid);
+        if let Some(max_age) = reply.max_age_sec {
+            eid = eid.with_refresh_in(Duration::from_secs(max_age));
+        }
+
+        let resolution = Resolution::found([eid]);
+        Ok(match reply.signature {
+            Some(signature) => resolution.replacing_state(&ExampleIdState { signature }),
+            None => resolution,
+        })
+    }
+}
+
+/// A capture-only provider that reads tokens from the API it proxies.
+pub(crate) struct ExampleCaptureProvider {
+    descriptor: ProviderDescriptor,
+}
+
+#[derive(Deserialize)]
+struct TokenReply {
+    tokens: Vec<Token>,
+}
+
+#[derive(Deserialize)]
+struct Token {
+    source: String,
+    value: String,
+    expires: u64,
+}
+
+impl ExampleCaptureProvider {
+    /// Builds the provider with the capture path of spec 4.6.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the descriptor is invalid.
+    pub(crate) fn new() -> Result<Self, Report<IdentityProviderError>> {
+        Self::with_capture_path("/integrations/examplecapture/api/token")
+    }
+
+    /// Builds the provider capturing from `path` instead.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the descriptor is invalid.
+    pub(crate) fn with_capture_path(path: &str) -> Result<Self, Report<IdentityProviderError>> {
+        let descriptor = ProviderDescriptor::builder(EXAMPLECAPTURE_INTEGRATION_ID.parse()?)
+            .with_source("examplecapture.example.com".parse()?)
+            .with_captures(Captures::new().with_path(Method::POST, path))
+            .build()?;
+        Ok(Self { descriptor })
+    }
+}
+
+impl IdentityProvider for ExampleCaptureProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn capture(
+        &self,
+        input: &CaptureInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let Ok(reply) = input.response().json::<TokenReply>() else {
+            return Ok(Resolution::no_match());
+        };
+        Ok(Resolution::found(reply.tokens.into_iter().filter_map(
+            |token| {
+                let source = input.source_named(&token.source)?;
+                Some(
+                    ResolvedEid::new(source, ResolvedUid::new(token.value))
+                        .with_expires_at(UnixTime::from_secs(token.expires)),
+                )
+            },
+        )))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use http::header::COOKIE;
+    use http::{HeaderValue, StatusCode};
+
+    use super::*;
+    use crate::ec::identity::descriptor::{EidProvenance, ProviderDescriptorBuilder};
+    use crate::ec::identity::ids::SourceDomain;
+    use crate::ec::identity::test_support::{
+        CaptureFixture, ConformanceCases, ConformanceFailure, HarnessSetup, ProviderHarness,
+        TestConsent, check_descriptor_ignores_secrets, resolver_policy,
+    };
+    use crate::openrtb::{Eid, Uid};
+
+    type RequestFn =
+        fn(&ResolveInput<'_>) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>>;
+    type ResponseFn = fn(
+        &ProviderResponse,
+        &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>>;
+    type CaptureFn = fn(&CaptureInput<'_>) -> Result<Resolution, Report<IdentityProviderError>>;
+
+    /// A resolver whose behaviour is two plain functions.
+    struct TestResolver {
+        descriptor: ProviderDescriptor,
+        request: RequestFn,
+        response: ResponseFn,
+    }
+
+    impl IdentityProvider for TestResolver {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.descriptor
+        }
+
+        fn request(
+            &self,
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            (self.request)(input)
+        }
+
+        fn response(
+            &self,
+            response: &ProviderResponse,
+            input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            (self.response)(response, input)
+        }
+    }
+
+    /// A capturer whose behaviour is one plain function.
+    struct TestCapturer {
+        descriptor: ProviderDescriptor,
+        capture: CaptureFn,
+    }
+
+    impl IdentityProvider for TestCapturer {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.descriptor
+        }
+
+        fn capture(
+            &self,
+            input: &CaptureInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            (self.capture)(input)
+        }
+    }
+
+    /// A provider that declares a capability and overrides nothing.
+    struct DeclaresOnly(ProviderDescriptor);
+
+    impl IdentityProvider for DeclaresOnly {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.0
+        }
+    }
+
+    const CAPTURE_PATH: &str = "/integrations/exampleid/api/token";
+
+    fn source() -> SourceDomain {
+        "exampleid.example.com"
+            .parse()
+            .expect("should parse the source")
+    }
+
+    fn builder() -> ProviderDescriptorBuilder {
+        ProviderDescriptor::builder(
+            EXAMPLEID_INTEGRATION_ID
+                .parse()
+                .expect("should parse the provider id"),
+        )
+        .with_source(source())
+        .with_consent_policy(resolver_policy())
+    }
+
+    fn resolves() -> Resolves {
+        Resolves::new().with_endpoint("https://api.exampleid.example.com/v1/fetch")
+    }
+
+    fn capturer(capture: CaptureFn) -> TestCapturer {
+        TestCapturer {
+            descriptor: builder()
+                .with_captures(Captures::new().with_path(Method::POST, CAPTURE_PATH))
+                .build()
+                .expect("should build the descriptor"),
+            capture,
+        }
+    }
+
+    fn capture_cases() -> ConformanceCases {
+        ConformanceCases::default()
+            .with_capture_case(CaptureFixture::new(Method::POST, CAPTURE_PATH))
+    }
+
+    fn plain_request(
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        ProviderRequest::post_json(input.endpoint()?, &json!({})).map(Some)
+    }
+
+    fn one_uid(
+        _response: &ProviderResponse,
+        _input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        Ok(Resolution::found([ResolvedEid::new(
+            &source(),
+            ResolvedUid::new("uid-1"),
+        )]))
+    }
+
+    fn resolver(
+        builder: ProviderDescriptorBuilder,
+        resolves: Resolves,
+        request: RequestFn,
+        response: ResponseFn,
+    ) -> TestResolver {
+        TestResolver {
+            descriptor: builder
+                .with_resolves(resolves)
+                .build()
+                .expect("should build the descriptor"),
+            request,
+            response,
+        }
+    }
+
+    fn resolve_cases() -> ConformanceCases {
+        ConformanceCases::default().with_resolve_case(
+            HarnessSetup::default(),
+            StatusCode::OK,
+            &json!({}),
+        )
+    }
+
+    fn failure(
+        provider: &dyn IdentityProvider,
+        cases: &ConformanceCases,
+    ) -> Report<ConformanceFailure> {
+        ProviderHarness::new(provider)
+            .try_check_conformance(cases)
+            .expect_err("should fail the conformance check")
+    }
+
+    #[test]
+    fn example_provider_round_trip() {
+        let provider =
+            ExampleIdProvider::new(&example_config()).expect("should build the provider");
+        let mut harness = ProviderHarness::new(&provider)
+            .with_client_ip("192.0.2.10")
+            .with_user_agent("ExampleBrowser/1.0");
+
+        let request = harness
+            .request()
+            .expect("should build a request")
+            .expect("should not skip the request");
+        assert_eq!(
+            request.url().host_str(),
+            Some("api.example.com"),
+            "should call the declared host"
+        );
+
+        let resolution = harness
+            .respond(
+                StatusCode::OK,
+                &json!({ "uid": "example-uid", "signature": "example-signature" }),
+            )
+            .expect("should parse the response");
+        assert_eq!(
+            resolution.eids()[0].uids()[0].id(),
+            "example-uid",
+            "should return the uid"
+        );
+        let state: ExampleIdState = harness.state_of(&resolution).expect("should replace state");
+        assert_eq!(
+            state.signature, "example-signature",
+            "should keep the signature"
+        );
+    }
+
+    #[test]
+    fn example_provider_conforms() {
+        let provider =
+            ExampleIdProvider::new(&example_config()).expect("should build the provider");
+        ProviderHarness::new(&provider).check_conformance_with_state::<ExampleIdState>(
+            &ConformanceCases::default().with_resolve_case(
+                HarnessSetup::default()
+                    .with_client_ip("192.0.2.10")
+                    .with_user_agent("ExampleBrowser/1.0"),
+                StatusCode::OK,
+                &json!({ "uid": "example-uid", "signature": "s" }),
+            ),
+        );
+    }
+
+    #[test]
+    fn stateful_provider_is_pointed_at_the_state_check() {
+        let provider =
+            ExampleIdProvider::new(&example_config()).expect("should build the provider");
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::StatefulNeedsStateType
+            ),
+            "should point at check_conformance_with_state"
+        );
+    }
+
+    #[test]
+    fn capture_provider_conforms() {
+        let provider = ExampleCaptureProvider::new().expect("should build the provider");
+
+        ProviderHarness::new(&provider).check_conformance(
+            &ConformanceCases::default().with_capture_case(
+                CaptureFixture::new(Method::POST, "/integrations/examplecapture/api/token")
+                    .with_response(
+                        StatusCode::OK,
+                        &json!({ "tokens": [{
+                            "source": "examplecapture.example.com",
+                            "value": "token-1",
+                            "expires": 1_760_086_400_u64,
+                        }] }),
+                    ),
+            ),
+        );
+    }
+
+    #[test]
+    fn conformance_catches_an_undeclared_read() {
+        fn reads_user_agent(
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            let _ignored = input.user_agent().ok();
+            plain_request(input)
+        }
+        let provider = resolver(builder(), resolves(), reads_user_agent, one_uid);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::UndeclaredInput { .. }
+            ),
+            "should report the undeclared input"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_an_undeclared_state_read() {
+        fn reads_state(
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            let _ignored = input.state::<serde_json::Value>().ok();
+            plain_request(input)
+        }
+        let provider = resolver(builder(), resolves(), reads_state, one_uid);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::UndeclaredInput { .. }
+            ),
+            "should report the undeclared state read"
+        );
+    }
+
+    #[test]
+    fn harness_skips_the_request_when_the_consent_policy_refuses() {
+        let provider =
+            ExampleIdProvider::new(&example_config()).expect("should build the provider");
+        let allowed = ProviderHarness::new(&provider)
+            .with_client_ip("192.0.2.10")
+            .with_user_agent("ExampleBrowser/1.0")
+            .request()
+            .expect("should build a request");
+        let refused = ProviderHarness::new(&provider)
+            .with_client_ip("192.0.2.10")
+            .with_user_agent("ExampleBrowser/1.0")
+            .with_consent(TestConsent::default().with_gdpr_applies(true))
+            .request()
+            .expect("should not fail the call");
+
+        assert!(allowed.is_some(), "should build a request without a signal");
+        assert!(
+            refused.is_none(),
+            "should skip the request when GDPR applies and no TCF consent is present"
+        );
+    }
+
+    #[test]
+    fn descriptor_ignores_secrets() {
+        check_descriptor_ignores_secrets(&example_config(), &example_config());
+    }
+
+    #[test]
+    fn output_eids_applies_the_provenance_default_only_to_bare_entries() {
+        fn two_entries(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(Resolution::found([
+                ResolvedEid::new(&source(), ResolvedUid::new("uid-a"))
+                    .with_inserter("vendor-inserter"),
+                ResolvedEid::new(&source(), ResolvedUid::new("uid-b")),
+            ]))
+        }
+        let provider = resolver(
+            builder().with_provenance(
+                &source(),
+                EidProvenance::new()
+                    .with_inserter("default-inserter")
+                    .with_matcher("default-matcher"),
+            ),
+            resolves(),
+            plain_request,
+            two_entries,
+        );
+        let mut harness = ProviderHarness::new(&provider);
+        harness
+            .request()
+            .expect("should build a request")
+            .expect("should not skip the request");
+        let resolution = harness
+            .respond(StatusCode::OK, &json!({}))
+            .expect("should resolve");
+
+        let eids = harness.output_eids(&resolution);
+
+        assert_eq!(eids.len(), 2, "should output both entries");
+        assert_eq!(
+            eids[0].inserter.as_deref(),
+            Some("vendor-inserter"),
+            "should keep the entry's own fields"
+        );
+        assert_eq!(
+            eids[0].matcher, None,
+            "should not mix the default into an entry that sets a field"
+        );
+        assert_eq!(
+            eids[1].inserter.as_deref(),
+            Some("default-inserter"),
+            "should apply the default to a bare entry"
+        );
+        assert_eq!(
+            eids[1].matcher.as_deref(),
+            Some("default-matcher"),
+            "should apply the whole default to a bare entry"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_cookie_header() {
+        fn sets_cookie(
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            Ok(plain_request(input)?.map(|request| {
+                request.with_header(COOKIE, HeaderValue::from_static("session=example"))
+            }))
+        }
+        let provider = resolver(builder(), resolves(), sets_cookie, one_uid);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::CookieHeader),
+            "should report the Cookie header"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_request_to_an_undeclared_host() {
+        fn wrong_host(
+            _input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            let url = Url::parse("https://other.example.org/v1/fetch").expect("should parse");
+            Ok(Some(ProviderRequest::get(&url)))
+        }
+        let provider = resolver(builder(), resolves(), wrong_host, one_uid);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::UndeclaredHost),
+            "should report the undeclared host"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_request_over_plain_http() {
+        fn plain_http(
+            _input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            let url =
+                Url::parse("http://api.exampleid.example.com/v1/fetch").expect("should parse");
+            Ok(Some(ProviderRequest::get(&url)))
+        }
+        let provider = resolver(builder(), resolves(), plain_http, one_uid);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::InsecureScheme),
+            "should report the plain http request"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_an_entry_for_an_undeclared_source() {
+        fn other_source(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            let other: SourceDomain = "other.example.com".parse().expect("should parse");
+            Ok(Resolution::found([ResolvedEid::new(
+                &other,
+                ResolvedUid::new("uid-1"),
+            )]))
+        }
+        let provider = resolver(builder(), resolves(), plain_request, other_source);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::UndeclaredSource { .. }
+            ),
+            "should report the undeclared source"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_33rd_uid() {
+        fn thirty_three(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            let mut eid = ResolvedEid::new(&source(), ResolvedUid::new("uid-0"));
+            for index in 1..33 {
+                eid = eid.with_uid(ResolvedUid::new(format!("uid-{index}")));
+            }
+            Ok(Resolution::found([eid]))
+        }
+        let provider = resolver(builder(), resolves(), plain_request, thirty_three);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::LimitHit { .. }),
+            "should report the dropped UID"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_blank_inserter() {
+        fn blank_inserter(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(Resolution::found([ResolvedEid::new(
+                &source(),
+                ResolvedUid::new("uid-1"),
+            )
+            .with_inserter(" ")]))
+        }
+        let provider = resolver(builder(), resolves(), plain_request, blank_inserter);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::LimitHit { .. }),
+            "should report the dropped inserter"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_an_oversized_set() {
+        fn eight_large_entries(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            let entries = (0..8).map(|index| {
+                ResolvedEid::new(
+                    &source(),
+                    ResolvedUid::new(format!("uid-{index}"))
+                        .with_ext(json!({ "pad": "x".repeat(1_000) })),
+                )
+            });
+            Ok(Resolution::found(entries))
+        }
+        let provider = resolver(builder(), resolves(), plain_request, eight_large_entries);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::SetTooLarge { .. }
+            ),
+            "should report the set over MAX_ENTRY_SET_BYTES"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_capability_declared_but_not_overridden() {
+        let resolving = DeclaresOnly(
+            builder()
+                .with_resolves(resolves())
+                .build()
+                .expect("should build the descriptor"),
+        );
+        let capturing = DeclaresOnly(
+            builder()
+                .with_captures(Captures::new().with_path(Method::POST, CAPTURE_PATH))
+                .build()
+                .expect("should build the descriptor"),
+        );
+
+        let resolve_error = failure(&resolving, &resolve_cases());
+        let capture_error = failure(&capturing, &capture_cases());
+
+        assert!(
+            matches!(
+                resolve_error.current_context(),
+                ConformanceFailure::NotImplemented { method: "request" }
+            ),
+            "should report the missing request override"
+        );
+        assert!(
+            matches!(
+                capture_error.current_context(),
+                ConformanceFailure::NotImplemented { method: "capture" }
+            ),
+            "should report the missing capture override"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_resolver_that_never_builds_a_request() {
+        fn skips(
+            _input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            Ok(None)
+        }
+        let provider = resolver(builder(), resolves(), skips, one_uid);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::ResolverNeverRequests
+            ),
+            "should report a resolver that never requests"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_capturer_that_never_captures() {
+        fn nothing(_input: &CaptureInput<'_>) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(Resolution::no_match())
+        }
+
+        let error = failure(&capturer(nothing), &capture_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::CapturerNeverMatches
+            ),
+            "should report a capturer that captures nothing"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_state_from_a_stateless_provider() {
+        fn returns_state(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(
+                Resolution::found([ResolvedEid::new(&source(), ResolvedUid::new("uid-1"))])
+                    .replacing_state(&json!({ "signature": "s" })),
+            )
+        }
+        let provider = resolver(builder(), resolves(), plain_request, returns_state);
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::StatelessState),
+            "should report state from a provider without private state"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_capture_that_changes_state() {
+        fn clears_state(
+            _input: &CaptureInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(
+                Resolution::found([ResolvedEid::new(&source(), ResolvedUid::new("uid-1"))])
+                    .clearing_state(),
+            )
+        }
+
+        let error = failure(&capturer(clears_state), &capture_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::CaptureStateChange
+            ),
+            "should report a capture that changes state"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_a_stateful_provider_that_accepts_a_bare_string_state() {
+        fn reads_any_state(
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            let _state = input.state::<serde_json::Value>()?;
+            plain_request(input)
+        }
+        fn keeps_state(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(
+                Resolution::found([ResolvedEid::new(&source(), ResolvedUid::new("uid-1"))])
+                    .replacing_state(&json!({ "signature": "s" })),
+            )
+        }
+        let provider = resolver(
+            builder(),
+            resolves().with_private_state(),
+            reads_any_state,
+            keeps_state,
+        );
+
+        let error = ProviderHarness::new(&provider)
+            .try_check_conformance_with_state::<serde_json::Value>(&resolve_cases())
+            .expect_err("should fail a state type that decodes a bare string");
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::BareStringStateAccepted
+            ),
+            "should report the accepted bare string"
+        );
+    }
+
+    #[test]
+    fn conformance_catches_an_expiring_source_without_an_expiry() {
+        let provider = resolver(
+            builder().with_expiring_source(&source()),
+            resolves(),
+            plain_request,
+            one_uid,
+        );
+
+        let error = failure(&provider, &resolve_cases());
+
+        assert!(
+            matches!(
+                error.current_context(),
+                ConformanceFailure::MissingExpiry { .. }
+            ),
+            "should report the missing expiry"
+        );
+    }
+
+    #[test]
+    fn conformance_accepts_a_complete_set_within_the_limits() {
+        fn complete_set(
+            _response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            Ok(Resolution::found([
+                ResolvedEid::new(
+                    &source(),
+                    ResolvedUid::new("uid-a")
+                        .with_atype(1)
+                        .with_ext(json!({ "stype": "ppuid" })),
+                )
+                .with_uid(ResolvedUid::new("uid-b"))
+                .with_inserter("inserter.example.com")
+                .with_matcher("matcher.example.com")
+                .with_mm(2)
+                .with_ext(json!({ "segments": ["s"] })),
+                ResolvedEid::new(&source(), ResolvedUid::new("uid-c"))
+                    .with_ext(json!({ "segments": ["t"] })),
+            ]))
+        }
+        let provider = resolver(builder(), resolves(), plain_request, complete_set);
+
+        let result = ProviderHarness::new(&provider).try_check_conformance(&resolve_cases());
+
+        assert!(
+            result.is_ok(),
+            "should accept two entries and three UIDs with every field"
+        );
+    }
+
+    #[test]
+    fn stored_full_set_reaches_a_refreshing_provider() {
+        fn echoes_stored_set(
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            let stored = input
+                .stored(&source())
+                .map(|stored| stored.eids().to_vec())
+                .unwrap_or_default();
+            ProviderRequest::post_json(input.endpoint()?, &stored).map(Some)
+        }
+        let provider = resolver(builder(), resolves(), echoes_stored_set, one_uid);
+        let set = vec![
+            Eid {
+                source: "exampleid.example.com".to_owned(),
+                uids: vec![
+                    Uid {
+                        id: "uid-a".to_owned(),
+                        atype: Some(1),
+                        ext: None,
+                    },
+                    Uid {
+                        id: "uid-b".to_owned(),
+                        atype: None,
+                        ext: Some(json!({ "stype": "ppuid" })),
+                    },
+                ],
+                inserter: Some("inserter.example.com".to_owned()),
+                matcher: None,
+                mm: Some(2),
+                ext: None,
+            },
+            Eid {
+                source: "exampleid.example.com".to_owned(),
+                uids: vec![Uid {
+                    id: "uid-c".to_owned(),
+                    atype: None,
+                    ext: None,
+                }],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: Some(json!({ "segments": ["s"] })),
+            },
+        ];
+        let mut harness = ProviderHarness::new(&provider)
+            .with_stored(StoredId::for_test(&source(), "uid-a").with_eids(set.clone()));
+
+        harness
+            .request()
+            .expect("should build a request")
+            .expect("should not skip the refresh");
+
+        assert_eq!(
+            harness.request_json::<Vec<Eid>>(),
+            set,
+            "should give the provider the stored full set"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/exchange.rs b/crates/trusted-server-core/src/ec/identity/exchange.rs
new file mode 100644
index 0000000000..87911bd704
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/exchange.rs
@@ -0,0 +1,445 @@
+//! What a provider sends and receives. The coordinator does all I/O.
+
+use core::fmt;
+
+use error_stack::Report;
+use http::header::{AUTHORIZATION, CONTENT_TYPE, COOKIE};
+use http::{HeaderMap, HeaderName, HeaderValue, Method, StatusCode};
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use url::Url;
+
+use super::resolution::IdentityProviderError;
+use crate::redacted::Redacted;
+
+/// Maximum JSON bytes of a call context.
+pub const MAX_CALL_CONTEXT_BYTES: usize = 1024;
+
+/// One call a provider wants made.
+#[derive(Clone)]
+pub struct ProviderRequest {
+    method: Method,
+    url: Url,
+    headers: HeaderMap,
+    body: Vec<u8>,
+    call_context: Option<String>,
+}
+
+impl fmt::Debug for ProviderRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderRequest")
+            .field("method", &self.method)
+            .field("host", &self.url.host_str())
+            .field("path", &self.url.path())
+            .field("headers", &self.headers.keys().collect::<Vec<_>>())
+            .field("body_len", &self.body.len())
+            .finish_non_exhaustive()
+    }
+}
+
+impl ProviderRequest {
+    /// Any method, with no body.
+    #[must_use]
+    pub fn new(method: Method, url: &Url) -> Self {
+        Self {
+            method,
+            url: url.clone(),
+            headers: HeaderMap::new(),
+            body: Vec::new(),
+            call_context: None,
+        }
+    }
+
+    /// A `GET`.
+    #[must_use]
+    pub fn get(url: &Url) -> Self {
+        Self::new(Method::GET, url)
+    }
+
+    /// A `POST` with a JSON body.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when `body` does not serialize.
+    pub fn post_json(
+        url: &Url,
+        body: &impl Serialize,
+    ) -> Result<Self, Report<IdentityProviderError>> {
+        let bytes = serde_json::to_vec(body)
+            .map_err(|_| IdentityProviderError::config("request body does not serialize"))?;
+        Self::new(Method::POST, url).with_body("application/json", bytes)
+    }
+
+    /// A `POST` with a `text/plain` body.
+    #[must_use]
+    pub fn post_text(url: &Url, body: &str) -> Self {
+        let mut request = Self::new(Method::POST, url);
+        request
+            .headers
+            .insert(CONTENT_TYPE, HeaderValue::from_static("text/plain"));
+        request.body = body.as_bytes().to_vec();
+        request
+    }
+
+    /// Sets the body and its `Content-Type`.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when `content_type` is not a valid header value.
+    pub fn with_body(
+        mut self,
+        content_type: &str,
+        body: Vec<u8>,
+    ) -> Result<Self, Report<IdentityProviderError>> {
+        let value = HeaderValue::from_str(content_type)
+            .map_err(|_| IdentityProviderError::config("invalid content type"))?;
+        self.headers.insert(CONTENT_TYPE, value);
+        self.body = body;
+        Ok(self)
+    }
+
+    /// Appends a query parameter, URL-encoded.
+    #[must_use]
+    pub fn with_query(mut self, name: &str, value: &str) -> Self {
+        self.url.query_pairs_mut().append_pair(name, value);
+        self
+    }
+
+    /// Sets a header. A `Cookie` header makes the coordinator refuse the call.
+    #[must_use]
+    pub fn with_header(mut self, name: HeaderName, value: HeaderValue) -> Self {
+        self.headers.insert(name, value);
+        self
+    }
+
+    /// Sets a header from strings.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when the name or value is invalid.
+    pub fn try_with_header(
+        self,
+        name: &str,
+        value: &str,
+    ) -> Result<Self, Report<IdentityProviderError>> {
+        let name = HeaderName::from_bytes(name.as_bytes())
+            .map_err(|_| IdentityProviderError::config("invalid header name"))?;
+        let value = HeaderValue::from_str(value)
+            .map_err(|_| IdentityProviderError::config("invalid header value"))?;
+        Ok(self.with_header(name, value))
+    }
+
+    /// Adds `Authorization: Bearer <token>`.
+    #[must_use]
+    pub fn with_bearer(mut self, token: &Redacted<String>) -> Self {
+        if let Ok(mut value) = HeaderValue::from_str(&format!("Bearer {}", token.expose())) {
+            value.set_sensitive(true);
+            self.headers.insert(AUTHORIZATION, value);
+        }
+        self
+    }
+
+    /// Data `response` needs from this call. Kept in memory, never sent.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when it does not serialize or is over 1,024 bytes of JSON.
+    pub fn try_with_call_context(
+        mut self,
+        context: &impl Serialize,
+    ) -> Result<Self, Report<IdentityProviderError>> {
+        let json = serde_json::to_string(context)
+            .map_err(|_| IdentityProviderError::config("call context does not serialize"))?;
+        if json.len() > MAX_CALL_CONTEXT_BYTES {
+            return Err(IdentityProviderError::config(
+                "call context exceeds 1024 bytes",
+            ));
+        }
+        self.call_context = Some(json);
+        Ok(self)
+    }
+
+    /// The method.
+    #[must_use]
+    pub fn method(&self) -> &Method {
+        &self.method
+    }
+
+    /// The URL.
+    #[must_use]
+    pub fn url(&self) -> &Url {
+        &self.url
+    }
+
+    /// The headers.
+    #[must_use]
+    pub fn headers(&self) -> &HeaderMap {
+        &self.headers
+    }
+
+    /// The body.
+    #[must_use]
+    pub fn body(&self) -> &[u8] {
+        &self.body
+    }
+
+    /// The call context JSON.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn call_context_json(&self) -> Option<&str> {
+        self.call_context.as_deref()
+    }
+
+    /// Whether the provider set a `Cookie` header.
+    #[must_use]
+    pub(crate) fn has_cookie_header(&self) -> bool {
+        self.headers.contains_key(COOKIE)
+    }
+}
+
+/// A buffered, decoded provider response.
+#[derive(Clone)]
+pub struct ProviderResponse {
+    status: StatusCode,
+    headers: HeaderMap,
+    body: Vec<u8>,
+    call_context: Option<String>,
+}
+
+impl fmt::Debug for ProviderResponse {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderResponse")
+            .field("status", &self.status)
+            .field("body_len", &self.body.len())
+            .finish_non_exhaustive()
+    }
+}
+
+impl ProviderResponse {
+    /// Built by the coordinator after buffering and decoding.
+    #[must_use]
+    pub(crate) fn new(
+        status: StatusCode,
+        headers: HeaderMap,
+        body: Vec<u8>,
+        call_context: Option<String>,
+    ) -> Self {
+        Self {
+            status,
+            headers,
+            body,
+            call_context,
+        }
+    }
+
+    /// A response for tests.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn for_test(status: StatusCode, body: &[u8]) -> Self {
+        Self::new(status, HeaderMap::new(), body.to_vec(), None)
+    }
+
+    /// The status.
+    #[must_use]
+    pub fn status(&self) -> StatusCode {
+        self.status
+    }
+
+    /// A header as a string, if present and visible ASCII.
+    #[must_use]
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).and_then(|value| value.to_str().ok())
+    }
+
+    /// The decoded body.
+    #[must_use]
+    pub fn body(&self) -> &[u8] {
+        &self.body
+    }
+
+    /// Parses the body as JSON, whatever the status.
+    ///
+    /// # Errors
+    ///
+    /// `Malformed` when it does not parse.
+    pub fn json<T: DeserializeOwned>(&self) -> Result<T, Report<IdentityProviderError>> {
+        serde_json::from_slice(&self.body).map_err(|_| IdentityProviderError::malformed())
+    }
+
+    /// Requires 2xx, then parses JSON.
+    ///
+    /// # Errors
+    ///
+    /// `Rejected` for a non-2xx status, `Malformed` for a bad body.
+    pub fn success_json<T: DeserializeOwned>(&self) -> Result<T, Report<IdentityProviderError>> {
+        self.require_success()?;
+        self.json()
+    }
+
+    /// Requires 2xx and a UTF-8 body.
+    ///
+    /// # Errors
+    ///
+    /// `Rejected` for a non-2xx status, `Malformed` for non-UTF-8.
+    pub fn success_text(&self) -> Result<&str, Report<IdentityProviderError>> {
+        self.require_success()?;
+        core::str::from_utf8(&self.body).map_err(|_| IdentityProviderError::malformed())
+    }
+
+    /// The context the request carried, decoded.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when it does not decode as `T`.
+    pub fn call_context<T: DeserializeOwned>(
+        &self,
+    ) -> Result<Option<T>, Report<IdentityProviderError>> {
+        self.call_context
+            .as_deref()
+            .map(|json| {
+                serde_json::from_str(json)
+                    .map_err(|_| IdentityProviderError::config("call context does not decode"))
+            })
+            .transpose()
+    }
+
+    fn require_success(&self) -> Result<(), Report<IdentityProviderError>> {
+        if self.status.is_success() {
+            Ok(())
+        } else {
+            Err(IdentityProviderError::rejected(self.status))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use http::{HeaderName, HeaderValue, Method, StatusCode};
+    use serde_json::json;
+
+    use super::*;
+
+    fn url() -> Url {
+        Url::parse("https://api.example.com/v1/fetch").expect("should parse")
+    }
+
+    #[test]
+    fn post_json_sets_body_and_content_type() {
+        let request = ProviderRequest::post_json(&url(), &json!({ "a": 1 }))
+            .expect("should build a JSON request");
+        assert_eq!(request.method(), Method::POST, "should use POST");
+        assert_eq!(
+            request.headers()["content-type"],
+            "application/json",
+            "should set the JSON content type"
+        );
+        assert_eq!(request.body(), br#"{"a":1}"#, "should serialize the body");
+    }
+
+    #[test]
+    fn query_bearer_and_headers() {
+        let request = ProviderRequest::get(&url())
+            .with_query("pid", "1 2")
+            .with_bearer(&Redacted::new("token".to_owned()))
+            .try_with_header("x-example", "v")
+            .expect("should accept a valid header");
+        assert_eq!(
+            request.url().as_str(),
+            "https://api.example.com/v1/fetch?pid=1+2",
+            "should encode the query"
+        );
+        assert_eq!(
+            request.headers()["authorization"],
+            "Bearer token",
+            "should set the bearer token"
+        );
+        assert_eq!(request.headers()["x-example"], "v", "should set the header");
+        let _ = ProviderRequest::get(&url())
+            .try_with_header("bad header", "v")
+            .expect_err("should reject a bad name");
+        let _ = ProviderRequest::get(&url())
+            .try_with_header("x", "bad\nvalue")
+            .expect_err("should reject a bad value");
+    }
+
+    #[test]
+    fn cookie_headers_are_flagged_from_either_helper() {
+        let typed = ProviderRequest::get(&url()).with_header(
+            HeaderName::from_static("cookie"),
+            HeaderValue::from_static("a=1"),
+        );
+        let dynamic = ProviderRequest::get(&url())
+            .try_with_header("Cookie", "a=1")
+            .expect("should accept a Cookie header from strings");
+        assert!(
+            typed.has_cookie_header(),
+            "should flag a Cookie header from the typed helper"
+        );
+        assert!(
+            dynamic.has_cookie_header(),
+            "should flag a Cookie header from the string helper"
+        );
+        assert!(
+            !ProviderRequest::get(&url()).has_cookie_header(),
+            "should not flag a request without one"
+        );
+    }
+
+    #[test]
+    fn call_context_round_trips_and_is_capped() {
+        let request = ProviderRequest::get(&url())
+            .try_with_call_context(&json!({ "nonce": [1, 2] }))
+            .expect("should accept a small call context");
+        let response = ProviderResponse::new(
+            StatusCode::OK,
+            http::HeaderMap::new(),
+            Vec::new(),
+            request.call_context_json().map(str::to_owned),
+        );
+        let context: serde_json::Value = response
+            .call_context()
+            .expect("should decode the call context")
+            .expect("should carry the call context");
+        assert_eq!(context, json!({ "nonce": [1, 2] }), "should round-trip");
+
+        let error = ProviderRequest::get(&url())
+            .try_with_call_context(&"x".repeat(MAX_CALL_CONTEXT_BYTES))
+            .expect_err("should reject an oversized call context");
+        assert!(
+            matches!(
+                error.current_context(),
+                IdentityProviderError::Config { .. }
+            ),
+            "should report an oversized call context as Config"
+        );
+    }
+
+    #[test]
+    fn success_helpers_check_status_and_encoding() {
+        let ok = ProviderResponse::for_test(StatusCode::OK, br#"{"uid":"u"}"#);
+        let value: serde_json::Value = ok.success_json().expect("should parse a 2xx JSON body");
+        assert_eq!(value["uid"], "u", "should read the uid");
+
+        let rejected = ProviderResponse::for_test(StatusCode::FORBIDDEN, br#"{}"#);
+        let error = rejected
+            .success_json::<serde_json::Value>()
+            .expect_err("should reject a non-2xx status");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::Rejected { status } if *status == StatusCode::FORBIDDEN),
+            "should report Rejected with the status"
+        );
+        rejected
+            .json::<serde_json::Value>()
+            .expect("should parse JSON whatever the status");
+
+        let binary = ProviderResponse::for_test(StatusCode::OK, &[0xff, 0xfe]);
+        let error = binary.success_text().expect_err("should reject non-UTF-8");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::Malformed),
+            "should report non-UTF-8 as Malformed"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/flush.rs b/crates/trusted-server-core/src/ec/identity/flush.rs
new file mode 100644
index 0000000000..c2969b4fb8
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/flush.rs
@@ -0,0 +1,1713 @@
+//! Phase 4: the writer's one flush after send (spec 5.2).
+//!
+//! The writer request stages every identity change in one
+//! [`IdentityMutation`]. After the response is sent, this module dispatches
+//! the after-send providers and writes the whole mutation once, with
+//! `IfGenerationMatch`. A failed flush is not retried as a whole; only its
+//! removals are written again, alone (spec 5.2 phase 4 step 5).
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::IpAddr;
+use std::time::Duration;
+
+use http::StatusCode;
+
+use super::coordinator::{
+    Call, Eligibility, EligibilityInput, EligibilityView, IdentityDeps, OutcomeChanges,
+    OutcomeContext, Phase, RequestFacts, dispatch, eligibility, opt_out_clears, outcome_to_changes,
+};
+use super::descriptor::{Input, Resolves};
+use super::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use super::input::{ProviderConsent, Region, ResolveSignals, StoredId, ThreadRandom};
+use super::mutation::{ApplyContext, IdentityMutation, ProviderStateChange, apply};
+use super::pending::{append_pending, load_pending};
+use super::policy::{PolicySignals, fingerprint_bits};
+use super::provider::IdentityProvider;
+use super::removal::{RemovalTiming, log_removal_lost, write_removals};
+use super::revision::StateRevision;
+use super::runtime::IdentityRuntime;
+use crate::consent::allows_eid_persistence;
+use crate::ec::kv::KvIdentityGraph;
+use crate::ec::kv_backend::EcKvWriteOutcome;
+use crate::ec::kv_types::KvEntry;
+use crate::ec::rate_limiter::RateLimiter;
+use crate::ec::{EcContext, EcKvSnapshot, current_timestamp, log_id};
+use crate::platform::RuntimeServices;
+use crate::settings::{ProviderMode, Settings};
+
+pub use super::removal::RemovalWriteOutcome;
+
+/// What phase 4 needs. The catalog and keys come from `runtime`.
+pub struct AfterSendInput<'a> {
+    /// The identity runtime of this settings load.
+    pub runtime: &'a IdentityRuntime,
+    /// The settings the request ran with.
+    pub settings: &'a Settings,
+    /// The request's platform services, for the after-send calls.
+    pub services: &'a RuntimeServices,
+    /// The identity graph to read and write.
+    pub graph: &'a KvIdentityGraph,
+    /// The request's EC state, holding the writer decision and the mutation.
+    pub context: &'a mut EcContext,
+    /// The status of the response that was sent.
+    pub status: StatusCode,
+    /// The per-visitor burst cap.
+    pub rate_limiter: &'a dyn RateLimiter,
+}
+
+/// How phase 4 ended.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FlushOutcome {
+    /// Not a returning EC's writer, or nothing to do. Nothing was read.
+    Skipped,
+    /// The mutation changed nothing in the row, so nothing was written.
+    NoChange,
+    /// The one write landed.
+    Written,
+    /// The row was a tombstone, missing or unreadable, or the merged row was
+    /// invalid. The mutation was dropped and no provider was called after it.
+    Dropped(&'static str),
+    /// The one write failed. `removals` is how the removal-only retry ended.
+    WriteFailed {
+        /// The removal-only retry's outcome.
+        removals: RemovalWriteOutcome,
+    },
+}
+
+/// Whether phase 4 can have work for this request: it is a returning EC's
+/// writer. A caller checks this before building the identity graph.
+#[must_use]
+pub fn may_flush(context: &EcContext) -> bool {
+    context.identity().writer() && context.ec_was_present() && !context.ec_generated()
+}
+
+/// Runs phase 4 for the writer request (spec 5.2, steps 1 to 5).
+///
+/// It reads the row at most once, calls the due after-send providers only
+/// after that read confirms a live, consenting row, and writes at most once
+/// with the generation it read. Only a failed write that holds removals adds
+/// the removal-only write of spec 5.3.
+#[must_use]
+pub fn run_after_send(input: AfterSendInput<'_>) -> FlushOutcome {
+    let AfterSendInput {
+        runtime,
+        settings,
+        services,
+        graph,
+        context,
+        status,
+        rate_limiter,
+    } = input;
+
+    let returning_writer = may_flush(context);
+    let Some(ec_id) = context.ec_value().map(str::to_owned) else {
+        return FlushOutcome::Skipped;
+    };
+    if !returning_writer {
+        return FlushOutcome::Skipped;
+    }
+
+    let mut mutation = core::mem::take(context.identity_mut().mutation_mut());
+    let status_ok = status.is_success() || status == StatusCode::NOT_MODIFIED;
+    if !status_ok {
+        mutation.retain_for_error_status();
+    }
+
+    let now = current_timestamp();
+    // Hold-mode providers run in phase 4 unless the hold dispatch already
+    // considered them on a usable row (spec 4.7 step 7).
+    let facts = request_facts(context, now, context.identity().hold_dispatched());
+    let phase_one = context.kv_snapshot().clone();
+    let phase_one_entry = phase_one.entry_for(&ec_id);
+    let phase_one_view =
+        phase_one_entry.map_or_else(EligibilityView::empty, EligibilityView::from_kv);
+    let due = if status_ok {
+        due_providers(runtime, settings, context, &phase_one_view, &facts)
+    } else {
+        Vec::new()
+    };
+    let needs_cluster_size = phase_one_entry.is_some_and(lacks_cluster_size);
+    // The SPA writer writes only on a row its auction read, and only once
+    // the interval since the last writer flush has passed (spec 5.1).
+    if context.identity().spa_writer() {
+        let interval = settings.ec.identity.spa_writer_interval_sec;
+        let waiting = phase_one_entry
+            .is_none_or(|entry| entry.wa.is_some_and(|at| now < at.saturating_add(interval)));
+        if waiting {
+            return FlushOutcome::Skipped;
+        }
+    }
+    // Every returning writer reads the pending key: what earlier requests
+    // could not write waits there for it (spec 5.3, Pending key).
+    let phase_one_applied = phase_one_entry.and_then(|entry| entry.pg).unwrap_or(0);
+    let mut pending = load_pending(graph, &ec_id, phase_one_applied);
+    // A re-grant clears a sticky opt-out on the writer's one flush (spec 8).
+    let regranted = opt_out_clears(
+        &phase_one_view,
+        runtime.catalog(),
+        context.consent(),
+        facts.policy_signals,
+    );
+
+    if mutation.is_empty()
+        && due.is_empty()
+        && !needs_cluster_size
+        && regranted.is_empty()
+        && pending.is_none()
+    {
+        return FlushOutcome::Skipped;
+    }
+
+    // Phase 1's read decides when no provider is due (spec 5.2 phase 4
+    // step 2). A failed or absent phase 1 read counts as no read.
+    let reusable = match &phase_one {
+        EcKvSnapshot::Present {
+            entry,
+            generation: Some(generation),
+            ..
+        } if due.is_empty() && phase_one.belongs_to(&ec_id) => {
+            Some((entry.as_ref().clone(), *generation))
+        }
+        EcKvSnapshot::Missing { .. } if due.is_empty() && phase_one.belongs_to(&ec_id) => {
+            return drop_mutation(&ec_id, "missing");
+        }
+        _ => None,
+    };
+    let (live, generation) = match reusable {
+        Some(snapshot) => snapshot,
+        None => match graph.get(&ec_id) {
+            Ok(Some(row)) => row,
+            Ok(None) => return drop_mutation(&ec_id, "missing"),
+            Err(error) => {
+                log::warn!(
+                    "Identity flush for '{}' could not read the row: {}",
+                    log_id(&ec_id),
+                    error.current_context()
+                );
+                return drop_mutation(&ec_id, "read failed");
+            }
+        },
+    };
+    if !live.consent.ok {
+        return drop_mutation(&ec_id, "tombstone");
+    }
+    let live_applied = live.pg.unwrap_or(0);
+    if pending.is_some() && live_applied != phase_one_applied {
+        pending = load_pending(graph, &ec_id, live_applied);
+    }
+
+    // The row is live and consenting: only now may the EC ID leave TS.
+    let live_view = EligibilityView::from_kv(&live);
+    let calls: Vec<Call> = due
+        .iter()
+        .filter_map(|id| live_call(runtime, settings, context, &live_view, &facts, id))
+        .collect();
+    if !calls.is_empty() {
+        let random = ThreadRandom;
+        let deps = runtime.deps(settings, services, &random, Some(rate_limiter));
+        // Phase 4 runs after the response is sent, outside any executor, so
+        // blocking here is safe. The hold dispatch awaits instead: it runs
+        // inside the request handler's executor.
+        futures::executor::block_on(add_dispatch_results(
+            &mut mutation,
+            &deps,
+            &DispatchInput {
+                context,
+                ec_id: &ec_id,
+                live: &live,
+                view: &live_view,
+                facts: &facts,
+            },
+            DispatchRun {
+                calls,
+                budget: None,
+            },
+        ));
+    }
+
+    for (provider, watermark) in regranted {
+        mutation.merge_state(
+            provider,
+            ProviderStateChange {
+                opt_out_clear: Some(watermark),
+                ..ProviderStateChange::default()
+            },
+        );
+    }
+
+    if lacks_cluster_size(&live) {
+        match graph.compute_cluster_size(&ec_id) {
+            Ok(size) => mutation.set_cluster_size(size),
+            Err(error) => log::warn!(
+                "Identity flush for '{}' could not compute the cluster size: {}",
+                log_id(&ec_id),
+                error.current_context()
+            ),
+        }
+    }
+
+    // Only this request's own removals go back to the pending key if the
+    // write fails: the merged items are still there.
+    let own_removals = mutation.removals();
+    let pending_generation = pending.map(|merge| {
+        let mut merged = merge.mutation;
+        merged.absorb(core::mem::take(&mut mutation));
+        mutation = merged;
+        merge.generation
+    });
+
+    let random = ThreadRandom;
+    let apply_context = ApplyContext {
+        now,
+        random: &random,
+        catalog: runtime.catalog(),
+    };
+    let Some(mut applied) = apply(&mutation, &live, &apply_context) else {
+        return drop_mutation(&ec_id, "invalid");
+    };
+    if let Some(generation) = pending_generation {
+        applied.entry.pg = Some(generation);
+        applied.changed = true;
+    }
+    if !applied.changed {
+        return FlushOutcome::NoChange;
+    }
+    applied.entry.wa = Some(now);
+
+    match graph.write_if_generation(&ec_id, &applied.entry, generation) {
+        Ok(EcKvWriteOutcome::Written) => FlushOutcome::Written,
+        Ok(EcKvWriteOutcome::PreconditionFailed) => {
+            log::warn!(
+                "Identity flush for '{}' lost its generation check; not retried",
+                log_id(&ec_id)
+            );
+            write_failed(
+                graph,
+                context,
+                &ec_id,
+                &mutation,
+                &own_removals,
+                &apply_context,
+            )
+        }
+        Err(error) => {
+            log::warn!(
+                "Identity flush for '{}' failed to write: {}",
+                log_id(&ec_id),
+                error.current_context()
+            );
+            write_failed(
+                graph,
+                context,
+                &ec_id,
+                &mutation,
+                &own_removals,
+                &apply_context,
+            )
+        }
+    }
+}
+
+fn drop_mutation(ec_id: &str, reason: &'static str) -> FlushOutcome {
+    log::debug!(
+        "Identity flush for '{}' dropped its mutation: {reason}",
+        log_id(ec_id)
+    );
+    FlushOutcome::Dropped(reason)
+}
+
+fn lacks_cluster_size(entry: &KvEntry) -> bool {
+    entry.consent.ok
+        && entry
+            .network
+            .as_ref()
+            .and_then(|network| network.cluster_size)
+            .is_none()
+}
+
+/// Writes the failed flush's removals alone. When that fails too, the
+/// request's own removals go to the pending key (spec 5.2 phase 4 step 5).
+fn write_failed(
+    graph: &KvIdentityGraph,
+    context: &mut EcContext,
+    ec_id: &str,
+    mutation: &IdentityMutation,
+    own_removals: &IdentityMutation,
+    apply_context: &ApplyContext<'_>,
+) -> FlushOutcome {
+    let removals = mutation.removals();
+    if !removals.has_removals() {
+        return FlushOutcome::WriteFailed {
+            removals: RemovalWriteOutcome::NothingToWrite,
+        };
+    }
+    // Phase 4 runs after send, right after the failed flush.
+    let outcome = write_removals(
+        graph,
+        ec_id,
+        &removals,
+        apply_context,
+        RemovalTiming::AfterSend,
+    );
+    if outcome == RemovalWriteOutcome::Failed {
+        defer_or_lose(graph, context, ec_id, own_removals);
+    }
+    FlushOutcome::WriteFailed { removals: outcome }
+}
+
+/// Appends removals the row write missed to the pending key and counts each
+/// as deferred, or, when that fails too, logs and counts each as lost.
+fn defer_or_lose(
+    graph: &KvIdentityGraph,
+    context: &mut EcContext,
+    ec_id: &str,
+    removals: &IdentityMutation,
+) {
+    if !removals.has_removals() {
+        return;
+    }
+    let deferred = append_pending(graph, ec_id, removals, current_timestamp());
+    if !deferred {
+        log_removal_lost(ec_id, removals);
+    }
+    for _ in removals.removal_labels() {
+        if deferred {
+            context.identity_mut().record_removal_deferred();
+        } else {
+            context.identity_mut().record_removal_lost();
+        }
+    }
+}
+
+/// Appends the positive writes a capture kept, on a request that is not the
+/// writer, to the pending key for the next writer (spec 5.3, Pending key).
+/// Without an EC ID, or after a global revoke, it drops them.
+pub fn defer_capture_writes(context: &mut EcContext, graph: &KvIdentityGraph) {
+    let writes = core::mem::take(context.identity_mut().capture_writes_mut());
+    if writes.is_empty() || context.global_revoke_requested() {
+        return;
+    }
+    let Some(ec_id) = context.ec_value().map(str::to_owned) else {
+        return;
+    };
+    if !append_pending(graph, &ec_id, &writes, current_timestamp()) {
+        log::warn!(
+            "Capture writes for '{}' could not reach the pending key",
+            log_id(&ec_id)
+        );
+    }
+}
+
+/// Tries once more, after send, the capture removal write that failed before
+/// send (spec 5.3).
+///
+/// This is the last row attempt: the pending removals are taken, and when
+/// they still cannot be written they go to the pending key, or are logged
+/// and counted as lost if that fails too. Without a pending removal it does
+/// nothing.
+pub fn retry_pending_removals(context: &mut EcContext, graph: &KvIdentityGraph) {
+    let Some(removals) = context.identity().pending_removals().cloned() else {
+        return;
+    };
+    let ec_id = context.ec_value().map(str::to_owned);
+    let runtime = context.identity().runtime().cloned();
+    let (Some(ec_id), Some(runtime)) = (ec_id, runtime) else {
+        log::warn!("Capture removal retry skipped: no EC ID or identity runtime");
+        lose_pending_removals(context);
+        return;
+    };
+    let random = ThreadRandom;
+    let outcome = write_removals(
+        graph,
+        &ec_id,
+        &removals,
+        &ApplyContext {
+            now: current_timestamp(),
+            random: &random,
+            catalog: runtime.catalog(),
+        },
+        RemovalTiming::AfterSend,
+    );
+    context.identity_mut().set_pending_removals(None);
+    if outcome == RemovalWriteOutcome::Failed {
+        defer_or_lose(graph, context, &ec_id, &removals);
+    }
+}
+
+/// Gives up the capture removal write that failed before send: logs and
+/// counts each removal as lost. For an after-send run that cannot even try,
+/// such as one without an identity graph.
+pub fn lose_pending_removals(context: &mut EcContext) {
+    let Some(removals) = context.identity().pending_removals().cloned() else {
+        return;
+    };
+    context.identity_mut().set_pending_removals(None);
+    log_removal_lost(context.ec_value().unwrap_or_default(), &removals);
+    for _ in removals.removal_labels() {
+        context.identity_mut().record_removal_lost();
+    }
+}
+
+/// What eligibility reads about the request itself.
+pub(super) fn request_facts(context: &EcContext, now: u64, runs_auction: bool) -> RequestFacts {
+    let identity = context.identity();
+    let mut available_inputs = BTreeSet::new();
+    for (input, present) in [
+        (Input::ClientIp, client_ip(context).is_some()),
+        (Input::UserAgent, identity.user_agent().is_some()),
+        (Input::PageUrl, identity.page_url().is_some()),
+        (Input::Region, region(context).is_some()),
+    ] {
+        if present {
+            available_inputs.insert(input);
+        }
+    }
+    RequestFacts {
+        is_real_browser: identity.is_real_browser(),
+        ec_persistence_allowed: context.ec_allowed() && allows_eid_persistence(context.consent()),
+        policy_signals: PolicySignals {
+            dnt: identity.dnt(),
+        },
+        writer: identity.writer(),
+        // A minted EC whose create waits for the hold dispatch may run
+        // hold-mode providers (spec 4.7, new visitors).
+        new_visitor: context.ec_generated() && context.deferred_entry().is_none(),
+        runs_auction,
+        now: UnixTime::from_secs(now),
+        available_inputs,
+    }
+}
+
+pub(super) fn client_ip(context: &EcContext) -> Option<IpAddr> {
+    context.client_ip().and_then(|ip| ip.parse().ok())
+}
+
+pub(super) fn region(context: &EcContext) -> Option<Region> {
+    context
+        .geo_info()
+        .and_then(|geo| Region::from_geo(&geo.country, geo.region.as_deref()))
+}
+
+/// The eligibility of `provider` for phase 4 against `view`.
+fn after_send_eligibility(
+    provider: &dyn IdentityProvider,
+    runtime: &IdentityRuntime,
+    settings: &Settings,
+    context: &EcContext,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+) -> Eligibility {
+    let provider_settings = settings.ec.identity.provider(provider.descriptor().id());
+    eligibility(
+        &EligibilityInput {
+            provider,
+            settings: &provider_settings,
+            identity: &settings.ec.identity,
+            catalog: runtime.catalog(),
+            consent: context.consent(),
+        },
+        view,
+        facts,
+        Phase::AfterSend,
+    )
+}
+
+/// The after-send providers due on the phase 1 view.
+fn due_providers(
+    runtime: &IdentityRuntime,
+    settings: &Settings,
+    context: &EcContext,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+) -> Vec<IdentityProviderId> {
+    let spa_writer = context.identity().spa_writer();
+    runtime
+        .catalog()
+        .providers()
+        // The SPA writer never runs a hold-mode provider (spec 5.1).
+        .filter(|provider| {
+            !spa_writer
+                || settings
+                    .ec
+                    .identity
+                    .provider(provider.descriptor().id())
+                    .mode
+                    == ProviderMode::AfterSend
+        })
+        .filter(|provider| {
+            matches!(
+                after_send_eligibility(provider.as_ref(), runtime, settings, context, view, facts),
+                Eligibility::Eligible { .. }
+            )
+        })
+        .map(|provider| provider.descriptor().id().clone())
+        .collect()
+}
+
+/// The call of a provider still due on the live row, with its live `ps.st`.
+fn live_call(
+    runtime: &IdentityRuntime,
+    settings: &Settings,
+    context: &EcContext,
+    view: &EligibilityView,
+    facts: &RequestFacts,
+    id: &IdentityProviderId,
+) -> Option<Call> {
+    let provider = runtime.catalog().get(id)?;
+    let Eligibility::Eligible { kinds } =
+        after_send_eligibility(provider.as_ref(), runtime, settings, context, view, facts)
+    else {
+        return None;
+    };
+    Some(Call {
+        provider: id.clone(),
+        kinds,
+        state_json: view
+            .state(id)
+            .and_then(|state| serde_json::to_string(state).ok()),
+    })
+}
+
+/// What dispatching the due providers reads.
+pub(super) struct DispatchInput<'a> {
+    pub(super) context: &'a EcContext,
+    pub(super) ec_id: &'a str,
+    pub(super) live: &'a KvEntry,
+    pub(super) view: &'a EligibilityView,
+    pub(super) facts: &'a RequestFacts,
+}
+
+/// The calls to send and, for a hold dispatch before the auction, the budget
+/// they share.
+pub(super) struct DispatchRun {
+    pub(super) calls: Vec<Call>,
+    pub(super) budget: Option<Duration>,
+}
+
+/// Dispatches `run.calls` and adds their outcomes to `mutation`.
+pub(super) async fn add_dispatch_results(
+    mutation: &mut IdentityMutation,
+    deps: &IdentityDeps<'_>,
+    input: &DispatchInput<'_>,
+    run: DispatchRun,
+) {
+    let DispatchRun { calls, budget } = run;
+    let resolving: BTreeSet<&SourceDomain> =
+        calls.iter().flat_map(|call| call.kinds.keys()).collect();
+    let stored: BTreeMap<SourceDomain, StoredId> = input
+        .view
+        .records()
+        .filter(|(source, _)| resolving.contains(source))
+        .filter_map(|(source, record)| {
+            StoredId::from_record(source, record).map(|stored| (source.clone(), stored))
+        })
+        .collect();
+    let identity = input.context.identity();
+    let signals = ResolveSignals {
+        client_ip: client_ip(input.context),
+        user_agent: identity.user_agent(),
+        page_url: identity.page_url().cloned(),
+        region: region(input.context),
+        hashed_email: None,
+        consent: ProviderConsent::from_context(input.context.consent()),
+        publisher_domain: &deps.settings.publisher.domain,
+        now: input.facts.now,
+        random: deps.random,
+        ec_id: Some(input.ec_id.to_owned()),
+        stored,
+    };
+    let catalog = deps.catalog;
+    for (id, outcome) in dispatch(deps, calls, &signals, budget).await {
+        let Some(provider) = catalog.get(&id) else {
+            continue;
+        };
+        let provider: &dyn IdentityProvider = provider.as_ref();
+        let descriptor = provider.descriptor();
+        let provider_settings = deps.settings.ec.identity.provider(&id);
+        let fingerprint = fingerprint_bits(
+            descriptor.consent_policy(),
+            input.context.consent(),
+            input.facts.policy_signals,
+        );
+        let stateful = descriptor
+            .resolves()
+            .is_some_and(Resolves::has_private_state);
+        let outcome_context = OutcomeContext {
+            now: input.facts.now,
+            catalog,
+            settings: &provider_settings,
+            identity: &deps.settings.ec.identity,
+            expected_state: stateful.then(|| {
+                StateRevision::of(
+                    input
+                        .live
+                        .ps
+                        .get(id.as_str())
+                        .and_then(|state| state.st.as_ref()),
+                )
+            }),
+            fingerprint: &fingerprint,
+        };
+        let found = outcome.is_found();
+        let changes = outcome_to_changes(provider, outcome, input.view, &outcome_context);
+        add_outcome(mutation, &id, changes, found);
+    }
+}
+
+/// Adds one outcome's changes to the mutation.
+///
+/// A `found` outcome's state change is tagged, so an error status drops its
+/// `n` and `f` with its positive answer (spec 5.1).
+fn add_outcome(
+    mutation: &mut IdentityMutation,
+    id: &IdentityProviderId,
+    changes: OutcomeChanges,
+    found: bool,
+) {
+    let OutcomeChanges {
+        changes,
+        result,
+        state,
+    } = changes;
+    for change in changes {
+        mutation.add_change(change);
+    }
+    if let Some(result) = result {
+        mutation.add_result(result);
+    }
+    if found {
+        mutation.merge_found_state(id.clone(), state);
+    } else {
+        mutation.merge_state(id.clone(), state);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::sync::Arc;
+
+    use error_stack::Report;
+
+    use super::*;
+    use crate::consent::types::GppConsent;
+    use crate::ec::identity::denials::{denials, filter_browser_candidates};
+    use crate::ec::identity::mutation::PartnerIdChange;
+    use crate::ec::identity::pending::pending_key;
+    use crate::ec::identity::removal::PER_KEY_WRITE_WINDOW;
+    use crate::ec::identity::request::WriterDecision;
+    use crate::ec::identity::revision::{record_revision, uid_hash, visitor_key};
+    use crate::ec::identity::test_support::fake_http::{
+        FakeBackend, FakeHttpClient, fake_services,
+    };
+    use crate::ec::identity::test_support::{
+        TEST_EC_ID, WriteCountingEcKv, allowing_consent, ec_partner, example_entry_set,
+        full_record, pid, record_for_test, source,
+    };
+    use crate::ec::kv_types::{KvNetwork, KvOptOut, KvPartnerId, KvProviderState};
+    use crate::error::TrustedServerError;
+    use crate::openrtb::{Eid, Uid};
+    use crate::settings::ProviderSettings;
+    use crate::test_support::tests::create_test_settings;
+
+    const PULL_HOST: &str = "sync.ssp.example.com";
+    const PULL_SOURCE: &str = "ssp.example.com";
+    const PULL_ID: &str = "pull-ssp-example-com";
+
+    /// Answers every burst-cap read with `exceeded`, and records the keys.
+    struct ScriptedLimiter {
+        exceeded: bool,
+        keys: RefCell<Vec<String>>,
+    }
+
+    impl ScriptedLimiter {
+        fn allowing() -> Self {
+            Self {
+                exceeded: false,
+                keys: RefCell::new(Vec::new()),
+            }
+        }
+
+        fn capped() -> Self {
+            Self {
+                exceeded: true,
+                keys: RefCell::new(Vec::new()),
+            }
+        }
+    }
+
+    impl RateLimiter for ScriptedLimiter {
+        fn exceeded(&self, key: &str, _limit: u32) -> Result<bool, Report<TrustedServerError>> {
+            self.keys.borrow_mut().push(key.to_owned());
+            Ok(self.exceeded)
+        }
+
+        fn record(&self, _key: &str) -> Result<(), Report<TrustedServerError>> {
+            Ok(())
+        }
+
+        fn count(&self, _key: &str) -> Result<u32, Report<TrustedServerError>> {
+            Ok(0)
+        }
+    }
+
+    struct Fixture {
+        settings: Settings,
+        runtime: IdentityRuntime,
+        client: Arc<FakeHttpClient>,
+        services: RuntimeServices,
+        graph: KvIdentityGraph,
+        store: Arc<WriteCountingEcKv>,
+        context: EcContext,
+    }
+
+    impl Fixture {
+        /// A returning writer whose phase 1 read found `row`. With
+        /// `pull_partner`, one generic pull partner is configured.
+        fn new(row: Option<&KvEntry>, pull_partner: bool) -> Self {
+            Self::with_settings(row, Self::settings(pull_partner))
+        }
+
+        fn settings(pull_partner: bool) -> Settings {
+            let mut settings = create_test_settings();
+            settings.ec.partners = if pull_partner {
+                vec![ec_partner(
+                    PULL_SOURCE,
+                    &format!("https://{PULL_HOST}/pull"),
+                    "example-token-value-0123456789abcdef",
+                )]
+            } else {
+                Vec::new()
+            };
+            settings
+        }
+
+        fn with_settings(row: Option<&KvEntry>, settings: Settings) -> Self {
+            let runtime = IdentityRuntime::from_settings(
+                &settings,
+                &crate::integrations::IntegrationRegistry::default(),
+            )
+            .expect("should build runtime");
+            let client = Arc::new(FakeHttpClient::new());
+            let backend = Arc::new(FakeBackend::new());
+            let services = fake_services(&client, &backend);
+            let (graph, store) = KvIdentityGraph::write_counting("flush-store");
+            let mut context = EcContext::new_for_test_with_ip(
+                Some(TEST_EC_ID.to_owned()),
+                allowing_consent(),
+                Some("192.0.2.10".to_owned()),
+            );
+            context.identity_mut().set_writer_decision(WriterDecision {
+                writer: true,
+                is_real_browser: true,
+                user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                dnt: false,
+                page_url: None,
+            });
+            if let Some(row) = row {
+                graph.create(TEST_EC_ID, row).expect("should seed the row");
+                context.set_kv_snapshot(graph.load_snapshot(TEST_EC_ID));
+            }
+            store.reset_counts();
+            Self {
+                settings,
+                runtime,
+                client,
+                services,
+                graph,
+                store,
+                context,
+            }
+        }
+
+        fn run(&mut self, limiter: &ScriptedLimiter) -> FlushOutcome {
+            self.run_with_status(limiter, StatusCode::OK)
+        }
+
+        fn run_with_status(
+            &mut self,
+            limiter: &ScriptedLimiter,
+            status: StatusCode,
+        ) -> FlushOutcome {
+            run_after_send(AfterSendInput {
+                runtime: &self.runtime,
+                settings: &self.settings,
+                services: &self.services,
+                graph: &self.graph,
+                context: &mut self.context,
+                status,
+                rate_limiter: limiter,
+            })
+        }
+
+        fn stage(&mut self, change: PartnerIdChange) {
+            self.context
+                .identity_mut()
+                .mutation_mut()
+                .add_change(change);
+        }
+
+        fn stage_sharedid(&mut self) {
+            self.stage(PartnerIdChange::FillMissing {
+                source: source("sharedid.org"),
+                record: KvPartnerId::browser("shared-uid", Some(current_timestamp())),
+            });
+        }
+
+        fn row(&self) -> KvEntry {
+            self.graph
+                .get(TEST_EC_ID)
+                .expect("should read the row")
+                .expect("should hold the row")
+                .0
+        }
+    }
+
+    /// A live, consenting row; `cluster_size` is set unless `sized` is false.
+    fn live_row(sized: bool) -> KvEntry {
+        let mut entry = KvEntry::new(&allowing_consent(), None, 1_000, "test-publisher.com");
+        if sized {
+            entry.network = Some(KvNetwork {
+                cluster_size: Some(1),
+            });
+        }
+        entry
+    }
+
+    fn pull_answers(fixture: &Fixture, uid: &str) {
+        fixture
+            .client
+            .respond(PULL_HOST, 200, format!(r#"{{"uid":"{uid}"}}"#).as_bytes());
+    }
+
+    #[test]
+    fn writer_flushes_mutation_once_with_generation_match() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), false);
+        fixture.stage_sharedid();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the mutation");
+        let writes = fixture.store.writes();
+        assert_eq!(
+            writes.if_generation_match, 1,
+            "should write once with a CAS"
+        );
+        assert_eq!(writes.total(), 1, "should make no other write");
+        assert_eq!(writes.lookups, 0, "should reuse the phase 1 read");
+        assert!(
+            fixture.row().ids.contains_key("sharedid.org"),
+            "should store the sharedId fill"
+        );
+    }
+
+    #[test]
+    fn writer_with_nothing_to_do_reads_and_writes_nothing() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), false);
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Skipped, "should have nothing to do");
+        let writes = fixture.store.writes();
+        assert_eq!(
+            (writes.lookups, writes.total()),
+            (0, 0),
+            "should touch no KV"
+        );
+    }
+
+    #[test]
+    fn non_2xx_or_304_status_drops_ingest_and_dispatches_nothing() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&fixture, "pulled-uid");
+        fixture.stage_sharedid();
+
+        let outcome = fixture.run_with_status(
+            &ScriptedLimiter::allowing(),
+            StatusCode::INTERNAL_SERVER_ERROR,
+        );
+
+        assert_eq!(outcome, FlushOutcome::Skipped, "should drop the ingest");
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should call no provider"
+        );
+        let writes = fixture.store.writes();
+        assert_eq!(
+            (writes.lookups, writes.total()),
+            (0, 0),
+            "should touch no KV"
+        );
+    }
+
+    #[test]
+    fn not_modified_status_still_flushes() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), false);
+        fixture.stage_sharedid();
+
+        let outcome =
+            fixture.run_with_status(&ScriptedLimiter::allowing(), StatusCode::NOT_MODIFIED);
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::Written,
+            "should treat 304 as success"
+        );
+    }
+
+    #[test]
+    fn tombstone_on_reread_drops_mutation_and_calls_no_provider() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&fixture, "leaked-uid");
+        fixture.stage_sharedid();
+        let tombstoned = fixture
+            .graph
+            .write_withdrawal_tombstone(TEST_EC_ID, drop)
+            .expect("should tombstone the row");
+        assert_eq!(
+            tombstoned,
+            crate::ec::kv::TombstoneOutcome::Written,
+            "should tombstone the live row"
+        );
+        fixture.store.reset_counts();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::Dropped("tombstone"),
+            "should drop the mutation on a tombstone"
+        );
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should disclose the EC ID to no provider"
+        );
+        assert_eq!(fixture.store.writes().total(), 0, "should write nothing");
+        assert!(
+            fixture.row().ids.is_empty(),
+            "should leave the tombstone bare"
+        );
+    }
+
+    #[test]
+    fn failed_phase_one_read_rereads_before_writing() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), false);
+        fixture.context.set_kv_snapshot(EcKvSnapshot::Failed {
+            ec_id: TEST_EC_ID.to_owned(),
+        });
+        fixture.stage_sharedid();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::Written,
+            "should write after the re-read"
+        );
+        let writes = fixture.store.writes();
+        assert_eq!(writes.lookups, 1, "should re-read once");
+        assert_eq!(writes.if_generation_match, 1, "should write once");
+    }
+
+    #[test]
+    fn ingest_queued_against_an_unread_snapshot_is_written_after_a_read() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), false);
+        fixture.context.set_kv_snapshot(EcKvSnapshot::NotRead);
+        fixture.stage_sharedid();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the ingest");
+        assert_eq!(
+            fixture.store.writes().lookups,
+            1,
+            "should read before writing"
+        );
+        assert!(
+            fixture.row().ids.contains_key("sharedid.org"),
+            "should store the sharedId the writer queued"
+        );
+    }
+
+    #[test]
+    fn due_generic_pull_provider_dispatches_after_reread_and_its_uid_lands_in_the_same_write() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&fixture, "pulled-uid");
+        fixture.stage_sharedid();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write once");
+        let writes = fixture.store.writes();
+        assert_eq!(writes.lookups, 1, "should re-read before dispatch");
+        assert_eq!(writes.total(), 1, "should make one write");
+        assert_eq!(
+            fixture.client.sent_hosts(),
+            [PULL_HOST],
+            "should call the partner"
+        );
+        let row = fixture.row();
+        let record = row
+            .ids
+            .get(PULL_SOURCE)
+            .expect("should store the pulled UID");
+        assert_eq!(record.eids.len(), 1, "should store a one-entry record");
+        assert_eq!(
+            record.first_uid(),
+            Some("pulled-uid"),
+            "should store the UID"
+        );
+        assert_eq!(
+            record.w.as_deref(),
+            Some(PULL_ID),
+            "should name the provider"
+        );
+        assert!(
+            row.ids.contains_key("sharedid.org"),
+            "should land the ingest too"
+        );
+    }
+
+    #[test]
+    fn generic_pull_results_join_the_single_flush() {
+        let mut settings = Fixture::settings(true);
+        settings.ec.partners.push(ec_partner(
+            "dsp.example.com",
+            "https://sync.dsp.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        ));
+        settings.ec.identity.max_concurrency = 1;
+        let mut fixture = Fixture::with_settings(Some(&live_row(true)), settings);
+        pull_answers(&fixture, "pulled-uid");
+        fixture
+            .client
+            .respond("sync.dsp.example.com", 200, br#"{"uid":"other-uid"}"#);
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write once");
+        assert_eq!(fixture.store.writes().total(), 1, "should make one write");
+        let row = fixture.row();
+        assert!(
+            row.ids.contains_key(PULL_SOURCE) && row.ids.contains_key("dsp.example.com"),
+            "should land both partners' UIDs in the one write"
+        );
+    }
+
+    /// A live row whose last writer flush was `age` seconds ago.
+    fn row_written_ago(age: u64) -> KvEntry {
+        let mut row = live_row(true);
+        row.wa = Some(current_timestamp().saturating_sub(age));
+        row
+    }
+
+    #[test]
+    fn spa_writer_waits_out_the_interval_since_the_last_write() {
+        let mut recent = Fixture::new(Some(&row_written_ago(10)), false);
+        recent.context.identity_mut().set_spa_writer(true);
+        recent.stage_sharedid();
+        assert_eq!(
+            recent.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Skipped,
+            "should not write within the interval"
+        );
+        assert_eq!(recent.store.writes().total(), 0, "should write nothing");
+
+        let mut unread = Fixture::new(None, false);
+        unread.context.identity_mut().set_spa_writer(true);
+        unread.stage_sharedid();
+        assert_eq!(
+            unread.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Skipped,
+            "should not read the row for an SPA writer whose auction did not"
+        );
+        assert_eq!(unread.store.writes().lookups, 0, "should read nothing");
+
+        let mut due = Fixture::new(Some(&row_written_ago(400)), false);
+        due.context.identity_mut().set_spa_writer(true);
+        due.stage_sharedid();
+        let before = current_timestamp();
+        assert_eq!(
+            due.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Written,
+            "should write once the interval has passed"
+        );
+        assert!(
+            due.row().wa.is_some_and(|at| at >= before),
+            "should store the time of this write"
+        );
+    }
+
+    #[test]
+    fn spa_writer_runs_no_hold_mode_provider() {
+        let hold = || {
+            let mut settings = Fixture::settings(true);
+            settings.ec.identity.providers.insert(
+                PULL_ID.to_owned(),
+                ProviderSettings {
+                    mode: ProviderMode::Hold,
+                    ..ProviderSettings::default()
+                },
+            );
+            settings
+        };
+        let mut spa = Fixture::with_settings(Some(&row_written_ago(400)), hold());
+        spa.context.identity_mut().set_spa_writer(true);
+        pull_answers(&spa, "pulled-uid");
+
+        spa.run(&ScriptedLimiter::allowing());
+
+        assert!(
+            spa.client.sent_hosts().is_empty(),
+            "should not call a hold-mode provider"
+        );
+
+        let mut after_send = Fixture::new(Some(&row_written_ago(400)), true);
+        after_send.context.identity_mut().set_spa_writer(true);
+        pull_answers(&after_send, "pulled-uid");
+        after_send.run(&ScriptedLimiter::allowing());
+        assert_eq!(
+            after_send.client.sent_hosts(),
+            [PULL_HOST],
+            "control: should call an after-send provider"
+        );
+    }
+
+    #[test]
+    fn hold_provider_on_a_navigation_without_an_auction_runs_in_phase_four() {
+        let mut settings = Fixture::settings(true);
+        settings.ec.identity.providers.insert(
+            PULL_ID.to_owned(),
+            ProviderSettings {
+                mode: ProviderMode::Hold,
+                ..ProviderSettings::default()
+            },
+        );
+        let mut fixture = Fixture::with_settings(Some(&live_row(true)), settings);
+        pull_answers(&fixture, "pulled-uid");
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the result");
+        assert_eq!(
+            fixture.client.sent_hosts(),
+            [PULL_HOST],
+            "should call the provider"
+        );
+    }
+
+    #[test]
+    fn cas_conflict_is_not_retried_as_a_whole() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), false);
+        fixture.stage_sharedid();
+        fixture.store.refuse_conditional_writes(TEST_EC_ID, 1);
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::WriteFailed {
+                removals: RemovalWriteOutcome::NothingToWrite
+            },
+            "should fail without a removal retry"
+        );
+        assert_eq!(
+            fixture.store.writes().if_generation_match,
+            1,
+            "should attempt the flush once"
+        );
+    }
+
+    /// A row holding `PULL_SOURCE`, and a mutation with a fill, a removal of
+    /// that record and an opt-out of the pull provider.
+    fn removal_fixture() -> (Fixture, u64) {
+        let mut row = live_row(true);
+        let record = record_for_test("old-uid", Some(PULL_ID), 900);
+        let expected = record_revision(&record);
+        row.ids.insert(PULL_SOURCE.to_owned(), record);
+        let mut fixture = Fixture::new(Some(&row), true);
+        fixture.stage_sharedid();
+        fixture.stage(PartnerIdChange::OwnerRemove {
+            source: source(PULL_SOURCE),
+            provider: pid(PULL_ID),
+            expected,
+        });
+        let at = current_timestamp();
+        fixture.context.identity_mut().mutation_mut().merge_state(
+            pid(PULL_ID),
+            ProviderStateChange {
+                opt_out: Some(KvOptOut {
+                    at,
+                    fp: "0".to_owned(),
+                }),
+                ..ProviderStateChange::default()
+            },
+        );
+        (fixture, at)
+    }
+
+    #[test]
+    fn failed_flush_writes_its_removals_alone() {
+        let (mut fixture, at) = removal_fixture();
+        fixture.store.refuse_conditional_writes(TEST_EC_ID, 1);
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::WriteFailed {
+                removals: RemovalWriteOutcome::Written
+            },
+            "should write the removals alone"
+        );
+        assert_eq!(
+            fixture.store.writes().if_generation_match,
+            2,
+            "should make one flush attempt and one removal write"
+        );
+        let row = fixture.row();
+        assert!(
+            !row.ids.contains_key(PULL_SOURCE),
+            "should apply the removal"
+        );
+        assert!(
+            !row.ids.contains_key("sharedid.org"),
+            "should drop the fill"
+        );
+        assert_eq!(
+            row.ps
+                .get(PULL_ID)
+                .and_then(|state| state.o.as_ref())
+                .map(|o| o.at),
+            Some(at),
+            "should store the opt-out"
+        );
+    }
+
+    #[test]
+    fn failed_flush_waits_the_per_key_window_before_its_removal_retry() {
+        let (mut fixture, _) = removal_fixture();
+        fixture.store.refuse_conditional_writes(TEST_EC_ID, 1);
+
+        fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            fixture.store.pauses(),
+            vec![PER_KEY_WRITE_WINDOW],
+            "should wait one per-key window after the failed flush"
+        );
+    }
+
+    #[test]
+    fn written_flush_never_waits() {
+        let (mut fixture, _) = removal_fixture();
+
+        fixture.run(&ScriptedLimiter::allowing());
+
+        assert!(
+            fixture.store.pauses().is_empty(),
+            "should not wait when the flush is written"
+        );
+    }
+
+    #[test]
+    fn a_removal_the_row_write_missed_goes_to_the_pending_key() {
+        let (mut fixture, _) = removal_fixture();
+        fixture
+            .store
+            .refuse_conditional_writes(TEST_EC_ID, usize::MAX);
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::WriteFailed {
+                removals: RemovalWriteOutcome::Failed
+            },
+            "should miss the row write"
+        );
+        assert_eq!(
+            fixture.context.identity().removal_lost(),
+            0,
+            "should lose nothing"
+        );
+        assert_eq!(
+            fixture.context.identity().removal_deferred(),
+            2,
+            "should defer the removal and the opt-out"
+        );
+        let merge = load_pending(&fixture.graph, TEST_EC_ID, 0).expect("should hold the item");
+        assert_eq!(
+            merge.mutation.removal_labels(),
+            vec![
+                (pid(PULL_ID), None),
+                (pid(PULL_ID), Some(source(PULL_SOURCE)))
+            ],
+            "should hold the request's removals only"
+        );
+    }
+
+    #[test]
+    fn the_next_writer_merges_the_pending_key_once() {
+        let mut row = live_row(true);
+        let record = record_for_test("old-uid", Some(PULL_ID), 900);
+        let expected = record_revision(&record);
+        row.ids.insert(PULL_SOURCE.to_owned(), record);
+        let mut fixture = Fixture::new(Some(&row), false);
+        let mut removal = IdentityMutation::default();
+        removal.add_change(PartnerIdChange::OwnerRemove {
+            source: source(PULL_SOURCE),
+            provider: pid(PULL_ID),
+            expected,
+        });
+        assert!(
+            append_pending(&fixture.graph, TEST_EC_ID, &removal, current_timestamp()),
+            "should seed the pending key"
+        );
+
+        fixture.store.reset_counts();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the merge");
+        assert_eq!(
+            fixture.store.writes().pending_lookups,
+            1,
+            "should read the pending key once"
+        );
+        let merged = fixture.row();
+        assert!(
+            !merged.ids.contains_key(PULL_SOURCE),
+            "should apply the pending removal"
+        );
+        let watermark = merged.pg.expect("should store the watermark");
+        assert!(
+            load_pending(&fixture.graph, TEST_EC_ID, watermark).is_none(),
+            "should cover every pending item"
+        );
+
+        fixture
+            .context
+            .set_kv_snapshot(fixture.graph.load_snapshot(TEST_EC_ID));
+        fixture.store.reset_counts();
+        let again = fixture.run(&ScriptedLimiter::allowing());
+        assert_eq!(again, FlushOutcome::Skipped, "should merge nothing twice");
+        assert_eq!(
+            fixture.store.writes().if_generation_match,
+            0,
+            "should write nothing twice"
+        );
+    }
+
+    #[test]
+    fn failed_removal_retry_counts_removal_lost() {
+        let (mut fixture, _) = removal_fixture();
+        fixture
+            .store
+            .refuse_conditional_writes(TEST_EC_ID, usize::MAX);
+        fixture.store.fail_all_writes(&pending_key(TEST_EC_ID));
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(
+            outcome,
+            FlushOutcome::WriteFailed {
+                removals: RemovalWriteOutcome::Failed
+            },
+            "should lose the removals"
+        );
+        assert_eq!(
+            fixture.store.writes().if_generation_match,
+            1 + 5,
+            "should make one flush attempt and five removal attempts"
+        );
+        assert_eq!(
+            fixture.context.identity().removal_lost(),
+            2,
+            "should count the removal and the opt-out"
+        );
+    }
+
+    #[test]
+    fn burst_capped_provider_gets_sixty_second_backoff_in_the_write() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&fixture, "pulled-uid");
+        let before = current_timestamp();
+
+        let outcome = fixture.run(&ScriptedLimiter::capped());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the backoff");
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should not call the provider"
+        );
+        let next = fixture
+            .row()
+            .ps
+            .get(PULL_ID)
+            .and_then(|state| state.n)
+            .expect("should store n");
+        assert!(
+            (before + 60..=current_timestamp() + 60).contains(&next),
+            "should wait one 60-second window"
+        );
+    }
+
+    #[test]
+    fn missing_cluster_size_is_added_to_the_one_write() {
+        let mut fixture = Fixture::new(Some(&live_row(false)), false);
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the size");
+        assert_eq!(fixture.store.writes().total(), 1, "should write once");
+        assert_eq!(
+            fixture
+                .row()
+                .network
+                .and_then(|network| network.cluster_size),
+            Some(1),
+            "should store the cluster size"
+        );
+    }
+
+    #[test]
+    fn untouched_entry_set_is_preserved_by_the_flush() {
+        let mut row = live_row(true);
+        let multi = full_record(Some("other"), example_entry_set());
+        row.ids.insert("multi.example.com".to_owned(), multi);
+        let mut fixture = Fixture::new(Some(&row), false);
+        let live = fixture
+            .graph
+            .get(TEST_EC_ID)
+            .expect("should read")
+            .expect("should hold the row")
+            .0;
+        fixture.store.reset_counts();
+        fixture.stage_sharedid();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the fill");
+        assert_eq!(
+            fixture.row().ids.get("multi.example.com"),
+            live.ids.get("multi.example.com"),
+            "should keep the untouched record field for field"
+        );
+    }
+
+    #[test]
+    fn generic_pull_runs_only_on_returning_writer() {
+        let mut stager = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&stager, "pulled-uid");
+        stager
+            .context
+            .identity_mut()
+            .set_writer_decision(WriterDecision {
+                writer: false,
+                is_real_browser: true,
+                user_agent: None,
+                dnt: false,
+                page_url: None,
+            });
+
+        assert_eq!(
+            stager.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Skipped,
+            "should skip a stager"
+        );
+        assert!(
+            stager.client.sent_hosts().is_empty(),
+            "should call no partner"
+        );
+    }
+
+    #[test]
+    fn new_visitor_reaches_pull_partners_from_second_page_load() {
+        let mut first = Fixture::new(None, true);
+        pull_answers(&first, "pulled-uid");
+        let snapshot = EcKvSnapshot::Present {
+            ec_id: TEST_EC_ID.to_owned(),
+            entry: Box::new(live_row(true)),
+            generation: None,
+        };
+        first
+            .context
+            .replace_with_generated(TEST_EC_ID.to_owned(), snapshot);
+
+        assert_eq!(
+            first.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Skipped,
+            "should run no provider on the first navigation"
+        );
+        assert!(
+            first.client.sent_hosts().is_empty(),
+            "should call no partner"
+        );
+
+        let mut second = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&second, "pulled-uid");
+        assert_eq!(
+            second.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Written,
+            "should pull on the second navigation"
+        );
+        assert_eq!(
+            second.client.sent_hosts(),
+            [PULL_HOST],
+            "should call the partner"
+        );
+    }
+
+    #[test]
+    fn failing_pull_partner_backs_off_through_ps() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        fixture.client.respond(PULL_HOST, 503, b"");
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should write the backoff");
+        let row = fixture.row();
+        let state = row.ps.get(PULL_ID).expect("should store provider state");
+        assert_eq!(state.f, 1, "should count the failure");
+        assert!(
+            state.n.is_some_and(|next| next > current_timestamp()),
+            "should push n into the future"
+        );
+
+        let mut again = Fixture::new(Some(&row), true);
+        again.client.respond(PULL_HOST, 503, b"");
+        assert_eq!(
+            again.run(&ScriptedLimiter::allowing()),
+            FlushOutcome::Skipped,
+            "should not retry the partner before n"
+        );
+        assert!(
+            again.client.sent_hosts().is_empty(),
+            "should call no partner"
+        );
+    }
+
+    #[test]
+    fn rate_limit_key_is_per_visitor_not_per_ip() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&fixture, "pulled-uid");
+        let limiter = ScriptedLimiter::allowing();
+
+        let _ = fixture.run(&limiter);
+
+        let expected = format!(
+            "identity:{PULL_ID}:{}",
+            visitor_key(fixture.runtime.keys(), TEST_EC_ID)
+        );
+        assert_eq!(*limiter.keys.borrow(), [expected], "should key by visitor");
+    }
+
+    #[test]
+    fn eid_persistence_denied_dispatches_no_pull_partner() {
+        let mut fixture = Fixture::new(Some(&live_row(true)), true);
+        pull_answers(&fixture, "pulled-uid");
+        *fixture.context.consent_mut() = crate::test_support::tests::purpose_one_only_consent();
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Skipped, "should have nothing to do");
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should call no partner"
+        );
+    }
+
+    #[test]
+    fn pull_partner_with_a_stored_uid_is_not_called() {
+        let mut row = live_row(true);
+        row.ids
+            .insert(PULL_SOURCE.to_owned(), KvPartnerId::new("already-known"));
+        let mut fixture = Fixture::new(Some(&row), true);
+        pull_answers(&fixture, "pulled-uid");
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Skipped, "should have nothing to do");
+        assert!(
+            fixture.client.sent_hosts().is_empty(),
+            "should call no partner"
+        );
+        assert_eq!(fixture.store.writes().lookups, 0, "should not re-read");
+    }
+
+    #[test]
+    fn regrant_clear_empties_ov() {
+        let held = "browser-held-uid";
+        let mut row = live_row(true);
+        row.ps.insert(
+            PULL_ID.to_owned(),
+            KvProviderState {
+                o: Some(KvOptOut {
+                    at: 1_000,
+                    fp: "800".to_owned(),
+                }),
+                ov: vec![uid_hash(held)],
+                ..KvProviderState::default()
+            },
+        );
+        let browser = Eid {
+            source: PULL_SOURCE.to_owned(),
+            uids: vec![Uid {
+                id: held.to_owned(),
+                atype: Some(1),
+                ext: None,
+            }],
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        };
+        let mut fixture = Fixture::new(Some(&row), true);
+        let before = denials(&row, fixture.runtime.catalog());
+        let mut consent = allowing_consent();
+        consent.gpp = Some(GppConsent {
+            version: 1,
+            section_ids: vec![7],
+            eu_tcf: None,
+            us_sale_opt_out: Some(false),
+            us_sharing_opt_out: None,
+            us_targeted_advertising_opt_out: None,
+            us_gpc: None,
+            us_known_child: None,
+            us_privacy_section: None,
+            us_section_decode_failed: false,
+        });
+        *fixture.context.consent_mut() = consent;
+
+        let outcome = fixture.run(&ScriptedLimiter::allowing());
+
+        assert_eq!(outcome, FlushOutcome::Written, "should flush the clear");
+        assert_eq!(
+            fixture.store.writes().if_generation_match,
+            1,
+            "should ride the one write"
+        );
+        let stored = fixture.row();
+        let state = stored
+            .ps
+            .get(PULL_ID)
+            .expect("should keep the provider state");
+        assert_eq!(
+            state.oc,
+            Some(1_000),
+            "should store the clear with the opt-out it read as its watermark"
+        );
+        assert!(state.ov.is_empty(), "should empty ps.ov");
+        assert!(
+            filter_browser_candidates(core::slice::from_ref(&browser), &before).is_empty(),
+            "control: before the clear the browser UID should be denied"
+        );
+        let after = denials(&stored, fixture.runtime.catalog());
+        assert_eq!(
+            filter_browser_candidates(core::slice::from_ref(&browser), &after),
+            vec![browser],
+            "should send the browser UID again after the clear"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/generic_pull.rs b/crates/trusted-server-core/src/ec/identity/generic_pull.rs
new file mode 100644
index 0000000000..9c34b05ba7
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/generic_pull.rs
@@ -0,0 +1,565 @@
+//! Today's pull sync, modelled as an identity provider.
+//!
+//! A pull-enabled `[[ec.partners]]` entry becomes one [`GenericPullProvider`]:
+//! a `GET` of the partner's `pull_sync_url` with the EC ID, answered with one
+//! UID. The coordinator owns eligibility, pacing, consent and write-back.
+
+use error_stack::{Report, ResultExt as _};
+use serde::Deserialize;
+use sha2::{Digest as _, Sha256};
+use url::Url;
+
+use super::descriptor::{ConsentPolicy, ProviderDescriptor, Resolves};
+use super::exchange::{ProviderRequest, ProviderResponse};
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::input::ResolveInput;
+use super::provider::IdentityProvider;
+use super::resolution::{IdentityProviderError, Resolution, ResolvedEid, ResolvedUid};
+use crate::ec::partner::normalize_partner_source_domain;
+use crate::ec::prebid_eids::is_valid_eid_uid;
+use crate::ec::pull_sync::{build_pull_request_url, validated_pull_sync_url};
+use crate::error::TrustedServerError;
+use crate::redacted::Redacted;
+use crate::settings::EcPartner;
+
+/// Longest provider ID, from `^[a-z][a-z0-9_-]{0,62}$`.
+const MAX_PROVIDER_ID_LENGTH: usize = 63;
+
+/// Readable characters kept when the ID is cut, leaving room for `-` and the
+/// 8 hash characters.
+const CUT_READABLE_LENGTH: usize = MAX_PROVIDER_ID_LENGTH - 9;
+
+/// Derives the provider ID of the pull partner with `source_domain`.
+///
+/// It is `pull-` plus the normalized domain with `.` replaced by `-`. A
+/// domain that already contains `-` also gets `-` and the first 8 hex digits
+/// of the SHA-256 of the domain, so `a-b.example.com` and `a.b.example.com`
+/// differ. An ID over 63 characters is cut to 54 readable characters, then
+/// `-` and the hash.
+#[must_use]
+pub(crate) fn generic_pull_id(source_domain: &str) -> IdentityProviderId {
+    let domain = normalize_partner_source_domain(source_domain)
+        .unwrap_or_else(|_| source_domain.to_ascii_lowercase());
+    let readable: String = format!("pull-{domain}")
+        .chars()
+        .map(|character| {
+            if character.is_ascii_lowercase() || character.is_ascii_digit() || character == '-' {
+                character
+            } else {
+                '-'
+            }
+        })
+        .collect();
+    let digest = Sha256::digest(domain.as_bytes());
+    let hash = hex::encode(&digest[..4]);
+
+    let id = if domain.contains('-') {
+        format!("{readable}-{hash}")
+    } else {
+        readable.clone()
+    };
+    let id = if id.len() > MAX_PROVIDER_ID_LENGTH {
+        format!("{}-{hash}", &readable[..CUT_READABLE_LENGTH])
+    } else {
+        id
+    };
+    id.parse()
+        .expect("should derive a valid provider ID from a normalized domain")
+}
+
+/// The descriptors of every pull-enabled partner.
+///
+/// Reads no secret, so it works on unresolved deploy-time settings.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::Configuration`] when a pull-enabled partner
+/// cannot be described, for example a `pull_sync_allowed_domains` entry that
+/// is not a hostname.
+pub(crate) fn generic_pull_descriptors(
+    partners: &[EcPartner],
+) -> Result<Vec<ProviderDescriptor>, Report<TrustedServerError>> {
+    partners
+        .iter()
+        .filter(|partner| partner.pull_sync_enabled)
+        .map(|partner| {
+            describe(partner).change_context(TrustedServerError::Configuration {
+                message: format!(
+                    "ec.partners: pull sync of '{}' cannot be described as an identity provider",
+                    partner.source_domain
+                ),
+            })
+        })
+        .collect()
+}
+
+fn describe(partner: &EcPartner) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+    let mut resolves = Resolves::new().with_ec_id();
+    for host in &partner.pull_sync_allowed_domains {
+        resolves = resolves.with_host(&host.trim().trim_end_matches('.').to_ascii_lowercase());
+    }
+    let source: SourceDomain = partner.source_domain.parse()?;
+    ProviderDescriptor::builder(generic_pull_id(&partner.source_domain))
+        .with_source(source)
+        .with_resolves(resolves)
+        .with_consent_policy(ConsentPolicy::eid_persistence_only())
+        .build()
+}
+
+/// The answer a pull partner gives.
+#[derive(Debug, Deserialize)]
+struct PullAnswer {
+    uid: Option<String>,
+}
+
+/// One pull-enabled partner, called as an identity provider.
+pub(crate) struct GenericPullProvider {
+    descriptor: ProviderDescriptor,
+    source: SourceDomain,
+    pull_sync_url: Option<String>,
+    allowed_domains: Vec<String>,
+    token: Option<Redacted<String>>,
+}
+
+impl GenericPullProvider {
+    /// Builds the provider of `partner`.
+    ///
+    /// The descriptor reads only `source_domain`, `pull_sync_url` and
+    /// `pull_sync_allowed_domains`, which are not secret, so this works on
+    /// unresolved deploy-time settings. The token is kept for
+    /// [`request`](IdentityProvider::request) only.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the partner cannot be
+    /// described.
+    pub(crate) fn from_partner(partner: &EcPartner) -> Result<Self, Report<IdentityProviderError>> {
+        let descriptor = describe(partner)?;
+        let source = descriptor.primary_source().clone();
+        Ok(Self {
+            descriptor,
+            source,
+            pull_sync_url: partner.pull_sync_url.clone(),
+            allowed_domains: partner.pull_sync_allowed_domains.clone(),
+            token: partner.ts_pull_token.clone(),
+        })
+    }
+}
+
+impl IdentityProvider for GenericPullProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let Some(mut url) =
+            validated_pull_sync_url(self.pull_sync_url.as_deref(), &self.allowed_domains)
+        else {
+            return Ok(None);
+        };
+        let Some(token) = self
+            .token
+            .as_ref()
+            .filter(|token| !token.expose().trim().is_empty())
+        else {
+            log::warn!(
+                "Pull sync: partner '{}' enabled but missing ts_pull_token",
+                self.source
+            );
+            return Ok(None);
+        };
+
+        // The allowlist match ignores a trailing dot, and the descriptor's
+        // hosts carry none, so call the dotless spelling.
+        let host = url
+            .host_str()
+            .unwrap_or_default()
+            .trim_end_matches('.')
+            .to_owned();
+        if url.host_str() != Some(host.as_str()) && url.set_host(Some(&host)).is_err() {
+            return Ok(None);
+        }
+        let url: Url = build_pull_request_url(url, input.ec_id()?);
+        Ok(Some(ProviderRequest::get(&url).with_bearer(token)))
+    }
+
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        _input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        // A 404 is the partner's "no user" answer, as pull sync treats it.
+        if response.status() == http::StatusCode::NOT_FOUND {
+            return Ok(Resolution::no_match());
+        }
+        let answer: PullAnswer = response.success_json()?;
+        match answer.uid {
+            Some(uid) if is_valid_eid_uid(&uid) => Ok(Resolution::found([ResolvedEid::new(
+                &self.source,
+                ResolvedUid::new(uid),
+            )])),
+            _ => Ok(Resolution::no_match()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use http::StatusCode;
+    use serde_json::json;
+
+    use super::*;
+    use crate::ec::identity::test_support::{ProviderHarness, TEST_EC_ID, ec_partner};
+    use crate::settings::{ProviderSettings, Settings};
+    use crate::test_support::tests::create_test_settings;
+
+    const TOKEN: &str = "example-token-value-0123456789abcdef";
+
+    fn partner() -> crate::settings::EcPartner {
+        ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            TOKEN,
+        )
+    }
+
+    #[test]
+    fn calls_the_partner_url_with_the_ec_id_and_bearer() {
+        let provider = GenericPullProvider::from_partner(&partner()).expect("should build");
+        let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+
+        let request = harness
+            .request()
+            .expect("should build")
+            .expect("should not skip");
+
+        assert_eq!(
+            request.url().host_str(),
+            Some("sync.ssp.example.com"),
+            "should call the partner host"
+        );
+        assert_eq!(
+            request
+                .url()
+                .query_pairs()
+                .find(|(name, _)| name == "ec_id")
+                .map(|(_, value)| value.into_owned()),
+            Some(TEST_EC_ID.to_owned()),
+            "should pass the EC ID"
+        );
+        assert_eq!(
+            request.headers()["authorization"],
+            format!("Bearer {TOKEN}"),
+            "should send the bearer token"
+        );
+        assert_eq!(request.method(), http::Method::GET, "should use GET");
+
+        let resolution = harness
+            .respond(StatusCode::OK, &json!({ "uid": "partner-uid" }))
+            .expect("should parse the answer");
+        assert_eq!(resolution.eids().len(), 1, "should return one entry");
+        let eid = &resolution.eids()[0];
+        assert_eq!(
+            eid.source().as_str(),
+            "ssp.example.com",
+            "should name the source"
+        );
+        assert_eq!(eid.uids().len(), 1, "should return one UID");
+        assert_eq!(
+            eid.uids()[0].id(),
+            "partner-uid",
+            "should return the partner's UID"
+        );
+        assert_eq!(
+            (
+                eid.uids()[0].atype(),
+                eid.uids()[0].ext(),
+                eid.inserter(),
+                eid.matcher(),
+                eid.mm(),
+                eid.ext()
+            ),
+            (None, None, None, None, None, None),
+            "should set nothing beyond the UID, so it is stored as one entry with one UID"
+        );
+    }
+
+    #[test]
+    fn keeps_the_query_the_partner_url_already_has() {
+        let partner = ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull?x=1",
+            TOKEN,
+        );
+        let provider = GenericPullProvider::from_partner(&partner).expect("should build");
+        let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+
+        let request = harness
+            .request()
+            .expect("should build")
+            .expect("should not skip");
+
+        let query = request.url().query().expect("should have a query");
+        assert!(query.contains("x=1"), "should keep the existing query");
+        assert!(query.contains("ec_id="), "should append the EC ID");
+        assert!(!query.contains("ip="), "should not forward the client IP");
+    }
+
+    #[test]
+    fn not_found_and_null_uid_are_no_match_as_today() {
+        let provider = GenericPullProvider::from_partner(&partner()).expect("should build");
+        let oversized = "x".repeat(513);
+        for (name, status, body) in [
+            ("404", StatusCode::NOT_FOUND, json!({})),
+            (
+                "404 with a body",
+                StatusCode::NOT_FOUND,
+                json!({ "uid": "u" }),
+            ),
+            ("null uid", StatusCode::OK, json!({ "uid": null })),
+            ("missing uid", StatusCode::OK, json!({})),
+            ("empty uid", StatusCode::OK, json!({ "uid": "" })),
+            ("blank uid", StatusCode::OK, json!({ "uid": "  " })),
+            ("oversized uid", StatusCode::OK, json!({ "uid": oversized })),
+        ] {
+            let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+            harness
+                .request()
+                .expect("should build")
+                .expect("should not skip");
+            let resolution = harness
+                .respond(status, &body)
+                .expect("should not be an error");
+            assert!(resolution.is_no_match(), "should be no_match for {name}");
+        }
+    }
+
+    #[test]
+    fn a_uid_at_the_size_limit_is_kept() {
+        let provider = GenericPullProvider::from_partner(&partner()).expect("should build");
+        let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+        harness
+            .request()
+            .expect("should build")
+            .expect("should not skip");
+
+        let resolution = harness
+            .respond(StatusCode::OK, &json!({ "uid": "x".repeat(512) }))
+            .expect("should parse");
+
+        assert_eq!(
+            resolution.eids()[0].uids()[0].id().len(),
+            512,
+            "should keep a UID of MAX_UID_LENGTH"
+        );
+    }
+
+    #[test]
+    fn other_failures_are_errors_not_no_match() {
+        let provider = GenericPullProvider::from_partner(&partner()).expect("should build");
+        let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+        harness
+            .request()
+            .expect("should build")
+            .expect("should not skip");
+
+        let rejected = harness
+            .respond(StatusCode::INTERNAL_SERVER_ERROR, &json!({}))
+            .expect_err("should reject a 500");
+        assert!(
+            matches!(
+                rejected.current_context(),
+                IdentityProviderError::Rejected { status } if *status == StatusCode::INTERNAL_SERVER_ERROR
+            ),
+            "should report Rejected"
+        );
+        let malformed = harness
+            .respond_raw(StatusCode::OK, &[], b"not json")
+            .expect_err("should reject a body that is not JSON");
+        assert!(
+            matches!(
+                malformed.current_context(),
+                IdentityProviderError::Malformed
+            ),
+            "should report Malformed"
+        );
+    }
+
+    #[test]
+    fn skips_without_a_valid_url_or_token() {
+        let mut http_url = partner();
+        http_url.pull_sync_url = Some("http://sync.ssp.example.com/pull".to_owned());
+        let mut other_host = partner();
+        other_host.pull_sync_url = Some("https://evil.example.net/pull".to_owned());
+        let mut no_url = partner();
+        no_url.pull_sync_url = None;
+        let mut no_token = partner();
+        no_token.ts_pull_token = None;
+
+        for (name, partner) in [
+            ("http scheme", http_url),
+            ("host outside the allowlist", other_host),
+            ("no URL", no_url),
+            ("no token", no_token),
+        ] {
+            let provider = GenericPullProvider::from_partner(&partner).expect("should build");
+            let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+
+            let request = harness.request().expect("should not be an error");
+
+            assert!(request.is_none(), "should skip for {name}");
+        }
+    }
+
+    #[test]
+    fn accepts_an_allowlist_match_after_normalization() {
+        let mut partner = partner();
+        partner.pull_sync_url = Some("https://SYNC.SSP.EXAMPLE.COM./pull".to_owned());
+        partner.pull_sync_allowed_domains = vec!["Sync.Ssp.Example.Com.".to_owned()];
+        let provider = GenericPullProvider::from_partner(&partner).expect("should build");
+        let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+
+        let request = harness.request().expect("should build");
+
+        assert!(request.is_some(), "should call a host the allowlist names");
+    }
+
+    #[test]
+    fn a_stored_record_makes_the_source_a_refresh_and_the_call_still_goes_out() {
+        let provider = GenericPullProvider::from_partner(&partner()).expect("should build");
+        let source = provider.descriptor().primary_source().clone();
+        let stored = crate::ec::identity::test_support::stored_for_test(&source, "stored-uid");
+        let mut harness = ProviderHarness::new(&provider)
+            .with_ec_id(TEST_EC_ID)
+            .with_stored(stored);
+
+        let request = harness.request().expect("should build");
+
+        assert!(request.is_some(), "should refresh a stored source");
+    }
+
+    #[test]
+    fn the_descriptor_reads_no_secret() {
+        let mut partner = partner();
+        partner.ts_pull_token = Some(crate::redacted::Redacted::new("secret-key-name".to_owned()));
+        let with_key_name = GenericPullProvider::from_partner(&partner).expect("should build");
+        let with_token = GenericPullProvider::from_partner(&self::partner()).expect("should build");
+
+        assert_eq!(
+            with_key_name.descriptor(),
+            with_token.descriptor(),
+            "should describe the same provider whatever the token holds"
+        );
+        let descriptor = with_token.descriptor();
+        assert_eq!(
+            descriptor.id().as_str(),
+            "pull-ssp-example-com",
+            "should derive the ID"
+        );
+        assert_eq!(descriptor.sources().len(), 1, "should claim one source");
+        assert_eq!(
+            descriptor.primary_source().as_str(),
+            "ssp.example.com",
+            "should claim the partner's source domain"
+        );
+        let resolves = descriptor.resolves().expect("should resolve");
+        assert_eq!(
+            resolves.hosts(),
+            ["sync.ssp.example.com".to_owned()],
+            "should allow only the allowlisted hosts"
+        );
+        assert!(resolves.gets_ec_id(), "should get the EC ID");
+        assert!(descriptor.captures().is_none(), "should not capture");
+        assert!(
+            descriptor.consent_policy().is_eid_persistence_only(),
+            "should require the EID persistence consent pull sync requires today"
+        );
+    }
+
+    #[test]
+    fn descriptors_cover_only_pull_enabled_partners() {
+        let mut disabled = ec_partner("off.example.com", "https://sync.off.example.com/p", TOKEN);
+        disabled.pull_sync_enabled = false;
+        let partners = [partner(), disabled];
+
+        let descriptors = generic_pull_descriptors(&partners).expect("should build");
+
+        assert_eq!(
+            descriptors.len(),
+            1,
+            "should skip a partner without pull sync"
+        );
+        assert_eq!(
+            descriptors[0].id().as_str(),
+            "pull-ssp-example-com",
+            "should describe the pull-enabled partner"
+        );
+    }
+
+    #[test]
+    fn provider_ids_are_derived_and_bounded() {
+        assert_eq!(
+            generic_pull_id("ssp.example.com").as_str(),
+            "pull-ssp-example-com",
+            "should keep a dot-only domain readable"
+        );
+        let long = format!("{}.example.com", "a".repeat(70));
+        let id = generic_pull_id(&long);
+        assert!(
+            id.as_str().len() <= 63,
+            "should bound the ID to 63 characters"
+        );
+        assert_ne!(
+            id,
+            generic_pull_id(&format!("{}.example.com", "a".repeat(71))),
+            "should keep long IDs unique by hash"
+        );
+        assert_ne!(
+            generic_pull_id("a-b.example.com"),
+            generic_pull_id("a.b.example.com"),
+            "should not collide when a domain already contains a hyphen"
+        );
+        assert_eq!(
+            generic_pull_id("SSP.Example.Com."),
+            generic_pull_id("ssp.example.com"),
+            "should derive the ID from the normalized domain"
+        );
+        let hyphenated_long = format!("{}-b.example.com", "a".repeat(70));
+        assert!(
+            generic_pull_id(&hyphenated_long).as_str().len() <= 63,
+            "should bound a long hyphenated domain too"
+        );
+    }
+
+    #[test]
+    fn generic_pull_pacing_comes_from_its_provider_table() {
+        let mut settings: Settings = create_test_settings();
+        let id = generic_pull_id("ssp.example.com");
+
+        let defaults = settings.ec.identity.provider(&id);
+        assert_eq!(
+            defaults.refresh_after_sec, 86_400,
+            "should default the refresh"
+        );
+        assert_eq!(
+            defaults.max_calls_per_minute, 1,
+            "should default the pacing"
+        );
+
+        settings.ec.identity.providers.insert(
+            id.as_str().to_owned(),
+            ProviderSettings {
+                max_calls_per_minute: 2,
+                ..ProviderSettings::default()
+            },
+        );
+        let configured = settings.ec.identity.provider(&id);
+        assert_eq!(
+            configured.max_calls_per_minute, 2,
+            "should read the pacing from the pull provider's table"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/ids.rs b/crates/trusted-server-core/src/ec/identity/ids.rs
new file mode 100644
index 0000000000..1f7bd921b6
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/ids.rs
@@ -0,0 +1,224 @@
+//! Identifiers shared by the identity provider API.
+
+use core::ops::Add;
+use core::str::FromStr;
+use std::time::Duration;
+
+use error_stack::Report;
+use serde::{Deserialize, Serialize};
+
+use super::resolution::IdentityProviderError;
+use crate::ec::partner::normalize_partner_source_domain;
+
+/// An identity provider's ID, such as `id5` or `pull-ssp-example-com`.
+///
+/// Matches `^[a-z][a-z0-9_-]{0,62}$`, so it can be a bare TOML key and can
+/// equal an integration ID that uses `_`. Separate from
+/// [`crate::auction::ProviderId`].
+#[derive(
+    Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display, Serialize, Deserialize,
+)]
+#[serde(try_from = "String", into = "String")]
+pub struct IdentityProviderId(String);
+
+impl IdentityProviderId {
+    /// The ID as written in config.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl FromStr for IdentityProviderId {
+    type Err = Report<IdentityProviderError>;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let mut bytes = value.bytes();
+        let valid_first = bytes.next().is_some_and(|byte| byte.is_ascii_lowercase());
+        let valid_rest = bytes.all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'_' || byte == b'-'
+        });
+        if valid_first && valid_rest && value.len() <= 63 {
+            Ok(Self(value.to_owned()))
+        } else {
+            Err(IdentityProviderError::config(format!(
+                "identity provider id `{value}` must match ^[a-z][a-z0-9_-]{{0,62}}$"
+            )))
+        }
+    }
+}
+
+impl TryFrom<String> for IdentityProviderId {
+    type Error = Report<IdentityProviderError>;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+
+impl From<IdentityProviderId> for String {
+    fn from(id: IdentityProviderId) -> Self {
+        id.0
+    }
+}
+
+/// An EID `source` domain, normalized. Also the key of the KV `ids` map.
+#[derive(
+    Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display, Serialize, Deserialize,
+)]
+#[serde(try_from = "String", into = "String")]
+pub struct SourceDomain(String);
+
+impl SourceDomain {
+    /// The normalized domain.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    /// Whether a vendor's spelling of a source names this one, after
+    /// normalization.
+    #[must_use]
+    pub fn matches(&self, name: &str) -> bool {
+        normalize_partner_source_domain(name).is_ok_and(|normalized| normalized == self.0)
+    }
+}
+
+impl FromStr for SourceDomain {
+    type Err = Report<IdentityProviderError>;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        normalize_partner_source_domain(value)
+            .map(Self)
+            .map_err(IdentityProviderError::config)
+    }
+}
+
+impl TryFrom<String> for SourceDomain {
+    type Error = Report<IdentityProviderError>;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+
+impl From<SourceDomain> for String {
+    fn from(source: SourceDomain) -> Self {
+        source.0
+    }
+}
+
+/// Unix seconds.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub struct UnixTime(u64);
+
+impl UnixTime {
+    /// From Unix seconds.
+    #[must_use]
+    pub fn from_secs(secs: u64) -> Self {
+        Self(secs)
+    }
+
+    /// From Unix milliseconds, for vendors such as Lockr and `UID2`. Floors to
+    /// whole seconds.
+    #[must_use]
+    pub fn from_millis(millis: u64) -> Self {
+        Self(millis / 1000)
+    }
+
+    /// As Unix seconds.
+    #[must_use]
+    pub fn as_secs(self) -> u64 {
+        self.0
+    }
+}
+
+impl Add<Duration> for UnixTime {
+    type Output = UnixTime;
+
+    fn add(self, rhs: Duration) -> UnixTime {
+        UnixTime(self.0.saturating_add(rhs.as_secs()))
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn provider_id_accepts_the_documented_grammar() {
+        for id in ["id5", "pull-ssp-example-com", "lockr_aim", "a"] {
+            assert!(
+                id.parse::<IdentityProviderId>().is_ok(),
+                "should accept `{id}`"
+            );
+        }
+        let longest = format!("a{}", "b".repeat(62));
+        longest
+            .parse::<IdentityProviderId>()
+            .expect("should accept 63 characters");
+    }
+
+    #[test]
+    fn provider_id_rejects_everything_else() {
+        let too_long = format!("a{}", "b".repeat(63));
+        for id in ["", "1id", "Id5", "id 5", "id.5", too_long.as_str()] {
+            let error = id
+                .parse::<IdentityProviderId>()
+                .expect_err("should reject the id");
+            assert!(
+                matches!(
+                    error.current_context(),
+                    IdentityProviderError::Config { .. }
+                ),
+                "should be a Config error for `{id}`"
+            );
+        }
+    }
+
+    #[test]
+    fn source_domain_normalizes_and_matches() {
+        let source: SourceDomain = "ID5-Sync.com.".parse().expect("should parse");
+        assert_eq!(
+            source.as_str(),
+            "id5-sync.com",
+            "should lower-case and drop the trailing dot"
+        );
+        assert!(
+            source.matches("id5-sync.COM"),
+            "should match another spelling"
+        );
+        assert!(
+            !source.matches("example.com"),
+            "should not match another domain"
+        );
+        assert!(
+            // The domain parser must reject URL syntax.
+            !source.matches("https://id5-sync.com"), // allow-domain: id5-sync.com
+            "should not match a URL"
+        );
+    }
+
+    #[test]
+    fn source_domain_round_trips_through_serde() {
+        let source: SourceDomain = "example.com".parse().expect("should parse");
+        let json = serde_json::to_string(&source).expect("should serialize");
+        assert_eq!(json, "\"example.com\"", "should serialize as a bare string");
+        let back: SourceDomain = serde_json::from_str(&json).expect("should deserialize");
+        assert_eq!(back, source, "should round-trip");
+        serde_json::from_str::<SourceDomain>("\"not a domain\"")
+            .expect_err("should reject an invalid domain on deserialize");
+    }
+
+    #[test]
+    fn unix_time_converts_millis_and_adds_durations() {
+        assert_eq!(
+            UnixTime::from_millis(1_760_000_000_999).as_secs(),
+            1_760_000_000,
+            "should floor millis"
+        );
+        let later = UnixTime::from_secs(100) + Duration::from_secs(50);
+        assert_eq!(later, UnixTime::from_secs(150), "should add seconds");
+        let saturated = UnixTime::from_secs(u64::MAX) + Duration::from_secs(1);
+        assert_eq!(saturated, UnixTime::from_secs(u64::MAX), "should saturate");
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/input.rs b/crates/trusted-server-core/src/ec/identity/input.rs
new file mode 100644
index 0000000000..ef64652df4
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/input.rs
@@ -0,0 +1,1246 @@
+//! What a provider may read for one call.
+
+use core::cell::RefCell;
+use core::fmt;
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::IpAddr;
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD;
+use error_stack::Report;
+use rand::RngCore as _;
+use serde::de::DeserializeOwned;
+use url::Url;
+
+use super::descriptor::{Access, Input, ProviderDescriptor, ResolveKind, Resolves};
+use super::exchange::ProviderResponse;
+use super::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use super::resolution::IdentityProviderError;
+use crate::consent::ConsentContext;
+use crate::ec::kv_types::KvPartnerId;
+use crate::openrtb::{Eid, Uid};
+
+/// The raw consent strings a provider forwards, and `gdpr_applies`.
+///
+/// Providers never decide consent. The coordinator has already applied the
+/// descriptor's policy.
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct ProviderConsent {
+    gdpr_applies: bool,
+    tc_string: Option<String>,
+    gpp_string: Option<String>,
+    gpp_section_ids: Option<Vec<u16>>,
+    us_privacy: Option<String>,
+}
+
+impl fmt::Debug for ProviderConsent {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderConsent")
+            .field("gdpr_applies", &self.gdpr_applies)
+            .field("tc_string", &self.tc_string.as_ref().map(|_| "[redacted]"))
+            .field(
+                "gpp_string",
+                &self.gpp_string.as_ref().map(|_| "[redacted]"),
+            )
+            .field("gpp_section_ids", &self.gpp_section_ids)
+            .field(
+                "us_privacy",
+                &self.us_privacy.as_ref().map(|_| "[redacted]"),
+            )
+            .finish()
+    }
+}
+
+impl ProviderConsent {
+    /// The view of a request's consent context.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn from_context(context: &ConsentContext) -> Self {
+        Self {
+            gdpr_applies: context.gdpr_applies,
+            tc_string: context.raw_tc_string.clone(),
+            gpp_string: context.raw_gpp_string.clone(),
+            gpp_section_ids: context.gpp_section_ids.clone(),
+            us_privacy: context.raw_us_privacy.clone(),
+        }
+    }
+
+    /// Whether GDPR applies to this request.
+    #[must_use]
+    pub fn gdpr_applies(&self) -> bool {
+        self.gdpr_applies
+    }
+
+    /// The raw TCF string.
+    #[must_use]
+    pub fn raw_tc_string(&self) -> Option<&str> {
+        self.tc_string.as_deref()
+    }
+
+    /// The raw GPP string.
+    #[must_use]
+    pub fn raw_gpp_string(&self) -> Option<&str> {
+        self.gpp_string.as_deref()
+    }
+
+    /// The applicable GPP section IDs.
+    #[must_use]
+    pub fn gpp_section_ids(&self) -> Option<&[u16]> {
+        self.gpp_section_ids.as_deref()
+    }
+
+    /// The raw US Privacy string.
+    #[must_use]
+    pub fn raw_us_privacy(&self) -> Option<&str> {
+        self.us_privacy.as_deref()
+    }
+}
+
+/// Country and subdivision, upper case.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Region {
+    country: String,
+    subdivision: Option<String>,
+}
+
+impl Region {
+    /// Normalizes platform geo: upper case, and an ISO 3166-2 `US-CA` style
+    /// region loses its country prefix. `None` without a two-letter country.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn from_geo(country: &str, region: Option<&str>) -> Option<Self> {
+        let country = country.trim().to_ascii_uppercase();
+        if country.len() != 2 || !country.bytes().all(|byte| byte.is_ascii_alphabetic()) {
+            return None;
+        }
+        let subdivision = region
+            .map(|value| value.trim().to_ascii_uppercase())
+            .map(|value| match value.split_once('-') {
+                Some((prefix, rest)) if prefix == country => rest.to_owned(),
+                _ => value,
+            })
+            .filter(|value| {
+                !value.is_empty() && value.bytes().all(|byte| byte.is_ascii_alphanumeric())
+            });
+        Some(Self {
+            country,
+            subdivision,
+        })
+    }
+
+    /// ISO 3166-1 alpha-2, upper case, for example `"US"`.
+    #[must_use]
+    pub fn country(&self) -> &str {
+        &self.country
+    }
+
+    /// The ISO 3166-2 subdivision without the country prefix, for example
+    /// `"CA"`. `None` when the platform does not know it.
+    #[must_use]
+    pub fn subdivision(&self) -> Option<&str> {
+        self.subdivision.as_deref()
+    }
+
+    /// Whether this is `country` and `subdivision`.
+    #[must_use]
+    pub fn is(&self, country: &str, subdivision: &str) -> bool {
+        self.country == country && self.subdivision.as_deref() == Some(subdivision)
+    }
+}
+
+/// The 32 raw bytes of a SHA-256 of a normalized email. Personal data.
+#[derive(Clone, PartialEq, Eq)]
+pub struct HashedEmail([u8; 32]);
+
+impl fmt::Debug for HashedEmail {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("HashedEmail([redacted])")
+    }
+}
+
+impl HashedEmail {
+    /// From digest bytes. Test support only: v1 has no source of hashed
+    /// emails, so nothing else builds one.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn from_bytes(bytes: [u8; 32]) -> Self {
+        Self(bytes)
+    }
+
+    /// From the SHA-256 digest of a normalized address. Test support only,
+    /// and the one constructor over [`Self::from_bytes`].
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn for_test(bytes: [u8; 32]) -> Self {
+        Self::from_bytes(bytes)
+    }
+
+    /// The digest.
+    #[must_use]
+    pub fn as_bytes(&self) -> &[u8; 32] {
+        &self.0
+    }
+
+    /// Lowercase hex, as `LiveRamp` takes it.
+    #[must_use]
+    pub fn to_hex(&self) -> String {
+        hex::encode(self.0)
+    }
+
+    /// Standard base64, as `UID2` takes it.
+    #[must_use]
+    pub fn to_base64(&self) -> String {
+        STANDARD.encode(self.0)
+    }
+}
+
+/// A stored record for one of this provider's sources, valid or expired.
+///
+/// It holds the source's whole entry set, which is never empty.
+#[derive(Clone, PartialEq)]
+pub struct StoredId {
+    eids: Vec<Eid>,
+    uid: String,
+    writer: Option<IdentityProviderId>,
+    acquired_at: Option<UnixTime>,
+    expires_at: Option<UnixTime>,
+    refresh_at: Option<UnixTime>,
+}
+
+impl fmt::Debug for StoredId {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("StoredId")
+            .field("entries", &self.eids.len())
+            .field("uid", &"[redacted]")
+            .field("writer", &self.writer)
+            .field("acquired_at", &self.acquired_at)
+            .field("expires_at", &self.expires_at)
+            .field("refresh_at", &self.refresh_at)
+            .finish_non_exhaustive()
+    }
+}
+
+impl StoredId {
+    /// From the KV record of `source`. A writer that does not parse is
+    /// treated as none. `None` for a record with no entry, which
+    /// `KvEntry::validate` never lets through.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn from_record(source: &SourceDomain, record: &KvPartnerId) -> Option<Self> {
+        let uid = record.first_uid()?.to_owned();
+        let eids = record
+            .eids
+            .iter()
+            .map(|entry| Eid {
+                source: source.as_str().to_owned(),
+                uids: entry
+                    .uids
+                    .iter()
+                    .map(|uid| Uid {
+                        id: uid.id.clone(),
+                        atype: uid.atype,
+                        ext: uid.ext.clone(),
+                    })
+                    .collect(),
+                inserter: entry.inserter.clone(),
+                matcher: entry.matcher.clone(),
+                mm: entry.mm,
+                ext: entry.ext.clone(),
+            })
+            .collect();
+        Some(Self {
+            eids,
+            uid,
+            writer: record.w.as_deref().and_then(|writer| writer.parse().ok()),
+            acquired_at: record.at.map(UnixTime::from_secs),
+            expires_at: record.exp.map(UnixTime::from_secs),
+            refresh_at: record.ra.map(UnixTime::from_secs),
+        })
+    }
+
+    fn first_uid(&self) -> Option<&Uid> {
+        self.eids.first().and_then(|eid| eid.uids.first())
+    }
+
+    /// A stored one-entry, one-UID record of `source`. Test support only.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `uid` is not a valid stored UID.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn for_test(source: &SourceDomain, uid: &str) -> Self {
+        Self::from_record(source, &KvPartnerId::new(uid))
+            .expect("should build a stored ID from a record with a UID")
+    }
+
+    /// Replaces the entry set with a full one, and `uid()` becomes its first
+    /// UID. Test support only, so a test can give a refreshing provider a
+    /// stored full set.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `eids` holds no UID.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn with_eids(mut self, eids: Vec<Eid>) -> Self {
+        self.uid = eids
+            .first()
+            .and_then(|eid| eid.uids.first())
+            .map(|uid| uid.id.clone())
+            .expect("should give the stored set at least one UID");
+        self.eids = eids;
+        self
+    }
+
+    /// Records `writer` as the provider that wrote it. Test support only.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn written_by(mut self, writer: &IdentityProviderId) -> Self {
+        self.writer = Some(writer.clone());
+        self
+    }
+
+    /// Sets the time it must stop being sent. Test support only.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn expiring_at(mut self, at: UnixTime) -> Self {
+        self.expires_at = Some(at);
+        self
+    }
+
+    /// Every stored entry for the source, in stored order, with its UIDs and
+    /// EID-level fields. A record that browser ingest, generic pull, batch
+    /// sync or a version 1 row wrote is one entry with one UID.
+    #[must_use]
+    pub fn eids(&self) -> &[Eid] {
+        &self.eids
+    }
+
+    /// The first UID of the first entry. What a single-UID refresh, such as
+    /// `LiveRamp`'s, sends back.
+    #[must_use]
+    pub fn uid(&self) -> &str {
+        &self.uid
+    }
+
+    /// The `atype` of that first UID.
+    #[must_use]
+    pub fn atype(&self) -> Option<i32> {
+        self.first_uid().and_then(|uid| uid.atype)
+    }
+
+    /// The UID-level ext of that first UID, as bidders read it in
+    /// `uids[].ext`.
+    #[must_use]
+    pub fn ext(&self) -> Option<&serde_json::Value> {
+        self.first_uid().and_then(|uid| uid.ext.as_ref())
+    }
+
+    /// The provider that wrote it. `None` for browser ingest and legacy rows.
+    #[must_use]
+    pub fn writer(&self) -> Option<&IdentityProviderId> {
+        self.writer.as_ref()
+    }
+
+    /// When it was acquired or last refreshed.
+    #[must_use]
+    pub fn acquired_at(&self) -> Option<UnixTime> {
+        self.acquired_at
+    }
+
+    /// When it must stop being sent.
+    #[must_use]
+    pub fn expires_at(&self) -> Option<UnixTime> {
+        self.expires_at
+    }
+
+    /// When it is due for refresh.
+    #[must_use]
+    pub fn refresh_at(&self) -> Option<UnixTime> {
+        self.refresh_at
+    }
+
+    /// Whether `now` is at or past its expiry.
+    #[must_use]
+    pub fn is_expired(&self, now: UnixTime) -> bool {
+        self.expires_at.is_some_and(|expires| now >= expires)
+    }
+}
+
+/// A source of random bytes.
+pub(crate) trait RandomSource: Send + Sync {
+    /// Fills `bytes`.
+    fn fill(&self, bytes: &mut [u8]);
+}
+
+/// The platform generator EC generation uses (`rand::thread_rng`).
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) struct ThreadRandom;
+
+impl RandomSource for ThreadRandom {
+    fn fill(&self, bytes: &mut [u8]) {
+        rand::thread_rng().fill_bytes(bytes);
+    }
+}
+
+/// Deterministic bytes for tests: xorshift64* from a seed.
+#[cfg(any(test, feature = "test-utils"))]
+#[derive(Debug)]
+pub struct SeededRandom(std::sync::Mutex<u64>);
+
+#[cfg(any(test, feature = "test-utils"))]
+impl SeededRandom {
+    /// A generator that yields the same bytes for the same seed. A zero
+    /// seed is treated as one, since xorshift never leaves zero.
+    #[must_use]
+    pub fn new(seed: u64) -> Self {
+        Self(std::sync::Mutex::new(seed.max(1)))
+    }
+}
+
+#[cfg(any(test, feature = "test-utils"))]
+impl RandomSource for SeededRandom {
+    fn fill(&self, bytes: &mut [u8]) {
+        let mut state = self.0.lock().expect("should lock the seed");
+        for byte in bytes {
+            *state ^= *state >> 12;
+            *state ^= *state << 25;
+            *state ^= *state >> 27;
+            *byte = state.wrapping_mul(0x2545_F491_4F6C_DD1D).to_be_bytes()[0];
+        }
+    }
+}
+
+/// Every signal the coordinator holds for one request. Crate-private: a
+/// provider only ever sees a [`ResolveInput`] filtered by its descriptor.
+pub(crate) struct ResolveSignals<'a> {
+    pub(crate) client_ip: Option<IpAddr>,
+    pub(crate) user_agent: Option<&'a str>,
+    pub(crate) page_url: Option<Url>,
+    pub(crate) region: Option<Region>,
+    pub(crate) hashed_email: Option<HashedEmail>,
+    pub(crate) consent: ProviderConsent,
+    pub(crate) publisher_domain: &'a str,
+    pub(crate) now: UnixTime,
+    pub(crate) random: &'a dyn RandomSource,
+    pub(crate) ec_id: Option<String>,
+    pub(crate) stored: BTreeMap<SourceDomain, StoredId>,
+}
+
+/// What one provider may read for one call.
+pub struct ResolveInput<'a> {
+    descriptor: &'a ProviderDescriptor,
+    kinds: BTreeMap<SourceDomain, ResolveKind>,
+    signals: &'a ResolveSignals<'a>,
+    declared: BTreeSet<Input>,
+    available: BTreeSet<Input>,
+    state_json: Option<String>,
+    undeclared: RefCell<Vec<Access>>,
+    state_failed: RefCell<bool>,
+    state_decoded: RefCell<bool>,
+}
+
+impl fmt::Debug for ResolveInput<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ResolveInput")
+            .field("provider", self.descriptor.id())
+            .field("kinds", &self.kinds)
+            .finish_non_exhaustive()
+    }
+}
+
+impl<'a> ResolveInput<'a> {
+    /// The input for one call. `kinds` holds only the sources to resolve.
+    /// The inputs of every kind present are available, plus the wanted ones.
+    /// An input declared only for a kind this call does not hold is
+    /// declared, so reading it is not an error of the provider, but it is
+    /// unavailable (spec 4.4).
+    #[must_use]
+    pub(crate) fn new(
+        descriptor: &'a ProviderDescriptor,
+        kinds: BTreeMap<SourceDomain, ResolveKind>,
+        signals: &'a ResolveSignals<'a>,
+    ) -> Self {
+        let (declared, available) =
+            descriptor
+                .resolves()
+                .map_or_else(Default::default, |resolves| {
+                    let mut available = resolves.wants().clone();
+                    for kind in kinds.values().copied().collect::<BTreeSet<_>>() {
+                        available.extend(resolves.needs(kind));
+                    }
+                    (resolves.declared_inputs(), available)
+                });
+        Self {
+            descriptor,
+            kinds,
+            signals,
+            declared,
+            available,
+            state_json: None,
+            undeclared: RefCell::new(Vec::new()),
+            state_failed: RefCell::new(false),
+            state_decoded: RefCell::new(false),
+        }
+    }
+
+    /// Gives the call its own provider's stored private state `ps.st`, as
+    /// JSON. State is per provider and sensitive, so it never rides on the
+    /// signals every call shares.
+    #[must_use]
+    pub(crate) fn with_state_json(mut self, state_json: Option<String>) -> Self {
+        self.state_json = state_json;
+        self
+    }
+
+    fn record(&self, access: Access) -> Report<IdentityProviderError> {
+        self.undeclared.borrow_mut().push(access);
+        Report::new(IdentityProviderError::UndeclaredInput { access })
+    }
+
+    fn declared<T>(
+        &self,
+        input: Input,
+        value: Option<T>,
+    ) -> Result<T, Report<IdentityProviderError>> {
+        if !self.declared.contains(&input) {
+            return Err(self.record(Access::Input(input)));
+        }
+        if !self.available.contains(&input) {
+            return Err(Report::new(IdentityProviderError::InputUnavailable {
+                input,
+            }));
+        }
+        value.ok_or_else(|| Report::new(IdentityProviderError::InputUnavailable { input }))
+    }
+
+    /// Undeclared reads recorded so far. The coordinator logs them as
+    /// `Config`, and the harness fails the test.
+    #[must_use]
+    pub(crate) fn recorded_errors(&self) -> Vec<Access> {
+        self.undeclared.borrow().clone()
+    }
+
+    /// Whether a `state()` call failed to decode.
+    #[must_use]
+    pub(crate) fn state_decode_failed(&self) -> bool {
+        *self.state_failed.borrow()
+    }
+
+    /// Whether a `state()` call decoded the stored state. The conformance
+    /// check of the test harness uses it to see a provider accept a state
+    /// that no valid state looks like.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub(crate) fn state_was_decoded(&self) -> bool {
+        *self.state_decoded.borrow()
+    }
+
+    /// The sources to resolve this time, each with its own kind.
+    pub fn sources(&self) -> impl Iterator<Item = (&SourceDomain, ResolveKind)> + '_ {
+        self.kinds.iter().map(|(source, kind)| (source, *kind))
+    }
+
+    /// Whether `source` is being resolved for the first time.
+    #[must_use]
+    pub fn is_initial(&self, source: &SourceDomain) -> bool {
+        self.kinds.get(source) == Some(&ResolveKind::Initial)
+    }
+
+    /// Whether `source` is being refreshed.
+    #[must_use]
+    pub fn is_refresh(&self, source: &SourceDomain) -> bool {
+        self.kinds.get(source) == Some(&ResolveKind::Refresh)
+    }
+
+    /// The descriptor's primary source.
+    #[must_use]
+    pub fn primary_source(&self) -> &SourceDomain {
+        self.descriptor.primary_source()
+    }
+
+    /// The stored record for one of this provider's sources.
+    #[must_use]
+    pub fn stored(&self, source: &SourceDomain) -> Option<&StoredId> {
+        self.signals.stored.get(source)
+    }
+
+    /// This provider's private state, decoded. `Ok(None)` when there is none.
+    ///
+    /// # Errors
+    ///
+    /// `InvalidState` when the stored state does not decode as `T`. The
+    /// failure is recorded, and the coordinator clears the state whatever
+    /// the provider returns. `UndeclaredInput` without `with_private_state()`.
+    pub fn state<T: DeserializeOwned>(&self) -> Result<Option<T>, Report<IdentityProviderError>> {
+        if !self
+            .descriptor
+            .resolves()
+            .is_some_and(Resolves::has_private_state)
+        {
+            return Err(self.record(Access::PrivateState));
+        }
+        let Some(raw) = self.state_json.as_deref() else {
+            return Ok(None);
+        };
+        serde_json::from_str(raw)
+            .map(|state| {
+                *self.state_decoded.borrow_mut() = true;
+                Some(state)
+            })
+            .map_err(|_| {
+                *self.state_failed.borrow_mut() = true;
+                Report::new(IdentityProviderError::InvalidState)
+            })
+    }
+
+    /// The endpoint declared with `Resolves::with_endpoint`.
+    ///
+    /// # Errors
+    ///
+    /// `UndeclaredInput { access: Endpoint }` when none was declared.
+    pub fn endpoint(&self) -> Result<&Url, Report<IdentityProviderError>> {
+        self.descriptor
+            .endpoint()
+            .ok_or_else(|| self.record(Access::Endpoint))
+    }
+
+    /// The consent strings to forward.
+    #[must_use]
+    pub fn consent(&self) -> &ProviderConsent {
+        &self.signals.consent
+    }
+
+    /// The publisher's domain.
+    #[must_use]
+    pub fn publisher_domain(&self) -> &str {
+        self.signals.publisher_domain
+    }
+
+    /// The request's time.
+    #[must_use]
+    pub fn now(&self) -> UnixTime {
+        self.signals.now
+    }
+
+    /// Random bytes from the platform generator. Fixed by the harness.
+    #[must_use]
+    pub fn random_bytes<const N: usize>(&self) -> [u8; N] {
+        let mut bytes = [0u8; N];
+        self.signals.random.fill(&mut bytes);
+        bytes
+    }
+
+    /// The platform's client address.
+    ///
+    /// # Errors
+    ///
+    /// `UndeclaredInput` when not declared, `InputUnavailable` when missing.
+    pub fn client_ip(&self) -> Result<IpAddr, Report<IdentityProviderError>> {
+        self.declared(Input::ClientIp, self.signals.client_ip)
+    }
+
+    /// The `User-Agent`.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn user_agent(&self) -> Result<&str, Report<IdentityProviderError>> {
+        self.declared(Input::UserAgent, self.signals.user_agent)
+    }
+
+    /// The page URL, without query string or fragment.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn page_url(&self) -> Result<&Url, Report<IdentityProviderError>> {
+        self.declared(Input::PageUrl, self.signals.page_url.as_ref())
+    }
+
+    /// Country and subdivision.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn region(&self) -> Result<&Region, Report<IdentityProviderError>> {
+        self.declared(Input::Region, self.signals.region.as_ref())
+    }
+
+    /// A hashed email. Never available in v1.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn hashed_email(&self) -> Result<&HashedEmail, Report<IdentityProviderError>> {
+        self.declared(Input::HashedEmail, self.signals.hashed_email.as_ref())
+    }
+
+    /// The full EC ID. Only for a resolver declared `with_ec_id()`.
+    ///
+    /// # Errors
+    ///
+    /// `UndeclaredInput { access: EcId }` otherwise. `Config` when the
+    /// request has no EC ID, which the coordinator never allows: it does not
+    /// dispatch generic pull without one.
+    pub(in crate::ec::identity) fn ec_id(&self) -> Result<&str, Report<IdentityProviderError>> {
+        if !self.descriptor.resolves().is_some_and(Resolves::gets_ec_id) {
+            return Err(self.record(Access::EcId));
+        }
+        self.signals.ec_id.as_deref().ok_or_else(|| {
+            IdentityProviderError::config("generic pull was called without an EC ID")
+        })
+    }
+}
+
+/// What a capture may read from one proxied response.
+pub struct CaptureInput<'a> {
+    descriptor: &'a ProviderDescriptor,
+    path: &'a str,
+    response: &'a ProviderResponse,
+    stored: &'a BTreeMap<SourceDomain, StoredId>,
+    consent: &'a ProviderConsent,
+    publisher_domain: &'a str,
+    now: UnixTime,
+}
+
+impl fmt::Debug for CaptureInput<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CaptureInput")
+            .field("provider", self.descriptor.id())
+            .field("path", &self.path)
+            .finish_non_exhaustive()
+    }
+}
+
+impl<'a> CaptureInput<'a> {
+    /// The input for one capture.
+    #[must_use]
+    pub(crate) fn new(
+        descriptor: &'a ProviderDescriptor,
+        path: &'a str,
+        response: &'a ProviderResponse,
+        stored: &'a BTreeMap<SourceDomain, StoredId>,
+        consent: &'a ProviderConsent,
+        publisher_domain: &'a str,
+        now: UnixTime,
+    ) -> Self {
+        Self {
+            descriptor,
+            path,
+            response,
+            stored,
+            consent,
+            publisher_domain,
+            now,
+        }
+    }
+
+    /// The proxied request path, without query string.
+    #[must_use]
+    pub fn path(&self) -> &str {
+        self.path
+    }
+
+    /// The proxied response, decoded.
+    #[must_use]
+    pub fn response(&self) -> &ProviderResponse {
+        self.response
+    }
+
+    /// The descriptor's primary source.
+    #[must_use]
+    pub fn primary_source(&self) -> &SourceDomain {
+        self.descriptor.primary_source()
+    }
+
+    /// Finds a declared source by a vendor's spelling.
+    #[must_use]
+    pub fn source_named(&self, name: &str) -> Option<&SourceDomain> {
+        self.descriptor.source_named(name)
+    }
+
+    /// The stored record for a source.
+    #[must_use]
+    pub fn stored(&self, source: &SourceDomain) -> Option<&StoredId> {
+        self.stored.get(source)
+    }
+
+    /// The request's consent, from its cookies and headers. The request
+    /// body is never read (spec 4.7).
+    #[must_use]
+    pub fn consent(&self) -> &ProviderConsent {
+        self.consent
+    }
+
+    /// The publisher's domain.
+    #[must_use]
+    pub fn publisher_domain(&self) -> &str {
+        self.publisher_domain
+    }
+
+    /// The request's time.
+    #[must_use]
+    pub fn now(&self) -> UnixTime {
+        self.now
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+    use std::net::IpAddr;
+
+    use super::*;
+    use crate::ec::identity::descriptor::{Captures, ProviderDescriptor, Resolves};
+    use crate::ec::identity::exchange::ProviderResponse;
+    use crate::ec::kv_types::{KvEid, KvPartnerId, KvUid};
+
+    fn descriptor(resolves: Resolves) -> ProviderDescriptor {
+        ProviderDescriptor::builder("p".parse().expect("should parse the provider id"))
+            .with_source("example.com".parse().expect("should parse the source"))
+            .with_resolves(resolves)
+            .with_consent_policy(crate::ec::identity::test_support::resolver_policy())
+            .build()
+            .expect("should build")
+    }
+
+    fn signals() -> ResolveSignals<'static> {
+        ResolveSignals {
+            client_ip: Some("192.0.2.10".parse().expect("should parse ip")),
+            user_agent: Some("ExampleBrowser/1.0"),
+            page_url: None,
+            region: Region::from_geo("us", Some("us-ca")),
+            hashed_email: None,
+            consent: ProviderConsent::default(),
+            publisher_domain: "www.example.com",
+            now: UnixTime::from_secs(1_760_000_000),
+            random: &ThreadRandom,
+            ec_id: Some("a".repeat(64) + ".ABC123"),
+            stored: BTreeMap::new(),
+        }
+    }
+
+    #[test]
+    fn declared_inputs_are_available_and_wanted_missing_ones_are_unavailable() {
+        let descriptor = descriptor(
+            Resolves::new()
+                .with_endpoint("https://a.example.com")
+                .with_needs([Input::ClientIp, Input::Region])
+                .with_wants([Input::PageUrl]),
+        );
+        let signals = signals();
+        let input = ResolveInput::new(
+            &descriptor,
+            kinds(&descriptor, ResolveKind::Initial),
+            &signals,
+        );
+
+        assert_eq!(
+            input.client_ip().expect("should read the ip"),
+            "192.0.2.10".parse::<IpAddr>().expect("should parse the ip"),
+            "should return the client ip"
+        );
+        let region = input.region().expect("should read region");
+        assert_eq!(
+            (region.country(), region.subdivision()),
+            ("US", Some("CA")),
+            "should normalize the region"
+        );
+        assert!(region.is("US", "CA"), "should test country and subdivision");
+        let error = input.page_url().expect_err("should be unavailable");
+        assert!(
+            matches!(
+                error.current_context(),
+                IdentityProviderError::InputUnavailable {
+                    input: Input::PageUrl
+                }
+            ),
+            "should report a declared but missing input as InputUnavailable"
+        );
+        assert!(
+            input.recorded_errors().is_empty(),
+            "should record nothing for declared reads"
+        );
+    }
+
+    #[test]
+    fn input_declared_only_for_an_absent_kind_is_unavailable() {
+        let descriptor = descriptor(
+            Resolves::new()
+                .with_endpoint("https://a.example.com")
+                .with_needs([Input::ClientIp])
+                .with_needs_for(ResolveKind::Refresh, [Input::UserAgent]),
+        );
+        let signals = signals();
+
+        let initial = ResolveInput::new(
+            &descriptor,
+            kinds(&descriptor, ResolveKind::Initial),
+            &signals,
+        );
+        let refresh = ResolveInput::new(
+            &descriptor,
+            kinds(&descriptor, ResolveKind::Refresh),
+            &signals,
+        );
+
+        let error = initial
+            .user_agent()
+            .expect_err("should hide a Refresh-only input on an Initial call");
+        assert!(
+            matches!(
+                error.current_context(),
+                IdentityProviderError::InputUnavailable {
+                    input: Input::UserAgent
+                }
+            ),
+            "should report InputUnavailable, not an undeclared read"
+        );
+        assert!(
+            initial.recorded_errors().is_empty(),
+            "should record no undeclared read"
+        );
+        assert_eq!(
+            refresh
+                .user_agent()
+                .expect("should read the user agent on a Refresh call"),
+            "ExampleBrowser/1.0",
+            "should return the user agent for the kind that declares it"
+        );
+    }
+
+    #[test]
+    fn undeclared_reads_are_recorded_even_when_ignored() {
+        let descriptor = descriptor(Resolves::new().with_endpoint("https://a.example.com"));
+        let signals = signals();
+        let input = ResolveInput::new(
+            &descriptor,
+            kinds(&descriptor, ResolveKind::Initial),
+            &signals,
+        );
+
+        let ignored = input.user_agent().ok();
+        let state = input.state::<serde_json::Value>();
+
+        assert!(ignored.is_none(), "should not return an undeclared input");
+        assert!(state.is_err(), "should need with_private_state for state");
+        assert_eq!(
+            input.recorded_errors(),
+            vec![Access::Input(Input::UserAgent), Access::PrivateState],
+            "should record both undeclared reads"
+        );
+        input
+            .endpoint()
+            .expect("should always return the declared endpoint");
+    }
+
+    #[test]
+    fn state_decodes_and_a_bad_state_is_recorded() {
+        let descriptor = descriptor(
+            Resolves::new()
+                .with_endpoint("https://a.example.com")
+                .with_private_state(),
+        );
+        let good = signals();
+        let input = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Refresh), &good)
+            .with_state_json(Some(r#"{"signature":"s"}"#.to_owned()));
+        let state: serde_json::Value = input
+            .state()
+            .expect("should decode the state")
+            .expect("should have a state");
+        assert_eq!(state["signature"], "s", "should decode the state");
+        assert!(
+            !input.state_decode_failed(),
+            "should not record a good state as a failure"
+        );
+
+        let bad = signals();
+        let input = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Refresh), &bad)
+            .with_state_json(Some(r#""a bare string""#.to_owned()));
+        let error = input
+            .state::<TypedState>()
+            .expect_err("should not decode a bare string");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::InvalidState),
+            "should report InvalidState"
+        );
+        assert!(input.state_decode_failed(), "should record the failure");
+    }
+
+    #[test]
+    fn ec_id_is_only_for_providers_declared_with_ec_id() {
+        let generic = descriptor(Resolves::new().with_host("a.example.com").with_ec_id());
+        let other = descriptor(Resolves::new().with_host("a.example.com"));
+        let with_ec = signals();
+        ResolveInput::new(&generic, kinds(&generic, ResolveKind::Initial), &with_ec)
+            .ec_id()
+            .expect("should let generic pull read the EC ID");
+        let input = ResolveInput::new(&other, kinds(&other, ResolveKind::Initial), &with_ec);
+        assert!(
+            input.ec_id().is_err(),
+            "should refuse the EC ID to other providers"
+        );
+        assert_eq!(
+            input.recorded_errors(),
+            vec![Access::EcId],
+            "should record an EC ID read"
+        );
+
+        let mut no_ec = signals();
+        no_ec.ec_id = None;
+        let error = ResolveInput::new(&generic, kinds(&generic, ResolveKind::Initial), &no_ec)
+            .ec_id()
+            .expect_err("should fail without an EC ID");
+        assert!(
+            matches!(
+                error.current_context(),
+                IdentityProviderError::Config { .. }
+            ),
+            "should report a missing EC ID as Config, not as a missing input"
+        );
+    }
+
+    #[test]
+    fn stored_ids_and_expiry() {
+        let record = KvPartnerId {
+            w: Some("p".to_owned()),
+            rv: Some("0123456789abcdef".to_owned()),
+            at: Some(10),
+            exp: Some(20),
+            ra: Some(15),
+            ru: None,
+            eids: vec![KvEid {
+                uids: vec![KvUid {
+                    id: "u".to_owned(),
+                    atype: Some(3),
+                    ext: None,
+                }],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            }],
+        };
+        let source: SourceDomain = "example.com".parse().expect("should parse the source");
+        let stored =
+            StoredId::from_record(&source, &record).expect("should read a record with an entry");
+        assert_eq!(
+            stored.writer().map(IdentityProviderId::as_str),
+            Some("p"),
+            "should parse the writer"
+        );
+        assert!(
+            !stored.is_expired(UnixTime::from_secs(19)),
+            "should not be expired before exp"
+        );
+        assert!(
+            stored.is_expired(UnixTime::from_secs(20)),
+            "should be expired at exp"
+        );
+        assert_eq!(
+            stored.refresh_at(),
+            Some(UnixTime::from_secs(15)),
+            "should read ra"
+        );
+        assert_eq!(
+            stored.eids().len(),
+            1,
+            "should expose a one-UID record as one entry"
+        );
+        let eid = &stored.eids()[0];
+        assert_eq!(eid.source, "example.com", "should fill in the source");
+        assert_eq!(eid.uids.len(), 1, "should expose its one UID");
+        assert_eq!(eid.uids[0].id, "u", "should keep the UID");
+        assert_eq!(eid.uids[0].atype, Some(3), "should keep the atype");
+        assert_eq!(
+            (
+                eid.inserter.as_deref(),
+                eid.matcher.as_deref(),
+                eid.mm,
+                eid.ext.as_ref()
+            ),
+            (None, None, None, None),
+            "should expose no EID-level fields when none are stored"
+        );
+        assert_eq!(
+            (stored.uid(), stored.atype()),
+            ("u", Some(3)),
+            "should describe the first UID"
+        );
+
+        let empty = KvPartnerId {
+            eids: Vec::new(),
+            ..record
+        };
+        assert!(
+            StoredId::from_record(&source, &empty).is_none(),
+            "should not read a record with no entry"
+        );
+    }
+
+    #[test]
+    fn a_full_record_exposes_every_entry_and_its_first_uid() {
+        let record = KvPartnerId {
+            w: Some("p".to_owned()),
+            rv: Some("0123456789abcdef".to_owned()),
+            at: Some(10),
+            exp: None,
+            ra: None,
+            ru: None,
+            eids: vec![
+                KvEid {
+                    uids: vec![
+                        KvUid {
+                            id: "first".to_owned(),
+                            atype: Some(1),
+                            ext: Some(serde_json::json!({ "rtiPartner": "TDID" })),
+                        },
+                        KvUid {
+                            id: "second".to_owned(),
+                            atype: Some(3),
+                            ext: None,
+                        },
+                    ],
+                    inserter: Some("inserter.example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(2),
+                    ext: Some(serde_json::json!({ "segments": ["a"] })),
+                },
+                KvEid {
+                    uids: vec![KvUid {
+                        id: "third".to_owned(),
+                        atype: None,
+                        ext: None,
+                    }],
+                    inserter: None,
+                    matcher: Some("matcher.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ],
+        };
+        let source: SourceDomain = "example.com".parse().expect("should parse the source");
+
+        let stored = StoredId::from_record(&source, &record).expect("should read the record");
+
+        let ids: Vec<Vec<&str>> = stored
+            .eids()
+            .iter()
+            .map(|eid| eid.uids.iter().map(|uid| uid.id.as_str()).collect())
+            .collect();
+        assert_eq!(
+            ids,
+            vec![vec!["first", "second"], vec!["third"]],
+            "should keep every entry in stored order"
+        );
+        assert!(
+            stored.eids().iter().all(|eid| eid.source == "example.com"),
+            "should fill in the source"
+        );
+        assert_eq!(
+            stored.eids()[0].inserter.as_deref(),
+            Some("inserter.example.com"),
+            "should keep the inserter"
+        );
+        assert_eq!(stored.eids()[0].mm, Some(2), "should keep mm");
+        assert_eq!(
+            stored.eids()[0].ext,
+            Some(serde_json::json!({ "segments": ["a"] })),
+            "should keep the EID-level ext"
+        );
+        assert_eq!(
+            stored.eids()[1].matcher.as_deref(),
+            Some("matcher.example.com"),
+            "should keep the matcher"
+        );
+        assert_eq!(
+            stored.uid(),
+            "first",
+            "should return the first UID of the first entry"
+        );
+        assert_eq!(stored.atype(), Some(1), "should return that UID's atype");
+        assert_eq!(
+            stored.ext(),
+            Some(&serde_json::json!({ "rtiPartner": "TDID" })),
+            "should return that UID's ext"
+        );
+        assert!(
+            !format!("{stored:?}").contains("second"),
+            "should redact every UID in Debug"
+        );
+    }
+
+    #[test]
+    fn hashed_email_debug_is_redacted() {
+        let email = HashedEmail::from_bytes([0xab; 32]);
+        assert_eq!(
+            email.to_hex(),
+            "ab".repeat(32),
+            "should encode lowercase hex"
+        );
+        assert_eq!(
+            format!("{email:?}"),
+            "HashedEmail([redacted])",
+            "should redact Debug"
+        );
+    }
+
+    #[test]
+    fn capture_input_exposes_path_and_never_the_request_body() {
+        let descriptor =
+            ProviderDescriptor::builder("c".parse().expect("should parse the provider id"))
+                .with_source("example.com".parse().expect("should parse the source"))
+                .with_captures(Captures::new().with_path(http::Method::POST, "/integrations/c/api"))
+                .build()
+                .expect("should build");
+        let response = ProviderResponse::for_test(http::StatusCode::OK, b"{}");
+        let consent = ProviderConsent::default();
+        let stored = BTreeMap::new();
+        let input = CaptureInput::new(
+            &descriptor,
+            "/integrations/c/api",
+            &response,
+            &stored,
+            &consent,
+            "www.example.com",
+            UnixTime::from_secs(1),
+        );
+        assert_eq!(
+            input.path(),
+            "/integrations/c/api",
+            "should expose the proxied path"
+        );
+        assert_eq!(
+            input.primary_source().as_str(),
+            "example.com",
+            "should expose the primary source"
+        );
+    }
+
+    fn kinds(
+        descriptor: &ProviderDescriptor,
+        kind: ResolveKind,
+    ) -> BTreeMap<SourceDomain, ResolveKind> {
+        descriptor
+            .sources()
+            .iter()
+            .map(|source| (source.clone(), kind))
+            .collect()
+    }
+
+    #[derive(Debug, serde::Deserialize)]
+    struct TypedState {
+        #[allow(dead_code)]
+        signature: String,
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/measurement.rs b/crates/trusted-server-core/src/ec/identity/measurement.rs
new file mode 100644
index 0000000000..b9b4edd844
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/measurement.rs
@@ -0,0 +1,267 @@
+//! The one `identity request measurement` line per request (spec 14, step 1).
+//!
+//! It carries sizes, counts and labels only: no EC ID, no UID and no cookie
+//! value can reach it (spec 9.3).
+
+use core::fmt::Write as _;
+
+use std::collections::BTreeMap;
+
+use super::flush::FlushOutcome;
+use super::ids::{IdentityProviderId, SourceDomain};
+
+/// What kind of identity route the request was.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub enum RouteKind {
+    /// The one browser-driven writer request.
+    #[display("writer")]
+    Writer,
+    /// Any other request: it reads and stages but never writes after send.
+    #[display("stager")]
+    Stager,
+    /// The request generated a new EC.
+    #[display("new_ec")]
+    NewEc,
+}
+
+/// What the adapter knows about the request after phase 4.
+#[derive(Debug, Clone, Copy)]
+pub struct MeasurementInput<'a> {
+    /// Whether phase 1 read the identity row.
+    pub phase_one_read: bool,
+    /// KV reads made after phase 1.
+    pub kv_reads: u32,
+    /// KV writes made after phase 1.
+    pub kv_writes: u32,
+    /// How phase 4 ended, or `None` when it did not run.
+    pub flush: Option<&'a FlushOutcome>,
+    /// Whether a withdrawal tombstone needed its after-send run.
+    pub withdrawal_after_send: bool,
+    /// Whether that run left the tombstone unwritten.
+    pub withdrawal_after_send_failed: bool,
+}
+
+/// The measurement of one request, formatted by [`core::fmt::Display`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IdentityMeasurement {
+    pub(crate) cookie_header_bytes: usize,
+    pub(crate) route: RouteKind,
+    pub(crate) kv_reads: u32,
+    pub(crate) kv_writes: u32,
+    pub(crate) flush: Option<FlushOutcome>,
+    pub(crate) removal_lost: u32,
+    pub(crate) removal_deferred: u32,
+    pub(crate) withdrawal_after_send: bool,
+    pub(crate) withdrawal_after_send_failed: bool,
+    pub(crate) capture_unpersisted: BTreeMap<(IdentityProviderId, SourceDomain), u32>,
+}
+
+impl IdentityMeasurement {
+    /// The inbound `Cookie` header size in bytes.
+    #[must_use]
+    pub fn cookie_header_bytes(&self) -> usize {
+        self.cookie_header_bytes
+    }
+
+    /// The route kind label.
+    #[must_use]
+    pub fn route(&self) -> RouteKind {
+        self.route
+    }
+
+    /// KV reads this request made.
+    #[must_use]
+    pub fn kv_reads(&self) -> u32 {
+        self.kv_reads
+    }
+
+    /// KV writes this request made.
+    #[must_use]
+    pub fn kv_writes(&self) -> u32 {
+        self.kv_writes
+    }
+
+    /// How phase 4 ended, or `None` when it did not run.
+    #[must_use]
+    pub fn flush(&self) -> Option<FlushOutcome> {
+        self.flush
+    }
+
+    /// Removals every attempt failed to write.
+    #[must_use]
+    pub fn removal_lost(&self) -> u32 {
+        self.removal_lost
+    }
+
+    /// Removals the row write missed that went to the pending key.
+    #[must_use]
+    pub fn removal_deferred(&self) -> u32 {
+        self.removal_deferred
+    }
+
+    /// Whether a withdrawal tombstone needed its after-send run.
+    #[must_use]
+    pub fn withdrawal_after_send(&self) -> bool {
+        self.withdrawal_after_send
+    }
+
+    /// Whether the after-send withdrawal run left the tombstone unwritten.
+    #[must_use]
+    pub fn withdrawal_after_send_failed(&self) -> bool {
+        self.withdrawal_after_send_failed
+    }
+
+    /// Positive capture IDs counted and never stored, per provider and
+    /// source. Counts only: no value is held.
+    #[must_use]
+    pub fn capture_unpersisted(&self) -> &BTreeMap<(IdentityProviderId, SourceDomain), u32> {
+        &self.capture_unpersisted
+    }
+
+    /// Logs the measurement at info level.
+    pub fn log(&self) {
+        log::info!("identity request measurement: {self}");
+    }
+}
+
+impl core::fmt::Display for IdentityMeasurement {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(
+            formatter,
+            "cookie_header_bytes={} route={} kv_reads={} kv_writes={} flush={} removal_lost={} \
+             removal_deferred={} withdrawal_after_send={} withdrawal_after_send_failed={} capture_unpersisted={}",
+            self.cookie_header_bytes,
+            self.route,
+            self.kv_reads,
+            self.kv_writes,
+            FlushLabel(self.flush),
+            self.removal_lost,
+            self.removal_deferred,
+            u8::from(self.withdrawal_after_send),
+            u8::from(self.withdrawal_after_send_failed),
+            CaptureUnpersisted(&self.capture_unpersisted),
+        )
+    }
+}
+
+/// The capture counts as `provider/source:count`, comma separated, or `none`.
+struct CaptureUnpersisted<'a>(&'a BTreeMap<(IdentityProviderId, SourceDomain), u32>);
+
+impl core::fmt::Display for CaptureUnpersisted<'_> {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        if self.0.is_empty() {
+            return formatter.write_str("none");
+        }
+        for (index, ((provider, source), count)) in self.0.iter().enumerate() {
+            if index > 0 {
+                formatter.write_char(',')?;
+            }
+            write!(formatter, "{provider}/{source}:{count}")?;
+        }
+        Ok(())
+    }
+}
+
+/// A phase 4 outcome as a lower snake case label, with a drop reason
+/// appended.
+pub(crate) struct FlushLabel(pub(crate) Option<FlushOutcome>);
+
+impl core::fmt::Display for FlushLabel {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self.0 {
+            None => formatter.write_str("not_run"),
+            Some(FlushOutcome::Skipped) => formatter.write_str("skipped"),
+            Some(FlushOutcome::NoChange) => formatter.write_str("no_change"),
+            Some(FlushOutcome::Written) => formatter.write_str("written"),
+            Some(FlushOutcome::Dropped(reason)) => {
+                formatter.write_str("dropped_")?;
+                reason.chars().try_for_each(|character| {
+                    formatter.write_char(if character == ' ' { '_' } else { character })
+                })
+            }
+            Some(FlushOutcome::WriteFailed { .. }) => formatter.write_str("write_failed"),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ec::identity::removal::RemovalWriteOutcome;
+
+    #[test]
+    fn flush_label_covers_every_outcome() {
+        let cases = [
+            (None, "not_run"),
+            (Some(FlushOutcome::Skipped), "skipped"),
+            (Some(FlushOutcome::NoChange), "no_change"),
+            (Some(FlushOutcome::Written), "written"),
+            (
+                Some(FlushOutcome::Dropped("read failed")),
+                "dropped_read_failed",
+            ),
+            (
+                Some(FlushOutcome::WriteFailed {
+                    removals: RemovalWriteOutcome::Failed,
+                }),
+                "write_failed",
+            ),
+        ];
+
+        for (outcome, expected) in cases {
+            assert_eq!(
+                FlushLabel(outcome).to_string(),
+                expected,
+                "should label {outcome:?}"
+            );
+        }
+    }
+
+    fn measurement(
+        capture_unpersisted: BTreeMap<(IdentityProviderId, SourceDomain), u32>,
+    ) -> IdentityMeasurement {
+        IdentityMeasurement {
+            cookie_header_bytes: 10,
+            route: RouteKind::Stager,
+            kv_reads: 0,
+            kv_writes: 0,
+            flush: None,
+            removal_lost: 0,
+            removal_deferred: 0,
+            withdrawal_after_send: false,
+            withdrawal_after_send_failed: false,
+            capture_unpersisted,
+        }
+    }
+
+    #[test]
+    fn measurement_line_counts_capture_unpersisted_per_provider_and_source() {
+        let line = measurement(BTreeMap::from([
+            (
+                (
+                    "lockr".parse().expect("should parse the provider ID"),
+                    "a.example.com".parse().expect("should parse the source"),
+                ),
+                2,
+            ),
+            (
+                (
+                    "lockr".parse().expect("should parse the provider ID"),
+                    "b.example.com".parse().expect("should parse the source"),
+                ),
+                1,
+            ),
+        ]))
+        .to_string();
+        let empty = measurement(BTreeMap::new()).to_string();
+
+        assert!(
+            line.ends_with("capture_unpersisted=lockr/a.example.com:2,lockr/b.example.com:1"),
+            "should list each provider and source with its count: {line}"
+        );
+        assert!(
+            empty.ends_with("capture_unpersisted=none"),
+            "control: should print none without a capture: {empty}"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/mirror.rs b/crates/trusted-server-core/src/ec/identity/mirror.rs
new file mode 100644
index 0000000000..db16c233f4
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/mirror.rs
@@ -0,0 +1,281 @@
+//! The `ts-eids-s` mirror payload: the servable server set for page scripts,
+//! capped to one cookie (spec 6.2). The server never reads the cookie back.
+
+use base64::Engine as _;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use serde_json::json;
+
+use super::ids::IdentityProviderId;
+use crate::openrtb::Eid;
+
+/// Maximum bytes of the encoded cookie value.
+pub(crate) const MIRROR_MAX_VALUE_BYTES: usize = 2048;
+/// Maximum cookie lifetime: that of `ts-eids`.
+pub(crate) const MIRROR_MAX_AGE_SEC: u64 = 86_400;
+
+/// One source's servable server entries, as bidders receive them.
+#[derive(Debug, Clone)]
+pub(crate) struct MirrorSource {
+    pub(crate) source: String,
+    /// The provider whose `cookie_priority` ranks the source, for the log.
+    pub(crate) provider: Option<IdentityProviderId>,
+    pub(crate) priority: i32,
+    /// The source's earliest `exp`, in Unix seconds.
+    pub(crate) expires_at: Option<u64>,
+    pub(crate) eids: Vec<Eid>,
+}
+
+/// What the request's KV read gave the mirror.
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum MirrorRead<'a> {
+    /// No KV read: the response carries no mirror member.
+    NotRead,
+    /// Consent denies EID persistence, or the row is a tombstone, withdrawn
+    /// or missing.
+    Cleared,
+    /// The servable server set, in output order.
+    Servable(&'a [MirrorSource]),
+}
+
+/// The mirror member of an `/auction` or `/_ts/page-bids` response.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum MirrorPayload {
+    Value { value: String, max_age: u64 },
+    Clear,
+}
+
+impl MirrorPayload {
+    /// The JSON the shim reads.
+    #[must_use]
+    pub(crate) fn to_json(&self) -> serde_json::Value {
+        match self {
+            Self::Value { value, max_age } => json!({ "value": value, "max_age": max_age }),
+            Self::Clear => json!({ "clear": true }),
+        }
+    }
+}
+
+fn encode(sources: &[&MirrorSource]) -> String {
+    let eids: Vec<&Eid> = sources.iter().flat_map(|source| &source.eids).collect();
+    let bytes =
+        serde_json::to_vec(&json!({ "v": 1, "eids": eids })).expect("should serialize EIDs");
+    URL_SAFE_NO_PAD.encode(bytes)
+}
+
+fn source_bytes(source: &MirrorSource) -> usize {
+    serde_json::to_vec(&source.eids).map_or(usize::MAX, |bytes| bytes.len())
+}
+
+/// The mirror payload for a request (spec 6.2).
+///
+/// # Performance
+///
+/// Encodes the set once per omission. A set holds at most one entry set per
+/// configured source, so this stays small.
+#[must_use]
+pub(crate) fn mirror_payload(read: MirrorRead<'_>, now: u64) -> Option<MirrorPayload> {
+    let sources = match read {
+        MirrorRead::NotRead => return None,
+        MirrorRead::Cleared => return Some(MirrorPayload::Clear),
+        MirrorRead::Servable(sources) => sources,
+    };
+    let mut kept: Vec<&MirrorSource> = sources.iter().collect();
+    let mut value = encode(&kept);
+    while value.len() > MIRROR_MAX_VALUE_BYTES && !kept.is_empty() {
+        let index = (0..kept.len())
+            .min_by_key(|&index| {
+                (
+                    kept[index].priority,
+                    core::cmp::Reverse(source_bytes(kept[index])),
+                    core::cmp::Reverse(index),
+                )
+            })
+            .expect("should hold a source");
+        let left_out = kept.remove(index);
+        log::info!(
+            "Leaving source '{}' of provider '{}' out of the ts-eids-s mirror, which exceeds {MIRROR_MAX_VALUE_BYTES} bytes",
+            left_out.source,
+            left_out
+                .provider
+                .as_ref()
+                .map_or("none", IdentityProviderId::as_str),
+        );
+        value = encode(&kept);
+    }
+    if kept.is_empty() {
+        return Some(MirrorPayload::Clear);
+    }
+    let max_age = kept
+        .iter()
+        .filter_map(|source| source.expires_at)
+        .map(|exp| exp.saturating_sub(now).max(1))
+        .fold(MIRROR_MAX_AGE_SEC, u64::min);
+    Some(MirrorPayload::Value { value, max_age })
+}
+
+#[cfg(test)]
+mod tests {
+    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+    use serde_json::json;
+
+    use super::*;
+    use crate::openrtb::{Eid, Uid};
+
+    const NOW: u64 = 1_760_000_000;
+
+    fn source(name: &str, priority: i32, expires_at: Option<u64>, ids: &[&str]) -> MirrorSource {
+        MirrorSource {
+            source: name.to_owned(),
+            provider: Some("p".parse().expect("should parse the provider ID")),
+            priority,
+            expires_at,
+            eids: vec![Eid::new(
+                name.to_owned(),
+                ids.iter()
+                    .map(|id| Uid {
+                        id: (*id).to_owned(),
+                        atype: Some(1),
+                        ext: None,
+                    })
+                    .collect(),
+            )],
+        }
+    }
+
+    fn decode(payload: &MirrorPayload) -> (serde_json::Value, u64) {
+        let MirrorPayload::Value { value, max_age } = payload else {
+            panic!("should hold a value");
+        };
+        let bytes = URL_SAFE_NO_PAD
+            .decode(value)
+            .expect("should be unpadded base64url");
+        (
+            serde_json::from_slice(&bytes).expect("should be JSON"),
+            *max_age,
+        )
+    }
+
+    #[test]
+    fn no_read_is_absent_and_a_denial_or_empty_set_is_clear() {
+        assert_eq!(
+            mirror_payload(MirrorRead::NotRead, NOW),
+            None,
+            "should leave the cookie as it is"
+        );
+        assert_eq!(
+            mirror_payload(MirrorRead::Cleared, NOW),
+            Some(MirrorPayload::Clear),
+            "should clear on a denial"
+        );
+        assert_eq!(
+            mirror_payload(MirrorRead::Servable(&[]), NOW),
+            Some(MirrorPayload::Clear),
+            "should clear an empty set"
+        );
+        assert_eq!(
+            MirrorPayload::Clear.to_json(),
+            json!({ "clear": true }),
+            "should serialize the clear shape"
+        );
+    }
+
+    #[test]
+    fn value_is_the_v1_entries_in_unpadded_base64url() {
+        let sources = [source("example.com", 0, None, &["example-a"])];
+
+        let payload =
+            mirror_payload(MirrorRead::Servable(&sources), NOW).expect("should return a payload");
+
+        let (decoded, max_age) = decode(&payload);
+        assert_eq!(
+            decoded,
+            json!({ "v": 1, "eids": [{ "source": "example.com", "uids": [{ "id": "example-a", "atype": 1 }] }] }),
+            "should hold the entries exactly as bidders receive them"
+        );
+        assert_eq!(
+            max_age, MIRROR_MAX_AGE_SEC,
+            "should live a day without an exp"
+        );
+        let MirrorPayload::Value { value, .. } = &payload else {
+            panic!("should hold a value")
+        };
+        assert_eq!(
+            payload.to_json(),
+            json!({ "value": value, "max_age": MIRROR_MAX_AGE_SEC }),
+            "should serialize"
+        );
+    }
+
+    #[test]
+    fn max_age_never_outlives_the_earliest_exp() {
+        let sources = [
+            source("a.example.com", 0, Some(NOW + 3_600), &["a"]),
+            source("b.example.com", 0, Some(NOW + 600), &["b"]),
+            source("c.example.com", 0, Some(NOW + 999_999), &["c"]),
+        ];
+
+        let (_, max_age) = decode(
+            &mirror_payload(MirrorRead::Servable(&sources), NOW).expect("should return a payload"),
+        );
+
+        assert_eq!(max_age, 600, "should take the earliest exp");
+    }
+
+    #[test]
+    fn an_oversized_set_drops_whole_sources_lowest_priority_then_largest() {
+        let big = |name: &str, priority, count| {
+            let ids: Vec<String> = (0..count)
+                .map(|index| format!("{name}-{index:040}"))
+                .collect();
+            source(
+                name,
+                priority,
+                None,
+                &ids.iter().map(String::as_str).collect::<Vec<_>>(),
+            )
+        };
+        let sources = [
+            big("keep-high", 10, 6),
+            big("drop-low-large", 0, 12),
+            big("keep-low-small", 0, 6),
+            big("keep-mid", 5, 6),
+        ];
+
+        let payload =
+            mirror_payload(MirrorRead::Servable(&sources), NOW).expect("should return a payload");
+
+        let MirrorPayload::Value { value, .. } = &payload else {
+            panic!("should hold a value")
+        };
+        assert!(value.len() <= MIRROR_MAX_VALUE_BYTES, "should fit the cap");
+        let (decoded, _) = decode(&payload);
+        let kept: Vec<&str> = decoded["eids"]
+            .as_array()
+            .expect("should be an array")
+            .iter()
+            .map(|eid| eid["source"].as_str().expect("should name the source"))
+            .collect();
+        assert_eq!(
+            kept,
+            vec!["keep-high", "keep-low-small", "keep-mid"],
+            "should drop the largest lowest-priority source whole"
+        );
+    }
+
+    #[test]
+    fn a_set_where_nothing_fits_is_clear() {
+        let ids: Vec<String> = (0..80).map(|index| format!("only-{index:040}")).collect();
+        let sources = [source(
+            "only.example.com",
+            0,
+            None,
+            &ids.iter().map(String::as_str).collect::<Vec<_>>(),
+        )];
+
+        assert_eq!(
+            mirror_payload(MirrorRead::Servable(&sources), NOW),
+            Some(MirrorPayload::Clear),
+            "should clear rather than keep an empty or partial set"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/mod.rs b/crates/trusted-server-core/src/ec/identity/mod.rs
new file mode 100644
index 0000000000..cd940b6863
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/mod.rs
@@ -0,0 +1,46 @@
+//! Server-side identity providers.
+//!
+//! An [`IdentityProvider`] turns request signals into `OpenRTB` EIDs.
+//! Providers only build requests and parse buffered responses. The
+//! coordinator owns eligibility, consent, transport limits and KV
+//! write-back, so every page load makes at most one browser-driven KV
+//! write. See `docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md`.
+
+pub(crate) mod catalog;
+pub(crate) mod coordinator;
+pub(crate) mod denials;
+pub mod descriptor;
+#[cfg(test)]
+pub(crate) mod examples;
+pub mod exchange;
+pub mod flush;
+pub(crate) mod generic_pull;
+pub mod ids;
+pub mod input;
+pub mod measurement;
+pub(crate) mod mirror;
+pub(crate) mod mutation;
+pub(crate) mod pending;
+pub(crate) mod policy;
+pub mod provider;
+pub(crate) mod removal;
+pub(crate) mod request;
+pub mod resolution;
+pub(crate) mod revision;
+pub mod runtime;
+pub(crate) mod servable;
+#[cfg(any(test, feature = "test-utils"))]
+pub mod test_support;
+
+pub use descriptor::{
+    Access, Captures, ConsentPolicy, EidProvenance, Input, ProviderDescriptor,
+    ProviderDescriptorBuilder, ResolveKind, Resolves, UsOptOut,
+};
+pub use exchange::{ProviderRequest, ProviderResponse};
+pub use ids::{IdentityProviderId, SourceDomain, UnixTime};
+pub use input::{CaptureInput, HashedEmail, ProviderConsent, Region, ResolveInput, StoredId};
+pub use provider::{IdentityProvider, IdentityProviderConfig};
+pub use resolution::{
+    IdentityProviderError, Resolution, ResolvedEid, ResolvedUid, StateChange, When,
+};
+pub use runtime::IdentityRuntime;
diff --git a/crates/trusted-server-core/src/ec/identity/mutation.rs b/crates/trusted-server-core/src/ec/identity/mutation.rs
new file mode 100644
index 0000000000..f074429c68
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/mutation.rs
@@ -0,0 +1,2340 @@
+//! One request's identity changes as a single mutation, and its merge into
+//! the live KV row (spec 5.4).
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use super::catalog::ProviderCatalog;
+use super::descriptor::Resolves;
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::input::RandomSource;
+use super::revision::{
+    Revision, StateRevision, new_revision, push_hashes, record_revision, set_hashes,
+};
+use crate::ec::kv_types::{
+    KvEntry, KvNetwork, KvOptOut, KvPartnerId, KvProviderState, MAX_INVALIDATED_UIDS,
+    MAX_PROVIDER_STATES,
+};
+
+/// A change to one source's record (spec 5.4).
+///
+/// Each `record` is the source's whole record: its `eids`, `w`, the timing
+/// fields and `rv`. Every change writes or removes a source's set whole.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) enum PartnerIdChange {
+    /// From browser ingest (`record.w` is `None`) or an unowned provider
+    /// (`record.w` names it). Fills a source that holds nothing usable.
+    FillMissing {
+        source: SourceDomain,
+        record: KvPartnerId,
+    },
+    /// From the owning provider, whose ID `record.w` holds.
+    OwnerWrite {
+        source: SourceDomain,
+        record: KvPartnerId,
+        expected: Option<Revision>,
+    },
+    /// From `Resolution::invalidate` or `also_invalidate`. `provider` is the
+    /// provider that invalidated, whose `ps.iv` receives the hashes.
+    OwnerRemove {
+        source: SourceDomain,
+        provider: IdentityProviderId,
+        expected: Revision,
+    },
+    /// From `Resolution::opted_out`. Removes the source's record if `writer`
+    /// wrote it, at any revision, and for a capture-only `writer` also a
+    /// record no provider wrote. Its hashes go to the writer's `ps.ov`.
+    WriterRemove {
+        source: SourceDomain,
+        writer: IdentityProviderId,
+    },
+}
+
+impl PartnerIdChange {
+    /// Whether the change removes a record.
+    pub(crate) fn is_removal(&self) -> bool {
+        matches!(self, Self::OwnerRemove { .. } | Self::WriterRemove { .. })
+    }
+}
+
+/// What a change does to a provider's private state `ps.st`.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) enum StateUpdate {
+    /// Leave `st` as it is.
+    #[default]
+    Keep,
+    /// Replace `st`.
+    Replace(serde_json::Value),
+    /// Remove `st`.
+    Clear,
+}
+
+/// A change to one provider's `ps` entry. It has no `iv` or `ov` field:
+/// those hashes come only from applied removals.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct ProviderStateChange {
+    pub(crate) n: Option<u64>,
+    pub(crate) f: Option<u32>,
+    pub(crate) opt_out: Option<KvOptOut>,
+    pub(crate) opt_out_clear: Option<u64>,
+    pub(crate) st: StateUpdate,
+}
+
+impl ProviderStateChange {
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    fn is_noop(&self) -> bool {
+        *self == Self::default()
+    }
+
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    fn has_removal(&self) -> bool {
+        self.opt_out.is_some() || self.opt_out_clear.is_some()
+    }
+
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    fn removals(&self) -> Self {
+        Self {
+            opt_out: self.opt_out.clone(),
+            opt_out_clear: self.opt_out_clear,
+            ..Self::default()
+        }
+    }
+
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    fn merge(&mut self, later: Self) {
+        self.n = self.n.max(later.n);
+        self.f = later.f.or(self.f);
+        if later.opt_out.as_ref().map(|o| o.at) >= self.opt_out.as_ref().map(|o| o.at) {
+            self.opt_out = later.opt_out.or_else(|| self.opt_out.take());
+        }
+        self.opt_out_clear = self.opt_out_clear.max(later.opt_out_clear);
+        if later.st != StateUpdate::Keep {
+            self.st = later.st;
+        }
+    }
+}
+
+/// One provider call's outcome. It applies as a unit: every ID change must
+/// apply on its own and the state revision must still match.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct ProviderResult {
+    pub(crate) provider: IdentityProviderId,
+    /// Positive changes only. Removals go to the mutation's own list.
+    pub(crate) ids: Vec<PartnerIdChange>,
+    pub(crate) state: ProviderStateChange,
+    /// `None` means the call read no state, so the state check always passes.
+    pub(crate) expected_state: Option<StateRevision>,
+}
+
+/// Everything one request changes in the identity row.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct IdentityMutation {
+    partner_ids: Vec<PartnerIdChange>,
+    provider_state: BTreeMap<IdentityProviderId, ProviderStateChange>,
+    results: Vec<ProviderResult>,
+    cluster_size: Option<u32>,
+    /// Providers whose stand-alone state change comes from a `found` outcome.
+    found_states: BTreeSet<IdentityProviderId>,
+}
+
+impl IdentityMutation {
+    /// Adds a change that stands alone.
+    pub(crate) fn add_change(&mut self, change: PartnerIdChange) {
+        self.partner_ids.push(change);
+    }
+
+    /// Adds a provider call's result.
+    ///
+    /// A removal in `result.ids` is a provider-side mistake: removals go
+    /// through `partner_ids` and `provider_state`. It is logged by provider
+    /// and source, never by UID.
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn add_result(&mut self, result: ProviderResult) {
+        for change in result.ids.iter().filter(|change| change.is_removal()) {
+            let (PartnerIdChange::OwnerRemove { source, .. }
+            | PartnerIdChange::WriterRemove { source, .. }) = change
+            else {
+                continue;
+            };
+            log::warn!(
+                "Identity provider '{}' put a removal for source '{}' in its result IDs; removals belong in partner_ids",
+                result.provider,
+                source.as_str(),
+            );
+        }
+        self.results.push(result);
+    }
+
+    /// Merges a state change into any earlier one for the same provider:
+    /// later `n`, last `f`, the later opt-out and clear, last non-`Keep`
+    /// `st`.
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn merge_state(
+        &mut self,
+        provider: IdentityProviderId,
+        change: ProviderStateChange,
+    ) {
+        self.provider_state
+            .entry(provider)
+            .or_default()
+            .merge(change);
+    }
+
+    /// Merges the state change of a `found` outcome and tags it, so
+    /// [`retain_for_error_status`](Self::retain_for_error_status) can drop
+    /// its `n` and `f` with the positive answer it belongs to.
+    pub(crate) fn merge_found_state(
+        &mut self,
+        provider: IdentityProviderId,
+        change: ProviderStateChange,
+    ) {
+        self.found_states.insert(provider.clone());
+        self.merge_state(provider, change);
+    }
+
+    /// Adds everything `other` holds, as if it had been staged here after
+    /// the changes already present.
+    pub(crate) fn absorb(&mut self, other: Self) {
+        let Self {
+            partner_ids,
+            provider_state,
+            results,
+            cluster_size,
+            found_states,
+        } = other;
+        self.partner_ids.extend(partner_ids);
+        for (provider, change) in provider_state {
+            self.merge_state(provider, change);
+        }
+        self.results.extend(results);
+        self.cluster_size = cluster_size.or(self.cluster_size);
+        self.found_states.extend(found_states);
+    }
+
+    /// Sets the cluster size to write.
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn set_cluster_size(&mut self, size: u32) {
+        self.cluster_size = Some(size);
+    }
+
+    /// How many changes the mutation holds: stand-alone ones, provider
+    /// results and provider state changes. Holds no UID, so it is safe to log.
+    #[must_use]
+    pub(crate) fn change_count(&self) -> usize {
+        self.partner_ids.len() + self.results.len() + self.provider_state.len()
+    }
+
+    /// The stand-alone changes, for tests that check what a caller staged.
+    #[cfg(test)]
+    pub(crate) fn positive_changes(&self) -> &[PartnerIdChange] {
+        &self.partner_ids
+    }
+
+    /// The stand-alone changes, removals and positives alike, for the
+    /// pending key.
+    #[must_use]
+    pub(crate) fn stand_alone_changes(&self) -> &[PartnerIdChange] {
+        &self.partner_ids
+    }
+
+    /// Each provider state change that holds an opt-out or clear, for the
+    /// pending key.
+    pub(crate) fn removal_states(
+        &self,
+    ) -> impl Iterator<Item = (&IdentityProviderId, &ProviderStateChange)> {
+        self.all_states().filter(|(_, state)| state.has_removal())
+    }
+
+    /// Whether nothing would change.
+    #[must_use]
+    pub(crate) fn is_empty(&self) -> bool {
+        self.partner_ids.is_empty()
+            && self.results.is_empty()
+            && self.cluster_size.is_none()
+            && self
+                .provider_state
+                .values()
+                .all(ProviderStateChange::is_noop)
+    }
+
+    /// Whether any removal, opt-out or clear is present.
+    #[must_use]
+    pub(crate) fn has_removals(&self) -> bool {
+        self.partner_ids.iter().any(PartnerIdChange::is_removal)
+            || self
+                .provider_state
+                .values()
+                .any(ProviderStateChange::has_removal)
+            || self.results.iter().any(|result| result.state.has_removal())
+    }
+
+    /// The provider and source of every removal, opt-out and clear, sorted and
+    /// de-duplicated. An opt-out or clear has no source. Holds no UID, so it
+    /// is safe to log.
+    #[must_use]
+    pub(crate) fn removal_labels(&self) -> Vec<(IdentityProviderId, Option<SourceDomain>)> {
+        let mut labels: Vec<_> = self
+            .partner_ids
+            .iter()
+            .filter_map(|change| match change {
+                PartnerIdChange::OwnerRemove {
+                    source, provider, ..
+                } => Some((provider.clone(), Some(source.clone()))),
+                PartnerIdChange::WriterRemove { source, writer } => {
+                    Some((writer.clone(), Some(source.clone())))
+                }
+                _ => None,
+            })
+            .collect();
+        labels.extend(
+            self.all_states()
+                .filter(|(_, state)| state.has_removal())
+                .map(|(provider, _)| (provider.clone(), None)),
+        );
+        labels.sort();
+        labels.dedup();
+        labels
+    }
+
+    /// A copy holding only the removals, opt-outs and clears, for the
+    /// removal write and the removal-only retry.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn removals(&self) -> Self {
+        let mut copy = Self {
+            partner_ids: self
+                .partner_ids
+                .iter()
+                .filter(|change| change.is_removal())
+                .cloned()
+                .collect(),
+            ..Self::default()
+        };
+        let states = self.provider_state.iter().chain(
+            self.results
+                .iter()
+                .map(|result| (&result.provider, &result.state)),
+        );
+        for (provider, state) in states {
+            if state.has_removal() {
+                copy.merge_state(provider.clone(), state.removals());
+            }
+        }
+        copy
+    }
+
+    /// Cuts the mutation down for a navigation whose origin status was not
+    /// 2xx or 304 (spec 5.1).
+    ///
+    /// Keeps every removal, opt-out and clear, the `n` and `f` of each
+    /// stand-alone state change that does not come from a `found` outcome,
+    /// and the cluster size. Drops browser ingest, every other positive
+    /// change, any stand-alone `st`, the `n` and `f` of a `found` outcome, and
+    /// each provider result whole, keeping only its opt-out and clear.
+    ///
+    /// A stand-alone state change carries the `n` and `f` of an outcome other
+    /// than a stateful `found`, whose scheduling rides in its result. A
+    /// stateless provider's `found` lands here too, and its tag
+    /// ([`merge_found_state`](Self::merge_found_state)) marks it for the cut.
+    pub(crate) fn retain_for_error_status(&mut self) {
+        self.partner_ids.retain(PartnerIdChange::is_removal);
+        for (provider, state) in &mut self.provider_state {
+            if self.found_states.contains(provider) {
+                *state = state.removals();
+            }
+            state.st = StateUpdate::Keep;
+        }
+        self.found_states.clear();
+        for result in core::mem::take(&mut self.results) {
+            if result.state.has_removal() {
+                self.merge_state(result.provider, result.state.removals());
+            }
+        }
+    }
+
+    /// Every provider state change that applies regardless of its result:
+    /// the standalone ones, and each result's.
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    fn all_states(&self) -> impl Iterator<Item = (&IdentityProviderId, &ProviderStateChange)> {
+        self.provider_state.iter().chain(
+            self.results
+                .iter()
+                .map(|result| (&result.provider, &result.state)),
+        )
+    }
+}
+
+/// What the merge needs besides the mutation and the live row.
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) struct ApplyContext<'a> {
+    pub(crate) now: u64,
+    pub(crate) random: &'a dyn RandomSource,
+    pub(crate) catalog: &'a ProviderCatalog,
+}
+
+/// The merged row.
+#[derive(Debug, Clone, PartialEq)]
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) struct Applied {
+    pub(crate) entry: KvEntry,
+    /// Whether the result differs from the live row. A caller skips the
+    /// write when it is `false`.
+    pub(crate) changed: bool,
+    /// Whether only the removals were applied, because the full result
+    /// failed validation.
+    pub(crate) removals_only: bool,
+}
+
+/// Merges `mutation` into `live` (spec 5.4).
+///
+/// A `ps` entry holding only default values is dropped during cleanup.
+///
+/// Apply order:
+///
+/// 1. A tombstone (`consent.ok == false`) gives `None`.
+/// 2. Removals, never skipped:
+///    - Every `OwnerRemove` whose `expected` equals `record_revision(live_record)`.
+///      A version 1 record matches `Revision::Unset`. It appends
+///      `set_hashes(&live_record.eids)` to `ps[provider].iv`.
+///    - Every `WriterRemove` whose live record has `w == writer`, or, when
+///      `writer` is capture-only and the source is one of its
+///      `capture_only_sources`, has no `w`. It appends the removed record's
+///      hashes to `ps[writer].ov`.
+///    - Each new opt-out applies when `at > live.o.at` (or there is no live
+///      `o`) and `at >= live.oc` (or there is no live `oc`). Applying it
+///      stores `o` and removes every live record that provider wrote, at any
+///      revision, and for a capture-only provider every record of its sources
+///      that no provider wrote, each adding its hashes to `ps.ov`.
+///    - Then each clear (`opt_out_clear`) that is strictly later than the
+///      provider's live `o.at` is stored as `oc` and empties `ps.ov`. A clear
+///      that is not later, or that finds no live opt-out, is dropped and
+///      writes nothing. `ps.iv` is never emptied.
+///    - Hashes always come from the record KV held. A removal that no longer
+///      applies adds none.
+/// 3. Positive changes:
+///    - A provider is opted out when its live `o` is set and its `oc` is not
+///      strictly later than `o.at`. Every change whose `record.w` is opted out
+///      is skipped, `OwnerWrite` and `FillMissing` alike.
+///    - For an owned source, every positive change is skipped while the owner
+///      is opted out, whoever wrote it, and an `OwnerWrite` or `FillMissing`
+///      any of whose UIDs hashes into the owner's `ps.iv` is skipped too. Both
+///      read the entry after step 2.
+///    - A `FillMissing` applies when the source is absent, or its record is
+///      expired, or its record's writer is not configured. It is skipped when
+///      the hash of any UID of its set is in the `ps.iv` or `ps.ov` of any
+///      provider in `catalog.claimants(source)`. A browser `FillMissing`
+///      (`record.w` is `None`) is also skipped when the source belongs to an
+///      opted-out capture-only provider's `capture_only_sources`.
+///    - An `OwnerWrite` applies when the live revision equals `expected`, or
+///      when `expected` is `None` and the source has no valid record with
+///      `w == record.w`. A browser-seeded value never blocks the owner.
+///    - A written record replaces the live record whole, never merges into it,
+///      so no entry of the old set survives. It gets a fresh `rv` and
+///      `at = record.at.or(now)`, and keeps the change's `w`.
+///    - Each `ProviderResult` applies only when every one of its ID changes
+///      would apply on its own and, when `expected_state` is `Some`,
+///      `StateRevision::of(live ps.st)` equals it. Its state change, `n` and
+///      `f` then apply with its IDs. Otherwise the whole result is dropped.
+/// 4. `ps` changes: `n` takes the later value, `f` is replaced, `st` is
+///    replaced or cleared. Then `cluster_size`. Then truncate each `ps.iv` and
+///    `ps.ov` from the front to `MAX_INVALIDATED_UIDS`. Then prune the `ps`
+///    entries of providers the catalog does not hold: each keeps only `o`,
+///    `oc` and `ov`, so a retired provider's opt-out survives its removal from
+///    config and holds again if it comes back, and an entry with none of them
+///    is dropped. While `ps` is over `MAX_PROVIDER_STATES`, drop retained
+///    entries first, oldest `o.at` first. Then drop expired records, except
+///    refresh anchors: the source's owner is configured and holds a `st`, and
+///    the record's `ru` has not passed.
+/// 5. `validate()`. On failure, rebuild from the live entry through
+///    [`apply_removals_only`], and if that also fails, give `None` and log.
+///    `validate()` checks the entry-set limits of spec 4.5, so a set that
+///    breaks one is dropped whole here and never trimmed.
+/// 6. `changed` is whether the result differs from `live`.
+#[must_use]
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) fn apply(
+    mutation: &IdentityMutation,
+    live: &KvEntry,
+    context: &ApplyContext<'_>,
+) -> Option<Applied> {
+    if !live.consent.ok {
+        return None;
+    }
+
+    let mut entry = live.clone();
+    apply_removals(&mut entry, mutation, context);
+    let accepted = apply_positive(&mut entry, mutation, context);
+    apply_state(&mut entry, mutation, &accepted);
+    finish_removal_fields(&mut entry, context);
+    drop_expired_records(&mut entry, context);
+
+    if let Err(message) = entry.validate() {
+        log::warn!("Identity mutation produced an invalid row, keeping removals only: {message}");
+        return apply_removals_only(mutation, live, context).map(|applied| Applied {
+            removals_only: true,
+            ..applied
+        });
+    }
+    let changed = &entry != live;
+    Some(Applied {
+        entry,
+        changed,
+        removals_only: false,
+    })
+}
+
+/// Applies only spec 5.4's steps 1, 2, 4 (`o`, `oc`, `iv` and `ov`), 5 and 6,
+/// for the capture removal write and the removal-only retry. It ignores every
+/// positive change, `n`, `f`, `st` and `cluster_size`.
+#[must_use]
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) fn apply_removals_only(
+    mutation: &IdentityMutation,
+    live: &KvEntry,
+    context: &ApplyContext<'_>,
+) -> Option<Applied> {
+    if !live.consent.ok {
+        return None;
+    }
+
+    let mut entry = live.clone();
+    apply_removals(&mut entry, mutation, context);
+    finish_removal_fields(&mut entry, context);
+
+    if let Err(message) = entry.validate() {
+        log::warn!("Identity removals produced an invalid row, dropping them: {message}");
+        return None;
+    }
+    let changed = &entry != live;
+    Some(Applied {
+        entry,
+        changed,
+        removals_only: true,
+    })
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn state_mut<'a>(entry: &'a mut KvEntry, provider: &IdentityProviderId) -> &'a mut KvProviderState {
+    entry.ps.entry(provider.to_string()).or_default()
+}
+
+/// Removes the record at `source` when `matches` accepts it, and hashes its
+/// set into the list `list` picks from `provider`'s state.
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn remove_record(
+    entry: &mut KvEntry,
+    source: &str,
+    matches: impl FnOnce(&KvPartnerId) -> bool,
+    provider: &IdentityProviderId,
+    list: fn(&mut KvProviderState) -> &mut Vec<String>,
+) {
+    if !entry.ids.get(source).is_some_and(matches) {
+        return;
+    }
+    if let Some(record) = entry.ids.remove(source) {
+        let hashes = set_hashes(&record.eids);
+        push_hashes(list(state_mut(entry, provider)), hashes);
+    }
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn invalidated(state: &mut KvProviderState) -> &mut Vec<String> {
+    &mut state.iv
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn opted_out_hashes(state: &mut KvProviderState) -> &mut Vec<String> {
+    &mut state.ov
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn apply_removals(entry: &mut KvEntry, mutation: &IdentityMutation, context: &ApplyContext<'_>) {
+    for change in &mutation.partner_ids {
+        match change {
+            PartnerIdChange::OwnerRemove {
+                source,
+                provider,
+                expected,
+            } => remove_record(
+                entry,
+                source.as_str(),
+                |record| record_revision(record) == *expected,
+                provider,
+                invalidated,
+            ),
+            PartnerIdChange::WriterRemove { source, writer } => {
+                let capture_only = context
+                    .catalog
+                    .capture_only_sources(writer)
+                    .contains(source);
+                remove_record(
+                    entry,
+                    source.as_str(),
+                    |record| match record.w.as_deref() {
+                        Some(written_by) => written_by == writer.as_str(),
+                        None => capture_only,
+                    },
+                    writer,
+                    opted_out_hashes,
+                );
+            }
+            PartnerIdChange::FillMissing { .. } | PartnerIdChange::OwnerWrite { .. } => {}
+        }
+    }
+
+    // A clear's watermark names an opt-out the clearing request read, so it
+    // applies before this mutation's own opt-outs, which it never saw.
+    for (provider, change) in mutation.all_states() {
+        if let Some(clear) = change.opt_out_clear {
+            apply_clear(entry, provider, clear);
+        }
+    }
+    for (provider, change) in mutation.all_states() {
+        if let Some(opt_out) = &change.opt_out {
+            apply_opt_out(entry, provider, opt_out, context);
+        }
+    }
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn apply_opt_out(
+    entry: &mut KvEntry,
+    provider: &IdentityProviderId,
+    opt_out: &KvOptOut,
+    context: &ApplyContext<'_>,
+) {
+    let live = entry.ps.get(provider.as_str());
+    let newer = live
+        .and_then(|state| state.o.as_ref())
+        .is_none_or(|existing| opt_out.at > existing.at);
+    let not_cleared_later = live
+        .and_then(|state| state.oc)
+        .is_none_or(|cleared| opt_out.at > cleared);
+    if !(newer && not_cleared_later) {
+        return;
+    }
+    state_mut(entry, provider).o = Some(opt_out.clone());
+
+    let capture_only_sources = context.catalog.capture_only_sources(provider);
+    let doomed: Vec<String> = entry
+        .ids
+        .iter()
+        .filter(|(source, record)| match record.w.as_deref() {
+            Some(written_by) => written_by == provider.as_str(),
+            None => capture_only_sources
+                .iter()
+                .any(|owned| owned.as_str() == source.as_str()),
+        })
+        .map(|(source, _)| source.clone())
+        .collect();
+    for source in doomed {
+        remove_record(entry, &source, |_| true, provider, opted_out_hashes);
+    }
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+/// Lifts the opt-out when `watermark`, the `at` of the newest opt-out the
+/// clearing request read, reaches it (spec 8). An opt-out the request never
+/// saw is newer than its watermark and stays.
+fn apply_clear(entry: &mut KvEntry, provider: &IdentityProviderId, watermark: u64) {
+    let Some(state) = entry.ps.get_mut(provider.as_str()) else {
+        return;
+    };
+    let lifts = state
+        .o
+        .as_ref()
+        .is_some_and(|opt_out| opt_out.at <= watermark)
+        && state.oc.is_none_or(|cleared| cleared < watermark);
+    if lifts {
+        state.oc = Some(watermark);
+        state.ov.clear();
+    }
+}
+
+/// Whether `provider` has a sticky opt-out in `entry` that no later clear lifts.
+pub(crate) fn is_opted_out(entry: &KvEntry, provider: &str) -> bool {
+    entry
+        .ps
+        .get(provider)
+        .and_then(|state| state.o.as_ref().map(|o| (o, state.oc)))
+        .is_some_and(|(opt_out, cleared)| cleared.is_none_or(|cleared| cleared < opt_out.at))
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn is_expired(record: &KvPartnerId, now: u64) -> bool {
+    record.exp.is_some_and(|exp| exp <= now)
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn change_applies(entry: &KvEntry, change: &PartnerIdChange, context: &ApplyContext<'_>) -> bool {
+    if let PartnerIdChange::FillMissing { source, record }
+    | PartnerIdChange::OwnerWrite { source, record, .. } = change
+        && owner_denies(entry, source, record, context)
+    {
+        return false;
+    }
+    match change {
+        PartnerIdChange::FillMissing { source, record } => {
+            fill_applies(entry, source, record, context)
+        }
+        PartnerIdChange::OwnerWrite {
+            source,
+            record,
+            expected,
+        } => {
+            if record
+                .w
+                .as_deref()
+                .is_some_and(|writer| is_opted_out(entry, writer))
+            {
+                return false;
+            }
+            let live = entry.ids.get(source.as_str());
+            match expected {
+                Some(expected) => live.is_some_and(|live| record_revision(live) == *expected),
+                None => !live.is_some_and(|live| {
+                    live.w.is_some() && live.w == record.w && !is_expired(live, context.now)
+                }),
+            }
+        }
+        PartnerIdChange::OwnerRemove { .. } | PartnerIdChange::WriterRemove { .. } => false,
+    }
+}
+
+/// Whether the source's owner denies a positive change: while the owner is
+/// opted out, nothing fills its source, and no writer, the owner included,
+/// stores a UID the owner invalidated. Both are read after step 2, so an
+/// opt-out or invalidation in the same mutation counts.
+fn owner_denies(
+    entry: &KvEntry,
+    source: &SourceDomain,
+    record: &KvPartnerId,
+    context: &ApplyContext<'_>,
+) -> bool {
+    let Some(owner) = context.catalog.owner_of(source) else {
+        return false;
+    };
+    if is_opted_out(entry, owner.as_str()) {
+        return true;
+    }
+    entry.ps.get(owner.as_str()).is_some_and(|state| {
+        set_hashes(&record.eids)
+            .iter()
+            .any(|hash| state.iv.contains(hash))
+    })
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn fill_applies(
+    entry: &KvEntry,
+    source: &SourceDomain,
+    record: &KvPartnerId,
+    context: &ApplyContext<'_>,
+) -> bool {
+    match &record.w {
+        Some(writer) if is_opted_out(entry, writer) => return false,
+        Some(_) => {}
+        None => {
+            let blocked = context.catalog.providers().any(|provider| {
+                let id = provider.descriptor().id();
+                is_opted_out(entry, id.as_str())
+                    && context.catalog.capture_only_sources(id).contains(source)
+            });
+            if blocked {
+                return false;
+            }
+        }
+    }
+
+    let open = entry.ids.get(source.as_str()).is_none_or(|live| {
+        is_expired(live, context.now)
+            || live.w.as_deref().is_some_and(|writer| {
+                !writer
+                    .parse::<IdentityProviderId>()
+                    .is_ok_and(|id| context.catalog.is_configured(&id))
+            })
+    });
+    if !open {
+        return false;
+    }
+
+    let hashes = set_hashes(&record.eids);
+    !context.catalog.claimants(source).any(|claimant| {
+        entry.ps.get(claimant.as_str()).is_some_and(|state| {
+            hashes
+                .iter()
+                .any(|hash| state.iv.contains(hash) || state.ov.contains(hash))
+        })
+    })
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn write_change(entry: &mut KvEntry, change: &PartnerIdChange, context: &ApplyContext<'_>) {
+    let (PartnerIdChange::FillMissing { source, record }
+    | PartnerIdChange::OwnerWrite { source, record, .. }) = change
+    else {
+        return;
+    };
+    let mut written = record.clone();
+    written.rv = Some(new_revision(context.random).as_str().to_owned());
+    written.at = record.at.or(Some(context.now));
+    entry.ids.insert(source.to_string(), written);
+}
+
+/// Applies the positive changes and returns the state changes that go with
+/// them: every standalone one, and those of the results that applied.
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn apply_positive<'a>(
+    entry: &mut KvEntry,
+    mutation: &'a IdentityMutation,
+    context: &ApplyContext<'_>,
+) -> Vec<(&'a IdentityProviderId, &'a ProviderStateChange)> {
+    for change in &mutation.partner_ids {
+        if !change.is_removal() && change_applies(entry, change, context) {
+            write_change(entry, change, context);
+        }
+    }
+
+    let mut accepted: Vec<_> = mutation.provider_state.iter().collect();
+    for result in &mutation.results {
+        let changes = || result.ids.iter().filter(|change| !change.is_removal());
+        let state_matches = result.expected_state.as_ref().is_none_or(|expected| {
+            let live = entry
+                .ps
+                .get(result.provider.as_str())
+                .and_then(|state| state.st.as_ref());
+            StateRevision::of(live) == *expected
+        });
+        if state_matches && changes().all(|change| change_applies(entry, change, context)) {
+            for change in changes() {
+                write_change(entry, change, context);
+            }
+            accepted.push((&result.provider, &result.state));
+        }
+    }
+    accepted
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn apply_state(
+    entry: &mut KvEntry,
+    mutation: &IdentityMutation,
+    accepted: &[(&IdentityProviderId, &ProviderStateChange)],
+) {
+    for (provider, change) in accepted {
+        if change.n.is_some() || change.f.is_some() || change.st != StateUpdate::Keep {
+            let state = state_mut(entry, provider);
+            state.n = state.n.max(change.n);
+            if let Some(failures) = change.f {
+                state.f = failures;
+            }
+            match &change.st {
+                StateUpdate::Keep => {}
+                StateUpdate::Replace(value) => state.st = Some(value.clone()),
+                StateUpdate::Clear => state.st = None,
+            }
+        }
+    }
+    if let Some(size) = mutation.cluster_size {
+        entry.network = Some(KvNetwork {
+            cluster_size: Some(size),
+        });
+    }
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn is_configured(entry_key: &str, context: &ApplyContext<'_>) -> bool {
+    entry_key
+        .parse::<IdentityProviderId>()
+        .is_ok_and(|id| context.catalog.is_configured(&id))
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn finish_removal_fields(entry: &mut KvEntry, context: &ApplyContext<'_>) {
+    for state in entry.ps.values_mut() {
+        for list in [&mut state.iv, &mut state.ov] {
+            let excess = list.len().saturating_sub(MAX_INVALIDATED_UIDS);
+            list.drain(..excess);
+        }
+    }
+
+    for (provider, state) in &mut entry.ps {
+        if !is_configured(provider, context) {
+            *state = KvProviderState {
+                o: state.o.take(),
+                oc: state.oc.take(),
+                ov: std::mem::take(&mut state.ov),
+                ..KvProviderState::default()
+            };
+        }
+    }
+    entry
+        .ps
+        .retain(|_, state| *state != KvProviderState::default());
+
+    while entry.ps.len() > MAX_PROVIDER_STATES {
+        let oldest = entry
+            .ps
+            .iter()
+            .filter(|(provider, _)| !is_configured(provider, context))
+            .min_by_key(|(_, state)| state.o.as_ref().map(|o| o.at))
+            .map(|(provider, _)| provider.clone());
+        let Some(oldest) = oldest else {
+            break;
+        };
+        entry.ps.remove(&oldest);
+    }
+}
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+fn drop_expired_records(entry: &mut KvEntry, context: &ApplyContext<'_>) {
+    let ps = &entry.ps;
+    entry.ids.retain(|source, record| {
+        if !is_expired(record, context.now) {
+            return true;
+        }
+        let Some(owner) = source
+            .parse::<SourceDomain>()
+            .ok()
+            .and_then(|source| context.catalog.owner_of(&source).cloned())
+            .filter(|owner| context.catalog.is_configured(owner))
+        else {
+            return false;
+        };
+        // A stateful owner anchors the record until its `ru`.
+        let state_anchor = ps
+            .get(owner.as_str())
+            .is_some_and(|state| state.st.is_some())
+            && record.ru.is_some_and(|ru| context.now < ru);
+        // A stateless owner anchors a record it wrote until `exp` plus the
+        // refresh grace its descriptor declares.
+        let grace_anchor = record.w.as_deref() == Some(owner.as_str())
+            && record.exp.is_some_and(|exp| {
+                context
+                    .catalog
+                    .get(&owner)
+                    .and_then(|provider| provider.descriptor().resolves())
+                    .and_then(Resolves::refresh_grace)
+                    .is_some_and(|grace| context.now < exp.saturating_add(grace.as_secs()))
+            });
+        state_anchor || grace_anchor
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+    use crate::ec::identity::catalog::ProviderCatalog;
+    use crate::ec::identity::descriptor::{ConsentPolicy, ProviderDescriptor};
+    use crate::ec::identity::input::SeededRandom;
+    use crate::ec::identity::revision::{RecordRevision, StateRevision, set_hashes, uid_hash};
+    use crate::ec::identity::test_support::{
+        example_entry_set, fixed_capture_provider, fixed_provider, full_record, provider_from,
+    };
+    use crate::ec::kv_types::{
+        KvEntry, KvOptOut, KvPartnerId, KvProviderState, MAX_INVALIDATED_UIDS, MAX_PROVIDER_STATES,
+    };
+
+    const NOW: u64 = 1_000;
+
+    fn src(name: &str) -> SourceDomain {
+        name.parse().expect("should parse the source")
+    }
+
+    fn pid(name: &str) -> IdentityProviderId {
+        name.parse().expect("should parse the provider ID")
+    }
+
+    fn rev(value: &str) -> Revision {
+        Revision::Set(RecordRevision::from_stored(value))
+    }
+
+    /// `owner` owns a.example.com, `other` claims b.example.com unowned, and
+    /// the capture-only `cap` is narrowed to c.example.com.
+    fn catalog() -> ProviderCatalog {
+        ProviderCatalog::new(
+            vec![
+                fixed_provider("owner", &["a.example.com"]),
+                fixed_provider("other", &["b.example.com"]),
+                fixed_capture_provider("cap", &["c.example.com"]),
+            ],
+            [(src("a.example.com"), pid("owner"))].into_iter().collect(),
+        )
+    }
+
+    fn run(mutation: &IdentityMutation, live: &KvEntry) -> Option<Applied> {
+        let random = SeededRandom::new(1);
+        let catalog = catalog();
+        apply(
+            mutation,
+            live,
+            &ApplyContext {
+                now: NOW,
+                random: &random,
+                catalog: &catalog,
+            },
+        )
+    }
+
+    fn run_removals(mutation: &IdentityMutation, live: &KvEntry) -> Option<Applied> {
+        let random = SeededRandom::new(1);
+        let catalog = catalog();
+        apply_removals_only(
+            mutation,
+            live,
+            &ApplyContext {
+                now: NOW,
+                random: &random,
+                catalog: &catalog,
+            },
+        )
+    }
+
+    fn written(writer: &str, uid: &str, rv: &str) -> KvPartnerId {
+        KvPartnerId {
+            w: Some(writer.to_owned()),
+            rv: Some(rv.to_owned()),
+            at: Some(900),
+            ..KvPartnerId::new(uid)
+        }
+    }
+
+    fn opt_out(at: u64) -> ProviderStateChange {
+        ProviderStateChange {
+            opt_out: Some(KvOptOut {
+                at,
+                fp: "1".to_owned(),
+            }),
+            ..ProviderStateChange::default()
+        }
+    }
+
+    fn fill(source: &str, record: KvPartnerId) -> PartnerIdChange {
+        PartnerIdChange::FillMissing {
+            source: src(source),
+            record,
+        }
+    }
+
+    #[test]
+    fn retain_for_error_status_keeps_removals_and_backoff() {
+        let removal = PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: Revision::Unset,
+        };
+        let backoff = ProviderStateChange {
+            n: Some(NOW + 86_400),
+            ..ProviderStateChange::default()
+        };
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("b.example.com", KvPartnerId::browser("u", Some(NOW))));
+        mutation.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: written("owner", "found-uid", "1111111111111111"),
+            expected: None,
+        });
+        mutation.add_change(removal.clone());
+        mutation.merge_state(pid("other"), backoff.clone());
+
+        mutation.retain_for_error_status();
+
+        let mut expected = IdentityMutation::default();
+        expected.add_change(removal);
+        expected.merge_state(pid("other"), backoff);
+        assert_eq!(
+            mutation, expected,
+            "should keep only the removal and the no_match backoff"
+        );
+    }
+
+    #[test]
+    fn retain_for_error_status_drops_the_scheduling_of_a_found_and_keeps_its_opt_out() {
+        let opt_out = KvOptOut {
+            at: NOW,
+            fp: "1".to_owned(),
+        };
+        let found = ProviderStateChange {
+            n: Some(NOW + 60),
+            f: Some(0),
+            opt_out: Some(opt_out.clone()),
+            ..ProviderStateChange::default()
+        };
+        let backoff = ProviderStateChange {
+            n: Some(NOW + 86_400),
+            f: Some(3),
+            ..ProviderStateChange::default()
+        };
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_found_state(pid("found"), found);
+        mutation.merge_state(pid("other"), backoff.clone());
+
+        mutation.retain_for_error_status();
+
+        let mut expected = IdentityMutation::default();
+        expected.merge_state(
+            pid("found"),
+            ProviderStateChange {
+                opt_out: Some(opt_out),
+                ..ProviderStateChange::default()
+            },
+        );
+        expected.merge_state(pid("other"), backoff);
+        assert_eq!(
+            mutation, expected,
+            "should keep the found's opt-out and the other outcome's n and f, and drop the found's n and f"
+        );
+    }
+
+    #[test]
+    fn absorb_adds_changes_states_and_found_tags_after_the_existing_ones() {
+        let mut base = IdentityMutation::default();
+        base.add_change(fill("a.example.com", KvPartnerId::browser("u", Some(NOW))));
+        base.merge_state(
+            pid("p"),
+            ProviderStateChange {
+                n: Some(10),
+                ..ProviderStateChange::default()
+            },
+        );
+        let mut other = IdentityMutation::default();
+        other.add_change(fill("b.example.com", KvPartnerId::browser("v", Some(NOW))));
+        other.merge_found_state(
+            pid("p"),
+            ProviderStateChange {
+                n: Some(20),
+                f: Some(0),
+                ..ProviderStateChange::default()
+            },
+        );
+
+        base.absorb(other);
+
+        let mut expected = IdentityMutation::default();
+        expected.add_change(fill("a.example.com", KvPartnerId::browser("u", Some(NOW))));
+        expected.add_change(fill("b.example.com", KvPartnerId::browser("v", Some(NOW))));
+        expected.merge_found_state(
+            pid("p"),
+            ProviderStateChange {
+                n: Some(20),
+                f: Some(0),
+                ..ProviderStateChange::default()
+            },
+        );
+        assert_eq!(
+            base, expected,
+            "should hold both mutations, the found tag included"
+        );
+    }
+
+    #[test]
+    fn tombstone_drops_everything() {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("b.example.com", KvPartnerId::browser("u", Some(NOW))));
+        assert!(
+            run(&mutation, &KvEntry::tombstone(1)).is_none(),
+            "should drop on a tombstone"
+        );
+        assert!(
+            run_removals(&mutation, &KvEntry::tombstone(1)).is_none(),
+            "should drop removals on a tombstone"
+        );
+    }
+
+    #[test]
+    fn fill_missing_fills_absent_expired_and_unconfigured_only() {
+        let mut live = KvEntry::minimal("b.example.com", "existing", 1);
+        live.ids.insert(
+            "d.example.com".to_owned(),
+            KvPartnerId {
+                exp: Some(NOW),
+                ..KvPartnerId::new("old")
+            },
+        );
+        live.ids.insert(
+            "f.example.com".to_owned(),
+            written("retired", "stale", "1111111111111111"),
+        );
+        let mut mutation = IdentityMutation::default();
+        for source in [
+            "b.example.com",
+            "d.example.com",
+            "e.example.com",
+            "f.example.com",
+        ] {
+            mutation.add_change(fill(source, KvPartnerId::browser("new", Some(NOW))));
+        }
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        let uid = |source: &str| applied.entry.ids[source].first_uid().map(str::to_owned);
+        assert_eq!(
+            uid("b.example.com").as_deref(),
+            Some("existing"),
+            "should not replace a live value"
+        );
+        assert_eq!(
+            uid("d.example.com").as_deref(),
+            Some("new"),
+            "should replace an expired value"
+        );
+        assert_eq!(
+            uid("e.example.com").as_deref(),
+            Some("new"),
+            "should fill an absent source"
+        );
+        assert_eq!(
+            uid("f.example.com").as_deref(),
+            Some("new"),
+            "should treat an unconfigured writer as absent"
+        );
+        let record = &applied.entry.ids["e.example.com"];
+        assert_eq!(
+            (record.at, record.w.as_deref()),
+            (Some(NOW), None),
+            "should be a browser record"
+        );
+        assert!(
+            record.rv.is_some(),
+            "should give every record it writes an rv"
+        );
+    }
+
+    #[test]
+    fn owner_write_checks_revision_and_gets_a_fresh_rv() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "v1", "1111111111111111"),
+        );
+        let write = |expected| {
+            let mut mutation = IdentityMutation::default();
+            mutation.add_change(PartnerIdChange::OwnerWrite {
+                source: src("a.example.com"),
+                record: KvPartnerId {
+                    w: Some("owner".to_owned()),
+                    ..KvPartnerId::new("v2")
+                },
+                expected,
+            });
+            run(&mutation, &live).expect("should apply")
+        };
+
+        assert!(
+            !write(Some(rev("2222222222222222"))).changed,
+            "should lose a stale revision to the newer write"
+        );
+        let applied = write(Some(rev("1111111111111111")));
+        let record = &applied.entry.ids["a.example.com"];
+        assert_eq!(record.first_uid(), Some("v2"), "should write");
+        assert_eq!(record.w.as_deref(), Some("owner"), "should keep the writer");
+        assert_ne!(
+            record.rv.as_deref(),
+            Some("1111111111111111"),
+            "should draw a new rv"
+        );
+        assert_eq!(record.at, Some(NOW), "should stamp at");
+    }
+
+    #[test]
+    fn owner_write_replaces_the_whole_set_and_leaves_other_sources() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId {
+                rv: Some("1111111111111111".to_owned()),
+                ..full_record(Some("owner"), example_entry_set())
+            },
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: KvPartnerId {
+                w: Some("owner".to_owned()),
+                ..KvPartnerId::new("only")
+            },
+            expected: Some(rev("1111111111111111")),
+        });
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert_eq!(
+            applied.entry.ids["a.example.com"],
+            KvPartnerId {
+                rv: applied.entry.ids["a.example.com"].rv.clone(),
+                at: Some(NOW),
+                w: Some("owner".to_owned()),
+                ..KvPartnerId::new("only")
+            },
+            "should keep no entry of the old set"
+        );
+        assert_eq!(
+            applied.entry.ids["b.example.com"].first_uid(),
+            Some("x"),
+            "should leave other sources alone"
+        );
+
+        let mut full = IdentityMutation::default();
+        full.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: full_record(Some("owner"), example_entry_set()),
+            expected: None,
+        });
+        let applied = run(&full, &KvEntry::minimal("b.example.com", "x", 1)).expect("should apply");
+        assert_eq!(
+            applied.entry.ids["a.example.com"].eids,
+            example_entry_set(),
+            "should write every entry, in order"
+        );
+    }
+
+    #[test]
+    fn browser_seeded_and_version_1_values_never_block_the_owner() {
+        let live = KvEntry::minimal("a.example.com", "seeded", 1);
+        let mut write = IdentityMutation::default();
+        write.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: KvPartnerId {
+                w: Some("owner".to_owned()),
+                ..KvPartnerId::new("owned")
+            },
+            expected: None,
+        });
+        assert_eq!(
+            run(&write, &live).expect("should apply").entry.ids["a.example.com"].first_uid(),
+            Some("owned"),
+            "should let the owner take over a seeded value"
+        );
+
+        let mut remove = IdentityMutation::default();
+        remove.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: Revision::Unset,
+        });
+        let applied = run(&remove, &live).expect("should apply");
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should match a record without rv as Unset"
+        );
+        assert_eq!(
+            applied.entry.ps["owner"].iv,
+            vec![uid_hash("seeded")],
+            "should hash the removed UID into iv"
+        );
+    }
+
+    #[test]
+    fn an_applied_invalidation_hashes_every_uid_of_the_live_set() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId {
+                rv: Some("1111111111111111".to_owned()),
+                ..full_record(Some("owner"), example_entry_set())
+            },
+        );
+        let invalidate = |expected: &str| {
+            let mut mutation = IdentityMutation::default();
+            mutation.add_change(PartnerIdChange::OwnerRemove {
+                source: src("a.example.com"),
+                provider: pid("owner"),
+                expected: rev(expected),
+            });
+            run(&mutation, &live).expect("should apply")
+        };
+
+        let applied = invalidate("1111111111111111");
+        let stale = invalidate("2222222222222222");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should remove the set"
+        );
+        assert_eq!(
+            applied.entry.ps["owner"].iv,
+            set_hashes(&example_entry_set()),
+            "should hash every UID it removed"
+        );
+        assert!(
+            stale.entry.ids.contains_key("a.example.com"),
+            "should keep a set at another revision"
+        );
+        assert!(
+            stale
+                .entry
+                .ps
+                .get("owner")
+                .is_none_or(|state| state.iv.is_empty()),
+            "should add no hash"
+        );
+    }
+
+    /// A live row where `owner` wrote `uid` on a.example.com at rv `1111…`.
+    fn owned_row(uid: &str) -> KvEntry {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", uid, "1111111111111111"),
+        );
+        live
+    }
+
+    #[test]
+    fn an_invalidation_and_a_browser_refill_of_the_same_uid_leave_it_removed() {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+        mutation.add_change(fill(
+            "a.example.com",
+            KvPartnerId::browser("uid-a", Some(950)),
+        ));
+
+        let applied = run(&mutation, &owned_row("uid-a")).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should not refill the UID the same mutation invalidated"
+        );
+        assert!(
+            !applied.entry.ps["owner"].iv.is_empty(),
+            "should record the invalidation"
+        );
+    }
+
+    #[test]
+    fn an_opted_out_owner_blocks_every_positive_change_to_its_sources() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                o: Some(KvOptOut {
+                    at: 500,
+                    fp: "1".to_owned(),
+                }),
+                ..KvProviderState::default()
+            },
+        );
+        let browser = fill("a.example.com", KvPartnerId::browser("new-uid", Some(950)));
+        let other_writer = fill(
+            "a.example.com",
+            written("other", "new-uid", "2222222222222222"),
+        );
+
+        for change in [browser, other_writer] {
+            let mut mutation = IdentityMutation::default();
+            mutation.add_change(change.clone());
+
+            let applied = run(&mutation, &live).expect("should apply");
+
+            assert!(
+                !applied.entry.ids.contains_key("a.example.com"),
+                "should skip {change:?} while the owner is opted out"
+            );
+        }
+
+        let mut control = IdentityMutation::default();
+        control.add_change(fill(
+            "b.example.com",
+            KvPartnerId::browser("new-uid", Some(950)),
+        ));
+        let applied =
+            run(&control, &KvEntry::minimal("c.example.com", "x", 1)).expect("should apply");
+        assert!(
+            applied.entry.ids.contains_key("b.example.com"),
+            "control: should fill a source the opted-out owner does not own"
+        );
+    }
+
+    #[test]
+    fn an_owner_opt_out_in_the_same_mutation_blocks_a_browser_refill() {
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(pid("owner"), opt_out(1_000));
+        mutation.add_change(fill(
+            "a.example.com",
+            KvPartnerId::browser("new-uid", Some(950)),
+        ));
+
+        let applied = run(&mutation, &owned_row("uid-a")).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should neither keep the owner's record nor take the browser's"
+        );
+    }
+
+    #[test]
+    fn an_owner_write_of_an_invalidated_uid_is_skipped() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                iv: vec![uid_hash("uid-a")],
+                ..KvProviderState::default()
+            },
+        );
+        let owner_write = |uid: &str| {
+            let mut mutation = IdentityMutation::default();
+            mutation.add_change(PartnerIdChange::OwnerWrite {
+                source: src("a.example.com"),
+                record: written("owner", uid, "3333333333333333"),
+                expected: None,
+            });
+            run(&mutation, &live).expect("should apply")
+        };
+
+        assert!(
+            !owner_write("uid-a").entry.ids.contains_key("a.example.com"),
+            "should not store a UID the owner invalidated"
+        );
+        assert!(
+            owner_write("uid-b").entry.ids.contains_key("a.example.com"),
+            "control: should store another UID"
+        );
+    }
+
+    #[test]
+    fn iv_keeps_the_128_most_recent_hashes() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        let old: Vec<String> = (0..MAX_INVALIDATED_UIDS)
+            .map(|index| format!("{index:016x}"))
+            .collect();
+        live.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                iv: old.clone(),
+                ..KvProviderState::default()
+            },
+        );
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "u", "1111111111111111"),
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        let iv = &applied.entry.ps["owner"].iv;
+        assert_eq!(iv.len(), MAX_INVALIDATED_UIDS, "should cap at 128");
+        assert_eq!(iv[..127], old[1..], "should drop the oldest hash");
+        assert_eq!(iv[127], uid_hash("u"), "should append the new hash");
+    }
+
+    #[test]
+    fn opt_out_removes_what_the_writer_wrote_fills_ov_and_skips_its_changes() {
+        let mut live = KvEntry::minimal("e.example.com", "browser", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "v1", "1111111111111111"),
+        );
+        live.ids.insert(
+            "b.example.com".to_owned(),
+            written("owner", "unowned-by-owner", "2222222222222222"),
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(pid("owner"), opt_out(NOW));
+        mutation.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: KvPartnerId {
+                w: Some("owner".to_owned()),
+                ..KvPartnerId::new("v2")
+            },
+            expected: None,
+        });
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should remove the owned record"
+        );
+        assert!(
+            !applied.entry.ids.contains_key("b.example.com"),
+            "should remove the unowned record it wrote"
+        );
+        assert_eq!(
+            applied.entry.ids["e.example.com"].first_uid(),
+            Some("browser"),
+            "should leave other records"
+        );
+        let state = &applied.entry.ps["owner"];
+        assert_eq!(
+            state.o.as_ref().map(|o| o.at),
+            Some(NOW),
+            "should store the opt-out"
+        );
+        assert_eq!(
+            state.ov,
+            vec![uid_hash("v1"), uid_hash("unowned-by-owner")],
+            "should hash what it removed into ov"
+        );
+        assert!(state.iv.is_empty(), "should leave iv for invalidations");
+    }
+
+    #[test]
+    fn a_capture_only_opt_out_removes_browser_records_of_its_sources_and_blocks_their_fill() {
+        let mut live = KvEntry::minimal("c.example.com", "browser-c", 1);
+        live.ids
+            .insert("e.example.com".to_owned(), KvPartnerId::new("browser-e"));
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(pid("cap"), opt_out(NOW));
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("c.example.com"),
+            "should remove a browser record of its source"
+        );
+        assert!(
+            applied.entry.ids.contains_key("e.example.com"),
+            "should leave a source it is not narrowed to"
+        );
+
+        let mut refill = IdentityMutation::default();
+        refill.add_change(fill(
+            "c.example.com",
+            KvPartnerId::browser("another", Some(NOW)),
+        ));
+        let applied = run(&refill, &applied.entry).expect("should apply");
+        assert!(
+            !applied.entry.ids.contains_key("c.example.com"),
+            "should skip a browser fill while it is opted out"
+        );
+    }
+
+    #[test]
+    fn a_clear_lifts_only_the_opt_out_it_saw() {
+        let mut opted = KvEntry::minimal("b.example.com", "x", 1);
+        opted.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                o: Some(KvOptOut {
+                    at: 900,
+                    fp: "1".to_owned(),
+                }),
+                ov: vec![uid_hash("opted-out")],
+                ..KvProviderState::default()
+            },
+        );
+        let clear_up_to = |watermark: u64| {
+            let mut clear = IdentityMutation::default();
+            clear.merge_state(
+                pid("owner"),
+                ProviderStateChange {
+                    opt_out_clear: Some(watermark),
+                    ..ProviderStateChange::default()
+                },
+            );
+            run(&clear, &opted)
+        };
+
+        let seen = clear_up_to(900).expect("should apply");
+        assert_eq!(
+            seen.entry.ps["owner"].oc,
+            Some(900),
+            "should store the at of the opt-out the clear saw"
+        );
+        assert!(
+            !is_opted_out(&seen.entry, "owner"),
+            "should lift the opt-out it saw"
+        );
+        assert!(
+            clear_up_to(899).is_none_or(|applied| is_opted_out(&applied.entry, "owner")),
+            "should leave an opt-out newer than the one the clear saw"
+        );
+
+        let mut reopted = IdentityMutation::default();
+        reopted.merge_state(pid("owner"), opt_out(901));
+        let again = run(&reopted, &seen.entry).expect("should apply");
+        assert!(
+            is_opted_out(&again.entry, "owner"),
+            "should apply a later opt-out over the clear"
+        );
+    }
+
+    #[test]
+    fn opt_out_and_clear_ordering() {
+        let live = KvEntry::minimal("b.example.com", "x", 1);
+        let mut same_second = IdentityMutation::default();
+        same_second.merge_state(
+            pid("owner"),
+            ProviderStateChange {
+                opt_out_clear: Some(NOW),
+                ..opt_out(NOW)
+            },
+        );
+        let applied = run(&same_second, &live).expect("should apply");
+        assert!(
+            applied.entry.ps["owner"].o.is_some(),
+            "should stay opted out"
+        );
+        assert_eq!(
+            applied.entry.ps["owner"].oc, None,
+            "should drop a clear that is not later"
+        );
+
+        let mut no_opt_out = IdentityMutation::default();
+        no_opt_out.merge_state(
+            pid("owner"),
+            ProviderStateChange {
+                opt_out_clear: Some(NOW),
+                ..ProviderStateChange::default()
+            },
+        );
+        assert!(
+            !run(&no_opt_out, &live).expect("should apply").changed,
+            "should drop a clear with nothing to clear"
+        );
+
+        let mut opted = live.clone();
+        opted.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                o: Some(KvOptOut {
+                    at: 900,
+                    fp: "1".to_owned(),
+                }),
+                iv: vec![uid_hash("invalidated")],
+                ov: vec![uid_hash("opted-out")],
+                ..KvProviderState::default()
+            },
+        );
+        let mut clear = IdentityMutation::default();
+        clear.merge_state(
+            pid("owner"),
+            ProviderStateChange {
+                opt_out_clear: Some(NOW),
+                ..ProviderStateChange::default()
+            },
+        );
+        let state = &run(&clear, &opted).expect("should apply").entry.ps["owner"];
+        assert_eq!(state.oc, Some(NOW), "should store the clear's watermark");
+        assert!(state.ov.is_empty(), "should empty ov");
+        assert_eq!(
+            state.iv,
+            vec![uid_hash("invalidated")],
+            "should never empty iv"
+        );
+
+        let mut older = IdentityMutation::default();
+        older.merge_state(pid("owner"), opt_out(899));
+        assert!(
+            !run(&older, &opted).expect("should apply").changed,
+            "should drop an opt-out not after the live one"
+        );
+    }
+
+    #[test]
+    fn fill_missing_is_skipped_when_any_uid_is_in_a_claimants_iv_or_ov() {
+        let mut live = KvEntry::minimal("e.example.com", "x", 1);
+        live.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                iv: vec![uid_hash("example-b")],
+                ..KvProviderState::default()
+            },
+        );
+        live.ps.insert(
+            "other".to_owned(),
+            KvProviderState {
+                ov: vec![uid_hash("removed")],
+                ..KvProviderState::default()
+            },
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill(
+            "a.example.com",
+            full_record(None, example_entry_set()),
+        ));
+        mutation.add_change(fill(
+            "b.example.com",
+            KvPartnerId::browser("removed", Some(NOW)),
+        ));
+        mutation.add_change(fill(
+            "d.example.com",
+            KvPartnerId::browser("removed", Some(NOW)),
+        ));
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should block an owned set on its second UID"
+        );
+        assert!(
+            !applied.entry.ids.contains_key("b.example.com"),
+            "should block an unowned source by its claimant's ov"
+        );
+        assert!(
+            applied.entry.ids.contains_key("d.example.com"),
+            "should not block a source no denying provider claims"
+        );
+    }
+
+    #[test]
+    fn provider_result_applies_atomically() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "newer", "3333333333333333"),
+        );
+        live.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                st: Some(json!({ "token": "B" })),
+                ..KvProviderState::default()
+            },
+        );
+        let result = |expected, expected_state| ProviderResult {
+            provider: pid("owner"),
+            ids: vec![PartnerIdChange::OwnerWrite {
+                source: src("a.example.com"),
+                record: KvPartnerId {
+                    w: Some("owner".to_owned()),
+                    ..KvPartnerId::new("mine")
+                },
+                expected: Some(expected),
+            }],
+            state: ProviderStateChange {
+                st: StateUpdate::Replace(json!({ "token": "A" })),
+                f: Some(0),
+                ..ProviderStateChange::default()
+            },
+            expected_state,
+        };
+
+        let mut lost_id = IdentityMutation::default();
+        lost_id.add_result(result(
+            rev("1111111111111111"),
+            Some(StateRevision::of(Some(&json!({ "token": "B" })))),
+        ));
+        let mut lost_state = IdentityMutation::default();
+        lost_state.add_result(result(
+            rev("3333333333333333"),
+            Some(StateRevision::of(Some(&json!({ "token": "A0" })))),
+        ));
+        let mut wins = IdentityMutation::default();
+        wins.add_result(result(
+            rev("3333333333333333"),
+            Some(StateRevision::of(Some(&json!({ "token": "B" })))),
+        ));
+
+        for (name, mutation) in [("an ID", lost_id), ("the state", lost_state)] {
+            assert!(
+                !run(&mutation, &live).expect("should apply").changed,
+                "should drop the whole result when {name} lost"
+            );
+        }
+        let applied = run(&wins, &live).expect("should apply");
+        assert_eq!(
+            applied.entry.ids["a.example.com"].first_uid(),
+            Some("mine"),
+            "should write the ID"
+        );
+        assert_eq!(
+            applied.entry.ps["owner"].st,
+            Some(json!({ "token": "A" })),
+            "should write the state with it"
+        );
+    }
+
+    #[test]
+    fn refresh_anchor_survives_until_ru_or_state_loss() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId {
+                exp: Some(NOW - 1),
+                ru: Some(NOW + 100),
+                ..written("owner", "expired", "1111111111111111")
+            },
+        );
+        live.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                st: Some(json!({ "r": 1 })),
+                ..KvProviderState::default()
+            },
+        );
+        let mut unrelated = IdentityMutation::default();
+        unrelated.set_cluster_size(1);
+
+        assert!(
+            run(&unrelated, &live)
+                .expect("should apply")
+                .entry
+                .ids
+                .contains_key("a.example.com"),
+            "should keep the anchor"
+        );
+        live.ps
+            .get_mut("owner")
+            .expect("should hold the owner's state")
+            .st = None;
+        assert!(
+            !run(&unrelated, &live)
+                .expect("should apply")
+                .entry
+                .ids
+                .contains_key("a.example.com"),
+            "should drop it"
+        );
+    }
+
+    /// Runs `mutation` with an owner of `a.example.com` that keeps no
+    /// private state and declares `grace` as its refresh grace.
+    fn run_with_graced_owner(
+        mutation: &IdentityMutation,
+        live: &KvEntry,
+        grace: Option<u64>,
+    ) -> Option<Applied> {
+        let mut resolves = Resolves::new().with_endpoint("https://api.example.com");
+        if let Some(grace) = grace {
+            resolves = resolves.with_refresh_grace(core::time::Duration::from_secs(grace));
+        }
+        let owner = provider_from(
+            ProviderDescriptor::builder(pid("owner"))
+                .with_source(src("a.example.com"))
+                .with_resolves(resolves)
+                .with_consent_policy(ConsentPolicy::eid_persistence_only())
+                .build()
+                .expect("should build the owner"),
+        );
+        let catalog = ProviderCatalog::new(
+            vec![owner, fixed_provider("other", &["b.example.com"])],
+            [(src("a.example.com"), pid("owner"))].into_iter().collect(),
+        );
+        let random = SeededRandom::new(1);
+        apply(
+            mutation,
+            live,
+            &ApplyContext {
+                now: NOW,
+                random: &random,
+                catalog: &catalog,
+            },
+        )
+    }
+
+    fn keeps_expired_owned_record(writer: &str, expired_for: u64, grace: Option<u64>) -> bool {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId {
+                exp: Some(NOW - expired_for),
+                ..written(writer, "expired", "1111111111111111")
+            },
+        );
+        let mut unrelated = IdentityMutation::default();
+        unrelated.set_cluster_size(1);
+        run_with_graced_owner(&unrelated, &live, grace)
+            .expect("should apply")
+            .entry
+            .ids
+            .contains_key("a.example.com")
+    }
+
+    #[test]
+    fn stateless_refresh_anchor_survives_until_exp_plus_grace() {
+        assert!(
+            keeps_expired_owned_record("owner", 50, Some(100)),
+            "should keep the owner's expired record inside its refresh grace"
+        );
+        assert!(
+            !keeps_expired_owned_record("owner", 100, Some(100)),
+            "should drop it once exp plus the grace has passed"
+        );
+        assert!(
+            !keeps_expired_owned_record("owner", 50, None),
+            "should drop it when the owner declares no grace, as before"
+        );
+        assert!(
+            !keeps_expired_owned_record("other", 50, Some(100)),
+            "should drop an expired record another provider wrote"
+        );
+    }
+
+    #[test]
+    fn unconfigured_provider_state_keeps_o_oc_and_ov() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        let kept = KvProviderState {
+            o: Some(KvOptOut {
+                at: 7,
+                fp: "1".to_owned(),
+            }),
+            oc: Some(6),
+            ov: vec![uid_hash("removed")],
+            ..KvProviderState::default()
+        };
+        live.ps.insert(
+            "retired".to_owned(),
+            KvProviderState {
+                n: Some(5),
+                iv: vec![uid_hash("invalidated")],
+                st: Some(json!(1)),
+                ..kept.clone()
+            },
+        );
+        live.ps.insert(
+            "gone".to_owned(),
+            KvProviderState {
+                n: Some(5),
+                ..KvProviderState::default()
+            },
+        );
+        live.ps.insert(
+            "other".to_owned(),
+            KvProviderState {
+                n: Some(5),
+                ..KvProviderState::default()
+            },
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.set_cluster_size(1);
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert_eq!(
+            applied.entry.ps["retired"], kept,
+            "should keep only o, oc and ov"
+        );
+        assert!(
+            !applied.entry.ps.contains_key("gone"),
+            "should drop an entry with none of them"
+        );
+        assert_eq!(
+            applied.entry.ps["other"].n,
+            Some(5),
+            "should leave a configured provider untouched"
+        );
+    }
+
+    #[test]
+    fn retained_opt_outs_are_pruned_first_when_over_the_state_cap() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ps.insert(
+            "other".to_owned(),
+            KvProviderState {
+                n: Some(5),
+                ..KvProviderState::default()
+            },
+        );
+        for (at, index) in (100_u64..).zip(0..MAX_PROVIDER_STATES) {
+            live.ps.insert(
+                format!("retired-{index:02}"),
+                KvProviderState {
+                    o: Some(KvOptOut {
+                        at,
+                        fp: "1".to_owned(),
+                    }),
+                    ..KvProviderState::default()
+                },
+            );
+        }
+        let mut mutation = IdentityMutation::default();
+        mutation.set_cluster_size(1);
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert_eq!(
+            applied.entry.ps.len(),
+            MAX_PROVIDER_STATES,
+            "should fit the cap"
+        );
+        assert!(
+            applied.entry.ps.contains_key("other"),
+            "should keep the configured provider"
+        );
+        assert!(
+            !applied.entry.ps.contains_key("retired-00"),
+            "should drop the oldest retained opt-out"
+        );
+        assert!(
+            applied.entry.ps.contains_key("retired-01"),
+            "should keep the newer ones"
+        );
+    }
+
+    #[test]
+    fn an_invalid_result_falls_back_to_removals_only() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "v1", "1111111111111111"),
+        );
+        let mut oversized = example_entry_set();
+        oversized[0].ext = Some(json!({ "segments": "x".repeat(2_000) }));
+        oversized[1].ext = Some(json!({ "segments": "y".repeat(2_000) }));
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("d.example.com", full_record(Some("other"), oversized)));
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+
+        let applied = run(&mutation, &live).expect("should apply removals");
+
+        assert!(
+            applied.removals_only,
+            "should fail validation for a set over MAX_ENTRY_SET_BYTES"
+        );
+        assert!(
+            !applied.entry.ids.contains_key("d.example.com"),
+            "should drop the set whole, never trim it"
+        );
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should still apply the removal"
+        );
+    }
+
+    #[test]
+    fn apply_removals_only_ignores_everything_but_removals() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "v1", "1111111111111111"),
+        );
+        live.ids.insert(
+            "d.example.com".to_owned(),
+            KvPartnerId {
+                exp: Some(NOW - 1),
+                ..KvPartnerId::new("expired")
+            },
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill(
+            "e.example.com",
+            KvPartnerId::browser("new", Some(NOW)),
+        ));
+        mutation.merge_state(
+            pid("other"),
+            ProviderStateChange {
+                n: Some(5),
+                f: Some(2),
+                ..opt_out(NOW)
+            },
+        );
+        mutation.set_cluster_size(3);
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+
+        let applied = run_removals(&mutation, &live).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should apply the removal"
+        );
+        assert!(
+            !applied.entry.ids.contains_key("e.example.com"),
+            "should ignore a positive change"
+        );
+        assert!(
+            applied.entry.ids.contains_key("d.example.com"),
+            "should not prune expired records"
+        );
+        let state = &applied.entry.ps["other"];
+        assert_eq!((state.n, state.f), (None, 0), "should never touch n or f");
+        assert!(state.o.is_some(), "should store the opt-out");
+        assert_eq!(
+            applied.entry.network, live.network,
+            "should not touch cluster_size"
+        );
+
+        let nothing = IdentityMutation::default();
+        assert!(
+            !run_removals(&nothing, &live).expect("should apply").changed,
+            "should report no change"
+        );
+    }
+
+    fn writer_remove(source: &str, writer: &str) -> IdentityMutation {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::WriterRemove {
+            source: src(source),
+            writer: pid(writer),
+        });
+        mutation
+    }
+
+    #[test]
+    fn a_writer_remove_removes_a_record_the_writer_owns() {
+        let mut live = KvEntry::minimal("e.example.com", "browser", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("owner", "v1", "1111111111111111"),
+        );
+
+        let applied =
+            run_removals(&writer_remove("a.example.com", "owner"), &live).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("a.example.com"),
+            "should remove the record the writer wrote"
+        );
+        assert_eq!(
+            applied.entry.ps["owner"].ov,
+            vec![uid_hash("v1")],
+            "should hash the removed UID into ov"
+        );
+    }
+
+    #[test]
+    fn a_capture_only_writer_remove_removes_a_browser_record() {
+        let mut live = KvEntry::minimal("e.example.com", "other", 1);
+        live.ids
+            .insert("c.example.com".to_owned(), KvPartnerId::new("browser-c"));
+
+        let applied =
+            run_removals(&writer_remove("c.example.com", "cap"), &live).expect("should apply");
+
+        assert!(
+            !applied.entry.ids.contains_key("c.example.com"),
+            "should remove the browser record of a capture-only source"
+        );
+        assert_eq!(
+            applied.entry.ps["cap"].ov,
+            vec![uid_hash("browser-c")],
+            "should hash the removed UID into ov"
+        );
+    }
+
+    #[test]
+    fn a_writer_remove_keeps_another_writers_record() {
+        let mut live = KvEntry::minimal("e.example.com", "browser", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            written("other", "v1", "1111111111111111"),
+        );
+
+        let applied =
+            run_removals(&writer_remove("a.example.com", "owner"), &live).expect("should apply");
+
+        assert!(
+            applied.entry.ids.contains_key("a.example.com"),
+            "should keep a record another writer wrote"
+        );
+        assert!(!applied.changed, "should report no change");
+    }
+
+    #[test]
+    fn removals_and_has_removals_round_trip() {
+        let mut mutation = writer_remove("a.example.com", "owner");
+        mutation.add_change(fill("b.example.com", KvPartnerId::browser("u", Some(NOW))));
+        mutation.merge_state(pid("other"), opt_out(NOW));
+        mutation.merge_state(
+            pid("cap"),
+            ProviderStateChange {
+                n: Some(3),
+                ..ProviderStateChange::default()
+            },
+        );
+
+        assert!(mutation.has_removals(), "should see the removals");
+        let removals = mutation.removals();
+        assert!(removals.has_removals(), "should keep the removals");
+        assert_eq!(
+            removals.removal_labels(),
+            mutation.removal_labels(),
+            "should keep every removal label"
+        );
+        assert!(
+            removals.partner_ids.iter().all(PartnerIdChange::is_removal),
+            "should drop the positive changes"
+        );
+        assert!(
+            !removals.provider_state.contains_key(&pid("cap")),
+            "should drop a state change that holds no removal"
+        );
+        assert!(
+            !IdentityMutation::default().has_removals(),
+            "should see no removals in an empty mutation"
+        );
+    }
+
+    #[test]
+    fn removal_labels_are_sorted_and_deduplicated() {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("2222222222222222"),
+        });
+        mutation.add_change(PartnerIdChange::WriterRemove {
+            source: src("b.example.com"),
+            writer: pid("cap"),
+        });
+        mutation.merge_state(pid("owner"), opt_out(NOW));
+        mutation.merge_state(
+            pid("other"),
+            ProviderStateChange {
+                opt_out_clear: Some(NOW),
+                ..ProviderStateChange::default()
+            },
+        );
+        mutation.add_result(ProviderResult {
+            provider: pid("owner"),
+            ids: Vec::new(),
+            state: opt_out(NOW),
+            expected_state: None,
+        });
+
+        assert_eq!(
+            mutation.removal_labels(),
+            vec![
+                (pid("cap"), Some(src("b.example.com"))),
+                (pid("other"), None),
+                (pid("owner"), None),
+                (pid("owner"), Some(src("a.example.com"))),
+            ],
+            "should list each provider and source once, sorted, with no UID"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/pending.rs b/crates/trusted-server-core/src/ec/identity/pending.rs
new file mode 100644
index 0000000000..461cb22216
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/pending.rs
@@ -0,0 +1,451 @@
+//! The pending key: removals and capture results that missed the row write,
+//! kept for the next writer to merge (spec 5.3, Pending key).
+//!
+//! `pending:<ec_id>` holds a list of items, each with a generation. An item
+//! is appended with a CAS, and the next writer request merges every item
+//! newer than the row's `pg` watermark into its one row write, then stores
+//! the newest generation as `pg`. The key is never deleted: its one-day TTL
+//! ends it. Auctions never read it.
+
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use serde::{Deserialize, Serialize};
+
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::mutation::{IdentityMutation, PartnerIdChange, ProviderStateChange};
+use super::revision::{RecordRevision, Revision};
+use crate::ec::kv::{KvIdentityGraph, MAX_CAS_RETRIES};
+use crate::ec::kv_backend::{EcKvWriteMode, EcKvWriteOutcome};
+use crate::ec::kv_types::{KvOptOut, KvPartnerId};
+use crate::ec::log_id;
+
+/// How long a pending key lives after its last append.
+pub(crate) const PENDING_TTL: Duration = Duration::from_secs(24 * 60 * 60);
+
+/// Items a pending key holds at most. An append to a full key fails.
+pub(crate) const MAX_PENDING_ITEMS: usize = 16;
+
+/// Generations per second. A generation is at least `now * 1000`, so a key
+/// that expired and comes back never reuses a generation a row has applied.
+const GENERATIONS_PER_SECOND: u64 = 1_000;
+
+/// The pending key of an EC ID.
+#[must_use]
+pub(crate) fn pending_key(ec_id: &str) -> String {
+    format!("pending:{ec_id}")
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+struct KvPending {
+    #[serde(default)]
+    items: Vec<KvPendingItem>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+struct KvPendingItem {
+    /// The item's generation.
+    g: u64,
+    /// When the item was appended, Unix seconds.
+    at: u64,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    ch: Vec<KvPendingChange>,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    ps: BTreeMap<IdentityProviderId, KvPendingState>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum KvRevision {
+    Unset,
+    Set(String),
+}
+
+impl From<&Revision> for KvRevision {
+    fn from(revision: &Revision) -> Self {
+        match revision {
+            Revision::Unset => Self::Unset,
+            Revision::Set(value) => Self::Set(value.as_str().to_owned()),
+        }
+    }
+}
+
+impl From<&KvRevision> for Revision {
+    fn from(revision: &KvRevision) -> Self {
+        match revision {
+            KvRevision::Unset => Self::Unset,
+            KvRevision::Set(value) => Self::Set(RecordRevision::from_stored(value)),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "k", rename_all = "snake_case")]
+enum KvPendingChange {
+    FillMissing {
+        s: SourceDomain,
+        r: KvPartnerId,
+    },
+    OwnerWrite {
+        s: SourceDomain,
+        r: KvPartnerId,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        e: Option<KvRevision>,
+    },
+    OwnerRemove {
+        s: SourceDomain,
+        p: IdentityProviderId,
+        e: KvRevision,
+    },
+    WriterRemove {
+        s: SourceDomain,
+        p: IdentityProviderId,
+    },
+}
+
+impl From<&PartnerIdChange> for KvPendingChange {
+    fn from(change: &PartnerIdChange) -> Self {
+        match change {
+            PartnerIdChange::FillMissing { source, record } => Self::FillMissing {
+                s: source.clone(),
+                r: record.clone(),
+            },
+            PartnerIdChange::OwnerWrite {
+                source,
+                record,
+                expected,
+            } => Self::OwnerWrite {
+                s: source.clone(),
+                r: record.clone(),
+                e: expected.as_ref().map(KvRevision::from),
+            },
+            PartnerIdChange::OwnerRemove {
+                source,
+                provider,
+                expected,
+            } => Self::OwnerRemove {
+                s: source.clone(),
+                p: provider.clone(),
+                e: KvRevision::from(expected),
+            },
+            PartnerIdChange::WriterRemove { source, writer } => Self::WriterRemove {
+                s: source.clone(),
+                p: writer.clone(),
+            },
+        }
+    }
+}
+
+impl From<&KvPendingChange> for PartnerIdChange {
+    fn from(change: &KvPendingChange) -> Self {
+        match change {
+            KvPendingChange::FillMissing { s, r } => Self::FillMissing {
+                source: s.clone(),
+                record: r.clone(),
+            },
+            KvPendingChange::OwnerWrite { s, r, e } => Self::OwnerWrite {
+                source: s.clone(),
+                record: r.clone(),
+                expected: e.as_ref().map(Revision::from),
+            },
+            KvPendingChange::OwnerRemove { s, p, e } => Self::OwnerRemove {
+                source: s.clone(),
+                provider: p.clone(),
+                expected: Revision::from(e),
+            },
+            KvPendingChange::WriterRemove { s, p } => Self::WriterRemove {
+                source: s.clone(),
+                writer: p.clone(),
+            },
+        }
+    }
+}
+
+/// The removal part of a provider's state change: its opt-out and clear.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+struct KvPendingState {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    o: Option<KvOptOut>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    oc: Option<u64>,
+}
+
+/// What the next writer merges: the pending items newer than its row's
+/// watermark, and the generation to store as the new watermark.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct PendingMerge {
+    pub(crate) mutation: IdentityMutation,
+    pub(crate) generation: u64,
+}
+
+fn to_item(mutation: &IdentityMutation, generation: u64, now: u64) -> KvPendingItem {
+    KvPendingItem {
+        g: generation,
+        at: now,
+        ch: mutation
+            .stand_alone_changes()
+            .iter()
+            .map(KvPendingChange::from)
+            .collect(),
+        ps: mutation
+            .removal_states()
+            .map(|(provider, state)| {
+                (
+                    provider.clone(),
+                    KvPendingState {
+                        o: state.opt_out.clone(),
+                        oc: state.opt_out_clear,
+                    },
+                )
+            })
+            .collect(),
+    }
+}
+
+/// Appends `mutation`'s stand-alone changes and opt-outs to the EC ID's
+/// pending key with a CAS, retrying a generation mismatch. Items older than
+/// [`PENDING_TTL`] are dropped first.
+///
+/// Returns `false` when the item was not stored: the key is full, unreadable
+/// or every attempt lost. The caller then counts what it held as lost.
+#[must_use]
+pub(crate) fn append_pending(
+    graph: &KvIdentityGraph,
+    ec_id: &str,
+    mutation: &IdentityMutation,
+    now: u64,
+) -> bool {
+    let key = pending_key(ec_id);
+    for _attempt in 0..MAX_CAS_RETRIES {
+        let (mut pending, mode) = match graph.lookup_key(&key) {
+            Ok(Some(lookup)) => match serde_json::from_slice::<KvPending>(&lookup.body) {
+                Ok(pending) => (pending, EcKvWriteMode::IfGenerationMatch(lookup.generation)),
+                Err(error) => {
+                    log::warn!("Pending key for '{}' is unreadable: {error}", log_id(ec_id));
+                    return false;
+                }
+            },
+            Ok(None) => (KvPending::default(), EcKvWriteMode::Add),
+            Err(error) => {
+                log::warn!(
+                    "Pending key for '{}' could not be read: {}",
+                    log_id(ec_id),
+                    error.current_context()
+                );
+                return false;
+            }
+        };
+        pending
+            .items
+            .retain(|item| item.at.saturating_add(PENDING_TTL.as_secs()) > now);
+        if pending.items.len() >= MAX_PENDING_ITEMS {
+            log::warn!("Pending key for '{}' is full", log_id(ec_id));
+            return false;
+        }
+        let last = pending.items.last().map_or(0, |item| item.g);
+        let generation = last
+            .saturating_add(1)
+            .max(now.saturating_mul(GENERATIONS_PER_SECOND));
+        pending.items.push(to_item(mutation, generation, now));
+        let Ok(body) = serde_json::to_string(&pending) else {
+            return false;
+        };
+        match graph.write_key(&key, &body, PENDING_TTL, mode) {
+            Ok(EcKvWriteOutcome::Written) => return true,
+            Ok(EcKvWriteOutcome::PreconditionFailed) => {}
+            Err(error) => {
+                log::warn!(
+                    "Pending key for '{}' could not be written: {}",
+                    log_id(ec_id),
+                    error.current_context()
+                );
+                return false;
+            }
+        }
+    }
+    false
+}
+
+/// Reads the EC ID's pending key and builds the merge of every item newer
+/// than `applied`, the row's watermark. `None` when there is nothing newer,
+/// or the key cannot be read.
+#[must_use]
+pub(crate) fn load_pending(
+    graph: &KvIdentityGraph,
+    ec_id: &str,
+    applied: u64,
+) -> Option<PendingMerge> {
+    let lookup = match graph.lookup_key(&pending_key(ec_id)) {
+        Ok(lookup) => lookup?,
+        Err(error) => {
+            log::warn!(
+                "Pending key for '{}' could not be read: {}",
+                log_id(ec_id),
+                error.current_context()
+            );
+            return None;
+        }
+    };
+    let pending: KvPending = match serde_json::from_slice(&lookup.body) {
+        Ok(pending) => pending,
+        Err(error) => {
+            log::warn!("Pending key for '{}' is unreadable: {error}", log_id(ec_id));
+            return None;
+        }
+    };
+    let mut mutation = IdentityMutation::default();
+    let mut generation = applied;
+    for item in pending.items.iter().filter(|item| item.g > applied) {
+        for change in &item.ch {
+            mutation.add_change(PartnerIdChange::from(change));
+        }
+        for (provider, state) in &item.ps {
+            mutation.merge_state(
+                provider.clone(),
+                ProviderStateChange {
+                    opt_out: state.o.clone(),
+                    opt_out_clear: state.oc,
+                    ..ProviderStateChange::default()
+                },
+            );
+        }
+        generation = generation.max(item.g);
+    }
+    (generation > applied).then_some(PendingMerge {
+        mutation,
+        generation,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ec::identity::test_support::{pid, record_for_test, source};
+    use crate::ec::kv_backend::test_support::InMemoryEcKv;
+
+    const EC_ID: &str = "0000000000000000000000000000000000000000000000000000000000000000.ABC123";
+
+    fn removal(name: &str) -> IdentityMutation {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::WriterRemove {
+            source: source(name),
+            writer: pid("lockr"),
+        });
+        mutation
+    }
+
+    #[test]
+    fn appended_items_merge_once_past_the_watermark() {
+        let graph = KvIdentityGraph::new(InMemoryEcKv::new("ec-store"));
+        let mut opt_out = removal("a.example.com");
+        opt_out.merge_state(
+            pid("lockr"),
+            ProviderStateChange {
+                opt_out: Some(KvOptOut {
+                    at: 90,
+                    fp: "1".to_owned(),
+                }),
+                ..ProviderStateChange::default()
+            },
+        );
+
+        assert!(
+            append_pending(&graph, EC_ID, &opt_out, 100),
+            "should store the first item"
+        );
+        assert!(
+            append_pending(&graph, EC_ID, &removal("b.example.com"), 100),
+            "should store the second item"
+        );
+
+        let merge = load_pending(&graph, EC_ID, 0).expect("should merge both items");
+        assert_eq!(
+            merge.generation,
+            100 * GENERATIONS_PER_SECOND + 1,
+            "should hand back the newest generation"
+        );
+        assert_eq!(
+            merge.mutation.removal_labels().len(),
+            3,
+            "should merge both removals and the opt-out"
+        );
+        let first_only = load_pending(&graph, EC_ID, 100 * GENERATIONS_PER_SECOND)
+            .expect("should merge the newer item");
+        assert_eq!(
+            first_only.mutation.removal_labels(),
+            vec![(pid("lockr"), Some(source("b.example.com")))],
+            "should skip an item the watermark covers"
+        );
+        assert!(
+            load_pending(&graph, EC_ID, merge.generation).is_none(),
+            "should merge nothing once the watermark covers every item"
+        );
+    }
+
+    #[test]
+    fn a_capture_write_round_trips_with_its_expected_revision() {
+        let graph = KvIdentityGraph::new(InMemoryEcKv::new("ec-store"));
+        let mut capture = IdentityMutation::default();
+        let change = PartnerIdChange::OwnerWrite {
+            source: source("a.example.com"),
+            record: record_for_test("uid-1", Some("lockr"), 100),
+            expected: Some(Revision::Set(RecordRevision::from_stored(
+                "0123456789abcdef",
+            ))),
+        };
+        capture.add_change(change.clone());
+
+        assert!(
+            append_pending(&graph, EC_ID, &capture, 100),
+            "should store the capture"
+        );
+
+        let merge = load_pending(&graph, EC_ID, 0).expect("should merge the capture");
+        assert_eq!(
+            merge.mutation.stand_alone_changes(),
+            std::slice::from_ref(&change),
+            "should give back the change it stored"
+        );
+    }
+
+    #[test]
+    fn a_full_key_refuses_and_expired_items_make_room() {
+        let graph = KvIdentityGraph::new(InMemoryEcKv::new("ec-store"));
+        for _ in 0..MAX_PENDING_ITEMS {
+            assert!(
+                append_pending(&graph, EC_ID, &removal("a.example.com"), 100),
+                "should store items up to the cap"
+            );
+        }
+
+        assert!(
+            !append_pending(&graph, EC_ID, &removal("a.example.com"), 100),
+            "should refuse an item past the cap"
+        );
+        assert!(
+            append_pending(
+                &graph,
+                EC_ID,
+                &removal("a.example.com"),
+                100 + PENDING_TTL.as_secs()
+            ),
+            "should drop expired items and store the new one"
+        );
+    }
+
+    #[test]
+    fn a_generation_never_falls_below_the_clock() {
+        let graph = KvIdentityGraph::new(InMemoryEcKv::new("ec-store"));
+        let applied_before_expiry = 500 * GENERATIONS_PER_SECOND + 3;
+
+        assert!(
+            append_pending(&graph, EC_ID, &removal("a.example.com"), 600),
+            "should store the item"
+        );
+
+        assert!(
+            load_pending(&graph, EC_ID, applied_before_expiry).is_some(),
+            "should merge an item appended after a key expired and came back"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/policy.rs b/crates/trusted-server-core/src/ec/identity/policy.rs
new file mode 100644
index 0000000000..51d08d14b2
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/policy.rs
@@ -0,0 +1,856 @@
+//! Evaluates a provider's [`ConsentPolicy`] against a request's consent.
+
+use super::descriptor::{ConsentPolicy, UsOptOut};
+use crate::consent::types::PrivacyFlag;
+use crate::consent::{ConsentContext, effective_tcf, tcf_applies};
+
+/// Signals the consent context does not carry.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) struct PolicySignals {
+    /// `DNT: 1` was present.
+    pub(crate) dnt: bool,
+}
+
+impl PolicySignals {
+    /// Reads the signals a request's headers carry.
+    #[must_use]
+    pub(crate) fn from_headers(headers: &http::HeaderMap) -> Self {
+        Self {
+            dnt: headers
+                .get("dnt")
+                .and_then(|value| value.to_str().ok())
+                .is_some_and(|value| value.trim() == "1"),
+        }
+    }
+}
+
+/// The highest TCF purpose the fingerprint has a bit for.
+pub(crate) const FP_PURPOSES: u8 = 10;
+/// Fingerprint bit of the vendor consent. Purposes 1 to 10 hold bits 0 to 9.
+pub(crate) const FP_VENDOR: u32 = 10;
+/// Fingerprint bit of the US sale opt-out.
+pub(crate) const FP_US_SALE: u32 = 11;
+/// Fingerprint bit of Global Privacy Control.
+pub(crate) const FP_GPC: u32 = 12;
+/// Fingerprint bit of `DNT: 1`.
+const FP_DNT: u32 = 13;
+/// Fingerprint bit of the US sharing opt-out.
+pub(crate) const FP_US_SHARING: u32 = 14;
+/// Fingerprint bit of the US targeted-advertising opt-out.
+pub(crate) const FP_US_TARGETED: u32 = 15;
+/// Fingerprint bit set when TCF applied and a TC string was decoded, so the
+/// purpose and vendor bits record a grant or a denial rather than nothing.
+pub(crate) const FP_TCF: u32 = 16;
+/// The US opt-out bits: sale, sharing, targeted advertising and GPC.
+pub(crate) const FP_US_OPT_OUT_MASK: u64 =
+    (1 << FP_US_SALE) | (1 << FP_US_SHARING) | (1 << FP_US_TARGETED) | (1 << FP_GPC);
+
+/// Whether the request carries a decoded US sale opt-out, from a GPP US
+/// section, GPP section 6 or the US Privacy string.
+fn us_sale_opt_out(consent: &ConsentContext) -> bool {
+    let section_6 = consent
+        .gpp
+        .as_ref()
+        .and_then(|gpp| gpp.us_privacy_section.as_ref());
+    consent.gpp.as_ref().and_then(|gpp| gpp.us_sale_opt_out) == Some(true)
+        || section_6
+            .into_iter()
+            .chain(consent.us_privacy.as_ref())
+            .any(|usp| usp.opt_out_sale == PrivacyFlag::Yes)
+}
+
+/// Whether the request carries a decoded US sharing opt-out from GPP.
+fn us_sharing_opt_out(consent: &ConsentContext) -> bool {
+    consent.gpp.as_ref().and_then(|gpp| gpp.us_sharing_opt_out) == Some(true)
+}
+
+/// Whether the request carries a decoded US targeted-advertising opt-out from
+/// GPP.
+fn us_targeted_advertising_opt_out(consent: &ConsentContext) -> bool {
+    consent
+        .gpp
+        .as_ref()
+        .and_then(|gpp| gpp.us_targeted_advertising_opt_out)
+        == Some(true)
+}
+
+/// Whether Global Privacy Control is set, by `Sec-GPC` or GPP's GPC field.
+fn gpc_signal(consent: &ConsentContext) -> bool {
+    consent.gpc || consent.gpp.as_ref().and_then(|gpp| gpp.us_gpc) == Some(true)
+}
+
+/// Whether GPP marks a known child without consent.
+fn known_child_without_consent(consent: &ConsentContext) -> bool {
+    consent.gpp.as_ref().and_then(|gpp| gpp.us_known_child) == Some(true)
+}
+
+/// The consent an opt-out's `fp` records, as a lowercase hex bitmask (spec 8).
+///
+/// Each signal has a fixed bit, whatever the policy reads:
+///
+/// - bits 0 to 9: TCF purposes 1 to 10, set when consent grants the purpose
+/// - bit 10: the policy's vendor, set when consent grants it
+/// - bit 11: the US sale opt-out, from `us_privacy`, a GPP US section or GPP
+///   section 6
+/// - bit 12: GPC
+/// - bit 13: DNT
+/// - bit 14: the US sharing opt-out
+/// - bit 15: the US targeted-advertising opt-out
+///
+/// The purpose bits are 0 when TCF does not apply or no TCF consent is
+/// present, so a request with no TCF consent and one that grants nothing
+/// share the same purpose bits.
+///
+/// A signal the policy does not read or relaxes stays 0. Later parts append
+/// bits after these and keep these where they are.
+#[must_use]
+// Temporary: the request wiring, the first non-test caller, arrives in a later task.
+#[allow(dead_code)]
+pub(crate) fn fingerprint_bits(
+    policy: &ConsentPolicy,
+    consent: &ConsentContext,
+    signals: PolicySignals,
+) -> String {
+    let mut bits: u64 = 0;
+    if !policy.is_eid_persistence_only() {
+        if tcf_applies(consent)
+            && let Some(tcf) = effective_tcf(consent)
+        {
+            bits |= 1 << FP_TCF;
+            for purpose in policy.tcf_purposes() {
+                if (1..=FP_PURPOSES).contains(purpose)
+                    && tcf.has_purpose_consent(usize::from(*purpose))
+                {
+                    bits |= 1 << (purpose - 1);
+                }
+            }
+            if let Some(vendor) = policy.tcf_vendor()
+                && tcf.has_vendor_consent(vendor)
+            {
+                bits |= 1 << FP_VENDOR;
+            }
+        }
+        if !policy.allows_us_opt_out(UsOptOut::Sale) && us_sale_opt_out(consent) {
+            bits |= 1 << FP_US_SALE;
+        }
+        if !policy.allows_us_opt_out(UsOptOut::Sharing) && us_sharing_opt_out(consent) {
+            bits |= 1 << FP_US_SHARING;
+        }
+        if !policy.allows_us_opt_out(UsOptOut::TargetedAdvertising)
+            && us_targeted_advertising_opt_out(consent)
+        {
+            bits |= 1 << FP_US_TARGETED;
+        }
+        if !policy.allows_gpc() && gpc_signal(consent) {
+            bits |= 1 << FP_GPC;
+        }
+        if !policy.allows_dnt() && signals.dnt {
+            bits |= 1 << FP_DNT;
+        }
+    }
+    format!("{bits:x}")
+}
+
+/// Whether `policy` allows a provider under this request's consent. The
+/// global EC and EID-persistence gates are checked separately (eligibility
+/// steps 1 and 2) and are not repeated here.
+#[must_use]
+pub(crate) fn policy_allows(
+    policy: &ConsentPolicy,
+    consent: &ConsentContext,
+    signals: PolicySignals,
+) -> bool {
+    if policy.is_eid_persistence_only() {
+        return true;
+    }
+    // Fail closed: a raw string with no decoded form blocks.
+    if (consent.raw_tc_string.is_some() && consent.tcf.is_none())
+        || (consent.raw_gpp_string.is_some() && consent.gpp.is_none())
+        || (consent.raw_us_privacy.is_some() && consent.us_privacy.is_none())
+    {
+        return false;
+    }
+    // A known child, or a US section whose opt-outs could not be read, blocks
+    // every provider whatever the policy relaxes.
+    if known_child_without_consent(consent)
+        || consent
+            .gpp
+            .as_ref()
+            .is_some_and(|gpp| gpp.us_section_decode_failed)
+    {
+        return false;
+    }
+    if tcf_applies(consent) {
+        // A TC string or a GPP TCF section. A header-only GPP string has
+        // neither, so TCF consent is still missing.
+        let Some(tcf) = effective_tcf(consent) else {
+            return false;
+        };
+        if !policy
+            .tcf_purposes()
+            .iter()
+            .all(|purpose| tcf.has_purpose_consent(usize::from(*purpose)))
+        {
+            return false;
+        }
+        if let Some(vendor) = policy.tcf_vendor()
+            && !tcf.has_vendor_consent(vendor)
+        {
+            return false;
+        }
+    }
+    if !policy.allows_us_opt_out(UsOptOut::Sale) && us_sale_opt_out(consent) {
+        return false;
+    }
+    if !policy.allows_us_opt_out(UsOptOut::Sharing) && us_sharing_opt_out(consent) {
+        return false;
+    }
+    if !policy.allows_us_opt_out(UsOptOut::TargetedAdvertising)
+        && us_targeted_advertising_opt_out(consent)
+    {
+        return false;
+    }
+    if !policy.allows_gpc() && gpc_signal(consent) {
+        return false;
+    }
+    if !policy.allows_dnt() && signals.dnt {
+        return false;
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::consent::ConsentContext;
+    use crate::consent::gpp::decode_gpp_string;
+    use crate::consent::jurisdiction::Jurisdiction;
+    use crate::consent::types::{GppConsent, TcfConsent};
+    use crate::consent::us_privacy::decode_us_privacy;
+    use crate::ec::identity::descriptor::{ConsentPolicy, UsOptOut};
+    use crate::ec::identity::test_support::resolver_policy;
+
+    #[derive(Default)]
+    struct Signals {
+        gdpr: bool,
+        purposes: Vec<usize>,
+        vendors: Vec<u16>,
+        us_sale_opt_out: bool,
+        gpc: bool,
+        raw_tc_without_decode: bool,
+        gpp_header_only: bool,
+        tcf_in_gpp: bool,
+    }
+
+    fn tcf_consent(purposes: &[usize], vendors: &[u16]) -> TcfConsent {
+        let mut purpose_consents = vec![false; 24];
+        for purpose in purposes {
+            purpose_consents[purpose - 1] = true;
+        }
+        TcfConsent {
+            version: 2,
+            cmp_id: 1,
+            cmp_version: 1,
+            consent_screen: 1,
+            consent_language: "EN".to_owned(),
+            vendor_list_version: 1,
+            tcf_policy_version: 4,
+            created_ds: 0,
+            last_updated_ds: 0,
+            purpose_consents,
+            purpose_legitimate_interests: vec![false; 24],
+            vendor_consents: vendors.to_vec(),
+            vendor_legitimate_interests: Vec::new(),
+            special_feature_opt_ins: vec![false; 12],
+        }
+    }
+
+    // Takes the builder by value so call sites read as a struct literal.
+    #[allow(clippy::needless_pass_by_value)]
+    fn consent_with(signals: Signals) -> ConsentContext {
+        let mut consent = ConsentContext {
+            gdpr_applies: signals.gdpr,
+            gpc: signals.gpc,
+            jurisdiction: if signals.gdpr {
+                Jurisdiction::Gdpr
+            } else {
+                Jurisdiction::UsState("CA".to_owned())
+            },
+            ..ConsentContext::default()
+        };
+        if signals.gdpr && !signals.tcf_in_gpp && !signals.purposes.is_empty() {
+            consent.tcf = Some(tcf_consent(&signals.purposes, &signals.vendors));
+        }
+        if signals.us_sale_opt_out {
+            consent.raw_us_privacy = Some("1YYN".to_owned());
+            consent.us_privacy =
+                Some(decode_us_privacy("1YYN").expect("should decode a US Privacy string"));
+        }
+        if signals.raw_tc_without_decode {
+            consent.raw_tc_string = Some("undecodable".to_owned());
+        }
+        if signals.gpp_header_only || signals.tcf_in_gpp {
+            consent.raw_gpp_string = Some("DBAA".to_owned());
+            let mut gpp =
+                decode_gpp_string("DBAA").expect("should decode a header-only GPP string");
+            if signals.tcf_in_gpp {
+                gpp.eu_tcf = Some(tcf_consent(&signals.purposes, &signals.vendors));
+            }
+            consent.gpp = Some(gpp);
+            consent.gpp_section_ids = Some(Vec::new());
+        }
+        consent
+    }
+
+    #[test]
+    fn strict_blocks_each_signal_it_decodes() {
+        let strict = resolver_policy();
+        let allowed = consent_with(Signals::default());
+        assert!(
+            policy_allows(&strict, &allowed, PolicySignals { dnt: false }),
+            "should allow a request with no signal set"
+        );
+
+        for (name, signals, dnt) in [
+            (
+                "gdpr without purpose 4",
+                Signals {
+                    gdpr: true,
+                    purposes: vec![1],
+                    ..Signals::default()
+                },
+                false,
+            ),
+            (
+                "us sale opt-out",
+                Signals {
+                    us_sale_opt_out: true,
+                    ..Signals::default()
+                },
+                false,
+            ),
+            (
+                "gpc",
+                Signals {
+                    gpc: true,
+                    ..Signals::default()
+                },
+                false,
+            ),
+            ("dnt", Signals::default(), true),
+            (
+                "undecodable tc string",
+                Signals {
+                    raw_tc_without_decode: true,
+                    ..Signals::default()
+                },
+                false,
+            ),
+        ] {
+            assert!(
+                !policy_allows(&strict, &consent_with(signals), PolicySignals { dnt }),
+                "should block under strict: {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn relaxations_and_vendor_consent() {
+        let gpc = consent_with(Signals {
+            gpc: true,
+            ..Signals::default()
+        });
+        assert!(
+            policy_allows(
+                &resolver_policy().allowing_gpc(),
+                &gpc,
+                PolicySignals { dnt: false }
+            ),
+            "should allow GPC when the policy relaxes it"
+        );
+        let sale = consent_with(Signals {
+            us_sale_opt_out: true,
+            ..Signals::default()
+        });
+        assert!(
+            policy_allows(
+                &resolver_policy().allowing_us_opt_out(UsOptOut::Sale),
+                &sale,
+                PolicySignals { dnt: false }
+            ),
+            "should allow a sale opt-out when the policy relaxes it"
+        );
+        let gdpr = consent_with(Signals {
+            gdpr: true,
+            purposes: vec![1, 4],
+            vendors: vec![9999],
+            ..Signals::default()
+        });
+        assert!(
+            policy_allows(
+                &resolver_policy().with_tcf_vendor(9999),
+                &gdpr,
+                PolicySignals { dnt: false }
+            ),
+            "should allow a granted vendor"
+        );
+        assert!(
+            !policy_allows(
+                &resolver_policy().with_tcf_vendor(1234),
+                &gdpr,
+                PolicySignals { dnt: false }
+            ),
+            "should block a vendor without consent"
+        );
+    }
+
+    #[test]
+    fn eid_persistence_only_ignores_provider_signals() {
+        let consent = consent_with(Signals {
+            gpc: true,
+            us_sale_opt_out: true,
+            ..Signals::default()
+        });
+        assert!(
+            policy_allows(
+                &ConsentPolicy::eid_persistence_only(),
+                &consent,
+                PolicySignals { dnt: true }
+            ),
+            "should check only the global gates for generic pull's parity policy, which the coordinator applies separately"
+        );
+    }
+
+    #[test]
+    fn header_only_gpp_does_not_block_strict_where_tcf_does_not_apply() {
+        let header_only = consent_with(Signals {
+            gpp_header_only: true,
+            ..Signals::default()
+        });
+        assert!(
+            policy_allows(
+                &resolver_policy(),
+                &header_only,
+                PolicySignals { dnt: false }
+            ),
+            "should not block on a decoded GPP string with no applicable section"
+        );
+
+        let under_gdpr = consent_with(Signals {
+            gdpr: true,
+            gpp_header_only: true,
+            ..Signals::default()
+        });
+        assert!(
+            !policy_allows(
+                &resolver_policy(),
+                &under_gdpr,
+                PolicySignals { dnt: false }
+            ),
+            "should still need TCF consent where TCF applies"
+        );
+
+        let gpp_tcf = consent_with(Signals {
+            gdpr: true,
+            purposes: vec![1, 4],
+            tcf_in_gpp: true,
+            ..Signals::default()
+        });
+        assert!(
+            policy_allows(&resolver_policy(), &gpp_tcf, PolicySignals { dnt: false }),
+            "should accept TCF consent from a GPP TCF section"
+        );
+
+        let mut undecodable = consent_with(Signals::default());
+        undecodable.raw_gpp_string = Some("not-a-gpp-string".to_owned());
+        assert!(
+            !policy_allows(
+                &resolver_policy(),
+                &undecodable,
+                PolicySignals { dnt: false }
+            ),
+            "should fail closed on a GPP string that has no decoded form"
+        );
+    }
+
+    #[test]
+    fn corrupt_us_section_blocks_strict_and_ignores_relaxations() {
+        let corrupt = decode_gpp_string("DBABL~not-a-valid-usnat-section")
+            .expect("should decode the GPP header with a raw section");
+        assert!(
+            corrupt.us_section_decode_failed,
+            "should flag the undecodable US section"
+        );
+        let mut consent = consent_with(Signals::default());
+        consent.raw_gpp_string = Some("corrupt".to_owned());
+        consent.gpp = Some(corrupt);
+        let relaxed = resolver_policy()
+            .allowing_gpc()
+            .allowing_dnt()
+            .allowing_us_opt_out(UsOptOut::Sale)
+            .allowing_us_opt_out(UsOptOut::Sharing)
+            .allowing_us_opt_out(UsOptOut::TargetedAdvertising);
+        assert!(
+            !allows(&resolver_policy(), &consent),
+            "should block strict on an undecodable US section"
+        );
+        assert!(
+            !allows(&relaxed, &consent),
+            "should block whatever the policy relaxes"
+        );
+        assert!(
+            allows(&ConsentPolicy::eid_persistence_only(), &consent),
+            "should leave generic pull's parity policy at the global gates"
+        );
+        let control = consent_with_gpp(|_| {});
+        assert!(
+            allows(&resolver_policy(), &control),
+            "should allow a decodable GPP string under the same policy"
+        );
+    }
+
+    fn consent_with_gpp(edit: impl FnOnce(&mut GppConsent)) -> ConsentContext {
+        let mut consent = consent_with(Signals {
+            gpp_header_only: true,
+            ..Signals::default()
+        });
+        edit(consent.gpp.as_mut().expect("should carry a decoded GPP"));
+        consent
+    }
+
+    fn allows(policy: &ConsentPolicy, consent: &ConsentContext) -> bool {
+        policy_allows(policy, consent, PolicySignals { dnt: false })
+    }
+
+    #[test]
+    fn strict_blocks_sharing_targeted_gpc_field_and_known_child() {
+        let strict = resolver_policy();
+        let control = consent_with_gpp(|gpp| {
+            gpp.us_sharing_opt_out = Some(false);
+            gpp.us_targeted_advertising_opt_out = Some(false);
+            gpp.us_gpc = Some(false);
+            gpp.us_known_child = Some(false);
+        });
+        assert!(
+            allows(&strict, &control),
+            "should allow a GPP string that sets none of the new signals"
+        );
+
+        let sharing = consent_with_gpp(|gpp| gpp.us_sharing_opt_out = Some(true));
+        assert!(
+            !allows(&strict, &sharing),
+            "should block on the sharing opt-out"
+        );
+        assert!(
+            allows(
+                &resolver_policy().allowing_us_opt_out(UsOptOut::Sharing),
+                &sharing
+            ),
+            "should allow the sharing opt-out when the policy relaxes it"
+        );
+        assert!(
+            !allows(
+                &resolver_policy().allowing_us_opt_out(UsOptOut::TargetedAdvertising),
+                &sharing
+            ),
+            "should keep blocking sharing when only another opt-out is relaxed"
+        );
+
+        let targeted = consent_with_gpp(|gpp| gpp.us_targeted_advertising_opt_out = Some(true));
+        assert!(
+            !allows(&strict, &targeted),
+            "should block on the targeted-advertising opt-out"
+        );
+        assert!(
+            allows(
+                &resolver_policy().allowing_us_opt_out(UsOptOut::TargetedAdvertising),
+                &targeted
+            ),
+            "should allow the targeted-advertising opt-out when the policy relaxes it"
+        );
+
+        let gpc = consent_with_gpp(|gpp| gpp.us_gpc = Some(true));
+        assert!(!allows(&strict, &gpc), "should block on GPP's GPC field");
+        assert!(
+            allows(&resolver_policy().allowing_gpc(), &gpc),
+            "should allow GPP's GPC field when the policy relaxes GPC"
+        );
+
+        let child = consent_with_gpp(|gpp| gpp.us_known_child = Some(true));
+        let everything_relaxed = resolver_policy()
+            .allowing_gpc()
+            .allowing_dnt()
+            .allowing_us_opt_out(UsOptOut::Sale)
+            .allowing_us_opt_out(UsOptOut::Sharing)
+            .allowing_us_opt_out(UsOptOut::TargetedAdvertising);
+        assert!(!allows(&strict, &child), "should block a known child");
+        assert!(
+            !allows(&everything_relaxed, &child),
+            "should block a known child whatever the policy relaxes"
+        );
+        assert!(
+            allows(&everything_relaxed, &control),
+            "should allow the control under the same relaxations"
+        );
+        assert!(
+            allows(&ConsentPolicy::eid_persistence_only(), &child),
+            "should leave generic pull's parity policy at the global gates only"
+        );
+    }
+
+    #[test]
+    fn targeted_advertising_opt_out_without_sale_opt_out_blocks_strict() {
+        let consent = consent_with_gpp(|gpp| {
+            gpp.us_sale_opt_out = Some(false);
+            gpp.us_targeted_advertising_opt_out = Some(true);
+        });
+        assert!(
+            !allows(&resolver_policy(), &consent),
+            "should block on targeted advertising alone"
+        );
+        let sale_only = consent_with_gpp(|gpp| gpp.us_sale_opt_out = Some(false));
+        assert!(
+            allows(&resolver_policy(), &sale_only),
+            "should allow when nothing opts out"
+        );
+    }
+
+    #[test]
+    fn section_6_sale_opt_out_inside_gpp_blocks_strict() {
+        let opted_out = consent_with_gpp(|gpp| {
+            gpp.us_privacy_section = Some(decode_us_privacy("1YYN").expect("should decode"));
+        });
+        assert!(
+            !allows(&resolver_policy(), &opted_out),
+            "should block on a sale opt-out in GPP section 6"
+        );
+        assert!(
+            allows(
+                &resolver_policy().allowing_us_opt_out(UsOptOut::Sale),
+                &opted_out
+            ),
+            "should allow it when the policy relaxes the sale opt-out"
+        );
+        let not_opted_out = consent_with_gpp(|gpp| {
+            gpp.us_privacy_section = Some(decode_us_privacy("1YNN").expect("should decode"));
+        });
+        assert!(
+            allows(&resolver_policy(), &not_opted_out),
+            "should allow a section 6 string that does not opt out"
+        );
+    }
+
+    #[test]
+    fn strict_fails_closed_on_raw_gpp_and_raw_us_privacy_without_a_decoded_form() {
+        let mut raw_gpp = consent_with(Signals::default());
+        raw_gpp.raw_gpp_string = Some("DBABTA~1YNN".to_owned());
+        assert!(
+            !allows(&resolver_policy(), &raw_gpp),
+            "should block a raw GPP string with no decoded form"
+        );
+        raw_gpp.gpp = Some(decode_gpp_string("DBABTA~1YNN").expect("should decode"));
+        assert!(
+            allows(&resolver_policy(), &raw_gpp),
+            "should allow the same string once it decodes"
+        );
+
+        let mut raw_usp = consent_with(Signals::default());
+        raw_usp.raw_us_privacy = Some("1YNN".to_owned());
+        assert!(
+            !allows(&resolver_policy(), &raw_usp),
+            "should block a raw US Privacy string with no decoded form"
+        );
+        raw_usp.us_privacy = Some(decode_us_privacy("1YNN").expect("should decode"));
+        assert!(
+            allows(&resolver_policy(), &raw_usp),
+            "should allow the same string once it decodes"
+        );
+    }
+
+    #[test]
+    fn custom_tcf_purposes_and_gpp_vendor_consent_are_enforced() {
+        let gdpr = consent_with(Signals {
+            gdpr: true,
+            purposes: vec![1, 4],
+            vendors: vec![9999],
+            ..Signals::default()
+        });
+        assert!(
+            allows(&resolver_policy(), &gdpr),
+            "should allow purposes 1 and 4 under strict"
+        );
+        assert!(
+            !allows(&resolver_policy().with_tcf_purposes([7]), &gdpr),
+            "should block when a custom required purpose is not granted"
+        );
+        let with_seven = consent_with(Signals {
+            gdpr: true,
+            purposes: vec![1, 4, 7],
+            ..Signals::default()
+        });
+        assert!(
+            allows(&resolver_policy().with_tcf_purposes([7]), &with_seven),
+            "should allow when the custom required purpose is granted"
+        );
+
+        let gpp_tcf = consent_with(Signals {
+            gdpr: true,
+            purposes: vec![1, 4],
+            vendors: vec![9999],
+            tcf_in_gpp: true,
+            ..Signals::default()
+        });
+        assert!(
+            allows(&resolver_policy().with_tcf_vendor(9999), &gpp_tcf),
+            "should allow a vendor granted in the GPP TCF section"
+        );
+        assert!(
+            !allows(&resolver_policy().with_tcf_vendor(1234), &gpp_tcf),
+            "should block a vendor the GPP TCF section does not grant"
+        );
+    }
+
+    fn fingerprint(policy: &ConsentPolicy, consent: &ConsentContext) -> String {
+        fingerprint_bits(policy, consent, PolicySignals::default())
+    }
+
+    #[test]
+    fn fingerprint_is_stable_across_cmp_resaves_and_changes_with_a_purpose() {
+        let first = {
+            let mut consent = consent_with(Signals {
+                gdpr: true,
+                purposes: vec![1, 4],
+                ..Signals::default()
+            });
+            consent.raw_tc_string = Some("tc-string-one".to_owned());
+            consent
+        };
+        let resaved = {
+            let mut consent = first.clone();
+            consent.raw_tc_string = Some("tc-string-two".to_owned());
+            let tcf = consent.tcf.as_mut().expect("should carry TCF");
+            tcf.last_updated_ds = 1_700_000_000;
+            tcf.created_ds = 1_600_000_000;
+            tcf.cmp_version = 9;
+            consent
+        };
+        let without_purpose_four = consent_with(Signals {
+            gdpr: true,
+            purposes: vec![1],
+            ..Signals::default()
+        });
+        let strict = resolver_policy();
+
+        assert_eq!(
+            fingerprint(&strict, &first),
+            fingerprint(&strict, &resaved),
+            "should give the same bits after a CMP resave with the same decisions"
+        );
+        assert_eq!(
+            fingerprint(&strict, &first),
+            "10009",
+            "should set bits 0 and 3 for purposes 1 and 4, and bit 16 for the decoded TC string"
+        );
+        assert_ne!(
+            fingerprint(&strict, &first),
+            fingerprint(&strict, &without_purpose_four),
+            "should change when purpose 4 is dropped"
+        );
+        assert_eq!(
+            fingerprint(&strict, &without_purpose_four),
+            "10001",
+            "should keep only bit 0 and the TCF bit when purpose 4 is dropped"
+        );
+    }
+
+    #[test]
+    fn fingerprint_bits_name_each_opt_out_separately() {
+        let strict = resolver_policy();
+        let bits = |consent: &ConsentContext| {
+            u64::from_str_radix(&fingerprint(&strict, consent), 16).expect("should parse as hex")
+        };
+        let neither = consent_with_gpp(|_| {});
+        let sharing = consent_with_gpp(|gpp| gpp.us_sharing_opt_out = Some(true));
+        let targeted = consent_with_gpp(|gpp| gpp.us_targeted_advertising_opt_out = Some(true));
+
+        assert_eq!(bits(&neither), 0, "should be zero with no opt-out");
+        assert_eq!(
+            bits(&sharing),
+            1 << FP_US_SHARING,
+            "should set only the sharing bit"
+        );
+        assert_eq!(
+            bits(&targeted),
+            1 << FP_US_TARGETED,
+            "should set only the targeted-advertising bit"
+        );
+        assert_ne!(
+            bits(&sharing),
+            bits(&targeted),
+            "should tell the two opt-outs apart"
+        );
+
+        let relaxed = resolver_policy()
+            .allowing_us_opt_out(UsOptOut::Sharing)
+            .allowing_us_opt_out(UsOptOut::TargetedAdvertising);
+        assert_eq!(
+            fingerprint(&relaxed, &sharing),
+            "0",
+            "should leave a relaxed sharing opt-out at zero"
+        );
+        assert_eq!(
+            fingerprint(&relaxed, &targeted),
+            "0",
+            "should leave a relaxed targeted-advertising opt-out at zero"
+        );
+    }
+
+    #[test]
+    fn fingerprint_names_gpp_gpc_sale_and_the_mask() {
+        let strict = resolver_policy();
+        let gpp_gpc = consent_with_gpp(|gpp| gpp.us_gpc = Some(true));
+        assert_eq!(
+            fingerprint(&strict, &gpp_gpc),
+            "1000",
+            "should set the existing GPC bit for GPP's GPC field"
+        );
+        let section_6 = consent_with_gpp(|gpp| {
+            gpp.us_privacy_section = Some(decode_us_privacy("1YYN").expect("should decode"));
+        });
+        assert_eq!(
+            fingerprint(&strict, &section_6),
+            "800",
+            "should set the sale bit for a section 6 opt-out"
+        );
+        assert_eq!(
+            (FP_US_SALE, FP_GPC, FP_US_SHARING, FP_US_TARGETED),
+            (11, 12, 14, 15),
+            "should keep each signal at its named position"
+        );
+        assert_eq!(
+            FP_US_OPT_OUT_MASK, 0xd800,
+            "should cover sale, sharing, targeted advertising and GPC"
+        );
+    }
+
+    #[test]
+    fn fingerprint_keeps_part_1_bit_positions() {
+        let policy = resolver_policy()
+            .with_tcf_purposes([2, 10])
+            .with_tcf_vendor(5);
+        let mut consent = consent_with(Signals {
+            gdpr: true,
+            purposes: (1..=10).collect(),
+            vendors: vec![5],
+            gpc: true,
+            us_sale_opt_out: true,
+            ..Signals::default()
+        });
+        consent.gpc = true;
+        assert_eq!(
+            fingerprint_bits(&policy, &consent, PolicySignals { dnt: true }),
+            "13e0b",
+            "should keep purposes 1, 2, 4 and 10 at bits 0, 1, 3 and 9, vendor 10, sale 11, GPC 12, DNT 13 and TCF 16"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/provider.rs b/crates/trusted-server-core/src/ec/identity/provider.rs
new file mode 100644
index 0000000000..923d45ca9f
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/provider.rs
@@ -0,0 +1,156 @@
+//! The identity provider trait.
+
+use error_stack::Report;
+
+use super::descriptor::ProviderDescriptor;
+use super::exchange::{ProviderRequest, ProviderResponse};
+use super::input::{CaptureInput, ResolveInput};
+use super::resolution::{IdentityProviderError, Resolution};
+use crate::settings::IntegrationConfig;
+
+/// A vendor that turns server-side request signals into EIDs.
+///
+/// Only [`descriptor`](Self::descriptor) is required. A provider adds a
+/// capability by declaring it in its descriptor and overriding the matching
+/// methods:
+///
+/// - active resolution: [`Resolves`](super::descriptor::Resolves), plus [`request`](Self::request) and
+///   [`response`](Self::response)
+/// - passive capture: [`Captures`](super::descriptor::Captures), plus [`capture`](Self::capture)
+///
+/// Methods added to this trait later get default bodies, so existing
+/// providers keep compiling. No method takes generic parameters, so the
+/// trait stays object-safe. Every default body returns the
+/// [`IdentityProviderError::not_implemented`] marker, so a capability that is
+/// declared but not implemented is caught by the harness.
+pub trait IdentityProvider: Send + Sync {
+    /// What this provider is, what it may write, what it needs and which
+    /// consent it requires.
+    fn descriptor(&self) -> &ProviderDescriptor;
+
+    /// Builds the call for this request, or `None` to skip it this time.
+    ///
+    /// Skipping is not a failure: the coordinator waits `refresh_after_sec`
+    /// before asking again (section 8).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::UndeclaredInput`] when it reads
+    /// something its descriptor did not declare, or another
+    /// [`IdentityProviderError`] when the request cannot be built.
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let _ = input;
+        Err(IdentityProviderError::not_implemented("request"))
+    }
+
+    /// Turns the buffered response to [`request`](Self::request) into a
+    /// resolution.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Rejected`] for a refusal and
+    /// [`IdentityProviderError::Malformed`] for a body it cannot parse.
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let _ = (response, input);
+        Err(IdentityProviderError::not_implemented("response"))
+    }
+
+    /// Reads IDs from a response TS proxied for this provider, with no
+    /// outbound call. [`Resolution::no_match`] means the response held
+    /// nothing to capture, and costs nothing: capture never backs off.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`IdentityProviderError`] only for a provider bug. A body
+    /// it does not recognise is `Ok(Resolution::no_match())`, not an error.
+    fn capture(
+        &self,
+        input: &CaptureInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let _ = input;
+        Err(IdentityProviderError::not_implemented("capture"))
+    }
+}
+
+/// Implemented by each identity integration's config type.
+///
+/// Builds the provider's descriptor from config alone, with no secrets, so
+/// `ts config validate` checks ownership against the same descriptor the
+/// running provider uses.
+pub trait IdentityProviderConfig: IntegrationConfig {
+    /// Describes the provider this config enables.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the config cannot
+    /// describe a valid provider.
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>>;
+}
+
+// Keeps the trait object-safe. Fails to compile if a method gains generics.
+const _: Option<&dyn IdentityProvider> = None;
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use http::Method;
+
+    use super::*;
+    use crate::ec::identity::descriptor::Captures;
+    use crate::ec::identity::exchange::ProviderResponse;
+    use crate::ec::identity::ids::UnixTime;
+    use crate::ec::identity::input::{CaptureInput, ProviderConsent};
+
+    struct DescriptorOnly(ProviderDescriptor);
+
+    impl IdentityProvider for DescriptorOnly {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.0
+        }
+    }
+
+    #[test]
+    fn default_capability_methods_return_the_not_implemented_marker() {
+        let provider = DescriptorOnly(
+            ProviderDescriptor::builder("p".parse().expect("should parse the provider id"))
+                .with_source("example.com".parse().expect("should parse the source"))
+                .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                .build()
+                .expect("should build"),
+        );
+        let boxed: Box<dyn IdentityProvider> = Box::new(provider);
+        let response = ProviderResponse::for_test(http::StatusCode::OK, b"{}");
+        let consent = ProviderConsent::default();
+        let stored = BTreeMap::new();
+        let input = CaptureInput::new(
+            boxed.descriptor(),
+            "/integrations/p/api",
+            &response,
+            &stored,
+            &consent,
+            "www.example.com",
+            UnixTime::from_secs(1),
+        );
+
+        let error = boxed
+            .capture(&input)
+            .expect_err("should return the not-implemented marker");
+        assert!(
+            error.current_context().is_not_implemented(),
+            "should carry the marker"
+        );
+        assert!(
+            !IdentityProviderError::config("other")
+                .current_context()
+                .is_not_implemented(),
+            "should not treat an ordinary Config error as the marker"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/removal.rs b/crates/trusted-server-core/src/ec/identity/removal.rs
new file mode 100644
index 0000000000..b5d52f3c48
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/removal.rs
@@ -0,0 +1,575 @@
+//! The shared removal write: a removal-only mutation written with the
+//! withdrawal path's CAS loop (spec 5.2 phase 4, 5.3).
+
+use std::time::Duration;
+
+use super::ids::SourceDomain;
+use super::mutation::{ApplyContext, IdentityMutation, apply_removals_only};
+use crate::ec::kv::{KvIdentityGraph, MAX_CAS_RETRIES};
+use crate::ec::kv_backend::{EcKvRateLimited, EcKvWriteOutcome};
+use crate::ec::{EcKvSnapshot, log_id};
+
+/// Writes the removal write makes at most, as the withdrawal path does.
+pub(crate) const REMOVAL_WRITE_ATTEMPTS: u32 = MAX_CAS_RETRIES;
+
+/// How long Fastly's per-key write limit lasts: about one write per second
+/// to one key.
+pub(crate) const PER_KEY_WRITE_WINDOW: Duration = Duration::from_secs(1);
+
+/// When a removal write runs, which decides whether it may wait out the
+/// per-key write limit (spec 5.2 phase 4, 5.3).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum RemovalTiming {
+    /// Before the response is sent. Never waits; a per-key limit ends the
+    /// attempt.
+    BeforeSend,
+    /// After the response is sent, right after a write to the same key
+    /// failed. Waits one per-key window first, and waits again and retries
+    /// after a per-key limit.
+    AfterSend,
+}
+
+/// How a removal write ended.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RemovalWriteOutcome {
+    /// The removals are in KV.
+    Written,
+    /// Nothing to write: a tombstone, a missing row, or already applied.
+    NothingToWrite,
+    /// Not written. The caller may try once more after send.
+    Failed,
+}
+
+/// The KV operations one removal write made.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) struct RemovalCost {
+    pub(crate) reads: u32,
+    pub(crate) writes: u32,
+}
+
+/// Reads the row, applies only `removals` and writes them with a CAS,
+/// retrying a generation mismatch, and after send a per-key limit too.
+///
+/// Runs whatever the request's consent: a revocation can arrive when consent
+/// is unusable. It does not log a lost removal; see [`log_removal_lost`].
+#[must_use]
+pub(crate) fn write_removals(
+    graph: &KvIdentityGraph,
+    ec_id: &str,
+    removals: &IdentityMutation,
+    context: &ApplyContext<'_>,
+    timing: RemovalTiming,
+) -> RemovalWriteOutcome {
+    write_removals_counted(graph, ec_id, removals, context, timing).0
+}
+
+/// As [`write_removals`], also returning the reads and writes it made, for
+/// the request's measurement.
+#[must_use]
+pub(crate) fn write_removals_counted(
+    graph: &KvIdentityGraph,
+    ec_id: &str,
+    removals: &IdentityMutation,
+    context: &ApplyContext<'_>,
+    timing: RemovalTiming,
+) -> (RemovalWriteOutcome, RemovalCost) {
+    let mut cost = RemovalCost::default();
+    if timing == RemovalTiming::AfterSend {
+        graph.pause(PER_KEY_WRITE_WINDOW);
+    }
+    for _attempt in 0..REMOVAL_WRITE_ATTEMPTS {
+        cost.reads = cost.reads.saturating_add(1);
+        let (entry, generation) = match graph.load_snapshot(ec_id) {
+            EcKvSnapshot::Present {
+                entry,
+                generation: Some(generation),
+                ..
+            } => (entry, generation),
+            EcKvSnapshot::Missing { .. } => return (RemovalWriteOutcome::NothingToWrite, cost),
+            _ => return (RemovalWriteOutcome::Failed, cost),
+        };
+        let Some(applied) =
+            apply_removals_only(removals, &entry, context).filter(|applied| applied.changed)
+        else {
+            return (RemovalWriteOutcome::NothingToWrite, cost);
+        };
+        cost.writes = cost.writes.saturating_add(1);
+        match graph.write_if_generation(ec_id, &applied.entry, generation) {
+            Ok(EcKvWriteOutcome::Written) => return (RemovalWriteOutcome::Written, cost),
+            Ok(EcKvWriteOutcome::PreconditionFailed) => {}
+            Err(error)
+                if timing == RemovalTiming::AfterSend && error.contains::<EcKvRateLimited>() =>
+            {
+                log::debug!(
+                    "Identity removal write for '{}' hit the per-key limit; waiting",
+                    log_id(ec_id)
+                );
+                graph.pause(PER_KEY_WRITE_WINDOW);
+            }
+            Err(error) => {
+                log::warn!(
+                    "Identity removal write failed for '{}': {error:?}",
+                    log_id(ec_id)
+                );
+                return (RemovalWriteOutcome::Failed, cost);
+            }
+        }
+    }
+    log::warn!(
+        "Identity removal write for '{}': no write after {REMOVAL_WRITE_ATTEMPTS} attempts",
+        log_id(ec_id)
+    );
+    (RemovalWriteOutcome::Failed, cost)
+}
+
+/// Logs a removal that every attempt failed to write. Names providers and
+/// sources only, never a UID.
+pub(crate) fn log_removal_lost(ec_id: &str, removals: &IdentityMutation) {
+    for (provider, source) in removals.removal_labels() {
+        log::error!(
+            "Identity removal lost for '{}': provider '{provider}', source '{}'",
+            log_id(ec_id),
+            source.as_ref().map_or("*", SourceDomain::as_str),
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+    use std::sync::Mutex;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::time::Duration;
+
+    use error_stack::Report;
+
+    use super::*;
+    use crate::ec::identity::catalog::ProviderCatalog;
+    use crate::ec::identity::input::SeededRandom;
+    use crate::ec::identity::mutation::{PartnerIdChange, ProviderStateChange};
+    use crate::ec::identity::revision::{RecordRevision, Revision};
+    use crate::ec::identity::test_support::fixed_provider;
+    use crate::ec::kv::KvIdentityGraph;
+    use crate::ec::kv_backend::test_support::InMemoryEcKv;
+    use crate::ec::kv_backend::{
+        EcKvLookup, EcKvRateLimited, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome,
+    };
+    use crate::ec::kv_types::{KvEntry, KvOptOut, KvPartnerId};
+    use crate::error::TrustedServerError;
+
+    const EC_ID: &str = "0000000000000000000000000000000000000000000000000000000000000000.ABC123";
+
+    /// Write counts and pauses the store keeps after seeding.
+    #[derive(Default)]
+    struct WriteCounts {
+        all: AtomicUsize,
+        generation_checked: AtomicUsize,
+        pauses: Mutex<Vec<Duration>>,
+    }
+
+    impl WriteCounts {
+        fn pauses(&self) -> Vec<Duration> {
+            self.pauses.lock().expect("should lock the pauses").clone()
+        }
+    }
+
+    /// Fails the first `rate_limited` generation-checked writes with a
+    /// per-key rate-limit error, then the next `conflicts` with
+    /// `PreconditionFailed`, or every generation-checked write with a plain
+    /// error when `error` is set. Counts every write and pause it sees.
+    struct ScriptedEcKv {
+        inner: InMemoryEcKv,
+        conflicts: Mutex<u32>,
+        rate_limited: Mutex<u32>,
+        error: bool,
+        counts: Arc<WriteCounts>,
+    }
+
+    impl EcKvStore for ScriptedEcKv {
+        fn store_name(&self) -> &str {
+            self.inner.store_name()
+        }
+
+        fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+            self.inner.lookup(key)
+        }
+
+        fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+            self.inner.key_exists(key)
+        }
+
+        fn insert(
+            &self,
+            key: &str,
+            write: EcKvWrite<'_>,
+        ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+            self.counts.all.fetch_add(1, Ordering::SeqCst);
+            if matches!(write.mode, EcKvWriteMode::IfGenerationMatch(_)) {
+                self.counts
+                    .generation_checked
+                    .fetch_add(1, Ordering::SeqCst);
+                if self.error {
+                    return Err(Report::new(TrustedServerError::KvStore {
+                        store_name: self.inner.store_name().to_owned(),
+                        message: "store unavailable".to_owned(),
+                    }));
+                }
+                let mut limited = self.rate_limited.lock().expect("should lock the counter");
+                if *limited > 0 {
+                    *limited -= 1;
+                    return Err(Report::new(TrustedServerError::KvStore {
+                        store_name: self.inner.store_name().to_owned(),
+                        message: "per-key write limit".to_owned(),
+                    })
+                    .attach_opaque(EcKvRateLimited));
+                }
+                drop(limited);
+                let mut remaining = self.conflicts.lock().expect("should lock the counter");
+                if *remaining > 0 {
+                    *remaining -= 1;
+                    return Ok(EcKvWriteOutcome::PreconditionFailed);
+                }
+            }
+            self.inner.insert(key, write)
+        }
+
+        fn list_keys_with_prefix(
+            &self,
+            prefix: &str,
+            limit: u32,
+        ) -> Result<Vec<String>, Report<TrustedServerError>> {
+            self.inner.list_keys_with_prefix(prefix, limit)
+        }
+
+        fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+            self.inner.delete(key)
+        }
+
+        fn pause(&self, duration: Duration) {
+            self.counts
+                .pauses
+                .lock()
+                .expect("should lock the pauses")
+                .push(duration);
+        }
+    }
+
+    /// Seeds `entry` with `create`, then wraps the store and zeroes the counts.
+    fn graph_with(
+        entry: Option<&KvEntry>,
+        conflicts: u32,
+        error: bool,
+    ) -> (KvIdentityGraph, Arc<WriteCounts>) {
+        graph_limited(entry, 0, conflicts, error)
+    }
+
+    /// As [`graph_with`], rate-limiting the first `rate_limited` writes.
+    fn graph_limited(
+        entry: Option<&KvEntry>,
+        rate_limited: u32,
+        conflicts: u32,
+        error: bool,
+    ) -> (KvIdentityGraph, Arc<WriteCounts>) {
+        let counts = Arc::new(WriteCounts::default());
+        let graph = KvIdentityGraph::new(ScriptedEcKv {
+            inner: InMemoryEcKv::new("removal-store"),
+            conflicts: Mutex::new(conflicts),
+            rate_limited: Mutex::new(rate_limited),
+            error,
+            counts: Arc::clone(&counts),
+        });
+        if let Some(entry) = entry {
+            graph.create(EC_ID, entry).expect("should seed the row");
+        }
+        counts.all.store(0, Ordering::SeqCst);
+        counts.generation_checked.store(0, Ordering::SeqCst);
+        (graph, counts)
+    }
+
+    fn removal() -> IdentityMutation {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: "a.example.com".parse().expect("should parse the source"),
+            provider: "owner".parse().expect("should parse the provider ID"),
+            expected: Revision::Set(RecordRevision::from_stored("1111111111111111")),
+        });
+        mutation
+    }
+
+    fn live() -> KvEntry {
+        let mut entry = KvEntry::minimal("b.example.com", "x", 1);
+        entry.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId {
+                w: Some("owner".to_owned()),
+                rv: Some("1111111111111111".to_owned()),
+                ..KvPartnerId::new("u")
+            },
+        );
+        entry
+    }
+
+    fn run(graph: &KvIdentityGraph, removals: &IdentityMutation) -> RemovalWriteOutcome {
+        run_at(graph, removals, RemovalTiming::BeforeSend)
+    }
+
+    fn run_at(
+        graph: &KvIdentityGraph,
+        removals: &IdentityMutation,
+        timing: RemovalTiming,
+    ) -> RemovalWriteOutcome {
+        let random = SeededRandom::new(1);
+        let catalog = ProviderCatalog::new(
+            vec![fixed_provider("owner", &["a.example.com"])],
+            [(
+                "a.example.com".parse().expect("should parse the source"),
+                "owner".parse().expect("should parse the provider ID"),
+            )]
+            .into_iter()
+            .collect(),
+        );
+        write_removals(
+            graph,
+            EC_ID,
+            removals,
+            &ApplyContext {
+                now: 1_000,
+                random: &random,
+                catalog: &catalog,
+            },
+            timing,
+        )
+    }
+
+    #[test]
+    fn before_send_neither_waits_nor_retries_a_per_key_limit() {
+        let (graph, counts) = graph_limited(Some(&live()), 1, 0, false);
+
+        assert_eq!(
+            run_at(&graph, &removal(), RemovalTiming::BeforeSend),
+            RemovalWriteOutcome::Failed,
+            "should end the attempt at the per-key limit"
+        );
+
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            1,
+            "should write once"
+        );
+        assert!(counts.pauses().is_empty(), "should not wait before send");
+    }
+
+    #[test]
+    fn after_send_waits_the_per_key_window_before_its_first_write() {
+        let (graph, counts) = graph_with(Some(&live()), 0, false);
+
+        assert_eq!(
+            run_at(&graph, &removal(), RemovalTiming::AfterSend),
+            RemovalWriteOutcome::Written,
+            "should write"
+        );
+
+        assert_eq!(
+            counts.pauses(),
+            vec![PER_KEY_WRITE_WINDOW],
+            "should wait one per-key window first"
+        );
+    }
+
+    #[test]
+    fn after_send_retries_a_per_key_limit_after_another_window() {
+        let (graph, counts) = graph_limited(Some(&live()), 1, 0, false);
+
+        assert_eq!(
+            run_at(&graph, &removal(), RemovalTiming::AfterSend),
+            RemovalWriteOutcome::Written,
+            "should win after the rate-limited write"
+        );
+
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            2,
+            "should re-read and write again"
+        );
+        assert_eq!(
+            counts.pauses(),
+            vec![PER_KEY_WRITE_WINDOW, PER_KEY_WRITE_WINDOW],
+            "should wait before the first write and after the limit"
+        );
+    }
+
+    #[test]
+    fn after_send_gives_up_on_a_per_key_limit_after_five_writes() {
+        let (graph, counts) = graph_limited(Some(&live()), 5, 0, false);
+
+        assert_eq!(
+            run_at(&graph, &removal(), RemovalTiming::AfterSend),
+            RemovalWriteOutcome::Failed,
+            "should give up"
+        );
+
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            5,
+            "should stop at five writes"
+        );
+    }
+
+    #[test]
+    fn after_send_does_not_retry_other_errors() {
+        let (graph, counts) = graph_with(Some(&live()), 0, true);
+
+        assert_eq!(
+            run_at(&graph, &removal(), RemovalTiming::AfterSend),
+            RemovalWriteOutcome::Failed,
+            "should stop at a non-CAS, non-limit error"
+        );
+
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            1,
+            "should write once"
+        );
+    }
+
+    #[test]
+    fn writes_the_removal_once_with_a_generation_check() {
+        let (graph, counts) = graph_with(Some(&live()), 0, false);
+
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::Written,
+            "should write"
+        );
+
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            1,
+            "should write once, with IfGenerationMatch"
+        );
+        let (entry, _) = graph
+            .get(EC_ID)
+            .expect("should read")
+            .expect("should hold the row");
+        assert!(
+            !entry.ids.contains_key("a.example.com"),
+            "should remove the record"
+        );
+        assert_eq!(
+            entry.ps["owner"].iv.len(),
+            1,
+            "should hash the removed UID into iv"
+        );
+    }
+
+    #[test]
+    fn retries_only_a_generation_mismatch_up_to_five_writes() {
+        let (graph, counts) = graph_with(Some(&live()), 2, false);
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::Written,
+            "should win on the third write"
+        );
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            3,
+            "should re-read and retry each conflict"
+        );
+
+        let (graph, counts) = graph_with(Some(&live()), 5, false);
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::Failed,
+            "should give up after five conflicts"
+        );
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            5,
+            "should stop at five writes"
+        );
+
+        let (graph, counts) = graph_with(Some(&live()), 0, true);
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::Failed,
+            "should stop at a non-CAS error"
+        );
+        assert_eq!(
+            counts.generation_checked.load(Ordering::SeqCst),
+            1,
+            "should not retry a non-CAS error"
+        );
+    }
+
+    #[test]
+    fn writes_nothing_for_a_tombstone_a_missing_row_or_an_applied_removal() {
+        let (graph, counts) = graph_with(Some(&KvEntry::tombstone(1)), 0, false);
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::NothingToWrite,
+            "should skip a tombstone"
+        );
+        assert_eq!(
+            counts.all.load(Ordering::SeqCst),
+            0,
+            "should not write a tombstone"
+        );
+
+        let (graph, counts) = graph_with(None, 0, false);
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::NothingToWrite,
+            "should skip a missing row"
+        );
+        assert_eq!(
+            counts.all.load(Ordering::SeqCst),
+            0,
+            "should not write a missing row"
+        );
+
+        let (graph, counts) =
+            graph_with(Some(&KvEntry::minimal("b.example.com", "x", 1)), 0, false);
+        assert_eq!(
+            run(&graph, &removal()),
+            RemovalWriteOutcome::NothingToWrite,
+            "should skip an applied removal"
+        );
+        assert_eq!(
+            counts.all.load(Ordering::SeqCst),
+            0,
+            "should not write an applied removal"
+        );
+    }
+
+    #[test]
+    fn an_opt_out_and_its_clear_are_written_without_positive_changes() {
+        let (graph, _) = graph_with(Some(&live()), 0, false);
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(
+            "owner".parse().expect("should parse the provider ID"),
+            ProviderStateChange {
+                opt_out: Some(KvOptOut {
+                    at: 1_000,
+                    fp: "1".to_owned(),
+                }),
+                ..ProviderStateChange::default()
+            },
+        );
+
+        assert_eq!(
+            run(&graph, &mutation.removals()),
+            RemovalWriteOutcome::Written,
+            "should write the opt-out"
+        );
+
+        let (entry, _) = graph
+            .get(EC_ID)
+            .expect("should read")
+            .expect("should hold the row");
+        assert!(entry.ps["owner"].o.is_some(), "should store o");
+        assert!(
+            !entry.ids.contains_key("a.example.com"),
+            "should remove what the provider wrote"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/request.rs b/crates/trusted-server-core/src/ec/identity/request.rs
new file mode 100644
index 0000000000..2ff20fb30b
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/request.rs
@@ -0,0 +1,392 @@
+//! Identity state one request carries on [`crate::ec::EcContext`] (spec 5.1).
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::Arc;
+
+use url::Url;
+
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::mutation::{IdentityMutation, is_opted_out};
+use super::runtime::IdentityRuntime;
+use crate::ec::kv_types::KvEntry;
+use crate::ec::rate_limiter::RateLimiter;
+
+/// The providers with a sticky opt-out (`ps.o`) in `entry`, unless a later
+/// `oc` clears it (spec 7.1).
+///
+/// KV is the only source: no cookie carries an opt-out. A key that is not a
+/// valid provider ID cannot name a configured provider and is skipped.
+#[must_use]
+pub(crate) fn opted_out(entry: &KvEntry) -> BTreeSet<IdentityProviderId> {
+    entry
+        .ps
+        .keys()
+        .filter(|provider| is_opted_out(entry, provider))
+        .filter_map(|provider| provider.parse().ok())
+        .collect()
+}
+
+/// What one request decides and collects for identity.
+///
+/// Its [`Debug`](core::fmt::Debug) prints counts and flags only: the mutation
+/// holds UIDs that must not reach a log (spec 9.3).
+#[derive(Default, Clone)]
+pub(crate) struct RequestIdentity {
+    writer: bool,
+    spa_writer: bool,
+    is_real_browser: bool,
+    user_agent: Option<String>,
+    dnt: bool,
+    page_url: Option<Url>,
+    runtime: Option<Arc<IdentityRuntime>>,
+    rate_limiter: Option<Arc<dyn RateLimiter + Send + Sync>>,
+    runs_auction: bool,
+    hold_dispatched: bool,
+    mutation: IdentityMutation,
+    pending_removals: Option<IdentityMutation>,
+    capture_writes: IdentityMutation,
+    removal_lost: u32,
+    removal_deferred: u32,
+    cookie_header_bytes: usize,
+    create_attempts: u32,
+    capture_unpersisted: BTreeMap<(IdentityProviderId, SourceDomain), u32>,
+    global_revoke: bool,
+    capture_kv_reads: u32,
+    capture_kv_writes: u32,
+}
+
+impl core::fmt::Debug for RequestIdentity {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("RequestIdentity")
+            .field("writer", &self.writer)
+            .field("is_real_browser", &self.is_real_browser)
+            .field("mutation_changes", &self.mutation.change_count())
+            .field("has_pending_removals", &self.pending_removals.is_some())
+            .field("capture_writes", &self.capture_writes.change_count())
+            .field("removal_lost", &self.removal_lost)
+            .field("removal_deferred", &self.removal_deferred)
+            .field("has_runtime", &self.runtime.is_some())
+            .finish_non_exhaustive()
+    }
+}
+
+// Temporary: the accessors and setters below are first used by later identity tasks.
+#[allow(dead_code)]
+impl RequestIdentity {
+    /// Whether this request is the one browser-driven writer.
+    #[must_use]
+    pub(crate) fn writer(&self) -> bool {
+        self.writer
+    }
+
+    /// Whether the request passed the real-browser check.
+    #[must_use]
+    pub(crate) fn is_real_browser(&self) -> bool {
+        self.is_real_browser
+    }
+
+    /// The request's `User-Agent`, captured in phase 1.
+    #[must_use]
+    pub(crate) fn user_agent(&self) -> Option<&str> {
+        self.user_agent.as_deref()
+    }
+
+    /// Whether the request sent `DNT: 1`.
+    #[must_use]
+    pub(crate) fn dnt(&self) -> bool {
+        self.dnt
+    }
+
+    /// The page URL without query or fragment.
+    #[must_use]
+    pub(crate) fn page_url(&self) -> Option<&Url> {
+        self.page_url.as_ref()
+    }
+
+    /// The request's identity runtime, when the adapter set one.
+    #[must_use]
+    pub(crate) fn runtime(&self) -> Option<&Arc<IdentityRuntime>> {
+        self.runtime.as_ref()
+    }
+
+    /// The limiter the provider burst cap and circuit breaker count in, when
+    /// the adapter set one.
+    #[must_use]
+    pub(crate) fn rate_limiter(&self) -> Option<Arc<dyn RateLimiter + Send + Sync>> {
+        self.rate_limiter.clone()
+    }
+
+    /// Sets the limiter the hold dispatch counts in.
+    pub(crate) fn set_rate_limiter(&mut self, limiter: Arc<dyn RateLimiter + Send + Sync>) {
+        self.rate_limiter = Some(limiter);
+    }
+
+    /// Whether this navigation runs an auction, so hold-mode providers may
+    /// be dispatched before it.
+    #[must_use]
+    pub(crate) fn runs_auction(&self) -> bool {
+        self.runs_auction
+    }
+
+    /// Whether the hold dispatch considered every hold-mode provider on a
+    /// usable phase 1 row, so phase 4 must not run them again.
+    #[must_use]
+    pub(crate) fn hold_dispatched(&self) -> bool {
+        self.hold_dispatched
+    }
+
+    /// Records that the hold dispatch ran on a usable phase 1 row.
+    pub(crate) fn set_hold_dispatched(&mut self) {
+        self.hold_dispatched = true;
+    }
+
+    /// Records that this navigation runs an auction (spec 4.7 step 7).
+    pub(crate) fn set_runs_auction(&mut self, runs_auction: bool) {
+        self.runs_auction = runs_auction;
+    }
+
+    /// The writer's one flush.
+    #[must_use]
+    pub(crate) fn mutation(&self) -> &IdentityMutation {
+        &self.mutation
+    }
+
+    /// The writer's one flush, to fill.
+    pub(crate) fn mutation_mut(&mut self) -> &mut IdentityMutation {
+        &mut self.mutation
+    }
+
+    /// A removal write that failed before send, to try once more after send.
+    #[must_use]
+    pub(crate) fn pending_removals(&self) -> Option<&IdentityMutation> {
+        self.pending_removals.as_ref()
+    }
+
+    /// Keeps a removal write for one retry after send.
+    pub(crate) fn set_pending_removals(&mut self, removals: Option<IdentityMutation>) {
+        self.pending_removals = removals;
+    }
+
+    /// Positive capture writes a request that is not the writer keeps for
+    /// the pending key (spec 5.3, Pending key).
+    #[must_use]
+    pub(crate) fn capture_writes(&self) -> &IdentityMutation {
+        &self.capture_writes
+    }
+
+    /// The capture writes, to fill or take.
+    pub(crate) fn capture_writes_mut(&mut self) -> &mut IdentityMutation {
+        &mut self.capture_writes
+    }
+
+    /// Removals the row write missed that went to the pending key.
+    #[must_use]
+    pub(crate) fn removal_deferred(&self) -> u32 {
+        self.removal_deferred
+    }
+
+    /// Counts one removal that went to the pending key.
+    pub(crate) fn record_removal_deferred(&mut self) {
+        self.removal_deferred = self.removal_deferred.saturating_add(1);
+    }
+
+    /// Removals every attempt failed to write (spec 5.2 phase 4, 5.3).
+    #[must_use]
+    pub(crate) fn removal_lost(&self) -> u32 {
+        self.removal_lost
+    }
+
+    /// Create writes the new-EC path attempted before routing.
+    #[must_use]
+    pub(crate) fn create_attempts(&self) -> u32 {
+        self.create_attempts
+    }
+
+    /// Counts one create write of the new-EC path.
+    pub(crate) fn record_create_attempt(&mut self) {
+        self.create_attempts = self.create_attempts.saturating_add(1);
+    }
+
+    /// The inbound `Cookie` header size in bytes.
+    #[must_use]
+    pub(crate) fn cookie_header_bytes(&self) -> usize {
+        self.cookie_header_bytes
+    }
+
+    /// Records the inbound `Cookie` header size in bytes.
+    pub(crate) fn set_cookie_header_bytes(&mut self, bytes: usize) {
+        self.cookie_header_bytes = bytes;
+    }
+
+    /// Counts one removal that every attempt failed to write.
+    pub(crate) fn record_removal_lost(&mut self) {
+        self.removal_lost = self.removal_lost.saturating_add(1);
+    }
+
+    /// Positive capture IDs counted but never stored (spec 4.7).
+    #[must_use]
+    pub(crate) fn capture_unpersisted(&self) -> &BTreeMap<(IdentityProviderId, SourceDomain), u32> {
+        &self.capture_unpersisted
+    }
+
+    /// Counts one positive capture ID that was not stored.
+    pub(crate) fn record_unpersisted(
+        &mut self,
+        provider: IdentityProviderId,
+        source: SourceDomain,
+    ) {
+        let count = self
+            .capture_unpersisted
+            .entry((provider, source))
+            .or_insert(0);
+        *count = count.saturating_add(1);
+    }
+
+    /// KV reads the capture made (its view read and the removal write's).
+    #[must_use]
+    pub(crate) fn capture_kv_reads(&self) -> u32 {
+        self.capture_kv_reads
+    }
+
+    /// KV writes the capture removal write attempted.
+    #[must_use]
+    pub(crate) fn capture_kv_writes(&self) -> u32 {
+        self.capture_kv_writes
+    }
+
+    /// Counts KV operations the capture made before send.
+    pub(crate) fn record_capture_kv(&mut self, reads: u32, writes: u32) {
+        self.capture_kv_reads = self.capture_kv_reads.saturating_add(reads);
+        self.capture_kv_writes = self.capture_kv_writes.saturating_add(writes);
+    }
+
+    /// Whether a real browser's capture asked for a global revoke (spec 8).
+    #[must_use]
+    pub(crate) fn global_revoke_requested(&self) -> bool {
+        self.global_revoke
+    }
+
+    /// Asks finalize to run the consent-withdrawal tombstone path.
+    pub(crate) fn request_global_revoke(&mut self) {
+        self.global_revoke = true;
+    }
+
+    /// Sets the writer decision and the signals captured with it.
+    pub(crate) fn set_writer_decision(&mut self, decision: WriterDecision) {
+        self.writer = decision.writer;
+        self.is_real_browser = decision.is_real_browser;
+        self.user_agent = decision.user_agent;
+        self.dnt = decision.dnt;
+        self.page_url = decision.page_url;
+    }
+
+    /// Whether the writer is a `/_ts/page-bids` call, which the interval
+    /// since the row's last writer flush paces and which runs no hold-mode
+    /// provider (spec 5.1).
+    #[must_use]
+    pub(crate) fn spa_writer(&self) -> bool {
+        self.spa_writer
+    }
+
+    /// Marks the writer as the SPA writer.
+    pub(crate) fn set_spa_writer(&mut self, spa_writer: bool) {
+        self.spa_writer = spa_writer;
+    }
+
+    /// Records only the real-browser flag, for a route that is never the writer.
+    pub(crate) fn set_real_browser(&mut self, is_real_browser: bool) {
+        self.is_real_browser = is_real_browser;
+    }
+
+    /// Sets the runtime built once per settings load.
+    pub(crate) fn set_runtime(&mut self, runtime: Arc<IdentityRuntime>) {
+        self.runtime = Some(runtime);
+    }
+}
+
+/// The writer decision and the signals captured with it.
+pub(crate) struct WriterDecision {
+    pub(crate) writer: bool,
+    pub(crate) is_real_browser: bool,
+    pub(crate) user_agent: Option<String>,
+    pub(crate) dnt: bool,
+    pub(crate) page_url: Option<Url>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ec::identity::mutation::PartnerIdChange;
+    use crate::ec::identity::revision::Revision;
+    use crate::ec::identity::test_support::{pid, record_for_test, source};
+    use crate::ec::kv_types::{KvEntry, KvOptOut, KvProviderState};
+
+    #[test]
+    fn request_identity_debug_prints_no_uid() {
+        let mut identity = RequestIdentity::default();
+        identity
+            .mutation_mut()
+            .add_change(PartnerIdChange::FillMissing {
+                source: source("ssp.example.com"),
+                record: record_for_test("secret-uid-1", None, 10),
+            });
+        identity
+            .mutation_mut()
+            .add_change(PartnerIdChange::OwnerRemove {
+                source: source("dsp.example.com"),
+                provider: pid("owner"),
+                expected: Revision::Unset,
+            });
+
+        let printed = format!("{identity:?}");
+
+        assert!(
+            !printed.contains("secret-uid-1"),
+            "should print no UID: {printed}"
+        );
+        assert!(
+            printed.contains("mutation_changes: 2"),
+            "should print the change count: {printed}"
+        );
+    }
+
+    #[test]
+    fn opted_out_reads_ps_o_and_honours_a_later_clear() {
+        let mut entry = KvEntry::minimal("ssp.example.com", "uid", 1);
+        let opt_out = || KvOptOut {
+            at: 100,
+            fp: String::new(),
+        };
+        entry.ps.insert(
+            "a".to_owned(),
+            KvProviderState {
+                o: Some(opt_out()),
+                ..KvProviderState::default()
+            },
+        );
+        entry.ps.insert(
+            "b".to_owned(),
+            KvProviderState {
+                o: Some(opt_out()),
+                oc: Some(101),
+                ..KvProviderState::default()
+            },
+        );
+        entry.ps.insert(
+            "c".to_owned(),
+            KvProviderState {
+                oc: Some(50),
+                ..KvProviderState::default()
+            },
+        );
+
+        let result = opted_out(&entry);
+
+        assert_eq!(
+            result,
+            BTreeSet::from([pid("a")]),
+            "should keep only the provider whose opt-out is not cleared later"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/resolution.rs b/crates/trusted-server-core/src/ec/identity/resolution.rs
new file mode 100644
index 0000000000..01f7441831
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/resolution.rs
@@ -0,0 +1,1311 @@
+//! Provider results and errors.
+
+use std::collections::BTreeMap;
+use std::iter;
+use std::time::Duration;
+
+use error_stack::Report;
+use http::StatusCode;
+use serde::Serialize;
+
+use super::descriptor::{Access, Input};
+use super::ids::{SourceDomain, UnixTime};
+use crate::ec::kv_types::{
+    KvEid, KvUid, MAX_ENTRIES_PER_SOURCE, MAX_ENTRY_SET_BYTES, MAX_PARTNER_EXT_BYTES,
+    MAX_PROVIDER_STATE_BYTES, MAX_UID_LENGTH, MAX_UIDS_PER_SOURCE, entry_set_bytes,
+    is_valid_eid_field, is_valid_partner_ext,
+};
+
+/// Marker message of [`IdentityProviderError::not_implemented`]. The harness
+/// matches on it to tell a missing override from a real failure.
+pub(crate) const NOT_IMPLEMENTED_MARKER: &str = "capability declared but not implemented: ";
+
+/// A provider failure. Built through the constructors below.
+#[derive(Debug, derive_more::Display)]
+#[non_exhaustive]
+pub enum IdentityProviderError {
+    /// Configuration or provider code makes the call impossible.
+    #[display("identity provider configuration error: {message}")]
+    Config {
+        /// What is wrong. Never contains a secret, UID or URL query.
+        message: String,
+    },
+    /// The provider read something its descriptor did not declare.
+    #[display("`{access}` was read but not declared")]
+    UndeclaredInput {
+        /// What was read.
+        access: Access,
+    },
+    /// A declared input is not available for this request.
+    #[display("input `{input}` is unavailable for this request")]
+    InputUnavailable {
+        /// The missing input.
+        input: Input,
+    },
+    /// The provider refused the request.
+    #[display("provider rejected the request with status {status}")]
+    Rejected {
+        /// The response status.
+        status: StatusCode,
+    },
+    /// The provider's response could not be parsed.
+    #[display("provider response could not be parsed")]
+    Malformed,
+    /// The stored private state does not decode as the provider's type.
+    #[display("stored provider state could not be decoded")]
+    InvalidState,
+    /// Set by the coordinator only. Providers never see transport failures.
+    #[display("provider request failed in transport")]
+    Transport,
+}
+
+impl core::error::Error for IdentityProviderError {}
+
+impl IdentityProviderError {
+    /// A [`Self::Config`] error.
+    pub fn config(message: impl Into<String>) -> Report<Self> {
+        Report::new(Self::Config {
+            message: message.into(),
+        })
+    }
+
+    /// A [`Self::Rejected`] error.
+    pub fn rejected(status: StatusCode) -> Report<Self> {
+        Report::new(Self::Rejected { status })
+    }
+
+    /// A [`Self::Malformed`] error.
+    pub fn malformed() -> Report<Self> {
+        Report::new(Self::Malformed)
+    }
+
+    /// The default body of a capability method: a `Config` error with a
+    /// fixed marker message, so the harness can tell a missing override from
+    /// a real failure.
+    pub fn not_implemented(method: &'static str) -> Report<Self> {
+        Self::config(format!("{NOT_IMPLEMENTED_MARKER}{method}"))
+    }
+
+    /// Whether this is the [`Self::not_implemented`] marker.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn is_not_implemented(&self) -> bool {
+        matches!(self, Self::Config { message } if message.starts_with(NOT_IMPLEMENTED_MARKER))
+    }
+}
+
+/// A time as a provider gave it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum When {
+    /// Relative to the request's `now`.
+    In(Duration),
+    /// Absolute.
+    At(UnixTime),
+}
+
+impl When {
+    /// Resolves against `now`.
+    #[must_use]
+    pub(crate) fn resolve(self, now: UnixTime) -> UnixTime {
+        match self {
+            Self::In(delay) => now + delay,
+            Self::At(at) => at,
+        }
+    }
+}
+
+fn ext_fits(ext: &serde_json::Value) -> bool {
+    serde_json::to_vec(ext).is_ok_and(|bytes| bytes.len() <= MAX_PARTNER_EXT_BYTES)
+}
+
+/// One UID within a [`ResolvedEid`].
+#[derive(Clone, PartialEq)]
+pub struct ResolvedUid {
+    id: String,
+    atype: Option<i32>,
+    ext: Option<serde_json::Value>,
+}
+
+impl core::fmt::Debug for ResolvedUid {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("ResolvedUid")
+            .field("id", &"[redacted]")
+            .field("atype", &self.atype)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ResolvedUid {
+    /// A UID with no `atype` or ext.
+    #[must_use]
+    pub fn new(id: impl Into<String>) -> Self {
+        Self {
+            id: id.into(),
+            atype: None,
+            ext: None,
+        }
+    }
+
+    /// Sets `atype`.
+    #[must_use]
+    pub fn with_atype(mut self, atype: i32) -> Self {
+        self.atype = Some(atype);
+        self
+    }
+
+    /// UID-level ext. Over 2,048 bytes as compact JSON it is dropped and the
+    /// UID kept.
+    #[must_use]
+    pub fn with_ext(mut self, ext: serde_json::Value) -> Self {
+        let fits = ext_fits(&ext);
+        if !fits {
+            log::debug!("Dropping an oversized UID-level ext");
+        }
+        self.ext = fits.then_some(ext);
+        self
+    }
+
+    /// The UID.
+    #[must_use]
+    pub fn id(&self) -> &str {
+        &self.id
+    }
+
+    /// `atype`.
+    #[must_use]
+    pub fn atype(&self) -> Option<i32> {
+        self.atype
+    }
+
+    /// UID-level ext.
+    #[must_use]
+    pub fn ext(&self) -> Option<&serde_json::Value> {
+        self.ext.as_ref()
+    }
+}
+
+/// One `OpenRTB` EID entry a provider returns: a source, its UIDs and its
+/// EID-level fields.
+#[derive(Clone, PartialEq)]
+pub struct ResolvedEid {
+    source: SourceDomain,
+    uids: Vec<ResolvedUid>,
+    inserter: Option<String>,
+    matcher: Option<String>,
+    mm: Option<i32>,
+    ext: Option<serde_json::Value>,
+    expiry: Option<When>,
+    refresh: Option<When>,
+    refresh_until: Option<UnixTime>,
+}
+
+impl core::fmt::Debug for ResolvedEid {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("ResolvedEid")
+            .field("source", &self.source)
+            .field("uids", &self.uids)
+            .field("mm", &self.mm)
+            .field("expiry", &self.expiry)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ResolvedEid {
+    /// An entry with one UID, the common case.
+    #[must_use]
+    pub fn new(source: &SourceDomain, uid: ResolvedUid) -> Self {
+        Self {
+            source: source.clone(),
+            uids: vec![uid],
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+            expiry: None,
+            refresh: None,
+            refresh_until: None,
+        }
+    }
+
+    /// Adds another UID to this entry. Repeatable.
+    #[must_use]
+    pub fn with_uid(mut self, uid: ResolvedUid) -> Self {
+        self.uids.push(uid);
+        self
+    }
+
+    /// Sets `inserter`. An entry that sets any of `inserter`, `matcher` and
+    /// `mm` states its EID-level fields completely, so the descriptor's
+    /// `with_provenance` default no longer applies to it (spec 4.3).
+    #[must_use]
+    pub fn with_inserter(mut self, inserter: &str) -> Self {
+        self.inserter = Some(inserter.to_owned());
+        self
+    }
+
+    /// Sets `matcher`. As [`Self::with_inserter`], it turns off the
+    /// descriptor's default for this entry.
+    #[must_use]
+    pub fn with_matcher(mut self, matcher: &str) -> Self {
+        self.matcher = Some(matcher.to_owned());
+        self
+    }
+
+    /// Sets `mm`. As [`Self::with_inserter`], it turns off the descriptor's
+    /// default for this entry.
+    #[must_use]
+    pub fn with_mm(mut self, mm: i32) -> Self {
+        self.mm = Some(mm);
+        self
+    }
+
+    /// EID-level ext. Over 2,048 bytes as compact JSON it is dropped and the
+    /// entry kept.
+    #[must_use]
+    pub fn with_ext(mut self, ext: serde_json::Value) -> Self {
+        let fits = ext_fits(&ext);
+        if !fits {
+            log::debug!("Dropping an oversized EID-level ext");
+        }
+        self.ext = fits.then_some(ext);
+        self
+    }
+
+    /// Expires after `delay`. Timing applies to the source's whole entry
+    /// set, and the earliest time across its entries wins.
+    #[must_use]
+    pub fn with_expires_in(mut self, delay: Duration) -> Self {
+        self.expiry = Some(When::In(delay));
+        self
+    }
+
+    /// Expires at `at`.
+    #[must_use]
+    pub fn with_expires_at(mut self, at: UnixTime) -> Self {
+        self.expiry = Some(When::At(at));
+        self
+    }
+
+    /// Due for refresh after `delay`.
+    #[must_use]
+    pub fn with_refresh_in(mut self, delay: Duration) -> Self {
+        self.refresh = Some(When::In(delay));
+        self
+    }
+
+    /// Due for refresh at `at`.
+    #[must_use]
+    pub fn with_refresh_at(mut self, at: UnixTime) -> Self {
+        self.refresh = Some(When::At(at));
+        self
+    }
+
+    /// When this ID stops being refreshable. Only for a provider declared
+    /// `with_private_state()`; the coordinator ignores it otherwise.
+    #[must_use]
+    pub fn with_refresh_until(mut self, at: UnixTime) -> Self {
+        self.refresh_until = Some(at);
+        self
+    }
+
+    /// The source.
+    #[must_use]
+    pub fn source(&self) -> &SourceDomain {
+        &self.source
+    }
+
+    /// The UIDs, in order.
+    #[must_use]
+    pub fn uids(&self) -> &[ResolvedUid] {
+        &self.uids
+    }
+
+    /// `inserter`, if set.
+    #[must_use]
+    pub fn inserter(&self) -> Option<&str> {
+        self.inserter.as_deref()
+    }
+
+    /// `matcher`, if set.
+    #[must_use]
+    pub fn matcher(&self) -> Option<&str> {
+        self.matcher.as_deref()
+    }
+
+    /// `mm`, if set.
+    #[must_use]
+    pub fn mm(&self) -> Option<i32> {
+        self.mm
+    }
+
+    /// EID-level ext.
+    #[must_use]
+    pub fn ext(&self) -> Option<&serde_json::Value> {
+        self.ext.as_ref()
+    }
+
+    /// The expiry as given.
+    #[must_use]
+    pub fn expiry(&self) -> Option<When> {
+        self.expiry
+    }
+
+    /// The refresh hint as given.
+    #[must_use]
+    pub fn refresh(&self) -> Option<When> {
+        self.refresh
+    }
+
+    /// The refresh limit.
+    #[must_use]
+    pub fn refresh_until(&self) -> Option<UnixTime> {
+        self.refresh_until
+    }
+}
+
+/// How a result changes the provider's private state.
+#[derive(Debug, PartialEq, Eq)]
+pub enum StateChange<'a> {
+    /// Leave it.
+    Keep,
+    /// Replace it with this JSON.
+    Replace(&'a str),
+    /// Remove it.
+    Clear,
+}
+
+#[derive(Clone, PartialEq)]
+enum StateOp {
+    Keep,
+    Replace(String),
+    Clear,
+    Rejected,
+}
+
+impl core::fmt::Debug for StateOp {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::Keep => formatter.write_str("Keep"),
+            Self::Replace(_) => formatter.write_str("Replace([redacted])"),
+            Self::Clear => formatter.write_str("Clear"),
+            Self::Rejected => formatter.write_str("Rejected"),
+        }
+    }
+}
+
+/// What one provider call produced. Its `Debug` prints entries through
+/// [`ResolvedEid`]'s redacting `Debug` and never prints provider state.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Resolution {
+    eids: Vec<ResolvedEid>,
+    invalidated: Vec<SourceDomain>,
+    opted_out: bool,
+    retry_in: Option<Duration>,
+    state: StateOp,
+}
+
+impl Resolution {
+    fn empty() -> Self {
+        Self {
+            eids: Vec::new(),
+            invalidated: Vec::new(),
+            opted_out: false,
+            retry_in: None,
+            state: StateOp::Keep,
+        }
+    }
+
+    /// One or more EID entries. A source may appear in several entries, in
+    /// the order bidders should see them. The entries of one source form its
+    /// new entry set, which replaces the stored set whole for an owned
+    /// source. For an unowned source the set only fills an absent or expired
+    /// record (spec 7.2). A source the result does not name, or whose set
+    /// the limits discard, is left as it is. An empty set is `no_match`.
+    #[must_use]
+    pub fn found(eids: impl IntoIterator<Item = ResolvedEid>) -> Self {
+        Self {
+            eids: eids.into_iter().collect(),
+            ..Self::empty()
+        }
+    }
+
+    /// Nothing recognized, or a capture held nothing.
+    #[must_use]
+    pub fn no_match() -> Self {
+        Self::empty()
+    }
+
+    /// The stored ID for `source` is no longer valid.
+    #[must_use]
+    pub fn invalidate(source: &SourceDomain) -> Self {
+        Self {
+            invalidated: vec![source.clone()],
+            ..Self::empty()
+        }
+    }
+
+    /// The provider reports the user opted out.
+    #[must_use]
+    pub fn opted_out() -> Self {
+        Self {
+            opted_out: true,
+            ..Self::empty()
+        }
+    }
+
+    /// Also invalidates `source`.
+    #[must_use]
+    pub fn also_invalidate(mut self, source: &SourceDomain) -> Self {
+        if !self.invalidated.contains(source) {
+            self.invalidated.push(source.clone());
+        }
+        self
+    }
+
+    /// The earliest the coordinator may call again.
+    #[must_use]
+    pub fn with_retry_in(mut self, delay: Duration) -> Self {
+        self.retry_in = Some(delay);
+        self
+    }
+
+    /// Replaces the provider's private state. Over 1,024 bytes of JSON, or
+    /// not serializable, the positive part of the result is rejected whole.
+    #[must_use]
+    pub fn replacing_state(mut self, state: &impl Serialize) -> Self {
+        self.state = match serde_json::to_string(state) {
+            Ok(json) if json.len() <= MAX_PROVIDER_STATE_BYTES => StateOp::Replace(json),
+            _ => StateOp::Rejected,
+        };
+        self
+    }
+
+    /// Clears the provider's private state.
+    #[must_use]
+    pub fn clearing_state(mut self) -> Self {
+        self.state = StateOp::Clear;
+        self
+    }
+
+    /// The returned entries, as given.
+    #[must_use]
+    pub fn eids(&self) -> &[ResolvedEid] {
+        &self.eids
+    }
+
+    /// Invalidated sources.
+    #[must_use]
+    pub fn invalidated(&self) -> &[SourceDomain] {
+        &self.invalidated
+    }
+
+    /// Whether nothing was found, invalidated or opted out.
+    #[must_use]
+    pub fn is_no_match(&self) -> bool {
+        self.eids.is_empty() && self.invalidated.is_empty() && !self.opted_out
+    }
+
+    /// Whether the provider reported an opt-out.
+    #[must_use]
+    pub fn is_opted_out(&self) -> bool {
+        self.opted_out
+    }
+
+    /// The retry delay.
+    #[must_use]
+    pub fn retry_in(&self) -> Option<Duration> {
+        self.retry_in
+    }
+
+    /// The state change.
+    #[must_use]
+    pub fn state_change(&self) -> StateChange<'_> {
+        match &self.state {
+            StateOp::Keep | StateOp::Rejected => StateChange::Keep,
+            StateOp::Replace(json) => StateChange::Replace(json),
+            StateOp::Clear => StateChange::Clear,
+        }
+    }
+
+    /// Whether `replacing_state` was given an oversized or unserializable
+    /// value. The coordinator then rejects the positive part (spec 4.5, 8).
+    #[must_use]
+    pub(crate) fn state_rejected(&self) -> bool {
+        self.state == StateOp::Rejected
+    }
+
+    /// Whether this result changes state at all.
+    #[must_use]
+    pub(crate) fn changes_state(&self) -> bool {
+        self.state != StateOp::Keep
+    }
+}
+
+/// The part of a result that a spec 4.5 limit dropped.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum DroppedPart {
+    /// A UID that is empty, blank or over `MAX_UID_LENGTH`.
+    #[display("uid")]
+    Uid,
+    /// A negative `atype`.
+    #[display("atype")]
+    Atype,
+    /// A UID-level ext that is not an object or is oversized.
+    #[display("uid ext")]
+    UidExt,
+    /// A blank or oversized `inserter`.
+    #[display("inserter")]
+    Inserter,
+    /// A blank or oversized `matcher`.
+    #[display("matcher")]
+    Matcher,
+    /// A negative `mm`.
+    #[display("mm")]
+    Mm,
+    /// An EID-level ext that is not an object or is oversized.
+    #[display("eid ext")]
+    EidExt,
+    /// An entry left with no UID.
+    #[display("entry without uid")]
+    EmptyEntry,
+    /// An entry equal to an earlier kept entry of its source.
+    #[display("duplicate entry")]
+    DuplicateEntry,
+    /// An entry past the source's first 8, or with no room left for a UID.
+    #[display("entry over the limit")]
+    ExtraEntry,
+    /// A UID past the source's first 32.
+    #[display("uid over the limit")]
+    ExtraUid,
+}
+
+/// One dropped part, for the coordinator's log line (provider, source and
+/// part only, never a value).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct EntryDrop {
+    pub(crate) source: SourceDomain,
+    pub(crate) part: DroppedPart,
+}
+
+/// One source's new entry set, as it is stored, and its timing resolved
+/// against `now`.
+#[derive(Clone, PartialEq)]
+pub(crate) struct EntrySet {
+    pub(crate) entries: Vec<KvEid>,
+    pub(crate) expires_at: Option<UnixTime>,
+    pub(crate) refresh_at: Option<UnixTime>,
+    pub(crate) refresh_until: Option<UnixTime>,
+}
+
+impl core::fmt::Debug for EntrySet {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("EntrySet")
+            .field("entries", &self.entries.len())
+            .field("expires_at", &self.expires_at)
+            .field("refresh_at", &self.refresh_at)
+            .field("refresh_until", &self.refresh_until)
+            .finish()
+    }
+}
+
+/// A result's entries, grouped by source and checked against spec 4.5.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct EntrySets {
+    /// Each source with at least one kept entry, under every limit.
+    pub(crate) sets: BTreeMap<SourceDomain, EntrySet>,
+    /// What the limits dropped, in order.
+    pub(crate) drops: Vec<EntryDrop>,
+    /// Sources whose set was over `MAX_ENTRY_SET_BYTES` and was discarded
+    /// whole. A stateful provider's positive part is then rejected.
+    pub(crate) oversized: Vec<SourceDomain>,
+}
+
+impl EntrySets {
+    /// Whether the result named at least one source and every set was
+    /// discarded. Every entry that is not kept records a drop, so a result
+    /// with entries and no kept set always has a drop or an oversized set.
+    /// The coordinator handles such a result as `Malformed` (spec 4.5).
+    #[must_use]
+    pub(crate) fn all_discarded(&self) -> bool {
+        self.sets.is_empty() && (!self.drops.is_empty() || !self.oversized.is_empty())
+    }
+}
+
+fn earliest(current: Option<UnixTime>, candidate: Option<UnixTime>) -> Option<UnixTime> {
+    match (current, candidate) {
+        (Some(current), Some(candidate)) => Some(current.min(candidate)),
+        (current, candidate) => current.or(candidate),
+    }
+}
+
+fn clean_text(
+    value: Option<&str>,
+    part: DroppedPart,
+    dropped: &mut Vec<DroppedPart>,
+) -> Option<String> {
+    let value = value?;
+    if !is_valid_eid_field(value) {
+        dropped.push(part);
+        return None;
+    }
+    Some(value.to_owned())
+}
+
+fn clean_number(
+    value: Option<i32>,
+    part: DroppedPart,
+    dropped: &mut Vec<DroppedPart>,
+) -> Option<i32> {
+    let value = value?;
+    if value < 0 {
+        dropped.push(part);
+        return None;
+    }
+    Some(value)
+}
+
+fn clean_ext(
+    value: Option<&serde_json::Value>,
+    part: DroppedPart,
+    dropped: &mut Vec<DroppedPart>,
+) -> Option<serde_json::Value> {
+    let value = value?;
+    if !is_valid_partner_ext(value) {
+        dropped.push(part);
+        return None;
+    }
+    Some(value.clone())
+}
+
+fn clean_uid(uid: &ResolvedUid, dropped: &mut Vec<DroppedPart>) -> Option<KvUid> {
+    if uid.id.trim().is_empty() || uid.id.len() > MAX_UID_LENGTH {
+        dropped.push(DroppedPart::Uid);
+        return None;
+    }
+    Some(KvUid {
+        id: uid.id.clone(),
+        atype: clean_number(uid.atype, DroppedPart::Atype, dropped),
+        ext: clean_ext(uid.ext.as_ref(), DroppedPart::UidExt, dropped),
+    })
+}
+
+fn clean_entry(eid: &ResolvedEid, dropped: &mut Vec<DroppedPart>) -> Option<KvEid> {
+    let uids: Vec<KvUid> = eid
+        .uids
+        .iter()
+        .filter_map(|uid| clean_uid(uid, dropped))
+        .collect();
+    if uids.is_empty() {
+        return None;
+    }
+    Some(KvEid {
+        uids,
+        inserter: clean_text(eid.inserter.as_deref(), DroppedPart::Inserter, dropped),
+        matcher: clean_text(eid.matcher.as_deref(), DroppedPart::Matcher, dropped),
+        mm: clean_number(eid.mm, DroppedPart::Mm, dropped),
+        ext: clean_ext(eid.ext.as_ref(), DroppedPart::EidExt, dropped),
+    })
+}
+
+/// Groups `eids` by source, in order, and applies every limit of spec 4.5:
+/// the browser parser's field and UID rules, then per-source caps the
+/// browser parser does not have: duplicates, the first 8 entries and 32 UIDs
+/// of a source, and `MAX_ENTRY_SET_BYTES` as [`entry_set_bytes`] measures
+/// the stored set. A set over that is discarded whole, never trimmed: field
+/// caps do not guarantee the set cap. Each set's `exp`, `ra` and `ru` are
+/// the earliest its kept entries set; a dropped or discarded entry's times
+/// do not count.
+///
+/// Source claims and operator narrowing are the coordinator's, which drops
+/// a set for an unclaimed source before using the result.
+///
+/// # Performance
+///
+/// Serializes each set once to measure it, and compares each entry with
+/// the at most 8 entries already kept.
+#[must_use]
+pub(crate) fn entry_sets(eids: &[ResolvedEid], now: UnixTime) -> EntrySets {
+    let mut result = EntrySets::default();
+    for eid in eids {
+        let mut dropped = Vec::new();
+        let cleaned = clean_entry(eid, &mut dropped);
+        let set = result
+            .sets
+            .entry(eid.source.clone())
+            .or_insert_with(|| EntrySet {
+                entries: Vec::new(),
+                expires_at: None,
+                refresh_at: None,
+                refresh_until: None,
+            });
+        match cleaned {
+            None => dropped.push(DroppedPart::EmptyEntry),
+            Some(entry) if set.entries.contains(&entry) => {
+                dropped.push(DroppedPart::DuplicateEntry)
+            }
+            Some(_) if set.entries.len() >= MAX_ENTRIES_PER_SOURCE => {
+                dropped.push(DroppedPart::ExtraEntry)
+            }
+            Some(mut entry) => {
+                let used: usize = set.entries.iter().map(|kept| kept.uids.len()).sum();
+                let room = MAX_UIDS_PER_SOURCE.saturating_sub(used);
+                if entry.uids.len() > room {
+                    dropped.extend(iter::repeat_n(
+                        DroppedPart::ExtraUid,
+                        entry.uids.len() - room,
+                    ));
+                    entry.uids.truncate(room);
+                }
+                if entry.uids.is_empty() {
+                    dropped.push(DroppedPart::ExtraEntry);
+                } else {
+                    set.expires_at =
+                        earliest(set.expires_at, eid.expiry.map(|when| when.resolve(now)));
+                    set.refresh_at =
+                        earliest(set.refresh_at, eid.refresh.map(|when| when.resolve(now)));
+                    set.refresh_until = earliest(set.refresh_until, eid.refresh_until);
+                    set.entries.push(entry);
+                }
+            }
+        }
+        result
+            .drops
+            .extend(dropped.into_iter().map(|part| EntryDrop {
+                source: eid.source.clone(),
+                part,
+            }));
+    }
+    result.sets.retain(|source, set| {
+        if set.entries.is_empty() {
+            return false;
+        }
+        let fits = entry_set_bytes(&set.entries) <= MAX_ENTRY_SET_BYTES;
+        if !fits {
+            result.oversized.push(source.clone());
+        }
+        fits
+    });
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use serde_json::json;
+
+    use super::*;
+    use crate::ec::kv_types::MAX_EID_FIELD_BYTES;
+    use crate::test_support::logs::{captured_logs, install_capturing_logger};
+
+    fn source(name: &str) -> SourceDomain {
+        name.parse().expect("should parse the source")
+    }
+
+    fn uid(id: &str) -> ResolvedUid {
+        ResolvedUid::new(id)
+    }
+
+    fn kv_uid(id: &str) -> KvUid {
+        KvUid {
+            id: id.to_owned(),
+            atype: None,
+            ext: None,
+        }
+    }
+
+    fn now() -> UnixTime {
+        UnixTime::from_secs(1_000)
+    }
+
+    fn parts(sets: &EntrySets) -> Vec<DroppedPart> {
+        sets.drops.iter().map(|drop| drop.part).collect()
+    }
+
+    #[test]
+    fn empty_found_is_no_match() {
+        let resolution = Resolution::found([]);
+        assert!(resolution.is_no_match(), "should be no_match");
+        assert!(resolution.eids().is_empty(), "should hold no entries");
+    }
+
+    #[test]
+    fn a_one_uid_entry_becomes_a_one_entry_set_without_eid_level_fields() {
+        let a = source("a.example.com");
+        let resolution = Resolution::found([ResolvedEid::new(&a, uid("u").with_atype(3))]);
+
+        let sets = entry_sets(resolution.eids(), now());
+
+        assert_eq!(
+            sets.sets[&a].entries,
+            vec![KvEid {
+                uids: vec![KvUid {
+                    id: "u".to_owned(),
+                    atype: Some(3),
+                    ext: None
+                }],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            }],
+            "should produce the one-UID shape browser ingest stores"
+        );
+        assert!(
+            sets.drops.is_empty() && sets.oversized.is_empty(),
+            "should drop nothing"
+        );
+    }
+
+    #[test]
+    fn entries_group_by_source_and_keep_every_uid_and_field_in_order() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let first = ResolvedEid::new(
+            &a,
+            uid("a1")
+                .with_atype(1)
+                .with_ext(json!({ "rtiPartner": "TDID" })),
+        )
+        .with_uid(uid("a2"))
+        .with_inserter("inserter.example.com")
+        .with_matcher("matcher.example.com")
+        .with_mm(2)
+        .with_ext(json!({ "segments": ["s"] }));
+        let other = ResolvedEid::new(&b, uid("b1"));
+        let second = ResolvedEid::new(&a, uid("a3"));
+
+        let sets = entry_sets(&[first, other, second], now());
+
+        assert_eq!(
+            sets.sets[&a].entries,
+            vec![
+                KvEid {
+                    uids: vec![
+                        KvUid {
+                            id: "a1".to_owned(),
+                            atype: Some(1),
+                            ext: Some(json!({ "rtiPartner": "TDID" }))
+                        },
+                        kv_uid("a2"),
+                    ],
+                    inserter: Some("inserter.example.com".to_owned()),
+                    matcher: Some("matcher.example.com".to_owned()),
+                    mm: Some(2),
+                    ext: Some(json!({ "segments": ["s"] })),
+                },
+                KvEid {
+                    uids: vec![kv_uid("a3")],
+                    inserter: None,
+                    matcher: None,
+                    mm: None,
+                    ext: None
+                },
+            ],
+            "should keep a's entries in the order returned"
+        );
+        assert_eq!(sets.sets[&b].entries.len(), 1, "should group b on its own");
+        assert!(sets.drops.is_empty(), "should drop nothing");
+    }
+
+    #[test]
+    fn bad_fields_are_dropped_and_their_entries_kept() {
+        let a = source("a.example.com");
+        let entry = ResolvedEid::new(
+            &a,
+            uid("u")
+                .with_atype(-1)
+                .with_ext(json!(["not", "an", "object"])),
+        )
+        .with_inserter("  ")
+        .with_matcher(&"m".repeat(MAX_EID_FIELD_BYTES + 1))
+        .with_mm(-2)
+        .with_ext(json!("not an object"));
+
+        let sets = entry_sets(&[entry], now());
+
+        assert_eq!(
+            sets.sets[&a].entries,
+            vec![KvEid {
+                uids: vec![kv_uid("u")],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None
+            }],
+            "should keep the entry without its bad fields"
+        );
+        assert_eq!(
+            parts(&sets),
+            vec![
+                DroppedPart::Atype,
+                DroppedPart::UidExt,
+                DroppedPart::Inserter,
+                DroppedPart::Matcher,
+                DroppedPart::Mm,
+                DroppedPart::EidExt,
+            ],
+            "should name each dropped field"
+        );
+    }
+
+    #[test]
+    fn bad_uids_are_dropped_and_an_entry_without_uids_is_discarded() {
+        let a = source("a.example.com");
+        let mixed = ResolvedEid::new(&a, uid(" ")).with_uid(uid("kept"));
+        let empty = ResolvedEid::new(&a, uid(&"x".repeat(MAX_UID_LENGTH + 1)))
+            .with_inserter("inserter.example.com");
+
+        let sets = entry_sets(&[mixed, empty], now());
+
+        assert_eq!(
+            sets.sets[&a].entries.len(),
+            1,
+            "should discard the entry left with no UID"
+        );
+        assert_eq!(
+            sets.sets[&a].entries[0].uids,
+            vec![kv_uid("kept")],
+            "should keep the valid UID"
+        );
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::Uid, DroppedPart::Uid, DroppedPart::EmptyEntry],
+            "should name the dropped UIDs and the discarded entry"
+        );
+    }
+
+    #[test]
+    fn a_source_with_no_kept_entry_is_not_named() {
+        let a = source("a.example.com");
+
+        let sets = entry_sets(&[ResolvedEid::new(&a, uid(""))], now());
+
+        assert!(
+            !sets.sets.contains_key(&a),
+            "should leave the stored set as it is"
+        );
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::Uid, DroppedPart::EmptyEntry],
+            "should record the dropped UID and the discarded entry"
+        );
+        assert!(
+            sets.all_discarded(),
+            "should report that every named set was discarded"
+        );
+    }
+
+    #[test]
+    fn all_discarded_only_when_nothing_was_kept() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+
+        let mixed = entry_sets(
+            &[
+                ResolvedEid::new(&a, uid("")),
+                ResolvedEid::new(&b, uid("kept")),
+            ],
+            now(),
+        );
+        let empty = entry_sets(&[], now());
+
+        assert!(
+            !mixed.all_discarded(),
+            "should not report a result that kept one set"
+        );
+        assert!(
+            !empty.all_discarded(),
+            "should not report a result that named nothing"
+        );
+    }
+
+    #[test]
+    fn duplicates_and_entries_and_uids_over_the_limits_are_dropped() {
+        let a = source("a.example.com");
+        let mut eids = vec![
+            ResolvedEid::new(&a, uid("e0")),
+            ResolvedEid::new(&a, uid("e0")),
+        ];
+        // 7 more entries of 4 UIDs: 1 + 28 = 29 UIDs, then a ninth entry.
+        for entry in 1..=7 {
+            let mut eid = ResolvedEid::new(&a, uid(&format!("e{entry}u0")));
+            for index in 1..4 {
+                eid = eid.with_uid(uid(&format!("e{entry}u{index}")));
+            }
+            eids.push(eid);
+        }
+        eids.push(ResolvedEid::new(&a, uid("ninth")));
+
+        let sets = entry_sets(&eids, now());
+
+        let set = &sets.sets[&a];
+        assert_eq!(
+            set.entries.len(),
+            MAX_ENTRIES_PER_SOURCE,
+            "should keep 8 entries"
+        );
+        let uid_count: usize = set.entries.iter().map(|entry| entry.uids.len()).sum();
+        assert_eq!(
+            uid_count, 29,
+            "should stay under the UID cap in this control"
+        );
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::DuplicateEntry, DroppedPart::ExtraEntry],
+            "should drop the duplicate and the ninth entry"
+        );
+
+        let mut wide = ResolvedEid::new(&a, uid("u0"));
+        for index in 1..=MAX_UIDS_PER_SOURCE {
+            wide = wide.with_uid(uid(&format!("u{index}")));
+        }
+        let sets = entry_sets(&[wide, ResolvedEid::new(&a, uid("later"))], now());
+        assert_eq!(
+            sets.sets[&a].entries.len(),
+            1,
+            "should discard the entry left with no room"
+        );
+        assert_eq!(
+            sets.sets[&a].entries[0].uids.len(),
+            MAX_UIDS_PER_SOURCE,
+            "should keep 32 UIDs"
+        );
+        assert_eq!(
+            parts(&sets),
+            vec![
+                DroppedPart::ExtraUid,
+                DroppedPart::ExtraUid,
+                DroppedPart::ExtraEntry
+            ],
+            "should drop the 33rd UID and the entry with no room"
+        );
+    }
+
+    #[test]
+    fn an_oversized_set_is_discarded_whole_and_others_are_kept() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+
+        let sets = entry_sets(
+            &[oversized_entry(&a), ResolvedEid::new(&b, uid("small"))],
+            now(),
+        );
+
+        assert!(
+            !sets.sets.contains_key(&a),
+            "should never trim an oversized set"
+        );
+        assert_eq!(
+            sets.oversized,
+            vec![a.clone()],
+            "should report the oversized source"
+        );
+        assert!(sets.sets.contains_key(&b), "should keep the other source");
+        assert!(
+            !sets.all_discarded(),
+            "should not report the result as all discarded"
+        );
+
+        let only = entry_sets(&[oversized_entry(&a)], now());
+        assert!(
+            only.all_discarded(),
+            "should report a result whose only set is oversized"
+        );
+    }
+
+    fn oversized_entry(source: &SourceDomain) -> ResolvedEid {
+        let mut big = ResolvedEid::new(source, uid(&"x".repeat(500)));
+        for index in 0..8 {
+            big = big.with_uid(uid(&format!("{index}{}", "x".repeat(499))));
+        }
+        big
+    }
+
+    #[test]
+    fn a_set_takes_the_earliest_times_its_entries_set() {
+        let a = source("a.example.com");
+        let first = ResolvedEid::new(&a, uid("one"))
+            .with_expires_in(Duration::from_secs(100))
+            .with_refresh_at(UnixTime::from_secs(1_080))
+            .with_refresh_until(UnixTime::from_secs(5_000));
+        let second = ResolvedEid::new(&a, uid("two"))
+            .with_expires_at(UnixTime::from_secs(1_050))
+            .with_refresh_in(Duration::from_secs(90))
+            .with_refresh_until(UnixTime::from_secs(4_000));
+        let third = ResolvedEid::new(&a, uid("three"));
+
+        let set = entry_sets(&[first, second, third], now())
+            .sets
+            .remove(&a)
+            .expect("should keep a");
+
+        assert_eq!(
+            set.expires_at,
+            Some(UnixTime::from_secs(1_050)),
+            "should take the earliest expiry"
+        );
+        assert_eq!(
+            set.refresh_at,
+            Some(UnixTime::from_secs(1_080)),
+            "should take the earliest refresh"
+        );
+        assert_eq!(
+            set.refresh_until,
+            Some(UnixTime::from_secs(4_000)),
+            "should take the earliest refresh limit"
+        );
+    }
+
+    #[test]
+    fn dropped_entries_do_not_count_toward_timing() {
+        let a = source("a.example.com");
+        let kept = ResolvedEid::new(&a, uid("one")).with_expires_at(UnixTime::from_secs(2_000));
+        let duplicate =
+            ResolvedEid::new(&a, uid("one")).with_expires_at(UnixTime::from_secs(1_100));
+        let empty = ResolvedEid::new(&a, uid("")).with_refresh_at(UnixTime::from_secs(1_010));
+
+        let set = entry_sets(&[kept, duplicate, empty], now())
+            .sets
+            .remove(&a)
+            .expect("should keep a");
+
+        assert_eq!(
+            set.expires_at,
+            Some(UnixTime::from_secs(2_000)),
+            "should ignore the expiry of a dropped duplicate"
+        );
+        assert_eq!(
+            set.refresh_at, None,
+            "should ignore the refresh time of a discarded entry"
+        );
+    }
+
+    #[test]
+    fn invalidations_chain_and_state_changes_are_reported() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let resolution = Resolution::found([ResolvedEid::new(&a, uid("u"))])
+            .also_invalidate(&b)
+            .with_retry_in(Duration::from_secs(60))
+            .replacing_state(&json!({ "signature": "s" }));
+        assert_eq!(resolution.invalidated(), &[b], "should invalidate b");
+        assert_eq!(
+            resolution.retry_in(),
+            Some(Duration::from_secs(60)),
+            "should keep the retry delay"
+        );
+        assert_eq!(
+            resolution.state_change(),
+            StateChange::Replace(r#"{"signature":"s"}"#),
+            "should replace the state"
+        );
+        assert_eq!(
+            Resolution::no_match().clearing_state().state_change(),
+            StateChange::Clear,
+            "should clear the state"
+        );
+        assert_eq!(
+            Resolution::no_match().state_change(),
+            StateChange::Keep,
+            "should keep the state by default"
+        );
+    }
+
+    #[test]
+    fn resolution_debug_redacts_state() {
+        let resolution =
+            Resolution::no_match().replacing_state(&json!({ "signature": "secret-state" }));
+
+        let debug = format!("{resolution:?}");
+
+        assert!(
+            !debug.contains("secret-state"),
+            "should not print provider state"
+        );
+        assert!(
+            debug.contains("Replace([redacted])"),
+            "should show that state is replaced"
+        );
+    }
+
+    #[test]
+    fn oversized_state_is_marked_invalid_not_dropped_silently() {
+        let resolution = Resolution::found([ResolvedEid::new(&source("a.example.com"), uid("u"))])
+            .replacing_state(&"x".repeat(2000));
+        assert!(
+            resolution.state_rejected(),
+            "should flag the state as rejected"
+        );
+    }
+
+    #[test]
+    fn oversized_eid_ext_logs_only_a_fixed_reason() {
+        install_capturing_logger();
+        let source = source("resolution-log-canary.example.com");
+        let eid = ResolvedEid::new(&source, uid("resolution-private-first-uid"))
+            .with_uid(uid("resolution-private-second-uid"))
+            .with_ext(json!({"private-ext": "resolution-private-ext".repeat(MAX_EID_FIELD_BYTES)}));
+        assert!(eid.ext().is_none(), "should still discard oversized ext");
+        let logs = captured_logs();
+        assert!(
+            logs.iter()
+                .any(|line| line == "Dropping an oversized EID-level ext"),
+            "should report the rejection reason"
+        );
+        for value in [
+            source.as_str(),
+            "resolution-private-first-uid",
+            "resolution-private-second-uid",
+            "resolution-private-ext",
+        ] {
+            assert!(
+                logs.iter().all(|line| !line.contains(value)),
+                "should not log identity input: {value}"
+            );
+        }
+    }
+
+    #[test]
+    fn oversized_ext_is_dropped_and_the_uid_and_entry_kept() {
+        let pad = json!({ "pad": "x".repeat(MAX_PARTNER_EXT_BYTES) });
+        let resolved = uid("u").with_ext(pad.clone());
+        assert_eq!(resolved.id(), "u", "should keep the UID");
+        assert!(resolved.ext().is_none(), "should drop the UID-level ext");
+        let small = uid("u").with_ext(json!({ "linkType": 2 }));
+        assert_eq!(
+            small.ext(),
+            Some(&json!({ "linkType": 2 })),
+            "should keep a small ext"
+        );
+
+        let eid = ResolvedEid::new(&source("a.example.com"), uid("u")).with_ext(pad);
+        assert_eq!(eid.uids().len(), 1, "should keep the entry");
+        assert!(eid.ext().is_none(), "should drop the EID-level ext");
+    }
+
+    #[test]
+    fn debug_redacts_every_uid() {
+        let eid = ResolvedEid::new(&source("a.example.com"), uid("secret-one"))
+            .with_uid(uid("secret-two"));
+        let debug = format!("{eid:?} {:?}", eid.uids()[0]);
+        assert!(!debug.contains("secret"), "should not print a UID");
+        assert!(debug.contains("a.example.com"), "should print the source");
+    }
+
+    #[test]
+    fn opted_out_is_reported() {
+        assert!(
+            Resolution::opted_out().is_opted_out(),
+            "should report the opt-out"
+        );
+        assert!(
+            !Resolution::no_match().is_opted_out(),
+            "should not report an opt-out for no_match"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/revision.rs b/crates/trusted-server-core/src/ec/identity/revision.rs
new file mode 100644
index 0000000000..24c8867cec
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/revision.rs
@@ -0,0 +1,277 @@
+//! Record revisions, state revisions, UID hashes and the visitor key.
+
+use hmac::{Hmac, KeyInit as _, Mac as _};
+use sha2::{Digest as _, Sha256};
+
+use super::input::RandomSource;
+use crate::ec::kv_types::{KvEid, KvPartnerId, RECORD_REVISION_HEX_LEN};
+use crate::settings::Settings;
+
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+type HmacSha256 = Hmac<Sha256>;
+
+/// The visitor key, derived from `ec.passphrase` once per settings load.
+///
+/// It is the only keyed value: nothing stored in the row is keyed
+/// (spec 9.3).
+#[derive(Clone)]
+pub(crate) struct IdentityKeys {
+    visitor: [u8; 32],
+}
+
+impl core::fmt::Debug for IdentityKeys {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter.write_str("IdentityKeys([redacted])")
+    }
+}
+
+impl IdentityKeys {
+    /// Derives the visitor key from `ec.passphrase`.
+    #[must_use]
+    pub(crate) fn from_settings(settings: &Settings) -> Self {
+        let passphrase = settings.ec.passphrase.expose().as_bytes();
+        let mut mac =
+            HmacSha256::new_from_slice(passphrase).expect("should accept any HMAC key length");
+        mac.update(b"trusted-server/identity/visitor/v1");
+        Self {
+            visitor: mac.finalize().into_bytes().into(),
+        }
+    }
+}
+
+fn hex16(digest: &[u8]) -> String {
+    hex::encode(&digest[..RECORD_REVISION_HEX_LEN / 2])
+}
+
+/// A record's stored revision: 16 lowercase hex digits.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub(crate) struct RecordRevision(String);
+
+impl RecordRevision {
+    /// Wraps a stored `rv`. `KvEntry::validate` has checked the format.
+    #[must_use]
+    pub(crate) fn from_stored(value: &str) -> Self {
+        Self(value.to_owned())
+    }
+
+    /// The hex digits.
+    #[must_use]
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// A record's revision (spec 5.4). `Unset` for a record without `rv`, which
+/// only a schema version 1 row holds, until its next write gives it one.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub(crate) enum Revision {
+    /// The record has no `rv`.
+    Unset,
+    /// The record's `rv`.
+    Set(RecordRevision),
+}
+
+/// A fresh random revision, drawn on every write of a record.
+#[must_use]
+pub(crate) fn new_revision(random: &dyn RandomSource) -> RecordRevision {
+    let mut bytes = [0u8; RECORD_REVISION_HEX_LEN / 2];
+    random.fill(&mut bytes);
+    RecordRevision(hex::encode(bytes))
+}
+
+/// The revision of a stored record. One revision covers the source's whole
+/// entry set.
+#[must_use]
+pub(crate) fn record_revision(record: &KvPartnerId) -> Revision {
+    record.rv.as_deref().map_or(Revision::Unset, |rv| {
+        Revision::Set(RecordRevision::from_stored(rv))
+    })
+}
+
+/// The hash of a provider's `ps.st` a call read, so a later apply can tell
+/// whether another writer changed it since.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct StateRevision(String);
+
+impl StateRevision {
+    /// The first 16 hex digits of the SHA-256 of `st` as compact JSON, or of
+    /// the empty string when there is none. Compact JSON is never empty, so
+    /// absent and present state never share a revision.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn of(st: Option<&serde_json::Value>) -> Self {
+        let bytes = st
+            .and_then(|value| serde_json::to_vec(value).ok())
+            .unwrap_or_default();
+        Self(hex16(&Sha256::digest(bytes)))
+    }
+}
+
+/// The hash stored in `ps.iv` or `ps.ov` for a removed UID: the first 16 hex
+/// digits of its unkeyed SHA-256 (spec 6.1).
+#[must_use]
+pub(crate) fn uid_hash(uid: &str) -> String {
+    hex16(&Sha256::digest(uid.as_bytes()))
+}
+
+/// One hash per UID of a removed set, in set order, without duplicates.
+#[must_use]
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) fn set_hashes(set: &[KvEid]) -> Vec<String> {
+    let mut hashes = Vec::new();
+    for uid in set.iter().flat_map(|entry| &entry.uids) {
+        let hash = uid_hash(&uid.id);
+        if !hashes.contains(&hash) {
+            hashes.push(hash);
+        }
+    }
+    hashes
+}
+
+/// Appends hashes to a `ps.iv` or `ps.ov` list, oldest first. A hash
+/// already present moves to the end. The caller truncates.
+// Temporary: first used by a later identity task.
+#[allow(dead_code)]
+pub(crate) fn push_hashes(list: &mut Vec<String>, hashes: Vec<String>) {
+    for hash in hashes {
+        list.retain(|existing| *existing != hash);
+        list.push(hash);
+    }
+}
+
+/// The per-visitor rate-limit key component, from the full EC ID.
+#[must_use]
+pub(crate) fn visitor_key(keys: &IdentityKeys, ec_id: &str) -> String {
+    let mut mac = HmacSha256::new_from_slice(&keys.visitor).expect("should accept a 32-byte key");
+    mac.update(ec_id.as_bytes());
+    hex16(&mac.finalize().into_bytes())
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+    use sha2::Sha256;
+
+    use super::*;
+    use crate::ec::identity::input::SeededRandom;
+    use crate::ec::kv_types::{KvEid, KvPartnerId, KvUid};
+    use crate::test_support::tests::create_test_settings;
+
+    fn uid(id: &str) -> KvUid {
+        KvUid {
+            id: id.to_owned(),
+            ..KvUid::default()
+        }
+    }
+
+    #[test]
+    fn new_revisions_are_hex_and_differ() {
+        let random = SeededRandom::new(7);
+        let first = new_revision(&random);
+        let second = new_revision(&random);
+        assert_eq!(first.as_str().len(), 16, "should be 16 hex digits");
+        assert!(
+            first
+                .as_str()
+                .bytes()
+                .all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase()),
+            "should be lowercase hex"
+        );
+        assert_ne!(
+            first, second,
+            "should give two writes of the same UID different revisions"
+        );
+    }
+
+    #[test]
+    fn record_revision_is_rv_or_unset() {
+        let with_rv = KvPartnerId {
+            rv: Some("0123456789abcdef".to_owned()),
+            ..KvPartnerId::new("u")
+        };
+        assert_eq!(
+            record_revision(&with_rv),
+            Revision::Set(RecordRevision::from_stored("0123456789abcdef")),
+            "should use rv"
+        );
+        assert_eq!(
+            record_revision(&KvPartnerId::browser("u", Some(10))),
+            Revision::Unset,
+            "should be Unset without rv, whatever the UID and at"
+        );
+    }
+
+    #[test]
+    fn uid_hashes_are_unkeyed_sha256_prefixes() {
+        let expected = hex::encode(&Sha256::digest(b"example-uid")[..8]);
+        assert_eq!(
+            uid_hash("example-uid"),
+            expected,
+            "should be the first 16 hex digits of SHA-256"
+        );
+
+        let mut other_settings = create_test_settings();
+        other_settings.ec.passphrase =
+            crate::redacted::Redacted::new("another-example-passphrase-value".to_owned());
+        assert_ne!(
+            visitor_key(&IdentityKeys::from_settings(&other_settings), "ec"),
+            visitor_key(&IdentityKeys::from_settings(&create_test_settings()), "ec"),
+            "should key only the visitor key by the passphrase"
+        );
+    }
+
+    #[test]
+    fn a_removal_hashes_every_uid_of_the_set_and_push_moves_repeats_to_the_end() {
+        let set = vec![
+            KvEid {
+                uids: vec![uid("a"), uid("b")],
+                ..KvEid::default()
+            },
+            KvEid {
+                uids: vec![uid("c"), uid("a")],
+                ..KvEid::default()
+            },
+        ];
+
+        let hashes = set_hashes(&set);
+
+        let expected: Vec<String> = ["a", "b", "c"].iter().map(|id| uid_hash(id)).collect();
+        assert_eq!(hashes, expected, "should hash each UID once, in set order");
+        assert_eq!(
+            set_hashes(&KvPartnerId::new("u").eids),
+            vec![uid_hash("u")],
+            "should cost one hash for a one-UID record"
+        );
+
+        let mut list = vec![uid_hash("a"), uid_hash("z")];
+        push_hashes(&mut list, vec![uid_hash("a"), uid_hash("y")]);
+        assert_eq!(
+            list,
+            vec![uid_hash("z"), uid_hash("a"), uid_hash("y")],
+            "should move a repeat to the end"
+        );
+    }
+
+    #[test]
+    fn state_revisions_tell_absent_and_changed_state_apart() {
+        let state = json!({ "token": "A0" });
+        assert_eq!(
+            StateRevision::of(Some(&state)),
+            StateRevision::of(Some(&state.clone())),
+            "should be stable"
+        );
+        assert_ne!(
+            StateRevision::of(Some(&state)),
+            StateRevision::of(Some(&json!({ "token": "A1" }))),
+            "should change with the state"
+        );
+        assert_ne!(
+            StateRevision::of(None),
+            StateRevision::of(Some(&json!(""))),
+            "should tell absent from empty"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/runtime.rs b/crates/trusted-server-core/src/ec/identity/runtime.rs
new file mode 100644
index 0000000000..8d673ea874
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/runtime.rs
@@ -0,0 +1,261 @@
+//! The identity state built once per settings load (spec 10.3).
+
+use std::collections::BTreeMap;
+
+use error_stack::Report;
+
+use super::catalog::ProviderCatalog;
+use super::coordinator::IdentityDeps;
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::input::RandomSource;
+use super::revision::IdentityKeys;
+use crate::ec::rate_limiter::RateLimiter;
+use crate::error::TrustedServerError;
+use crate::integrations::IntegrationRegistry;
+use crate::platform::RuntimeServices;
+use crate::settings::{IdentitySettings, ProviderMode, Settings};
+
+/// The provider catalog, the keys and the identity policy of one settings load.
+///
+/// The adapter builds it once and shares it through an `Arc`. It is the one
+/// identity type the adapter names, so the crate-private catalog and keys
+/// never cross the crate boundary.
+pub struct IdentityRuntime {
+    catalog: ProviderCatalog,
+    // Temporary: first read by a later identity task.
+    #[allow(dead_code)]
+    keys: IdentityKeys,
+    // Temporary: first read by a later identity task.
+    #[allow(dead_code)]
+    identity: IdentitySettings,
+}
+
+impl core::fmt::Debug for IdentityRuntime {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("IdentityRuntime")
+            .field("providers", &self.catalog.providers().count())
+            .finish_non_exhaustive()
+    }
+}
+
+impl IdentityRuntime {
+    /// Builds the runtime from settings and the providers `integrations`
+    /// registered, without resolving any secret.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when a provider cannot be
+    /// described or the catalog rules fail.
+    pub fn from_settings(
+        settings: &Settings,
+        integrations: &IntegrationRegistry,
+    ) -> Result<Self, Report<TrustedServerError>> {
+        let catalog = ProviderCatalog::from_settings(settings, &integrations.identity_providers())?
+            .with_narrowing(narrowing(&settings.ec.identity));
+        Ok(Self {
+            catalog,
+            keys: IdentityKeys::from_settings(settings),
+            identity: settings.ec.identity.clone(),
+        })
+    }
+
+    /// Builds the runtime with `providers` and source `owners` in place of
+    /// the generic pull providers `settings` describes, for tests that drive
+    /// a request through a provider no configuration can name.
+    ///
+    /// # Errors
+    ///
+    /// Never fails today; it returns a `Result` to match
+    /// [`from_settings`](Self::from_settings).
+    #[cfg(any(test, feature = "test-utils"))]
+    pub fn from_settings_with_providers(
+        settings: &Settings,
+        providers: Vec<std::sync::Arc<dyn super::provider::IdentityProvider>>,
+        owners: BTreeMap<SourceDomain, IdentityProviderId>,
+    ) -> Result<Self, Report<TrustedServerError>> {
+        let catalog = ProviderCatalog::new(providers, owners)
+            .with_narrowing(narrowing(&settings.ec.identity));
+        Ok(Self {
+            catalog,
+            keys: IdentityKeys::from_settings(settings),
+            identity: settings.ec.identity.clone(),
+        })
+    }
+
+    /// The enabled providers.
+    /// A copy of this runtime with the `ts-eids-s` mirror turned on, for
+    /// tests that exercise the mirror.
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn with_mirror_enabled(&self) -> Self {
+        let mut identity = self.identity.clone();
+        identity.mirror_enabled = true;
+        Self {
+            catalog: self.catalog.clone(),
+            keys: self.keys.clone(),
+            identity,
+        }
+    }
+
+    #[must_use]
+    pub(crate) fn catalog(&self) -> &ProviderCatalog {
+        &self.catalog
+    }
+
+    /// Whether a new visitor's first navigation can run a hold-mode provider:
+    /// one is configured that does not read the EC ID. A publisher navigation
+    /// then mints the EC with [`EcContext::mint_deferred`] (spec 4.7).
+    ///
+    /// [`EcContext::mint_deferred`]: crate::ec::EcContext::mint_deferred
+    #[must_use]
+    pub fn holds_on_first_navigation(&self) -> bool {
+        self.catalog.providers().any(|provider| {
+            let descriptor = provider.descriptor();
+            self.identity.provider(descriptor.id()).mode == ProviderMode::Hold
+                && !descriptor
+                    .resolves()
+                    .is_some_and(super::descriptor::Resolves::gets_ec_id)
+        })
+    }
+
+    /// The keys derived from `ec.passphrase`.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn keys(&self) -> &IdentityKeys {
+        &self.keys
+    }
+
+    /// The `[ec.identity]` policy.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn identity(&self) -> &IdentitySettings {
+        &self.identity
+    }
+
+    /// What the coordinator needs besides the request.
+    #[must_use]
+    // Temporary: first used by a later identity task.
+    #[allow(dead_code)]
+    pub(crate) fn deps<'a>(
+        &'a self,
+        settings: &'a Settings,
+        services: &'a RuntimeServices,
+        random: &'a dyn RandomSource,
+        rate_limiter: Option<&'a dyn RateLimiter>,
+    ) -> IdentityDeps<'a> {
+        IdentityDeps {
+            settings,
+            catalog: &self.catalog,
+            keys: &self.keys,
+            random,
+            services,
+            rate_limiter,
+        }
+    }
+}
+
+/// Each provider table's `sources`, for the providers that list any.
+///
+/// Config validation has rejected a malformed source, so one that does not
+/// parse is skipped.
+fn narrowing(identity: &IdentitySettings) -> BTreeMap<IdentityProviderId, Vec<SourceDomain>> {
+    identity
+        .providers
+        .iter()
+        .filter_map(|(id, table)| {
+            let listed = table.sources.as_ref()?;
+            Some((
+                id.parse().ok()?,
+                listed
+                    .iter()
+                    .filter_map(|source| source.parse().ok())
+                    .collect(),
+            ))
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ec::identity::test_support::{ec_partner, pid, source};
+    use crate::settings::ProviderSettings;
+    use crate::test_support::tests::create_test_settings;
+
+    fn settings_with_listed_sources(listed: Option<Vec<String>>) -> Settings {
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![ec_partner(
+            "ssp.example.com",
+            "https://sync.ssp.example.com/pull",
+            "example-token-value-0123456789abcdef",
+        )];
+        settings.ec.identity.providers.insert(
+            "pull-ssp-example-com".to_owned(),
+            ProviderSettings {
+                sources: listed,
+                ..ProviderSettings::default()
+            },
+        );
+        settings
+    }
+
+    #[test]
+    fn runtime_debug_prints_no_key_material() {
+        let settings = settings_with_listed_sources(None);
+        let runtime = IdentityRuntime::from_settings(&settings, &IntegrationRegistry::default())
+            .expect("should build");
+
+        let printed = format!("{runtime:?}");
+
+        assert!(
+            printed.contains("providers: 1"),
+            "should print the provider count: {printed}"
+        );
+        assert!(
+            !printed.contains(settings.ec.passphrase.expose()),
+            "should not print the passphrase: {printed}"
+        );
+        assert!(
+            !printed.contains("keys"),
+            "should not print the keys: {printed}"
+        );
+    }
+
+    #[test]
+    fn runtime_narrows_providers_by_their_sources_table() {
+        let id = pid("pull-ssp-example-com");
+
+        let unlisted = IdentityRuntime::from_settings(
+            &settings_with_listed_sources(None),
+            &IntegrationRegistry::default(),
+        )
+        .expect("should build");
+        let kept = IdentityRuntime::from_settings(
+            &settings_with_listed_sources(Some(vec!["ssp.example.com".to_owned()])),
+            &IntegrationRegistry::default(),
+        )
+        .expect("should build");
+        assert_eq!(
+            unlisted.catalog().sources_of(&id),
+            [source("ssp.example.com")],
+            "control: should claim the descriptor's source with no table"
+        );
+        assert_eq!(
+            kept.catalog().sources_of(&id),
+            [source("ssp.example.com")],
+            "should keep a listed source"
+        );
+        let error = IdentityRuntime::from_settings(
+            &settings_with_listed_sources(Some(vec!["other.example.com".to_owned()])),
+            &IntegrationRegistry::default(),
+        )
+        .expect_err("should reject a source the descriptor does not declare");
+        assert!(
+            format!("{error}").contains("other.example.com"),
+            "should name the undeclared source: {error}"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/servable.rs b/crates/trusted-server-core/src/ec/identity/servable.rs
new file mode 100644
index 0000000000..6fe18264f0
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/servable.rs
@@ -0,0 +1,392 @@
+//! The one servability check shared by the bidstream, the admin view and
+//! `/_ts/api/v1/identify` (spec 7.1).
+
+use std::collections::BTreeSet;
+
+use super::catalog::ProviderCatalog;
+use super::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use super::policy::{PolicySignals, policy_allows};
+use crate::consent::ConsentContext;
+use crate::ec::kv_types::KvPartnerId;
+
+/// What a servability decision needs from the request.
+pub(crate) struct ServeContext<'a> {
+    pub(crate) now: UnixTime,
+    pub(crate) consent: &'a ConsentContext,
+    pub(crate) signals: PolicySignals,
+    pub(crate) catalog: &'a ProviderCatalog,
+    /// The providers with a `ps.o` in the row the request read.
+    pub(crate) opted_out: &'a BTreeSet<IdentityProviderId>,
+}
+
+/// Whether a stored record, the source's whole entry set, may be sent from
+/// the server.
+#[must_use]
+pub(crate) fn is_servable(
+    context: &ServeContext<'_>,
+    source: &SourceDomain,
+    record: &KvPartnerId,
+) -> bool {
+    if record.eids.is_empty() {
+        return false;
+    }
+    if record.exp.is_some_and(|exp| context.now.as_secs() >= exp) {
+        return false;
+    }
+    let writer = record
+        .w
+        .as_deref()
+        .and_then(|writer| writer.parse::<IdentityProviderId>().ok());
+    if record.w.is_some() {
+        let Some(writer) = writer.as_ref() else {
+            return false;
+        };
+        let Some(provider) = context.catalog.get(writer) else {
+            return false;
+        };
+        if context.opted_out.contains(writer)
+            || !policy_allows(
+                provider.descriptor().consent_policy(),
+                context.consent,
+                context.signals,
+            )
+        {
+            return false;
+        }
+    }
+    if let Some(owner) = context.catalog.owner_of(source) {
+        // An opted-out owner stops its source whoever wrote the record, so a
+        // browser-seeded record its opt-out did not remove is not served.
+        // No stored record matches the owner's `ps.iv`: every invalidation
+        // removes its record, and nothing refills one (spec 5.4).
+        if context.opted_out.contains(owner) {
+            return false;
+        }
+        let Some(owner_provider) = context.catalog.get(owner) else {
+            return false;
+        };
+        let descriptor = owner_provider.descriptor();
+        if !policy_allows(
+            descriptor.consent_policy(),
+            context.consent,
+            context.signals,
+        ) {
+            return false;
+        }
+        if descriptor.is_expiring(source)
+            && (writer.as_ref() != Some(owner) || record.exp.is_none())
+        {
+            return false;
+        }
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::{BTreeMap, BTreeSet};
+    use std::sync::Arc;
+
+    use super::*;
+    use crate::ec::identity::descriptor::{Captures, ConsentPolicy, ProviderDescriptor, Resolves};
+    use crate::ec::identity::provider::IdentityProvider;
+    use crate::ec::identity::test_support::resolver_policy;
+    use crate::ec::identity::test_support::{
+        example_entry_set, full_record, test_consent_allowing_everything,
+        test_consent_gdpr_without_vendor,
+    };
+    use crate::ec::kv_types::KvPartnerId;
+
+    struct Fixed(ProviderDescriptor);
+    impl IdentityProvider for Fixed {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.0
+        }
+    }
+
+    fn provider(
+        id: &str,
+        source: &str,
+        policy: ConsentPolicy,
+        expiring: bool,
+    ) -> Arc<dyn IdentityProvider> {
+        let mut builder =
+            ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+                .with_source(source.parse().expect("should parse the source"))
+                .with_resolves(Resolves::new().with_endpoint("https://api.example.com"))
+                .with_consent_policy(policy);
+        if expiring {
+            builder = builder.with_expiring_ids();
+        }
+        Arc::new(Fixed(builder.build().expect("should build")))
+    }
+
+    fn record(writer: Option<&str>, exp: Option<u64>) -> KvPartnerId {
+        KvPartnerId {
+            w: writer.map(str::to_owned),
+            exp,
+            ..KvPartnerId::new("u")
+        }
+    }
+
+    fn check(
+        catalog: &ProviderCatalog,
+        opted_out: &BTreeSet<IdentityProviderId>,
+        source: &str,
+        record: &KvPartnerId,
+    ) -> bool {
+        let consent = test_consent_allowing_everything();
+        let context = ServeContext {
+            now: UnixTime::from_secs(100),
+            consent: &consent,
+            signals: PolicySignals::default(),
+            catalog,
+            opted_out,
+        };
+        is_servable(
+            &context,
+            &source.parse().expect("should parse the source"),
+            record,
+        )
+    }
+
+    #[test]
+    fn expiry_writer_presence_and_opt_out() {
+        let catalog = ProviderCatalog::new(
+            vec![provider(
+                "p",
+                "a.example.com",
+                ConsentPolicy::eid_persistence_only(),
+                false,
+            )],
+            BTreeMap::new(),
+        );
+        let none = BTreeSet::new();
+        assert!(
+            check(
+                &catalog,
+                &none,
+                "a.example.com",
+                &record(Some("p"), Some(101))
+            ),
+            "should serve a valid record"
+        );
+        assert!(
+            !check(
+                &catalog,
+                &none,
+                "a.example.com",
+                &record(Some("p"), Some(100))
+            ),
+            "should treat now == exp as expired"
+        );
+        assert!(
+            !check(
+                &catalog,
+                &none,
+                "a.example.com",
+                &record(Some("gone"), None)
+            ),
+            "should not serve an unknown writer"
+        );
+        let opted: BTreeSet<_> = ["p".parse().expect("should parse the provider ID")]
+            .into_iter()
+            .collect();
+        assert!(
+            !check(&catalog, &opted, "a.example.com", &record(Some("p"), None)),
+            "should not serve an opted-out writer"
+        );
+        assert!(
+            check(&catalog, &none, "b.example.com", &record(None, None)),
+            "should serve an unowned browser record"
+        );
+    }
+
+    #[test]
+    fn an_opted_out_owner_stops_every_record_of_its_source() {
+        let catalog = ProviderCatalog::new(
+            vec![provider(
+                "owner",
+                "a.example.com",
+                ConsentPolicy::eid_persistence_only(),
+                false,
+            )],
+            [(
+                "a.example.com".parse().expect("should parse the source"),
+                "owner".parse().expect("should parse the provider ID"),
+            )]
+            .into_iter()
+            .collect(),
+        );
+        let opted: BTreeSet<_> = ["owner".parse().expect("should parse the provider ID")]
+            .into_iter()
+            .collect();
+
+        assert!(
+            !check(&catalog, &opted, "a.example.com", &record(None, None)),
+            "should not serve a browser-seeded record of the owned source"
+        );
+        assert!(
+            check(
+                &catalog,
+                &BTreeSet::new(),
+                "a.example.com",
+                &record(None, None)
+            ),
+            "control: should serve it while the owner is not opted out"
+        );
+    }
+
+    #[test]
+    fn a_full_record_is_servable_or_not_as_a_whole() {
+        let catalog = ProviderCatalog::new(
+            vec![provider(
+                "p",
+                "a.example.com",
+                ConsentPolicy::eid_persistence_only(),
+                false,
+            )],
+            BTreeMap::new(),
+        );
+        let none = BTreeSet::new();
+        let valid = KvPartnerId {
+            exp: Some(101),
+            ..full_record(Some("p"), example_entry_set())
+        };
+        let expired = KvPartnerId {
+            exp: Some(100),
+            ..full_record(Some("p"), example_entry_set())
+        };
+        assert!(
+            check(&catalog, &none, "a.example.com", &valid),
+            "should serve the whole valid set"
+        );
+        assert!(
+            !check(&catalog, &none, "a.example.com", &expired),
+            "should never serve an expired set"
+        );
+    }
+
+    #[test]
+    fn rollback_rule_for_expiring_owned_sources() {
+        let owner: IdentityProviderId = "owner".parse().expect("should parse the provider ID");
+        let catalog = ProviderCatalog::new(
+            vec![provider(
+                "owner",
+                "a.example.com",
+                ConsentPolicy::eid_persistence_only(),
+                true,
+            )],
+            [(
+                "a.example.com".parse().expect("should parse the source"),
+                owner,
+            )]
+            .into_iter()
+            .collect(),
+        );
+        let none = BTreeSet::new();
+        assert!(
+            check(
+                &catalog,
+                &none,
+                "a.example.com",
+                &record(Some("owner"), Some(200))
+            ),
+            "should serve the owner's value"
+        );
+        assert!(
+            !check(&catalog, &none, "a.example.com", &record(None, None)),
+            "should never serve a browser-seeded value from the server"
+        );
+        assert!(
+            !check(
+                &catalog,
+                &none,
+                "a.example.com",
+                &record(Some("owner"), None)
+            ),
+            "should not serve a value with a stripped exp"
+        );
+    }
+
+    #[test]
+    fn narrowing_limits_claims_and_capture_only_sources() {
+        let capture_only: Arc<dyn IdentityProvider> = Arc::new(Fixed(
+            ProviderDescriptor::builder("c".parse().expect("should parse the provider ID"))
+                .with_source("a.example.com".parse().expect("should parse the source"))
+                .with_source("b.example.com".parse().expect("should parse the source"))
+                .with_captures(Captures::new().with_path_prefix("/integrations/c/"))
+                .build()
+                .expect("should build"),
+        ));
+        let resolver = provider(
+            "p",
+            "a.example.com",
+            ConsentPolicy::eid_persistence_only(),
+            false,
+        );
+        let a: SourceDomain = "a.example.com".parse().expect("should parse the source");
+        let b: SourceDomain = "b.example.com".parse().expect("should parse the source");
+        let c: IdentityProviderId = "c".parse().expect("should parse the provider ID");
+        let p: IdentityProviderId = "p".parse().expect("should parse the provider ID");
+
+        let catalog = ProviderCatalog::new(vec![capture_only, resolver], BTreeMap::new())
+            .with_narrowing([(c.clone(), vec![b.clone()])].into_iter().collect());
+
+        assert_eq!(
+            catalog.sources_of(&c),
+            std::slice::from_ref(&b),
+            "should narrow the capture-only provider"
+        );
+        assert!(
+            catalog.is_capture_only(&c) && !catalog.is_capture_only(&p),
+            "should tell capture-only apart"
+        );
+        assert_eq!(
+            catalog.capture_only_sources(&c),
+            std::slice::from_ref(&b),
+            "should list its narrowed sources"
+        );
+        assert!(
+            catalog.capture_only_sources(&p).is_empty(),
+            "should list none for a resolver"
+        );
+        assert_eq!(
+            catalog.claimants(&a).collect::<Vec<_>>(),
+            vec![&p],
+            "should drop a narrowed-away claim"
+        );
+        assert_eq!(
+            catalog.claimants(&b).collect::<Vec<_>>(),
+            vec![&c],
+            "should keep the narrowed claim"
+        );
+    }
+
+    #[test]
+    fn writer_policy_applies_to_unowned_sources() {
+        let strict = resolver_policy().with_tcf_vendor(9999);
+        let catalog = ProviderCatalog::new(
+            vec![provider("p", "a.example.com", strict, false)],
+            BTreeMap::new(),
+        );
+        let consent = test_consent_gdpr_without_vendor(9999);
+        let none = BTreeSet::new();
+        let context = ServeContext {
+            now: UnixTime::from_secs(100),
+            consent: &consent,
+            signals: PolicySignals::default(),
+            catalog: &catalog,
+            opted_out: &none,
+        };
+        let source = "a.example.com".parse().expect("should parse the source");
+        assert!(
+            !is_servable(&context, &source, &record(Some("p"), None)),
+            "should not serve when the writer's vendor is denied"
+        );
+        assert!(
+            is_servable(&context, &source, &record(None, None)),
+            "should leave a browser value unaffected"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/identity/test_support.rs b/crates/trusted-server-core/src/ec/identity/test_support.rs
new file mode 100644
index 0000000000..4ada943441
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/identity/test_support.rs
@@ -0,0 +1,3032 @@
+//! Shared helpers for identity tests.
+
+#![cfg_attr(
+    not(test),
+    allow(
+        dead_code,
+        reason = "the test-utils library build compiles the crate-private helpers without their unit-test callers"
+    )
+)]
+
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+use std::net::IpAddr;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use error_stack::Report;
+use http::{HeaderMap, HeaderName, HeaderValue, Method, StatusCode};
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use serde_json::json;
+use url::Url;
+
+use crate::consent::jurisdiction::Jurisdiction;
+use crate::consent::types::RawConsentSignals;
+use crate::consent::types::TcfConsent;
+use crate::consent::{ConsentContext, build_context_from_signals};
+use crate::ec::identity::catalog::ProviderCatalog;
+use crate::ec::identity::coordinator::{OutcomeContext, RequestFacts};
+use crate::ec::identity::descriptor::{
+    Access, Captures, ConsentPolicy, EidProvenance, Input, ProviderDescriptor, ResolveKind,
+    Resolves,
+};
+use crate::ec::identity::exchange::{ProviderRequest, ProviderResponse};
+use crate::ec::identity::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use crate::ec::identity::input::{
+    CaptureInput, HashedEmail, ProviderConsent, Region, ResolveInput, ResolveSignals, SeededRandom,
+    StoredId,
+};
+use crate::ec::identity::policy::{PolicySignals, policy_allows};
+use crate::ec::identity::provider::{IdentityProvider, IdentityProviderConfig};
+use crate::ec::identity::resolution::{
+    IdentityProviderError, Resolution, ResolvedEid, ResolvedUid, StateChange, When, entry_sets,
+};
+use crate::ec::identity::revision::{StateRevision, new_revision};
+use crate::ec::kv_backend::in_memory::InMemoryEcKv;
+use crate::ec::kv_backend::{EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome};
+use crate::ec::kv_types::{KvEid, KvPartnerId, KvUid};
+use crate::ec::rate_limiter::RateLimiter;
+use crate::error::TrustedServerError;
+use crate::openrtb::{Eid, Uid};
+use crate::redacted::Redacted;
+use crate::settings::{EcPartner, IdentitySettings, ProviderSettings};
+
+/// A request with no consent signal and no regulated jurisdiction.
+/// Purposes 1 and 4 with no vendor: the policy test resolvers run under.
+#[must_use]
+pub fn resolver_policy() -> ConsentPolicy {
+    ConsentPolicy::strict()
+        .with_tcf_purposes([4])
+        .without_tcf_vendor()
+}
+
+#[must_use]
+pub fn test_consent_allowing_everything() -> ConsentContext {
+    ConsentContext {
+        jurisdiction: Jurisdiction::NonRegulated,
+        ..ConsentContext::default()
+    }
+}
+
+/// A GDPR request whose TCF string grants every purpose but not `vendor_id`.
+#[must_use]
+pub fn test_consent_gdpr_without_vendor(vendor_id: u16) -> ConsentContext {
+    let vendors: Vec<u16> = (1..=20).filter(|vendor| *vendor != vendor_id).collect();
+    ConsentContext {
+        gdpr_applies: true,
+        jurisdiction: Jurisdiction::Gdpr,
+        tcf: Some(TcfConsent {
+            version: 2,
+            cmp_id: 1,
+            cmp_version: 1,
+            consent_screen: 1,
+            consent_language: "EN".to_owned(),
+            vendor_list_version: 1,
+            tcf_policy_version: 4,
+            created_ds: 0,
+            last_updated_ds: 0,
+            purpose_consents: vec![true; 24],
+            purpose_legitimate_interests: vec![false; 24],
+            vendor_consents: vendors,
+            vendor_legitimate_interests: Vec::new(),
+            special_feature_opt_ins: vec![false; 12],
+        }),
+        ..ConsentContext::default()
+    }
+}
+
+/// Spec 6.1's example set: two entries, three UIDs, with UID-level and
+/// EID-level fields.
+#[must_use]
+pub fn example_entry_set() -> Vec<KvEid> {
+    vec![
+        KvEid {
+            uids: vec![
+                KvUid {
+                    id: "example-a".to_owned(),
+                    atype: Some(1),
+                    ext: None,
+                },
+                KvUid {
+                    id: "example-b".to_owned(),
+                    atype: Some(3),
+                    ext: Some(json!({ "stype": "ppuid" })),
+                },
+            ],
+            inserter: Some("example.com".to_owned()),
+            mm: Some(3),
+            ..KvEid::default()
+        },
+        KvEid {
+            uids: vec![KvUid {
+                id: "example-c".to_owned(),
+                atype: Some(1),
+                ext: None,
+            }],
+            matcher: Some("partner.example.com".to_owned()),
+            ..KvEid::default()
+        },
+    ]
+}
+
+/// A record holding `set`, written by `writer`.
+#[must_use]
+pub fn full_record(writer: Option<&str>, set: Vec<KvEid>) -> KvPartnerId {
+    KvPartnerId {
+        w: writer.map(str::to_owned),
+        eids: set,
+        ..KvPartnerId::default()
+    }
+}
+
+/// A descriptor-only resolver for `id`, declaring `sources`, with a dummy
+/// endpoint and the `eid_persistence_only` policy.
+///
+/// # Panics
+///
+/// Panics when `id` or a source is not valid.
+#[must_use]
+pub fn fixed_provider(id: &str, sources: &[&str]) -> Arc<dyn IdentityProvider> {
+    let mut builder =
+        ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+            .with_resolves(Resolves::new().with_endpoint("https://api.example.com"))
+            .with_consent_policy(ConsentPolicy::eid_persistence_only());
+    for source in sources {
+        builder = builder.with_source(source.parse().expect("should parse the source"));
+    }
+    Arc::new(DescriptorOnly(
+        builder.build().expect("should build the descriptor"),
+    ))
+}
+
+/// A descriptor-only capture-only provider for `id`, declaring `sources`.
+///
+/// # Panics
+///
+/// Panics when `id` or a source is not valid.
+#[must_use]
+pub fn fixed_capture_provider(id: &str, sources: &[&str]) -> Arc<dyn IdentityProvider> {
+    let mut builder =
+        ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+            .with_captures(Captures::new().with_path_prefix(&format!("/integrations/{id}/")))
+            .with_consent_policy(ConsentPolicy::eid_persistence_only());
+    for source in sources {
+        builder = builder.with_source(source.parse().expect("should parse the source"));
+    }
+    Arc::new(DescriptorOnly(
+        builder.build().expect("should build the descriptor"),
+    ))
+}
+
+/// A capture-only provider that answers as the 2xx JSON body says:
+/// `{"tokens":[{"source":"a.example.com","value":"x"}],"invalidate":["a.example.com"],
+/// "opted_out":true,"state":"s"}`. Every member is optional. `opted_out` wins,
+/// then `tokens`, then `invalidate`, and anything else is `no_match`.
+struct AnsweringCapture {
+    descriptor: ProviderDescriptor,
+}
+
+impl IdentityProvider for AnsweringCapture {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn capture(
+        &self,
+        input: &CaptureInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let Ok(body) = input.response().json::<serde_json::Value>() else {
+            return Ok(Resolution::no_match());
+        };
+        let sources = |name: &str| -> Vec<SourceDomain> {
+            body[name]
+                .as_array()
+                .into_iter()
+                .flatten()
+                .filter_map(|value| value.as_str()?.parse().ok())
+                .collect()
+        };
+        let tokens: Vec<ResolvedEid> = body["tokens"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .filter_map(|token| {
+                let source = input.source_named(token["source"].as_str()?)?;
+                Some(ResolvedEid::new(
+                    source,
+                    ResolvedUid::new(token["value"].as_str()?),
+                ))
+            })
+            .collect();
+        let invalidated = sources("invalidate");
+        let mut resolution = if body["opted_out"].as_bool() == Some(true) {
+            Resolution::opted_out()
+        } else if !tokens.is_empty() {
+            Resolution::found(tokens)
+        } else if let Some(first) = invalidated.first() {
+            Resolution::invalidate(first)
+        } else {
+            Resolution::no_match()
+        };
+        for source in &invalidated {
+            resolution = resolution.also_invalidate(source);
+        }
+        if let Some(state) = body["state"].as_str() {
+            resolution = resolution.replacing_state(&state);
+        }
+        Ok(resolution)
+    }
+}
+
+/// A capture-only provider `id` over `sources` that answers as the response
+/// body says, with a capture rule on `/integrations/<id>/`. With `gvl_id` its
+/// consent policy names that TCF vendor.
+///
+/// # Panics
+///
+/// Panics when `id` or a source is not valid.
+#[must_use]
+pub fn answering_capture_provider(
+    id: &str,
+    sources: &[&str],
+    gvl_id: Option<u16>,
+) -> Arc<dyn IdentityProvider> {
+    answering_capture_provider_at(id, sources, gvl_id, &format!("/integrations/{id}/"))
+}
+
+/// As [`answering_capture_provider`], with the capture rule on `prefix`.
+///
+/// # Panics
+///
+/// Panics when `id` or a source is not valid.
+#[must_use]
+pub fn answering_capture_provider_at(
+    id: &str,
+    sources: &[&str],
+    gvl_id: Option<u16>,
+    prefix: &str,
+) -> Arc<dyn IdentityProvider> {
+    let policy = match gvl_id {
+        Some(vendor) => resolver_policy().with_tcf_vendor(vendor),
+        None => ConsentPolicy::eid_persistence_only(),
+    };
+    let mut builder =
+        ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+            .with_captures(Captures::new().with_path_prefix(prefix))
+            .with_consent_policy(policy);
+    for source in sources {
+        builder = builder.with_source(source.parse().expect("should parse the source"));
+    }
+    Arc::new(AnsweringCapture {
+        descriptor: builder.build().expect("should build the descriptor"),
+    })
+}
+
+/// A [`fixed_provider`] that also declares a `with_provenance` default per
+/// listed source.
+///
+/// # Panics
+///
+/// Panics when `id` or a source is not valid.
+#[must_use]
+pub fn provenance_provider(
+    id: &str,
+    sources: &[&str],
+    provenance: Vec<(&str, EidProvenance)>,
+) -> Arc<dyn IdentityProvider> {
+    let mut builder =
+        ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+            .with_resolves(Resolves::new().with_endpoint("https://api.example.com"))
+            .with_consent_policy(ConsentPolicy::eid_persistence_only());
+    for source in sources {
+        builder = builder.with_source(source.parse().expect("should parse the source"));
+    }
+    for (source, default) in provenance {
+        builder =
+            builder.with_provenance(&source.parse().expect("should parse the source"), default);
+    }
+    provider_from(builder.build().expect("should build the descriptor"))
+}
+
+/// A descriptor-only provider for `descriptor`, for tests that need more
+/// than [`fixed_provider`] declares.
+#[must_use]
+pub fn provider_from(descriptor: ProviderDescriptor) -> Arc<dyn IdentityProvider> {
+    Arc::new(DescriptorOnly(descriptor))
+}
+
+/// The source [`MultiEntryTestProvider`] writes.
+pub const MULTI_ENTRY_SOURCE: &str = "exampleid.example.com";
+
+/// The endpoint [`MultiEntryTestProvider`] calls.
+pub const MULTI_ENTRY_ENDPOINT: &str = "https://api.exampleid.example.com/v1/resolve";
+
+/// A resolver for [`MULTI_ENTRY_SOURCE`] that returns a complete set, for
+/// request-level tests of a registered provider.
+///
+/// The JSON body of the endpoint's reply picks the answer through its
+/// `entries` member:
+///
+/// - `"full"`, or a body without the member: two entries. The first holds
+///   `uid-a` (`atype` 1, a UID-level `ext`) and `uid-b`, with `inserter`,
+///   `matcher` and `mm`. The second holds `uid-c` and an EID-level `ext`, and
+///   sets none of `inserter`, `matcher` and `mm`.
+/// - `"first"`: the first entry alone.
+/// - `"single"`: `uid-a` with `atype` 1 and its UID-level `ext`, and no
+///   EID-level field.
+/// - `"oversized"`: a set over `MAX_ENTRY_SET_BYTES`, which also invalidates
+///   the source.
+/// - `"none"`: no match.
+///
+/// The descriptor declares a `with_provenance` default of an `inserter` and a
+/// `matcher`. [`stateful`](Self::stateful) is the same provider declared
+/// `with_private_state()`; it keeps `{"seen": true}` in every answer that
+/// finds an ID.
+pub struct MultiEntryTestProvider {
+    descriptor: ProviderDescriptor,
+    stateful: bool,
+}
+
+impl MultiEntryTestProvider {
+    /// The stateless provider.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the fixed descriptor does not build.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::build(false)
+    }
+
+    /// The same provider, declared `with_private_state()`.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the fixed descriptor does not build.
+    #[must_use]
+    pub fn stateful() -> Self {
+        Self::build(true)
+    }
+
+    fn build(stateful: bool) -> Self {
+        let mut resolves = Resolves::new().with_endpoint(MULTI_ENTRY_ENDPOINT);
+        if stateful {
+            resolves = resolves.with_private_state();
+        }
+        let descriptor =
+            ProviderDescriptor::builder("exampleid".parse().expect("should parse the provider ID"))
+                .with_source(source(MULTI_ENTRY_SOURCE))
+                .with_resolves(resolves)
+                .with_consent_policy(resolver_policy())
+                .with_provenance(
+                    &source(MULTI_ENTRY_SOURCE),
+                    EidProvenance::new()
+                        .with_inserter("default-inserter.example.com")
+                        .with_matcher("default-matcher.example.com"),
+                )
+                .build()
+                .expect("should build the descriptor");
+        Self {
+            descriptor,
+            stateful,
+        }
+    }
+
+    fn first_entry(source: &SourceDomain) -> ResolvedEid {
+        ResolvedEid::new(
+            source,
+            ResolvedUid::new("uid-a")
+                .with_atype(1)
+                .with_ext(json!({ "rtiPartner": "example" })),
+        )
+        .with_uid(ResolvedUid::new("uid-b"))
+        .with_inserter("inserter-a.example.com")
+        .with_matcher("matcher-a.example.com")
+        .with_mm(2)
+    }
+}
+
+impl Default for MultiEntryTestProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl IdentityProvider for MultiEntryTestProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        Ok(Some(ProviderRequest::get(input.endpoint()?)))
+    }
+
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        _input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let body: serde_json::Value = response.success_json()?;
+        let source = source(MULTI_ENTRY_SOURCE);
+        let resolution = match body["entries"].as_str() {
+            Some("none") => Resolution::no_match(),
+            Some("first") => Resolution::found([Self::first_entry(&source)]),
+            Some("single") => Resolution::found([ResolvedEid::new(
+                &source,
+                ResolvedUid::new("uid-a")
+                    .with_atype(1)
+                    .with_ext(json!({ "rtiPartner": "example" })),
+            )]),
+            Some("oversized") => {
+                let entries = (0..8).map(|index| {
+                    ResolvedEid::new(
+                        &source,
+                        ResolvedUid::new(format!("uid-{index}"))
+                            .with_ext(json!({ "pad": "x".repeat(1_000) })),
+                    )
+                });
+                return Ok(self.with_state(Resolution::found(entries).also_invalidate(&source)));
+            }
+            _ => Resolution::found([
+                Self::first_entry(&source),
+                ResolvedEid::new(&source, ResolvedUid::new("uid-c"))
+                    .with_ext(json!({ "segments": ["example"] })),
+            ]),
+        };
+        Ok(self.with_state(resolution))
+    }
+}
+
+impl MultiEntryTestProvider {
+    fn with_state(&self, resolution: Resolution) -> Resolution {
+        if self.stateful {
+            resolution.replacing_state(&json!({ "seen": true }))
+        } else {
+            resolution
+        }
+    }
+}
+
+/// A `fixed_provider` declared `with_private_state()`.
+///
+/// # Panics
+///
+/// Panics when `id` or a source is not valid.
+#[must_use]
+pub fn stateful_fixed_provider(id: &str, sources: &[&str]) -> Arc<dyn IdentityProvider> {
+    let mut builder =
+        ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint("https://api.example.com")
+                    .with_private_state(),
+            )
+            .with_consent_policy(ConsentPolicy::eid_persistence_only());
+    for source in sources {
+        builder = builder.with_source(source.parse().expect("should parse the source"));
+    }
+    provider_from(builder.build().expect("should build the descriptor"))
+}
+
+/// A request with no consent signal and no regulated jurisdiction.
+#[must_use]
+pub fn allowing_consent() -> ConsentContext {
+    test_consent_allowing_everything()
+}
+
+/// A source domain.
+///
+/// # Panics
+///
+/// Panics when `domain` is not valid.
+#[must_use]
+pub fn source(domain: &str) -> SourceDomain {
+    domain.parse().expect("should parse the source")
+}
+
+/// A provider ID.
+///
+/// # Panics
+///
+/// Panics when `id` is not valid.
+#[must_use]
+pub fn pid(id: &str) -> IdentityProviderId {
+    id.parse().expect("should parse the provider ID")
+}
+
+/// A one-UID record with a fresh `rv`, written by `writer` at `at`.
+#[must_use]
+pub fn record_for_test(uid: &str, writer: Option<&str>, at: u64) -> KvPartnerId {
+    KvPartnerId {
+        w: writer.map(str::to_owned),
+        rv: Some(new_revision(&SeededRandom::new(at)).as_str().to_owned()),
+        at: Some(at),
+        ..KvPartnerId::new(uid)
+    }
+}
+
+/// Facts for a returning visitor's writer navigation that runs no auction:
+/// a real browser, persistence allowed and every input available.
+#[must_use]
+pub(crate) fn facts_for_writer() -> RequestFacts {
+    RequestFacts {
+        is_real_browser: true,
+        ec_persistence_allowed: true,
+        policy_signals: PolicySignals::default(),
+        writer: true,
+        new_visitor: false,
+        runs_auction: false,
+        now: UnixTime::from_secs(1_000),
+        available_inputs: BTreeSet::from([
+            Input::ClientIp,
+            Input::UserAgent,
+            Input::PageUrl,
+            Input::Region,
+            Input::HashedEmail,
+        ]),
+    }
+}
+
+/// An owned fixture for [`OutcomeContext`], which borrows from it.
+///
+/// `new` holds a catalog with provider `p` claiming `a.example.com` and
+/// `b.example.com`, no source owners and default settings.
+pub(crate) struct OutcomeFixture {
+    catalog: ProviderCatalog,
+    settings: ProviderSettings,
+    identity: IdentitySettings,
+    expected_state: Option<StateRevision>,
+    fingerprint: String,
+}
+
+impl OutcomeFixture {
+    #[must_use]
+    pub(crate) fn new() -> Self {
+        Self {
+            catalog: ProviderCatalog::new(
+                vec![fixed_provider("p", &["a.example.com", "b.example.com"])],
+                std::collections::BTreeMap::new(),
+            ),
+            settings: ProviderSettings::default(),
+            identity: IdentitySettings::default(),
+            expected_state: None,
+            fingerprint: "0".to_owned(),
+        }
+    }
+
+    /// Replaces the catalog.
+    #[must_use]
+    pub(crate) fn with_catalog(mut self, catalog: ProviderCatalog) -> Self {
+        self.catalog = catalog;
+        self
+    }
+
+    /// Replaces the provider's settings.
+    #[must_use]
+    pub(crate) fn with_settings(mut self, settings: ProviderSettings) -> Self {
+        self.settings = settings;
+        self
+    }
+
+    /// Sets the consent fingerprint an opt-out records.
+    #[must_use]
+    pub(crate) fn with_fingerprint(mut self, fingerprint: &str) -> Self {
+        fingerprint.clone_into(&mut self.fingerprint);
+        self
+    }
+
+    /// Sets the state revision the call read.
+    #[must_use]
+    pub(crate) fn with_expected_state(mut self, expected_state: StateRevision) -> Self {
+        self.expected_state = Some(expected_state);
+        self
+    }
+
+    /// The context for an outcome at `now`.
+    #[must_use]
+    pub(crate) fn context_at(&self, now: u64) -> OutcomeContext<'_> {
+        OutcomeContext {
+            now: UnixTime::from_secs(now),
+            catalog: &self.catalog,
+            settings: &self.settings,
+            identity: &self.identity,
+            expected_state: self.expected_state.clone(),
+            fingerprint: &self.fingerprint,
+        }
+    }
+}
+
+/// A valid EC ID in `{64-hex}.{6-alnum}` format.
+pub const TEST_EC_ID: &str =
+    "0000000000000000000000000000000000000000000000000000000000000000.ABC123";
+
+/// A partner with pull sync enabled, calling `pull_sync_url` with `token`.
+///
+/// The URL's host is the only allowed domain.
+///
+/// # Panics
+///
+/// Panics when `source` is not a domain or `pull_sync_url` is not a URL with a host.
+#[must_use]
+pub fn ec_partner(source: &str, pull_sync_url: &str, token: &str) -> EcPartner {
+    let host = Url::parse(pull_sync_url)
+        .expect("should parse the pull URL")
+        .host_str()
+        .expect("should have a pull URL host")
+        .to_owned();
+    EcPartner {
+        name: format!("Partner {source}"),
+        source_domain: source.to_owned(),
+        openrtb_atype: EcPartner::default_openrtb_atype(),
+        bidstream_enabled: true,
+        api_token: None,
+        batch_rate_limit: EcPartner::default_batch_rate_limit(),
+        pull_sync_enabled: true,
+        pull_sync_url: Some(pull_sync_url.to_owned()),
+        pull_sync_allowed_domains: vec![host],
+        removed_pull_sync_ttl_sec: None,
+        removed_pull_sync_rate_limit: None,
+        owner: None,
+        ts_pull_token: Some(Redacted::new(token.to_owned())),
+    }
+}
+
+/// A stored one-UID record of `source`, as a provider reads it.
+///
+/// # Panics
+///
+/// Panics when the record is not valid.
+#[must_use]
+pub(crate) fn stored_for_test(source: &SourceDomain, uid: &str) -> StoredId {
+    StoredId::for_test(source, uid)
+}
+
+/// Write and lookup counts of a [`WriteCountingEcKv`].
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct WriteCounts {
+    /// Writes in [`EcKvWriteMode::Add`] mode.
+    pub add: usize,
+    /// Writes in [`EcKvWriteMode::IfGenerationMatch`] mode.
+    pub if_generation_match: usize,
+    /// Writes in [`EcKvWriteMode::Overwrite`] mode.
+    pub overwrite: usize,
+    /// Point reads of identity rows.
+    pub lookups: usize,
+    /// Point reads of pending keys (spec 5.3, Pending key).
+    pub pending_lookups: usize,
+}
+
+impl WriteCounts {
+    /// Every write, whatever its mode.
+    #[must_use]
+    pub fn total(&self) -> usize {
+        self.add + self.if_generation_match + self.overwrite
+    }
+}
+
+/// An in-memory KV store that counts lookups and writes by mode.
+///
+/// Every write is applied or refused as the in-memory store does, so a
+/// write that loses its precondition is still counted and reports
+/// [`EcKvWriteOutcome::PreconditionFailed`].
+pub struct WriteCountingEcKv {
+    inner: InMemoryEcKv,
+    add: AtomicUsize,
+    if_generation_match: AtomicUsize,
+    overwrite: AtomicUsize,
+    lookups: AtomicUsize,
+    pending_lookups: AtomicUsize,
+    refusals: Mutex<BTreeMap<String, usize>>,
+    failing: Mutex<BTreeSet<String>>,
+    failing_all: Mutex<BTreeSet<String>>,
+    pauses: Mutex<Vec<Duration>>,
+}
+
+impl WriteCountingEcKv {
+    /// An empty store named `name`.
+    #[must_use]
+    pub fn new(name: impl Into<String>) -> Self {
+        Self {
+            inner: InMemoryEcKv::new(name),
+            add: AtomicUsize::new(0),
+            if_generation_match: AtomicUsize::new(0),
+            overwrite: AtomicUsize::new(0),
+            lookups: AtomicUsize::new(0),
+            pending_lookups: AtomicUsize::new(0),
+            refusals: Mutex::new(BTreeMap::new()),
+            failing: Mutex::new(BTreeSet::new()),
+            failing_all: Mutex::new(BTreeSet::new()),
+            pauses: Mutex::new(Vec::new()),
+        }
+    }
+
+    /// Fails every generation-checked write to `key` with a store error that
+    /// is never retried. A failed write is still counted.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the failure table is poisoned.
+    pub fn fail_conditional_writes(&self, key: &str) {
+        self.failing
+            .lock()
+            .expect("should lock the failures")
+            .insert(key.to_owned());
+    }
+
+    /// Fails every write to `key`, whatever its mode, with a store error.
+    /// A failed write is still counted.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the failure table is poisoned.
+    pub fn fail_all_writes(&self, key: &str) {
+        self.failing_all
+            .lock()
+            .expect("should lock the failures")
+            .insert(key.to_owned());
+    }
+
+    /// Refuses the next `count` generation-checked writes to `key` with
+    /// [`EcKvWriteOutcome::PreconditionFailed`], the retryable refusal. A
+    /// refused write is still counted.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the refusal table is poisoned.
+    pub fn refuse_conditional_writes(&self, key: &str, count: usize) {
+        self.refusals
+            .lock()
+            .expect("should lock the refusals")
+            .insert(key.to_owned(), count);
+    }
+
+    /// Every [`EcKvStore::pause`] so far, in order.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the pause list is poisoned.
+    #[must_use]
+    pub fn pauses(&self) -> Vec<Duration> {
+        self.pauses.lock().expect("should lock the pauses").clone()
+    }
+
+    /// The counts so far, seeding included.
+    #[must_use]
+    pub fn writes(&self) -> WriteCounts {
+        WriteCounts {
+            add: self.add.load(Ordering::SeqCst),
+            if_generation_match: self.if_generation_match.load(Ordering::SeqCst),
+            overwrite: self.overwrite.load(Ordering::SeqCst),
+            lookups: self.lookups.load(Ordering::SeqCst),
+            pending_lookups: self.pending_lookups.load(Ordering::SeqCst),
+        }
+    }
+
+    /// Zeroes the counts, to count only what follows the seeding.
+    pub fn reset_counts(&self) {
+        for count in [
+            &self.add,
+            &self.if_generation_match,
+            &self.overwrite,
+            &self.lookups,
+            &self.pending_lookups,
+        ] {
+            count.store(0, Ordering::SeqCst);
+        }
+    }
+}
+
+impl EcKvStore for WriteCountingEcKv {
+    fn store_name(&self) -> &str {
+        self.inner.store_name()
+    }
+
+    fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+        let count = if key.starts_with("pending:") {
+            &self.pending_lookups
+        } else {
+            &self.lookups
+        };
+        count.fetch_add(1, Ordering::SeqCst);
+        self.inner.lookup(key)
+    }
+
+    fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+        self.inner.key_exists(key)
+    }
+
+    fn insert(
+        &self,
+        key: &str,
+        write: EcKvWrite<'_>,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        let count = match write.mode {
+            EcKvWriteMode::Add => &self.add,
+            EcKvWriteMode::IfGenerationMatch(_) => &self.if_generation_match,
+            EcKvWriteMode::Overwrite => &self.overwrite,
+        };
+        count.fetch_add(1, Ordering::SeqCst);
+        if self
+            .failing_all
+            .lock()
+            .expect("should lock the failures")
+            .contains(key)
+        {
+            return Err(Report::new(TrustedServerError::KvStore {
+                store_name: self.inner.store_name().to_owned(),
+                message: "store unavailable".to_owned(),
+            }));
+        }
+        if matches!(write.mode, EcKvWriteMode::IfGenerationMatch(_)) {
+            if self
+                .failing
+                .lock()
+                .expect("should lock the failures")
+                .contains(key)
+            {
+                return Err(Report::new(TrustedServerError::KvStore {
+                    store_name: self.inner.store_name().to_owned(),
+                    message: "store unavailable".to_owned(),
+                }));
+            }
+            let mut refusals = self.refusals.lock().expect("should lock the refusals");
+            if let Some(remaining) = refusals.get_mut(key)
+                && *remaining > 0
+            {
+                *remaining -= 1;
+                return Ok(EcKvWriteOutcome::PreconditionFailed);
+            }
+        }
+        self.inner.insert(key, write)
+    }
+
+    fn list_keys_with_prefix(
+        &self,
+        prefix: &str,
+        limit: u32,
+    ) -> Result<Vec<String>, Report<TrustedServerError>> {
+        self.inner.list_keys_with_prefix(prefix, limit)
+    }
+
+    fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+        self.inner.delete(key)
+    }
+
+    fn pause(&self, duration: Duration) {
+        self.pauses
+            .lock()
+            .expect("should lock the pauses")
+            .push(duration);
+    }
+}
+
+/// The harness clock when a test does not set one.
+const HARNESS_NOW: u64 = 1_760_000_000;
+
+/// Inputs for one harness run. The harness's own `with_*` methods delegate
+/// to an inner `HarnessSetup`.
+#[derive(Debug, Clone, Default)]
+pub struct HarnessSetup {
+    client_ip: Option<IpAddr>,
+    user_agent: Option<String>,
+    page_url: Option<Url>,
+    region: Option<Region>,
+    hashed_email: Option<HashedEmail>,
+    consent: TestConsent,
+    stored: Vec<StoredId>,
+    state_json: Option<String>,
+    now: Option<UnixTime>,
+    random_seed: Option<u64>,
+}
+
+impl HarnessSetup {
+    /// Sets the client IP.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `ip` is not an IP address.
+    #[must_use]
+    pub fn with_client_ip(mut self, ip: &str) -> Self {
+        self.client_ip = Some(ip.parse().expect("should parse the client IP"));
+        self
+    }
+
+    /// Sets the `User-Agent`.
+    #[must_use]
+    pub fn with_user_agent(mut self, user_agent: &str) -> Self {
+        self.user_agent = Some(user_agent.to_owned());
+        self
+    }
+
+    /// Sets the page URL, without its query string and fragment, as a
+    /// request gives it to a provider.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `url` is not a URL.
+    #[must_use]
+    pub fn with_page_url(mut self, url: &str) -> Self {
+        let mut url = Url::parse(url).expect("should parse the page URL");
+        url.set_query(None);
+        url.set_fragment(None);
+        self.page_url = Some(url);
+        self
+    }
+
+    /// Sets the region.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `country` is not a country code.
+    #[must_use]
+    pub fn with_region(mut self, country: &str, subdivision: Option<&str>) -> Self {
+        self.region =
+            Some(Region::from_geo(country, subdivision).expect("should accept the country"));
+        self
+    }
+
+    /// Sets the hashed email.
+    #[must_use]
+    pub fn with_hashed_email(mut self, email: HashedEmail) -> Self {
+        self.hashed_email = Some(email);
+        self
+    }
+
+    /// Sets the raw consent strings. Default: GDPR does not apply and there
+    /// are no opt-outs.
+    #[must_use]
+    pub fn with_consent(mut self, consent: TestConsent) -> Self {
+        self.consent = consent;
+        self
+    }
+
+    /// Gives the provider a stored record, valid or expired. Its source is
+    /// the one its first entry names, or the provider's primary source.
+    #[must_use]
+    pub fn with_stored(mut self, stored: StoredId) -> Self {
+        self.stored.push(stored);
+        self
+    }
+
+    /// Gives the provider its private state, as stored.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `state` does not serialize.
+    #[must_use]
+    pub fn with_state(mut self, state: &impl Serialize) -> Self {
+        self.state_json = Some(serde_json::to_string(state).expect("should serialize the state"));
+        self
+    }
+
+    /// Sets the fixed clock. Default: 1,760,000,000.
+    #[must_use]
+    pub fn with_now(mut self, now: UnixTime) -> Self {
+        self.now = Some(now);
+        self
+    }
+
+    /// Seeds the random source. Default: 1.
+    #[must_use]
+    pub fn with_random_seed(mut self, seed: u64) -> Self {
+        self.random_seed = Some(seed);
+        self
+    }
+
+    fn now(&self) -> UnixTime {
+        self.now.unwrap_or(UnixTime::from_secs(HARNESS_NOW))
+    }
+
+    fn random(&self) -> SeededRandom {
+        SeededRandom::new(self.random_seed.unwrap_or(1))
+    }
+}
+
+/// Raw TCF, GPP and US Privacy strings, as a request would carry them.
+#[derive(Debug, Clone, Default)]
+pub struct TestConsent {
+    gdpr_applies: Option<bool>,
+    tc_string: Option<String>,
+    gpp: Option<(String, Vec<u16>)>,
+    us_privacy: Option<String>,
+    gpc: bool,
+    dnt: bool,
+}
+
+impl TestConsent {
+    /// Sets whether GDPR applies, whatever the strings say.
+    #[must_use]
+    pub fn with_gdpr_applies(mut self, applies: bool) -> Self {
+        self.gdpr_applies = Some(applies);
+        self
+    }
+
+    /// Sets the raw TCF string.
+    #[must_use]
+    pub fn with_tc_string(mut self, tc: &str) -> Self {
+        self.tc_string = Some(tc.to_owned());
+        self
+    }
+
+    /// Sets the raw GPP string and its section IDs.
+    #[must_use]
+    pub fn with_gpp_string(mut self, gpp: &str, section_ids: &[u16]) -> Self {
+        self.gpp = Some((gpp.to_owned(), section_ids.to_vec()));
+        self
+    }
+
+    /// Sets the raw US Privacy string.
+    #[must_use]
+    pub fn with_us_privacy(mut self, us_privacy: &str) -> Self {
+        self.us_privacy = Some(us_privacy.to_owned());
+        self
+    }
+
+    /// Sets the Global Privacy Control signal.
+    #[must_use]
+    pub fn with_gpc(mut self) -> Self {
+        self.gpc = true;
+        self
+    }
+
+    /// Sets the `DNT: 1` signal.
+    #[must_use]
+    pub fn with_dnt(mut self) -> Self {
+        self.dnt = true;
+        self
+    }
+
+    /// The consent context a request carrying these signals would build.
+    fn context(&self) -> ConsentContext {
+        let signals = RawConsentSignals {
+            raw_tc_string: self.tc_string.clone(),
+            raw_gpp_string: self.gpp.as_ref().map(|(gpp, _)| gpp.clone()),
+            raw_gpp_sid: self
+                .gpp
+                .as_ref()
+                .map(|(_, ids)| ids.iter().map(u16::to_string).collect::<Vec<_>>().join(",")),
+            raw_us_privacy: self.us_privacy.clone(),
+            gpc: self.gpc,
+        };
+        let mut context = build_context_from_signals(&signals);
+        // A known non-regulated region, so only the strings given matter.
+        context.jurisdiction = Jurisdiction::NonRegulated;
+        if let Some(applies) = self.gdpr_applies {
+            context.gdpr_applies = applies;
+        }
+        context
+    }
+}
+
+/// One proxied call: the request a capture rule matches, and its response.
+#[derive(Debug, Clone)]
+pub struct CaptureFixture {
+    method: Method,
+    path: String,
+    status: StatusCode,
+    body: Vec<u8>,
+}
+
+impl CaptureFixture {
+    /// A proxied call with `method` and `path`, answered 200 with no body.
+    #[must_use]
+    pub fn new(method: Method, path: &str) -> Self {
+        Self {
+            method,
+            path: path.to_owned(),
+            status: StatusCode::OK,
+            body: Vec::new(),
+        }
+    }
+
+    /// Sets the response status and JSON body.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `body` does not serialize.
+    #[must_use]
+    pub fn with_response(mut self, status: StatusCode, body: &serde_json::Value) -> Self {
+        self.status = status;
+        self.body = serde_json::to_vec(body).expect("should serialize the response body");
+        self
+    }
+}
+
+#[derive(Debug, Clone)]
+struct ResolveCase {
+    setup: HarnessSetup,
+    status: StatusCode,
+    headers: Vec<(String, String)>,
+    body: Vec<u8>,
+}
+
+/// The setups to run `request` under, the responses to answer with, and the
+/// proxied calls to capture from, for one conformance run.
+#[derive(Debug, Clone, Default)]
+pub struct ConformanceCases {
+    resolve: Vec<ResolveCase>,
+    capture: Vec<CaptureFixture>,
+}
+
+impl ConformanceCases {
+    /// A setup to run `request` under, and the response to answer it with.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `response` does not serialize.
+    #[must_use]
+    pub fn with_resolve_case(
+        self,
+        setup: HarnessSetup,
+        status: StatusCode,
+        response: &serde_json::Value,
+    ) -> Self {
+        let body = serde_json::to_vec(response).expect("should serialize the response body");
+        self.with_resolve_case_raw(setup, status, &[], &body)
+    }
+
+    /// As [`Self::with_resolve_case`], for text, binary or empty replies,
+    /// such as a base64 body or a 204.
+    #[must_use]
+    pub fn with_resolve_case_raw(
+        mut self,
+        setup: HarnessSetup,
+        status: StatusCode,
+        headers: &[(&str, &str)],
+        body: &[u8],
+    ) -> Self {
+        self.resolve.push(ResolveCase {
+            setup,
+            status,
+            headers: headers
+                .iter()
+                .map(|(name, value)| ((*name).to_owned(), (*value).to_owned()))
+                .collect(),
+            body: body.to_vec(),
+        });
+        self
+    }
+
+    /// A proxied call to run `capture` on.
+    #[must_use]
+    pub fn with_capture_case(mut self, fixture: CaptureFixture) -> Self {
+        self.capture.push(fixture);
+        self
+    }
+}
+
+/// The first conformance check a provider failed. Each variant names what
+/// failed and never a value.
+#[derive(Debug, derive_more::Display)]
+#[non_exhaustive]
+pub enum ConformanceFailure {
+    /// A read of something the descriptor does not declare.
+    #[display("the provider read `{access}` without declaring it")]
+    UndeclaredInput {
+        /// What was read.
+        access: Access,
+    },
+    /// A request to a host the descriptor does not declare.
+    #[display("a request went to a host the descriptor does not declare")]
+    UndeclaredHost,
+    /// A request that is not `https`.
+    #[display("a request did not use https")]
+    InsecureScheme,
+    /// A request that sets a `Cookie` header.
+    #[display("a request set a Cookie header")]
+    CookieHeader,
+    /// A request header whose value is not visible ASCII.
+    #[display("a request header value is not valid")]
+    InvalidHeader,
+    /// An entry for a source the descriptor does not declare.
+    #[display("a result holds an entry for undeclared source `{source}`")]
+    UndeclaredSource {
+        /// The source.
+        source: SourceDomain,
+    },
+    /// A fixture result that hits a limit of spec 4.5.
+    #[display("a result for `{source}` hit a limit: {part} was dropped")]
+    LimitHit {
+        /// The source.
+        source: SourceDomain,
+        /// What the limit dropped.
+        part: String,
+    },
+    /// A fixture set over `MAX_ENTRY_SET_BYTES`.
+    #[display("the entry set for `{source}` is over the size limit")]
+    SetTooLarge {
+        /// The source.
+        source: SourceDomain,
+    },
+    /// A capability the descriptor declares and the provider does not
+    /// override.
+    #[display("`{method}` is declared but not implemented")]
+    NotImplemented {
+        /// The missing method.
+        method: &'static str,
+    },
+    /// A provider that declares `resolves` and builds no request in any case.
+    #[display("the provider built no request for any listed setup")]
+    ResolverNeverRequests,
+    /// A provider that declares `captures` and captures nothing in any case.
+    #[display("the provider captured nothing for any listed fixture")]
+    CapturerNeverMatches,
+    /// A provider without `with_private_state()` that returns state.
+    #[display("a provider without private state returned a state change")]
+    StatelessState,
+    /// A capture that returns a state change.
+    #[display("a capture returned a state change")]
+    CaptureStateChange,
+    /// A fixture set of an expiring source without an expiry.
+    #[display("the entry set for expiring source `{source}` carries no expiry")]
+    MissingExpiry {
+        /// The source.
+        source: SourceDomain,
+    },
+    /// A stateful provider that accepts a bare-JSON-string stored state.
+    #[display("the provider accepted a bare-string stored state as valid")]
+    BareStringStateAccepted,
+    /// A returned state that does not round-trip through the state type.
+    #[display("a returned state does not round-trip through the state type")]
+    StateRoundTrip,
+    /// A stateful provider checked without a state type.
+    #[display(
+        "the provider keeps private state: use `check_conformance_with_state` with its state type"
+    )]
+    StatefulNeedsStateType,
+    /// A provider bug that is not one of the checks above.
+    #[display("the provider failed in `{stage}` with a configuration error")]
+    ProviderFailed {
+        /// The failing method.
+        stage: &'static str,
+    },
+}
+
+impl core::error::Error for ConformanceFailure {}
+
+/// Checks that a returned state round-trips through the provider's state type.
+type StateRoundTrip<'a, 'provider> = dyn Fn(&ProviderHarness<'provider>, &str) -> bool + 'a;
+
+/// Drives one provider the way the coordinator does, so a vendor's tests
+/// stay short.
+///
+/// A source with a [`with_stored`](Self::with_stored) record is a `Refresh`,
+/// any other an `Initial`. Sources whose kind needs an input the harness
+/// does not hold are left out, and with none left
+/// [`request`](Self::request) returns `Ok(None)` without calling the
+/// provider. So does a consent the provider's policy refuses.
+pub struct ProviderHarness<'provider> {
+    provider: &'provider dyn IdentityProvider,
+    setup: HarnessSetup,
+    random: SeededRandom,
+    ec_id: Option<String>,
+    last_request: Option<ProviderRequest>,
+    recorded: Vec<Access>,
+    state_decoded: bool,
+}
+
+impl<'provider> ProviderHarness<'provider> {
+    /// A harness for `provider` with no inputs, the clock at 1,760,000,000
+    /// and random seed 1.
+    #[must_use]
+    pub fn new(provider: &'provider dyn IdentityProvider) -> Self {
+        let setup = HarnessSetup::default();
+        Self {
+            provider,
+            random: setup.random(),
+            setup,
+            ec_id: None,
+            last_request: None,
+            recorded: Vec::new(),
+            state_decoded: false,
+        }
+    }
+
+    /// Replaces every input at once, for conformance cases.
+    #[must_use]
+    pub fn with_setup(mut self, setup: HarnessSetup) -> Self {
+        self.random = setup.random();
+        self.setup = setup;
+        self
+    }
+
+    fn map_setup(mut self, change: impl FnOnce(HarnessSetup) -> HarnessSetup) -> Self {
+        self.setup = change(core::mem::take(&mut self.setup));
+        self
+    }
+
+    /// Sets the client IP.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `ip` is not an IP address.
+    #[must_use]
+    pub fn with_client_ip(self, ip: &str) -> Self {
+        self.map_setup(|setup| setup.with_client_ip(ip))
+    }
+
+    /// Sets the `User-Agent`.
+    #[must_use]
+    pub fn with_user_agent(self, user_agent: &str) -> Self {
+        self.map_setup(|setup| setup.with_user_agent(user_agent))
+    }
+
+    /// Sets the page URL.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `url` is not a URL.
+    #[must_use]
+    pub fn with_page_url(self, url: &str) -> Self {
+        self.map_setup(|setup| setup.with_page_url(url))
+    }
+
+    /// Sets the region.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `country` is not a country code.
+    #[must_use]
+    pub fn with_region(self, country: &str, subdivision: Option<&str>) -> Self {
+        self.map_setup(|setup| setup.with_region(country, subdivision))
+    }
+
+    /// Sets the hashed email.
+    #[must_use]
+    pub fn with_hashed_email(self, email: HashedEmail) -> Self {
+        self.map_setup(|setup| setup.with_hashed_email(email))
+    }
+
+    /// Sets the raw consent strings. Default: GDPR does not apply and no
+    /// opt-outs.
+    #[must_use]
+    pub fn with_consent(self, consent: TestConsent) -> Self {
+        self.map_setup(|setup| setup.with_consent(consent))
+    }
+
+    /// Gives the provider a stored record, valid or expired. Its source is
+    /// the one its first entry names, or the provider's primary source.
+    #[must_use]
+    pub fn with_stored(self, stored: StoredId) -> Self {
+        self.map_setup(|setup| setup.with_stored(stored))
+    }
+
+    /// Gives the provider its private state, as stored.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `state` does not serialize.
+    #[must_use]
+    pub fn with_state(self, state: &impl Serialize) -> Self {
+        self.map_setup(|setup| setup.with_state(state))
+    }
+
+    /// Sets the fixed clock.
+    #[must_use]
+    pub fn with_now(self, now: UnixTime) -> Self {
+        self.map_setup(|setup| setup.with_now(now))
+    }
+
+    /// Reseeds the random source.
+    #[must_use]
+    pub fn with_random_seed(mut self, seed: u64) -> Self {
+        self.setup = core::mem::take(&mut self.setup).with_random_seed(seed);
+        self.random = self.setup.random();
+        self
+    }
+
+    /// Gives the provider the EC ID. Only generic pull reads it.
+    #[must_use]
+    pub(crate) fn with_ec_id(mut self, ec_id: &str) -> Self {
+        self.ec_id = Some(ec_id.to_owned());
+        self
+    }
+
+    /// Calls `request` and keeps the built request and its call context.
+    ///
+    /// # Errors
+    ///
+    /// Returns what the provider returns.
+    pub fn request(&mut self) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let kinds = self.kinds();
+        let (result, recorded, decoded) = if kinds.is_empty() || !self.consent_allows() {
+            (Ok(None), Vec::new(), false)
+        } else {
+            self.call(kinds, |input| self.provider.request(input))
+        };
+        self.recorded.extend(recorded);
+        self.state_decoded |= decoded;
+        let request = result?;
+        self.last_request.clone_from(&request);
+        Ok(request)
+    }
+
+    /// Decodes the last built request's JSON body.
+    ///
+    /// # Panics
+    ///
+    /// Panics when no request was built or its body is not a `T`.
+    #[must_use]
+    pub fn request_json<T: DeserializeOwned>(&self) -> T {
+        let request = self
+            .last_request
+            .as_ref()
+            .expect("should have built a request");
+        serde_json::from_slice(request.body()).expect("should decode the request body")
+    }
+
+    /// Calls `response` with the kept call context.
+    ///
+    /// # Errors
+    ///
+    /// Returns what the provider returns.
+    ///
+    /// # Panics
+    ///
+    /// Panics when `body` does not serialize.
+    pub fn respond(
+        &mut self,
+        status: StatusCode,
+        body: &serde_json::Value,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let bytes = serde_json::to_vec(body).expect("should serialize the response body");
+        self.respond_raw(status, &[], &bytes)
+    }
+
+    /// Calls `response` with `headers` and a raw `body`, such as an empty 204.
+    ///
+    /// # Errors
+    ///
+    /// Returns what the provider returns.
+    ///
+    /// # Panics
+    ///
+    /// Panics when a header is not valid.
+    pub fn respond_raw(
+        &mut self,
+        status: StatusCode,
+        headers: &[(&str, &str)],
+        body: &[u8],
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let mut header_map = HeaderMap::new();
+        for (name, value) in headers {
+            header_map.insert(
+                HeaderName::from_bytes(name.as_bytes()).expect("should be a header name"),
+                HeaderValue::from_str(value).expect("should be a header value"),
+            );
+        }
+        let call_context = self
+            .last_request
+            .as_ref()
+            .and_then(|request| request.call_context_json().map(str::to_owned));
+        let response = ProviderResponse::new(status, header_map, body.to_vec(), call_context);
+        let (result, recorded, decoded) = self.call(self.kinds(), |input| {
+            self.provider.response(&response, input)
+        });
+        self.recorded.extend(recorded);
+        self.state_decoded |= decoded;
+        result
+    }
+
+    /// Runs a capture as the coordinator does: the fixture's response is
+    /// already decoded. A call no capture rule matches is `no_match`, as
+    /// the coordinator never runs the provider for it.
+    ///
+    /// # Errors
+    ///
+    /// Returns what the provider returns.
+    pub fn capture(
+        &self,
+        fixture: &CaptureFixture,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let descriptor = self.provider.descriptor();
+        if !descriptor
+            .captures()
+            .is_some_and(|captures| captures.matches(&fixture.method, &fixture.path))
+        {
+            return Ok(Resolution::no_match());
+        }
+        let response =
+            ProviderResponse::new(fixture.status, HeaderMap::new(), fixture.body.clone(), None);
+        let stored = self.stored_by_source();
+        let consent = ProviderConsent::from_context(&self.setup.consent.context());
+        let input = CaptureInput::new(
+            descriptor,
+            &fixture.path,
+            &response,
+            &stored,
+            &consent,
+            "www.example.com",
+            self.setup.now(),
+        );
+        self.provider.capture(&input)
+    }
+
+    /// Resolves an expiry or refresh against the fixed clock.
+    #[must_use]
+    pub fn resolve(&self, when: When) -> UnixTime {
+        when.resolve(self.setup.now())
+    }
+
+    /// The replacement state in a result, decoded, for assertions.
+    #[must_use]
+    pub fn state_of<T: DeserializeOwned>(&self, resolution: &Resolution) -> Option<T> {
+        match resolution.state_change() {
+            StateChange::Replace(json) => serde_json::from_str(json).ok(),
+            StateChange::Keep | StateChange::Clear => None,
+        }
+    }
+
+    /// The EIDs bidders would see for a result: the section 4.5 rules, then
+    /// the descriptor's provenance default for an entry that sets none of
+    /// `inserter`, `matcher` and `mm` (section 7.1).
+    #[must_use]
+    pub fn output_eids(&self, resolution: &Resolution) -> Vec<Eid> {
+        let sets = entry_sets(resolution.eids(), self.setup.now());
+        let mut order: Vec<&SourceDomain> = Vec::new();
+        for eid in resolution.eids() {
+            if !order.contains(&eid.source()) {
+                order.push(eid.source());
+            }
+        }
+        let descriptor = self.provider.descriptor();
+        let mut output = Vec::new();
+        for source in order {
+            let Some(set) = sets.sets.get(source) else {
+                continue;
+            };
+            for entry in &set.entries {
+                let mut eid = Eid {
+                    source: source.as_str().to_owned(),
+                    uids: entry
+                        .uids
+                        .iter()
+                        .map(|uid| Uid {
+                            id: uid.id.clone(),
+                            atype: uid.atype,
+                            ext: uid.ext.clone(),
+                        })
+                        .collect(),
+                    inserter: entry.inserter.clone(),
+                    matcher: entry.matcher.clone(),
+                    mm: entry.mm,
+                    ext: entry.ext.clone(),
+                };
+                if let Some(default) = descriptor.provenance(source)
+                    && eid.inserter.is_none()
+                    && eid.matcher.is_none()
+                    && eid.mm.is_none()
+                {
+                    eid.inserter = default.inserter().map(str::to_owned);
+                    eid.matcher = default.matcher().map(str::to_owned);
+                    eid.mm = default.mm();
+                }
+                output.push(eid);
+            }
+        }
+        output
+    }
+
+    /// Runs only the cases passed in, never the harness's own inputs, and
+    /// fails the test on the first failed check. A provider declared
+    /// `with_private_state()` fails here with a pointer to
+    /// [`check_conformance_with_state`](Self::check_conformance_with_state).
+    ///
+    /// # Panics
+    ///
+    /// Panics when the provider does not conform.
+    pub fn check_conformance(&self, cases: &ConformanceCases) {
+        self.try_check_conformance(cases)
+            .expect("should conform: the provider failed a conformance check");
+    }
+
+    /// As [`check_conformance`](Self::check_conformance), for a provider with
+    /// private state of type `S`. Also checks that `S` round-trips through
+    /// `replacing_state` and `input.state()`.
+    ///
+    /// # Panics
+    ///
+    /// Panics when the provider does not conform.
+    pub fn check_conformance_with_state<S: Serialize + DeserializeOwned>(
+        &self,
+        cases: &ConformanceCases,
+    ) {
+        self.try_check_conformance_with_state::<S>(cases)
+            .expect("should conform: the provider failed a conformance check");
+    }
+
+    /// The same checks as [`check_conformance`](Self::check_conformance),
+    /// returning the first failure instead of failing the test. A panic
+    /// aborts a `wasm32-wasip1` test run, so the harness's own negative
+    /// tests use this.
+    ///
+    /// # Errors
+    ///
+    /// The first failed check.
+    pub fn try_check_conformance(
+        &self,
+        cases: &ConformanceCases,
+    ) -> Result<(), Report<ConformanceFailure>> {
+        self.conform(cases, None)
+    }
+
+    /// As [`try_check_conformance`](Self::try_check_conformance), for a
+    /// provider with private state of type `S`.
+    ///
+    /// # Errors
+    ///
+    /// The first failed check.
+    pub fn try_check_conformance_with_state<S: Serialize + DeserializeOwned>(
+        &self,
+        cases: &ConformanceCases,
+    ) -> Result<(), Report<ConformanceFailure>> {
+        self.conform(
+            cases,
+            Some(&|harness, json| harness.state_round_trips::<S>(json)),
+        )
+    }
+
+    fn conform(
+        &self,
+        cases: &ConformanceCases,
+        round_trip: Option<&StateRoundTrip<'_, 'provider>>,
+    ) -> Result<(), Report<ConformanceFailure>> {
+        let descriptor = self.provider.descriptor();
+        let stateful = descriptor
+            .resolves()
+            .is_some_and(Resolves::has_private_state);
+        if stateful && round_trip.is_none() {
+            return Err(Report::new(ConformanceFailure::StatefulNeedsStateType));
+        }
+
+        let mut requested = false;
+        for case in &cases.resolve {
+            let mut harness = Self::new(self.provider).with_setup(case.setup.clone());
+            let request = harness.request();
+            harness.check_recorded()?;
+            let request = match request {
+                Ok(Some(request)) => request,
+                Ok(None) => continue,
+                Err(error) => {
+                    classify(error.current_context(), "request")?;
+                    continue;
+                }
+            };
+            requested = true;
+            check_request(descriptor, &request)?;
+            let headers: Vec<(&str, &str)> = case
+                .headers
+                .iter()
+                .map(|(name, value)| (name.as_str(), value.as_str()))
+                .collect();
+            let resolution = harness.respond_raw(case.status, &headers, &case.body);
+            harness.check_recorded()?;
+            match resolution {
+                Ok(resolution) => {
+                    if !stateful && resolution.changes_state() {
+                        return Err(Report::new(ConformanceFailure::StatelessState));
+                    }
+                    self.check_resolution(&resolution)?;
+                    if let (StateChange::Replace(json), Some(round_trip)) =
+                        (resolution.state_change(), round_trip)
+                        && !round_trip(&harness, json)
+                    {
+                        return Err(Report::new(ConformanceFailure::StateRoundTrip));
+                    }
+                }
+                Err(error) => classify(error.current_context(), "response")?,
+            }
+            if stateful {
+                self.check_bare_string_state(case)?;
+            }
+        }
+        if descriptor.resolves().is_some() && !requested {
+            return Err(Report::new(ConformanceFailure::ResolverNeverRequests));
+        }
+
+        let mut captured = false;
+        for fixture in &cases.capture {
+            match self.capture(fixture) {
+                Ok(resolution) => {
+                    if resolution.changes_state() {
+                        return Err(Report::new(ConformanceFailure::CaptureStateChange));
+                    }
+                    self.check_resolution(&resolution)?;
+                    captured |= !resolution.is_no_match();
+                }
+                Err(error) => classify(error.current_context(), "capture")?,
+            }
+        }
+        if descriptor.captures().is_some() && !captured {
+            return Err(Report::new(ConformanceFailure::CapturerNeverMatches));
+        }
+        Ok(())
+    }
+
+    fn check_recorded(&self) -> Result<(), Report<ConformanceFailure>> {
+        match self.recorded.first() {
+            Some(access) => Err(Report::new(ConformanceFailure::UndeclaredInput {
+                access: *access,
+            })),
+            None => Ok(()),
+        }
+    }
+
+    fn check_resolution(&self, resolution: &Resolution) -> Result<(), Report<ConformanceFailure>> {
+        let descriptor = self.provider.descriptor();
+        for eid in resolution.eids() {
+            if !descriptor.sources().contains(eid.source()) {
+                return Err(Report::new(ConformanceFailure::UndeclaredSource {
+                    source: eid.source().clone(),
+                }));
+            }
+        }
+        let sets = entry_sets(resolution.eids(), self.setup.now());
+        if let Some(dropped) = sets.drops.first() {
+            return Err(Report::new(ConformanceFailure::LimitHit {
+                source: dropped.source.clone(),
+                part: dropped.part.to_string(),
+            }));
+        }
+        if let Some(source) = sets.oversized.first() {
+            return Err(Report::new(ConformanceFailure::SetTooLarge {
+                source: source.clone(),
+            }));
+        }
+        for (source, set) in &sets.sets {
+            if descriptor.is_expiring(source) && set.expires_at.is_none() {
+                return Err(Report::new(ConformanceFailure::MissingExpiry {
+                    source: source.clone(),
+                }));
+            }
+        }
+        Ok(())
+    }
+
+    /// Injects a stored state that is a bare JSON string, which no struct
+    /// decodes, and fails when the provider decodes it as valid state.
+    fn check_bare_string_state(
+        &self,
+        case: &ResolveCase,
+    ) -> Result<(), Report<ConformanceFailure>> {
+        let mut setup = case.setup.clone();
+        setup.state_json = Some("\"bare\"".to_owned());
+        let mut probe = Self::new(self.provider).with_setup(setup);
+        if matches!(probe.request(), Ok(Some(_))) {
+            let _ignored = probe.respond_raw(case.status, &[], &case.body);
+        }
+        if probe.state_decoded {
+            return Err(Report::new(ConformanceFailure::BareStringStateAccepted));
+        }
+        Ok(())
+    }
+
+    /// Whether `json` decodes as `S`, serializes back to the same value and
+    /// decodes again through `input.state()`.
+    fn state_round_trips<S: Serialize + DeserializeOwned>(&self, json: &str) -> bool {
+        let Ok(state) = serde_json::from_str::<S>(json) else {
+            return false;
+        };
+        let Ok(again) = serde_json::to_string(&state) else {
+            return false;
+        };
+        let same = serde_json::from_str::<serde_json::Value>(json).ok()
+            == serde_json::from_str::<serde_json::Value>(&again).ok();
+        let mut setup = self.setup.clone();
+        setup.state_json = Some(again);
+        let probe = Self::new(self.provider).with_setup(setup);
+        #[allow(
+            clippy::redundant_closure_for_method_calls,
+            reason = "the method reference does not satisfy the higher-ranked closure bound"
+        )]
+        let (decoded, _, _) =
+            probe.call(probe.kinds(), |input: &ResolveInput<'_>| input.state::<S>());
+        same && matches!(decoded, Ok(Some(_)))
+    }
+
+    fn call<R>(
+        &self,
+        kinds: BTreeMap<SourceDomain, ResolveKind>,
+        run: impl FnOnce(&ResolveInput<'_>) -> R,
+    ) -> (R, Vec<Access>, bool) {
+        let signals = self.signals();
+        let input = ResolveInput::new(self.provider.descriptor(), kinds, &signals)
+            .with_state_json(self.setup.state_json.clone());
+        let result = run(&input);
+        (result, input.recorded_errors(), input.state_was_decoded())
+    }
+
+    fn consent_allows(&self) -> bool {
+        policy_allows(
+            self.provider.descriptor().consent_policy(),
+            &self.setup.consent.context(),
+            PolicySignals {
+                dnt: self.setup.consent.dnt,
+            },
+        )
+    }
+
+    fn stored_by_source(&self) -> BTreeMap<SourceDomain, StoredId> {
+        self.setup
+            .stored
+            .iter()
+            .map(|stored| {
+                let source = stored
+                    .eids()
+                    .first()
+                    .and_then(|eid| eid.source.parse().ok())
+                    .unwrap_or_else(|| self.provider.descriptor().primary_source().clone());
+                (source, stored.clone())
+            })
+            .collect()
+    }
+
+    fn available_inputs(&self) -> BTreeSet<Input> {
+        let mut available = BTreeSet::new();
+        for (input, present) in [
+            (Input::ClientIp, self.setup.client_ip.is_some()),
+            (Input::UserAgent, self.setup.user_agent.is_some()),
+            (Input::PageUrl, self.setup.page_url.is_some()),
+            (Input::Region, self.setup.region.is_some()),
+            (Input::HashedEmail, self.setup.hashed_email.is_some()),
+        ] {
+            if present {
+                available.insert(input);
+            }
+        }
+        available
+    }
+
+    fn kinds(&self) -> BTreeMap<SourceDomain, ResolveKind> {
+        let descriptor = self.provider.descriptor();
+        let Some(resolves) = descriptor.resolves() else {
+            return BTreeMap::new();
+        };
+        let available = self.available_inputs();
+        let stored = self.stored_by_source();
+        descriptor
+            .sources()
+            .iter()
+            .filter_map(|source| {
+                let kind = if stored.contains_key(source) {
+                    ResolveKind::Refresh
+                } else {
+                    ResolveKind::Initial
+                };
+                (resolves.kinds().contains(&kind) && resolves.needs(kind).is_subset(&available))
+                    .then(|| (source.clone(), kind))
+            })
+            .collect()
+    }
+
+    fn signals(&self) -> ResolveSignals<'_> {
+        ResolveSignals {
+            client_ip: self.setup.client_ip,
+            user_agent: self.setup.user_agent.as_deref(),
+            page_url: self.setup.page_url.clone(),
+            region: self.setup.region.clone(),
+            hashed_email: self.setup.hashed_email.clone(),
+            consent: ProviderConsent::from_context(&self.setup.consent.context()),
+            publisher_domain: "www.example.com",
+            now: self.setup.now(),
+            random: &self.random,
+            ec_id: self.ec_id.clone(),
+            stored: self.stored_by_source(),
+        }
+    }
+}
+
+/// Maps a provider error to the conformance check it breaks. Failures the
+/// coordinator treats as a vendor outcome, such as a refusal or a body that
+/// does not parse, are not bugs.
+fn classify(
+    error: &IdentityProviderError,
+    stage: &'static str,
+) -> Result<(), Report<ConformanceFailure>> {
+    match error {
+        IdentityProviderError::UndeclaredInput { access } => {
+            Err(Report::new(ConformanceFailure::UndeclaredInput {
+                access: *access,
+            }))
+        }
+        error if error.is_not_implemented() => {
+            Err(Report::new(ConformanceFailure::NotImplemented {
+                method: stage,
+            }))
+        }
+        IdentityProviderError::Config { .. } => {
+            Err(Report::new(ConformanceFailure::ProviderFailed { stage }))
+        }
+        _ => Ok(()),
+    }
+}
+
+/// The request rules of the coordinator, each as its own failure.
+fn check_request(
+    descriptor: &ProviderDescriptor,
+    request: &ProviderRequest,
+) -> Result<(), Report<ConformanceFailure>> {
+    if request.url().scheme() != "https" {
+        return Err(Report::new(ConformanceFailure::InsecureScheme));
+    }
+    let host = request.url().host_str().unwrap_or_default();
+    let declared = descriptor.resolves().is_some_and(|resolves| {
+        resolves
+            .hosts()
+            .iter()
+            .any(|allowed| allowed.eq_ignore_ascii_case(host))
+    });
+    if !declared {
+        return Err(Report::new(ConformanceFailure::UndeclaredHost));
+    }
+    if request.has_cookie_header() {
+        return Err(Report::new(ConformanceFailure::CookieHeader));
+    }
+    if request
+        .headers()
+        .values()
+        .any(|value| value.to_str().is_err())
+    {
+        return Err(Report::new(ConformanceFailure::InvalidHeader));
+    }
+    Ok(())
+}
+
+/// Builds the descriptor from a config with placeholder secret names and
+/// from one with resolved secrets, and fails the test when the two differ
+/// (spec 10.2).
+///
+/// # Panics
+///
+/// Panics when either config cannot describe a provider, or when the
+/// descriptors differ.
+pub fn check_descriptor_ignores_secrets<C: IdentityProviderConfig>(placeholder: &C, resolved: &C) {
+    let from_placeholder = placeholder
+        .build_descriptor()
+        .expect("should build the descriptor from the placeholder config");
+    let from_resolved = resolved
+        .build_descriptor()
+        .expect("should build the descriptor from the resolved config");
+    assert_eq!(
+        from_placeholder, from_resolved,
+        "should build the same descriptor whatever the secrets"
+    );
+}
+
+struct DescriptorOnly(ProviderDescriptor);
+
+impl IdentityProvider for DescriptorOnly {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.0
+    }
+}
+
+/// An in-memory [`RateLimiter`] that can be set to fail each method.
+///
+/// `exceeded` counts like the Fastly limiter: it increments on every check
+/// under the limit. `record` and `count` use the same counts.
+#[derive(Debug, Default)]
+pub struct FakeRateLimiter {
+    counts: Mutex<HashMap<String, u32>>,
+    fail_exceeded: AtomicBool,
+    fail_record: AtomicBool,
+    fail_count: AtomicBool,
+}
+
+#[allow(clippy::missing_panics_doc, reason = "the fake locks its own mutex")]
+impl FakeRateLimiter {
+    /// An empty limiter whose methods all succeed.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Makes `exceeded` and `exceeded_per_minute` fail.
+    #[must_use]
+    pub fn failing_exceeded(self) -> Self {
+        self.fail_exceeded.store(true, Ordering::SeqCst);
+        self
+    }
+
+    /// Makes `record` fail.
+    #[must_use]
+    pub fn failing_record(self) -> Self {
+        self.fail_record.store(true, Ordering::SeqCst);
+        self
+    }
+
+    /// Makes `count` fail.
+    #[must_use]
+    pub fn failing_count(self) -> Self {
+        self.fail_count.store(true, Ordering::SeqCst);
+        self
+    }
+
+    /// Sets the count of `key`.
+    #[must_use]
+    pub fn with_count(self, key: &str, count: u32) -> Self {
+        self.counts
+            .lock()
+            .expect("should lock the counts")
+            .insert(key.to_owned(), count);
+        self
+    }
+
+    /// The count of `key`, 0 when it was never touched.
+    #[must_use]
+    pub fn count_of(&self, key: &str) -> u32 {
+        self.counts
+            .lock()
+            .expect("should lock the counts")
+            .get(key)
+            .copied()
+            .unwrap_or(0)
+    }
+
+    /// Every key with a count, sorted.
+    #[must_use]
+    pub fn keys(&self) -> Vec<String> {
+        let mut keys: Vec<String> = self
+            .counts
+            .lock()
+            .expect("should lock the counts")
+            .keys()
+            .cloned()
+            .collect();
+        keys.sort();
+        keys
+    }
+
+    fn unavailable() -> Report<TrustedServerError> {
+        Report::new(TrustedServerError::Proxy {
+            message: "limiter unavailable".to_owned(),
+        })
+    }
+}
+
+impl RateLimiter for FakeRateLimiter {
+    fn exceeded(&self, key: &str, hourly_limit: u32) -> Result<bool, Report<TrustedServerError>> {
+        if self.fail_exceeded.load(Ordering::SeqCst) {
+            return Err(Self::unavailable());
+        }
+        let limit = hourly_limit.div_ceil(60);
+        let mut counts = self.counts.lock().expect("should lock the counts");
+        let current = counts.entry(key.to_owned()).or_insert(0);
+        if *current >= limit {
+            return Ok(true);
+        }
+        *current += 1;
+        Ok(false)
+    }
+
+    fn record(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+        if self.fail_record.load(Ordering::SeqCst) {
+            return Err(Self::unavailable());
+        }
+        *self
+            .counts
+            .lock()
+            .expect("should lock the counts")
+            .entry(key.to_owned())
+            .or_insert(0) += 1;
+        Ok(())
+    }
+
+    fn count(&self, key: &str) -> Result<u32, Report<TrustedServerError>> {
+        if self.fail_count.load(Ordering::SeqCst) {
+            return Err(Self::unavailable());
+        }
+        Ok(self.count_of(key))
+    }
+}
+
+/// A fake HTTP client, backend and provider for dispatch tests.
+#[cfg(any(test, feature = "test-utils"))]
+#[allow(
+    clippy::missing_panics_doc,
+    clippy::new_without_default,
+    reason = "test doubles lock their own mutexes and are built with new"
+)]
+pub mod fake_http {
+    use std::collections::BTreeMap;
+    use std::sync::{Arc, Mutex};
+    use std::time::Duration;
+
+    use error_stack::Report;
+
+    use crate::ec::identity::descriptor::EidProvenance;
+    use crate::ec::identity::descriptor::{ConsentPolicy, ProviderDescriptor, Resolves};
+    use crate::ec::identity::exchange::{ProviderRequest, ProviderResponse};
+    use crate::ec::identity::ids::SourceDomain;
+    use crate::ec::identity::input::ResolveInput;
+    use crate::ec::identity::provider::IdentityProvider;
+    use crate::ec::identity::resolution::{
+        IdentityProviderError, Resolution, ResolvedEid, ResolvedUid,
+    };
+    #[cfg(test)]
+    use crate::platform::test_support::{NoopConfigStore, NoopGeo, NoopSecretStore};
+    use crate::platform::{
+        BackendNamingPolicy, PlatformBackend, PlatformBackendSpec, PlatformError,
+        PlatformHttpClient, PlatformHttpRequest, PlatformPendingRequest, PlatformResponse,
+        PlatformSelectResult,
+    };
+    #[cfg(test)]
+    use crate::platform::{ClientInfo, RuntimeServices};
+    use serde_json::json;
+
+    /// What the fake does for one host.
+    #[derive(Clone)]
+    enum Route {
+        Respond {
+            status: u16,
+            headers: Vec<(String, String)>,
+            body: Vec<u8>,
+        },
+        Fail,
+    }
+
+    struct FakePending {
+        host: String,
+        route: Route,
+        delay: Duration,
+        /// The first-byte timeout the request's backend was registered with.
+        timeout: Option<Duration>,
+    }
+
+    /// An HTTP client that answers per host, and records what it was sent.
+    pub struct FakeHttpClient {
+        routes: Mutex<BTreeMap<String, Route>>,
+        delays: Mutex<BTreeMap<String, Duration>>,
+        sent: Mutex<Vec<String>>,
+        uris: Mutex<Vec<String>>,
+        backend: Mutex<Option<Arc<FakeBackend>>>,
+        earlier: Mutex<usize>,
+    }
+
+    impl FakeHttpClient {
+        /// A client with no routes.
+        #[must_use]
+        pub fn new() -> Self {
+            Self {
+                routes: Mutex::new(BTreeMap::new()),
+                delays: Mutex::new(BTreeMap::new()),
+                sent: Mutex::new(Vec::new()),
+                uris: Mutex::new(Vec::new()),
+                backend: Mutex::new(None),
+                earlier: Mutex::new(0),
+            }
+        }
+
+        /// Counts `count` backend requests as started before any provider
+        /// call, as the origin or the auction would.
+        pub fn started_earlier(&self, count: usize) {
+            *self.earlier.lock().expect("should lock the earlier count") = count;
+        }
+
+        /// Makes a wait that outlasts the first-byte timeout `backend` last
+        /// registered for the host fail once that timeout has passed, as a
+        /// real backend does.
+        pub fn honour_timeouts_of(&self, backend: &Arc<FakeBackend>) {
+            *self.backend.lock().expect("should lock the backend") = Some(Arc::clone(backend));
+        }
+
+        /// Answers `host` with `status` and `body`.
+        pub fn respond(&self, host: &str, status: u16, body: &[u8]) {
+            self.respond_with_headers(host, status, body, &[]);
+        }
+
+        /// Answers `host` with `status`, `headers` and `body`.
+        pub fn respond_with_headers(
+            &self,
+            host: &str,
+            status: u16,
+            body: &[u8],
+            headers: &[(&str, &str)],
+        ) {
+            let route = Route::Respond {
+                status,
+                headers: headers
+                    .iter()
+                    .map(|(name, value)| ((*name).to_owned(), (*value).to_owned()))
+                    .collect(),
+                body: body.to_vec(),
+            };
+            self.routes
+                .lock()
+                .expect("should lock the routes")
+                .insert(host.to_owned(), route);
+        }
+
+        /// Makes the wait for `host` fail, as a first-byte timeout does.
+        pub fn time_out(&self, host: &str) {
+            self.routes
+                .lock()
+                .expect("should lock the routes")
+                .insert(host.to_owned(), Route::Fail);
+        }
+
+        /// Makes the wait for `host` take `delay` of wall-clock time.
+        pub fn delay(&self, host: &str, delay: Duration) {
+            self.delays
+                .lock()
+                .expect("should lock the delays")
+                .insert(host.to_owned(), delay);
+        }
+
+        /// The URIs requests were sent to, in order.
+        pub fn sent_uris(&self) -> Vec<String> {
+            self.uris.lock().expect("should lock the sent URIs").clone()
+        }
+
+        /// The hosts requests were sent to, in order.
+        pub fn sent_hosts(&self) -> Vec<String> {
+            self.sent
+                .lock()
+                .expect("should lock the sent hosts")
+                .clone()
+        }
+    }
+
+    #[async_trait::async_trait(?Send)]
+    impl PlatformHttpClient for FakeHttpClient {
+        fn requests_started(&self) -> Option<usize> {
+            let earlier = *self.earlier.lock().expect("should lock the earlier count");
+            Some(earlier + self.sent.lock().expect("should lock the sent hosts").len())
+        }
+
+        async fn send(
+            &self,
+            _request: PlatformHttpRequest,
+        ) -> Result<PlatformResponse, Report<PlatformError>> {
+            Err(Report::new(PlatformError::Unsupported))
+        }
+
+        async fn send_async(
+            &self,
+            request: PlatformHttpRequest,
+        ) -> Result<PlatformPendingRequest, Report<PlatformError>> {
+            let host = request.request.uri().host().unwrap_or_default().to_owned();
+            self.sent
+                .lock()
+                .expect("should lock the sent hosts")
+                .push(host.clone());
+            self.uris
+                .lock()
+                .expect("should lock the sent URIs")
+                .push(request.request.uri().to_string());
+            let route = self
+                .routes
+                .lock()
+                .expect("should lock the routes")
+                .get(&host)
+                .cloned()
+                .ok_or_else(|| Report::new(PlatformError::HttpClient))?;
+            let delay = self
+                .delays
+                .lock()
+                .expect("should lock the delays")
+                .get(&host)
+                .copied()
+                .unwrap_or_default();
+            let timeout = self
+                .backend
+                .lock()
+                .expect("should lock the backend")
+                .as_ref()
+                .and_then(|backend| backend.last_first_byte_timeout(&host));
+            Ok(PlatformPendingRequest::new(FakePending {
+                host,
+                route,
+                delay,
+                timeout,
+            }))
+        }
+
+        async fn select(
+            &self,
+            mut pending_requests: Vec<PlatformPendingRequest>,
+        ) -> Result<PlatformSelectResult, Report<PlatformError>> {
+            if pending_requests.is_empty() {
+                return Err(Report::new(PlatformError::HttpClient));
+            }
+            let first = pending_requests.remove(0);
+            let ready = self.wait(first).await;
+            Ok(PlatformSelectResult {
+                ready,
+                remaining: pending_requests,
+                failed_backend_name: None,
+            })
+        }
+
+        async fn wait(
+            &self,
+            pending: PlatformPendingRequest,
+        ) -> Result<PlatformResponse, Report<PlatformError>> {
+            let pending = pending
+                .downcast::<FakePending>()
+                .map_err(|_| Report::new(PlatformError::HttpClient))?;
+            if let Some(timeout) = pending.timeout
+                && pending.delay > timeout
+            {
+                std::thread::sleep(timeout);
+                return Err(Report::new(PlatformError::HttpClient));
+            }
+            if !pending.delay.is_zero() {
+                std::thread::sleep(pending.delay);
+            }
+            match pending.route {
+                Route::Fail => Err(Report::new(PlatformError::HttpClient)),
+                Route::Respond {
+                    status,
+                    headers,
+                    body,
+                } => {
+                    let mut builder = edgezero_core::http::response_builder().status(status);
+                    for (name, value) in headers {
+                        builder = builder.header(name, value);
+                    }
+                    let response = builder
+                        .body(edgezero_core::body::Body::from(body))
+                        .map_err(|_| Report::new(PlatformError::HttpClient))?;
+                    Ok(PlatformResponse::new(response).with_backend_name(pending.host))
+                }
+            }
+        }
+    }
+
+    /// A backend named after its host, that records each spec it is given.
+    pub struct FakeBackend {
+        specs: Mutex<Vec<PlatformBackendSpec>>,
+    }
+
+    impl FakeBackend {
+        /// A backend that has registered nothing.
+        #[must_use]
+        pub fn new() -> Self {
+            Self {
+                specs: Mutex::new(Vec::new()),
+            }
+        }
+
+        /// The first-byte timeout `host` was last registered with.
+        fn last_first_byte_timeout(&self, host: &str) -> Option<Duration> {
+            self.specs
+                .lock()
+                .expect("should lock the specs")
+                .iter()
+                .rev()
+                .find(|spec| spec.host == host)
+                .map(|spec| spec.first_byte_timeout)
+        }
+
+        /// The connect timeouts the backends were registered with, in order.
+        pub fn connect_timeouts(&self) -> Vec<Option<Duration>> {
+            self.specs
+                .lock()
+                .expect("should lock the specs")
+                .iter()
+                .map(|spec| spec.connect_timeout)
+                .collect()
+        }
+
+        /// The first-byte timeouts the backends were registered with, in order.
+        pub fn first_byte_timeouts(&self) -> Vec<Duration> {
+            self.specs
+                .lock()
+                .expect("should lock the specs")
+                .iter()
+                .map(|spec| spec.first_byte_timeout)
+                .collect()
+        }
+    }
+
+    impl PlatformBackend for FakeBackend {
+        fn naming_policy(&self) -> BackendNamingPolicy {
+            BackendNamingPolicy::Axum
+        }
+
+        fn predict_name(
+            &self,
+            spec: &PlatformBackendSpec,
+        ) -> Result<String, Report<PlatformError>> {
+            Ok(spec.host.clone())
+        }
+
+        fn ensure(&self, spec: &PlatformBackendSpec) -> Result<String, Report<PlatformError>> {
+            self.specs
+                .lock()
+                .expect("should lock the specs")
+                .push(spec.clone());
+            Ok(spec.host.clone())
+        }
+    }
+
+    /// Services that send through `client` and register backends in `backend`.
+    #[cfg(test)]
+    pub(crate) fn fake_services(
+        client: &Arc<FakeHttpClient>,
+        backend: &Arc<FakeBackend>,
+    ) -> RuntimeServices {
+        fake_services_from(client, backend, ClientInfo::default())
+    }
+
+    /// [`fake_services`] for a request from `client_info`.
+    #[cfg(test)]
+    pub(crate) fn fake_services_from(
+        client: &Arc<FakeHttpClient>,
+        backend: &Arc<FakeBackend>,
+        client_info: ClientInfo,
+    ) -> RuntimeServices {
+        client.honour_timeouts_of(backend);
+        RuntimeServices::builder()
+            .config_store(Arc::new(NoopConfigStore))
+            .secret_store(Arc::new(NoopSecretStore))
+            .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+            .backend(backend.clone())
+            .http_client(client.clone())
+            .geo(Arc::new(NoopGeo))
+            .client_info(client_info)
+            .build()
+    }
+
+    /// A resolver that calls its endpoint and answers `no_match` to a 2xx.
+    pub(crate) struct ScriptedProvider {
+        descriptor: ProviderDescriptor,
+        reads_user_agent: bool,
+        stateful: bool,
+    }
+
+    impl ScriptedProvider {
+        /// A provider `id` calling `host`, claiming `source`. With `generic`
+        /// it is a generic pull provider.
+        pub(crate) fn new(id: &str, host: &str, source: &str, generic: bool) -> Self {
+            let mut resolves = Resolves::new().with_endpoint(&format!("https://{host}/resolve"));
+            if generic {
+                resolves = resolves.with_ec_id();
+            }
+            let descriptor =
+                ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+                    .with_source(source.parse().expect("should parse the source"))
+                    .with_resolves(resolves)
+                    .with_consent_policy(ConsentPolicy::eid_persistence_only())
+                    .build()
+                    .expect("should build the descriptor");
+            Self {
+                descriptor,
+                reads_user_agent: false,
+                stateful: false,
+            }
+        }
+
+        /// Reads `user_agent()` without declaring it, and ignores the error.
+        pub(crate) fn reading_undeclared_user_agent(mut self) -> Self {
+            self.reads_user_agent = true;
+            self
+        }
+
+        /// Declares private state, and sends what it read in a `state` query.
+        pub(crate) fn stateful(mut self) -> Self {
+            self.stateful = true;
+            self.descriptor = ProviderDescriptor::builder(self.descriptor.id().clone())
+                .with_source(self.descriptor.primary_source().clone())
+                .with_resolves(
+                    Resolves::new()
+                        .with_endpoint(
+                            self.descriptor
+                                .endpoint()
+                                .expect("should have an endpoint")
+                                .as_str(),
+                        )
+                        .with_private_state(),
+                )
+                .with_consent_policy(ConsentPolicy::eid_persistence_only())
+                .build()
+                .expect("should build the descriptor");
+            self
+        }
+
+        pub(crate) fn into_provider(self) -> Arc<dyn IdentityProvider> {
+            Arc::new(self)
+        }
+    }
+
+    impl IdentityProvider for ScriptedProvider {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.descriptor
+        }
+
+        fn request(
+            &self,
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            if self.reads_user_agent {
+                let _ = input.user_agent().ok();
+            }
+            let mut request = ProviderRequest::get(input.endpoint()?);
+            if self.stateful {
+                let state = input.state::<serde_json::Value>()?;
+                request = request.with_query(
+                    "state",
+                    &state.map_or_else(|| "none".to_owned(), |state| state.to_string()),
+                );
+            }
+            Ok(Some(request))
+        }
+
+        fn response(
+            &self,
+            response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            response.success_text().map(|_| Resolution::no_match())
+        }
+    }
+
+    /// A resolver that calls its endpoint and answers as the 2xx JSON body
+    /// says: `{"answer":"found","entries":[{"uids":[{"id":"x","atype":1}],
+    /// "inserter":"example.com"}]}`, `{"answer":"invalidate"}` or anything
+    /// else for `no_match`.
+    pub(crate) struct AnsweringProvider {
+        descriptor: ProviderDescriptor,
+        stateful: bool,
+    }
+
+    impl AnsweringProvider {
+        /// A provider `id` calling `host`, claiming `source`, with `default`
+        /// as its provenance default for the source when given.
+        pub(crate) fn new(
+            id: &str,
+            host: &str,
+            source: &str,
+            default: Option<EidProvenance>,
+        ) -> Self {
+            Self::build(id, host, source, default, false, false)
+        }
+
+        /// As [`Self::new`], declaring private state that a `found` replaces.
+        pub(crate) fn stateful(id: &str, host: &str, source: &str) -> Self {
+            Self::build(id, host, source, None, true, false)
+        }
+
+        /// As [`Self::new`], reading the EC ID, as generic pull does.
+        pub(crate) fn reading_ec_id(id: &str, host: &str, source: &str) -> Self {
+            Self::build(id, host, source, None, false, true)
+        }
+
+        fn build(
+            id: &str,
+            host: &str,
+            source: &str,
+            default: Option<EidProvenance>,
+            stateful: bool,
+            ec_id: bool,
+        ) -> Self {
+            let mut resolves = Resolves::new().with_endpoint(&format!("https://{host}/resolve"));
+            if stateful {
+                resolves = resolves.with_private_state();
+            }
+            if ec_id {
+                resolves = resolves.with_ec_id();
+            }
+            let source: SourceDomain = source.parse().expect("should parse the source");
+            let mut builder =
+                ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+                    .with_source(source.clone())
+                    .with_resolves(resolves)
+                    .with_consent_policy(ConsentPolicy::eid_persistence_only());
+            if let Some(default) = default {
+                builder = builder.with_provenance(&source, default);
+            }
+            Self {
+                descriptor: builder.build().expect("should build the descriptor"),
+                stateful,
+            }
+        }
+
+        pub(crate) fn into_provider(self) -> Arc<dyn IdentityProvider> {
+            Arc::new(self)
+        }
+    }
+
+    impl IdentityProvider for AnsweringProvider {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.descriptor
+        }
+
+        fn request(
+            &self,
+            input: &ResolveInput<'_>,
+        ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+            if self.stateful {
+                input.state::<serde_json::Value>()?;
+            }
+            Ok(Some(ProviderRequest::get(input.endpoint()?)))
+        }
+
+        fn response(
+            &self,
+            response: &ProviderResponse,
+            _input: &ResolveInput<'_>,
+        ) -> Result<Resolution, Report<IdentityProviderError>> {
+            let body: serde_json::Value = response.success_json()?;
+            let source = self.descriptor.primary_source();
+            match body["answer"].as_str() {
+                Some("found") => {
+                    let eids = body["entries"]
+                        .as_array()
+                        .map(Vec::as_slice)
+                        .unwrap_or_default()
+                        .iter()
+                        .map(|entry| {
+                            let mut uids =
+                                entry["uids"].as_array().into_iter().flatten().map(|uid| {
+                                    let mut resolved = ResolvedUid::new(
+                                        uid["id"].as_str().expect("should have a UID"),
+                                    );
+                                    if let Some(atype) = uid["atype"].as_i64() {
+                                        resolved = resolved.with_atype(
+                                            i32::try_from(atype).expect("should fit an atype"),
+                                        );
+                                    }
+                                    resolved
+                                });
+                            let mut eid = ResolvedEid::new(
+                                source,
+                                uids.next().expect("should have a first UID"),
+                            );
+                            for uid in uids {
+                                eid = eid.with_uid(uid);
+                            }
+                            if let Some(inserter) = entry["inserter"].as_str() {
+                                eid = eid.with_inserter(inserter);
+                            }
+                            eid
+                        });
+                    let mut resolution = Resolution::found(eids);
+                    if self.stateful {
+                        resolution = resolution.replacing_state(&json!({ "seen": true }));
+                    }
+                    Ok(resolution)
+                }
+                Some("invalidate") => Ok(Resolution::invalidate(source)),
+                _ => Ok(Resolution::no_match()),
+            }
+        }
+    }
+}
+
+/// A returning writer navigation with a live row, hold-mode providers and a
+/// fake client, for the tests of hold dispatch and the flush that follows.
+#[cfg(test)]
+pub(crate) mod hold_fixture {
+    use std::collections::BTreeMap;
+    use std::sync::Arc;
+
+    use http::StatusCode;
+
+    use super::fake_http::{FakeBackend, FakeHttpClient, fake_services};
+    use super::{FakeRateLimiter, TEST_EC_ID, WriteCountingEcKv, allowing_consent};
+    use crate::ec::EcContext;
+    use crate::ec::finalize::BrowserSeed;
+    use crate::ec::identity::coordinator::{HoldResults, run_hold};
+    use crate::ec::identity::flush::{AfterSendInput, FlushOutcome, run_after_send};
+    use crate::ec::identity::ids::{IdentityProviderId, SourceDomain};
+    use crate::ec::identity::input::ThreadRandom;
+    use crate::ec::identity::provider::IdentityProvider;
+    use crate::ec::identity::request::WriterDecision;
+    use crate::ec::identity::runtime::IdentityRuntime;
+    use crate::ec::kv::KvIdentityGraph;
+    use crate::ec::kv_types::KvEntry;
+    use crate::platform::RuntimeServices;
+    use crate::settings::{ProviderMode, ProviderSettings, Settings};
+    use crate::test_support::tests::create_test_settings;
+
+    /// A live, consenting row sized for the flush, with no IDs.
+    pub(crate) fn live_row() -> KvEntry {
+        let mut entry = KvEntry::new(&allowing_consent(), None, 1_000, "test-publisher.com");
+        entry.network = Some(crate::ec::kv_types::KvNetwork {
+            cluster_size: Some(1),
+        });
+        entry
+    }
+
+    /// Everything one hold navigation reads.
+    pub(crate) struct HoldFixture {
+        pub(crate) settings: Settings,
+        pub(crate) runtime: Arc<IdentityRuntime>,
+        pub(crate) client: Arc<FakeHttpClient>,
+        pub(crate) backend: Arc<FakeBackend>,
+        pub(crate) services: RuntimeServices,
+        pub(crate) graph: KvIdentityGraph,
+        pub(crate) store: Arc<WriteCountingEcKv>,
+        pub(crate) context: EcContext,
+        pub(crate) limiter: Arc<FakeRateLimiter>,
+    }
+
+    impl HoldFixture {
+        /// A writer navigation with `row` read in phase 1. Each provider runs
+        /// in the given mode. With `runs_auction` the navigation runs one.
+        pub(crate) fn new(
+            providers: Vec<(Arc<dyn IdentityProvider>, ProviderMode)>,
+            row: &KvEntry,
+            runs_auction: bool,
+        ) -> Self {
+            let mut settings = create_test_settings();
+            for (provider, mode) in &providers {
+                settings.ec.identity.providers.insert(
+                    provider.descriptor().id().to_string(),
+                    ProviderSettings {
+                        mode: *mode,
+                        ..ProviderSettings::default()
+                    },
+                );
+            }
+            let runtime = Arc::new(
+                IdentityRuntime::from_settings_with_providers(
+                    &settings,
+                    providers
+                        .into_iter()
+                        .map(|(provider, _)| provider)
+                        .collect(),
+                    BTreeMap::<SourceDomain, IdentityProviderId>::new(),
+                )
+                .expect("should build the runtime"),
+            );
+            let client = Arc::new(FakeHttpClient::new());
+            let backend = Arc::new(FakeBackend::new());
+            let services = fake_services(&client, &backend);
+            let (graph, store) = KvIdentityGraph::write_counting("hold-store");
+            graph.create(TEST_EC_ID, row).expect("should seed the row");
+            let mut context = EcContext::new_for_test_with_ip(
+                Some(TEST_EC_ID.to_owned()),
+                allowing_consent(),
+                Some("192.0.2.10".to_owned()),
+            );
+            context.set_identity_runtime(Arc::clone(&runtime));
+            context.identity_mut().set_writer_decision(WriterDecision {
+                writer: true,
+                is_real_browser: true,
+                user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                dnt: false,
+                page_url: None,
+            });
+            context.identity_mut().set_runs_auction(runs_auction);
+            context.set_kv_snapshot(graph.load_snapshot(TEST_EC_ID));
+            store.reset_counts();
+            Self {
+                settings,
+                runtime,
+                client,
+                backend,
+                services,
+                graph,
+                store,
+                context,
+                limiter: Arc::new(FakeRateLimiter::new()),
+            }
+        }
+
+        /// A new visitor's writer navigation: no row, and an EC minted with its
+        /// create deferred until after the hold dispatch (spec 4.7).
+        pub(crate) fn new_visitor(
+            providers: Vec<(Arc<dyn IdentityProvider>, ProviderMode)>,
+        ) -> Self {
+            let mut fixture = Self::new(providers, &live_row(), true);
+            let (graph, store) = KvIdentityGraph::write_counting("hold-store");
+            let mut context = EcContext::new_for_test_with_ip(
+                None,
+                allowing_consent(),
+                Some("192.0.2.10".to_owned()),
+            );
+            context.set_identity_runtime(Arc::clone(&fixture.runtime));
+            context.identity_mut().set_writer_decision(WriterDecision {
+                writer: true,
+                is_real_browser: true,
+                user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                dnt: false,
+                page_url: None,
+            });
+            context.identity_mut().set_runs_auction(true);
+            context
+                .mint_deferred(&fixture.settings, &BrowserSeed::empty())
+                .expect("should mint the EC");
+            fixture.graph = graph;
+            fixture.store = store;
+            fixture.context = context;
+            fixture
+        }
+
+        /// Runs the hold dispatch before the auction.
+        ///
+        /// It runs inside an executor, as the publisher handler does, so a
+        /// nested `block_on` anywhere in the hold dispatch panics every hold
+        /// test instead of only failing in production.
+        pub(crate) fn run_hold(&mut self) -> HoldResults {
+            let random = ThreadRandom;
+            let deps = self.runtime.deps(
+                &self.settings,
+                &self.services,
+                &random,
+                Some(self.limiter.as_ref()),
+            );
+            futures::executor::block_on(run_hold(&deps, &mut self.context))
+        }
+
+        /// Runs phase 4 for a response with `status`.
+        pub(crate) fn flush(&mut self, status: StatusCode) -> FlushOutcome {
+            run_after_send(AfterSendInput {
+                runtime: &self.runtime,
+                settings: &self.settings,
+                services: &self.services,
+                graph: &self.graph,
+                context: &mut self.context,
+                status,
+                rate_limiter: self.limiter.as_ref(),
+            })
+        }
+
+        /// The row as KV holds it.
+        pub(crate) fn row(&self) -> KvEntry {
+            self.graph
+                .get(TEST_EC_ID)
+                .expect("should read the row")
+                .expect("should hold the row")
+                .0
+        }
+    }
+}
+
+/// A proxied API call from a browser with a live row and capture-only
+/// providers, for the tests of the capture removal write.
+#[cfg(test)]
+pub(crate) mod capture_fixture {
+    use std::collections::BTreeMap;
+    use std::sync::Arc;
+
+    use http::{HeaderMap, Method, StatusCode};
+
+    use super::fake_http::{FakeBackend, FakeHttpClient, fake_services};
+    use super::{TEST_EC_ID, WriteCountingEcKv, allowing_consent};
+    use crate::consent::ConsentContext;
+    use crate::ec::EcContext;
+    use crate::ec::identity::coordinator::{CaptureCall, run_capture};
+    use crate::ec::identity::flush::retry_pending_removals;
+    use crate::ec::identity::ids::{IdentityProviderId, SourceDomain};
+    use crate::ec::identity::input::ThreadRandom;
+    use crate::ec::identity::provider::IdentityProvider;
+    use crate::ec::identity::request::WriterDecision;
+    use crate::ec::identity::runtime::IdentityRuntime;
+    use crate::ec::kv::KvIdentityGraph;
+    use crate::ec::kv_types::KvEntry;
+    use crate::platform::RuntimeServices;
+    use crate::settings::{ProviderSettings, RevokeScope, Settings};
+    use crate::test_support::tests::create_test_settings;
+
+    /// The path every fixture capture call goes to.
+    pub(crate) fn capture_path(provider: &str) -> String {
+        format!("/integrations/{provider}/api/token")
+    }
+
+    /// Everything one capture call reads.
+    pub(crate) struct CaptureFixture {
+        pub(crate) settings: Settings,
+        pub(crate) runtime: Arc<IdentityRuntime>,
+        pub(crate) services: RuntimeServices,
+        pub(crate) graph: KvIdentityGraph,
+        pub(crate) store: Arc<WriteCountingEcKv>,
+        pub(crate) context: EcContext,
+    }
+
+    impl CaptureFixture {
+        /// A real browser's proxied call with `row` stored, read in phase 1,
+        /// and every provider's `revoke_scope` at its default.
+        pub(crate) fn new(
+            providers: Vec<Arc<dyn IdentityProvider>>,
+            row: Option<&KvEntry>,
+        ) -> Self {
+            Self::with_scopes(providers, row, &[])
+        }
+
+        /// As [`Self::new`], with `revoke_scope = "global"` for each provider
+        /// listed in `global`.
+        pub(crate) fn with_scopes(
+            providers: Vec<Arc<dyn IdentityProvider>>,
+            row: Option<&KvEntry>,
+            global: &[&str],
+        ) -> Self {
+            let mut settings = create_test_settings();
+            for id in global {
+                settings.ec.identity.providers.insert(
+                    (*id).to_owned(),
+                    ProviderSettings {
+                        revoke_scope: Some(RevokeScope::Global),
+                        ..ProviderSettings::default()
+                    },
+                );
+            }
+            let runtime = Arc::new(
+                IdentityRuntime::from_settings_with_providers(
+                    &settings,
+                    providers,
+                    BTreeMap::<SourceDomain, IdentityProviderId>::new(),
+                )
+                .expect("should build the runtime"),
+            );
+            let client = Arc::new(FakeHttpClient::new());
+            let backend = Arc::new(FakeBackend::new());
+            let services = fake_services(&client, &backend);
+            let (graph, store) = KvIdentityGraph::write_counting("capture-store");
+            if let Some(row) = row {
+                graph.create(TEST_EC_ID, row).expect("should seed the row");
+            }
+            let mut context = EcContext::new_for_test_with_ip(
+                Some(TEST_EC_ID.to_owned()),
+                allowing_consent(),
+                Some("192.0.2.10".to_owned()),
+            );
+            context.set_identity_runtime(Arc::clone(&runtime));
+            context.identity_mut().set_writer_decision(WriterDecision {
+                writer: false,
+                is_real_browser: true,
+                user_agent: Some("ExampleBrowser/1.0".to_owned()),
+                dnt: false,
+                page_url: None,
+            });
+            context.set_kv_snapshot(graph.load_snapshot(TEST_EC_ID));
+            store.reset_counts();
+            Self {
+                settings,
+                runtime,
+                services,
+                graph,
+                store,
+                context,
+            }
+        }
+
+        /// Replaces the request's consent.
+        pub(crate) fn with_consent(mut self, consent: ConsentContext) -> Self {
+            let mut context = EcContext::new_for_test_with_ip(
+                Some(TEST_EC_ID.to_owned()),
+                consent,
+                Some("192.0.2.10".to_owned()),
+            );
+            context.set_identity_runtime(Arc::clone(&self.runtime));
+            context.set_kv_snapshot(self.context.kv_snapshot().clone());
+            context.identity_mut().set_real_browser(true);
+            self.context = context;
+            self
+        }
+
+        /// Makes the request a client that does not look like a browser.
+        pub(crate) fn not_a_browser(mut self) -> Self {
+            self.context.identity_mut().set_real_browser(false);
+            self
+        }
+
+        /// Runs the capture for a 200 response holding `body` at `path`.
+        pub(crate) fn capture(&mut self, path: &str, body: &serde_json::Value) {
+            let bytes = serde_json::to_vec(body).expect("should serialize the body");
+            self.capture_bytes(path, StatusCode::OK, &bytes);
+        }
+
+        /// Runs the capture for a response with `status` holding `bytes`.
+        pub(crate) fn capture_bytes(&mut self, path: &str, status: StatusCode, bytes: &[u8]) {
+            let random = ThreadRandom;
+            let deps = self
+                .runtime
+                .deps(&self.settings, &self.services, &random, None);
+            let headers = HeaderMap::new();
+            run_capture(
+                &deps,
+                Some(&self.graph),
+                &mut self.context,
+                &CaptureCall {
+                    method: &Method::POST,
+                    path,
+                    status,
+                    headers: &headers,
+                    body: bytes,
+                },
+            );
+        }
+
+        /// Runs the removal write's one retry after send.
+        pub(crate) fn retry_after_send(&mut self) {
+            retry_pending_removals(&mut self.context, &self.graph);
+        }
+
+        /// The row as KV holds it.
+        pub(crate) fn row(&self) -> KvEntry {
+            self.graph
+                .get(TEST_EC_ID)
+                .expect("should read the row")
+                .expect("should hold the row")
+                .0
+        }
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/kv.rs b/crates/trusted-server-core/src/ec/kv.rs
index b0eb83d3fa..d0fd8097a1 100644
--- a/crates/trusted-server-core/src/ec/kv.rs
+++ b/crates/trusted-server-core/src/ec/kv.rs
@@ -20,12 +20,15 @@ use error_stack::{Report, ResultExt};
 use crate::error::TrustedServerError;
 
 use super::generation::ec_hash;
-use super::kv_backend::{EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome};
-use super::kv_types::{KvEntry, KvMetadata, KvNetwork};
+use super::kv_backend::{
+    EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome, KvOperationCounts,
+    OperationCountingEcKv,
+};
+use super::kv_types::{KvEntry, KvMetadata};
 use super::{EcKvSnapshot, checked_current_timestamp, current_timestamp, log_id};
 
 /// Maximum number of CAS retry attempts before giving up.
-const MAX_CAS_RETRIES: u32 = 5;
+pub(crate) const MAX_CAS_RETRIES: u32 = 5;
 
 /// Maximum number of keys to request when counting hash-prefix matches
 /// for cluster size evaluation. Anything above this is clearly a large
@@ -77,137 +80,57 @@ pub(crate) struct PartnerIdUpdate {
     pub(crate) partner_id: String,
     /// Partner-scoped user ID value.
     pub(crate) uid: String,
+    /// Unix seconds this request saw the ID. Stored as the record's `at`.
+    pub(crate) acquired_at: Option<u64>,
 }
 
 impl PartnerIdUpdate {
-    /// Creates a partner UID update.
+    /// Creates a partner UID update with no acquisition time.
     pub(crate) fn new(partner_id: impl Into<String>, uid: impl Into<String>) -> Self {
         Self {
             partner_id: partner_id.into(),
             uid: uid.into(),
+            acquired_at: None,
         }
     }
+
+    /// Records when this request saw the ID.
+    #[must_use]
+    pub(crate) fn with_acquired_at(mut self, at: u64) -> Self {
+        self.acquired_at = Some(at);
+        self
+    }
 }
 
-/// Terminal result of one browser EID-cookie persistence attempt.
+/// Terminal result of the browser EID-cookie persistence the `EID sync
+/// measurement` line still reports: a new EC's create.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
 pub(crate) enum EidCookieSyncOutcome {
-    /// The stored values already matched without a write.
-    #[display("already_matched")]
-    AlreadyMatched,
-    /// The one conditional write succeeded.
+    /// The new EC's create stored the browser ingest.
     #[display("written")]
     Written,
-    /// The write added missing IDs while deferring different values of unknown freshness.
-    #[display("written_with_deferred_freshness")]
-    WrittenWithDeferredFreshness,
-    /// A conflicting writer persisted every desired value.
-    #[display("conflict_matched")]
-    ConflictMatched,
-    /// A conflict left at least one desired value absent or different.
-    #[display("deferred_conflict")]
-    DeferredConflict,
-    /// A different stored value had unknown freshness.
-    #[display("deferred_freshness")]
-    DeferredFreshness,
-    /// An eventually consistent read missed a row already proven to exist.
-    #[display("deferred_stale_read")]
-    DeferredStaleRead,
-    /// The identity graph row was missing.
-    #[display("missing")]
-    Missing,
-    /// Consent had been withdrawn in the identity graph.
-    #[display("consent_withdrawn")]
-    ConsentWithdrawn,
-    /// KV or serialization failed.
-    #[display("failed")]
-    Failed,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum CookieUpdateApplication {
-    AlreadyMatched,
-    Changed { deferred: bool },
-    DeferredFreshness,
-}
-
-fn apply_cookie_partner_id_updates(
-    entry: &mut KvEntry,
-    updates: &[PartnerIdUpdate],
-) -> CookieUpdateApplication {
-    let mut latest_updates = BTreeMap::new();
-    for update in updates {
-        latest_updates.insert(update.partner_id.as_str(), update.uid.as_str());
-    }
-
-    let mut changed = false;
-    let mut deferred = false;
-    for (partner_id, uid) in latest_updates {
-        match entry.ids.get(partner_id) {
-            Some(existing) if existing.uid == uid => continue,
-            // Browser EID cookies carry no value-owned sequence or timestamp.
-            // A different value therefore has unknown freshness and must not
-            // replace the stored value.
-            Some(_) => {
-                deferred = true;
-                continue;
-            }
-            None => {}
-        }
-
-        entry.ids.insert(
-            partner_id.to_owned(),
-            super::kv_types::KvPartnerId {
-                uid: uid.to_owned(),
-            },
-        );
-        changed = true;
-    }
-
-    if changed {
-        CookieUpdateApplication::Changed { deferred }
-    } else if deferred {
-        CookieUpdateApplication::DeferredFreshness
-    } else {
-        CookieUpdateApplication::AlreadyMatched
-    }
-}
-
-fn partner_id_updates_match(entry: &KvEntry, updates: &[PartnerIdUpdate]) -> bool {
-    let mut latest_updates = BTreeMap::new();
-    for update in updates {
-        latest_updates.insert(update.partner_id.as_str(), update.uid.as_str());
-    }
-
-    latest_updates.into_iter().all(|(partner_id, uid)| {
-        entry
-            .ids
-            .get(partner_id)
-            .is_some_and(|existing| existing.uid == uid)
-    })
 }
 
 pub(crate) fn apply_partner_id_updates(entry: &mut KvEntry, updates: &[PartnerIdUpdate]) -> bool {
     let mut latest_updates = BTreeMap::new();
     for update in updates {
-        latest_updates.insert(update.partner_id.as_str(), update.uid.as_str());
+        latest_updates.insert(update.partner_id.as_str(), update);
     }
 
     let mut changed = false;
-    for (partner_id, uid) in latest_updates {
+    for (partner_id, update) in latest_updates {
+        let uid = update.uid.as_str();
         if entry
             .ids
             .get(partner_id)
-            .is_some_and(|existing| existing.uid == uid)
+            .is_some_and(|existing| existing.first_uid() == Some(uid))
         {
             continue;
         }
 
         entry.ids.insert(
             partner_id.to_owned(),
-            super::kv_types::KvPartnerId {
-                uid: uid.to_owned(),
-            },
+            super::kv_types::KvPartnerId::browser(uid, update.acquired_at),
         );
         changed = true;
     }
@@ -255,12 +178,66 @@ impl KvIdentityGraph {
         }
     }
 
+    /// Returns a graph over the same store that also counts its operations
+    /// into `counts`.
+    #[must_use]
+    pub fn with_operation_counts(self, counts: &KvOperationCounts) -> Self {
+        Self {
+            store: Arc::new(OperationCountingEcKv::new(self.store, counts.clone())),
+        }
+    }
+
+    /// Returns a graph over the same store, recording this request's KV latency.
+    #[must_use]
+    pub fn with_request_timings(self, timings: &crate::request_timing::RequestTimings) -> Self {
+        Self {
+            store: Arc::new(crate::platform::TimedKvStore::new(
+                self.store,
+                timings.clone(),
+            )),
+        }
+    }
+
+    /// Blocks the request for `duration` through the store, so an
+    /// after-send write can outlast the platform's per-key write limit.
+    pub(crate) fn pause(&self, duration: core::time::Duration) {
+        self.store.pause(duration);
+    }
+
     /// Returns the configured store name.
     #[must_use]
     pub fn store_name(&self) -> &str {
         self.store.store_name()
     }
 
+    /// Reads any key of the store, such as a pending key, raw.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::KvStore`] on store open or read failure.
+    pub(crate) fn lookup_key(
+        &self,
+        key: &str,
+    ) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+        self.store.lookup(key)
+    }
+
+    /// Writes any key of the store, such as a pending key, raw, with no
+    /// metadata.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::KvStore`] on store open or write failure.
+    pub(crate) fn write_key(
+        &self,
+        key: &str,
+        body: &str,
+        ttl: Duration,
+        mode: EcKvWriteMode,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        self.write_entry(key, body, "", ttl, mode)
+    }
+
     fn kv_error(&self, message: String) -> Report<TrustedServerError> {
         Report::new(TrustedServerError::KvStore {
             store_name: self.store_name().to_owned(),
@@ -357,12 +334,28 @@ impl KvIdentityGraph {
         ec_id: &str,
         body_bytes: &[u8],
     ) -> Result<KvEntry, Report<TrustedServerError>> {
-        let entry: KvEntry =
+        let mut entry: KvEntry =
             serde_json::from_slice(body_bytes).change_context(TrustedServerError::KvStore {
                 store_name: store_name.to_owned(),
                 message: format!("Failed to deserialize entry for key '{}'", log_id(ec_id)),
             })?;
 
+        let dropped = entry.upgrade_for_read().map_err(|message| {
+            Report::new(TrustedServerError::KvStore {
+                store_name: store_name.to_owned(),
+                message: format!(
+                    "Loaded invalid entry for key '{}': {message}",
+                    log_id(ec_id)
+                ),
+            })
+        })?;
+        for message in dropped {
+            log::warn!(
+                "Dropping an invalid record on read for key '{}': {message}",
+                log_id(ec_id)
+            );
+        }
+
         entry.validate().map_err(|message| {
             Report::new(TrustedServerError::KvStore {
                 store_name: store_name.to_owned(),
@@ -555,154 +548,6 @@ impl KvIdentityGraph {
         )))
     }
 
-    /// Persists browser EID cookies with one conditional write and one conflict read.
-    ///
-    /// Browser cookies do not carry a value-owned version, so a different
-    /// existing value has unknown freshness and is always deferred. After a CAS
-    /// conflict this method never writes again. A live follow-up becomes the
-    /// authoritative snapshot; a missing or failed follow-up retains the live
-    /// pre-write snapshot as proof and defers the update.
-    pub(crate) fn sync_eid_cookie_updates_from_snapshot(
-        &self,
-        ec_id: &str,
-        updates: &[PartnerIdUpdate],
-        snapshot: EcKvSnapshot,
-    ) -> (EcKvSnapshot, EidCookieSyncOutcome) {
-        if updates.is_empty() {
-            return (snapshot, EidCookieSyncOutcome::AlreadyMatched);
-        }
-
-        let proven = match snapshot {
-            EcKvSnapshot::Present {
-                ec_id: ref snapshot_id,
-                ..
-            } if snapshot_id == ec_id => Some(snapshot.clone()),
-            _ => None,
-        };
-
-        let current = match snapshot {
-            EcKvSnapshot::Present {
-                ec_id: ref snapshot_id,
-                generation: Some(_),
-                ..
-            } if snapshot_id == ec_id => snapshot,
-            EcKvSnapshot::Failed {
-                ec_id: ref snapshot_id,
-            } if snapshot_id == ec_id => return (snapshot, EidCookieSyncOutcome::Failed),
-            _ => self.load_snapshot(ec_id),
-        };
-
-        let (mut entry, generation) = match current {
-            EcKvSnapshot::Present {
-                ec_id: ref snapshot_id,
-                ref entry,
-                generation: Some(generation),
-            } if snapshot_id == ec_id => (entry.as_ref().clone(), generation),
-            EcKvSnapshot::Missing { .. } => {
-                let outcome = if proven.is_some() {
-                    EidCookieSyncOutcome::DeferredStaleRead
-                } else {
-                    EidCookieSyncOutcome::Missing
-                };
-                let kept = Self::keep_proven(ec_id, current, proven.as_ref());
-                return (kept, outcome);
-            }
-            EcKvSnapshot::Failed { .. } => {
-                let kept = Self::keep_proven(ec_id, current, proven.as_ref());
-                return (kept, EidCookieSyncOutcome::Failed);
-            }
-            EcKvSnapshot::Present { .. } | EcKvSnapshot::NotRead => {
-                return (
-                    EcKvSnapshot::Failed {
-                        ec_id: ec_id.to_owned(),
-                    },
-                    EidCookieSyncOutcome::Failed,
-                );
-            }
-        };
-
-        if !entry.consent.ok {
-            return (current, EidCookieSyncOutcome::ConsentWithdrawn);
-        }
-        let deferred_freshness = match apply_cookie_partner_id_updates(&mut entry, updates) {
-            CookieUpdateApplication::AlreadyMatched => {
-                return (current, EidCookieSyncOutcome::AlreadyMatched);
-            }
-            CookieUpdateApplication::DeferredFreshness => {
-                return (current, EidCookieSyncOutcome::DeferredFreshness);
-            }
-            CookieUpdateApplication::Changed { deferred } => deferred,
-        };
-
-        let Ok((body, meta_str)) = Self::serialize_entry(&entry, self.store_name()) else {
-            return (
-                EcKvSnapshot::Failed {
-                    ec_id: ec_id.to_owned(),
-                },
-                EidCookieSyncOutcome::Failed,
-            );
-        };
-        match self.write_entry(
-            ec_id,
-            &body,
-            &meta_str,
-            ENTRY_TTL,
-            EcKvWriteMode::IfGenerationMatch(generation),
-        ) {
-            Ok(EcKvWriteOutcome::Written) => (
-                EcKvSnapshot::Present {
-                    ec_id: ec_id.to_owned(),
-                    entry: Box::new(entry),
-                    generation: None,
-                },
-                if deferred_freshness {
-                    EidCookieSyncOutcome::WrittenWithDeferredFreshness
-                } else {
-                    EidCookieSyncOutcome::Written
-                },
-            ),
-            Ok(EcKvWriteOutcome::PreconditionFailed) => {
-                let refreshed = self.load_snapshot(ec_id);
-                let Some(refreshed_entry) = refreshed.entry_for(ec_id) else {
-                    // The failed CAS proved `current`'s generation stale. Keep
-                    // only its existence proof so later writes must reread.
-                    let proof = match current {
-                        EcKvSnapshot::Present {
-                            ec_id: proven_id,
-                            entry,
-                            ..
-                        } => EcKvSnapshot::Present {
-                            ec_id: proven_id,
-                            entry,
-                            generation: None,
-                        },
-                        other => other,
-                    };
-                    let kept = Self::keep_proven(ec_id, refreshed, Some(&proof));
-                    return (kept, EidCookieSyncOutcome::DeferredConflict);
-                };
-                if !refreshed_entry.consent.ok {
-                    return (refreshed, EidCookieSyncOutcome::ConsentWithdrawn);
-                }
-                let outcome = if partner_id_updates_match(refreshed_entry, updates) {
-                    EidCookieSyncOutcome::ConflictMatched
-                } else {
-                    EidCookieSyncOutcome::DeferredConflict
-                };
-                (refreshed, outcome)
-            }
-            Err(err) => {
-                log::warn!("EID cookie sync write failed: {err:?}");
-                (
-                    EcKvSnapshot::Failed {
-                        ec_id: ec_id.to_owned(),
-                    },
-                    EidCookieSyncOutcome::Failed,
-                )
-            }
-        }
-    }
-
     /// Merges partner IDs using request-scoped persisted state as the first CAS input.
     ///
     /// A caller-supplied `Present` snapshot is *proof* that the row exists —
@@ -720,6 +565,9 @@ impl KvIdentityGraph {
     /// later chance to retry.
     ///
     /// [`generate_if_needed`]: super::generate_if_needed
+    // No production caller since phase 4 replaced pull sync's own write; its
+    // tests still pin the merge rules. Remove with them in a cleanup task.
+    #[allow(dead_code)]
     pub(crate) fn upsert_partner_ids_from_snapshot(
         &self,
         ec_id: &str,
@@ -837,6 +685,31 @@ impl KvIdentityGraph {
         }
     }
 
+    /// Writes `entry` only if the row is still at `generation`.
+    ///
+    /// The identity removal write and the phase 4 flush share this path, so
+    /// every identity write is validated and generation-checked.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `entry` does not serialize or validate, or the
+    /// store write fails for a reason other than a generation mismatch.
+    pub(crate) fn write_if_generation(
+        &self,
+        ec_id: &str,
+        entry: &KvEntry,
+        generation: u64,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        let (body, metadata) = Self::serialize_entry(entry, self.store_name())?;
+        self.write_entry(
+            ec_id,
+            &body,
+            &metadata,
+            ENTRY_TTL,
+            EcKvWriteMode::IfGenerationMatch(generation),
+        )
+    }
+
     /// Returns `proven` instead of a read outcome that cannot disprove it.
     ///
     /// Partner-ID enrichment is best effort. When the caller already held proof
@@ -846,6 +719,9 @@ impl KvIdentityGraph {
     /// update is logged. Write failures are *not* routed here: they are real
     /// operation failures and stay [`EcKvSnapshot::Failed`] so callers can
     /// report them.
+    // No production caller since phase 4 replaced pull sync's own write; its
+    // tests still pin the merge rules. Remove with them in a cleanup task.
+    #[allow(dead_code)]
     fn keep_proven(
         ec_id: &str,
         downgraded: EcKvSnapshot,
@@ -913,16 +789,14 @@ impl KvIdentityGraph {
             if entry
                 .ids
                 .get(partner_id)
-                .is_some_and(|existing| existing.uid == uid)
+                .is_some_and(|existing| existing.first_uid() == Some(uid))
             {
                 return Ok(());
             }
 
             entry.ids.insert(
                 partner_id.to_owned(),
-                super::kv_types::KvPartnerId {
-                    uid: uid.to_owned(),
-                },
+                super::kv_types::KvPartnerId::new(uid),
             );
 
             let (body, meta_str) = Self::serialize_entry(&entry, self.store_name())?;
@@ -971,6 +845,28 @@ impl KvIdentityGraph {
         ec_id: &str,
         partner_id: &str,
         uid: &str,
+    ) -> Result<UpsertResult, Report<TrustedServerError>> {
+        self.upsert_partner_id_if_exists_policy(ec_id, partner_id, uid, false)
+    }
+
+    /// Like [`Self::upsert_partner_id_if_exists`], with the replacement rule
+    /// chosen by the caller.
+    ///
+    /// With `only_when_absent`, a source that already holds a value is left
+    /// untouched and the call returns [`UpsertResult::Unchanged`] without a
+    /// write. Batch sync sets it for a source an identity provider owns, so a
+    /// provider's entry set is never replaced.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::KvStore`] on store I/O or CAS
+    /// exhaustion errors.
+    pub fn upsert_partner_id_if_exists_policy(
+        &self,
+        ec_id: &str,
+        partner_id: &str,
+        uid: &str,
+        only_when_absent: bool,
     ) -> Result<UpsertResult, Report<TrustedServerError>> {
         for attempt in 0..MAX_CAS_RETRIES {
             let (mut entry, generation) = match self.get(ec_id)? {
@@ -982,19 +878,21 @@ impl KvIdentityGraph {
                 return Ok(UpsertResult::ConsentWithdrawn);
             }
 
+            if only_when_absent && entry.ids.contains_key(partner_id) {
+                return Ok(UpsertResult::Unchanged);
+            }
+
             if entry
                 .ids
                 .get(partner_id)
-                .is_some_and(|existing| existing.uid == uid)
+                .is_some_and(|existing| existing.first_uid() == Some(uid))
             {
                 return Ok(UpsertResult::Unchanged);
             }
 
             entry.ids.insert(
                 partner_id.to_owned(),
-                super::kv_types::KvPartnerId {
-                    uid: uid.to_owned(),
-                },
+                super::kv_types::KvPartnerId::new(uid),
             );
 
             let (body, meta_str) = Self::serialize_entry(&entry, self.store_name())?;
@@ -1468,84 +1366,16 @@ impl KvIdentityGraph {
             .count_keys_with_prefix(hash_prefix, CLUSTER_LIST_LIMIT)
     }
 
-    /// Evaluates the cluster size for an EC entry.
+    /// Counts the entries sharing `ec_id`'s hash prefix, without writing.
     ///
-    /// Returns the stored `cluster_size` when it has already been evaluated
-    /// for a live entry. Tombstone entries return `None` without store I/O so
-    /// their 24-hour withdrawal TTL is not extended. Otherwise, counts the
-    /// number of keys sharing the same hash prefix via
-    /// [`count_hash_prefix_keys`](Self::count_hash_prefix_keys) and writes the
-    /// result back to the entry. The CAS write is best-effort — on conflict
-    /// or write failure, the computed value is still returned.
+    /// The prefix list and count only. A caller that wants the size kept
+    /// stages it on a write of its own.
     ///
     /// # Errors
     ///
     /// Returns [`TrustedServerError::KvStore`] on store or list failure.
-    pub fn evaluate_cluster(
-        &self,
-        ec_id: &str,
-        entry: &KvEntry,
-        generation: u64,
-    ) -> Result<Option<u32>, Report<TrustedServerError>> {
-        if !entry.consent.ok {
-            log::trace!("evaluate_cluster: skipping tombstone entry");
-            return Ok(None);
-        }
-
-        if let Some(cluster_size) = entry
-            .network
-            .as_ref()
-            .and_then(|network| network.cluster_size)
-        {
-            log::trace!("evaluate_cluster: using stored cluster_size");
-            return Ok(Some(cluster_size));
-        }
-
-        // Compute cluster size via prefix list.
-        let hash_prefix = ec_hash(ec_id);
-        let cluster_size = self.count_hash_prefix_keys(hash_prefix)?;
-
-        log::debug!(
-            "evaluate_cluster: computed cluster_size={cluster_size} for '{}'",
-            log_id(ec_id)
-        );
-
-        // Best-effort CAS write-back — update only the cluster size so any
-        // future `network` fields are preserved across this lazy write.
-        let mut updated_entry = entry.clone();
-        let mut network = updated_entry
-            .network
-            .unwrap_or(KvNetwork { cluster_size: None });
-        network.cluster_size = Some(cluster_size);
-        updated_entry.network = Some(network);
-
-        let (body, meta_str) = Self::serialize_entry(&updated_entry, self.store_name())?;
-
-        match self.write_entry(
-            ec_id,
-            &body,
-            &meta_str,
-            ENTRY_TTL,
-            EcKvWriteMode::IfGenerationMatch(generation),
-        ) {
-            Ok(EcKvWriteOutcome::Written) => {}
-            Ok(EcKvWriteOutcome::PreconditionFailed) => {
-                log::debug!(
-                    "evaluate_cluster: CAS conflict writing cluster_size for '{}', \
-                     returning computed value anyway",
-                    log_id(ec_id),
-                );
-            }
-            Err(report) => {
-                // Log but don't fail — the computed value is still valid.
-                log::warn!(
-                    "evaluate_cluster: failed to write cluster_size for '{}': {report}",
-                    log_id(ec_id)
-                );
-            }
-        }
-
-        Ok(Some(cluster_size))
+    pub fn compute_cluster_size(&self, ec_id: &str) -> Result<u32, Report<TrustedServerError>> {
+        self.count_hash_prefix_keys(ec_hash(ec_id))
     }
 
     /// Hard-deletes the entry and any withdrawal completion marker.
@@ -1564,6 +1394,31 @@ impl KvIdentityGraph {
     }
 }
 
+#[cfg(any(test, feature = "test-utils"))]
+impl KvIdentityGraph {
+    /// Test helper: a graph backed by an in-memory store that counts lookups
+    /// and writes by mode, with the store to read the counts from.
+    ///
+    /// Counts include any seeding, so call
+    /// [`WriteCountingEcKv::reset_counts`](crate::ec::identity::test_support::WriteCountingEcKv::reset_counts)
+    /// after seeding to count only what the code under test does.
+    #[must_use]
+    pub fn write_counting(
+        store_name: impl Into<String>,
+    ) -> (
+        Self,
+        Arc<crate::ec::identity::test_support::WriteCountingEcKv>,
+    ) {
+        let store = Arc::new(crate::ec::identity::test_support::WriteCountingEcKv::new(
+            store_name,
+        ));
+        let graph = Self {
+            store: store.clone(),
+        };
+        (graph, store)
+    }
+}
+
 #[cfg(test)]
 impl KvIdentityGraph {
     /// Test helper: a graph whose every store operation fails, mimicking a
@@ -1717,6 +1572,28 @@ mod tests {
         assert!(ts > 0, "should return a nonzero timestamp");
     }
 
+    #[test]
+    fn kv_span_accumulates_across_graph_operations() {
+        let timings = crate::request_timing::RequestTimings::new();
+        let graph = KvIdentityGraph::new(crate::platform::TimedKvStore::new(
+            crate::ec::kv_backend::test_support::InMemoryEcKv::new("test-store"),
+            timings.clone(),
+        ));
+
+        graph
+            .create("ec-1", &live_entry())
+            .expect("should create entry through the timed store");
+        graph
+            .get("ec-1")
+            .expect("should read the entry back through the timed store");
+
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().kv_ms.is_some(),
+            "should accumulate Phase::EcKv across both graph operations, not just the last write"
+        );
+    }
+
     #[test]
     fn serialize_entry_produces_valid_json() {
         let entry = KvEntry::tombstone(1000);
@@ -1733,22 +1610,74 @@ mod tests {
     }
 
     #[test]
-    fn deserialize_entry_rejects_invalid_legacy_values() {
+    fn deserialize_entry_drops_an_invalid_record() {
         let mut entry = KvEntry::tombstone(1000);
         entry.ids.insert(
             "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "x".repeat(crate::ec::kv_types::MAX_UID_LENGTH + 1),
-            },
+            crate::ec::kv_types::KvPartnerId::new(
+                "x".repeat(crate::ec::kv_types::MAX_UID_LENGTH + 1),
+            ),
+        );
+        entry.ids.insert(
+            "ssp_y".to_owned(),
+            crate::ec::kv_types::KvPartnerId::new("valid-uid"),
         );
         let body = serde_json::to_vec(&entry).expect("should serialize invalid entry payload");
 
-        let err = KvIdentityGraph::deserialize_entry("test-store", "ec-id", &body)
-            .expect_err("should reject invalid legacy entry values");
-        let err_text = format!("{err}");
+        let read = KvIdentityGraph::deserialize_entry("test-store", "ec-id", &body)
+            .expect("should read a row whose one record is invalid");
+
         assert!(
-            err_text.contains("Loaded invalid entry"),
-            "should report validation failure for loaded entries"
+            !read.ids.contains_key("ssp_x"),
+            "should drop the invalid record"
+        );
+        assert_eq!(
+            read.ids["ssp_y"].first_uid(),
+            Some("valid-uid"),
+            "should keep the valid record"
+        );
+
+        let malformed = serde_json::json!({
+            "v": 2,
+            "created": 1000,
+            "consent": { "ok": "yes", "updated": 1000 },
+            "geo": { "country": "US" }
+        });
+        let err = KvIdentityGraph::deserialize_entry(
+            "test-store",
+            "ec-id",
+            &serde_json::to_vec(&malformed).expect("should serialize"),
+        )
+        .expect_err("should still fail a row-level fault as a whole");
+        assert!(
+            format!("{err}").contains("Failed to deserialize entry"),
+            "should report the row-level fault"
+        );
+    }
+
+    #[test]
+    fn deserialize_entry_reads_a_version_1_body() {
+        let body = serde_json::to_vec(&serde_json::json!({
+            "v": 1,
+            "created": 1_760_000_000,
+            "consent": { "ok": true, "updated": 1_760_000_000 },
+            "geo": { "country": "US" },
+            "ids": { "id5-sync.com": { "uid": "ID5*example" } }
+        }))
+        .expect("should serialize a row from main");
+
+        let entry = KvIdentityGraph::deserialize_entry("test-store", "ec-id", &body)
+            .expect("should read a version 1 row");
+
+        assert_eq!(
+            entry.v,
+            crate::ec::kv_types::SCHEMA_VERSION,
+            "should upgrade the version"
+        );
+        assert_eq!(
+            entry.ids["id5-sync.com"],
+            crate::ec::kv_types::KvPartnerId::new("ID5*example"),
+            "should read the uid as one entry"
         );
     }
 
@@ -1772,9 +1701,9 @@ mod tests {
         let mut entry = KvEntry::tombstone(1000);
         entry.ids.insert(
             "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "x".repeat(crate::ec::kv_types::MAX_UID_LENGTH + 1),
-            },
+            crate::ec::kv_types::KvPartnerId::new(
+                "x".repeat(crate::ec::kv_types::MAX_UID_LENGTH + 1),
+            ),
         );
 
         let err = KvIdentityGraph::serialize_entry(&entry, "test-store")
@@ -1796,9 +1725,7 @@ mod tests {
         let mut entry = live_entry();
         entry.ids.insert(
             "concurrent.example.com".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "concurrent-uid".to_owned(),
-            },
+            crate::ec::kv_types::KvPartnerId::new("concurrent-uid"),
         );
         entry
     }
@@ -1846,167 +1773,40 @@ mod tests {
             self.inner
                 .insert(
                     ec_id,
-                    EcKvWrite {
-                        body: &body,
-                        metadata: &meta,
-                        ttl: TOMBSTONE_TTL,
-                        mode: EcKvWriteMode::Add,
-                    },
-                )
-                .expect("should seed tombstone");
-        }
-
-        fn seed_live(&self, ec_id: &str) {
-            let (body, meta) =
-                KvIdentityGraph::serialize_entry(&live_entry(), self.inner.store_name())
-                    .expect("should serialize live entry");
-            self.inner
-                .insert(
-                    ec_id,
-                    EcKvWrite {
-                        body: &body,
-                        metadata: &meta,
-                        ttl: TOMBSTONE_TTL,
-                        mode: EcKvWriteMode::Add,
-                    },
-                )
-                .expect("should seed live entry");
-        }
-    }
-
-    impl EcKvStore for ConflictInjectingEcKv {
-        fn store_name(&self) -> &str {
-            self.inner.store_name()
-        }
-
-        fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
-            self.inner.lookup(key)
-        }
-
-        fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
-            self.inner.key_exists(key)
-        }
-
-        fn insert(
-            &self,
-            key: &str,
-            write: EcKvWrite<'_>,
-        ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
-            if matches!(write.mode, EcKvWriteMode::IfGenerationMatch(_)) {
-                let mut remaining = self
-                    .conflicts_remaining
-                    .lock()
-                    .expect("should lock conflict counter");
-                if *remaining > 0 {
-                    *remaining -= 1;
-                    if self.revive_on_conflict {
-                        // Simulate a concurrent writer reviving the entry
-                        // between this writer's read and its CAS write.
-                        let concurrent_entry = if self.partner_update_on_conflict {
-                            concurrent_live_entry()
-                        } else {
-                            live_entry()
-                        };
-                        let (body, meta) = KvIdentityGraph::serialize_entry(
-                            &concurrent_entry,
-                            self.inner.store_name(),
-                        )
-                        .expect("should serialize concurrent live entry");
-                        self.inner
-                            .insert(
-                                key,
-                                EcKvWrite {
-                                    body: &body,
-                                    metadata: &meta,
-                                    ttl: ENTRY_TTL,
-                                    mode: EcKvWriteMode::Overwrite,
-                                },
-                            )
-                            .expect("should apply concurrent revive");
-                    }
-                    return Ok(EcKvWriteOutcome::PreconditionFailed);
-                }
-            }
-            self.inner.insert(key, write)
-        }
-
-        fn list_keys_with_prefix(
-            &self,
-            prefix: &str,
-            limit: u32,
-        ) -> Result<Vec<String>, Report<TrustedServerError>> {
-            self.inner.list_keys_with_prefix(prefix, limit)
-        }
-
-        fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
-            self.inner.delete(key)
-        }
-    }
-
-    /// Store that replaces the row during the first EID CAS write and records
-    /// the request's reads and conditional writes.
-    struct EidConflictEcKv {
-        inner: InMemoryEcKv,
-        concurrent_entry: KvEntry,
-        lookups: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-        conditional_writes: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-        follow_up_miss: bool,
-        miss_next_lookup: std::sync::atomic::AtomicBool,
-    }
-
-    impl EidConflictEcKv {
-        fn new(
-            concurrent_entry: KvEntry,
-            lookups: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-            conditional_writes: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-        ) -> Self {
-            Self {
-                inner: InMemoryEcKv::new("eid-conflict-store"),
-                concurrent_entry,
-                lookups,
-                conditional_writes,
-                follow_up_miss: false,
-                miss_next_lookup: std::sync::atomic::AtomicBool::new(false),
-            }
-        }
-
-        fn with_follow_up_miss(mut self) -> Self {
-            self.follow_up_miss = true;
-            self
+                    EcKvWrite {
+                        body: &body,
+                        metadata: &meta,
+                        ttl: TOMBSTONE_TTL,
+                        mode: EcKvWriteMode::Add,
+                    },
+                )
+                .expect("should seed tombstone");
         }
 
         fn seed_live(&self, ec_id: &str) {
             let (body, meta) =
                 KvIdentityGraph::serialize_entry(&live_entry(), self.inner.store_name())
-                    .expect("should serialize initial entry");
+                    .expect("should serialize live entry");
             self.inner
                 .insert(
                     ec_id,
                     EcKvWrite {
                         body: &body,
                         metadata: &meta,
-                        ttl: ENTRY_TTL,
+                        ttl: TOMBSTONE_TTL,
                         mode: EcKvWriteMode::Add,
                     },
                 )
-                .expect("should seed initial entry");
+                .expect("should seed live entry");
         }
     }
 
-    impl EcKvStore for EidConflictEcKv {
+    impl EcKvStore for ConflictInjectingEcKv {
         fn store_name(&self) -> &str {
             self.inner.store_name()
         }
 
         fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
-            self.lookups
-                .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-            if self
-                .miss_next_lookup
-                .swap(false, std::sync::atomic::Ordering::Relaxed)
-            {
-                return Ok(None);
-            }
             self.inner.lookup(key)
         }
 
@@ -2020,29 +1820,39 @@ mod tests {
             write: EcKvWrite<'_>,
         ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
             if matches!(write.mode, EcKvWriteMode::IfGenerationMatch(_)) {
-                self.conditional_writes
-                    .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-                let (body, meta) = KvIdentityGraph::serialize_entry(
-                    &self.concurrent_entry,
-                    self.inner.store_name(),
-                )
-                .expect("should serialize concurrent entry");
-                self.inner
-                    .insert(
-                        key,
-                        EcKvWrite {
-                            body: &body,
-                            metadata: &meta,
-                            ttl: ENTRY_TTL,
-                            mode: EcKvWriteMode::Overwrite,
-                        },
-                    )
-                    .expect("should write concurrent entry");
-                if self.follow_up_miss {
-                    self.miss_next_lookup
-                        .store(true, std::sync::atomic::Ordering::Relaxed);
+                let mut remaining = self
+                    .conflicts_remaining
+                    .lock()
+                    .expect("should lock conflict counter");
+                if *remaining > 0 {
+                    *remaining -= 1;
+                    if self.revive_on_conflict {
+                        // Simulate a concurrent writer reviving the entry
+                        // between this writer's read and its CAS write.
+                        let concurrent_entry = if self.partner_update_on_conflict {
+                            concurrent_live_entry()
+                        } else {
+                            live_entry()
+                        };
+                        let (body, meta) = KvIdentityGraph::serialize_entry(
+                            &concurrent_entry,
+                            self.inner.store_name(),
+                        )
+                        .expect("should serialize concurrent live entry");
+                        self.inner
+                            .insert(
+                                key,
+                                EcKvWrite {
+                                    body: &body,
+                                    metadata: &meta,
+                                    ttl: ENTRY_TTL,
+                                    mode: EcKvWriteMode::Overwrite,
+                                },
+                            )
+                            .expect("should apply concurrent revive");
+                    }
+                    return Ok(EcKvWriteOutcome::PreconditionFailed);
                 }
-                return Ok(EcKvWriteOutcome::PreconditionFailed);
             }
             self.inner.insert(key, write)
         }
@@ -2055,14 +1865,6 @@ mod tests {
             self.inner.list_keys_with_prefix(prefix, limit)
         }
 
-        fn count_keys_with_prefix(
-            &self,
-            prefix: &str,
-            limit: u32,
-        ) -> Result<u32, Report<TrustedServerError>> {
-            self.inner.count_keys_with_prefix(prefix, limit)
-        }
-
         fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
             self.inner.delete(key)
         }
@@ -2131,16 +1933,35 @@ mod tests {
         let mut entry = live_entry();
         entry.ids.insert(
             "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "uid-1".to_owned(),
-            },
+            crate::ec::kv_types::KvPartnerId::new("uid-1"),
         );
         let updates = vec![PartnerIdUpdate::new("ssp_x", "uid-1")];
 
         let changed = apply_partner_id_updates(&mut entry, &updates);
 
         assert!(!changed, "should not change when UID already matches");
-        assert_eq!(entry.ids["ssp_x"].uid, "uid-1");
+        assert_eq!(entry.ids["ssp_x"].first_uid(), Some("uid-1"));
+    }
+
+    #[test]
+    fn browser_ingest_records_acquisition_time() {
+        let mut entry = KvEntry::minimal("sharedid.org", "existing", 1);
+        let updates =
+            [PartnerIdUpdate::new("example.com", "new-uid").with_acquired_at(1_760_000_000)];
+
+        let changed = apply_partner_id_updates(&mut entry, &updates);
+
+        assert!(changed, "should report a change");
+        assert_eq!(
+            entry.ids["example.com"],
+            crate::ec::kv_types::KvPartnerId::browser("new-uid", Some(1_760_000_000)),
+            "should store the UID with at and no writer"
+        );
+        assert_eq!(
+            entry.ids["sharedid.org"],
+            crate::ec::kv_types::KvPartnerId::new("existing"),
+            "should leave other sources alone"
+        );
     }
 
     #[test]
@@ -2151,7 +1972,7 @@ mod tests {
         let changed = apply_partner_id_updates(&mut entry, &updates);
 
         assert!(changed, "should report changed entry");
-        assert_eq!(entry.ids["ssp_x"].uid, "uid-1");
+        assert_eq!(entry.ids["ssp_x"].first_uid(), Some("uid-1"));
     }
 
     #[test]
@@ -2159,16 +1980,14 @@ mod tests {
         let mut entry = live_entry();
         entry.ids.insert(
             "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "old-uid".to_owned(),
-            },
+            crate::ec::kv_types::KvPartnerId::new("old-uid"),
         );
         let updates = vec![PartnerIdUpdate::new("ssp_x", "new-uid")];
 
         let changed = apply_partner_id_updates(&mut entry, &updates);
 
         assert!(changed, "should report changed entry");
-        assert_eq!(entry.ids["ssp_x"].uid, "new-uid");
+        assert_eq!(entry.ids["ssp_x"].first_uid(), Some("new-uid"));
     }
 
     #[test]
@@ -2182,8 +2001,8 @@ mod tests {
         let changed = apply_partner_id_updates(&mut entry, &updates);
 
         assert!(changed, "should report changed entry");
-        assert_eq!(entry.ids["ssp_x"].uid, "uid-x");
-        assert_eq!(entry.ids["ssp_y"].uid, "uid-y");
+        assert_eq!(entry.ids["ssp_x"].first_uid(), Some("uid-x"));
+        assert_eq!(entry.ids["ssp_y"].first_uid(), Some("uid-y"));
     }
 
     #[test]
@@ -2191,9 +2010,7 @@ mod tests {
         let mut entry = live_entry();
         entry.ids.insert(
             "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "original".to_owned(),
-            },
+            crate::ec::kv_types::KvPartnerId::new("original"),
         );
         let updates = vec![
             PartnerIdUpdate::new("ssp_x", "intermediate"),
@@ -2206,324 +2023,7 @@ mod tests {
             !changed,
             "should not write when the final duplicate value matches existing state"
         );
-        assert_eq!(entry.ids["ssp_x"].uid, "original");
-    }
-
-    #[test]
-    fn eid_cookie_sync_conflict_matching_value_stops_after_one_write() {
-        let ec_id = snapshot_ec_id();
-        let mut concurrent = live_entry();
-        concurrent.ids.insert(
-            "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "desired-uid".to_owned(),
-            },
-        );
-        let lookups = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let writes = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let store = EidConflictEcKv::new(
-            concurrent,
-            std::sync::Arc::clone(&lookups),
-            std::sync::Arc::clone(&writes),
-        );
-        store.seed_live(&ec_id);
-        let graph = KvIdentityGraph::new(store);
-        let snapshot = graph.load_snapshot(&ec_id);
-
-        let (snapshot, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[PartnerIdUpdate::new("ssp_x", "desired-uid")],
-            snapshot,
-        );
-
-        assert_eq!(outcome, EidCookieSyncOutcome::ConflictMatched);
-        assert_eq!(
-            snapshot
-                .entry_for(&ec_id)
-                .and_then(|entry| entry.ids.get("ssp_x"))
-                .map(|id| id.uid.as_str()),
-            Some("desired-uid"),
-            "the authoritative follow-up snapshot should replace stale request state"
-        );
-        assert_eq!(
-            lookups.load(std::sync::atomic::Ordering::Relaxed),
-            2,
-            "a conflict should perform exactly one follow-up read"
-        );
-        assert_eq!(
-            writes.load(std::sync::atomic::Ordering::Relaxed),
-            1,
-            "a conflict must not trigger another conditional write"
-        );
-    }
-
-    #[test]
-    fn eid_cookie_sync_keeps_live_proof_when_conflict_follow_up_misses() {
-        let ec_id = snapshot_ec_id();
-        let lookups = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let writes = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let store = EidConflictEcKv::new(
-            live_entry(),
-            std::sync::Arc::clone(&lookups),
-            std::sync::Arc::clone(&writes),
-        )
-        .with_follow_up_miss();
-        store.seed_live(&ec_id);
-        let graph = KvIdentityGraph::new(store);
-
-        let (snapshot, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[PartnerIdUpdate::new("ssp_x", "desired-uid")],
-            EcKvSnapshot::Missing {
-                ec_id: ec_id.clone(),
-            },
-        );
-
-        assert_eq!(outcome, EidCookieSyncOutcome::DeferredConflict);
-        assert!(
-            snapshot.entry_for(&ec_id).is_some(),
-            "the live pre-write row should prevent conflict deferral from entering orphan recovery"
-        );
-        assert_eq!(
-            snapshot.generation_for(&ec_id),
-            None,
-            "a failed CAS must not return its rejected generation"
-        );
-        assert_eq!(
-            lookups.load(std::sync::atomic::Ordering::Relaxed),
-            2,
-            "the initial refresh and conflict follow-up should be the only reads"
-        );
-        assert_eq!(
-            writes.load(std::sync::atomic::Ordering::Relaxed),
-            1,
-            "the conflict must remain the request's only conditional write"
-        );
-    }
-
-    #[test]
-    fn eid_cookie_sync_reports_proven_refresh_miss_as_deferred() {
-        let ec_id = snapshot_ec_id();
-        let graph = KvIdentityGraph::in_memory("empty-store");
-        let proven = EcKvSnapshot::Present {
-            ec_id: ec_id.clone(),
-            entry: Box::new(live_entry()),
-            generation: None,
-        };
-
-        let (snapshot, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[PartnerIdUpdate::new("ssp_x", "desired-uid")],
-            proven,
-        );
-
-        assert!(
-            snapshot.entry_for(&ec_id).is_some(),
-            "the add-confirmed row should survive an eventually consistent miss"
-        );
-        assert_eq!(
-            outcome,
-            EidCookieSyncOutcome::DeferredStaleRead,
-            "a row already proven to exist should report a deferred stale read"
-        );
-    }
-
-    #[test]
-    fn partner_id_conflict_match_uses_last_duplicate_value() {
-        let mut entry = live_entry();
-        entry.ids.insert(
-            "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "latest-uid".to_owned(),
-            },
-        );
-        let updates = [
-            PartnerIdUpdate::new("ssp_x", "older-uid"),
-            PartnerIdUpdate::new("ssp_x", "latest-uid"),
-        ];
-
-        assert!(
-            partner_id_updates_match(&entry, &updates),
-            "conflict matching should use the same last-value-wins rule as writes"
-        );
-    }
-
-    #[test]
-    fn eid_cookie_sync_conflicting_value_defers_after_one_write() {
-        let ec_id = snapshot_ec_id();
-        let mut concurrent = live_entry();
-        concurrent.ids.insert(
-            "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "concurrent-uid".to_owned(),
-            },
-        );
-        let lookups = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let writes = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let store = EidConflictEcKv::new(
-            concurrent,
-            std::sync::Arc::clone(&lookups),
-            std::sync::Arc::clone(&writes),
-        );
-        store.seed_live(&ec_id);
-        let graph = KvIdentityGraph::new(store);
-        let snapshot = graph.load_snapshot(&ec_id);
-
-        let (_, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[PartnerIdUpdate::new("ssp_x", "stale-uid")],
-            snapshot,
-        );
-
-        assert_eq!(outcome, EidCookieSyncOutcome::DeferredConflict);
-        assert_eq!(
-            lookups.load(std::sync::atomic::Ordering::Relaxed),
-            2,
-            "a conflict should perform exactly one follow-up read"
-        );
-        assert_eq!(
-            writes.load(std::sync::atomic::Ordering::Relaxed),
-            1,
-            "a conflict must not trigger another conditional write"
-        );
-        let (stored, _) = graph
-            .get(&ec_id)
-            .expect("should read concurrent row")
-            .expect("row should remain");
-        assert_eq!(stored.ids["ssp_x"].uid, "concurrent-uid");
-    }
-
-    #[test]
-    fn eid_cookie_sync_preserves_concurrent_withdrawal_after_conflict() {
-        let ec_id = snapshot_ec_id();
-        let lookups = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let writes = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let store = EidConflictEcKv::new(
-            KvEntry::tombstone(2_000),
-            std::sync::Arc::clone(&lookups),
-            std::sync::Arc::clone(&writes),
-        );
-        store.seed_live(&ec_id);
-        let graph = KvIdentityGraph::new(store);
-        let snapshot = graph.load_snapshot(&ec_id);
-
-        let (snapshot, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[PartnerIdUpdate::new("ssp_x", "desired-uid")],
-            snapshot,
-        );
-
-        assert_eq!(outcome, EidCookieSyncOutcome::ConsentWithdrawn);
-        assert!(
-            snapshot
-                .entry_for(&ec_id)
-                .is_some_and(|entry| !entry.consent.ok),
-            "the refreshed withdrawal tombstone must remain authoritative"
-        );
-        assert_eq!(
-            lookups.load(std::sync::atomic::Ordering::Relaxed),
-            2,
-            "a conflict should perform exactly one follow-up read"
-        );
-        assert_eq!(
-            writes.load(std::sync::atomic::Ordering::Relaxed),
-            1,
-            "a conflict must not trigger another conditional write"
-        );
-    }
-
-    #[test]
-    fn eid_cookie_sync_defers_different_values_without_value_owned_freshness() {
-        let ec_id = snapshot_ec_id();
-        let graph = KvIdentityGraph::in_memory("freshness-store");
-        let mut entry = live_entry();
-        entry.ids.insert(
-            "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "protected-uid".to_owned(),
-            },
-        );
-        graph.create(&ec_id, &entry).expect("should seed entry");
-
-        let (_, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[PartnerIdUpdate::new("ssp_x", "incoming-uid")],
-            graph.load_snapshot(&ec_id),
-        );
-
-        assert_eq!(outcome, EidCookieSyncOutcome::DeferredFreshness);
-        let (stored, _) = graph
-            .get(&ec_id)
-            .expect("should read protected row")
-            .expect("row should remain");
-        assert_eq!(stored.ids["ssp_x"].uid, "protected-uid");
-    }
-
-    #[test]
-    fn eid_cookie_sync_adds_missing_ids_while_deferring_different_values() {
-        let ec_id = snapshot_ec_id();
-        let graph = KvIdentityGraph::in_memory("mixed-freshness-store");
-        let mut entry = live_entry();
-        entry.ids.insert(
-            "ssp_x".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "protected-uid".to_owned(),
-            },
-        );
-        graph.create(&ec_id, &entry).expect("should seed entry");
-
-        let (_, outcome) = graph.sync_eid_cookie_updates_from_snapshot(
-            &ec_id,
-            &[
-                PartnerIdUpdate::new("ssp_x", "different-uid"),
-                PartnerIdUpdate::new("ssp_y", "new-uid"),
-            ],
-            graph.load_snapshot(&ec_id),
-        );
-
-        assert_eq!(outcome, EidCookieSyncOutcome::WrittenWithDeferredFreshness);
-        let (stored, _) = graph
-            .get(&ec_id)
-            .expect("should read updated row")
-            .expect("row should remain");
-        assert_eq!(stored.ids["ssp_x"].uid, "protected-uid");
-        assert_eq!(stored.ids["ssp_y"].uid, "new-uid");
-    }
-
-    #[test]
-    fn evaluate_cluster_returns_stored_value_without_store_io() {
-        let kv = KvIdentityGraph::failing("nonexistent_store_for_cluster_cache_test");
-        let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let mut entry = live_entry();
-        entry.network = Some(KvNetwork {
-            cluster_size: Some(5),
-        });
-
-        let cluster_size = kv
-            .evaluate_cluster(&ec_id, &entry, 0)
-            .expect("should not touch store when cluster_size is already known");
-
-        assert_eq!(
-            cluster_size,
-            Some(5),
-            "should return stored cluster_size without re-listing keys"
-        );
-    }
-
-    #[test]
-    fn evaluate_cluster_skips_tombstone_without_store_io() {
-        let kv = KvIdentityGraph::failing("nonexistent_store_for_tombstone_cluster_test");
-        let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let entry = KvEntry::tombstone(1000);
-
-        let cluster_size = kv
-            .evaluate_cluster(&ec_id, &entry, 0)
-            .expect("should not touch store for tombstone entries");
-
-        assert_eq!(
-            cluster_size, None,
-            "should not evaluate or write cluster_size for tombstones"
-        );
+        assert_eq!(entry.ids["ssp_x"].first_uid(), Some("original"));
     }
 
     #[test]
@@ -3139,7 +2639,7 @@ mod tests {
             .expect("should read persisted entry")
             .expect("should retain entry after conflict");
         assert_eq!(
-            entry.ids.get("ssp_x").map(|id| id.uid.as_str()),
+            entry.ids.get("ssp_x").and_then(|id| id.first_uid()),
             Some("uid-1"),
             "should persist requested UID after retry"
         );
@@ -3176,7 +2676,7 @@ mod tests {
             .entry_for(&ec_id)
             .expect("should retain persisted entry");
         assert_eq!(
-            entry.ids.get("ssp_x").map(|id| id.uid.as_str()),
+            entry.ids.get("ssp_x").and_then(|id| id.first_uid()),
             Some("uid-1")
         );
         assert_eq!(
@@ -3607,7 +3107,7 @@ mod tests {
             outcome
                 .entry_for(&ec_id)
                 .and_then(|entry| entry.ids.get("ssp_x"))
-                .map(|id| id.uid.as_str()),
+                .and_then(|id| id.first_uid()),
             Some("uid-1")
         );
         assert_eq!(
@@ -3695,7 +3195,7 @@ mod tests {
             outcome
                 .entry_for(&ec_id)
                 .and_then(|entry| entry.ids.get("ssp_x"))
-                .map(|id| id.uid.as_str()),
+                .and_then(|id| id.first_uid()),
             Some("uid-1"),
             "the fifth CAS attempt must still succeed after a refresh and four conflicts"
         );
@@ -3715,7 +3215,7 @@ mod tests {
             .entry_for(&ec_id)
             .expect("should persist re-merged entry");
         assert_eq!(
-            entry.ids.get("ssp_x").map(|id| id.uid.as_str()),
+            entry.ids.get("ssp_x").and_then(|id| id.first_uid()),
             Some("uid-1"),
             "conflict must re-merge our update onto the concurrently revived row"
         );
@@ -3742,9 +3242,10 @@ mod tests {
         );
 
         assert_eq!(
-            outcome
-                .entry_for(&ec_id)
-                .and_then(|entry| entry.ids.get("ssp_x").map(|id| id.uid.clone())),
+            outcome.entry_for(&ec_id).and_then(|entry| entry
+                .ids
+                .get("ssp_x")
+                .and_then(|id| id.first_uid().map(str::to_owned))),
             Some("uid-1".to_owned()),
             "a stale miss must be revalidated before the updates are dropped"
         );
@@ -3753,7 +3254,7 @@ mod tests {
             .expect("should read store")
             .expect("row should remain");
         assert_eq!(
-            stored.ids.get("ssp_x").map(|id| id.uid.as_str()),
+            stored.ids.get("ssp_x").and_then(|id| id.first_uid()),
             Some("uid-1"),
             "the revalidated update must reach the store"
         );
diff --git a/crates/trusted-server-core/src/ec/kv_backend.rs b/crates/trusted-server-core/src/ec/kv_backend.rs
index bfe74ca6f3..01f6ed2825 100644
--- a/crates/trusted-server-core/src/ec/kv_backend.rs
+++ b/crates/trusted-server-core/src/ec/kv_backend.rs
@@ -11,6 +11,8 @@
 //! expressed through [`EcKvWriteMode`] so compare-and-swap loops stay in
 //! core while the platform supplies the actual precondition mechanics.
 
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU32, Ordering};
 use std::time::Duration;
 
 use error_stack::Report;
@@ -64,13 +66,22 @@ pub enum EcKvWriteOutcome {
     PreconditionFailed,
 }
 
+/// Attached to an [`EcKvStore::insert`] error when the platform refused the
+/// write under its per-key write rate limit, so a caller that can wait may
+/// try again after [`EcKvStore::pause`].
+#[derive(Debug, Clone, Copy)]
+pub struct EcKvRateLimited;
+
 /// Raw KV store primitives backing the EC identity graph.
 ///
 /// Implementations map these operations onto the platform KV API.
 /// Infrastructure failures are reported as [`TrustedServerError::KvStore`];
 /// write precondition failures are part of the normal control flow and are
 /// returned as [`EcKvWriteOutcome::PreconditionFailed`] instead of errors.
-pub trait EcKvStore {
+///
+/// `Send + Sync` so a [`super::kv::KvIdentityGraph`] can be built once and
+/// held in shared application state.
+pub trait EcKvStore: Send + Sync {
     /// Returns the platform store name, used in log and error messages.
     fn store_name(&self) -> &str;
 
@@ -115,8 +126,9 @@ pub trait EcKvStore {
     /// # Errors
     ///
     /// Returns [`TrustedServerError::KvStore`] on store open or write
-    /// failure. Precondition failures are reported through the
-    /// [`EcKvWriteOutcome`] instead.
+    /// failure, with an [`EcKvRateLimited`] attachment when the platform's
+    /// per-key write limit refused it. Precondition failures are reported
+    /// through the [`EcKvWriteOutcome`] instead.
     fn insert(
         &self,
         key: &str,
@@ -169,13 +181,260 @@ pub trait EcKvStore {
     ///
     /// Returns [`TrustedServerError::KvStore`] on store open or delete failure.
     fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>>;
+
+    /// Blocks the request for `duration`, so a write made after the response
+    /// was sent can outlast the platform's per-key write limit.
+    ///
+    /// The default returns at once, for platforms and test doubles that have
+    /// no such limit.
+    fn pause(&self, duration: Duration) {
+        let _ = duration;
+    }
+}
+
+impl<S: EcKvStore + ?Sized> EcKvStore for Arc<S> {
+    fn store_name(&self) -> &str {
+        self.as_ref().store_name()
+    }
+
+    fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+        self.as_ref().lookup(key)
+    }
+
+    fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+        self.as_ref().key_exists(key)
+    }
+
+    fn insert(
+        &self,
+        key: &str,
+        write: EcKvWrite<'_>,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        self.as_ref().insert(key, write)
+    }
+
+    fn list_keys_with_prefix(
+        &self,
+        prefix: &str,
+        limit: u32,
+    ) -> Result<Vec<String>, Report<TrustedServerError>> {
+        self.as_ref().list_keys_with_prefix(prefix, limit)
+    }
+
+    fn count_keys_with_prefix(
+        &self,
+        prefix: &str,
+        limit: u32,
+    ) -> Result<u32, Report<TrustedServerError>> {
+        self.as_ref().count_keys_with_prefix(prefix, limit)
+    }
+
+    fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+        self.as_ref().delete(key)
+    }
+
+    fn pause(&self, duration: Duration) {
+        self.as_ref().pause(duration);
+    }
+}
+
+/// Counts of KV operations one request makes, shared by every clone.
+///
+/// Reads are row lookups and writes are inserts and deletes. Existence
+/// checks and key listings are not counted: they read no row. A graph reports into it through
+/// [`KvIdentityGraph::with_operation_counts`](super::kv::KvIdentityGraph::with_operation_counts).
+#[derive(Debug, Clone, Default)]
+pub struct KvOperationCounts {
+    reads: Arc<AtomicU32>,
+    writes: Arc<AtomicU32>,
+}
+
+impl KvOperationCounts {
+    /// Reads counted so far.
+    #[must_use]
+    pub fn reads(&self) -> u32 {
+        self.reads.load(Ordering::Relaxed)
+    }
+
+    /// Writes counted so far.
+    #[must_use]
+    pub fn writes(&self) -> u32 {
+        self.writes.load(Ordering::Relaxed)
+    }
+
+    fn record_read(&self) {
+        self.reads.fetch_add(1, Ordering::Relaxed);
+    }
+
+    fn record_write(&self) {
+        self.writes.fetch_add(1, Ordering::Relaxed);
+    }
+}
+
+/// An [`EcKvStore`] that counts every operation it forwards.
+pub(crate) struct OperationCountingEcKv {
+    inner: Arc<dyn EcKvStore>,
+    counts: KvOperationCounts,
+}
+
+impl OperationCountingEcKv {
+    /// Wraps `inner`, reporting into `counts`.
+    pub(crate) fn new(inner: Arc<dyn EcKvStore>, counts: KvOperationCounts) -> Self {
+        Self { inner, counts }
+    }
+}
+
+impl EcKvStore for OperationCountingEcKv {
+    fn store_name(&self) -> &str {
+        self.inner.store_name()
+    }
+
+    fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+        self.counts.record_read();
+        self.inner.lookup(key)
+    }
+
+    fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+        self.inner.key_exists(key)
+    }
+
+    fn insert(
+        &self,
+        key: &str,
+        write: EcKvWrite<'_>,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        self.counts.record_write();
+        self.inner.insert(key, write)
+    }
+
+    fn list_keys_with_prefix(
+        &self,
+        prefix: &str,
+        limit: u32,
+    ) -> Result<Vec<String>, Report<TrustedServerError>> {
+        self.inner.list_keys_with_prefix(prefix, limit)
+    }
+
+    fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+        self.counts.record_write();
+        self.inner.delete(key)
+    }
+
+    fn pause(&self, duration: Duration) {
+        self.inner.pause(duration);
+    }
+}
+
+/// An in-memory store for tests, reachable from other crates through the
+/// `test-utils` feature.
+#[cfg(any(test, feature = "test-utils"))]
+pub mod in_memory {
+    use std::collections::BTreeMap;
+    use std::sync::Mutex;
+
+    use super::*;
+
+    /// In-memory [`EcKvStore`] with generation tracking for CAS tests.
+    pub struct InMemoryEcKv {
+        name: String,
+        entries: Mutex<BTreeMap<String, StoredEntry>>,
+    }
+
+    struct StoredEntry {
+        body: Vec<u8>,
+        metadata: Option<Vec<u8>>,
+        generation: u64,
+    }
+
+    impl InMemoryEcKv {
+        /// An empty store named `name`.
+        pub fn new(name: impl Into<String>) -> Self {
+            Self {
+                name: name.into(),
+                entries: Mutex::new(BTreeMap::new()),
+            }
+        }
+    }
+
+    impl EcKvStore for InMemoryEcKv {
+        fn store_name(&self) -> &str {
+            &self.name
+        }
+
+        fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+            let entries = self.entries.lock().expect("should lock in-memory store");
+            Ok(entries.get(key).map(|stored| EcKvLookup {
+                body: stored.body.clone(),
+                metadata: stored.metadata.clone(),
+                generation: stored.generation,
+            }))
+        }
+
+        fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+            let entries = self.entries.lock().expect("should lock in-memory store");
+            Ok(entries.contains_key(key))
+        }
+
+        fn insert(
+            &self,
+            key: &str,
+            write: EcKvWrite<'_>,
+        ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+            let mut entries = self.entries.lock().expect("should lock in-memory store");
+            let existing_generation = entries.get(key).map(|stored| stored.generation);
+
+            match write.mode {
+                EcKvWriteMode::Add if existing_generation.is_some() => {
+                    return Ok(EcKvWriteOutcome::PreconditionFailed);
+                }
+                EcKvWriteMode::IfGenerationMatch(expected)
+                    if existing_generation != Some(expected) =>
+                {
+                    return Ok(EcKvWriteOutcome::PreconditionFailed);
+                }
+                EcKvWriteMode::Add
+                | EcKvWriteMode::Overwrite
+                | EcKvWriteMode::IfGenerationMatch(_) => {}
+            }
+
+            entries.insert(
+                key.to_owned(),
+                StoredEntry {
+                    body: write.body.as_bytes().to_vec(),
+                    metadata: Some(write.metadata.as_bytes().to_vec()),
+                    generation: existing_generation.unwrap_or(0) + 1,
+                },
+            );
+            Ok(EcKvWriteOutcome::Written)
+        }
+
+        fn list_keys_with_prefix(
+            &self,
+            prefix: &str,
+            limit: u32,
+        ) -> Result<Vec<String>, Report<TrustedServerError>> {
+            let entries = self.entries.lock().expect("should lock in-memory store");
+            Ok(entries
+                .keys()
+                .filter(|key| key.starts_with(prefix))
+                .take(limit as usize)
+                .cloned()
+                .collect())
+        }
+
+        fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+            let mut entries = self.entries.lock().expect("should lock in-memory store");
+            entries.remove(key);
+            Ok(())
+        }
+    }
 }
 
 #[cfg(test)]
 pub(crate) mod test_support {
-    use std::collections::BTreeMap;
     use std::sync::Mutex;
 
+    pub(crate) use super::in_memory::InMemoryEcKv;
     use super::*;
 
     /// [`EcKvStore`] wrapper that counts `lookup` calls through a shared counter
@@ -312,100 +571,6 @@ pub(crate) mod test_support {
         }
     }
 
-    /// In-memory [`EcKvStore`] with generation tracking for CAS tests.
-    pub(crate) struct InMemoryEcKv {
-        name: String,
-        entries: Mutex<BTreeMap<String, StoredEntry>>,
-    }
-
-    struct StoredEntry {
-        body: Vec<u8>,
-        metadata: Option<Vec<u8>>,
-        generation: u64,
-    }
-
-    impl InMemoryEcKv {
-        pub(crate) fn new(name: impl Into<String>) -> Self {
-            Self {
-                name: name.into(),
-                entries: Mutex::new(BTreeMap::new()),
-            }
-        }
-    }
-
-    impl EcKvStore for InMemoryEcKv {
-        fn store_name(&self) -> &str {
-            &self.name
-        }
-
-        fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
-            let entries = self.entries.lock().expect("should lock in-memory store");
-            Ok(entries.get(key).map(|stored| EcKvLookup {
-                body: stored.body.clone(),
-                metadata: stored.metadata.clone(),
-                generation: stored.generation,
-            }))
-        }
-
-        fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
-            let entries = self.entries.lock().expect("should lock in-memory store");
-            Ok(entries.contains_key(key))
-        }
-
-        fn insert(
-            &self,
-            key: &str,
-            write: EcKvWrite<'_>,
-        ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
-            let mut entries = self.entries.lock().expect("should lock in-memory store");
-            let existing_generation = entries.get(key).map(|stored| stored.generation);
-
-            match write.mode {
-                EcKvWriteMode::Add if existing_generation.is_some() => {
-                    return Ok(EcKvWriteOutcome::PreconditionFailed);
-                }
-                EcKvWriteMode::IfGenerationMatch(expected)
-                    if existing_generation != Some(expected) =>
-                {
-                    return Ok(EcKvWriteOutcome::PreconditionFailed);
-                }
-                EcKvWriteMode::Add
-                | EcKvWriteMode::Overwrite
-                | EcKvWriteMode::IfGenerationMatch(_) => {}
-            }
-
-            entries.insert(
-                key.to_owned(),
-                StoredEntry {
-                    body: write.body.as_bytes().to_vec(),
-                    metadata: Some(write.metadata.as_bytes().to_vec()),
-                    generation: existing_generation.unwrap_or(0) + 1,
-                },
-            );
-            Ok(EcKvWriteOutcome::Written)
-        }
-
-        fn list_keys_with_prefix(
-            &self,
-            prefix: &str,
-            limit: u32,
-        ) -> Result<Vec<String>, Report<TrustedServerError>> {
-            let entries = self.entries.lock().expect("should lock in-memory store");
-            Ok(entries
-                .keys()
-                .filter(|key| key.starts_with(prefix))
-                .take(limit as usize)
-                .cloned()
-                .collect())
-        }
-
-        fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
-            let mut entries = self.entries.lock().expect("should lock in-memory store");
-            entries.remove(key);
-            Ok(())
-        }
-    }
-
     /// [`EcKvStore`] that fails every operation, mimicking a missing or
     /// unreachable platform store.
     pub(crate) struct FailingEcKv {
diff --git a/crates/trusted-server-core/src/ec/kv_types.rs b/crates/trusted-server-core/src/ec/kv_types.rs
index 589f280c11..86b2766a89 100644
--- a/crates/trusted-server-core/src/ec/kv_types.rs
+++ b/crates/trusted-server-core/src/ec/kv_types.rs
@@ -4,7 +4,8 @@
 //! EC identity graph. Each EC ID (`{64hex}.{6alnum}`) maps to a [`KvEntry`]
 //! containing consent state, geo location, and accumulated partner IDs.
 //!
-//! The schema is versioned (`v: 1`) to allow future migrations.
+//! The schema is versioned (`v: 2`). Version 1 rows, which hold one `uid` per
+//! source, still read and are written back as version 2.
 
 use std::collections::{BTreeMap, BTreeSet};
 
@@ -14,10 +15,11 @@ use crate::consent::ConsentContext;
 use crate::geo::GeoInfo;
 
 /// Current schema version for KV entries.
-pub const SCHEMA_VERSION: u8 = 1;
+pub const SCHEMA_VERSION: u8 = 2;
 
-// Unsupported schema versions fail closed on read. Future schema bumps must
-// add an explicit lazy migration or backfill path before changing this value.
+// Versions 1 and 2 read (see [`KvEntry::upgrade_for_read`]). Any other
+// version fails closed on read. Future schema bumps must add an explicit lazy
+// migration or backfill path before changing this value.
 
 /// Maximum number of publisher-domain entries accepted in
 /// [`KvPubProperties::seen_domains`].
@@ -34,11 +36,41 @@ pub const MAX_STORED_DOMAIN_LENGTH: usize = 255;
 /// validation.
 pub const MAX_UID_LENGTH: usize = 512;
 
+/// Maximum serialized bytes of a stored UID-level or EID-level `ext`.
+pub const MAX_PARTNER_EXT_BYTES: usize = 2048;
+/// Maximum bytes of a stored `inserter` or `matcher`.
+pub const MAX_EID_FIELD_BYTES: usize = 255;
+/// Maximum number of EID entries stored for one source.
+pub const MAX_ENTRIES_PER_SOURCE: usize = 8;
+/// Maximum number of UIDs stored for one source, across its entries.
+pub const MAX_UIDS_PER_SOURCE: usize = 32;
+/// Maximum bytes of one source's stored entry set, as measured by
+/// [`entry_set_bytes`].
+pub const MAX_ENTRY_SET_BYTES: usize = 4096;
+/// Maximum serialized bytes of one provider's private state (`ps.st`).
+pub const MAX_PROVIDER_STATE_BYTES: usize = 1024;
+/// Maximum number of providers with a `ps` entry in one row.
+pub const MAX_PROVIDER_STATES: usize = 32;
+/// Maximum number of UID hashes kept in each of a provider's `ps.iv` and
+/// `ps.ov` lists, enough for four whole 32-UID sets.
+pub const MAX_INVALIDATED_UIDS: usize = 128;
+/// Length of a record revision (`rv`) in lowercase hex digits.
+pub const RECORD_REVISION_HEX_LEN: usize = 16;
+/// Maximum length of an opt-out fingerprint (`ps.o.fp`) in lowercase hex
+/// digits.
+const OPT_OUT_FINGERPRINT_MAX_HEX_LEN: usize = 16;
+
 /// Full KV entry stored as the body of an EC identity graph record.
 ///
 /// **KV key:** Full EC ID (`{64hex}.{6alnum}`).
-/// **KV value:** JSON-serialized `KvEntry` (max ~5KB).
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+/// **KV value:** JSON-serialized `KvEntry`. This is a documented estimate, not
+/// an enforced limit (spec 6.1): a one-UID record is about 120 bytes, and a
+/// record at every cap is about 4.2 KB. With every cap reached, eight owned
+/// sources come to about 34 KB, plus 1 KB for each provider with state, and
+/// `ps.iv` and `ps.ov` add up to 2.4 KB each per provider. A row with two full
+/// sets and two stateful providers at every cap is about 15 KB, and typical
+/// sets are far smaller.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 pub struct KvEntry {
     /// Schema version — always [`SCHEMA_VERSION`].
     pub v: u8,
@@ -62,10 +94,22 @@ pub struct KvEntry {
     /// Populated by pixel sync, batch sync, and pull sync operations.
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub ids: BTreeMap<String, KvPartnerId>,
+    /// Per-provider scheduling, opt-out, removal and private state, keyed by
+    /// identity provider ID. Never sent to bidders.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub ps: BTreeMap<String, KvProviderState>,
+    /// The newest pending-key generation merged into this row (spec 5.3,
+    /// Pending key). Items at or below it are never merged again.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pg: Option<u64>,
+    /// Unix seconds of the row's last writer flush, which paces the SPA
+    /// writer (spec 5.1).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub wa: Option<u64>,
 }
 
 /// Consent state within a KV entry.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 pub struct KvConsent {
     /// Raw TCF v2 consent string.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -80,7 +124,7 @@ pub struct KvConsent {
 }
 
 /// Geo location within a KV entry.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
 pub struct KvGeo {
     /// ISO 3166-1 alpha-2 country code (e.g. `"US"`).
     pub country: String,
@@ -97,11 +141,225 @@ pub struct KvGeo {
     pub dma: Option<i64>,
 }
 
-/// A partner user ID within a KV entry.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+/// A source's record within a KV entry (spec 6.1).
+///
+/// Every record stores its source's entry set in `eids`. A version 1 record,
+/// which holds one `uid`, reads as one entry holding that UID.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+#[serde(from = "KvPartnerIdWire")]
 pub struct KvPartnerId {
-    /// The partner's user identifier.
-    pub uid: String,
+    /// Writer: an identity provider ID. Absent for browser ingest and
+    /// version 1 records.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub w: Option<String>,
+    /// Record revision: 16 lowercase hex digits, random on every write.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rv: Option<String>,
+    /// Unix seconds when the ID was acquired or last refreshed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub at: Option<u64>,
+    /// Unix seconds at or after which the ID must not be sent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub exp: Option<u64>,
+    /// Unix seconds after which the ID is due for refresh.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ra: Option<u64>,
+    /// Unix seconds after which the ID can no longer be refreshed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ru: Option<u64>,
+    /// The source's entry set, in order. Never empty in a valid record.
+    pub eids: Vec<KvEid>,
+}
+
+/// The stored shape of [`KvPartnerId`], which also reads version 1's `uid`.
+#[derive(Deserialize)]
+struct KvPartnerIdWire {
+    #[serde(default)]
+    uid: Option<String>,
+    #[serde(default)]
+    w: Option<String>,
+    #[serde(default)]
+    rv: Option<String>,
+    #[serde(default)]
+    at: Option<u64>,
+    #[serde(default)]
+    exp: Option<u64>,
+    #[serde(default)]
+    ra: Option<u64>,
+    #[serde(default)]
+    ru: Option<u64>,
+    #[serde(default)]
+    eids: Vec<KvEid>,
+}
+
+impl From<KvPartnerIdWire> for KvPartnerId {
+    fn from(wire: KvPartnerIdWire) -> Self {
+        let eids = match (wire.eids.is_empty(), wire.uid) {
+            (true, Some(uid)) => vec![KvEid::one_uid(uid)],
+            (_, _) => wire.eids,
+        };
+        Self {
+            w: wire.w,
+            rv: wire.rv,
+            at: wire.at,
+            exp: wire.exp,
+            ra: wire.ra,
+            ru: wire.ru,
+            eids,
+        }
+    }
+}
+
+impl KvPartnerId {
+    /// A record holding one entry with one UID, and no metadata.
+    #[must_use]
+    pub fn new(uid: impl Into<String>) -> Self {
+        Self {
+            eids: vec![KvEid::one_uid(uid.into())],
+            ..Self::default()
+        }
+    }
+
+    /// A browser-ingested record: no writer, with its acquisition time.
+    #[must_use]
+    pub fn browser(uid: impl Into<String>, acquired_at: Option<u64>) -> Self {
+        Self {
+            at: acquired_at,
+            ..Self::new(uid)
+        }
+    }
+
+    /// The first UID of the first entry, which `/identify` returns and
+    /// today's one-UID readers use.
+    #[must_use]
+    pub fn first_uid(&self) -> Option<&str> {
+        self.eids
+            .first()
+            .and_then(|entry| entry.uids.first())
+            .map(|uid| uid.id.as_str())
+    }
+}
+
+/// One EID entry of a record (spec 6.1).
+///
+/// The `OpenRTB` EID object without `source`, which the `ids` key holds.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct KvEid {
+    /// The entry's UIDs, in order. Never empty in a valid record.
+    pub uids: Vec<KvUid>,
+    /// `eid.inserter`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub inserter: Option<String>,
+    /// `eid.matcher`. Absent means `source`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub matcher: Option<String>,
+    /// `eid.mm`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mm: Option<i32>,
+    /// EID-level `ext`, at most [`MAX_PARTNER_EXT_BYTES`] serialized bytes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ext: Option<serde_json::Value>,
+}
+
+impl KvEid {
+    /// One entry holding one UID and nothing else: the shape browser
+    /// ingest, generic pull and batch sync write.
+    fn one_uid(id: String) -> Self {
+        Self {
+            uids: vec![KvUid {
+                id,
+                atype: None,
+                ext: None,
+            }],
+            ..Self::default()
+        }
+    }
+}
+
+/// One UID of a stored entry.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct KvUid {
+    /// The user identifier.
+    pub id: String,
+    /// `uid.atype`. Absent: use the partner's `openrtb_atype`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub atype: Option<i32>,
+    /// UID-level `ext`, at most [`MAX_PARTNER_EXT_BYTES`] serialized bytes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ext: Option<serde_json::Value>,
+}
+
+/// A provider's sticky opt-out (spec 8).
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct KvOptOut {
+    /// Unix seconds when the opt-out was reported.
+    pub at: u64,
+    /// The consent bits the provider's policy read then, as a lowercase hex
+    /// bitmask of at most 16 digits. Plain, not keyed (spec 8).
+    pub fp: String,
+}
+
+/// Per-provider state in a KV row (`ps.<provider>`).
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct KvProviderState {
+    /// Unix seconds before which the provider must not be called.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub n: Option<u64>,
+    /// Consecutive failures, for backoff.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub f: u32,
+    /// Sticky opt-out.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub o: Option<KvOptOut>,
+    /// When the provider's opt-out was last cleared.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub oc: Option<u64>,
+    /// Unkeyed hashes of UIDs the owner invalidated, oldest first, at most
+    /// [`MAX_INVALIDATED_UIDS`]. Never emptied (spec 5.4).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub iv: Vec<String>,
+    /// Unkeyed hashes of UIDs the provider's opt-out removed, oldest first,
+    /// at most [`MAX_INVALIDATED_UIDS`]. Emptied when the opt-out clears.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub ov: Vec<String>,
+    /// The provider's private state as embedded JSON. KV only.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub st: Option<serde_json::Value>,
+}
+
+fn is_zero(value: &u32) -> bool {
+    *value == 0
+}
+
+/// Bytes of a stored entry set as compact JSON: the array of entries without
+/// `source`, as `eids` stores it. Both `validate` and the coordinator measure
+/// [`MAX_ENTRY_SET_BYTES`] with this function.
+pub(crate) fn entry_set_bytes(set: &[KvEid]) -> usize {
+    serde_json::to_vec(set).map_or(usize::MAX, |bytes| bytes.len())
+}
+
+/// Whether `value` is non-empty lowercase hex of at most `max_len` digits.
+///
+/// Shared by the `rv` and `ps.o.fp` checks.
+pub(crate) fn is_lowercase_hex(value: &str, max_len: usize) -> bool {
+    !value.is_empty()
+        && value.len() <= max_len
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+/// Whether an `inserter` or `matcher` is stored-valid: not blank and at most
+/// [`MAX_EID_FIELD_BYTES`] bytes.
+pub(crate) fn is_valid_eid_field(value: &str) -> bool {
+    !value.trim().is_empty() && value.len() <= MAX_EID_FIELD_BYTES
+}
+
+/// Whether a UID-level or EID-level `ext` is stored-valid: a JSON object of at
+/// most [`MAX_PARTNER_EXT_BYTES`] bytes as compact JSON.
+pub(crate) fn is_valid_partner_ext(ext: &serde_json::Value) -> bool {
+    ext.is_object()
+        && serde_json::to_vec(ext).is_ok_and(|bytes| bytes.len() <= MAX_PARTNER_EXT_BYTES)
 }
 
 /// Publisher property metadata captured when an EC entry is created.
@@ -293,6 +551,9 @@ impl KvEntry {
             device: None,
             network: None,
             ids: BTreeMap::new(),
+            ps: BTreeMap::new(),
+            pg: None,
+            wa: None,
         }
     }
 
@@ -303,12 +564,7 @@ impl KvEntry {
     #[must_use]
     pub fn minimal(partner_id: &str, uid: &str, now: u64) -> Self {
         let mut ids = BTreeMap::new();
-        ids.insert(
-            partner_id.to_owned(),
-            KvPartnerId {
-                uid: uid.to_owned(),
-            },
-        );
+        ids.insert(partner_id.to_owned(), KvPartnerId::new(uid));
         Self {
             v: SCHEMA_VERSION,
             created: now,
@@ -328,6 +584,9 @@ impl KvEntry {
             device: None,
             network: None,
             ids,
+            ps: BTreeMap::new(),
+            pg: None,
+            wa: None,
         }
     }
 
@@ -360,6 +619,9 @@ impl KvEntry {
             device: None,
             network: None,
             ids: BTreeMap::new(),
+            ps: BTreeMap::new(),
+            pg: None,
+            wa: None,
         }
     }
 
@@ -380,11 +642,35 @@ impl KvEntry {
             ));
         }
 
-        for (partner_id, partner_uid) in &self.ids {
-            if partner_uid.uid.len() > MAX_UID_LENGTH {
+        for (partner_id, record) in &self.ids {
+            validate_record(partner_id, record)?;
+        }
+
+        if self.ps.len() > MAX_PROVIDER_STATES {
+            return Err(format!(
+                "ps exceeds MAX_PROVIDER_STATES ({})",
+                self.ps.len()
+            ));
+        }
+        for (provider, state) in &self.ps {
+            for (name, hashes) in [("iv", &state.iv), ("ov", &state.ov)] {
+                if hashes.len() > MAX_INVALIDATED_UIDS {
+                    return Err(format!(
+                        "ps '{provider}' {name} exceeds {MAX_INVALIDATED_UIDS} hashes"
+                    ));
+                }
+            }
+            if let Some(opt_out) = &state.o
+                && !is_lowercase_hex(&opt_out.fp, OPT_OUT_FINGERPRINT_MAX_HEX_LEN)
+            {
+                return Err(format!("ps '{provider}' o.fp is not a hex bitmask"));
+            }
+            if let Some(st) = &state.st
+                && serde_json::to_vec(st)
+                    .map_or(true, |bytes| bytes.len() > MAX_PROVIDER_STATE_BYTES)
+            {
                 return Err(format!(
-                    "partner ID '{partner_id}' exceeds MAX_UID_LENGTH ({})",
-                    partner_uid.uid.len()
+                    "ps '{provider}' st exceeds {MAX_PROVIDER_STATE_BYTES} bytes"
                 ));
             }
         }
@@ -417,6 +703,117 @@ impl KvEntry {
 
         Ok(())
     }
+
+    /// Brings a row read from KV to the current schema (spec 6.1).
+    ///
+    /// Accepts schema versions 1 and 2 and sets the version to 2. Drops each
+    /// record that breaks a rule of spec 4.5 or 6.1, and returns one message
+    /// per dropped record, naming the source and the rule, never a UID.
+    /// Called on read only, before [`Self::validate`], so one bad record
+    /// never makes the row unreadable.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error naming the version when the row's version is
+    /// neither 1 nor 2.
+    pub(crate) fn upgrade_for_read(&mut self) -> Result<Vec<String>, String> {
+        if !(1..=SCHEMA_VERSION).contains(&self.v) {
+            return Err(format!(
+                "unsupported KV entry schema version {} (expected 1 or {})",
+                self.v, SCHEMA_VERSION
+            ));
+        }
+        self.v = SCHEMA_VERSION;
+        let mut messages = Vec::new();
+        self.ids.retain(
+            |partner_id, record| match validate_record(partner_id, record) {
+                Ok(()) => true,
+                Err(message) => {
+                    messages.push(message);
+                    false
+                }
+            },
+        );
+        Ok(messages)
+    }
+}
+
+/// Checks one record against the limits of spec 4.5 and 6.1.
+///
+/// Messages name the partner ID and the rule and never a UID, so they are safe
+/// to log.
+fn validate_record(partner_id: &str, record: &KvPartnerId) -> Result<(), String> {
+    if record.eids.is_empty() {
+        return Err(format!("partner ID '{partner_id}' has an empty eids"));
+    }
+    if let Some(rv) = &record.rv
+        && (rv.len() != RECORD_REVISION_HEX_LEN || !is_lowercase_hex(rv, RECORD_REVISION_HEX_LEN))
+    {
+        return Err(format!(
+            "partner ID '{partner_id}' rv is not {RECORD_REVISION_HEX_LEN} hex digits"
+        ));
+    }
+    if record.eids.len() > MAX_ENTRIES_PER_SOURCE {
+        return Err(format!(
+            "partner ID '{partner_id}' has more than {MAX_ENTRIES_PER_SOURCE} entries"
+        ));
+    }
+    let mut uid_count = 0;
+    for entry in &record.eids {
+        if entry.uids.is_empty() {
+            return Err(format!(
+                "partner ID '{partner_id}' has an entry without a uid"
+            ));
+        }
+        for (name, value) in [("inserter", &entry.inserter), ("matcher", &entry.matcher)] {
+            if value
+                .as_deref()
+                .is_some_and(|value| !is_valid_eid_field(value))
+            {
+                return Err(format!(
+                    "partner ID '{partner_id}' {name} is blank or over {MAX_EID_FIELD_BYTES} bytes"
+                ));
+            }
+        }
+        if entry.mm.is_some_and(|mm| mm < 0) {
+            return Err(format!("partner ID '{partner_id}' mm is negative"));
+        }
+        validate_ext(partner_id, entry.ext.as_ref())?;
+        for uid in &entry.uids {
+            if uid.id.trim().is_empty() || uid.id.len() > MAX_UID_LENGTH {
+                return Err(format!(
+                    "partner ID '{partner_id}' has a blank uid or one over MAX_UID_LENGTH ({MAX_UID_LENGTH})"
+                ));
+            }
+            if uid.atype.is_some_and(|atype| atype < 0) {
+                return Err(format!("partner ID '{partner_id}' atype is negative"));
+            }
+            validate_ext(partner_id, uid.ext.as_ref())?;
+        }
+        uid_count += entry.uids.len();
+    }
+    if uid_count > MAX_UIDS_PER_SOURCE {
+        return Err(format!(
+            "partner ID '{partner_id}' has more than {MAX_UIDS_PER_SOURCE} uids"
+        ));
+    }
+    if entry_set_bytes(&record.eids) > MAX_ENTRY_SET_BYTES {
+        return Err(format!(
+            "partner ID '{partner_id}' entry set exceeds {MAX_ENTRY_SET_BYTES} bytes"
+        ));
+    }
+    Ok(())
+}
+
+/// Checks an optional UID-level or EID-level `ext` with
+/// [`is_valid_partner_ext`].
+fn validate_ext(partner_id: &str, ext: Option<&serde_json::Value>) -> Result<(), String> {
+    if ext.is_some_and(|ext| !is_valid_partner_ext(ext)) {
+        return Err(format!(
+            "partner ID '{partner_id}' ext is not an object of at most {MAX_PARTNER_EXT_BYTES} bytes"
+        ));
+    }
+    Ok(())
 }
 
 impl KvMetadata {
@@ -463,6 +860,7 @@ impl KvGeo {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use serde_json::json;
 
     fn sample_consent_context() -> ConsentContext {
         ConsentContext {
@@ -490,12 +888,9 @@ mod tests {
         let geo = sample_geo_info();
         let consent = sample_consent_context();
         let mut entry = KvEntry::new(&consent, Some(&geo), 1_741_824_000, "example.com");
-        entry.ids.insert(
-            "liveramp".to_owned(),
-            KvPartnerId {
-                uid: "LR_xyz".to_owned(),
-            },
-        );
+        entry
+            .ids
+            .insert("liveramp".to_owned(), KvPartnerId::new("LR_xyz"));
 
         let json = serde_json::to_string(&entry).expect("should serialize KvEntry");
         let deserialized: KvEntry =
@@ -514,7 +909,7 @@ mod tests {
         assert_eq!(deserialized.geo.asn, Some(7922));
         assert_eq!(deserialized.geo.dma, Some(807));
         assert_eq!(
-            deserialized.ids.get("liveramp").map(|p| p.uid.as_str()),
+            deserialized.ids.get("liveramp").and_then(|p| p.first_uid()),
             Some("LR_xyz"),
         );
         assert!(
@@ -560,7 +955,7 @@ mod tests {
             entry
                 .ids
                 .get("liveramp")
-                .map(|partner| partner.uid.as_str()),
+                .and_then(|partner| partner.first_uid()),
             Some("abc")
         );
         assert!(
@@ -737,9 +1132,7 @@ mod tests {
         let mut entry = KvEntry::tombstone(1000);
         entry.ids.insert(
             "ssp_x".to_owned(),
-            KvPartnerId {
-                uid: "x".repeat(MAX_UID_LENGTH + 1),
-            },
+            KvPartnerId::new("x".repeat(MAX_UID_LENGTH + 1)),
         );
 
         let err = entry
@@ -853,7 +1246,7 @@ mod tests {
         );
         assert_eq!(entry.ids.len(), 1);
         let partner = entry.ids.get("ssp_x").expect("should have ssp_x entry");
-        assert_eq!(partner.uid, "abc123");
+        assert_eq!(partner.first_uid(), Some("abc123"));
     }
 
     #[test]
@@ -1206,4 +1599,405 @@ mod tests {
             "known_browser should default to None"
         );
     }
+
+    fn kv_uid(id: &str, atype: Option<i32>) -> KvUid {
+        KvUid {
+            id: id.to_owned(),
+            atype,
+            ext: None,
+        }
+    }
+
+    fn kv_eid(uids: Vec<KvUid>) -> KvEid {
+        KvEid {
+            uids,
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
+    }
+
+    /// The set of spec 6.1's `example-ids.example.com` record.
+    fn example_full_set() -> Vec<KvEid> {
+        vec![
+            KvEid {
+                uids: vec![
+                    kv_uid("example-a", Some(1)),
+                    KvUid {
+                        id: "example-b".to_owned(),
+                        atype: Some(3),
+                        ext: Some(json!({ "stype": "ppuid" })),
+                    },
+                ],
+                inserter: Some("example.com".to_owned()),
+                matcher: None,
+                mm: Some(3),
+                ext: None,
+            },
+            KvEid {
+                uids: vec![kv_uid("example-c", Some(1))],
+                inserter: None,
+                matcher: Some("partner.example.com".to_owned()),
+                mm: None,
+                ext: None,
+            },
+        ]
+    }
+
+    fn with_set(set: Vec<KvEid>) -> KvEntry {
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+        entry.ids.get_mut("example.com").expect("should exist").eids = set;
+        entry
+    }
+
+    #[test]
+    fn golden_version_1_row_reads_as_one_entry_records_and_writes_version_2() {
+        let main_row = json!({
+            "v": 1,
+            "created": 1_760_000_000,
+            "consent": { "ok": true, "updated": 1_760_000_000 },
+            "geo": { "country": "US" },
+            "ids": {
+                "id5-sync.com": { "uid": "ID5*example" },
+                "sharedid.org": { "uid": "example-shared-id" }
+            }
+        });
+
+        let mut entry: KvEntry =
+            serde_json::from_value(main_row).expect("should read a row from main");
+        let messages = entry.upgrade_for_read().expect("should accept version 1");
+        entry.validate().expect("should be valid once upgraded");
+
+        assert!(
+            messages.is_empty(),
+            "should drop nothing from a valid version 1 row"
+        );
+        assert_eq!(
+            entry.ids["id5-sync.com"],
+            KvPartnerId::new("ID5*example"),
+            "should read uid as one entry"
+        );
+        assert_eq!(
+            serde_json::to_value(&entry).expect("should write"),
+            json!({
+                "v": 2,
+                "created": 1_760_000_000,
+                "consent": { "ok": true, "updated": 1_760_000_000 },
+                "geo": { "country": "US" },
+                "ids": {
+                    "id5-sync.com": { "eids": [{ "uids": [{ "id": "ID5*example" }] }] },
+                    "sharedid.org": { "eids": [{ "uids": [{ "id": "example-shared-id" }] }] }
+                }
+            }),
+            "should write version 2, with no uid key and no ps"
+        );
+    }
+
+    #[test]
+    fn version_2_row_and_provider_state_round_trip() {
+        let stored = json!({
+            "v": 2,
+            "created": 1_760_000_000,
+            "consent": { "ok": true, "updated": 1_760_000_000 },
+            "geo": { "country": "US" },
+            "ids": {
+                "id5-sync.com": {
+                    "w": "id5",
+                    "rv": "9c1d04b7e6a83f2a",
+                    "at": 1_760_000_000,
+                    "exp": 1_767_776_000,
+                    "ra": 1_760_086_400,
+                    "ru": 1_770_000_000,
+                    "eids": [{ "uids": [{ "id": "ID5*example", "atype": 1, "ext": { "linkType": 2 } }] }]
+                },
+                "example-ids.example.com": {
+                    "w": "exampleid",
+                    "rv": "4be71f0c2d9a6e35",
+                    "at": 1_760_000_000,
+                    "eids": [
+                        {
+                            "uids": [
+                                { "id": "example-a", "atype": 1 },
+                                { "id": "example-b", "atype": 3, "ext": { "stype": "ppuid" } }
+                            ],
+                            "inserter": "example.com",
+                            "mm": 3
+                        },
+                        {
+                            "uids": [{ "id": "example-c", "atype": 1 }],
+                            "matcher": "partner.example.com"
+                        }
+                    ]
+                }
+            },
+            "ps": {
+                "id5": {
+                    "n": 1_760_003_600,
+                    "f": 1,
+                    "o": { "at": 1_759_000_000, "fp": "1a" },
+                    "oc": 1_759_500_000,
+                    "iv": ["aaaaaaaaaaaaaaaa"],
+                    "ov": ["bbbbbbbbbbbbbbbb"],
+                    "st": { "signature": "example-opaque-state" }
+                }
+            }
+        });
+
+        let entry: KvEntry = serde_json::from_value(stored.clone()).expect("should read");
+        entry.validate().expect("should be valid");
+        assert_eq!(
+            serde_json::to_value(&entry).expect("should write"),
+            stored,
+            "should round-trip exactly"
+        );
+        assert_eq!(
+            entry.ids["example-ids.example.com"].eids,
+            example_full_set(),
+            "should read the set whole and in order"
+        );
+    }
+
+    #[test]
+    fn a_record_reads_its_eids_and_its_version_1_uid_only_without_them() {
+        let both: KvPartnerId = serde_json::from_value(json!({
+            "uid": "stale-copy",
+            "eids": [{ "uids": [{ "id": "example-a" }] }]
+        }))
+        .expect("should read a record with both keys");
+        assert_eq!(
+            both.first_uid(),
+            Some("example-a"),
+            "should take eids over a uid copy"
+        );
+
+        let neither: KvPartnerId =
+            serde_json::from_value(json!({ "w": "exampleid" })).expect("should read");
+        assert!(
+            neither.eids.is_empty(),
+            "should read no entry from a record with neither key"
+        );
+        assert_eq!(neither.first_uid(), None, "should have no first UID");
+        with_set(Vec::new())
+            .validate()
+            .expect_err("should reject a record with an empty eids on write");
+    }
+
+    #[test]
+    fn upgrade_for_read_drops_bad_records_and_names_the_source_only() {
+        let mut set = example_full_set();
+        set[1].matcher = Some("  ".to_owned());
+        let mut entry = with_set(set);
+        entry.ids.insert(
+            "sharedid.org".to_owned(),
+            KvPartnerId::new("example-shared-id"),
+        );
+        entry.v = 1;
+
+        let messages = entry.upgrade_for_read().expect("should accept the row");
+
+        assert_eq!(entry.v, SCHEMA_VERSION, "should upgrade the version");
+        assert_eq!(messages.len(), 1, "should report one dropped record");
+        assert!(
+            messages[0].contains("example.com"),
+            "should name the source"
+        );
+        assert!(
+            !messages[0].contains("example-a"),
+            "should never name a UID"
+        );
+        assert!(
+            !entry.ids.contains_key("example.com"),
+            "should drop the bad record"
+        );
+        assert_eq!(
+            entry.ids["sharedid.org"],
+            KvPartnerId::new("example-shared-id"),
+            "should leave a valid record alone"
+        );
+        entry.validate().expect("should validate once upgraded");
+
+        let mut future = KvEntry::minimal("example.com", "example-uid", 1);
+        future.v = SCHEMA_VERSION + 1;
+        future
+            .upgrade_for_read()
+            .expect_err("should reject a version it does not know");
+    }
+
+    #[test]
+    fn entry_set_bytes_measures_the_stored_array() {
+        let set = example_full_set();
+        let bytes = serde_json::to_vec(&set).expect("should serialize the set");
+
+        assert_eq!(
+            entry_set_bytes(&set),
+            bytes.len(),
+            "should measure the stored array"
+        );
+        assert!(
+            !String::from_utf8(bytes)
+                .expect("should be UTF-8")
+                .contains("\"source\""),
+            "should measure entries without source"
+        );
+    }
+
+    #[test]
+    fn validate_rejects_entry_set_limits() {
+        let rejects = |entry: &KvEntry, field: &str| {
+            let error = entry
+                .validate()
+                .expect_err(&format!("should reject {field}"));
+            assert!(error.contains(field), "should name {field}, got {error}");
+        };
+
+        rejects(&with_set(Vec::new()), "eids");
+
+        let mut set = example_full_set();
+        set[0].ext = Some(json!({ "pad": "x".repeat(MAX_PARTNER_EXT_BYTES) }));
+        rejects(&with_set(set), "ext");
+
+        let mut set = example_full_set();
+        set[0].uids[0].ext = Some(json!("not an object"));
+        rejects(&with_set(set), "ext");
+
+        let mut set = example_full_set();
+        set[0].inserter = Some("  ".to_owned());
+        rejects(&with_set(set), "inserter");
+
+        let mut set = example_full_set();
+        set[1].matcher = Some("m".repeat(MAX_EID_FIELD_BYTES + 1));
+        rejects(&with_set(set), "matcher");
+
+        let mut set = example_full_set();
+        set[0].mm = Some(-1);
+        rejects(&with_set(set), "mm");
+
+        let mut set = example_full_set();
+        set[0].uids[1].atype = Some(-1);
+        rejects(&with_set(set), "atype");
+
+        let mut set = example_full_set();
+        set[1].uids[0].id = " ".to_owned();
+        rejects(&with_set(set), "uid");
+
+        let mut set = example_full_set();
+        set[1].uids.clear();
+        rejects(&with_set(set), "uid");
+
+        let nine_entries = (0..=MAX_ENTRIES_PER_SOURCE)
+            .map(|index| kv_eid(vec![kv_uid(&format!("example-{index}"), None)]))
+            .collect();
+        rejects(&with_set(nine_entries), "entries");
+
+        let thirty_three_uids = (0..=MAX_UIDS_PER_SOURCE)
+            .map(|index| kv_uid(&format!("example-{index}"), None))
+            .collect();
+        rejects(&with_set(vec![kv_eid(thirty_three_uids)]), "uids");
+
+        let oversized = (0..4)
+            .map(|index| KvEid {
+                ext: Some(json!({ "pad": "x".repeat(1_100) })),
+                ..kv_eid(vec![kv_uid(&format!("example-{index}"), None)])
+            })
+            .collect();
+        rejects(&with_set(oversized), "entry set");
+
+        let mut old = with_set(example_full_set());
+        old.v = 1;
+        rejects(&old, "version");
+
+        with_set(example_full_set())
+            .validate()
+            .expect("should accept the control set");
+    }
+
+    #[test]
+    fn validate_rejects_oversized_state_and_too_many_providers() {
+        let with_state = |state: KvProviderState| {
+            let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+            entry.ps.insert("id5".to_owned(), state);
+            entry
+        };
+        let hashes = |count: usize| vec!["a".repeat(16); count];
+
+        let error = with_state(KvProviderState {
+            st: Some(json!("x".repeat(MAX_PROVIDER_STATE_BYTES))),
+            ..KvProviderState::default()
+        })
+        .validate()
+        .expect_err("should reject st");
+        assert!(error.contains("st"), "should name st");
+
+        for (name, state) in [
+            (
+                "iv",
+                KvProviderState {
+                    iv: hashes(MAX_INVALIDATED_UIDS + 1),
+                    ..KvProviderState::default()
+                },
+            ),
+            (
+                "ov",
+                KvProviderState {
+                    ov: hashes(MAX_INVALIDATED_UIDS + 1),
+                    ..KvProviderState::default()
+                },
+            ),
+            (
+                "fp",
+                KvProviderState {
+                    o: Some(KvOptOut {
+                        at: 1,
+                        fp: "XYZ".to_owned(),
+                    }),
+                    ..KvProviderState::default()
+                },
+            ),
+        ] {
+            let error = with_state(state)
+                .validate()
+                .expect_err(&format!("should reject {name}"));
+            assert!(error.contains(name), "should name {name}, got {error}");
+        }
+        with_state(KvProviderState {
+            iv: hashes(MAX_INVALIDATED_UIDS),
+            ov: hashes(MAX_INVALIDATED_UIDS),
+            o: Some(KvOptOut {
+                at: 1,
+                fp: "1a".to_owned(),
+            }),
+            ..KvProviderState::default()
+        })
+        .validate()
+        .expect("should accept 128 hashes in each list and a hex fingerprint");
+
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+        for index in 0..=MAX_PROVIDER_STATES {
+            entry
+                .ps
+                .insert(format!("p{index}"), KvProviderState::default());
+        }
+        assert!(
+            entry
+                .validate()
+                .expect_err("should reject ps size")
+                .contains("ps"),
+            "should name ps"
+        );
+
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+        entry.ids.get_mut("example.com").expect("should exist").rv = Some("not-hex".to_owned());
+        assert!(
+            entry
+                .validate()
+                .expect_err("should reject rv")
+                .contains("rv"),
+            "should name rv"
+        );
+
+        KvEntry::minimal("example.com", "example-uid", 1)
+            .validate()
+            .expect("should accept the control entry");
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/mod.rs b/crates/trusted-server-core/src/ec/mod.rs
index f24c489edd..6b1d4706f7 100644
--- a/crates/trusted-server-core/src/ec/mod.rs
+++ b/crates/trusted-server-core/src/ec/mod.rs
@@ -33,6 +33,7 @@ mod auth;
 
 pub mod admin;
 pub mod batch_sync;
+pub(crate) mod client_eids;
 pub mod consent;
 pub mod cookies;
 pub mod device;
@@ -40,13 +41,13 @@ pub mod eids;
 pub mod finalize;
 pub mod generation;
 pub mod identify;
+pub mod identity;
 pub mod kv;
 pub mod kv_backend;
 pub mod kv_types;
 pub mod partner;
 pub mod prebid_eids;
 pub mod pull_sync;
-pub(crate) mod pull_sync_marker;
 pub mod rate_limiter;
 pub mod registry;
 
@@ -67,32 +68,43 @@ pub fn log_id(ec_id: &str) -> String {
     format!("{prefix}\u{2026}")
 }
 
+use std::sync::Arc;
+
 use cookie::CookieJar;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
-use http::Request;
+use http::{Request, header};
+use url::Url;
 
 use crate::consent::{self as consent_mod, ConsentContext, ConsentPipelineInput};
-use crate::constants::{COOKIE_TS_EC, COOKIE_TS_EC_PULL_COMPLETE};
+use crate::constants::{COOKIE_TS_EC, COOKIE_TS_EC_REVOKED};
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
-use crate::openrtb::Eid;
+use crate::http_util::{is_document_navigation, is_prefetch_request};
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 use device::DeviceSignals;
 
-use self::kv::{CreateIfAbsentOutcome, KvIdentityGraph};
+use self::finalize::BrowserSeed;
+use self::identity::measurement::{IdentityMeasurement, MeasurementInput, RouteKind};
+use self::identity::request::{RequestIdentity, WriterDecision};
+use self::identity::runtime::IdentityRuntime;
+use self::kv::{CreateIfAbsentOutcome, KvIdentityGraph, apply_partner_id_updates};
 use self::kv_types::KvEntry;
-use self::pull_sync_marker::{PullSyncMarkerState, validate_marker_state};
+use self::rate_limiter::RateLimiter;
 
-/// Bounded request classifications that may persist browser EID cookies.
+/// Bounded request classifications that may stage browser EID cookies.
 ///
 /// Adapters classify publisher navigations and `POST /auction` only after
 /// pre-route filters allow dispatch. The shared page-bids handler classifies an
 /// admitted SPA navigation, while EC finalization classifies new identities.
-/// Challenged or blocked requests remain unclassified and cannot persist EIDs.
+/// Challenged or blocked requests remain unclassified and cannot stage EIDs.
+///
+/// Only [`Self::NewEc`] still reports an `EID sync measurement` line. A
+/// returning visitor's request reports the `identity request measurement`
+/// line instead, which carries no source label.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
 pub enum EidSyncSource {
     /// Publisher top-level document navigation.
@@ -174,6 +186,9 @@ impl EcKvSnapshot {
     }
 }
 
+/// Create attempts a new EC makes, each with a fresh ID after a collision.
+const MAX_CREATE_ATTEMPTS: usize = 5;
+
 pub use generation::{
     ec_hash, generate_ec_id, is_valid_ec_hash, is_valid_ec_id, normalize_ec_id_for_kv,
 };
@@ -182,8 +197,6 @@ pub use generation::{
 struct RequestEc {
     /// EC ID from the `ts-ec` cookie, if present.
     cookie_ec: Option<String>,
-    /// Pull-sync completeness marker, if present.
-    pull_sync_marker: Option<String>,
     /// The parsed cookie jar (retained for consent pipeline input).
     jar: Option<CookieJar>,
 }
@@ -200,17 +213,7 @@ fn parse_ec_from_request(req: &Request<EdgeBody>) -> Result<RequestEc, Report<Tr
         .and_then(|j| j.get(COOKIE_TS_EC))
         .map(cookie::Cookie::value)
         .and_then(|value| request_ec_id_if_allowed(value, "ts-ec cookie"));
-    let pull_sync_marker = jar
-        .as_ref()
-        .and_then(|j| j.get(COOKIE_TS_EC_PULL_COMPLETE))
-        .map(cookie::Cookie::value)
-        .map(str::to_owned);
-
-    Ok(RequestEc {
-        cookie_ec,
-        pull_sync_marker,
-        jar,
-    })
+    Ok(RequestEc { cookie_ec, jar })
 }
 
 fn request_ec_id_if_allowed(value: &str, source: &str) -> Option<String> {
@@ -272,16 +275,19 @@ pub struct EcContext {
     kv_snapshot: EcKvSnapshot,
     /// Whether this request may rotate an orphaned EC identity.
     recovery_eligible: bool,
-    /// EIDs the route resolved from the current request: the `/auction` JSON
-    /// body, or the `ts-eids` cookie when the body carried none. Carried to
-    /// response finalization so KV ingestion can use the full set the client
-    /// sent instead of being limited to whatever fits in the size-capped
-    /// `ts-eids` cookie.
-    client_eids: Option<Vec<Eid>>,
-    /// Browser-carried proof of recent pull-partner completeness.
-    pull_sync_marker: PullSyncMarkerState,
     /// Allowed returning-user EID persistence source, assigned only after request filters pass.
     eid_sync_source: Option<EidSyncSource>,
+    /// Identity state this request decides and collects.
+    identity: RequestIdentity,
+    /// Withdrawn EC IDs whose before-send tombstone returned
+    /// [`EcKvSnapshot::Failed`], for the after-send retry.
+    failed_withdrawals: Vec<String>,
+    /// The `ts-ec-revoked` marker the request carried: the consent
+    /// fingerprint a global revoke saw (spec 8).
+    revoke_marker: Option<String>,
+    /// The row of an EC minted by [`EcContext::mint_deferred`], created after
+    /// the hold dispatch.
+    deferred_create: Option<Box<KvEntry>>,
 }
 
 impl EcContext {
@@ -361,9 +367,25 @@ impl EcContext {
             device_signals: None,
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
-            client_eids: None,
-            pull_sync_marker: PullSyncMarkerState::from_cookie(parsed.pull_sync_marker),
             eid_sync_source: None,
+            identity: {
+                let mut identity = RequestIdentity::default();
+                identity.set_cookie_header_bytes(
+                    req.headers()
+                        .get_all(header::COOKIE)
+                        .iter()
+                        .map(|value| value.as_bytes().len())
+                        .sum(),
+                );
+                identity
+            },
+            failed_withdrawals: Vec::new(),
+            revoke_marker: parsed
+                .jar
+                .as_ref()
+                .and_then(|jar| jar.get(COOKIE_TS_EC_REVOKED))
+                .map(|cookie| cookie.value().to_owned()),
+            deferred_create: None,
         })
     }
 
@@ -376,6 +398,10 @@ impl EcContext {
     /// If an EC ID already exists (from the request), this is a no-op.
     /// If consent does not permit EC creation, this is a no-op.
     ///
+    /// The new row carries `seed`, the request's browser ingest, so a new
+    /// visitor's create is the one write (spec 5.2 phase 1). Pass
+    /// [`BrowserSeed::empty`] when there is nothing to seed.
+    ///
     /// # Errors
     ///
     /// Returns an error if the client IP is unavailable and generation is
@@ -384,9 +410,88 @@ impl EcContext {
         &mut self,
         settings: &Settings,
         kv: Option<&KvIdentityGraph>,
+        seed: &BrowserSeed,
     ) -> Result<(), Report<TrustedServerError>> {
-        if self.ec_value.is_some() {
+        let Some(entry) = self.new_entry_if_needed(settings, seed) else {
+            return Ok(());
+        };
+        self.create_entry(settings, kv, entry, MAX_CREATE_ATTEMPTS)
+    }
+
+    /// Mints an EC ID as [`generate_if_needed`](Self::generate_if_needed)
+    /// would, but keeps its row for
+    /// [`complete_deferred_create`](Self::complete_deferred_create), so a new
+    /// visitor's hold-mode providers can join the create (spec 4.7).
+    ///
+    /// No row exists until the create, so nothing may disclose the ID before
+    /// it: the hold dispatch calls no provider that reads it.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the client IP is unavailable or HMAC generation
+    /// fails.
+    pub fn mint_deferred(
+        &mut self,
+        settings: &Settings,
+        seed: &BrowserSeed,
+    ) -> Result<(), Report<TrustedServerError>> {
+        let Some(entry) = self.new_entry_if_needed(settings, seed) else {
+            return Ok(());
+        };
+        let ec_id = generation::generate_ec_id(settings, self.require_client_ip()?)?;
+        log::info!(
+            "Minted new EC ID with a deferred create: {}",
+            log_id(&ec_id)
+        );
+        self.ec_value = Some(ec_id);
+        self.ec_generated = true;
+        self.deferred_create = Some(Box::new(entry));
+        Ok(())
+    }
+
+    /// Creates the row [`mint_deferred`](Self::mint_deferred) kept, with
+    /// whatever the hold dispatch added. Does nothing without one.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the create fails or no unique ID is found.
+    pub fn complete_deferred_create(
+        &mut self,
+        settings: &Settings,
+        kv: Option<&KvIdentityGraph>,
+    ) -> Result<(), Report<TrustedServerError>> {
+        let Some(entry) = self.deferred_create.take() else {
             return Ok(());
+        };
+        // One attempt: the auction may already hold the minted ID, so a
+        // collision fails the create instead of minting another.
+        self.create_entry(settings, kv, *entry, 1)
+    }
+
+    /// Whether a minted EC still waits for its create.
+    #[must_use]
+    pub fn has_deferred_create(&self) -> bool {
+        self.deferred_create.is_some()
+    }
+
+    /// The row a minted EC will be created with.
+    #[must_use]
+    pub(crate) fn deferred_entry(&self) -> Option<&KvEntry> {
+        self.deferred_create.as_deref()
+    }
+
+    /// Replaces the row a minted EC will be created with.
+    pub(crate) fn set_deferred_entry(&mut self, entry: KvEntry) {
+        if self.deferred_create.is_some() {
+            self.deferred_create = Some(Box::new(entry));
+        }
+    }
+
+    /// The new row for a request without an EC whose consent allows one, or
+    /// `None` when it needs none.
+    fn new_entry_if_needed(&self, settings: &Settings, seed: &BrowserSeed) -> Option<KvEntry> {
+        if self.ec_value.is_some() {
+            return None;
         }
 
         if !consent::ec_consent_granted(&self.consent) {
@@ -394,32 +499,61 @@ impl EcContext {
                 "EC generation skipped: consent not granted (jurisdiction={})",
                 self.consent.jurisdiction,
             );
-            return Ok(());
+            return None;
+        }
+
+        if self.revoke_blocks_minting() {
+            log::info!("EC generation skipped: a global revoke holds until consent changes");
+            return None;
         }
 
-        let client_ip = self.client_ip.as_deref().ok_or_else(|| {
+        let mut entry = KvEntry::new(
+            &self.consent,
+            self.geo_info.as_ref(),
+            current_timestamp(),
+            &settings.publisher.domain,
+        );
+        entry.device = self
+            .device_signals
+            .as_ref()
+            .map(DeviceSignals::to_kv_device);
+        apply_partner_id_updates(&mut entry, seed.updates());
+        Some(entry)
+    }
+
+    fn require_client_ip(&self) -> Result<&str, Report<TrustedServerError>> {
+        self.client_ip.as_deref().ok_or_else(|| {
             Report::new(TrustedServerError::EdgeCookie {
                 message: "Client IP required for EC generation but unavailable".to_owned(),
             })
-        })?;
-
-        const MAX_CREATE_ATTEMPTS: usize = 5;
-        for attempt in 0..MAX_CREATE_ATTEMPTS {
-            let ec_id = generation::generate_ec_id(settings, client_ip)?;
-            log::info!("Generated new EC ID: {}", log_id(&ec_id));
-            let now = current_timestamp();
-            let mut entry = KvEntry::new(
-                &self.consent,
-                self.geo_info.as_ref(),
-                now,
-                &settings.publisher.domain,
-            );
-            entry.device = self
-                .device_signals
-                .as_ref()
-                .map(DeviceSignals::to_kv_device);
+        })
+    }
+
+    /// Creates `entry` under the minted EC ID, or a fresh one, retrying an ID
+    /// collision with a fresh ID.
+    fn create_entry(
+        &mut self,
+        settings: &Settings,
+        kv: Option<&KvIdentityGraph>,
+        entry: KvEntry,
+        max_attempts: usize,
+    ) -> Result<(), Report<TrustedServerError>> {
+        let client_ip = self.require_client_ip()?.to_owned();
+        let mut minted = self.ec_value.take();
+        self.ec_generated = false;
+
+        for attempt in 0..max_attempts {
+            let ec_id = match minted.take() {
+                Some(ec_id) => ec_id,
+                None => {
+                    let ec_id = generation::generate_ec_id(settings, &client_ip)?;
+                    log::info!("Generated new EC ID: {}", log_id(&ec_id));
+                    ec_id
+                }
+            };
 
             if let Some(graph) = kv {
+                self.identity.record_create_attempt();
                 match graph.create_if_absent(&ec_id, &entry) {
                     Ok(CreateIfAbsentOutcome::Written) => {
                         self.kv_snapshot = EcKvSnapshot::Present {
@@ -430,7 +564,7 @@ impl EcContext {
                     }
                     Ok(CreateIfAbsentOutcome::AlreadyExists) => {
                         log::warn!(
-                            "Generated EC ID collision on attempt {}/{MAX_CREATE_ATTEMPTS}",
+                            "Generated EC ID collision on attempt {}/{max_attempts}",
                             attempt + 1
                         );
                         continue;
@@ -450,14 +584,11 @@ impl EcContext {
 
             self.ec_value = Some(ec_id);
             self.ec_generated = true;
-            self.pull_sync_marker.invalidate_for_replaced_ec();
             return Ok(());
         }
 
         Err(Report::new(TrustedServerError::EdgeCookie {
-            message: format!(
-                "Failed to allocate a unique EC ID after {MAX_CREATE_ATTEMPTS} attempts"
-            ),
+            message: format!("Failed to allocate a unique EC ID after {max_attempts} attempts"),
         }))
     }
 
@@ -513,6 +644,209 @@ impl EcContext {
         self.device_signals = Some(signals);
     }
 
+    /// Builds the `identity request measurement` for this request after
+    /// phase 4 (spec 14, step 1).
+    ///
+    /// The route kind is `new_ec` for a request that generated an EC,
+    /// `writer` for the one browser-driven writer, and `stager` otherwise.
+    #[must_use]
+    pub fn identity_measurement(&self, input: &MeasurementInput<'_>) -> IdentityMeasurement {
+        let route = if self.ec_generated {
+            RouteKind::NewEc
+        } else if self.identity.writer() {
+            RouteKind::Writer
+        } else {
+            RouteKind::Stager
+        };
+        IdentityMeasurement {
+            cookie_header_bytes: self.identity.cookie_header_bytes(),
+            route,
+            // A snapshot that came from the new-EC create read nothing, and
+            // each create attempt is one write made before routing.
+            kv_reads: input
+                .kv_reads
+                .saturating_add(u32::from(
+                    input.phase_one_read && self.identity.create_attempts() == 0,
+                ))
+                .saturating_add(self.identity.capture_kv_reads()),
+            // The capture's pre-send reads and writes go through the
+            // request-state graph, which the adapter's counters do not see.
+            kv_writes: input
+                .kv_writes
+                .saturating_add(self.identity.create_attempts())
+                .saturating_add(self.identity.capture_kv_writes()),
+            flush: input.flush.copied(),
+            removal_lost: self.identity.removal_lost(),
+            removal_deferred: self.identity.removal_deferred(),
+            withdrawal_after_send: input.withdrawal_after_send,
+            withdrawal_after_send_failed: input.withdrawal_after_send_failed,
+            capture_unpersisted: self.identity.capture_unpersisted().clone(),
+        }
+    }
+
+    /// Asks finalize to run the consent-withdrawal tombstone path for this
+    /// request, as a `revoke_scope = "global"` capture does from any client
+    /// (spec 8).
+    pub(crate) fn request_global_revoke(&mut self) {
+        self.identity.request_global_revoke();
+    }
+
+    /// Whether the request carries a global-revoke marker for its own
+    /// consent, which stops EC minting (spec 8).
+    #[must_use]
+    pub(crate) fn revoke_blocks_minting(&self) -> bool {
+        self.revoke_marker.as_deref() == Some(cookies::revoke_marker_value(&self.consent).as_str())
+    }
+
+    /// Whether the request carries a global-revoke marker at all.
+    #[must_use]
+    pub(crate) fn has_revoke_marker(&self) -> bool {
+        self.revoke_marker.is_some()
+    }
+
+    /// Sets the request's global-revoke marker, as if it carried the cookie.
+    #[cfg(test)]
+    pub(crate) fn set_revoke_marker_for_test(&mut self, marker: &str) {
+        self.revoke_marker = Some(marker.to_owned());
+    }
+
+    /// Whether a capture asked for the consent-withdrawal tombstone path.
+    /// The adapter gives finalize the identity graph when it did.
+    #[must_use]
+    pub fn global_revoke_requested(&self) -> bool {
+        self.identity.global_revoke_requested()
+    }
+
+    /// The identity state this request decides and collects.
+    #[must_use]
+    pub(crate) fn identity(&self) -> &RequestIdentity {
+        &self.identity
+    }
+
+    /// The identity state this request decides and collects, to fill.
+    pub(crate) fn identity_mut(&mut self) -> &mut RequestIdentity {
+        &mut self.identity
+    }
+
+    /// Gives the request the identity runtime built for the settings load.
+    ///
+    /// The adapter calls this where it builds the request's EC state.
+    pub fn set_identity_runtime(&mut self, runtime: Arc<IdentityRuntime>) {
+        self.identity.set_runtime(runtime);
+    }
+
+    /// Turns the `ts-eids-s` mirror on for this request, keeping its provider
+    /// catalog, or with no provider when it has no runtime yet.
+    #[cfg(test)]
+    pub(crate) fn enable_mirror_for_test(&mut self) {
+        let runtime = match self.identity_runtime() {
+            Some(runtime) => runtime.with_mirror_enabled(),
+            None => IdentityRuntime::from_settings_with_providers(
+                &crate::test_support::tests::create_test_settings(),
+                Vec::new(),
+                std::collections::BTreeMap::new(),
+            )
+            .expect("should build an empty runtime")
+            .with_mirror_enabled(),
+        };
+        self.set_identity_runtime(Arc::new(runtime));
+    }
+
+    /// Gives the request the limiter that counts provider calls for the burst
+    /// cap and the circuit breaker before the response is sent.
+    pub fn set_identity_rate_limiter(&mut self, limiter: Arc<dyn RateLimiter + Send + Sync>) {
+        self.identity.set_rate_limiter(limiter);
+    }
+
+    /// The identity runtime, when the adapter set one.
+    #[must_use]
+    pub(crate) fn identity_runtime(&self) -> Option<&IdentityRuntime> {
+        self.identity.runtime().map(Arc::as_ref)
+    }
+
+    /// Records whether the request passed the real-browser check, for a route
+    /// that is never the writer.
+    pub fn set_real_browser(&mut self, is_real_browser: bool) {
+        self.identity.set_real_browser(is_real_browser);
+    }
+
+    /// Decides whether this request is the one browser-driven identity writer.
+    ///
+    /// Only an organic real-browser top-level document navigation that is not
+    /// a prefetch writes (spec 5.1). Also captures the user agent, `DNT` and
+    /// the page URL without query or fragment.
+    ///
+    /// The page URL is read from the request URI, so it needs an absolute
+    /// URI. The Fastly adapter gives one (`edgezero-adapter-fastly` builds the
+    /// request from `get_url_str()`); a request with an origin-form URI has no
+    /// page URL, and a provider that wants the `PageUrl` input is then not
+    /// due.
+    pub fn decide_writer(
+        &mut self,
+        req: &Request<EdgeBody>,
+        organic_route: bool,
+        is_real_browser: bool,
+    ) {
+        let writer = organic_route
+            && is_document_navigation(req)
+            && !is_prefetch_request(req)
+            && is_real_browser;
+        let user_agent = req
+            .headers()
+            .get(header::USER_AGENT)
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_owned);
+        let dnt = req
+            .headers()
+            .get("dnt")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.trim() == "1");
+        let page_url = Url::parse(&req.uri().to_string()).ok().map(|mut url| {
+            url.set_query(None);
+            url.set_fragment(None);
+            url
+        });
+        self.identity.set_writer_decision(WriterDecision {
+            writer,
+            is_real_browser,
+            user_agent,
+            dnt,
+            page_url,
+        });
+    }
+
+    /// Decides whether a `/_ts/page-bids` call is the SPA writer (spec 5.1):
+    /// a real browser, `Sec-Fetch-Site: same-origin` and an interval above
+    /// zero. The flush then checks the interval against the row's last
+    /// writer flush. Reads the real-browser flag set earlier with
+    /// [`set_real_browser`](Self::set_real_browser).
+    pub fn decide_spa_writer(&mut self, req: &Request<EdgeBody>, interval_sec: u64) {
+        let same_origin = req
+            .headers()
+            .get("sec-fetch-site")
+            .and_then(|value| value.to_str().ok())
+            == Some("same-origin");
+        if !(same_origin && interval_sec > 0 && self.identity.is_real_browser()) {
+            return;
+        }
+        self.identity.set_writer_decision(WriterDecision {
+            writer: true,
+            is_real_browser: true,
+            user_agent: req
+                .headers()
+                .get(header::USER_AGENT)
+                .and_then(|value| value.to_str().ok())
+                .map(str::to_owned),
+            dnt: req
+                .headers()
+                .get("dnt")
+                .and_then(|value| value.to_str().ok())
+                .is_some_and(|value| value.trim() == "1"),
+            page_url: None,
+        });
+        self.identity.set_spa_writer(true);
+    }
+
     /// Returns the device signals, if set.
     #[must_use]
     pub fn device_signals(&self) -> Option<&DeviceSignals> {
@@ -537,6 +871,49 @@ impl EcContext {
         &self.kv_snapshot
     }
 
+    /// Returns the withdrawn EC IDs whose tombstone has failed and not yet
+    /// succeeded.
+    ///
+    /// Before the after-send retry these are the before-send failures. After
+    /// it, only the IDs that failed a second time remain, which is what the
+    /// failure counters count.
+    #[must_use]
+    pub(crate) fn failed_withdrawals(&self) -> &[String] {
+        &self.failed_withdrawals
+    }
+
+    /// Whether any withdrawn EC ID's tombstone is still unwritten.
+    #[must_use]
+    pub fn has_failed_withdrawals(&self) -> bool {
+        !self.failed_withdrawals.is_empty()
+    }
+
+    /// Whether a capture removal write failed before send and awaits its
+    /// one retry after send.
+    #[must_use]
+    pub fn has_pending_removals(&self) -> bool {
+        self.identity.pending_removals().is_some()
+    }
+
+    /// Whether a capture kept positive writes for the pending key, which
+    /// [`identity::flush::defer_capture_writes`] appends after send.
+    #[must_use]
+    pub fn has_capture_writes(&self) -> bool {
+        !self.identity.capture_writes().is_empty()
+    }
+
+    /// Forgets a withdrawn EC ID whose retried tombstone was written.
+    pub(crate) fn clear_failed_withdrawal(&mut self, ec_id: &str) {
+        self.failed_withdrawals.retain(|id| id != ec_id);
+    }
+
+    /// Records a withdrawn EC ID whose before-send tombstone failed.
+    pub(crate) fn record_failed_withdrawal(&mut self, ec_id: &str) {
+        if !self.failed_withdrawals.iter().any(|id| id == ec_id) {
+            self.failed_withdrawals.push(ec_id.to_owned());
+        }
+    }
+
     /// Replaces the request-scoped identity-graph snapshot.
     pub fn set_kv_snapshot(&mut self, snapshot: EcKvSnapshot) {
         self.kv_snapshot = snapshot;
@@ -564,55 +941,11 @@ impl EcContext {
         self.recovery_eligible
     }
 
-    /// Records the current request's own EIDs (e.g. an `/auction` body) for
-    /// use by response finalization's KV ingestion.
-    pub(crate) fn set_client_eids(&mut self, eids: Vec<Eid>) {
-        self.client_eids = Some(eids);
-    }
-
-    /// Returns the current request's own EIDs, if the route captured any.
-    #[must_use]
-    pub(crate) fn client_eids(&self) -> Option<&[Eid]> {
-        self.client_eids.as_deref()
-    }
-
-    /// Validates a browser completeness marker against the active EC and partner set.
-    pub(crate) fn validate_pull_sync_marker(
-        &mut self,
-        settings: &Settings,
-        registry: &registry::PartnerRegistry,
-    ) {
-        validate_marker_state(
-            &mut self.pull_sync_marker,
-            settings,
-            registry,
-            self.ec_value.as_deref(),
-        );
-    }
-
-    /// Returns the current pull-sync marker state.
-    #[must_use]
-    pub(crate) fn pull_sync_marker(&self) -> &PullSyncMarkerState {
-        &self.pull_sync_marker
-    }
-
-    /// Returns mutable pull-sync marker state for response reconciliation.
-    pub(crate) fn pull_sync_marker_mut(&mut self) -> &mut PullSyncMarkerState {
-        &mut self.pull_sync_marker
-    }
-
-    /// Sets pull-sync marker state in focused unit tests.
-    #[cfg(test)]
-    pub(crate) fn set_pull_sync_marker_for_test(&mut self, state: PullSyncMarkerState) {
-        self.pull_sync_marker = state;
-    }
-
     /// Replaces an orphaned active ID after its new backing row is persisted.
     pub(crate) fn replace_with_generated(&mut self, ec_id: String, snapshot: EcKvSnapshot) {
         self.ec_value = Some(ec_id);
         self.ec_generated = true;
         self.kv_snapshot = snapshot;
-        self.pull_sync_marker.invalidate_for_replaced_ec();
     }
 
     /// Returns whether EC creation is permitted by consent for this request.
@@ -662,12 +995,34 @@ impl EcContext {
             device_signals: None,
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
-            client_eids: None,
-            pull_sync_marker: PullSyncMarkerState::Absent,
             eid_sync_source: None,
+            identity: RequestIdentity::default(),
+            failed_withdrawals: Vec::new(),
+            revoke_marker: None,
+            deferred_create: None,
         }
     }
 
+    /// Creates a test-only [`EcContext`] for a real browser's writer
+    /// navigation, with explicit client IP.
+    #[cfg(test)]
+    #[must_use]
+    pub fn new_writer_for_test_with_ip(
+        ec_value: Option<String>,
+        consent: ConsentContext,
+        client_ip: Option<String>,
+    ) -> Self {
+        let mut context = Self::new_for_test_with_ip(ec_value, consent, client_ip);
+        context.identity.set_writer_decision(WriterDecision {
+            writer: true,
+            is_real_browser: true,
+            user_agent: None,
+            dnt: false,
+            page_url: None,
+        });
+        context
+    }
+
     /// Creates a test-only [`EcContext`] with explicit client IP.
     #[cfg(test)]
     #[must_use]
@@ -687,9 +1042,11 @@ impl EcContext {
             device_signals: None,
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
-            client_eids: None,
-            pull_sync_marker: PullSyncMarkerState::Absent,
             eid_sync_source: None,
+            identity: RequestIdentity::default(),
+            failed_withdrawals: Vec::new(),
+            revoke_marker: None,
+            deferred_create: None,
         }
     }
 
@@ -715,9 +1072,11 @@ impl EcContext {
             device_signals: None,
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
-            client_eids: None,
-            pull_sync_marker: PullSyncMarkerState::Absent,
             eid_sync_source: None,
+            identity: RequestIdentity::default(),
+            failed_withdrawals: Vec::new(),
+            revoke_marker: None,
+            deferred_create: None,
         }
     }
 }
@@ -773,6 +1132,128 @@ mod tests {
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
 
+    #[test]
+    fn decide_spa_writer_needs_a_same_origin_browser_and_an_interval() {
+        let page_bids = |site: Option<&str>| {
+            let mut builder = Request::builder()
+                .uri("https://www.example.com/_ts/page-bids?path=/a")
+                .header("x-tsjs-page-bids", "1");
+            if let Some(site) = site {
+                builder = builder.header("sec-fetch-site", site);
+            }
+            builder
+                .body(EdgeBody::empty())
+                .expect("should build the request")
+        };
+        let decide = |request: &Request<EdgeBody>, browser: bool, interval: u64| {
+            let mut context = EcContext::default();
+            context.set_real_browser(browser);
+            context.decide_spa_writer(request, interval);
+            (context.identity().writer(), context.identity().spa_writer())
+        };
+
+        assert_eq!(
+            decide(&page_bids(Some("same-origin")), true, 300),
+            (true, true),
+            "should make a same-origin browser page-bids call the SPA writer"
+        );
+        for (name, request, browser, interval) in [
+            ("no Sec-Fetch-Site", page_bids(None), true, 300),
+            ("same-site", page_bids(Some("same-site")), true, 300),
+            ("not a browser", page_bids(Some("same-origin")), false, 300),
+            ("interval off", page_bids(Some("same-origin")), true, 0),
+        ] {
+            assert_eq!(
+                decide(&request, browser, interval),
+                (false, false),
+                "should not be the writer: {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn decide_writer_needs_every_condition() {
+        let navigation = || {
+            Request::builder()
+                .uri("https://www.example.com/a?b=c#d")
+                .header("sec-fetch-dest", "document")
+                .header(header::USER_AGENT, "ExampleBrowser/1.0")
+                .header("dnt", "1")
+                .body(EdgeBody::empty())
+                .expect("should build the request")
+        };
+        let mut context = EcContext::default();
+        context.decide_writer(&navigation(), true, true);
+        assert!(
+            context.identity().writer(),
+            "should make an organic real-browser document navigation the writer"
+        );
+        assert!(
+            context.identity().is_real_browser(),
+            "should record the real browser"
+        );
+        assert_eq!(
+            context.identity().page_url().map(Url::as_str),
+            Some("https://www.example.com/a"),
+            "should drop the query and fragment"
+        );
+        assert_eq!(
+            context.identity().user_agent(),
+            Some("ExampleBrowser/1.0"),
+            "should capture the user agent"
+        );
+        assert!(context.identity().dnt(), "should capture DNT");
+
+        for (name, organic, browser, request) in [
+            ("named route", false, true, navigation()),
+            ("bot", true, false, navigation()),
+            (
+                "prefetch",
+                true,
+                true,
+                Request::builder()
+                    .header("sec-fetch-dest", "document")
+                    .header("sec-purpose", "prefetch")
+                    .body(EdgeBody::empty())
+                    .expect("should build the request"),
+            ),
+        ] {
+            let mut context = EcContext::default();
+            context.decide_writer(&request, organic, browser);
+            assert!(
+                !context.identity().writer(),
+                "should not be a writer: {name}"
+            );
+            assert_eq!(
+                context.identity().is_real_browser(),
+                browser,
+                "should keep the real-browser flag: {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn decide_writer_has_no_page_url_for_an_origin_form_uri() {
+        let request = Request::builder()
+            .uri("/a?b=c")
+            .header("sec-fetch-dest", "document")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        let mut context = EcContext::default();
+
+        context.decide_writer(&request, true, true);
+
+        assert!(
+            context.identity().writer(),
+            "control: the request is still the writer"
+        );
+        assert_eq!(
+            context.identity().page_url(),
+            None,
+            "should have no page URL without an absolute URI"
+        );
+    }
+
     /// [`EcKvStore`] wrapper whose first `collisions` `Add` writes report a
     /// precondition failure, forcing generation to retry with a fresh suffix.
     struct AddCollidingEcKv {
@@ -844,7 +1325,7 @@ mod tests {
             EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()));
         let graph = KvIdentityGraph::new(AddCollidingEcKv::new(2));
 
-        ec.generate_if_needed(&settings, Some(&graph))
+        ec.generate_if_needed(&settings, Some(&graph), &BrowserSeed::empty())
             .expect("should generate after bounded collisions");
 
         assert!(ec.ec_value().is_some(), "should allocate a fresh EC ID");
@@ -855,6 +1336,100 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_revoke_marker_for_this_consent_stops_minting_until_consent_changes() {
+        let settings = create_test_settings();
+        let mint_under = |consent: ConsentContext, marker: &str| {
+            let mut ec =
+                EcContext::new_for_test_with_ip(None, consent, Some("192.0.2.5".to_owned()));
+            ec.set_revoke_marker_for_test(marker);
+            let graph = KvIdentityGraph::in_memory("ec-store");
+            ec.generate_if_needed(&settings, Some(&graph), &BrowserSeed::empty())
+                .expect("should not error");
+            ec.ec_generated()
+        };
+        let same = cookies::revoke_marker_value(&granting_consent());
+        let mut with_gpc = granting_consent();
+        with_gpc.gpc = true;
+        let earlier = cookies::revoke_marker_value(&with_gpc);
+
+        assert_ne!(earlier, same, "precondition: GPC changes the marker value");
+        assert!(
+            !mint_under(granting_consent(), &same),
+            "should not mint while the consent the revoke saw is unchanged"
+        );
+        assert!(
+            mint_under(granting_consent(), &earlier),
+            "should mint once the consent differs from the one the revoke saw"
+        );
+    }
+
+    #[test]
+    fn read_from_request_reads_the_revoke_marker() {
+        let settings = create_test_settings();
+        let req = create_test_request(&[("cookie", "ts-ec-revoked=10009")]);
+
+        let ec = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect("should read EC context");
+
+        assert!(ec.has_revoke_marker(), "should read the marker cookie");
+        let plain =
+            EcContext::read_from_request(&settings, &create_test_request(&[]), &noop_services())
+                .expect("should read EC context");
+        assert!(!plain.has_revoke_marker(), "control: no cookie, no marker");
+    }
+
+    #[test]
+    fn mint_deferred_writes_nothing_until_the_create() {
+        let settings = create_test_settings();
+        let graph = KvIdentityGraph::in_memory("ec-store");
+        let mut ec =
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()));
+
+        ec.mint_deferred(&settings, &BrowserSeed::empty())
+            .expect("should mint");
+
+        let ec_id = ec.ec_value().expect("should hold the minted ID").to_owned();
+        assert!(ec.has_deferred_create(), "should keep the row for later");
+        assert!(
+            graph.get(&ec_id).expect("should read").is_none(),
+            "should write nothing yet"
+        );
+
+        ec.complete_deferred_create(&settings, Some(&graph))
+            .expect("should create");
+
+        assert_eq!(
+            ec.ec_value(),
+            Some(ec_id.as_str()),
+            "should keep the minted ID"
+        );
+        assert!(
+            graph.get(&ec_id).expect("should read").is_some(),
+            "should create the row"
+        );
+        assert!(
+            matches!(ec.kv_snapshot(), EcKvSnapshot::Present { .. }),
+            "should hold the created row"
+        );
+    }
+
+    #[test]
+    fn deferred_create_fails_on_a_collision_instead_of_reminting() {
+        let settings = create_test_settings();
+        let graph = KvIdentityGraph::new(AddCollidingEcKv::new(1));
+        let mut ec =
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()));
+        ec.mint_deferred(&settings, &BrowserSeed::empty())
+            .expect("should mint");
+
+        let result = ec.complete_deferred_create(&settings, Some(&graph));
+
+        assert!(result.is_err(), "should fail rather than mint another ID");
+        assert!(ec.ec_value().is_none(), "should keep no EC");
+        assert!(!ec.ec_generated(), "should not count as generated");
+    }
+
     #[test]
     fn generate_if_needed_errors_after_collision_exhaustion() {
         let settings = create_test_settings();
@@ -863,7 +1438,7 @@ mod tests {
         // Collide on every attempt so the bounded retry is exhausted.
         let graph = KvIdentityGraph::new(AddCollidingEcKv::new(u32::MAX));
 
-        let result = ec.generate_if_needed(&settings, Some(&graph));
+        let result = ec.generate_if_needed(&settings, Some(&graph), &BrowserSeed::empty());
 
         assert!(result.is_err(), "should fail after exhausting attempts");
         assert!(
@@ -1084,7 +1659,7 @@ mod tests {
 
         let mut ec = EcContext::read_from_request(&settings, &req, &noop_services())
             .expect("should read EC context");
-        ec.generate_if_needed(&settings, None)
+        ec.generate_if_needed(&settings, None, &BrowserSeed::empty())
             .expect("should not error when EC already exists");
 
         assert_eq!(
diff --git a/crates/trusted-server-core/src/ec/prebid_eids.rs b/crates/trusted-server-core/src/ec/prebid_eids.rs
index d823cb32fb..e46080ebe4 100644
--- a/crates/trusted-server-core/src/ec/prebid_eids.rs
+++ b/crates/trusted-server-core/src/ec/prebid_eids.rs
@@ -3,17 +3,19 @@
 //! Parses the `ts-eids` cookie written by the TSJS Prebid integration and
 //! syncs matched partner UIDs to the KV identity graph.
 //!
-//! The current cookie format stores a base64-encoded JSON array of full
-//! OpenRTB-style `Eid` objects (`{source, uids:[...]}`). For rollout
-//! compatibility we also accept the earlier flattened payload shape
-//! (`{source, id, atype}` per entry).
+//! The current cookie holds a base64-encoded JSON array of OpenRTB-style EID
+//! objects, validated entry by entry with the same parser as the `/auction`
+//! body (`ec::client_eids`). The earlier flattened payload shape
+//! (`{source, id, atype}` per entry) is still accepted.
 
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
+use serde_json::value::RawValue;
 
 use crate::openrtb::{Eid, Uid};
 
+use super::client_eids::parse_client_eids;
 use super::kv::PartnerIdUpdate;
 use super::kv_types::MAX_UID_LENGTH;
 use super::registry::PartnerRegistry;
@@ -29,26 +31,9 @@ struct LegacyCookieEid {
     atype: i32,
 }
 
-/// OpenRTB-style `ts-eids` cookie entry.
-#[derive(Debug, Deserialize)]
-struct StructuredCookieEid {
-    source: String,
-    #[serde(default)]
-    uids: Vec<StructuredCookieUid>,
-}
-
-#[derive(Debug, Deserialize)]
-struct StructuredCookieUid {
-    id: String,
-    #[serde(default)]
-    atype: Option<i32>,
-    #[serde(default)]
-    ext: Option<JsonValue>,
-}
-
 enum DecodedCookieEids {
     Legacy(Vec<LegacyCookieEid>),
-    Structured(Vec<StructuredCookieEid>),
+    Structured(Box<RawValue>),
 }
 
 pub(crate) struct DiagnosticEidSource {
@@ -91,8 +76,11 @@ fn decode_prebid_eids_cookie(cookie_value: &str) -> Result<DecodedCookieEids, St
         return Ok(DecodedCookieEids::Legacy(eids));
     }
 
-    let structured = serde_json::from_slice::<Vec<StructuredCookieEid>>(&bytes)
+    let structured = serde_json::from_slice::<Box<RawValue>>(&bytes)
         .map_err(|e| format!("JSON parse failed: {e}"))?;
+    if !structured.get().trim_start().starts_with('[') {
+        return Err("JSON parse failed: ts-eids payload is not an array".to_owned());
+    }
     Ok(DecodedCookieEids::Structured(structured))
 }
 
@@ -107,39 +95,67 @@ impl DecodedCookieEids {
                     uids: vec![entry.id.clone()],
                 })
                 .collect(),
-            Self::Structured(entries) => entries
-                .iter()
-                .filter(|entry| !entry.source.is_empty())
-                .map(|entry| DiagnosticEidSource {
-                    source: entry.source.clone(),
-                    uids: entry.uids.iter().map(|uid| uid.id.clone()).collect(),
-                })
-                .collect(),
+            Self::Structured(raw) => raw_diagnostic_sources(raw),
         }
     }
 
     fn into_openrtb(self) -> Vec<Eid> {
         match self {
             Self::Legacy(entries) => legacy_cookie_eids_to_openrtb(entries),
-            Self::Structured(entries) => structured_cookie_eids_to_openrtb(entries),
+            Self::Structured(raw) => parse_client_eids(&raw),
         }
     }
 }
 
+/// Reports every source and raw UID string in a structured cookie, before
+/// validation, so admin diagnostics can tell "no partner" from "no valid UID".
+fn raw_diagnostic_sources(raw: &RawValue) -> Vec<DiagnosticEidSource> {
+    let Ok(elements) = serde_json::from_str::<Vec<&RawValue>>(raw.get()) else {
+        return Vec::new();
+    };
+
+    elements
+        .iter()
+        .filter_map(|element| {
+            let JsonValue::Object(entry) = serde_json::from_str::<JsonValue>(element.get()).ok()?
+            else {
+                return None;
+            };
+            let source = entry
+                .get("source")
+                .and_then(JsonValue::as_str)
+                .filter(|source| !source.is_empty())?
+                .to_owned();
+            let uids = entry
+                .get("uids")
+                .and_then(JsonValue::as_array)
+                .map(|uids| {
+                    uids.iter()
+                        .filter_map(|uid| uid.get("id").and_then(JsonValue::as_str))
+                        .map(str::to_owned)
+                        .collect()
+                })
+                .unwrap_or_default();
+            Some(DiagnosticEidSource { source, uids })
+        })
+        .collect()
+}
+
 /// Collects validated request-local partner updates without performing KV I/O.
 ///
-/// `body_eids` is the current request's own EIDs (e.g. an `/auction` JSON
-/// body), when the route captured any. It is applied after the `ts-eids`
-/// cookie so it wins on conflicts: the cookie is size-capped by the browser
-/// (see `MAX_EID_COOKIE_BYTES` in the TSJS Prebid integration) and may be
-/// missing partners the request body still carries in full. The `sharedId`
-/// cookie is applied last, unaffected by `body_eids`, preserving its existing
-/// override behavior.
+/// Finalization passes either the `ts-eids` cookie or the request's own client
+/// EIDs, never both: `/auction` passes the client set it used, every other
+/// route the cookie. The `sharedId` cookie is applied last, so it wins over a
+/// Prebid EID for the same partner. With repeated sources, the later entry's
+/// first valid UID is the candidate for that partner.
+///
+/// When `now` is `Some`, each update carries it as its acquisition time.
 pub(crate) fn collect_eid_updates(
     eids_cookie: Option<&str>,
     sharedid_cookie: Option<&str>,
     body_eids: Option<&[Eid]>,
     registry: &PartnerRegistry,
+    now: Option<u64>,
 ) -> Vec<PartnerIdUpdate> {
     if registry.is_empty() {
         return Vec::new();
@@ -157,6 +173,12 @@ pub(crate) fn collect_eid_updates(
     {
         updates.push(update);
     }
+    if let Some(now) = now {
+        updates = updates
+            .into_iter()
+            .map(|update| update.with_acquired_at(now))
+            .collect();
+    }
     dedupe_partner_updates(updates)
 }
 
@@ -220,13 +242,10 @@ fn collect_prebid_eid_updates_from_eids(
 pub(crate) fn dedupe_partner_updates(updates: Vec<PartnerIdUpdate>) -> Vec<PartnerIdUpdate> {
     let mut latest = std::collections::BTreeMap::new();
     for update in updates {
-        latest.insert(update.partner_id, update.uid);
+        latest.insert(update.partner_id.clone(), update);
     }
 
-    latest
-        .into_iter()
-        .map(|(partner_id, uid)| PartnerIdUpdate::new(partner_id, uid))
-        .collect()
+    latest.into_values().collect()
 }
 
 fn first_valid_uid(uids: &[Uid]) -> Option<&Uid> {
@@ -277,61 +296,19 @@ fn sharedid_cookie_exceeds_size_limit(cookie_value: &str) -> bool {
     cookie_value.len() > MAX_UID_LENGTH
 }
 
-fn structured_cookie_eids_to_openrtb(entries: Vec<StructuredCookieEid>) -> Vec<Eid> {
-    let mut eids = Vec::new();
-
-    for entry in entries {
-        if entry.source.is_empty() {
-            continue;
-        }
-
-        let uids: Vec<_> = entry
-            .uids
-            .into_iter()
-            .filter_map(structured_cookie_uid_to_openrtb)
-            .collect();
-        if uids.is_empty() {
-            continue;
-        }
-
-        eids.push(Eid {
-            source: entry.source,
-            uids,
-        });
-    }
-
-    eids
-}
-
-fn structured_cookie_uid_to_openrtb(uid: StructuredCookieUid) -> Option<Uid> {
-    if uid.id.is_empty() {
-        return None;
-    }
-
-    let atype = uid.atype.filter(|atype| *atype >= 0);
-    let ext = match uid.ext {
-        Some(JsonValue::Object(_)) => uid.ext,
-        _ => None,
-    };
-
-    Some(Uid {
-        id: uid.id,
-        atype,
-        ext,
-    })
-}
-
 fn legacy_cookie_eids_to_openrtb(entries: Vec<LegacyCookieEid>) -> Vec<Eid> {
     entries
         .into_iter()
-        .filter(|entry| !entry.source.is_empty() && !entry.id.is_empty())
-        .map(|entry| Eid {
-            source: entry.source,
-            uids: vec![Uid {
-                id: entry.id,
-                atype: (entry.atype >= 0).then_some(entry.atype),
-                ext: None,
-            }],
+        .filter(|entry| !entry.source.trim().is_empty() && is_valid_eid_uid(&entry.id))
+        .map(|entry| {
+            Eid::new(
+                entry.source,
+                vec![Uid {
+                    id: entry.id,
+                    atype: (entry.atype >= 0).then_some(entry.atype),
+                    ext: None,
+                }],
+            )
         })
         .collect()
 }
@@ -342,6 +319,8 @@ mod tests {
     use base64::engine::general_purpose::STANDARD as BASE64;
     use serde_json::json;
 
+    use crate::ec::kv::apply_partner_id_updates;
+    use crate::ec::kv_types::KvEntry;
     use crate::ec::registry::PartnerRegistry;
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
@@ -359,8 +338,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -377,6 +357,100 @@ mod tests {
         BASE64.encode(serde_json::to_vec(value).expect("should serialize EID JSON"))
     }
 
+    #[test]
+    fn structured_cookie_keeps_eid_level_fields() {
+        let entries = json!([{
+            "source": "adserver.org",
+            "inserter": "adserver.org",
+            "matcher": "adserver.org",
+            "mm": 4,
+            "uids": [{ "id": "fictional-tdid", "atype": 1 }]
+        }]);
+
+        let decoded =
+            parse_prebid_eids_cookie(&encode_json(&entries)).expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            entries,
+            "should keep EID-level fields from the cookie"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_drops_a_mistyped_field_instead_of_the_whole_cookie() {
+        let encoded = encode_json(&json!([
+            { "source": "a.example.com", "uids": [{ "id": "a-uid", "atype": "1" }] },
+            { "source": "b.example.com", "uids": [{ "id": "b-uid", "atype": 3 }] }
+        ]));
+
+        let decoded = parse_prebid_eids_cookie(&encoded).expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            json!([
+                { "source": "a.example.com", "uids": [{ "id": "a-uid" }] },
+                { "source": "b.example.com", "uids": [{ "id": "b-uid", "atype": 3 }] }
+            ]),
+            "a mistyped atype should drop only that field"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_isolates_an_unparsable_entry() {
+        let raw = r#"[{"source":"a.example.com","uids":[{"id":"a-uid"}]},{"source":"bad.example.com","uids":[{"id":"bad-\ud800"}]}]"#;
+
+        let decoded = parse_prebid_eids_cookie(&BASE64.encode(raw)).expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            json!([{ "source": "a.example.com", "uids": [{ "id": "a-uid" }] }]),
+            "a lone surrogate should cost only its own entry"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_applies_the_entry_cap() {
+        let entries: Vec<serde_json::Value> = (0..65)
+            .map(|index| json!({ "source": format!("s{index}.example.com"), "uids": [{ "id": "u" }] }))
+            .collect();
+
+        let decoded =
+            parse_prebid_eids_cookie(&encode_json(&serde_json::Value::Array(entries.clone())))
+                .expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            serde_json::Value::Array(entries[..64].to_vec()),
+            "the body's 64-entry cap should apply to the cookie"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_diagnostics_report_raw_uid_strings() {
+        let registry = make_registry(vec![("example", "example.com")]);
+        let oversized = "x".repeat(MAX_UID_LENGTH + 1);
+        let encoded =
+            encode_json(&json!([{ "source": "example.com", "uids": [{ "id": oversized }] }]));
+
+        let analysis =
+            analyze_prebid_eids_cookie(&encoded, &registry).expect("should decode cookie");
+
+        assert!(
+            analysis.eids.is_empty(),
+            "an oversized UID should not survive validation"
+        );
+        assert_eq!(
+            analysis
+                .diagnostic_sources
+                .iter()
+                .map(|source| (source.source.clone(), source.uids.clone()))
+                .collect::<Vec<_>>(),
+            vec![("example.com".to_owned(), vec![oversized])],
+            "diagnostics should still report the raw source and UID so admin can say no valid UID"
+        );
+    }
+
     #[test]
     fn parse_prebid_eids_cookie_parses_legacy_flat_payload() {
         let eids = vec![
@@ -463,6 +537,16 @@ mod tests {
         assert!(result.is_err(), "should reject invalid JSON");
     }
 
+    #[test]
+    fn parse_prebid_eids_cookie_rejects_non_array_json() {
+        let result = parse_prebid_eids_cookie(&encode_json(&json!({"a": 1})));
+        let error = result.expect_err("should reject a JSON object");
+        assert!(
+            error.contains("not an array"),
+            "should explain that the payload is not an array"
+        );
+    }
+
     #[test]
     fn ts_eids_cookie_rejects_oversized_payloads() {
         let oversized = "x".repeat(MAX_EIDS_COOKIE_BYTES + 1);
@@ -614,7 +698,13 @@ mod tests {
             {"source": "id5-sync.com", "uids": [{"id": "ID5_abc", "atype": 1}]}
         ]));
 
-        let updates = collect_eid_updates(Some(&eids_cookie), Some(" shared-1 "), None, &registry);
+        let updates = collect_eid_updates(
+            Some(&eids_cookie),
+            Some(" shared-1 "),
+            None,
+            &registry,
+            None,
+        );
 
         assert_eq!(
             updates.len(),
@@ -636,25 +726,26 @@ mod tests {
             {"source": "id5-sync.com", "uids": [{"id": "ID5_stale", "atype": 1}]}
         ]));
         let body_eids = vec![
-            Eid {
-                source: "id5-sync.com".to_owned(),
-                uids: vec![Uid {
+            Eid::new(
+                "id5-sync.com".to_owned(),
+                vec![Uid {
                     id: "ID5_fresh".to_owned(),
                     atype: Some(1),
                     ext: None,
                 }],
-            },
-            Eid {
-                source: "liveramp.com".to_owned(),
-                uids: vec![Uid {
+            ),
+            Eid::new(
+                "liveramp.com".to_owned(),
+                vec![Uid {
                     id: "LR_xyz".to_owned(),
                     atype: Some(3),
                     ext: None,
                 }],
-            },
+            ),
         ];
 
-        let updates = collect_eid_updates(Some(&eids_cookie), None, Some(&body_eids), &registry);
+        let updates =
+            collect_eid_updates(Some(&eids_cookie), None, Some(&body_eids), &registry, None);
 
         assert_eq!(
             updates,
@@ -675,7 +766,8 @@ mod tests {
             {"source": "id5-sync.com", "uids": [{"id": "ID5_abc", "atype": 1}]}
         ]));
 
-        let updates = collect_eid_updates(Some(&eids_cookie), Some("shared-1"), None, &registry);
+        let updates =
+            collect_eid_updates(Some(&eids_cookie), Some("shared-1"), None, &registry, None);
 
         assert!(
             updates.is_empty(),
@@ -716,7 +808,13 @@ mod tests {
             {"source": "liveramp.com", "uids": [{"id": "LR_xyz", "atype": 3}]}
         ]));
 
-        let updates = collect_eid_updates(Some(&cookie), Some("shared-cookie-id"), None, &registry);
+        let updates = collect_eid_updates(
+            Some(&cookie),
+            Some("shared-cookie-id"),
+            None,
+            &registry,
+            None,
+        );
 
         assert_eq!(
             updates,
@@ -739,7 +837,7 @@ mod tests {
             }
         ]));
 
-        let updates = collect_eid_updates(Some(&cookie), None, None, &registry);
+        let updates = collect_eid_updates(Some(&cookie), None, None, &registry, None);
 
         assert_eq!(
             updates,
@@ -755,7 +853,8 @@ mod tests {
             {"source": "sharedid.org", "uids": [{"id": "prebid-shared", "atype": 3}]}
         ]));
 
-        let updates = collect_eid_updates(Some(&cookie), Some("cookie-shared"), None, &registry);
+        let updates =
+            collect_eid_updates(Some(&cookie), Some("cookie-shared"), None, &registry, None);
 
         assert_eq!(
             updates,
@@ -771,11 +870,53 @@ mod tests {
             {"source": "unknown.example", "uids": [{"id": "unknown", "atype": 1}]}
         ]));
 
-        let updates = collect_eid_updates(Some(&cookie), None, None, &registry);
+        let updates = collect_eid_updates(Some(&cookie), None, None, &registry, None);
 
         assert!(
             updates.is_empty(),
             "should ignore unmatched partner updates"
         );
     }
+
+    #[test]
+    fn golden_browser_ingest_stores_one_uid_per_registered_source() {
+        let registry = make_registry(vec![("id5", "id5-sync.com"), ("sharedid", "sharedid.org")]);
+        let eids_cookie = encode_json(&json!([
+            { "source": "id5-sync.com", "uids": [{ "id": "ID5_earlier_entry", "atype": 1 }] },
+            {
+                "source": "id5-sync.com",
+                "uids": [
+                    { "id": " ", "atype": 1 },
+                    { "id": "ID5_first", "atype": 1, "ext": { "linkType": 2 } },
+                    { "id": "ID5_second", "atype": 1 }
+                ],
+                "inserter": "example.com",
+                "matcher": "partner.example.com",
+                "mm": 3,
+                "ext": { "segments": ["example-segment"] }
+            },
+            { "source": "sharedid.org", "uids": [{ "id": "prebid-shared-id", "atype": 1 }] },
+            { "source": "unregistered.example.com", "uids": [{ "id": "other", "atype": 1 }] }
+        ]));
+        let updates = collect_eid_updates(
+            Some(&eids_cookie),
+            Some(" cookie-shared-id "),
+            None,
+            &registry,
+            Some(1_760_000_000),
+        );
+        let mut entry = KvEntry::minimal("example.com", "existing", 1);
+        apply_partner_id_updates(&mut entry, &updates);
+        let stored = serde_json::to_value(&entry.ids).expect("should serialize ids");
+
+        assert_eq!(
+            stored,
+            json!({
+                "example.com": { "eids": [{ "uids": [{ "id": "existing" }] }] },
+                "id5-sync.com": { "at": 1_760_000_000, "eids": [{ "uids": [{ "id": "ID5_first" }] }] },
+                "sharedid.org": { "at": 1_760_000_000, "eids": [{ "uids": [{ "id": "cookie-shared-id" }] }] }
+            }),
+            "should store one UID per registered source by today's rule, with no EID-level field, atype or ext"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/pull_sync.rs b/crates/trusted-server-core/src/ec/pull_sync.rs
index 191e6c6d24..a718aa5568 100644
--- a/crates/trusted-server-core/src/ec/pull_sync.rs
+++ b/crates/trusted-server-core/src/ec/pull_sync.rs
@@ -1,552 +1,69 @@
-//! Pull sync background dispatch.
+//! Pull sync URL helpers.
 //!
-//! Launches partner pull-sync requests for organic traffic after the client
-//! response has been sent. Dispatch is best-effort and never affects client
-//! response status.
-//!
-//! Pull sync currently fills missing partner UIDs only. Once a partner UID is
-//! present in the EC identity entry, it is not periodically refreshed because
-//! the entry no longer stores per-partner sync timestamps.
+//! Pull partners are called as generic pull identity providers
+//! (`identity::generic_pull`), dispatched by the writer's phase 4
+//! flush. These helpers validate and build the partner URL they call.
 
-use edgezero_core::body::Body as EdgeBody;
-use http::{Method, StatusCode, header};
-use serde::Deserialize;
 use url::Url;
 
-use crate::consent::allows_eid_persistence;
-use crate::platform::{
-    DEFAULT_FIRST_BYTE_TIMEOUT, PlatformBackendSpec, PlatformHttpRequest, PlatformPendingRequest,
-    PlatformResponse, RuntimeServices,
-};
-use crate::settings::Settings;
-
-use super::generation::{ec_hash, is_valid_ec_id};
-use super::kv::{KvIdentityGraph, PartnerIdUpdate};
-use super::kv_types::KvEntry;
-use super::rate_limiter::RateLimiter;
-use super::registry::{PartnerConfig, PartnerRegistry};
-
-// `current_timestamp` is defined in the parent `ec` module.
-use super::EcContext;
-use super::EcKvSnapshot;
-use super::current_timestamp;
-
-/// Inputs needed to dispatch pull sync after response flush.
-#[derive(Debug, Clone)]
-pub struct PullSyncContext {
-    ec_id: String,
-    snapshot: EcKvSnapshot,
-}
-
-impl PullSyncContext {
-    /// Returns the EC ID for the request.
-    #[must_use]
-    pub fn ec_id(&self) -> &str {
-        &self.ec_id
-    }
-}
-
-struct InFlightPull {
-    source_domain: String,
-    pending: PlatformPendingRequest,
-}
-
-#[derive(Debug, Deserialize)]
-struct PullSyncResponse {
-    uid: Option<String>,
-}
-
-/// Builds post-send pull-sync context from the route EC context.
+/// Returns the pull URL when it is HTTPS and its host is allowlisted.
 ///
-/// Returns `None` when there are no pull-enabled partners, when consent denies
-/// EC, when there is no valid active EC ID, or when the request snapshot holds
-/// no consented row that is still missing at least one pull-partner UID.
-#[must_use]
-pub fn build_pull_sync_context(
-    ec_context: &EcContext,
-    registry: &PartnerRegistry,
-) -> Option<PullSyncContext> {
-    // Without EID-persistence consent (TCF Purpose 1 + 4), finalization
-    // withholds browser-supplied partner UIDs. That leaves partner slots empty,
-    // which pull sync would otherwise read as eligible and disclose the EC ID
-    // to partners for exactly the users who opted out.
-    if registry.pull_enabled_partners().is_empty()
-        || !ec_context.ec_allowed()
-        || !allows_eid_persistence(ec_context.consent())
-    {
-        return None;
-    }
-
-    let ec_id_ref = ec_context.ec_value()?;
-    if !is_valid_ec_id(ec_id_ref) {
-        log::debug!("Pull sync: skipping dispatch because active EC ID is invalid format");
-        return None;
-    }
-
-    let entry = ec_context.kv_snapshot().entry_for(ec_id_ref)?;
-    if !entry.consent.ok || entry_is_pull_complete(entry, registry) {
-        return None;
-    }
-
-    let ec_id = ec_id_ref.to_owned();
-    let snapshot = ec_context.kv_snapshot().clone();
-    Some(PullSyncContext { ec_id, snapshot })
-}
-
-/// Dispatches partner pull-sync requests in the background.
-///
-/// This function is best-effort: all errors are logged and swallowed.
-///
-/// # Consent revalidation
-///
-/// Pull sync runs *after* the page response has been flushed to the browser and
-/// discloses the raw `ec_id` to partners, so it cannot be authorized by the
-/// request snapshot alone: a concurrent CMP withdrawal can tombstone the row in
-/// the window between snapshot capture and dispatch. The live row is re-read
-/// immediately before the first partner request and anything short of a live,
-/// consenting entry cancels the dispatch. The read is deferred until after the
-/// snapshot-based eligibility filter, so a request with nothing to pull still
-/// costs no KV operation, and the fresh snapshot is reused for the write-back
-/// instead of the stale one.
-///
-/// # Panics
-///
-/// Panics if the HTTP request builder produces an invalid request, which
-/// cannot happen with the hardcoded method and well-formed URI used here.
-pub fn dispatch_pull_sync(
-    settings: &Settings,
-    kv: &KvIdentityGraph,
-    registry: &PartnerRegistry,
-    rate_limiter: &dyn RateLimiter,
-    context: &PullSyncContext,
-    services: &RuntimeServices,
-) {
-    let now = current_timestamp();
-    let mut pull_partners = registry.pull_enabled_partners();
-
-    if pull_partners.is_empty() {
-        return;
-    }
-
-    let Some(request_entry) = context.snapshot.entry_for(context.ec_id()) else {
-        log::debug!(
-            "Pull sync: skipping dispatch for '{}' because the request captured no usable \
-             identity snapshot",
-            super::log_id(context.ec_id())
-        );
-        return;
-    };
-    if !request_entry.consent.ok {
-        return;
-    }
-
-    // Sort by source domain for deterministic ordering, then apply a rotating
-    // hourly offset so that different partners get dispatch priority (§10.3).
-    pull_partners.sort_by(|a, b| a.source_domain.cmp(&b.source_domain));
-
-    log::debug!(
-        "Pull sync: {} pull-enabled partners after filtering",
-        pull_partners.len(),
-    );
-
-    // Rotate the partner list so that the starting partner changes each
-    // hour. This ensures fair distribution when max_concurrency limits
-    // how many partners are dispatched per request.
-    let offset = (now / 3600) as usize % pull_partners.len();
-    pull_partners.rotate_left(offset);
-
-    // Drop partners the request snapshot already has a UID for before paying
-    // for the revalidation read: a dispatch with nothing to pull must not add a
-    // KV operation.
-    pull_partners.retain(|partner| is_partner_pull_eligible(partner, Some(request_entry)));
-    if pull_partners.is_empty() {
-        return;
-    }
-
-    let live_snapshot = kv.load_snapshot(context.ec_id());
-    let Some(live_entry) = live_snapshot.entry_for(context.ec_id()) else {
-        log::warn!(
-            "Pull sync: skipping dispatch for '{}' because the live identity row could not be \
-             confirmed",
-            super::log_id(context.ec_id())
-        );
-        return;
-    };
-    if !live_entry.consent.ok {
-        log::info!(
-            "Pull sync: skipping dispatch for '{}' because consent was withdrawn after the \
-             request snapshot was captured",
-            super::log_id(context.ec_id())
-        );
-        return;
-    }
-
-    let max_concurrency = settings.ec.pull_sync_concurrency.max(1);
-    let mut in_flight: Vec<InFlightPull> = Vec::new();
-    let mut updates = Vec::new();
-
-    for partner in pull_partners {
-        // Re-checked against the live row: a concurrent request may have filled
-        // this partner's UID since the request snapshot was captured.
-        if !is_partner_pull_eligible(partner, Some(live_entry)) {
-            continue;
-        }
-
-        let Some(url) = validated_pull_sync_url(partner) else {
-            continue;
-        };
-
-        let rate_key = pull_rate_limit_key(&partner.source_domain, context.ec_id());
-        match rate_limiter.exceeded(&rate_key, partner.pull_sync_rate_limit) {
-            Ok(true) => {
-                log::debug!(
-                    "Pull sync: rate-limited partner '{}' for ec_id '{}'",
-                    partner.source_domain,
-                    super::log_id(context.ec_id())
-                );
-                continue;
-            }
-            Ok(false) => {}
-            Err(err) => {
-                log::warn!(
-                    "Pull sync: failed to read rate limit for partner '{}': {err:?}",
-                    partner.source_domain
-                );
-                continue;
-            }
-        }
-
-        let Some(token) = partner.ts_pull_token.as_ref() else {
-            log::warn!(
-                "Pull sync: partner '{}' enabled but missing ts_pull_token",
-                partner.source_domain
-            );
-            continue;
-        };
-
-        let request_url = build_pull_request_url(url, context.ec_id());
-        let scheme = request_url.scheme().to_string();
-        let host = request_url.host_str().unwrap_or_default().to_string();
-        let port = request_url.port();
-
-        let backend_name = match services.backend().ensure(&PlatformBackendSpec {
-            scheme,
-            host,
-            port,
-            host_header_override: None,
-            certificate_check: settings.proxy.certificate_check,
-            first_byte_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
-            between_bytes_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
-            discriminator: None,
-        }) {
-            Ok(name) => name,
-            Err(err) => {
-                log::warn!(
-                    "Pull sync: failed to resolve backend for partner '{}': {err:?}",
-                    partner.source_domain
-                );
-                continue;
-            }
-        };
-
-        let request = http::Request::builder()
-            .method(Method::GET)
-            .uri(request_url.as_str())
-            .header("authorization", format!("Bearer {}", token.expose()))
-            .body(EdgeBody::empty())
-            .expect("should build pull sync request");
-
-        let pending = match futures::executor::block_on(
-            services
-                .http_client()
-                .send_async(PlatformHttpRequest::new(request, backend_name)),
-        ) {
-            Ok(pending) => pending,
-            Err(err) => {
-                log::warn!(
-                    "Pull sync: failed to dispatch partner '{}': {err:?}",
-                    partner.source_domain
-                );
-                continue;
-            }
-        };
-
-        in_flight.push(InFlightPull {
-            source_domain: partner.source_domain.clone(),
-            pending,
-        });
-
-        if in_flight.len() >= max_concurrency {
-            drain_pull_batch(&mut in_flight, services, &mut updates);
-        }
-    }
-
-    drain_pull_batch(&mut in_flight, services, &mut updates);
-    if !updates.is_empty() {
-        // Write back from the revalidated snapshot, not the request one: its
-        // generation is current, so the first CAS attempt is not spent losing a
-        // conflict against the read that authorized this dispatch.
-        let outcome =
-            kv.upsert_partner_ids_from_snapshot(context.ec_id(), &updates, live_snapshot.clone());
-        if matches!(outcome, EcKvSnapshot::Failed { .. }) {
-            log::warn!(
-                "Pull sync: failed to persist partner updates for '{}'",
-                super::log_id(context.ec_id())
-            );
-        }
-    }
-}
-
-/// Returns whether a consented live entry holds an ID for every pull-enabled
-/// partner. Always returns `false` when there are no pull-enabled partners.
-#[must_use]
-pub(crate) fn entry_is_pull_complete(entry: &KvEntry, registry: &PartnerRegistry) -> bool {
-    let pull_partners = registry.pull_enabled_partners();
-    !pull_partners.is_empty()
-        && entry.consent.ok
-        && pull_partners
-            .iter()
-            .all(|partner| !is_partner_pull_eligible(partner, Some(entry)))
-}
-
-fn is_partner_pull_eligible(partner: &PartnerConfig, kv_entry: Option<&KvEntry>) -> bool {
-    kv_entry
-        .and_then(|entry| entry.ids.get(&partner.source_domain))
-        .is_none()
-}
-
-fn validated_pull_sync_url(partner: &PartnerConfig) -> Option<Url> {
-    let pull_sync_url = partner.pull_sync_url.as_deref()?;
+/// The host comparison ignores case and a trailing dot on both sides.
+/// Returns `None`, with a log line that names no partner, for a missing,
+/// invalid or non-HTTPS URL and for a host outside `allowed_domains`.
+pub(crate) fn validated_pull_sync_url(
+    pull_sync_url: Option<&str>,
+    allowed_domains: &[String],
+) -> Option<Url> {
+    let pull_sync_url = pull_sync_url?;
     let parsed = match Url::parse(pull_sync_url) {
         Ok(url) => url,
         Err(err) => {
-            log::error!(
-                "Pull sync: partner '{}' has invalid pull_sync_url '{}': {err}",
-                partner.source_domain,
-                pull_sync_url
-            );
+            log::error!("Pull sync: invalid pull_sync_url '{pull_sync_url}': {err}");
             return None;
         }
     };
 
     if parsed.scheme() != "https" {
         log::error!(
-            "Pull sync: partner '{}' pull_sync_url must use HTTPS, got scheme '{}'",
-            partner.source_domain,
+            "Pull sync: pull_sync_url must use HTTPS, got scheme '{}'",
             parsed.scheme()
         );
         return None;
     }
 
     let Some(hostname) = parsed.host_str() else {
-        log::error!(
-            "Pull sync: partner '{}' pull_sync_url has no hostname: {}",
-            partner.source_domain,
-            pull_sync_url
-        );
+        log::error!("Pull sync: pull_sync_url has no hostname: {pull_sync_url}");
         return None;
     };
 
     let hostname = hostname.trim_end_matches('.').to_ascii_lowercase();
-    if !partner.pull_sync_allowed_domains.iter().any(|domain| {
+    if !allowed_domains.iter().any(|domain| {
         domain
             .trim()
             .trim_end_matches('.')
             .eq_ignore_ascii_case(&hostname)
     }) {
-        log::error!(
-            "Pull sync: partner '{}' URL host '{}' not in pull_sync_allowed_domains",
-            partner.source_domain,
-            hostname
-        );
+        log::error!("Pull sync: URL host '{hostname}' not in pull_sync_allowed_domains");
         return None;
     }
 
     Some(parsed)
 }
 
-fn build_pull_request_url(mut base_url: Url, ec_id: &str) -> Url {
+/// Appends the `ec_id` query parameter to a validated pull URL.
+pub(crate) fn build_pull_request_url(mut base_url: Url, ec_id: &str) -> Url {
     base_url.query_pairs_mut().append_pair("ec_id", ec_id);
     base_url
 }
 
-fn pull_rate_limit_key(source_domain: &str, ec_id: &str) -> String {
-    format!("pull:{source_domain}:{}", ec_hash(ec_id))
-}
-
-fn drain_pull_batch(
-    in_flight: &mut Vec<InFlightPull>,
-    services: &RuntimeServices,
-    updates: &mut Vec<PartnerIdUpdate>,
-) {
-    for pending in in_flight.drain(..) {
-        let source_domain = pending.source_domain;
-        // All requests were dispatched up front via send_async, so waiting on
-        // each in turn does not change concurrency.
-        let response =
-            match futures::executor::block_on(services.http_client().wait(pending.pending)) {
-                Ok(response) => response,
-                Err(err) => {
-                    log::warn!(
-                        "Pull sync: request failed for partner '{}': {err:?}",
-                        source_domain
-                    );
-                    continue;
-                }
-            };
-
-        let Some(uid) = extract_pull_uid(response, &source_domain) else {
-            continue;
-        };
-
-        updates.push(PartnerIdUpdate::new(source_domain, uid));
-    }
-}
-
-/// Maximum response body size accepted from pull sync partners (64 KiB).
-///
-/// The expected response is `{"uid":"<string>"}`, so 64 KiB is generous.
-/// This prevents a misbehaving partner from exhausting WASM memory.
-const MAX_PULL_RESPONSE_BYTES: usize = 64 * 1024;
-
-fn response_content_length_exceeds_limit(response: &PlatformResponse, source_domain: &str) -> bool {
-    let Some(value) = response.response.headers().get(header::CONTENT_LENGTH) else {
-        return false;
-    };
-
-    let Some(value) = value.to_str().ok() else {
-        log::warn!(
-            "Pull sync: partner '{}' returned invalid Content-Length header, rejecting",
-            source_domain
-        );
-        return true;
-    };
-
-    let Ok(length) = value.parse::<usize>() else {
-        log::warn!(
-            "Pull sync: partner '{}' returned malformed Content-Length header, rejecting",
-            source_domain
-        );
-        return true;
-    };
-
-    if length > MAX_PULL_RESPONSE_BYTES {
-        log::warn!(
-            "Pull sync: partner '{}' returned oversized Content-Length ({} bytes), rejecting",
-            source_domain,
-            length
-        );
-        return true;
-    }
-
-    false
-}
-
-fn extract_pull_uid(response: PlatformResponse, source_domain: &str) -> Option<String> {
-    let status = response.response.status();
-
-    if status == StatusCode::NOT_FOUND {
-        log::debug!(
-            "Pull sync: partner '{}' returned 404, treating as no-op",
-            source_domain
-        );
-        return None;
-    }
-
-    if !status.is_success() {
-        log::warn!(
-            "Pull sync: partner '{}' returned non-success status {}",
-            source_domain,
-            status
-        );
-        return None;
-    }
-
-    if response_content_length_exceeds_limit(&response, source_domain) {
-        return None;
-    }
-
-    let body = response
-        .response
-        .into_body()
-        .into_bytes()
-        .unwrap_or_default();
-    if body.len() > MAX_PULL_RESPONSE_BYTES {
-        log::warn!(
-            "Pull sync: partner '{}' returned oversized response ({} bytes), rejecting",
-            source_domain,
-            body.len()
-        );
-        return None;
-    }
-    let payload = match serde_json::from_slice::<PullSyncResponse>(&body) {
-        Ok(payload) => payload,
-        Err(err) => {
-            log::warn!(
-                "Pull sync: partner '{}' returned invalid JSON body: {err}",
-                source_domain
-            );
-            return None;
-        }
-    };
-
-    use super::kv_types::MAX_UID_LENGTH;
-
-    let uid = payload.uid.filter(|value| !value.trim().is_empty());
-    match uid {
-        None => {
-            log::debug!(
-                "Pull sync: partner '{}' returned null/empty uid, treating as no-op",
-                source_domain
-            );
-            None
-        }
-        Some(ref value) if value.len() > MAX_UID_LENGTH => {
-            log::warn!(
-                "Pull sync: partner '{}' returned uid exceeding {} bytes (got {}), rejecting",
-                source_domain,
-                MAX_UID_LENGTH,
-                value.len()
-            );
-            None
-        }
-        _ => uid,
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::consent::types::ConsentContext;
-    use crate::ec::kv_types::KvEntry;
-    use crate::platform::PlatformResponse;
+    use crate::ec::registry::PartnerConfig;
     use crate::redacted::Redacted;
-    use crate::test_support::tests::purpose_one_only_consent;
 
-    fn make_response(status: u16, body: &[u8]) -> PlatformResponse {
-        PlatformResponse::new(
-            edgezero_core::http::response_builder()
-                .status(status)
-                .body(EdgeBody::from(body.to_vec()))
-                .expect("should build test response"),
-        )
-    }
-
-    fn make_response_with_content_length(
-        status: u16,
-        content_length: usize,
-        body: &[u8],
-    ) -> PlatformResponse {
-        PlatformResponse::new(
-            edgezero_core::http::response_builder()
-                .status(status)
-                .header(header::CONTENT_LENGTH, content_length.to_string())
-                .body(EdgeBody::from(body.to_vec()))
-                .expect("should build test response"),
-        )
-    }
-
-    fn pull_partner(ttl_sec: u64) -> PartnerConfig {
+    fn pull_partner() -> PartnerConfig {
         PartnerConfig {
             name: "SSP X".to_owned(),
             api_key_hash: Some("deadbeef".to_owned()),
@@ -557,168 +74,20 @@ mod tests {
             pull_sync_enabled: true,
             pull_sync_url: Some("https://sync.partner.test/pull".to_owned()),
             pull_sync_allowed_domains: vec!["sync.partner.test".to_owned()],
-            pull_sync_ttl_sec: ttl_sec,
-            pull_sync_rate_limit: 20,
             ts_pull_token: Some(Redacted::new("token".to_owned())),
+            owner: None,
         }
     }
 
-    #[test]
-    fn build_pull_sync_context_returns_context_when_valid() {
-        let consent = ConsentContext {
-            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
-            ..ConsentContext::default()
-        };
-        let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let mut ec_context = EcContext::new_for_test(Some(ec_id.clone()), consent);
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, &ec_id));
-        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
-            .expect("should build registry");
-
-        let context = build_pull_sync_context(&ec_context, &registry)
-            .expect("should build pull sync context for valid EC");
-        assert_eq!(
-            context.ec_id(),
-            ec_context.ec_value().expect("ec should be present"),
-            "should capture the EC ID from context"
-        );
-    }
-
-    #[test]
-    fn build_pull_sync_context_rejects_invalid_ec_id() {
-        let consent = ConsentContext {
-            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
-            ..ConsentContext::default()
-        };
-        let ec_context = EcContext::new_for_test(Some("invalid-ec".to_owned()), consent);
-        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
-            .expect("should build registry");
-
-        let context = build_pull_sync_context(&ec_context, &registry);
-        assert!(
-            context.is_none(),
-            "should reject pull sync context when EC ID format is invalid"
-        );
-    }
-
-    #[test]
-    fn build_pull_sync_context_skips_when_eid_persistence_is_denied() {
-        // Purpose 1 granted keeps the EC, but Purpose 4 denied withholds EID
-        // writes and leaves partner slots empty. Pull sync must not read those
-        // empty slots as eligible and disclose the EC ID to partners.
-        let consent = purpose_one_only_consent();
-        let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let mut ec_context = EcContext::new_for_test(Some(ec_id.clone()), consent);
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, &ec_id));
-        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
-            .expect("should build registry");
-        assert!(
-            ec_context.ec_allowed(),
-            "should keep the EC allowed when Purpose 1 is granted"
-        );
-
-        let context = build_pull_sync_context(&ec_context, &registry);
-
-        assert!(
-            context.is_none(),
-            "should skip pull sync when TCF Purpose 4 is denied"
-        );
-    }
-
-    #[test]
-    fn build_pull_sync_context_skips_empty_registry_and_complete_snapshot() {
-        let consent = ConsentContext {
-            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
-            ..ConsentContext::default()
-        };
-        let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let mut ec_context = EcContext::new_for_test(Some(ec_id.clone()), consent);
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let mut snapshot = seed_present_snapshot(&graph, &ec_id);
-        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
-            .expect("should build registry");
-
-        assert!(
-            build_pull_sync_context(&ec_context, &PartnerRegistry::empty()).is_none(),
-            "no pull partners should skip before graph construction"
-        );
-        assert!(
-            build_pull_sync_context(&ec_context, &registry).is_none(),
-            "an unread snapshot should skip before graph construction"
-        );
-
-        if let EcKvSnapshot::Present { entry, .. } = &mut snapshot {
-            entry.ids.insert(
-                "ssp.example.com".to_owned(),
-                crate::ec::kv_types::KvPartnerId {
-                    uid: "uid".to_owned(),
-                },
-            );
-        }
-        ec_context.set_kv_snapshot(snapshot);
-        assert!(
-            build_pull_sync_context(&ec_context, &registry).is_none(),
-            "a complete snapshot should skip post-send work"
-        );
-    }
-
-    #[test]
-    fn partner_is_eligible_when_missing_from_entry() {
-        let partner = pull_partner(3600);
-        let entry = KvEntry::minimal("other_partner", "uid-1", 100);
-
-        assert!(
-            is_partner_pull_eligible(&partner, Some(&entry)),
-            "should dispatch when partner has no stored UID"
-        );
-    }
-
-    #[test]
-    fn partner_is_not_eligible_when_already_present() {
-        let partner = pull_partner(3600);
-        let entry = KvEntry::minimal("ssp.example.com", "uid-1", 1000);
-
-        assert!(
-            !is_partner_pull_eligible(&partner, Some(&entry)),
-            "should skip dispatch when partner already has a stored UID"
-        );
-    }
-
-    #[test]
-    fn completeness_requires_all_pull_partner_ids() {
-        let registry = PartnerRegistry::from_config(&[
-            pull_enabled_ec_partner("a.example.com"),
-            pull_enabled_ec_partner("b.example.com"),
-        ])
-        .expect("should build registry");
-        let mut entry = KvEntry::minimal("a.example.com", "uid-a", 1_000);
-
-        assert!(
-            !entry_is_pull_complete(&entry, &registry),
-            "entry missing a pull partner ID should be incomplete"
-        );
-
-        entry.ids.insert(
-            "b.example.com".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "uid-b".to_owned(),
-            },
-        );
-
-        assert!(
-            entry_is_pull_complete(&entry, &registry),
-            "entry with every pull partner ID should be complete"
-        );
-    }
-
     #[test]
     fn validated_pull_sync_url_rejects_http_scheme() {
-        let mut partner = pull_partner(3600);
+        let mut partner = pull_partner();
         partner.pull_sync_url = Some("http://sync.partner.test/pull".to_owned());
 
-        let validated = validated_pull_sync_url(&partner);
+        let validated = validated_pull_sync_url(
+            partner.pull_sync_url.as_deref(),
+            &partner.pull_sync_allowed_domains,
+        );
         assert!(
             validated.is_none(),
             "should reject pull_sync_url with HTTP scheme"
@@ -727,10 +96,13 @@ mod tests {
 
     #[test]
     fn validated_pull_sync_url_rejects_non_allowlisted_host() {
-        let mut partner = pull_partner(3600);
+        let mut partner = pull_partner();
         partner.pull_sync_url = Some("https://evil.test/pull".to_owned());
 
-        let validated = validated_pull_sync_url(&partner);
+        let validated = validated_pull_sync_url(
+            partner.pull_sync_url.as_deref(),
+            &partner.pull_sync_allowed_domains,
+        );
         assert!(
             validated.is_none(),
             "should reject runtime pull_sync_url host outside allowlist"
@@ -739,11 +111,14 @@ mod tests {
 
     #[test]
     fn validated_pull_sync_url_accepts_normalized_allowlist_match() {
-        let mut partner = pull_partner(3600);
+        let mut partner = pull_partner();
         partner.pull_sync_url = Some("https://SYNC.PARTNER.TEST./pull".to_owned());
         partner.pull_sync_allowed_domains = vec!["sync.partner.test".to_owned()];
 
-        let validated = validated_pull_sync_url(&partner);
+        let validated = validated_pull_sync_url(
+            partner.pull_sync_url.as_deref(),
+            &partner.pull_sync_allowed_domains,
+        );
         assert!(
             validated.is_some(),
             "should accept allowlist match after hostname normalization"
@@ -763,488 +138,4 @@ mod tests {
             "should not forward client IP to partners"
         );
     }
-
-    #[test]
-    fn pull_rate_limit_key_uses_ec_hash_only() {
-        let first_ec_id = format!("{}.ABC123", "a".repeat(64));
-        let second_ec_id = format!("{}.XYZ789", "a".repeat(64));
-
-        let first_key = pull_rate_limit_key("ssp.example.com", &first_ec_id);
-        let second_key = pull_rate_limit_key("ssp.example.com", &second_ec_id);
-
-        assert_eq!(
-            first_key, second_key,
-            "should bucket different suffixes for the same EC hash together"
-        );
-        assert_eq!(
-            first_key,
-            format!("pull:ssp.example.com:{}", "a".repeat(64)),
-            "should key pull-sync rate limiting by source domain and EC hash"
-        );
-    }
-
-    #[test]
-    fn extract_pull_uid_treats_404_as_noop() {
-        let response = make_response(404, b"");
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert!(uid.is_none(), "should treat 404 as no-op");
-    }
-
-    #[test]
-    fn extract_pull_uid_treats_uid_null_as_noop() {
-        let response = make_response(200, b"{\"uid\":null}");
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert!(uid.is_none(), "should treat uid=null as no-op");
-    }
-
-    #[test]
-    fn extract_pull_uid_rejects_oversized_uid() {
-        let long_uid = "x".repeat(513);
-        let body = format!("{{\"uid\":\"{long_uid}\"}}");
-        let response = make_response(200, body.as_bytes());
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert!(uid.is_none(), "should reject uid exceeding 512 bytes");
-    }
-
-    #[test]
-    fn extract_pull_uid_reads_uid_from_success_body() {
-        let response = make_response(200, b"{\"uid\":\"abc123\"}");
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert_eq!(
-            uid.as_deref(),
-            Some("abc123"),
-            "should parse uid from 200 body"
-        );
-    }
-
-    #[test]
-    fn extract_pull_uid_rejects_oversized_content_length_before_body_read() {
-        let response = make_response_with_content_length(
-            200,
-            MAX_PULL_RESPONSE_BYTES + 1,
-            b"{\"uid\":\"abc123\"}",
-        );
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert!(
-            uid.is_none(),
-            "should reject oversized Content-Length before parsing body"
-        );
-    }
-
-    #[test]
-    fn extract_pull_uid_accepts_small_body_without_content_length() {
-        let response = make_response(200, b"{\"uid\":\"abc123\"}");
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert_eq!(
-            uid.as_deref(),
-            Some("abc123"),
-            "should accept small valid response without Content-Length"
-        );
-    }
-
-    #[test]
-    fn extract_pull_uid_rejects_body_larger_than_limit() {
-        let body = format!("{{\"uid\":\"{}\"}}", "x".repeat(MAX_PULL_RESPONSE_BYTES));
-        let response = make_response(200, body.as_bytes());
-
-        let uid = extract_pull_uid(response, "ssp.example.com");
-        assert!(uid.is_none(), "should reject body larger than limit");
-    }
-
-    #[test]
-    fn rotating_offset_distributes_partners_across_hours() {
-        // Simulate 3 partners sorted by source domain: alpha, beta, gamma.
-        let ids = vec!["alpha.example.com", "beta.example.com", "gamma.example.com"];
-
-        // Hour 0: offset = 0 % 3 = 0 → [alpha, beta, gamma]
-        let ts_h0: u64 = 100; // within hour 0
-        let offset_h0 = (ts_h0 / 3600) as usize % ids.len();
-        assert_eq!(offset_h0, 0, "hour 0 should start at index 0");
-
-        // Hour 1: offset = (3600 / 3600) % 3 = 1 → [beta, gamma, alpha]
-        let offset_h1 = (3600u64 / 3600) as usize % ids.len();
-        assert_eq!(offset_h1, 1, "hour 1 should start at index 1");
-
-        // Hour 2: offset = (7200 / 3600) % 3 = 2 → [gamma, alpha, beta]
-        let offset_h2 = (7200u64 / 3600) as usize % ids.len();
-        assert_eq!(offset_h2, 2, "hour 2 should start at index 2");
-
-        // Hour 3: offset = (10800 / 3600) % 3 = 0 → wraps back to [alpha, beta, gamma]
-        let offset_h3 = (10800u64 / 3600) as usize % ids.len();
-        assert_eq!(offset_h3, 0, "hour 3 should wrap back to index 0");
-
-        // Verify rotate_left produces expected ordering
-        let mut rotated = ids.clone();
-        rotated.rotate_left(offset_h1);
-        assert_eq!(
-            rotated,
-            vec!["beta.example.com", "gamma.example.com", "alpha.example.com"],
-            "hour 1 rotation should move beta to front"
-        );
-    }
-
-    // -----------------------------------------------------------------------
-    // Snapshot-driven eligibility and request-wide aggregation
-    // -----------------------------------------------------------------------
-
-    use crate::ec::kv::TombstoneOutcome;
-    use crate::error::TrustedServerError;
-    use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
-    use crate::settings::EcPartner;
-    use crate::test_support::tests::create_test_settings;
-    use error_stack::Report;
-    use std::sync::Arc;
-
-    struct AllowAllRateLimiter;
-
-    impl RateLimiter for AllowAllRateLimiter {
-        fn exceeded(
-            &self,
-            _key: &str,
-            _hourly_limit: u32,
-        ) -> Result<bool, Report<TrustedServerError>> {
-            Ok(false)
-        }
-    }
-
-    fn pull_enabled_ec_partner(source_domain: &str) -> EcPartner {
-        EcPartner {
-            name: format!("Partner {source_domain}"),
-            source_domain: source_domain.to_owned(),
-            openrtb_atype: EcPartner::default_openrtb_atype(),
-            bidstream_enabled: true,
-            api_token: Some(Redacted::new(format!(
-                "{source_domain}-api-token-32-bytes-minimum"
-            ))),
-            batch_rate_limit: EcPartner::default_batch_rate_limit(),
-            pull_sync_enabled: true,
-            pull_sync_url: Some(format!("https://{source_domain}/sync")),
-            pull_sync_allowed_domains: vec![source_domain.to_owned()],
-            pull_sync_ttl_sec: 3600,
-            pull_sync_rate_limit: 100,
-            ts_pull_token: Some(Redacted::new("outbound-token".to_owned())),
-        }
-    }
-
-    fn snapshot_ec_id() -> String {
-        format!("{}.ABC123", "a".repeat(64))
-    }
-
-    fn seed_present_snapshot(graph: &KvIdentityGraph, ec_id: &str) -> EcKvSnapshot {
-        let mut entry = KvEntry::tombstone(1000);
-        entry.consent.ok = true;
-        graph.create(ec_id, &entry).expect("should seed live entry");
-        graph.load_snapshot(ec_id)
-    }
-
-    #[test]
-    fn dispatch_pull_sync_aggregates_batches_into_one_bulk_write() {
-        let mut settings = create_test_settings();
-        // Force one partner per concurrency batch so responses span batches.
-        settings.ec.pull_sync_concurrency = 1;
-        let registry = PartnerRegistry::from_config(&[
-            pull_enabled_ec_partner("alpha.example.com"),
-            pull_enabled_ec_partner("beta.example.com"),
-        ])
-        .expect("should build pull registry");
-
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let ec_id = snapshot_ec_id();
-        let snapshot = seed_present_snapshot(&graph, &ec_id);
-
-        let stub = Arc::new(StubHttpClient::new());
-        // One JSON response per partner, drained across two concurrency batches.
-        stub.push_response(200, br#"{"uid":"synced-uid"}"#.to_vec());
-        stub.push_response(200, br#"{"uid":"synced-uid"}"#.to_vec());
-        let services = build_services_with_http_client(stub.clone());
-
-        let context = PullSyncContext {
-            ec_id: ec_id.clone(),
-            snapshot,
-        };
-        dispatch_pull_sync(
-            &settings,
-            &graph,
-            &registry,
-            &AllowAllRateLimiter,
-            &context,
-            &services,
-        );
-
-        let (entry, generation) = graph
-            .get(&ec_id)
-            .expect("should read store")
-            .expect("entry should exist");
-        assert_eq!(
-            entry.ids.get("alpha.example.com").map(|id| id.uid.as_str()),
-            Some("synced-uid"),
-            "first partner UID should persist"
-        );
-        assert_eq!(
-            entry.ids.get("beta.example.com").map(|id| id.uid.as_str()),
-            Some("synced-uid"),
-            "second partner UID should persist"
-        );
-        assert_eq!(
-            generation, 2,
-            "two partner responses across batches must persist in exactly one bulk write"
-        );
-    }
-
-    #[test]
-    fn dispatch_pull_sync_calls_and_persists_only_missing_partner() {
-        let mut settings = create_test_settings();
-        settings.ec.pull_sync_concurrency = 4;
-        let registry = PartnerRegistry::from_config(&[
-            pull_enabled_ec_partner("alpha.example.com"),
-            pull_enabled_ec_partner("beta.example.com"),
-        ])
-        .expect("should build pull registry");
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let ec_id = snapshot_ec_id();
-        graph
-            .create(
-                &ec_id,
-                &KvEntry::minimal("alpha.example.com", "existing-alpha", 1_000),
-            )
-            .expect("should seed partial entry");
-        let snapshot = graph.load_snapshot(&ec_id);
-        let stub = Arc::new(StubHttpClient::new());
-        stub.push_response(200, br#"{"uid":"new-beta"}"#.to_vec());
-        let services = build_services_with_http_client(stub.clone());
-        let context = PullSyncContext {
-            ec_id: ec_id.clone(),
-            snapshot,
-        };
-
-        dispatch_pull_sync(
-            &settings,
-            &graph,
-            &registry,
-            &AllowAllRateLimiter,
-            &context,
-            &services,
-        );
-
-        assert_eq!(
-            stub.recorded_backend_names().len(),
-            1,
-            "should call only the missing partner"
-        );
-        let (entry, generation) = graph
-            .get(&ec_id)
-            .expect("should read store")
-            .expect("entry should exist");
-        assert_eq!(
-            entry
-                .ids
-                .get("alpha.example.com")
-                .map(|partner_id| partner_id.uid.as_str()),
-            Some("existing-alpha"),
-            "existing UID should remain unchanged"
-        );
-        assert_eq!(
-            entry
-                .ids
-                .get("beta.example.com")
-                .map(|partner_id| partner_id.uid.as_str()),
-            Some("new-beta"),
-            "missing UID should persist"
-        );
-        assert_eq!(generation, 2, "missing UID should use one bulk CAS write");
-    }
-
-    #[test]
-    fn dispatch_pull_sync_skips_non_present_snapshots() {
-        let mut settings = create_test_settings();
-        settings.ec.pull_sync_concurrency = 4;
-        let registry =
-            PartnerRegistry::from_config(&[pull_enabled_ec_partner("alpha.example.com")])
-                .expect("should build registry");
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let ec_id = snapshot_ec_id();
-        let stub = Arc::new(StubHttpClient::new());
-        let services = build_services_with_http_client(stub.clone());
-
-        for snapshot in [
-            EcKvSnapshot::NotRead,
-            EcKvSnapshot::Missing {
-                ec_id: ec_id.clone(),
-            },
-            EcKvSnapshot::Failed {
-                ec_id: ec_id.clone(),
-            },
-        ] {
-            let context = PullSyncContext {
-                ec_id: ec_id.clone(),
-                snapshot,
-            };
-            dispatch_pull_sync(
-                &settings,
-                &graph,
-                &registry,
-                &AllowAllRateLimiter,
-                &context,
-                &services,
-            );
-        }
-
-        assert!(
-            stub.recorded_backend_names().is_empty(),
-            "not-read, missing, and failed snapshots must not dispatch pull sync"
-        );
-        assert!(
-            graph.get(&ec_id).expect("should read store").is_none(),
-            "no snapshot state should create a missing root"
-        );
-    }
-
-    #[test]
-    fn dispatch_pull_sync_skips_tombstone_snapshot() {
-        let mut settings = create_test_settings();
-        settings.ec.pull_sync_concurrency = 4;
-        let registry =
-            PartnerRegistry::from_config(&[pull_enabled_ec_partner("alpha.example.com")])
-                .expect("should build registry");
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let ec_id = snapshot_ec_id();
-        let snapshot = EcKvSnapshot::Present {
-            ec_id: ec_id.clone(),
-            entry: Box::new(KvEntry::tombstone(1000)),
-            generation: Some(1),
-        };
-        let stub = Arc::new(StubHttpClient::new());
-        let services = build_services_with_http_client(stub.clone());
-
-        let context = PullSyncContext {
-            ec_id: ec_id.clone(),
-            snapshot,
-        };
-        dispatch_pull_sync(
-            &settings,
-            &graph,
-            &registry,
-            &AllowAllRateLimiter,
-            &context,
-            &services,
-        );
-
-        assert!(
-            stub.recorded_backend_names().is_empty(),
-            "a tombstone snapshot must not dispatch pull sync"
-        );
-    }
-    #[test]
-    fn dispatch_pull_sync_skips_dispatch_when_ec_is_tombstoned_after_snapshot_capture() {
-        // The request snapshot authorized pull sync, then a concurrent request
-        // completed a CMP withdrawal while the page response was in flight.
-        // Pull sync runs post-send and discloses the raw `ec_id` to partners, so
-        // it must revalidate the live row and cancel rather than leak an
-        // identity the user just withdrew.
-        let mut settings = create_test_settings();
-        settings.ec.pull_sync_concurrency = 4;
-        let registry =
-            PartnerRegistry::from_config(&[pull_enabled_ec_partner("alpha.example.com")])
-                .expect("should build registry");
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let ec_id = snapshot_ec_id();
-        let snapshot = seed_present_snapshot(&graph, &ec_id);
-
-        // Concurrent withdrawal lands after the snapshot was captured.
-        assert_eq!(
-            graph
-                .write_withdrawal_tombstone(&ec_id, drop)
-                .expect("should tombstone the row"),
-            TombstoneOutcome::Written,
-            "should tombstone the row the snapshot still reports as present"
-        );
-
-        let stub = Arc::new(StubHttpClient::new());
-        stub.push_response(200, br#"{"uid":"leaked-uid"}"#.to_vec());
-        let services = build_services_with_http_client(stub.clone());
-
-        let context = PullSyncContext {
-            ec_id: ec_id.clone(),
-            snapshot,
-        };
-        dispatch_pull_sync(
-            &settings,
-            &graph,
-            &registry,
-            &AllowAllRateLimiter,
-            &context,
-            &services,
-        );
-
-        assert!(
-            stub.recorded_backend_names().is_empty(),
-            "a withdrawal that lands after snapshot capture must cancel post-send pull sync"
-        );
-        let (entry, _) = graph
-            .get(&ec_id)
-            .expect("should read store")
-            .expect("tombstone should remain");
-        assert!(
-            entry.ids.is_empty(),
-            "no partner UID may be written back onto a tombstoned row"
-        );
-    }
-
-    #[test]
-    fn dispatch_pull_sync_skips_revalidation_read_when_no_partner_is_eligible() {
-        // Every pull-enabled partner already has a UID in the request snapshot,
-        // so there is nothing to dispatch. The revalidation read exists to
-        // authorize outbound calls; with no calls to authorize it must not cost
-        // a KV operation.
-        let mut settings = create_test_settings();
-        settings.ec.pull_sync_concurrency = 4;
-        let registry =
-            PartnerRegistry::from_config(&[pull_enabled_ec_partner("alpha.example.com")])
-                .expect("should build registry");
-        let graph = KvIdentityGraph::in_memory("pull_store");
-        let ec_id = snapshot_ec_id();
-        let mut entry = KvEntry::tombstone(1000);
-        entry.consent.ok = true;
-        entry.ids.insert(
-            "alpha.example.com".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "already-known".to_owned(),
-            },
-        );
-        graph
-            .create(&ec_id, &entry)
-            .expect("should seed live entry");
-        let snapshot = EcKvSnapshot::Present {
-            ec_id: ec_id.clone(),
-            entry: Box::new(entry),
-            generation: Some(1),
-        };
-
-        let stub = Arc::new(StubHttpClient::new());
-        let services = build_services_with_http_client(stub.clone());
-
-        let context = PullSyncContext {
-            ec_id: ec_id.clone(),
-            snapshot,
-        };
-        dispatch_pull_sync(
-            &settings,
-            &graph,
-            &registry,
-            &AllowAllRateLimiter,
-            &context,
-            &services,
-        );
-
-        assert!(
-            stub.recorded_backend_names().is_empty(),
-            "a fully synced entry must not dispatch pull sync"
-        );
-    }
 }
diff --git a/crates/trusted-server-core/src/ec/pull_sync_marker.rs b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
deleted file mode 100644
index 11df47296f..0000000000
--- a/crates/trusted-server-core/src/ec/pull_sync_marker.rs
+++ /dev/null
@@ -1,693 +0,0 @@
-//! Short-lived browser marker for complete pull-sync partner state.
-
-use core::fmt;
-
-use edgezero_core::body::Body as EdgeBody;
-use hmac::{Hmac, KeyInit as _, Mac as _};
-use http::{HeaderValue, Response, header};
-use sha2::{Digest as _, Sha256};
-
-use crate::constants::COOKIE_TS_EC_PULL_COMPLETE;
-use crate::redacted::Redacted;
-use crate::settings::Settings;
-
-use super::pull_sync::entry_is_pull_complete;
-use super::registry::PartnerRegistry;
-use super::{EcKvSnapshot, current_timestamp};
-
-type HmacSha256 = Hmac<Sha256>;
-
-const MARKER_VERSION: &str = "v1";
-const MARKER_KEY_LABEL: &[u8] = b"trusted-server/ec-pull-complete/key/v1";
-const MARKER_MAX_AGE_SECS: u64 = 60 * 60;
-const MARKER_CLOCK_SKEW_SECS: u64 = 60;
-const MAX_MARKER_LENGTH: usize = 256;
-
-/// Request-local validation state for the pull-sync completeness marker.
-#[derive(Clone, Default)]
-pub(crate) enum PullSyncMarkerState {
-    /// No marker cookie was present.
-    #[default]
-    Absent,
-    /// A marker was present but has not been checked against the active EC and partner set.
-    Unvalidated(Redacted<String>),
-    /// A present marker failed validation or was disproved by authoritative KV state.
-    Invalid,
-    /// The marker is valid until the given Unix timestamp.
-    Valid { expires_at: u64 },
-}
-
-impl fmt::Debug for PullSyncMarkerState {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Absent => formatter.write_str("Absent"),
-            Self::Unvalidated(_) => formatter.write_str("Unvalidated(<redacted>)"),
-            Self::Invalid => formatter.write_str("Invalid"),
-            Self::Valid { expires_at } => formatter
-                .debug_struct("Valid")
-                .field("expires_at", expires_at)
-                .finish(),
-        }
-    }
-}
-
-impl PullSyncMarkerState {
-    /// Creates marker state from an optional request cookie value.
-    #[must_use]
-    pub(crate) fn from_cookie(value: Option<String>) -> Self {
-        value
-            .map(Redacted::new)
-            .map_or(Self::Absent, Self::Unvalidated)
-    }
-
-    /// Returns whether a marker cookie was present on the request.
-    #[must_use]
-    pub(crate) fn was_present(&self) -> bool {
-        !matches!(self, Self::Absent)
-    }
-
-    /// Returns whether the marker is currently valid.
-    #[must_use]
-    pub(crate) fn is_valid(&self) -> bool {
-        matches!(self, Self::Valid { .. })
-    }
-
-    /// Invalidates state bound to a replaced active EC ID.
-    pub(crate) fn invalidate_for_replaced_ec(&mut self) {
-        if self.was_present() {
-            *self = Self::Invalid;
-        }
-    }
-}
-
-/// Validates an unvalidated marker against the active EC and current pull-partner set.
-pub(crate) fn validate_marker_state(
-    state: &mut PullSyncMarkerState,
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: Option<&str>,
-) {
-    let PullSyncMarkerState::Unvalidated(value) = state else {
-        return;
-    };
-    let valid_until = ec_id.and_then(|ec_id| {
-        validate_marker(
-            value.expose(),
-            settings,
-            registry,
-            ec_id,
-            current_timestamp(),
-        )
-    });
-    *state = valid_until.map_or(PullSyncMarkerState::Invalid, |expires_at| {
-        PullSyncMarkerState::Valid { expires_at }
-    });
-}
-
-/// Reconciles browser marker state against finalized authoritative KV state.
-pub(crate) fn reconcile_marker(
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: Option<&str>,
-    snapshot: &EcKvSnapshot,
-    state: &mut PullSyncMarkerState,
-    response: &mut Response<EdgeBody>,
-) {
-    let pull_partners = sorted_pull_partner_domains(registry);
-    if pull_partners.is_empty() {
-        expire_if_present(state, response);
-        return;
-    }
-
-    let Some(ec_id) = ec_id else {
-        expire_if_present(state, response);
-        return;
-    };
-
-    if !matches!(snapshot, EcKvSnapshot::NotRead) && !snapshot.belongs_to(ec_id) {
-        expire_if_present(state, response);
-        return;
-    }
-
-    match snapshot {
-        EcKvSnapshot::Present { .. } => {
-            let entry = snapshot
-                .entry_for(ec_id)
-                .expect("snapshot binding should be checked before marker reconciliation");
-            if !entry.consent.ok {
-                expire_if_present(state, response);
-            } else if entry_is_pull_complete(entry, registry) {
-                if !state.is_valid() {
-                    set_marker(settings, registry, ec_id, state, response);
-                }
-            } else {
-                expire_if_present(state, response);
-            }
-        }
-        EcKvSnapshot::Missing { .. } => {
-            expire_if_present(state, response);
-        }
-        EcKvSnapshot::Failed { .. } | EcKvSnapshot::NotRead => {
-            if matches!(state, PullSyncMarkerState::Invalid) {
-                expire_if_present(state, response);
-            }
-        }
-    }
-}
-
-/// Expires the completeness marker regardless of KV state.
-pub(crate) fn expire_marker(state: &mut PullSyncMarkerState, response: &mut Response<EdgeBody>) {
-    append_cookie(response, &format_marker_cookie("", 0));
-    *state = PullSyncMarkerState::Absent;
-}
-
-fn set_marker(
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: &str,
-    state: &mut PullSyncMarkerState,
-    response: &mut Response<EdgeBody>,
-) {
-    let now = current_timestamp();
-    let expires_at = now.saturating_add(MARKER_MAX_AGE_SECS);
-    let Some(value) = create_marker(settings, registry, ec_id, expires_at) else {
-        return;
-    };
-    append_cookie(response, &format_marker_cookie(&value, MARKER_MAX_AGE_SECS));
-    *state = PullSyncMarkerState::Valid { expires_at };
-}
-
-fn expire_if_present(state: &mut PullSyncMarkerState, response: &mut Response<EdgeBody>) {
-    if state.was_present() {
-        expire_marker(state, response);
-    }
-}
-
-fn append_cookie(response: &mut Response<EdgeBody>, value: &str) {
-    match HeaderValue::from_str(value) {
-        Ok(value) => {
-            response.headers_mut().append(header::SET_COOKIE, value);
-        }
-        Err(err) => {
-            log::warn!("Skipping pull-sync marker cookie: invalid header value: {err}");
-        }
-    }
-}
-
-fn format_marker_cookie(value: &str, max_age: u64) -> String {
-    // Keep this cookie host-only. The signed payload does not include the
-    // request host, so a Domain attribute would allow replay across sibling
-    // hosts that share the domain-wide EC cookie and passphrase.
-    format!(
-        "{COOKIE_TS_EC_PULL_COMPLETE}={value}; Path=/; Secure; SameSite=Lax; Max-Age={max_age}; HttpOnly"
-    )
-}
-
-#[cfg(test)]
-pub(crate) fn create_marker_for_test(
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: &str,
-) -> String {
-    create_marker_for_test_with_expiry(
-        settings,
-        registry,
-        ec_id,
-        current_timestamp().saturating_add(MARKER_MAX_AGE_SECS),
-    )
-}
-
-#[cfg(test)]
-pub(crate) fn create_marker_for_test_with_expiry(
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: &str,
-    expires_at: u64,
-) -> String {
-    create_marker(settings, registry, ec_id, expires_at)
-        .expect("should create marker for non-empty test registry")
-}
-
-fn create_marker(
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: &str,
-    expires_at: u64,
-) -> Option<String> {
-    let fingerprint = partner_set_fingerprint(registry)?;
-    let payload = marker_payload(ec_id, expires_at, &fingerprint);
-    let key = marker_key(settings);
-    let mut mac = HmacSha256::new_from_slice(&key).expect("should create marker HMAC");
-    mac.update(payload.as_bytes());
-    let tag = hex::encode(mac.finalize().into_bytes());
-    Some(format!("{MARKER_VERSION}.{expires_at}.{fingerprint}.{tag}"))
-}
-
-fn validate_marker(
-    value: &str,
-    settings: &Settings,
-    registry: &PartnerRegistry,
-    ec_id: &str,
-    now: u64,
-) -> Option<u64> {
-    if value.len() > MAX_MARKER_LENGTH {
-        return None;
-    }
-
-    let mut segments = value.split('.');
-    let version = segments.next()?;
-    let expires = segments.next()?;
-    let fingerprint = segments.next()?;
-    let tag = segments.next()?;
-    if segments.next().is_some() || version != MARKER_VERSION {
-        return None;
-    }
-
-    let expires_at = expires.parse::<u64>().ok()?;
-    let max_future = now
-        .saturating_add(MARKER_MAX_AGE_SECS)
-        .saturating_add(MARKER_CLOCK_SKEW_SECS);
-    if expires_at <= now || expires_at > max_future {
-        return None;
-    }
-
-    let expected_fingerprint = partner_set_fingerprint(registry)?;
-    if fingerprint != expected_fingerprint {
-        return None;
-    }
-
-    let tag = hex::decode(tag).ok()?;
-    if tag.len() != 32 {
-        return None;
-    }
-
-    let payload = marker_payload(ec_id, expires_at, fingerprint);
-    let key = marker_key(settings);
-    let mut mac = HmacSha256::new_from_slice(&key).expect("should create marker HMAC");
-    mac.update(payload.as_bytes());
-    mac.verify_slice(&tag).ok()?;
-    Some(expires_at)
-}
-
-fn marker_key(settings: &Settings) -> [u8; 32] {
-    let mut mac = HmacSha256::new_from_slice(settings.ec.passphrase.expose().as_bytes())
-        .expect("should create marker key HMAC");
-    mac.update(MARKER_KEY_LABEL);
-    mac.finalize().into_bytes().into()
-}
-
-fn marker_payload(ec_id: &str, expires_at: u64, fingerprint: &str) -> String {
-    format!("{MARKER_VERSION}\0{ec_id}\0{expires_at}\0{fingerprint}")
-}
-
-fn partner_set_fingerprint(registry: &PartnerRegistry) -> Option<String> {
-    let domains = sorted_pull_partner_domains(registry);
-    if domains.is_empty() {
-        return None;
-    }
-
-    let mut hasher = Sha256::new();
-    hasher.update(b"trusted-server/ec-pull-partners/v1\0");
-    for domain in domains {
-        hasher.update((domain.len() as u64).to_be_bytes());
-        hasher.update(domain.as_bytes());
-    }
-    Some(hex::encode(hasher.finalize()))
-}
-
-fn sorted_pull_partner_domains(registry: &PartnerRegistry) -> Vec<String> {
-    let mut domains = registry
-        .pull_enabled_partners()
-        .into_iter()
-        .map(|partner| partner.source_domain.clone())
-        .collect::<Vec<_>>();
-    domains.sort();
-    domains
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::ec::kv_types::KvEntry;
-    use crate::redacted::Redacted;
-    use crate::settings::{EcPartner, Settings};
-    use crate::test_support::tests::create_test_settings;
-
-    const EC_ID: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.ABC123";
-
-    fn pull_partner(source_domain: &str) -> EcPartner {
-        EcPartner {
-            name: format!("Partner {source_domain}"),
-            source_domain: source_domain.to_owned(),
-            openrtb_atype: EcPartner::default_openrtb_atype(),
-            bidstream_enabled: true,
-            api_token: Some(Redacted::new(format!(
-                "token-{source_domain}-32-bytes-minimum-value"
-            ))),
-            batch_rate_limit: EcPartner::default_batch_rate_limit(),
-            pull_sync_enabled: true,
-            pull_sync_url: Some(format!("https://sync.{source_domain}/pull")),
-            pull_sync_allowed_domains: vec![format!("sync.{source_domain}")],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
-            ts_pull_token: Some(Redacted::new("pull-token".to_owned())),
-        }
-    }
-
-    fn settings_and_registry(domains: &[&str]) -> (Settings, PartnerRegistry) {
-        let mut settings = create_test_settings();
-        settings.ec.partners = domains.iter().map(|domain| pull_partner(domain)).collect();
-        let registry = PartnerRegistry::from_config(&settings.ec.partners)
-            .expect("should build pull partner registry");
-        (settings, registry)
-    }
-
-    fn empty_response() -> Response<EdgeBody> {
-        Response::builder()
-            .status(200)
-            .body(EdgeBody::empty())
-            .expect("should build response")
-    }
-
-    fn live_snapshot(ec_id: &str, domains: &[&str]) -> EcKvSnapshot {
-        let mut entry = KvEntry::tombstone(1_000);
-        entry.consent.ok = true;
-        for domain in domains {
-            entry.ids.insert(
-                (*domain).to_owned(),
-                crate::ec::kv_types::KvPartnerId {
-                    uid: format!("uid-{domain}"),
-                },
-            );
-        }
-        EcKvSnapshot::Present {
-            ec_id: ec_id.to_owned(),
-            entry: Box::new(entry),
-            generation: Some(1),
-        }
-    }
-
-    fn marker_cookies(response: &Response<EdgeBody>) -> Vec<&str> {
-        response
-            .headers()
-            .get_all(header::SET_COOKIE)
-            .iter()
-            .filter_map(|value| value.to_str().ok())
-            .collect()
-    }
-
-    fn assert_expired(state: &PullSyncMarkerState, response: &Response<EdgeBody>) {
-        assert!(matches!(state, PullSyncMarkerState::Absent));
-        assert_eq!(
-            marker_cookies(response),
-            vec!["ts-ec-pull-complete=; Path=/; Secure; SameSite=Lax; Max-Age=0; HttpOnly"],
-            "should emit the exact host-only expiration cookie"
-        );
-    }
-
-    #[test]
-    fn marker_round_trip_binds_ec_and_partner_set() {
-        let (settings, registry) = settings_and_registry(&["a.example.com", "b.example.com"]);
-        let now = 1_000;
-        let marker =
-            create_marker(&settings, &registry, EC_ID, now + 3_600).expect("should create marker");
-
-        assert_eq!(
-            validate_marker(&marker, &settings, &registry, EC_ID, now),
-            Some(now + 3_600),
-            "should validate the issued marker"
-        );
-        assert!(
-            validate_marker(&marker, &settings, &registry, "wrong", now).is_none(),
-            "should reject a marker for another EC"
-        );
-    }
-
-    #[test]
-    fn marker_fingerprint_is_order_independent_and_set_sensitive() {
-        let (settings, first) = settings_and_registry(&["a.example.com", "b.example.com"]);
-        let (_, reordered) = settings_and_registry(&["b.example.com", "a.example.com"]);
-        let (_, changed) = settings_and_registry(&["a.example.com", "c.example.com"]);
-        let marker = create_marker(&settings, &first, EC_ID, 4_600).expect("should create marker");
-
-        assert!(
-            validate_marker(&marker, &settings, &reordered, EC_ID, 1_000).is_some(),
-            "config ordering should not change the marker"
-        );
-        assert!(
-            validate_marker(&marker, &settings, &changed, EC_ID, 1_000).is_none(),
-            "partner-set changes should invalidate the marker"
-        );
-    }
-
-    #[test]
-    fn fingerprint_changes_for_enable_disable_add_and_remove() {
-        let (_, enabled_one) = settings_and_registry(&["a.example.com"]);
-        let (_, enabled_two) = settings_and_registry(&["a.example.com", "b.example.com"]);
-        let mut disabled_config = pull_partner("a.example.com");
-        disabled_config.pull_sync_enabled = false;
-        let disabled = PartnerRegistry::from_config(&[disabled_config])
-            .expect("should build disabled registry");
-        let removed = PartnerRegistry::empty();
-
-        let base = partner_set_fingerprint(&enabled_one);
-        assert_ne!(
-            base,
-            partner_set_fingerprint(&enabled_two),
-            "adding a pull partner should change the fingerprint"
-        );
-        assert_ne!(
-            base,
-            partner_set_fingerprint(&disabled),
-            "disabling a pull partner should change the fingerprint"
-        );
-        assert_ne!(
-            base,
-            partner_set_fingerprint(&removed),
-            "removing a pull partner should change the fingerprint"
-        );
-        assert_ne!(
-            partner_set_fingerprint(&disabled),
-            partner_set_fingerprint(&enabled_one),
-            "enabling a partner should change the fingerprint"
-        );
-    }
-
-    #[test]
-    fn reconcile_rejects_snapshot_bound_to_different_ec() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let snapshot = live_snapshot("different-ec", &["a.example.com"]);
-        let mut valid_state = PullSyncMarkerState::Valid { expires_at: 4_600 };
-        let mut valid_response = empty_response();
-
-        reconcile_marker(
-            &settings,
-            &registry,
-            Some(EC_ID),
-            &snapshot,
-            &mut valid_state,
-            &mut valid_response,
-        );
-        assert_expired(&valid_state, &valid_response);
-
-        let mut absent_state = PullSyncMarkerState::Absent;
-        let mut absent_response = empty_response();
-        reconcile_marker(
-            &settings,
-            &registry,
-            Some(EC_ID),
-            &snapshot,
-            &mut absent_state,
-            &mut absent_response,
-        );
-        assert!(marker_cookies(&absent_response).is_empty());
-        assert!(matches!(absent_state, PullSyncMarkerState::Absent));
-    }
-
-    #[test]
-    fn authoritative_incomplete_states_expire_valid_marker() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let mut tombstone = KvEntry::tombstone(1_000);
-        tombstone.ids.insert(
-            "a.example.com".to_owned(),
-            crate::ec::kv_types::KvPartnerId {
-                uid: "stale".to_owned(),
-            },
-        );
-        let snapshots = [
-            live_snapshot(EC_ID, &[]),
-            EcKvSnapshot::Missing {
-                ec_id: EC_ID.to_owned(),
-            },
-            EcKvSnapshot::Present {
-                ec_id: EC_ID.to_owned(),
-                entry: Box::new(tombstone),
-                generation: Some(1),
-            },
-        ];
-
-        for snapshot in snapshots {
-            let mut state = PullSyncMarkerState::Valid { expires_at: 4_600 };
-            let mut response = empty_response();
-            reconcile_marker(
-                &settings,
-                &registry,
-                Some(EC_ID),
-                &snapshot,
-                &mut state,
-                &mut response,
-            );
-            assert_expired(&state, &response);
-        }
-    }
-
-    #[test]
-    fn non_authoritative_states_preserve_valid_fixed_expiry_marker() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let snapshots = [
-            EcKvSnapshot::Failed {
-                ec_id: EC_ID.to_owned(),
-            },
-            EcKvSnapshot::NotRead,
-        ];
-
-        for snapshot in snapshots {
-            let mut state = PullSyncMarkerState::Valid { expires_at: 4_600 };
-            let mut response = empty_response();
-            reconcile_marker(
-                &settings,
-                &registry,
-                Some(EC_ID),
-                &snapshot,
-                &mut state,
-                &mut response,
-            );
-            assert!(matches!(
-                state,
-                PullSyncMarkerState::Valid { expires_at: 4_600 }
-            ));
-            assert!(marker_cookies(&response).is_empty());
-        }
-    }
-
-    #[test]
-    fn steady_states_leave_the_marker_cookie_untouched() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let complete = live_snapshot(EC_ID, &["a.example.com"]);
-        let incomplete = live_snapshot(EC_ID, &[]);
-        let cases = [
-            (PullSyncMarkerState::Valid { expires_at: 4_600 }, &complete),
-            (PullSyncMarkerState::Absent, &incomplete),
-        ];
-
-        for (mut state, snapshot) in cases {
-            let mut response = empty_response();
-            reconcile_marker(
-                &settings,
-                &registry,
-                Some(EC_ID),
-                snapshot,
-                &mut state,
-                &mut response,
-            );
-            assert!(
-                marker_cookies(&response).is_empty(),
-                "a steady marker state should not add a Set-Cookie header"
-            );
-        }
-    }
-
-    #[test]
-    fn invalid_marker_is_cleared_without_authoritative_snapshot() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let mut state = PullSyncMarkerState::Invalid;
-        let mut response = empty_response();
-
-        reconcile_marker(
-            &settings,
-            &registry,
-            Some(EC_ID),
-            &EcKvSnapshot::NotRead,
-            &mut state,
-            &mut response,
-        );
-
-        assert_expired(&state, &response);
-    }
-
-    #[test]
-    fn marker_allows_sixty_seconds_of_issuer_clock_skew() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let marker =
-            create_marker(&settings, &registry, EC_ID, 4_600).expect("should create marker");
-
-        assert_eq!(
-            validate_marker(&marker, &settings, &registry, EC_ID, 940),
-            Some(4_600),
-            "a marker from an issuer sixty seconds ahead should remain valid"
-        );
-    }
-
-    #[test]
-    fn marker_rejects_expired_overlong_and_tampered_values() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let marker =
-            create_marker(&settings, &registry, EC_ID, 4_600).expect("should create marker");
-        let mut tampered = marker.clone();
-        tampered.push('0');
-
-        assert!(
-            validate_marker(&marker, &settings, &registry, EC_ID, 4_600).is_none(),
-            "expired marker should fail"
-        );
-        assert!(
-            validate_marker(&marker, &settings, &registry, EC_ID, 939).is_none(),
-            "marker beyond the lifetime and clock-skew allowance should fail"
-        );
-        assert!(
-            validate_marker(&tampered, &settings, &registry, EC_ID, 1_000).is_none(),
-            "tampering should fail"
-        );
-        assert!(
-            validate_marker(
-                &"x".repeat(MAX_MARKER_LENGTH + 1),
-                &settings,
-                &registry,
-                EC_ID,
-                1_000
-            )
-            .is_none(),
-            "overlong marker should fail"
-        );
-    }
-
-    #[test]
-    fn marker_rejects_wrong_passphrase_and_empty_partner_set() {
-        let (settings, registry) = settings_and_registry(&["a.example.com"]);
-        let marker =
-            create_marker(&settings, &registry, EC_ID, 4_600).expect("should create marker");
-        let mut changed_settings = settings.clone();
-        changed_settings.ec.passphrase =
-            Redacted::new("different-secret-key-32-bytes-minimum".to_owned());
-        let empty = PartnerRegistry::empty();
-
-        assert!(
-            validate_marker(&marker, &changed_settings, &registry, EC_ID, 1_000).is_none(),
-            "passphrase rotation should invalidate the marker"
-        );
-        assert!(
-            create_marker(&settings, &empty, EC_ID, 4_600).is_none(),
-            "empty partner sets should not produce a marker"
-        );
-    }
-
-    #[test]
-    fn marker_cookie_is_host_only_and_secure() {
-        let cookie = format_marker_cookie("value", MARKER_MAX_AGE_SECS);
-        assert_eq!(
-            cookie,
-            "ts-ec-pull-complete=value; Path=/; Secure; SameSite=Lax; Max-Age=3600; HttpOnly"
-        );
-        assert!(!cookie.contains("Domain="), "marker should be host-only");
-    }
-}
diff --git a/crates/trusted-server-core/src/ec/rate_limiter.rs b/crates/trusted-server-core/src/ec/rate_limiter.rs
index 5a5dac27e5..5fa335f20b 100644
--- a/crates/trusted-server-core/src/ec/rate_limiter.rs
+++ b/crates/trusted-server-core/src/ec/rate_limiter.rs
@@ -45,4 +45,20 @@ pub trait RateLimiter {
         // hourly API used by pixel sync.
         self.exceeded(key, per_minute_limit.saturating_mul(60))
     }
+
+    /// Adds one to the 60-second count for `key`, without checking a limit.
+    ///
+    /// The identity circuit breaker records one provider failure this way.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError`] on rate counter I/O failure.
+    fn record(&self, key: &str) -> Result<(), Report<TrustedServerError>>;
+
+    /// Returns the 60-second count for `key`, without changing it.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError`] on rate counter I/O failure.
+    fn count(&self, key: &str) -> Result<u32, Report<TrustedServerError>>;
 }
diff --git a/crates/trusted-server-core/src/ec/registry.rs b/crates/trusted-server-core/src/ec/registry.rs
index c4637b4310..357ba4b53f 100644
--- a/crates/trusted-server-core/src/ec/registry.rs
+++ b/crates/trusted-server-core/src/ec/registry.rs
@@ -38,15 +38,10 @@ pub struct PartnerConfig {
     pub pull_sync_url: Option<String>,
     /// Allowlist of domains TS may call for this partner's pull sync.
     pub pull_sync_allowed_domains: Vec<String>,
-    /// Legacy seconds between pull sync refreshes retained for config compatibility.
-    ///
-    /// Pull sync currently fills missing partner UIDs only, so this value is
-    /// not used to refresh existing UIDs.
-    pub pull_sync_ttl_sec: u64,
-    /// Max pull sync calls per EC hash per partner per hour.
-    pub pull_sync_rate_limit: u32,
     /// Outbound bearer token for pull sync requests.
     pub ts_pull_token: Option<Redacted<String>>,
+    /// The identity provider that owns this source, when one does.
+    pub owner: Option<String>,
 }
 
 /// In-memory partner registry with O(1) lookups by source domain and API key hash.
@@ -103,14 +98,13 @@ impl PartnerRegistry {
                 }));
             }
 
-            validate_rate_limits_values(partner.batch_rate_limit, partner.pull_sync_rate_limit)
-                .map_err(|error| {
-                    Report::new(TrustedServerError::Configuration {
-                        message: format!(
-                            "ec.partners: invalid rate limits for '{normalized_source}': {error}"
-                        ),
-                    })
-                })?;
+            validate_rate_limits_values(partner.batch_rate_limit).map_err(|error| {
+                Report::new(TrustedServerError::Configuration {
+                    message: format!(
+                        "ec.partners: invalid rate limits for '{normalized_source}': {error}"
+                    ),
+                })
+            })?;
 
             if partner.pull_sync_enabled {
                 validate_pull_sync_fields(
@@ -302,34 +296,24 @@ fn build_partner_config(
         pull_sync_enabled: partner.pull_sync_enabled,
         pull_sync_url: partner.pull_sync_url.clone(),
         pull_sync_allowed_domains: partner.pull_sync_allowed_domains.clone(),
-        pull_sync_ttl_sec: partner.pull_sync_ttl_sec,
-        pull_sync_rate_limit: partner.pull_sync_rate_limit,
         ts_pull_token: partner.ts_pull_token.clone(),
+        owner: partner.owner.clone(),
     }
 }
 
 fn validate_rate_limits(config: &PartnerConfig) -> Result<(), Report<TrustedServerError>> {
-    validate_rate_limits_values(config.batch_rate_limit, config.pull_sync_rate_limit).map_err(
-        |message| {
-            Report::new(TrustedServerError::Configuration {
-                message: message.to_owned(),
-            })
-        },
-    )
+    validate_rate_limits_values(config.batch_rate_limit).map_err(|message| {
+        Report::new(TrustedServerError::Configuration {
+            message: message.to_owned(),
+        })
+    })
 }
 
-fn validate_rate_limits_values(
-    batch_rate_limit: u32,
-    pull_sync_rate_limit: u32,
-) -> Result<(), &'static str> {
+fn validate_rate_limits_values(batch_rate_limit: u32) -> Result<(), &'static str> {
     if batch_rate_limit == 0 {
         return Err("batch_rate_limit must be greater than 0");
     }
 
-    if pull_sync_rate_limit == 0 {
-        return Err("pull_sync_rate_limit must be greater than 0");
-    }
-
     Ok(())
 }
 
@@ -429,8 +413,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: vec![],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: None,
         }
     }
@@ -669,17 +654,4 @@ mod tests {
         let result = PartnerRegistry::from_config(&[partner]);
         assert!(result.is_err(), "should reject zero batch_rate_limit");
     }
-
-    #[test]
-    fn zero_pull_sync_rate_limit_is_rejected() {
-        let mut partner = make_partner("pull.example.com", &valid_api_token("token-p"));
-        partner.pull_sync_enabled = true;
-        partner.pull_sync_url = Some("https://pull.example.com/sync".to_owned());
-        partner.pull_sync_allowed_domains = vec!["pull.example.com".to_owned()];
-        partner.pull_sync_rate_limit = 0;
-        partner.ts_pull_token = Some(Redacted::new("outbound-token".to_owned()));
-
-        let result = PartnerRegistry::from_config(&[partner]);
-        assert!(result.is_err(), "should reject zero pull_sync_rate_limit");
-    }
 }
diff --git a/crates/trusted-server-core/src/geo.rs b/crates/trusted-server-core/src/geo.rs
index 63f7907f53..fe5785d260 100644
--- a/crates/trusted-server-core/src/geo.rs
+++ b/crates/trusted-server-core/src/geo.rs
@@ -48,6 +48,24 @@ impl GeoInfo {
     }
 }
 
+/// Carries the outcome of a request-phase geo lookup across to
+/// response-phase finalization, so a finalize consumer can reuse it instead
+/// of performing a second lookup for the same request.
+///
+/// Attached as a response extension on every exit path that attempted a
+/// lookup, including the asset-route fallback (which does not carry an EC
+/// finalize state).
+#[derive(Debug, Clone)]
+pub enum GeoLookupState {
+    /// No lookup has been attempted for this request.
+    NotAttempted,
+    /// A lookup ran and failed (or returned no result). This must not be
+    /// retried: finalize treats it the same as no geo info being available.
+    Attempted,
+    /// A lookup ran and resolved geo info.
+    Resolved(GeoInfo),
+}
+
 fn insert_geo_header(headers: &mut http::HeaderMap, name: http::header::HeaderName, value: &str) {
     match HeaderValue::from_str(value) {
         Ok(header_value) => {
diff --git a/crates/trusted-server-core/src/http_util.rs b/crates/trusted-server-core/src/http_util.rs
index 4a6bf1edb4..38d3a2f211 100644
--- a/crates/trusted-server-core/src/http_util.rs
+++ b/crates/trusted-server-core/src/http_util.rs
@@ -81,6 +81,31 @@ pub fn sanitize_forwarded_headers(req: &mut Request<EdgeBody>) {
     }
 }
 
+/// Returns whether the request is a top-level document navigation.
+///
+/// True only for `Sec-Fetch-Dest: document`. Unlike [`is_navigation_request`]
+/// there is no `Accept` fallback, because `fetch()` can set `Accept: text/html`.
+#[must_use]
+pub fn is_document_navigation(req: &Request<EdgeBody>) -> bool {
+    req.headers()
+        .get("sec-fetch-dest")
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|dest| dest.trim().eq_ignore_ascii_case("document"))
+}
+
+/// Returns true when the request advertises itself as a prefetch via either
+/// the standard `Sec-Purpose` or the legacy `Purpose` header.
+#[must_use]
+pub fn is_prefetch_request(req: &Request<EdgeBody>) -> bool {
+    let header = |name: &str| {
+        req.headers()
+            .get(name)
+            .and_then(|v| v.to_str().ok())
+            .is_some_and(|v| v.contains("prefetch"))
+    };
+    header("sec-purpose") || header("purpose")
+}
+
 /// Returns `true` when the request looks like a top-level document navigation.
 ///
 /// Uses [`Sec-Fetch-Dest`] when available (preferred — it is a forbidden
@@ -515,6 +540,38 @@ mod tests {
     use crate::settings::TrustedClientIpConfig;
     use http::{HeaderName, HeaderValue, Method};
 
+    #[test]
+    fn document_navigation_requires_sec_fetch_dest_document() {
+        let with_dest = Request::builder()
+            .header("sec-fetch-dest", "document")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        let accept_only = Request::builder()
+            .header(header::ACCEPT, "text/html")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        let iframe = Request::builder()
+            .header("sec-fetch-dest", "iframe")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        assert!(
+            is_document_navigation(&with_dest),
+            "should count a document destination"
+        );
+        assert!(
+            !is_document_navigation(&accept_only),
+            "should not count the Accept fallback"
+        );
+        assert!(
+            is_navigation_request(&accept_only),
+            "control: the broad check should still accept it"
+        );
+        assert!(
+            !is_document_navigation(&iframe),
+            "should not count an iframe"
+        );
+    }
+
     fn build_request(method: Method, uri: &str) -> Request<EdgeBody> {
         Request::builder()
             .method(method)
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 62f8c8f068..d9174524dd 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -1981,7 +1981,10 @@ pub fn register_providers(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::test_support::canonical_parity_auction_request;
+    use crate::auction::test_support::{
+        canonical_parity_auction_request, repeated_source_provenance_eids,
+        repeated_source_provenance_eids_json,
+    };
     use crate::auction::types::{
         AdFormat, AdSlot, AuctionContext, AuctionRequest, BidStatus, PublisherInfo, UserInfo,
     };
@@ -2317,6 +2320,36 @@ mod tests {
         );
     }
 
+    #[test]
+    fn aps_request_forwards_eid_provenance_fields_and_repeated_sources() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut auction_request = canonical_parity_auction_request();
+        auction_request.user.eids = Some(repeated_source_provenance_eids());
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            transport_timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let openrtb = provider.build_openrtb_request(&auction_request, &context);
+
+        let serialized = serde_json::to_value(&openrtb).expect("should serialize request");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"],
+            repeated_source_provenance_eids_json(),
+            "APS should receive both entries with their own EID-level fields"
+        );
+    }
+
     #[test]
     fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
         let provider = ApsAuctionProvider::new(config());
diff --git a/crates/trusted-server-core/src/integrations/datadome/protection.rs b/crates/trusted-server-core/src/integrations/datadome/protection.rs
index 1d153d087b..6e313bc5e6 100644
--- a/crates/trusted-server-core/src/integrations/datadome/protection.rs
+++ b/crates/trusted-server-core/src/integrations/datadome/protection.rs
@@ -237,6 +237,7 @@ impl DataDomeIntegration {
             certificate_check: true,
             first_byte_timeout: Duration::from_millis(u64::from(self.config.timeout_ms)),
             between_bytes_timeout: Duration::from_millis(u64::from(self.config.timeout_ms)),
+            connect_timeout: None,
             discriminator: None,
         };
 
diff --git a/crates/trusted-server-core/src/integrations/gpt_bootstrap.js b/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
index ef4893a41b..861bfa52b3 100644
--- a/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
+++ b/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
@@ -330,6 +330,7 @@
     initialBids,
     initialSlots,
     traceAuctionTransport,
+    initialAuctionDiagnostics,
   ) {
     // The bundle may replace this scheduler after the fallback claims the initial
     // pass. Keep the latch on the shared document API so replacement cannot reset it.
@@ -340,6 +341,9 @@
     // would overwrite a committed SPA navigation's slots.
     if (initialSlots !== undefined) ts.adSlots = initialSlots;
     if (initialBids !== undefined) ts.bids = initialBids;
+    if (initialAuctionDiagnostics !== undefined) {
+      ts.auctionDiagnostics = initialAuctionDiagnostics;
+    }
     var fire = function () {
       if ((ts.navGeneration || 0) !== 0) return;
       try {
@@ -400,6 +404,7 @@
         opportunity,
         trace.auctionId,
         requestedSizes,
+        undefined,
         trace.identity,
       );
     } catch (_) {
diff --git a/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs b/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs
index a5f708b7ec..f2480afec4 100644
--- a/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs
+++ b/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs
@@ -90,6 +90,7 @@ impl GptDiagnosticsCookieAction {
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct GptDiagnosticsRequestDecision {
     active: bool,
+    browser_session_active: bool,
     clean_browser_path_and_query: Option<String>,
     cookie_action: GptDiagnosticsCookieAction,
 }
@@ -101,6 +102,16 @@ impl GptDiagnosticsRequestDecision {
         self.active
     }
 
+    /// Whether this request came from an activated diagnostics browser session.
+    ///
+    /// Unlike [`Self::active`], this remains true for non-document requests such
+    /// as the SPA page-bids fetch. It is captured before the private activation
+    /// cookie is stripped from the request.
+    #[must_use]
+    pub(crate) fn browser_session_active(&self) -> bool {
+        self.browser_session_active
+    }
+
     /// Whether the response must be private and non-storeable.
     #[must_use]
     pub fn requires_private_no_store(&self) -> bool {
@@ -149,6 +160,7 @@ impl GptDiagnosticsRequestDecision {
     pub(crate) fn active_for_tests() -> Self {
         Self {
             active: true,
+            browser_session_active: true,
             clean_browser_path_and_query: None,
             cookie_action: GptDiagnosticsCookieAction::None,
         }
@@ -171,6 +183,7 @@ mod head_seam_invariant_tests {
                 ] {
                     out.push(GptDiagnosticsRequestDecision {
                         active,
+                        browser_session_active: active,
                         clean_browser_path_and_query: clean.clone(),
                         cookie_action,
                     });
@@ -299,7 +312,7 @@ pub fn prepare_request(
     let cookie_state = console_cookie_state(request);
     let eligible_navigation = request.method() == Method::GET
         && is_navigation_request(request)
-        && !crate::publisher::is_prefetch_request(request)
+        && !crate::http_util::is_prefetch_request(request)
         && !crate::publisher::is_bot_user_agent(request);
 
     sanitize_console_cookie(request);
@@ -307,12 +320,19 @@ pub fn prepare_request(
         replace_path_and_query(request, &clean_path)?;
     }
 
-    let mut decision = GptDiagnosticsRequestDecision::default();
+    let mut decision = GptDiagnosticsRequestDecision {
+        browser_session_active: integration_enabled
+            && directive == QueryDirective::Absent
+            && cookie_state.occurrences == 1
+            && cookie_state.canonical,
+        ..GptDiagnosticsRequestDecision::default()
+    };
     if integration_enabled && eligible_navigation && had_reserved_query {
         decision.clean_browser_path_and_query = Some(clean_path);
         match directive {
             QueryDirective::Enable => {
                 decision.active = true;
+                decision.browser_session_active = true;
                 decision.cookie_action = GptDiagnosticsCookieAction::SetSession;
             }
             QueryDirective::Disable => {
@@ -566,6 +586,22 @@ mod tests {
         assert_eq!(duplicate.headers()[header::COOKIE], "other=value");
     }
 
+    #[test]
+    fn active_cookie_marks_non_document_requests_without_activating_document_behavior() {
+        let mut request = Request::builder()
+            .method(Method::GET)
+            .uri("https://publisher.example/_ts/page-bids?path=/article")
+            .header(header::COOKIE, "__Host-ts-console=1; other=value")
+            .body(EdgeBody::empty())
+            .expect("should build page-bids request");
+
+        let decision = prepare_request(&settings(true), &mut request).expect("should prepare");
+
+        assert!(!decision.active());
+        assert!(decision.browser_session_active());
+        assert_eq!(request.headers()[header::COOKIE], "other=value");
+    }
+
     #[test]
     fn invalid_duplicate_and_disable_directives_fail_closed() {
         for query in [
diff --git a/crates/trusted-server-core/src/integrations/lockr.rs b/crates/trusted-server-core/src/integrations/lockr.rs
index 88c20fcc33..3ef9d670b8 100644
--- a/crates/trusted-server-core/src/integrations/lockr.rs
+++ b/crates/trusted-server-core/src/integrations/lockr.rs
@@ -19,6 +19,7 @@ use validator::Validate;
 
 use crate::constants::INTERNAL_HEADERS;
 use crate::error::TrustedServerError;
+use crate::integrations::sdk_url::parse_sdk_network_url;
 use crate::integrations::{
     AttributeRewriteAction, INTEGRATION_MAX_BODY_BYTES, IntegrationAttributeContext,
     IntegrationAttributeRewriter, IntegrationEndpoint, IntegrationProxy, IntegrationRegistration,
@@ -98,10 +99,15 @@ impl LockrIntegration {
 
     /// Check if a URL is a Lockr SDK URL.
     fn is_lockr_sdk_url(&self, url: &str) -> bool {
-        let lower = url.to_ascii_lowercase();
-        (lower.contains("aim.loc.kr") || lower.contains("identity.loc.kr"))
-            && lower.contains("identity-lockr")
-            && lower.ends_with(".js")
+        // Keep browser/Rust cases in crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json aligned.
+        let Some(parsed) = parse_sdk_network_url(url) else {
+            return false;
+        };
+        let host = parsed.host_str().unwrap_or_default();
+        let path = parsed.path().to_ascii_lowercase();
+        matches!(host, "aim.loc.kr" | "identity.loc.kr")
+            && path.contains("identity-lockr")
+            && path.ends_with(".js")
     }
 
     /// Handle SDK serving — fetch from Lockr CDN and serve through first-party domain.
@@ -201,7 +207,8 @@ impl LockrIntegration {
             .unwrap_or_default();
         let target_url = format!("{}{}{}", self.config.api_endpoint, target_path, query);
 
-        log::info!("Forwarding to Lockr API: {}", target_url);
+        // The query string can carry identifiers, so only the path is logged.
+        log::info!("Forwarding to Lockr API path: {target_path}");
 
         let request_body = if method == Method::POST {
             let bytes =
@@ -227,8 +234,7 @@ impl LockrIntegration {
             .send(PlatformHttpRequest::new(target_req, backend_name))
             .await
             .change_context(Self::error(format!(
-                "Failed to forward request to {}",
-                target_url
+                "Failed to forward request to Lockr API path {target_path}"
             )))?
             .response;
 
@@ -436,6 +442,9 @@ mod tests {
     use edgezero_core::http::Method as HttpMethod;
     use serde_json::json;
 
+    use crate::integrations::sdk_url_test_support::{
+        assert_sdk_html_attribute_rewrite, assert_sdk_url_rewrite, sdk_url_cases,
+    };
     use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
     use crate::test_support::tests::create_test_settings;
 
@@ -462,6 +471,33 @@ mod tests {
         }
     }
 
+    #[test]
+    fn sdk_url_ownership_matches_shared_corpus() {
+        let integration = LockrIntegration::new(test_config());
+
+        for case in sdk_url_cases() {
+            let matches = case.owner.as_deref() == Some(LOCKR_INTEGRATION_ID);
+            assert_eq!(
+                integration.is_lockr_sdk_url(&case.url),
+                matches,
+                "should match expected lockr ownership for {}: {}",
+                case.name,
+                case.url
+            );
+
+            assert_sdk_url_rewrite(
+                integration.as_ref(),
+                &case,
+                "https://edge.example.com/integrations/lockr/sdk",
+            );
+            assert_sdk_html_attribute_rewrite(
+                integration.as_ref(),
+                &case,
+                "https://edge.example.com/integrations/lockr/sdk",
+            );
+        }
+    }
+
     #[test]
     fn test_lockr_sdk_url_detection() {
         let integration = LockrIntegration::new(test_config());
@@ -471,6 +507,16 @@ mod tests {
         assert!(integration.is_lockr_sdk_url("https://aim.loc.kr/identity-lockr-trust-server.js"));
         assert!(integration.is_lockr_sdk_url("https://identity.loc.kr/identity-lockr-v2.0.js"));
 
+        // Hosts that only end with a Lockr SDK host are different hosts.
+        assert!(
+            !integration.is_lockr_sdk_url("https://notaim.loc.kr/identity-lockr.js"), // allow-domain: notaim.loc.kr
+            "should require an exact aim.loc.kr hostname"
+        );
+        assert!(
+            !integration.is_lockr_sdk_url("https://notidentity.loc.kr/identity-lockr.js"), // allow-domain: notidentity.loc.kr
+            "should require an exact identity.loc.kr hostname"
+        );
+
         // Should not match non-SDK resources on Lockr domains
         assert!(
             !integration.is_lockr_sdk_url("https://aim.loc.kr/pixel.gif"),
@@ -623,6 +669,41 @@ mod tests {
         );
     }
 
+    #[test]
+    fn lockr_proxy_log_omits_query() {
+        use crate::test_support::logs::{captured_logs, install_capturing_logger};
+
+        install_capturing_logger();
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response(200, b"ok".to_vec());
+        let services = build_services_with_http_client(
+            Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+        );
+        let settings = create_test_settings();
+        let integration = LockrIntegration::new(test_config());
+        let req = http::Request::builder()
+            .method(HttpMethod::GET)
+            .uri("https://publisher.example/integrations/lockr/api/logpath/v1/token?uid=query-secret-4471&email=person-4471%40example.com")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        futures::executor::block_on(integration.handle(&settings, &services, req))
+            .expect("should proxy request");
+
+        let logs = captured_logs();
+        assert!(
+            logs.iter()
+                .any(|line| line == "Forwarding to Lockr API path: /logpath/v1/token"),
+            "should log the upstream path: {logs:?}"
+        );
+        assert!(
+            !logs
+                .iter()
+                .any(|line| line.contains("query-secret-4471") || line.contains("person-4471")),
+            "should log no part of the query string"
+        );
+    }
+
     #[test]
     fn lockr_proxy_forwards_body_and_strips_publisher_credentials() {
         // Regression guard for the upstream-rejection / credential-leak causes:
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index 9e3840b3fb..20cde2d743 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -25,6 +25,9 @@ pub mod osano;
 pub mod permutive;
 pub mod prebid;
 mod registry;
+mod sdk_url;
+#[cfg(test)]
+mod sdk_url_test_support;
 pub mod sourcepoint;
 pub mod testlight;
 
@@ -155,6 +158,7 @@ fn integration_backend_spec(
         certificate_check,
         first_byte_timeout,
         between_bytes_timeout: first_byte_timeout,
+        connect_timeout: None,
         // Distinguish this integration's backend from any other provider that
         // targets the same origin, so auction response correlation by backend
         // name cannot cross providers.
diff --git a/crates/trusted-server-core/src/integrations/permutive.rs b/crates/trusted-server-core/src/integrations/permutive.rs
index b59f4e3820..9a6b0249cd 100644
--- a/crates/trusted-server-core/src/integrations/permutive.rs
+++ b/crates/trusted-server-core/src/integrations/permutive.rs
@@ -15,6 +15,7 @@ use validator::Validate;
 
 use crate::constants::INTERNAL_HEADERS;
 use crate::error::TrustedServerError;
+use crate::integrations::sdk_url::parse_sdk_network_url;
 use crate::integrations::{
     AttributeRewriteAction, INTEGRATION_MAX_BODY_BYTES, IntegrationAttributeContext,
     IntegrationAttributeRewriter, IntegrationEndpoint, IntegrationProxy, IntegrationRegistration,
@@ -99,9 +100,17 @@ impl PermutiveIntegration {
 
     /// Check if a URL is a Permutive SDK URL.
     fn is_permutive_sdk_url(&self, url: &str) -> bool {
-        let lower = url.to_ascii_lowercase();
-        (lower.contains(".edge.permutive.app") || lower.contains("cdn.permutive.com"))
-            && lower.ends_with("-web.js")
+        // Keep browser/Rust cases in crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json aligned.
+        let Some(parsed) = parse_sdk_network_url(url) else {
+            return false;
+        };
+        let host = parsed.host_str().unwrap_or_default();
+        let path = parsed.path().to_ascii_lowercase();
+        (host == "cdn.permutive.com"
+            || host
+                .strip_suffix(".edge.permutive.app")
+                .is_some_and(|subdomain| !subdomain.is_empty()))
+            && path.ends_with("-web.js")
     }
 
     /// Handle SDK serving - fetch from Permutive CDN and serve through first-party domain.
@@ -474,9 +483,44 @@ mod tests {
     use std::sync::Arc;
 
     use super::*;
+    use crate::integrations::sdk_url_test_support::{
+        assert_sdk_html_attribute_rewrite, assert_sdk_url_rewrite, sdk_url_cases,
+    };
     use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
     use crate::test_support::tests::create_test_settings;
 
+    #[test]
+    fn sdk_url_ownership_matches_shared_corpus() {
+        let integration = PermutiveIntegration::new(PermutiveConfig {
+            enabled: true,
+            organization_id: "example".to_string(),
+            workspace_id: "workspace".to_string(),
+            project_id: String::new(),
+            api_endpoint: default_api_endpoint(),
+            secure_signals_endpoint: default_secure_signals_endpoint(),
+            cache_ttl_seconds: 3600,
+            rewrite_sdk: true,
+        });
+
+        for case in sdk_url_cases() {
+            let matches = case.owner.as_deref() == Some(PERMUTIVE_INTEGRATION_ID);
+            assert_eq!(
+                integration.is_permutive_sdk_url(&case.url),
+                matches,
+                "should match expected permutive ownership for {}: {}",
+                case.name,
+                case.url
+            );
+
+            assert_sdk_url_rewrite(integration.as_ref(), &case, "/integrations/permutive/sdk");
+            assert_sdk_html_attribute_rewrite(
+                integration.as_ref(),
+                &case,
+                "/integrations/permutive/sdk",
+            );
+        }
+    }
+
     #[test]
     fn test_permutive_sdk_url_generation() {
         let config = PermutiveConfig {
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index c13260704f..1e90485de3 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -975,6 +975,9 @@ fn validate_external_bundle_config(
 
 pub struct PrebidIntegration {
     config: PrebidIntegrationConfig,
+    /// Every `[[ec.partners]]` source domain, sorted, for the shim's
+    /// `ts-eids` trim (spec 5.3).
+    registered_sources: Vec<String>,
     planned_head_inserts: Option<Vec<String>>,
     #[cfg(test)]
     legacy_config: Option<LegacyPrebidServerConfig>,
@@ -988,6 +991,7 @@ impl PrebidIntegration {
         let engine = Arc::new(BidParamOverrideEngine::try_from_config(&config)?);
         Ok(Arc::new(Self {
             config: PrebidIntegrationConfig::from(&config),
+            registered_sources: Vec::new(),
             planned_head_inserts: None,
             legacy_config: Some(config),
             engine,
@@ -999,9 +1003,14 @@ impl PrebidIntegration {
         Self::try_new(config).expect("should compile prebid bid param overrides")
     }
 
-    fn for_browser_plan(config: &PrebidIntegrationConfig, plan: &AuctionPlan) -> Arc<Self> {
+    fn for_browser_plan(
+        config: &PrebidIntegrationConfig,
+        plan: &AuctionPlan,
+        registered_sources: Vec<String>,
+    ) -> Arc<Self> {
         let mut integration = Self {
             config: config.clone(),
+            registered_sources,
             planned_head_inserts: None,
             #[cfg(test)]
             legacy_config: None,
@@ -1125,6 +1134,7 @@ impl PrebidIntegration {
             } else {
                 Vec::new()
             }),
+            registered_sources: &self.registered_sources,
             ..InjectedPrebidClientConfig::from(browser_config)
         };
         let config_json = serialize_injected_prebid_config(&payload);
@@ -1370,7 +1380,15 @@ pub fn register_for_plan(
     config.excluded_gam_ad_unit_path_suffixes = canonical;
     validate_browser_config_for_startup(&config, &settings.proxy.allowed_domains)?;
     validate_browser_bidder_ownership(&config, plan)?;
-    let integration = PrebidIntegration::for_browser_plan(&config, plan);
+    let registered_sources = settings
+        .ec
+        .partners
+        .iter()
+        .map(|partner| partner.source_domain.clone())
+        .collect::<std::collections::BTreeSet<_>>()
+        .into_iter()
+        .collect();
+    let integration = PrebidIntegration::for_browser_plan(&config, plan, registered_sources);
     Ok(Some(
         IntegrationRegistration::builder(PREBID_INTEGRATION_ID)
             .with_proxy(integration.clone())
@@ -1584,6 +1602,9 @@ struct InjectedPrebidClientConfig<'a> {
     client_side_bidders: &'a [String],
     #[serde(skip_serializing_if = "<[String]>::is_empty")]
     excluded_gam_ad_unit_path_suffixes: &'a [String],
+    /// The source domains of `[[ec.partners]]`, nothing else from the table.
+    #[serde(skip_serializing_if = "<[String]>::is_empty")]
+    registered_sources: &'a [String],
 }
 
 impl<'a> From<&'a PrebidIntegrationConfig> for InjectedPrebidClientConfig<'a> {
@@ -1601,6 +1622,7 @@ impl<'a> From<&'a PrebidIntegrationConfig> for InjectedPrebidClientConfig<'a> {
             server_side_bidders: None,
             client_side_bidders: &config.client_side_bidders,
             excluded_gam_ad_unit_path_suffixes: &config.excluded_gam_ad_unit_path_suffixes,
+            registered_sources: &[],
         }
     }
 }
@@ -3741,6 +3763,7 @@ mod tests {
     use crate::auction::test_support::{
         canonical_parity_auction_request,
         create_test_auction_context as shared_test_auction_context,
+        repeated_source_provenance_eids, repeated_source_provenance_eids_json,
     };
     use crate::auction::types::{
         AdFormat, AdSlot, AuctionContext, AuctionRequest, DeviceInfo, PublisherInfo, UserInfo,
@@ -4303,6 +4326,60 @@ server_url = "https://prebid.example/openrtb2/auction"
             "should inject the canonical suffix list: {config_insert}"
         );
     }
+    #[test]
+    fn injected_config_lists_registered_sources() {
+        let mut settings = make_settings();
+        settings
+            .integrations
+            .insert_config(
+                PREBID_INTEGRATION_ID,
+                &json!({
+                    "enabled": true,
+                    "external_bundle_url": "https://assets.example/prebid/trusted-prebid.js"
+                }),
+            )
+            .expect("should replace Prebid test configuration");
+        settings.ec.partners = ["zeta.example.com", "alpha.example.com", "mid.example.com"]
+            .into_iter()
+            .map(|source| {
+                crate::ec::identity::test_support::ec_partner(
+                    source,
+                    "https://sync.example.com/pull",
+                    "example-token-value-0123456789abcdef",
+                )
+            })
+            .collect();
+        let plan = Arc::new(
+            crate::auction::compile_auction_plan(&settings).expect("should compile auction plan"),
+        );
+        let registry = IntegrationRegistry::with_plan(&settings, plan)
+            .expect("should build integration registry");
+        let document_state = IntegrationDocumentState::default();
+        let context = IntegrationHtmlContext {
+            request_host: "pub.example",
+            request_scheme: "https",
+            origin_host: "origin.example",
+            document_state: &document_state,
+        };
+
+        let inserts = registry.head_inserts(&context);
+        let config_insert = inserts
+            .iter()
+            .find(|insert| insert.contains("window.__tsjs_prebid"))
+            .expect("should inject planned Prebid config");
+
+        assert!(
+            config_insert.contains(
+                r#""registeredSources":["alpha.example.com","mid.example.com","zeta.example.com"]"#
+            ),
+            "should list every partner source domain, sorted: {config_insert}"
+        );
+        assert!(
+            !config_insert.contains("example-token") && !config_insert.contains("sync.example.com"),
+            "should carry nothing else from the partner table: {config_insert}"
+        );
+    }
+
     #[test]
     fn managed_user_ids_parse_with_opaque_params() {
         let config = parse_prebid_toml(
@@ -7010,35 +7087,59 @@ external_bundle_sri = "sha384-AAAA"
         );
     }
 
+    #[test]
+    fn to_openrtb_forwards_eid_provenance_fields_and_repeated_sources() {
+        let provider = PrebidAuctionProvider::new(base_config());
+        let mut auction_request = create_test_auction_request();
+        auction_request.user.eids = Some(repeated_source_provenance_eids());
+        let settings = make_settings();
+        let request = build_test_request();
+        let context = create_test_auction_context(&settings, &request);
+
+        let openrtb = provider.to_openrtb(
+            &auction_request,
+            &context,
+            None,
+            make_request_info(&context),
+        );
+
+        let serialized = serde_json::to_value(&openrtb).expect("should serialize OpenRTB request");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"],
+            repeated_source_provenance_eids_json(),
+            "Prebid Server should receive both entries with their own EID-level fields"
+        );
+    }
+
     #[test]
     fn to_openrtb_includes_eids_from_auction_request() {
         let provider = PrebidAuctionProvider::new(base_config());
         let mut auction_request = create_test_auction_request();
         auction_request.user.eids = Some(vec![
-            crate::openrtb::Eid {
-                source: "liveramp.com".to_owned(),
-                uids: vec![crate::openrtb::Uid {
+            crate::openrtb::Eid::new(
+                "liveramp.com".to_owned(),
+                vec![crate::openrtb::Uid {
                     id: "LR_xyz".to_owned(),
                     atype: Some(3),
                     ext: None,
                 }],
-            },
-            crate::openrtb::Eid {
-                source: "id5-sync.com".to_owned(),
-                uids: vec![crate::openrtb::Uid {
+            ),
+            crate::openrtb::Eid::new(
+                "id5-sync.com".to_owned(),
+                vec![crate::openrtb::Uid {
                     id: "ID5_abc".to_owned(),
                     atype: Some(1),
                     ext: None,
                 }],
-            },
-            crate::openrtb::Eid {
-                source: "google.com".to_owned(),
-                uids: vec![crate::openrtb::Uid {
+            ),
+            crate::openrtb::Eid::new(
+                "google.com".to_owned(),
+                vec![crate::openrtb::Uid {
                     id: "pair-id".to_owned(),
                     atype: Some(571187),
                     ext: None,
                 }],
-            },
+            ),
         ]);
 
         let settings = make_settings();
@@ -9952,7 +10053,9 @@ set = { networkId = 42 }
                 (None, None),
                 (Some(""), None),
                 (
-                    Some("ts-ec=secret; ts-eids=secret; sharedId=secret; session=secret"),
+                    Some(
+                        "ts-ec=secret; ts-eids=secret; __Host-ts-eids-s=secret; ts-ec-revoked=secret; sharedId=secret; session=secret",
+                    ),
                     None,
                 ),
                 (
@@ -9973,7 +10076,7 @@ set = { networkId = 42 }
                 ),
                 (
                     Some(
-                        " session=secret ; euconsent-v2=TC==; __gpp=GPP; __gpp_sid=2,6; us_privacy=1YNN",
+                        " session=secret ; __Host-ts-eids-s=secret; ts-ec-revoked=secret; euconsent-v2=TC==; __gpp=GPP; __gpp_sid=2,6; us_privacy=1YNN",
                     ),
                     Some("euconsent-v2=TC==; __gpp=GPP; __gpp_sid=2,6; us_privacy=1YNN"),
                 ),
@@ -10192,6 +10295,115 @@ set = { networkId = 42 }
         );
     }
 
+    fn cookie_values(request: &http::Request<EdgeBody>) -> Vec<String> {
+        request
+            .headers()
+            .get_all(header::COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should be ASCII").to_owned())
+            .collect()
+    }
+
+    #[test]
+    fn prebid_headers_strip_identity_cookies_when_consent_cookies_are_forwarded() {
+        let cookies = [
+            HeaderValue::from_static("ts-ec=abc; euconsent-v2=tcf; other=1"),
+            HeaderValue::from_static("__Host-ts-eids-s=eyJ2IjoxfQ; partner=p"),
+            HeaderValue::from_static("ts-eids=W10; second=2"),
+        ];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &PrebidConsentCookies::from_header(cookies.first()),
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::Both,
+            None,
+        );
+
+        assert_eq!(
+            cookie_values(&to),
+            vec!["euconsent-v2=tcf".to_owned()],
+            "should keep only consent from the selected header and omit every identity cookie"
+        );
+    }
+
+    #[test]
+    fn prebid_headers_strip_identity_and_consent_cookies_in_openrtb_only_mode() {
+        let cookies = [HeaderValue::from_static(
+            "ts-ec=abc; euconsent-v2=tcf; other=1",
+        )];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &PrebidConsentCookies::from_header(cookies.first()),
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::OpenrtbOnly,
+            None,
+        );
+
+        assert_eq!(
+            cookie_values(&to),
+            Vec::<String>::new(),
+            "should omit all cookies in OpenRTB-only mode"
+        );
+    }
+
+    #[test]
+    fn prebid_headers_drop_non_utf8_cookie_fields_and_empty_results() {
+        let cookies = [
+            HeaderValue::from_bytes(b"x=\xff").expect("should build an opaque header"),
+            HeaderValue::from_static("ts-ec=abc"),
+        ];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &PrebidConsentCookies::from_header(cookies.first()),
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::Both,
+            None,
+        );
+
+        assert!(
+            to.headers().get(header::COOKIE).is_none(),
+            "should send no Cookie header"
+        );
+    }
+
+    #[test]
+    fn prebid_headers_drop_non_utf8_field_but_strip_identity_from_the_rest() {
+        let cookies = [
+            HeaderValue::from_bytes(b"ts-ec=\xff; leaked=1")
+                .expect("should build an opaque header"),
+            HeaderValue::from_static("ts-ec=abc; ts-eids=W10; keep=1"),
+        ];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &PrebidConsentCookies::from_header(cookies.first()),
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::Both,
+            None,
+        );
+
+        assert_eq!(
+            cookie_values(&to),
+            Vec::<String>::new(),
+            "should fail closed on the selected non-UTF-8 field without forwarding later fields"
+        );
+    }
+
     fn header_value<'a>(headers: &'a [(String, Vec<u8>)], name: &str) -> Option<&'a [u8]> {
         headers
             .iter()
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index 15a6486fd8..e3f23545bb 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -5,12 +5,17 @@ use std::sync::{Arc, Mutex};
 use async_trait::async_trait;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
+use futures::StreamExt as _;
 use http::{Method, Request, Response};
 use matchit::Router;
 
 use crate::auction::AuctionPlan;
 use crate::constants::HEADER_X_TS_EC;
 use crate::ec::EcContext;
+use crate::ec::finalize::BrowserSeed;
+use crate::ec::identity::coordinator::{CaptureCall, decode_body, has_capture_rule, run_capture};
+use crate::ec::identity::input::ThreadRandom;
+use crate::ec::identity::{IdentityProvider, IdentityProviderError};
 use crate::ec::kv::KvIdentityGraph;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
@@ -619,6 +624,7 @@ pub struct IntegrationRegistration {
     pub html_stream_processors: Vec<Arc<dyn IntegrationHtmlStreamProcessorFactory>>,
     pub head_injectors: Vec<Arc<dyn IntegrationHeadInjector>>,
     pub request_filters: Vec<Arc<dyn IntegrationRequestFilter>>,
+    pub identity_providers: Vec<Arc<dyn IdentityProvider>>,
 }
 
 impl IntegrationRegistration {
@@ -645,6 +651,7 @@ impl IntegrationRegistrationBuilder {
                 html_stream_processors: Vec::new(),
                 head_injectors: Vec::new(),
                 request_filters: Vec::new(),
+                identity_providers: Vec::new(),
             },
         }
     }
@@ -691,6 +698,34 @@ impl IntegrationRegistrationBuilder {
         self
     }
 
+    /// Registers an identity provider this integration contributes.
+    #[must_use]
+    pub fn with_identity_provider(mut self, provider: Arc<dyn IdentityProvider>) -> Self {
+        self.registration.identity_providers.push(provider);
+        self
+    }
+
+    /// Registers a provider built by a fallible constructor.
+    ///
+    /// A failure becomes [`TrustedServerError::Integration`], naming the
+    /// integration the builder already holds.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Integration`] when `provider` is an error.
+    pub fn try_with_identity_provider<P: IdentityProvider + 'static>(
+        self,
+        provider: Result<P, Report<IdentityProviderError>>,
+    ) -> Result<Self, Report<TrustedServerError>> {
+        match provider {
+            Ok(provider) => Ok(self.with_identity_provider(Arc::new(provider))),
+            Err(error) => Err(Report::new(TrustedServerError::Integration {
+                integration: self.registration.integration_id.to_owned(),
+                message: error.current_context().to_string(),
+            })),
+        }
+    }
+
     /// Mark this integration's JS module for deferred loading via
     /// `<script defer>` instead of the main synchronous bundle.
     #[must_use]
@@ -713,7 +748,62 @@ impl IntegrationRegistrationBuilder {
     }
 }
 
-type RouteValue = (Arc<dyn IntegrationProxy>, &'static str);
+/// Proxy handler, integration id, and the registered route pattern (kept so
+/// telemetry can label responses with the integration-defined literal, e.g.
+/// `/integrations/prebid/*`, instead of deriving anything from the request
+/// path).
+type RouteValue = (Arc<dyn IntegrationProxy>, &'static str, String);
+
+/// A test-constructor route entry: method, path pattern, and the proxy with
+/// its integration id ([`IntegrationRegistry::from_routes`] fills the
+/// pattern into [`RouteValue`] itself).
+#[cfg(test)]
+type RouteEntry<'a> = (Method, &'a str, (Arc<dyn IntegrationProxy>, &'static str));
+/// Rejects a capture rule outside the registering integration's own routes.
+fn validate_capture_rules(
+    registration: &IntegrationRegistration,
+) -> Result<(), Report<TrustedServerError>> {
+    let routes: Vec<String> = registration
+        .proxies
+        .iter()
+        .flat_map(|proxy| proxy.routes())
+        .map(|route| route.path)
+        .collect();
+    for provider in &registration.identity_providers {
+        let Some(captures) = provider.descriptor().captures() else {
+            continue;
+        };
+        let rejected = captures
+            .paths()
+            .iter()
+            .map(|(_, path)| path)
+            .find(|path| {
+                !routes.iter().any(|route| match route.strip_suffix('*') {
+                    Some(base) if base.ends_with('/') => path.starts_with(base),
+                    _ => route == *path,
+                })
+            })
+            // An exact route never contains a prefix, which matches more paths.
+            .or_else(|| {
+                captures.prefixes().iter().find(|prefix| {
+                    !routes.iter().any(|route| match route.strip_suffix('*') {
+                        Some(base) if base.ends_with('/') => prefix.starts_with(base),
+                        _ => false,
+                    })
+                })
+            });
+        if let Some(rejected) = rejected {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "integration `{}` identity provider `{}` captures `{rejected}`, which is outside its own routes",
+                    registration.integration_id,
+                    provider.descriptor().id()
+                ),
+            }));
+        }
+    }
+    Ok(())
+}
 
 struct IntegrationRegistryInner {
     // Method-specific routers for O(log n) lookups
@@ -735,6 +825,7 @@ struct IntegrationRegistryInner {
     html_stream_processors: Vec<Arc<dyn IntegrationHtmlStreamProcessorFactory>>,
     head_injectors: Vec<Arc<dyn IntegrationHeadInjector>>,
     request_filters: Vec<Arc<dyn IntegrationRequestFilter>>,
+    identity_providers: Vec<Arc<dyn IdentityProvider>>,
 }
 
 impl Default for IntegrationRegistryInner {
@@ -756,6 +847,7 @@ impl Default for IntegrationRegistryInner {
             html_stream_processors: Vec::new(),
             head_injectors: Vec::new(),
             request_filters: Vec::new(),
+            identity_providers: Vec::new(),
         }
     }
 }
@@ -796,9 +888,139 @@ pub struct ProxyDispatchInput<'a> {
     pub kv: Option<&'a KvIdentityGraph>,
     pub ec_context: &'a mut EcContext,
     pub services: &'a RuntimeServices,
+    /// Whether the client looks like a real browser. EC generation needs it.
+    pub is_real_browser: bool,
+    /// The request's browser ingest, carried by an EC minted here.
+    pub seed: &'a BrowserSeed,
     pub req: Request<EdgeBody>,
 }
 
+/// What capturing a proxied response reads besides the response.
+struct CaptureExchange<'a> {
+    settings: &'a Settings,
+    services: &'a RuntimeServices,
+    kv: Option<&'a KvIdentityGraph>,
+    ec_context: &'a mut EcContext,
+    method: &'a Method,
+    path: &'a str,
+}
+
+/// A proxied body, buffered for capture or left alone.
+enum Buffered {
+    /// The whole body, as sent (still encoded).
+    Whole(bytes::Bytes),
+    /// A body over the cap, rebuilt so the browser still receives every byte.
+    Passthrough(EdgeBody),
+}
+
+/// Buffers `body` up to `cap` bytes. A body over the cap, or a stream that
+/// fails, is handed back whole so the browser receives it unchanged.
+async fn buffer_up_to(body: EdgeBody, cap: usize) -> Buffered {
+    match body {
+        EdgeBody::Once(bytes) if bytes.len() <= cap => Buffered::Whole(bytes),
+        EdgeBody::Stream(mut stream) => {
+            let mut items = Vec::new();
+            let mut total = 0_usize;
+            while let Some(item) = stream.next().await {
+                let over = match &item {
+                    Ok(chunk) => {
+                        total = total.saturating_add(chunk.len());
+                        total > cap
+                    }
+                    Err(_) => true,
+                };
+                items.push(item);
+                if over {
+                    return Buffered::Passthrough(EdgeBody::from_stream(
+                        futures::stream::iter(items).chain(stream),
+                    ));
+                }
+            }
+            let mut whole = Vec::with_capacity(total);
+            for chunk in items.iter().filter_map(|item| item.as_ref().ok()) {
+                whole.extend_from_slice(chunk);
+            }
+            Buffered::Whole(bytes::Bytes::from(whole))
+        }
+        other => Buffered::Passthrough(other),
+    }
+}
+
+/// Offers a proxied 2xx response to the identity providers whose capture rule
+/// matches, and returns it unchanged (spec 4.7).
+///
+/// A body over `max_response_bytes` is passed through uncaptured. The request
+/// body is never read here.
+async fn capture_proxied_response(
+    exchange: CaptureExchange<'_>,
+    response: Response<EdgeBody>,
+) -> Response<EdgeBody> {
+    let CaptureExchange {
+        settings,
+        services,
+        kv,
+        ec_context,
+        method,
+        path,
+    } = exchange;
+    if !response.status().is_success() {
+        return response;
+    }
+    let Some(runtime) = ec_context.identity().runtime().cloned() else {
+        return response;
+    };
+    if !has_capture_rule(runtime.catalog(), method, path) {
+        return response;
+    }
+
+    let cap = settings.ec.identity.max_response_bytes;
+    let (parts, body) = response.into_parts();
+    let declared_over_cap = parts
+        .headers
+        .get(http::header::CONTENT_LENGTH)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.parse::<usize>().ok())
+        .is_some_and(|length| length > cap);
+    if declared_over_cap {
+        log::debug!("Skipping capture on '{path}': the response is over the size cap");
+        return Response::from_parts(parts, body);
+    }
+    let raw = match buffer_up_to(body, cap).await {
+        Buffered::Whole(raw) => raw,
+        Buffered::Passthrough(body) => {
+            log::debug!("Skipping capture on '{path}': the response is over the size cap");
+            return Response::from_parts(parts, body);
+        }
+    };
+
+    let encoding = parts
+        .headers
+        .get(http::header::CONTENT_ENCODING)
+        .and_then(|value| value.to_str().ok());
+    match decode_body(encoding, raw.to_vec(), cap) {
+        Some(decoded) => {
+            let random = ThreadRandom;
+            let deps = runtime.deps(settings, services, &random, None);
+            run_capture(
+                &deps,
+                kv,
+                ec_context,
+                &CaptureCall {
+                    method,
+                    path,
+                    status: parts.status,
+                    headers: &parts.headers,
+                    body: &decoded,
+                },
+            );
+        }
+        None => {
+            log::debug!("Skipping capture on '{path}': the body is undecodable or over the cap")
+        }
+    }
+    Response::from_parts(parts, EdgeBody::from_bytes(raw))
+}
+
 /// In-memory registry of integrations discovered from settings.
 #[derive(Clone, Default)]
 pub struct IntegrationRegistry {
@@ -825,15 +1047,10 @@ impl IntegrationRegistry {
     /// # Errors
     ///
     /// Returns an error if route registration fails due to duplicate routes or invalid paths.
-    ///
-    /// # Panics
-    ///
-    /// Panics if a route path ends with `/*` but `strip_suffix` unexpectedly fails (invariant violation).
     pub fn with_plan(
         settings: &Settings,
         plan: Arc<AuctionPlan>,
     ) -> Result<Self, Report<TrustedServerError>> {
-        let mut inner = IntegrationRegistryInner::default();
         let mut registrations = Vec::new();
         if let Some(registration) = crate::integrations::prebid::register_for_plan(settings, &plan)?
         {
@@ -852,14 +1069,42 @@ impl IntegrationRegistry {
             }
         }
 
+        let mut registry = Self::from_registrations(registrations)?;
+        registry.plan = Some(plan);
+        registry.ensure_async_html_finish_allowed(settings)?;
+        Ok(registry)
+    }
+
+    /// Merges registrations into a registry with no auction plan.
+    ///
+    /// Tests pass a registration no settings can produce.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when a route fails to
+    /// register, or when an identity provider's capture rule lies outside
+    /// the routes of the integration that registered it.
+    ///
+    /// # Panics
+    ///
+    /// Panics if a route path ends with `/*` but `strip_suffix` unexpectedly fails (invariant violation).
+    pub(crate) fn from_registrations(
+        registrations: Vec<IntegrationRegistration>,
+    ) -> Result<Self, Report<TrustedServerError>> {
+        let mut inner = IntegrationRegistryInner::default();
         for registration in registrations {
+            validate_capture_rules(&registration)?;
             inner
                 .enabled_integration_ids
                 .push(registration.integration_id);
 
             for proxy in registration.proxies {
                 for route in proxy.routes() {
-                    let value = (proxy.clone(), registration.integration_id);
+                    let value = (
+                        proxy.clone(),
+                        registration.integration_id,
+                        route.path.clone(),
+                    );
 
                     // Convert /* wildcard to matchit's {*rest} syntax
                     let matchit_path = if route.path.ends_with("/*") {
@@ -914,6 +1159,9 @@ impl IntegrationRegistry {
                 .extend(registration.html_stream_processors);
             inner.head_injectors.extend(registration.head_injectors);
             inner.request_filters.extend(registration.request_filters);
+            inner
+                .identity_providers
+                .extend(registration.identity_providers);
             if registration.js_disabled {
                 inner.disabled_js_ids.push(registration.integration_id);
             } else if registration.js_deferred {
@@ -921,12 +1169,16 @@ impl IntegrationRegistry {
             }
         }
 
-        let registry = Self {
+        Ok(Self {
             inner: Arc::new(inner),
-            plan: Some(plan),
-        };
-        registry.ensure_async_html_finish_allowed(settings)?;
-        Ok(registry)
+            plan: None,
+        })
+    }
+
+    /// The identity providers integrations registered.
+    #[must_use]
+    pub fn identity_providers(&self) -> Vec<Arc<dyn IdentityProvider>> {
+        self.inner.identity_providers.clone()
     }
 
     /// Return whether this registry and another consumer share the same plan allocation.
@@ -958,6 +1210,27 @@ impl IntegrationRegistry {
         self.find_route(method, path).is_some()
     }
 
+    /// The registered route pattern matched by `method` and `path`, if any.
+    ///
+    /// Patterns are integration-defined literals (for example
+    /// `/integrations/prebid/*`), so they are bounded and content-free and
+    /// safe to store as a telemetry dimension, unlike the request path.
+    #[must_use]
+    pub fn matched_route_pattern(&self, method: &Method, path: &str) -> Option<&str> {
+        self.find_route(method, path).map(|value| value.2.as_str())
+    }
+
+    /// Return true when at least one integration request filter is
+    /// registered.
+    ///
+    /// Adapters use this to decide whether to record a request-filter phase
+    /// timing span, so unconfigured deployments (no request filters) omit
+    /// that entry from observability output entirely.
+    #[must_use]
+    pub fn has_request_filters(&self) -> bool {
+        !self.inner.request_filters.is_empty()
+    }
+
     /// Run pre-routing request filters.
     ///
     /// Request header mutations are applied immediately so later filters and
@@ -1031,26 +1304,44 @@ impl IntegrationRegistry {
             kv,
             ec_context,
             services,
+            is_real_browser,
+            seed,
             mut req,
         } = input;
-        if let Some((proxy, _)) = self.find_route(method, path) {
+        if let Some((proxy, _, _)) = self.find_route(method, path) {
             // Organic proxy handler: generate if needed (best effort).
-            // Only generate for document navigations — subresource requests
-            // may lack consent signals such as the Sec-GPC header.
-            if is_navigation_request(&req) {
-                if let Err(err) = ec_context.generate_if_needed(settings, kv) {
+            // Only generate for document navigations by real browsers —
+            // subresource requests may lack consent signals such as the
+            // Sec-GPC header.
+            if is_real_browser && is_navigation_request(&req) {
+                if let Err(err) = ec_context.generate_if_needed(settings, kv, seed) {
                     log::warn!("EC generation failed for integration proxy: {err:?}");
                 }
             } else {
                 log::debug!(
-                    "EC generation skipped for integration proxy: non-document request (path={path})",
+                    "EC generation skipped for integration proxy: not a real-browser document request (path={path})",
                 );
             }
 
             // Remove any caller-supplied EC header rather than forwarding it.
             req.headers_mut().remove(HEADER_X_TS_EC.clone());
 
-            Some(proxy.handle(settings, services, req).await)
+            let handled = proxy.handle(settings, services, req).await;
+            Some(match handled {
+                Ok(response) => Ok(capture_proxied_response(
+                    CaptureExchange {
+                        settings,
+                        services,
+                        kv,
+                        ec_context,
+                        method,
+                        path,
+                    },
+                    response,
+                )
+                .await),
+                Err(error) => Err(error),
+            })
         } else {
             None
         }
@@ -1331,6 +1622,7 @@ impl IntegrationRegistry {
                 html_stream_processors: Vec::new(),
                 head_injectors: Vec::new(),
                 request_filters: Vec::new(),
+                identity_providers: Vec::new(),
                 deferred_js_ids: Vec::new(),
                 disabled_js_ids: Vec::new(),
             }),
@@ -1361,6 +1653,7 @@ impl IntegrationRegistry {
                 html_stream_processors: Vec::new(),
                 head_injectors,
                 request_filters: Vec::new(),
+                identity_providers: Vec::new(),
                 deferred_js_ids: Vec::new(),
                 disabled_js_ids: Vec::new(),
             }),
@@ -1387,6 +1680,7 @@ impl IntegrationRegistry {
                 html_stream_processors: Vec::new(),
                 head_injectors: Vec::new(),
                 request_filters,
+                identity_providers: Vec::new(),
                 deferred_js_ids: Vec::new(),
                 disabled_js_ids: Vec::new(),
             }),
@@ -1401,7 +1695,7 @@ impl IntegrationRegistry {
     /// # Panics
     ///
     /// Panics if route registration fails due to duplicate or invalid paths.
-    pub fn from_routes(routes: Vec<(Method, &str, RouteValue)>) -> Self {
+    pub fn from_routes(routes: Vec<RouteEntry<'_>>) -> Self {
         let mut get_router = Router::new();
         let mut post_router = Router::new();
         let mut put_router = Router::new();
@@ -1410,7 +1704,8 @@ impl IntegrationRegistry {
         let mut head_router = Router::new();
         let mut options_router = Router::new();
 
-        for (method, path, value) in routes {
+        for (method, path, (proxy, integration_id)) in routes {
+            let value: RouteValue = (proxy, integration_id, path.to_owned());
             // Convert /* wildcard to matchit's {*rest} syntax
             let matchit_path = if path.ends_with("/*") {
                 format!(
@@ -1453,6 +1748,7 @@ impl IntegrationRegistry {
                 html_stream_processors: Vec::new(),
                 head_injectors: Vec::new(),
                 request_filters: Vec::new(),
+                identity_providers: Vec::new(),
                 deferred_js_ids: Vec::new(),
                 disabled_js_ids: Vec::new(),
             }),
@@ -1465,6 +1761,10 @@ impl IntegrationRegistry {
 mod tests {
     use super::*;
     use crate::constants::COOKIE_TS_EC;
+    use crate::ec::identity::examples::{
+        ExampleCaptureProvider, ExampleIdProvider, example_config,
+    };
+    use crate::ec::identity::test_support::{fixed_capture_provider, fixed_provider};
     use crate::platform::test_support::noop_services;
     use http::{HeaderValue, StatusCode, header};
 
@@ -1844,6 +2144,8 @@ mod tests {
             kv: None,
             ec_context: &mut ec_context,
             services: &noop_services(),
+            is_real_browser: true,
+            seed: &BrowserSeed::empty(),
             req,
         }))
         .expect("should match route")
@@ -2201,6 +2503,8 @@ mod tests {
             kv: None,
             ec_context: &mut ec_context,
             services: &services,
+            is_real_browser: true,
+            seed: &BrowserSeed::empty(),
             req,
         }));
 
@@ -2217,6 +2521,151 @@ mod tests {
         );
     }
 
+    #[test]
+    fn handle_proxy_generates_an_ec_only_for_a_real_browser() {
+        let settings = create_test_settings();
+        let registry = IntegrationRegistry::from_routes(vec![(
+            Method::GET,
+            "/integrations/test/ec",
+            (
+                Arc::new(EcTestProxy) as Arc<dyn IntegrationProxy>,
+                "ec_test",
+            ),
+        )]);
+        let services = noop_services();
+        let mut minted = Vec::new();
+
+        for is_real_browser in [false, true] {
+            let req = Request::builder()
+                .method(Method::GET)
+                // Keep the host aligned with the shared settings fixture.
+                .uri("https://test-publisher.com/integrations/test/ec") // allow-domain: test-publisher.com
+                .header("sec-fetch-dest", "document")
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            let mut ec_context = EcContext::new_for_test_with_ip(
+                None,
+                crate::consent::ConsentContext {
+                    jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                    ..crate::consent::ConsentContext::default()
+                },
+                Some("192.0.2.1".to_owned()),
+            );
+
+            let result = futures::executor::block_on(registry.handle_proxy(ProxyDispatchInput {
+                method: &Method::GET,
+                path: "/integrations/test/ec",
+                settings: &settings,
+                kv: None,
+                ec_context: &mut ec_context,
+                services: &services,
+                is_real_browser,
+                seed: &BrowserSeed::empty(),
+                req,
+            }));
+
+            assert!(
+                result.is_some_and(|response| response.is_ok()),
+                "should handle the request"
+            );
+            minted.push(ec_context.ec_value().is_some());
+        }
+
+        assert_eq!(
+            minted,
+            [false, true],
+            "should mint an EC only when the client is a real browser"
+        );
+    }
+
+    #[test]
+    fn integration_proxy_new_ec_carries_browser_ingest() {
+        let settings = create_test_settings();
+        let registry = IntegrationRegistry::from_routes(vec![(
+            Method::GET,
+            "/integrations/test/ec",
+            (
+                Arc::new(EcTestProxy) as Arc<dyn IntegrationProxy>,
+                "ec_test",
+            ),
+        )]);
+        let services = noop_services();
+        let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+        let consent = crate::consent::ConsentContext {
+            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+            ..crate::consent::ConsentContext::default()
+        };
+        let mut ec_context =
+            EcContext::new_for_test_with_ip(None, consent, Some("192.0.2.1".to_owned()));
+        let partner_registry =
+            crate::ec::registry::PartnerRegistry::from_config(&[crate::settings::EcPartner {
+                name: "Shared ID".to_owned(),
+                source_domain: "sharedid.org".to_owned(),
+                openrtb_atype: crate::settings::EcPartner::default_openrtb_atype(),
+                bidstream_enabled: true,
+                api_token: Some(crate::redacted::Redacted::new(
+                    "token-sharedid.org-32-bytes-minimum-value".to_owned(),
+                )),
+                batch_rate_limit: crate::settings::EcPartner::default_batch_rate_limit(),
+                pull_sync_enabled: false,
+                pull_sync_url: None,
+                pull_sync_allowed_domains: vec![],
+                removed_pull_sync_ttl_sec: None,
+                removed_pull_sync_rate_limit: None,
+                owner: None,
+                ts_pull_token: None,
+            }])
+            .expect("should build partner registry");
+        let seed = crate::ec::finalize::browser_seed(
+            &settings,
+            &partner_registry,
+            ec_context.consent(),
+            None,
+            Some("example-shared-id"),
+            1_760_000_000,
+        );
+        let req = Request::builder()
+            .method(Method::GET)
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/integrations/test/ec") // allow-domain: test-publisher.com
+            .header("sec-fetch-dest", "document")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let result = futures::executor::block_on(registry.handle_proxy(ProxyDispatchInput {
+            method: &Method::GET,
+            path: "/integrations/test/ec",
+            settings: &settings,
+            kv: Some(&graph),
+            ec_context: &mut ec_context,
+            services: &services,
+            is_real_browser: true,
+            seed: &seed,
+            req,
+        }));
+
+        assert!(
+            result.is_some_and(|response| response.is_ok()),
+            "should handle the request"
+        );
+        let writes = store.writes();
+        assert_eq!(writes.add, 1, "should write one create");
+        assert_eq!(writes.total(), 1, "should write nothing else");
+        let ec_id = ec_context.ec_value().expect("should mint an EC");
+        let (stored, _) = graph
+            .get(ec_id)
+            .expect("should read store")
+            .expect("should hold the new row");
+        assert_eq!(
+            stored
+                .ids
+                .get("sharedid.org")
+                .and_then(crate::ec::kv_types::KvPartnerId::first_uid),
+            Some("example-shared-id"),
+            "should carry the seeded UID in the create"
+        );
+    }
+
     #[test]
     fn handle_proxy_rejects_invalid_ec_request_header() {
         let settings = create_test_settings();
@@ -2251,6 +2700,8 @@ mod tests {
             kv: None,
             ec_context: &mut ec_context,
             services: &services,
+            is_real_browser: true,
+            seed: &BrowserSeed::empty(),
             req,
         }))
         .expect("should handle proxy request");
@@ -2300,6 +2751,8 @@ mod tests {
             kv: None,
             ec_context: &mut ec_context,
             services: &services,
+            is_real_browser: true,
+            seed: &BrowserSeed::empty(),
             req,
         }))
         .expect("should handle proxy request");
@@ -2346,6 +2799,8 @@ mod tests {
             kv: None,
             ec_context: &mut ec_context,
             services: &services,
+            is_real_browser: true,
+            seed: &BrowserSeed::empty(),
             req,
         }));
 
@@ -2592,4 +3047,616 @@ mod tests {
             "should reconstruct full module list from immediate + deferred"
         );
     }
+
+    struct ExampleCaptureProxy;
+
+    #[async_trait(?Send)]
+    impl IntegrationProxy for ExampleCaptureProxy {
+        fn integration_name(&self) -> &'static str {
+            "examplecapture"
+        }
+
+        fn routes(&self) -> Vec<IntegrationEndpoint> {
+            vec![IntegrationEndpoint::post("/integrations/examplecapture/*")]
+        }
+
+        async fn handle(
+            &self,
+            _settings: &Settings,
+            _services: &RuntimeServices,
+            _req: Request<EdgeBody>,
+        ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+            Ok(Response::new(EdgeBody::empty()))
+        }
+    }
+
+    fn capture_registration(path: &str) -> IntegrationRegistration {
+        IntegrationRegistration::builder("examplecapture")
+            .with_proxy(Arc::new(ExampleCaptureProxy))
+            .try_with_identity_provider(ExampleCaptureProvider::with_capture_path(path))
+            .expect("should register the capture provider")
+            .build()
+    }
+
+    #[test]
+    fn try_with_identity_provider_converts_a_constructor_error_once() {
+        let failing: Result<ExampleIdProvider, Report<IdentityProviderError>> =
+            Err(IdentityProviderError::config("bad partner id"));
+        let error = IntegrationRegistration::builder("exampleid")
+            .try_with_identity_provider(failing)
+            .err()
+            .expect("should fail on a constructor error");
+        assert!(
+            matches!(error.current_context(), TrustedServerError::Integration { integration, .. } if integration == "exampleid"),
+            "should name the integration"
+        );
+
+        let built = IntegrationRegistration::builder("exampleid")
+            .try_with_identity_provider(ExampleIdProvider::new(&example_config()))
+            .expect("should register a valid provider")
+            .build();
+        assert_eq!(
+            built.identity_providers.len(),
+            1,
+            "should hold one registered provider"
+        );
+    }
+
+    #[test]
+    fn capture_rule_outside_the_integrations_routes_is_rejected_at_startup() {
+        let error = IntegrationRegistry::from_registrations(vec![capture_registration(
+            "/integrations/other/api",
+        )])
+        .err()
+        .expect("should reject a capture rule outside the integration's routes");
+        assert!(
+            format!("{error}").contains("examplecapture"),
+            "should name the integration"
+        );
+
+        let registry = IntegrationRegistry::from_registrations(vec![capture_registration(
+            "/integrations/examplecapture/api/token",
+        )])
+        .expect("should accept a capture rule under the integration's own routes");
+        assert_eq!(
+            registry.identity_providers().len(),
+            1,
+            "should expose the registered provider"
+        );
+    }
+
+    #[test]
+    fn capture_prefix_must_lie_under_a_wildcard_route() {
+        let registration = |provider_id: &str| {
+            IntegrationRegistration::builder("examplecapture")
+                .with_proxy(Arc::new(ExampleCaptureProxy))
+                .with_identity_provider(fixed_capture_provider(
+                    provider_id,
+                    &["examplecapture.example.com"],
+                ))
+                .build()
+        };
+
+        IntegrationRegistry::from_registrations(vec![registration("examplecapture")])
+            .expect("should accept a prefix under the wildcard route");
+        assert!(
+            IntegrationRegistry::from_registrations(vec![registration("other")]).is_err(),
+            "should reject a prefix outside the routes"
+        );
+    }
+
+    struct ExactRouteProxy;
+
+    #[async_trait(?Send)]
+    impl IntegrationProxy for ExactRouteProxy {
+        fn integration_name(&self) -> &'static str {
+            "examplecapture"
+        }
+
+        fn routes(&self) -> Vec<IntegrationEndpoint> {
+            vec![IntegrationEndpoint::post(
+                "/integrations/examplecapture/api",
+            )]
+        }
+
+        async fn handle(
+            &self,
+            _settings: &Settings,
+            _services: &RuntimeServices,
+            _req: Request<EdgeBody>,
+        ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+            Ok(Response::new(EdgeBody::empty()))
+        }
+    }
+
+    #[test]
+    fn capture_prefix_under_an_exact_route_is_rejected_with_the_prefix_named() {
+        let registration = |proxy: Arc<dyn IntegrationProxy>| {
+            IntegrationRegistration::builder("examplecapture")
+                .with_proxy(proxy)
+                .with_identity_provider(fixed_capture_provider(
+                    "examplecapture",
+                    &["examplecapture.example.com"],
+                ))
+                .build()
+        };
+
+        IntegrationRegistry::from_registrations(vec![registration(Arc::new(ExampleCaptureProxy))])
+            .expect("control: a wildcard route should contain the prefix");
+        let error =
+            IntegrationRegistry::from_registrations(vec![registration(Arc::new(ExactRouteProxy))])
+                .err()
+                .expect("should reject a prefix under an exact route");
+        assert!(
+            format!("{error}").contains("/integrations/examplecapture/"),
+            "should name the rejected prefix: {error}"
+        );
+    }
+
+    #[test]
+    fn two_integrations_registering_the_same_provider_id_fail_at_startup() {
+        let registration = |integration: &'static str| {
+            IntegrationRegistration::builder(integration)
+                .with_identity_provider(fixed_provider("shared-id", &["shared.example.com"]))
+                .build()
+        };
+
+        let registry = IntegrationRegistry::from_registrations(vec![registration("first")])
+            .expect("control: one registration should build");
+        let duplicated = IntegrationRegistry::from_registrations(vec![
+            registration("first"),
+            registration("second"),
+        ])
+        .expect("should merge both registrations");
+        let error = crate::ec::identity::catalog::ProviderCatalog::from_settings(
+            &crate::test_support::tests::create_test_settings(),
+            &duplicated.identity_providers(),
+        )
+        .err()
+        .expect("should reject the duplicate provider ID");
+        assert!(
+            format!("{error}").contains("`shared-id` is declared more than once"),
+            "should report the duplicate: {error}"
+        );
+        assert_eq!(registry.identity_providers().len(), 1, "should hold one");
+    }
+
+    /// Revoke-only capture around `handle_proxy` (spec 4.7).
+    mod capture_proxy {
+        use std::collections::BTreeMap;
+        use std::io::Write as _;
+        use std::sync::{Arc, Mutex};
+
+        use bytes::Bytes;
+        use serde_json::json;
+
+        use super::*;
+        use crate::ec::identity::IdentityRuntime;
+        use crate::ec::identity::revision::set_hashes;
+        use crate::ec::identity::test_support::hold_fixture::live_row;
+        use crate::ec::identity::test_support::{
+            TEST_EC_ID, WriteCountingEcKv, allowing_consent, answering_capture_provider,
+            record_for_test,
+        };
+        use crate::ec::kv_types::KvEntry;
+        use crate::test_support::logs::{captured_logs, install_capturing_logger};
+        use crate::test_support::tests::create_test_settings;
+
+        const FIRST: &str = "a.example.com";
+
+        /// How the upstream answers.
+        #[derive(Clone)]
+        struct Upstream {
+            status: StatusCode,
+            headers: Vec<(&'static str, &'static str)>,
+            body: Vec<u8>,
+            streamed: bool,
+        }
+
+        impl Upstream {
+            fn json(body: &serde_json::Value) -> Self {
+                Self {
+                    status: StatusCode::OK,
+                    headers: vec![("content-type", "application/json")],
+                    body: serde_json::to_vec(body).expect("should serialize the body"),
+                    streamed: false,
+                }
+            }
+        }
+
+        struct ScriptedProxy {
+            upstream: Upstream,
+            request_body: Arc<Mutex<Option<Vec<u8>>>>,
+        }
+
+        #[async_trait(?Send)]
+        impl IntegrationProxy for ScriptedProxy {
+            fn integration_name(&self) -> &'static str {
+                "lockr"
+            }
+
+            fn routes(&self) -> Vec<IntegrationEndpoint> {
+                vec![
+                    IntegrationEndpoint::post("/integrations/lockr/*"),
+                    IntegrationEndpoint::post("/integrations/examplecapture/*"),
+                ]
+            }
+
+            async fn handle(
+                &self,
+                _settings: &Settings,
+                _services: &RuntimeServices,
+                req: Request<EdgeBody>,
+            ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+                let seen = req.into_body().into_bytes().unwrap_or_default().to_vec();
+                *self.request_body.lock().expect("should lock the body") = Some(seen);
+                let mut builder = Response::builder().status(self.upstream.status);
+                for (name, value) in &self.upstream.headers {
+                    builder = builder.header(*name, *value);
+                }
+                let body = if self.upstream.streamed {
+                    let chunks: Vec<Result<Bytes, std::io::Error>> = self
+                        .upstream
+                        .body
+                        .chunks(7)
+                        .map(|chunk| Ok(Bytes::copy_from_slice(chunk)))
+                        .collect();
+                    EdgeBody::from_stream(futures::stream::iter(chunks))
+                } else {
+                    EdgeBody::from(self.upstream.body.clone())
+                };
+                Ok(builder.body(body).expect("should build the response"))
+            }
+        }
+
+        /// What one proxied call left behind.
+        struct Exchange {
+            response: Response<EdgeBody>,
+            request_body: Option<Vec<u8>>,
+            store: Arc<WriteCountingEcKv>,
+            context: EcContext,
+            row: Option<KvEntry>,
+        }
+
+        impl Exchange {
+            fn response_bytes(self) -> Vec<u8> {
+                futures::executor::block_on(self.response.into_body().into_bytes_bounded(1 << 20))
+                    .expect("should read the response body")
+                    .to_vec()
+            }
+        }
+
+        struct Call<'a> {
+            provider: Arc<dyn IdentityProvider>,
+            path: &'a str,
+            upstream: Upstream,
+            request_body: &'a [u8],
+            real_browser: bool,
+            row: Option<&'a KvEntry>,
+            max_response_bytes: usize,
+        }
+
+        fn call<'a>(
+            provider: Arc<dyn IdentityProvider>,
+            path: &'a str,
+            upstream: Upstream,
+        ) -> Call<'a> {
+            Call {
+                provider,
+                path,
+                upstream,
+                request_body: b"{}",
+                real_browser: true,
+                row: None,
+                max_response_bytes: 65_536,
+            }
+        }
+
+        fn exchange(call: Call<'_>) -> Exchange {
+            let mut settings = create_test_settings();
+            settings.ec.identity.max_response_bytes = call.max_response_bytes;
+            let request_body = Arc::new(Mutex::new(None));
+            let registry = IntegrationRegistry::from_registrations(vec![
+                IntegrationRegistration::builder("lockr")
+                    .with_proxy(Arc::new(ScriptedProxy {
+                        upstream: call.upstream,
+                        request_body: Arc::clone(&request_body),
+                    }))
+                    .with_identity_provider(call.provider)
+                    .build(),
+            ])
+            .expect("should build the registry");
+            let runtime = Arc::new(
+                IdentityRuntime::from_settings_with_providers(
+                    &settings,
+                    registry.identity_providers(),
+                    BTreeMap::new(),
+                )
+                .expect("should build the runtime"),
+            );
+            let (graph, store) = KvIdentityGraph::write_counting("capture-proxy-store");
+            if let Some(row) = call.row {
+                graph.create(TEST_EC_ID, row).expect("should seed the row");
+            }
+            let mut context = EcContext::new_for_test_with_ip(
+                Some(TEST_EC_ID.to_owned()),
+                allowing_consent(),
+                Some("192.0.2.10".to_owned()),
+            );
+            context.set_identity_runtime(runtime);
+            context.set_kv_snapshot(graph.load_snapshot(TEST_EC_ID));
+            store.reset_counts();
+
+            let req = http::Request::builder()
+                .method(http::Method::POST)
+                .uri(format!("https://www.example.com{}", call.path))
+                .body(EdgeBody::from(call.request_body.to_vec()))
+                .expect("should build the request");
+            let response = futures::executor::block_on(registry.handle_proxy(ProxyDispatchInput {
+                method: &http::Method::POST,
+                path: call.path,
+                settings: &settings,
+                kv: Some(&graph),
+                ec_context: &mut context,
+                services: &noop_services(),
+                is_real_browser: call.real_browser,
+                seed: &BrowserSeed::empty(),
+                req,
+            }))
+            .expect("should match the route")
+            .expect("the proxy should answer");
+            let row = graph.get(TEST_EC_ID).ok().flatten().map(|(row, _)| row);
+            Exchange {
+                response,
+                request_body: request_body.lock().expect("should lock the body").clone(),
+                store,
+                context,
+                row,
+            }
+        }
+
+        fn token_body() -> serde_json::Value {
+            json!({"tokens": [{"source": FIRST, "value": "secret-uid-a"}]})
+        }
+
+        fn gzip(bytes: &[u8]) -> Vec<u8> {
+            let mut encoder =
+                flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+            encoder.write_all(bytes).expect("should compress");
+            encoder.finish().expect("should finish the stream")
+        }
+
+        fn brotli(bytes: &[u8]) -> Vec<u8> {
+            let mut out = Vec::new();
+            {
+                let mut encoder = ::brotli::CompressorWriter::new(&mut out, 4096, 5, 22);
+                encoder.write_all(bytes).expect("should compress");
+            }
+            out
+        }
+
+        fn counted(exchange: &Exchange) -> usize {
+            exchange.context.identity().capture_unpersisted().len()
+        }
+
+        #[test]
+        fn capture_runs_only_for_matching_rules() {
+            let token = json!({"tokens": [{
+                "source": "examplecapture.example.com", "value": "v", "expires": 4_102_444_800_u64
+            }]});
+            let provider = || -> Arc<dyn IdentityProvider> {
+                Arc::new(ExampleCaptureProvider::new().expect("should build the provider"))
+            };
+
+            let matching = exchange(call(
+                provider(),
+                "/integrations/examplecapture/api/token",
+                Upstream::json(&token),
+            ));
+            let other_path = exchange(call(
+                provider(),
+                "/integrations/examplecapture/api/other",
+                Upstream::json(&token),
+            ));
+
+            assert_eq!(counted(&matching), 1, "should capture on the matching rule");
+            assert_eq!(
+                counted(&other_path),
+                0,
+                "should not capture on a path outside the rules"
+            );
+        }
+
+        #[test]
+        fn capture_runs_only_on_a_2xx_response() {
+            let provider = || answering_capture_provider("lockr", &[FIRST], None);
+            let path = "/integrations/lockr/api/token";
+            let mut failing = Upstream::json(&token_body());
+            failing.status = StatusCode::INTERNAL_SERVER_ERROR;
+
+            let ok = exchange(call(provider(), path, Upstream::json(&token_body())));
+            let error = exchange(call(provider(), path, failing));
+
+            assert_eq!(counted(&ok), 1, "should capture a 200");
+            assert_eq!(counted(&error), 0, "should not capture a 500");
+            assert_eq!(
+                error.response.status(),
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "should still return the 500"
+            );
+        }
+
+        #[test]
+        fn capture_decodes_gzip_and_brotli_responses_and_forwards_them_unchanged() {
+            let plain = serde_json::to_vec(&token_body()).expect("should serialize");
+            for (encoding, compressed) in [("gzip", gzip(&plain)), ("br", brotli(&plain))] {
+                let upstream = Upstream {
+                    status: StatusCode::OK,
+                    headers: vec![
+                        ("content-type", "application/json"),
+                        ("content-encoding", encoding),
+                    ],
+                    body: compressed.clone(),
+                    streamed: false,
+                };
+
+                let result = exchange(call(
+                    answering_capture_provider("lockr", &[FIRST], None),
+                    "/integrations/lockr/api/token",
+                    upstream,
+                ));
+
+                assert_eq!(counted(&result), 1, "should decode {encoding} for capture");
+                assert_eq!(
+                    result.response.headers()["content-encoding"],
+                    encoding,
+                    "should keep the encoding header"
+                );
+                assert_eq!(
+                    result.response_bytes(),
+                    compressed,
+                    "should forward the {encoding} bytes unchanged"
+                );
+            }
+        }
+
+        #[test]
+        fn capture_never_reads_the_request_body() {
+            install_capturing_logger();
+            let request_body = serde_json::to_vec(
+                &json!({"email": "capture-body-7731@example.com", "consent": true}),
+            )
+            .expect("should serialize");
+            let mut request = call(
+                answering_capture_provider("lockr", &[FIRST], None),
+                "/integrations/lockr/api/token",
+                Upstream::json(&token_body()),
+            );
+            request.request_body = &request_body;
+
+            let result = exchange(request);
+
+            assert_eq!(
+                result.request_body.as_deref(),
+                Some(request_body.as_slice()),
+                "should hand the upstream the request body unchanged"
+            );
+            assert_eq!(counted(&result), 1, "control: the response is captured");
+            assert!(
+                !captured_logs()
+                    .iter()
+                    .any(|line| line.contains("capture-body-7731")),
+                "should log nothing from the request body"
+            );
+        }
+
+        #[test]
+        fn capture_skips_an_oversized_proxied_body() {
+            let body = json!({"tokens": [{"source": FIRST, "value": "x".repeat(200)}]});
+            let provider = || answering_capture_provider("lockr", &[FIRST], None);
+            let path = "/integrations/lockr/api/token";
+            let plain = serde_json::to_vec(&body).expect("should serialize");
+
+            for streamed in [false, true] {
+                let mut upstream = Upstream::json(&body);
+                upstream.streamed = streamed;
+                let mut oversized = call(provider(), path, upstream.clone());
+                oversized.max_response_bytes = 64;
+                let skipped = exchange(oversized);
+                assert_eq!(
+                    counted(&skipped),
+                    0,
+                    "should not capture (streamed={streamed})"
+                );
+                assert_eq!(
+                    skipped.response_bytes(),
+                    plain,
+                    "should pass the body through unchanged (streamed={streamed})"
+                );
+
+                let within = exchange(call(provider(), path, upstream));
+                assert_eq!(counted(&within), 1, "control: captures within the cap");
+                assert_eq!(
+                    within.response_bytes(),
+                    plain,
+                    "control: forwards the buffered body unchanged (streamed={streamed})"
+                );
+            }
+        }
+
+        #[test]
+        fn capture_removal_from_a_real_browser_is_written_before_the_response_returns() {
+            let mut seeded = live_row();
+            seeded
+                .ids
+                .insert(FIRST.to_owned(), record_for_test("secret-uid-a", None, 500));
+            let mut request = call(
+                answering_capture_provider("lockr", &[FIRST], None),
+                "/integrations/lockr/api/token",
+                Upstream::json(&json!({"invalidate": [FIRST]})),
+            );
+            request.row = Some(&seeded);
+
+            let result = exchange(request);
+
+            let row = result.row.as_ref().expect("should hold the row");
+            assert!(!row.ids.contains_key(FIRST), "should remove the record");
+            assert_eq!(
+                row.ps["lockr"].iv,
+                set_hashes(&seeded.ids[FIRST].eids),
+                "should hash the record into iv"
+            );
+            assert_eq!(result.store.writes().total(), 1, "should write once");
+        }
+
+        #[test]
+        fn capture_from_a_non_browser_writes_only_removals() {
+            let mut seeded = live_row();
+            seeded.ids.insert(
+                FIRST.to_owned(),
+                record_for_test("secret-uid-a", Some("lockr"), 500),
+            );
+            for body in [json!({"invalidate": [FIRST]}), json!({"opted_out": true})] {
+                let mut request = call(
+                    answering_capture_provider("lockr", &[FIRST], None),
+                    "/integrations/lockr/api/token",
+                    Upstream::json(&body),
+                );
+                request.real_browser = false;
+                request.row = Some(&seeded);
+
+                let result = exchange(request);
+
+                let row = result.row.as_ref().expect("should hold the row");
+                assert!(
+                    !row.ids.contains_key(FIRST),
+                    "should apply the removal for {body}"
+                );
+                assert_eq!(
+                    result.store.writes().total(),
+                    1,
+                    "should write once for {body}"
+                );
+            }
+
+            let mut request = call(
+                answering_capture_provider("lockr", &[FIRST], None),
+                "/integrations/lockr/api/token",
+                Upstream::json(&token_body()),
+            );
+            request.real_browser = false;
+            request.row = Some(&seeded);
+            let result = exchange(request);
+            assert_eq!(
+                result.store.writes().total(),
+                0,
+                "should write nothing for a positive result"
+            );
+            assert_eq!(
+                result.row.as_ref(),
+                Some(&seeded),
+                "should change no row for a positive result"
+            );
+        }
+    }
 }
diff --git a/crates/trusted-server-core/src/integrations/sdk_url.rs b/crates/trusted-server-core/src/integrations/sdk_url.rs
new file mode 100644
index 0000000000..5713163556
--- /dev/null
+++ b/crates/trusted-server-core/src/integrations/sdk_url.rs
@@ -0,0 +1,36 @@
+//! Shared input policy for SDK URL ownership checks.
+
+use std::borrow::Cow;
+
+use url::Url;
+
+/// Parse an HTTP(S) SDK URL with an explicit authority, or a protocol-relative URL.
+///
+/// Applies browser C0/space trimming, removes tab/CR/LF, and accepts backslash
+/// authority separators. Literal NULs, relative paths, and base-dependent shorthand
+/// stay unowned; HTML replaces NULs rather than treating them as URL whitespace.
+/// Browser/Rust ownership cases live in crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json.
+pub(super) fn parse_sdk_network_url(url: &str) -> Option<Url> {
+    if url.contains('\0') {
+        return None;
+    }
+    let trimmed = url.trim_matches(|character| character <= '\u{20}');
+    let value = if trimmed.contains(['\t', '\n', '\r']) {
+        Cow::Owned(trimmed.replace(['\t', '\n', '\r'], ""))
+    } else {
+        Cow::Borrowed(trimmed)
+    };
+    let has_authority = |value: &str| matches!(value.as_bytes(), [b'/' | b'\\', b'/' | b'\\', ..]);
+    let parsed = if has_authority(&value) {
+        Url::parse(&format!("https:{value}"))
+    } else {
+        let (scheme, remainder) = value.split_once(':')?;
+        if !(scheme.eq_ignore_ascii_case("http") || scheme.eq_ignore_ascii_case("https"))
+            || !has_authority(remainder)
+        {
+            return None;
+        }
+        Url::parse(&value)
+    };
+    parsed.ok()
+}
diff --git a/crates/trusted-server-core/src/integrations/sdk_url_test_support.rs b/crates/trusted-server-core/src/integrations/sdk_url_test_support.rs
new file mode 100644
index 0000000000..a1d504468e
--- /dev/null
+++ b/crates/trusted-server-core/src/integrations/sdk_url_test_support.rs
@@ -0,0 +1,126 @@
+//! Shared SDK URL corpus and attribute-rewrite assertions.
+
+use lol_html::{RewriteStrSettings, element, rewrite_str};
+use serde::Deserialize;
+
+use super::{AttributeRewriteAction, IntegrationAttributeContext, IntegrationAttributeRewriter};
+
+/// One raw URL and its expected integration owner from the shared corpus.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct SdkUrlCase {
+    /// Descriptive case name for assertion failures.
+    pub(super) name: String,
+    /// Input before browser DOM URL resolution.
+    pub(super) url: String,
+    /// Expected integration ID, or none for an unowned URL.
+    pub(super) owner: Option<String>,
+    /// Owner once `lol_html` has read the attribute, when that differs from `owner`.
+    pub(super) server_html_owner: Option<String>,
+}
+
+/// Load the URL ownership cases used by both Rust and browser tests.
+///
+/// # Panics
+///
+/// Panics if the committed fixture is invalid.
+pub(super) fn sdk_url_cases() -> Vec<SdkUrlCase> {
+    serde_json::from_str(include_str!(
+        "../../../trusted-server-js/lib/test/fixtures/sdk-url-ownership.json"
+    ))
+    .expect("should parse shared SDK URL ownership corpus")
+}
+
+/// Assert SDK rewriting for both script and link attribute contexts.
+///
+/// # Panics
+///
+/// Panics if the rewrite result disagrees with the corpus owner and SDK route.
+pub(super) fn assert_sdk_url_rewrite(
+    integration: &dyn IntegrationAttributeRewriter,
+    case: &SdkUrlCase,
+    sdk_path: &str,
+) {
+    let expected = if case.owner.as_deref() == Some(integration.integration_id()) {
+        AttributeRewriteAction::Replace(sdk_path.to_string())
+    } else {
+        AttributeRewriteAction::Keep
+    };
+    for (attribute, element) in [("src", "script"), ("href", "link")] {
+        assert!(
+            integration.handles_attribute(attribute),
+            "should route {attribute} to the {} rewriter",
+            integration.integration_id()
+        );
+        let context = IntegrationAttributeContext {
+            attribute_name: attribute,
+            element_name: element,
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "origin.example.com",
+        };
+        assert_eq!(
+            integration.rewrite(attribute, &case.url, &context),
+            expected,
+            "should apply expected {} {attribute} rewrite for {}: {}",
+            integration.integration_id(),
+            case.name,
+            case.url
+        );
+    }
+}
+
+/// Assert the SDK rewrite of a corpus URL after `lol_html` reads it from markup.
+///
+/// # Panics
+///
+/// Panics if HTML processing fails or the output disagrees with the server-side owner.
+pub(super) fn assert_sdk_html_attribute_rewrite(
+    integration: &dyn IntegrationAttributeRewriter,
+    case: &SdkUrlCase,
+    sdk_path: &str,
+) {
+    let owner = case.server_html_owner.as_ref().or(case.owner.as_ref());
+    let owned = owner.map(String::as_str) == Some(integration.integration_id());
+    for (attribute, tag) in [("src", "script"), ("href", "link")] {
+        let html = format!(
+            "<{tag} {attribute}=\"{}\"></{tag}>",
+            case.url.replace('"', "&quot;")
+        );
+        let context = IntegrationAttributeContext {
+            attribute_name: attribute,
+            element_name: tag,
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "origin.example.com",
+        };
+        let output = rewrite_str(
+            &html,
+            RewriteStrSettings {
+                element_content_handlers: vec![element!(tag, |element| {
+                    let value = element
+                        .get_attribute(attribute)
+                        .expect("should read the SDK URL attribute");
+                    if let AttributeRewriteAction::Replace(next) =
+                        integration.rewrite(attribute, &value, &context)
+                    {
+                        element.set_attribute(attribute, &next)?;
+                    }
+                    Ok(())
+                })],
+                ..RewriteStrSettings::default()
+            },
+        )
+        .expect("should process SDK URL markup");
+        let expected = if owned {
+            format!("<{tag} {attribute}=\"{sdk_path}\"></{tag}>")
+        } else {
+            html
+        };
+        assert_eq!(
+            output, expected,
+            "should apply expected HTML {attribute} rewrite for {}",
+            case.name
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 5cdc1d1248..d026e5f6f8 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -31,6 +31,7 @@
     )
 )]
 
+pub mod access_telemetry;
 pub(crate) mod asset_image_optimizer;
 pub mod auction;
 pub mod auction_config_types;
@@ -64,6 +65,7 @@ pub mod proxy;
 pub mod publisher;
 pub mod redacted;
 pub mod request_signing;
+pub mod request_timing;
 pub(crate) mod response_header_rewrite;
 pub mod response_privacy;
 pub mod rsc_flight;
diff --git a/crates/trusted-server-core/src/migration_guards.rs b/crates/trusted-server-core/src/migration_guards.rs
index 17b3d624f6..720e8b7ca0 100644
--- a/crates/trusted-server-core/src/migration_guards.rs
+++ b/crates/trusted-server-core/src/migration_guards.rs
@@ -75,6 +75,7 @@ fn checked_sources() -> &'static [(&'static str, &'static str)] {
         ("creative.rs", include_str!("creative.rs")),
         ("ec/auth.rs", include_str!("ec/auth.rs")),
         ("ec/batch_sync.rs", include_str!("ec/batch_sync.rs")),
+        ("ec/client_eids.rs", include_str!("ec/client_eids.rs")),
         ("ec/consent.rs", include_str!("ec/consent.rs")),
         ("ec/cookies.rs", include_str!("ec/cookies.rs")),
         ("ec/device.rs", include_str!("ec/device.rs")),
@@ -82,6 +83,69 @@ fn checked_sources() -> &'static [(&'static str, &'static str)] {
         ("ec/finalize.rs", include_str!("ec/finalize.rs")),
         ("ec/generation.rs", include_str!("ec/generation.rs")),
         ("ec/identify.rs", include_str!("ec/identify.rs")),
+        (
+            "ec/identity/catalog.rs",
+            include_str!("ec/identity/catalog.rs"),
+        ),
+        (
+            "ec/identity/coordinator.rs",
+            include_str!("ec/identity/coordinator.rs"),
+        ),
+        (
+            "ec/identity/descriptor.rs",
+            include_str!("ec/identity/descriptor.rs"),
+        ),
+        (
+            "ec/identity/exchange.rs",
+            include_str!("ec/identity/exchange.rs"),
+        ),
+        ("ec/identity/ids.rs", include_str!("ec/identity/ids.rs")),
+        ("ec/identity/input.rs", include_str!("ec/identity/input.rs")),
+        ("ec/identity/mod.rs", include_str!("ec/identity/mod.rs")),
+        (
+            "ec/identity/mirror.rs",
+            include_str!("ec/identity/mirror.rs"),
+        ),
+        (
+            "ec/identity/mutation.rs",
+            include_str!("ec/identity/mutation.rs"),
+        ),
+        (
+            "ec/identity/policy.rs",
+            include_str!("ec/identity/policy.rs"),
+        ),
+        (
+            "ec/identity/provider.rs",
+            include_str!("ec/identity/provider.rs"),
+        ),
+        (
+            "ec/identity/removal.rs",
+            include_str!("ec/identity/removal.rs"),
+        ),
+        (
+            "ec/identity/request.rs",
+            include_str!("ec/identity/request.rs"),
+        ),
+        (
+            "ec/identity/resolution.rs",
+            include_str!("ec/identity/resolution.rs"),
+        ),
+        (
+            "ec/identity/runtime.rs",
+            include_str!("ec/identity/runtime.rs"),
+        ),
+        (
+            "ec/identity/servable.rs",
+            include_str!("ec/identity/servable.rs"),
+        ),
+        (
+            "ec/identity/test_support.rs",
+            include_str!("ec/identity/test_support.rs"),
+        ),
+        (
+            "ec/identity/revision.rs",
+            include_str!("ec/identity/revision.rs"),
+        ),
         ("ec/kv.rs", include_str!("ec/kv.rs")),
         ("ec/kv_types.rs", include_str!("ec/kv_types.rs")),
         ("ec/mod.rs", include_str!("ec/mod.rs")),
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index 67cd7f6950..b502a5f164 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -65,17 +65,63 @@ pub struct ConsentedProvidersSettings {
 }
 
 /// An Extended User ID entry from an identity provider.
-#[derive(Debug, Clone, Serialize, Deserialize)]
+///
+/// Mirrors `OpenRTB` 2.6 §3.2.27. Browser entries keep the EID-level fields
+/// Prebid set; KV-resolved entries carry the EID-level fields a provider
+/// stored, and a record from browser ingest or a version 1 row has none.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct Eid {
     /// Identity provider domain (e.g. `"id5-sync.com"`).
     pub source: String,
     /// One or more user IDs from this provider.
     pub uids: Vec<Uid>,
+    /// Entity that inserted the IDs into the request (`eid.inserter`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub inserter: Option<String>,
+    /// Entity that matched the IDs (`eid.matcher`). Absent means `source`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub matcher: Option<String>,
+    /// Match method (`eid.mm`). Vendor values from 500 up are passed through.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mm: Option<i32>,
+    /// Provider-specific extension data, e.g. `LiveIntent` `segments`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ext: Option<Value>,
+}
+
+impl Eid {
+    /// Builds an [`Eid`] without EID-level fields.
+    ///
+    /// Use this for EIDs that never carry provenance, such as KV-resolved
+    /// partner IDs.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use trusted_server_core::openrtb::{Eid, Uid};
+    ///
+    /// let eid = Eid::new(
+    ///     "ids.example.com".to_owned(),
+    ///     vec![Uid { id: "uid-1".to_owned(), atype: Some(1), ext: None }],
+    /// );
+    /// assert_eq!(eid.inserter, None);
+    /// ```
+    #[must_use]
+    pub fn new(source: String, uids: Vec<Uid>) -> Self {
+        Self {
+            source,
+            uids,
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
+    }
 }
 
 /// A single user identifier within an [`Eid`] entry.
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct Uid {
     /// The identifier value.
@@ -189,6 +235,10 @@ pub struct ResponseExt {
     /// Optional request-scoped trace transport under its own namespace.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub trusted_server: Option<TraceResponseExt>,
+    /// The `ts-eids-s` mirror payload, absent when the request read no KV
+    /// (spec 6.2).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ts_eids_s: Option<serde_json::Value>,
 }
 
 impl ToExt for ResponseExt {}
@@ -207,6 +257,87 @@ pub struct TraceResponseExt {
 mod tests {
     use super::*;
     use crate::auction::types::OrchestratorExt;
+    use serde_json::json;
+
+    #[test]
+    fn eid_serializes_openrtb_provenance_fields_when_present() {
+        let eid = Eid {
+            source: "ids.example.com".to_owned(),
+            uids: vec![Uid {
+                id: "uid-1".to_owned(),
+                atype: Some(1),
+                ext: Some(json!({ "rtiPartner": "TDID" })),
+            }],
+            inserter: Some("inserter.example.com".to_owned()),
+            matcher: Some("matcher.example.com".to_owned()),
+            mm: Some(4),
+            ext: Some(json!({ "segments": ["s1"] })),
+        };
+
+        let serialized = serde_json::to_value(&eid).expect("should serialize EID");
+
+        assert_eq!(
+            serialized,
+            json!({
+                "source": "ids.example.com",
+                "uids": [{ "id": "uid-1", "atype": 1, "ext": { "rtiPartner": "TDID" } }],
+                "inserter": "inserter.example.com",
+                "matcher": "matcher.example.com",
+                "mm": 4,
+                "ext": { "segments": ["s1"] }
+            }),
+            "should serialize every EID-level field"
+        );
+    }
+
+    #[test]
+    fn eid_without_provenance_fields_serializes_as_before() {
+        let eid = Eid::new(
+            "ids.example.com".to_owned(),
+            vec![Uid {
+                id: "uid-1".to_owned(),
+                atype: Some(1),
+                ext: None,
+            }],
+        );
+
+        let serialized = serde_json::to_string(&eid).expect("should serialize EID");
+
+        assert_eq!(
+            serialized, r#"{"source":"ids.example.com","uids":[{"id":"uid-1","atype":1}]}"#,
+            "an EID without EID-level fields should serialize byte-identically to before"
+        );
+    }
+
+    #[test]
+    fn eid_deserializes_provenance_fields_and_keeps_rejecting_unknown_keys() {
+        let parsed: Eid = serde_json::from_str(
+            r#"{"source":"ids.example.com","uids":[{"id":"uid-1"}],"inserter":"inserter.example.com","matcher":"matcher.example.com","mm":3,"ext":{"k":"v"}}"#,
+        )
+        .expect("should deserialize EID-level fields");
+
+        assert_eq!(
+            parsed,
+            Eid {
+                source: "ids.example.com".to_owned(),
+                uids: vec![Uid {
+                    id: "uid-1".to_owned(),
+                    atype: None,
+                    ext: None,
+                }],
+                inserter: Some("inserter.example.com".to_owned()),
+                matcher: Some("matcher.example.com".to_owned()),
+                mm: Some(3),
+                ext: Some(json!({ "k": "v" })),
+            },
+            "should read every EID-level field"
+        );
+        assert!(
+            serde_json::from_str::<Eid>(r#"{"source":"ids.example.com","uids":[],"unknown":1}"#)
+                .is_err(),
+            "should keep deny_unknown_fields"
+        );
+    }
 
     #[test]
     fn openrtb_response_round_trips_with_struct_literals() {
@@ -239,6 +370,7 @@ mod tests {
                 dropped_winner_count: 0,
                 dropped_winner_reasons: Default::default(),
             },
+            ts_eids_s: None,
         }
         .to_ext();
 
@@ -407,14 +539,14 @@ mod tests {
 
     #[test]
     fn eid_serializes_correctly() {
-        let eid = Eid {
-            source: "id5-sync.com".to_owned(),
-            uids: vec![Uid {
+        let eid = Eid::new(
+            "id5-sync.com".to_owned(),
+            vec![Uid {
                 id: "ID5-abc123".to_owned(),
                 atype: Some(1),
                 ext: None,
             }],
-        };
+        );
 
         let serialized = serde_json::to_value(&eid).expect("should serialize");
         assert_eq!(serialized["source"], "id5-sync.com", "source should match");
@@ -431,14 +563,14 @@ mod tests {
 
     #[test]
     fn eid_serializes_vendor_specific_atype() {
-        let eid = Eid {
-            source: "google.com".to_owned(),
-            uids: vec![Uid {
+        let eid = Eid::new(
+            "google.com".to_owned(),
+            vec![Uid {
                 id: "pair-id".to_owned(),
                 atype: Some(571187),
                 ext: None,
             }],
-        };
+        );
 
         let serialized = serde_json::to_value(&eid).expect("should serialize");
 
diff --git a/crates/trusted-server-core/src/platform/backend_naming.rs b/crates/trusted-server-core/src/platform/backend_naming.rs
index 52487def53..826bb0d849 100644
--- a/crates/trusted-server-core/src/platform/backend_naming.rs
+++ b/crates/trusted-server-core/src/platform/backend_naming.rs
@@ -321,6 +321,10 @@ fn fastly_canonical_spec(spec: &PlatformBackendSpec, target_port: u16) -> String
         &mut buffer,
         &spec.between_bytes_timeout.as_millis().to_string(),
     );
+    if let Some(timeout) = spec.connect_timeout {
+        buffer.push('c');
+        push_field(&mut buffer, &timeout.as_millis().to_string());
+    }
     buffer
 }
 
@@ -381,14 +385,21 @@ fn predict_fastly(
         .as_deref()
         .map(|value| format!("_p_{}", sanitize_fastly_component(value)))
         .unwrap_or_default();
+    // Only a spec that sets a connect timeout names it, so every name from
+    // before the field existed is unchanged.
+    let connect_suffix = spec
+        .connect_timeout
+        .map(|timeout| format!("_ct{}", timeout.as_millis()))
+        .unwrap_or_default();
     let readable_full = format!(
-        "{}{}{}{}_fb{}_bb{}",
+        "{}{}{}{}_fb{}_bb{}{}",
         sanitize_fastly_component(&name_base),
         host_override_suffix,
         cert_suffix,
         discriminator_suffix,
         spec.first_byte_timeout.as_millis(),
-        spec.between_bytes_timeout.as_millis()
+        spec.between_bytes_timeout.as_millis(),
+        connect_suffix
     );
     let readable = readable_full
         .chars()
@@ -502,6 +513,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: Duration::from_millis(1500),
             between_bytes_timeout: Duration::from_millis(1500),
+            connect_timeout: None,
             discriminator: Some("provider-one".to_owned()),
         }
     }
@@ -545,6 +557,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn fastly_prediction_names_a_connect_timeout_only_when_set() {
+        let default = BackendNamingPolicy::Fastly
+            .predict(&spec())
+            .expect("should predict the default backend");
+        let mut capped = spec();
+        capped.connect_timeout = Some(Duration::from_millis(80));
+        let capped = BackendNamingPolicy::Fastly
+            .predict(&capped)
+            .expect("should predict the capped backend");
+
+        assert_ne!(
+            default.name, capped.name,
+            "should register a capped connect timeout as its own backend"
+        );
+        assert!(
+            capped.name.contains("_bb1500_ct80_"),
+            "should name the connect timeout in the readable part"
+        );
+    }
+
     #[test]
     fn fastly_prediction_canonicalizes_only_bracketed_ipv6_hosts() {
         let mut bare = spec();
diff --git a/crates/trusted-server-core/src/platform/http.rs b/crates/trusted-server-core/src/platform/http.rs
index e1fe8ff1f2..e58981b154 100644
--- a/crates/trusted-server-core/src/platform/http.rs
+++ b/crates/trusted-server-core/src/platform/http.rs
@@ -379,6 +379,14 @@ pub trait PlatformHttpClient: Send + Sync {
         true
     }
 
+    /// How many upstream requests this client has started, with
+    /// [`send`](Self::send) or [`send_async`](Self::send_async), on the
+    /// platform execution it belongs to. `None` when the adapter does not
+    /// count them, which leaves callers that budget requests unbudgeted.
+    fn requests_started(&self) -> Option<usize> {
+        None
+    }
+
     /// Whether [`send`](Self::send) can preserve upstream response bodies as
     /// [`Body::Stream`](edgezero_core::body::Body::Stream) when requested via
     /// [`PlatformHttpRequest::with_stream_response`].
diff --git a/crates/trusted-server-core/src/platform/mod.rs b/crates/trusted-server-core/src/platform/mod.rs
index e4733106e3..f41370f748 100644
--- a/crates/trusted-server-core/src/platform/mod.rs
+++ b/crates/trusted-server-core/src/platform/mod.rs
@@ -44,6 +44,7 @@ mod template_assembly;
 mod template_cache;
 #[cfg(test)]
 pub(crate) mod test_support;
+mod timed_kv;
 mod timer;
 mod traits;
 mod types;
@@ -75,6 +76,7 @@ pub use template_cache::{
     TemplateCookieValue, TemplateEntry, TemplateMetadata, TemplateMetadataEncodeError,
     UnavailableTemplateCache, VaryHeaderValues, VarySpec, reader_url_surrogate_key,
 };
+pub use timed_kv::TimedKvStore;
 pub use timer::PlatformTimer;
 pub use traits::{PlatformBackend, PlatformConfigStore, PlatformGeo, PlatformSecretStore};
 pub use types::{
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index be0b3feb8f..44052ab0a9 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -1527,6 +1527,7 @@ mod tests {
             certificate_check: true,
             first_byte_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
             between_bytes_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
+            connect_timeout: None,
             discriminator: None,
         };
         let name = stub.ensure(&spec).expect("should return a backend name");
diff --git a/crates/trusted-server-core/src/platform/timed_kv.rs b/crates/trusted-server-core/src/platform/timed_kv.rs
new file mode 100644
index 0000000000..653fc9d5b9
--- /dev/null
+++ b/crates/trusted-server-core/src/platform/timed_kv.rs
@@ -0,0 +1,321 @@
+//! Latency-only timing decorator for Edge Cookie KV store handles.
+//!
+//! [`TimedKvStore`] wraps an [`EcKvStore`] plus a [`RequestTimings`] handle and
+//! records [`Phase::EcKv`] around every store call at
+//! [`KvIdentityGraph`](crate::ec::kv::KvIdentityGraph) construction sites.
+//! The decorator measures latency only: it never reads, parses, or logs values.
+
+use error_stack::Report;
+
+use crate::ec::kv_backend::{EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteOutcome};
+use crate::error::TrustedServerError;
+use crate::request_timing::{Phase, RequestTimings};
+
+/// Wraps `inner` plus a [`RequestTimings`] handle, recording [`Phase::EcKv`]
+/// around every store call made through it.
+pub struct TimedKvStore<S> {
+    /// The wrapped store handle.
+    inner: S,
+    /// The request's phase-timing collector.
+    timings: RequestTimings,
+}
+
+impl<S> TimedKvStore<S> {
+    /// Creates a decorator around `inner` that records into `timings`.
+    #[must_use]
+    pub fn new(inner: S, timings: RequestTimings) -> Self {
+        Self { inner, timings }
+    }
+}
+
+impl<S: EcKvStore> EcKvStore for TimedKvStore<S> {
+    fn store_name(&self) -> &str {
+        self.inner.store_name()
+    }
+
+    fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+        let _span = self.timings.span(Phase::EcKv);
+        self.inner.lookup(key)
+    }
+
+    fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+        let _span = self.timings.span(Phase::EcKv);
+        self.inner.key_exists(key)
+    }
+
+    fn insert(
+        &self,
+        key: &str,
+        write: EcKvWrite<'_>,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        let _span = self.timings.span(Phase::EcKv);
+        self.inner.insert(key, write)
+    }
+
+    fn list_keys_with_prefix(
+        &self,
+        prefix: &str,
+        limit: u32,
+    ) -> Result<Vec<String>, Report<TrustedServerError>> {
+        let _span = self.timings.span(Phase::EcKv);
+        self.inner.list_keys_with_prefix(prefix, limit)
+    }
+
+    fn count_keys_with_prefix(
+        &self,
+        prefix: &str,
+        limit: u32,
+    ) -> Result<u32, Report<TrustedServerError>> {
+        let _span = self.timings.span(Phase::EcKv);
+        self.inner.count_keys_with_prefix(prefix, limit)
+    }
+
+    fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+        let _span = self.timings.span(Phase::EcKv);
+        self.inner.delete(key)
+    }
+
+    fn pause(&self, duration: std::time::Duration) {
+        self.inner.pause(duration);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use super::*;
+    use crate::ec::kv_backend::test_support::InMemoryEcKv;
+
+    struct DelayingCountingEcKv {
+        inner: InMemoryEcKv,
+        calls: std::sync::Arc<std::sync::Mutex<Vec<&'static str>>>,
+    }
+
+    impl DelayingCountingEcKv {
+        fn record(&self, operation: &'static str) {
+            self.calls
+                .lock()
+                .expect("should lock KV operation calls")
+                .push(operation);
+            std::thread::sleep(Duration::from_millis(12));
+        }
+    }
+
+    impl EcKvStore for DelayingCountingEcKv {
+        fn store_name(&self) -> &str {
+            self.inner.store_name()
+        }
+
+        fn lookup(&self, key: &str) -> Result<Option<EcKvLookup>, Report<TrustedServerError>> {
+            self.record("lookup");
+            self.inner.lookup(key)
+        }
+
+        fn key_exists(&self, key: &str) -> Result<bool, Report<TrustedServerError>> {
+            self.record("key_exists");
+            self.inner.key_exists(key)
+        }
+
+        fn insert(
+            &self,
+            key: &str,
+            write: EcKvWrite<'_>,
+        ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+            self.record("insert");
+            self.inner.insert(key, write)
+        }
+
+        fn list_keys_with_prefix(
+            &self,
+            prefix: &str,
+            limit: u32,
+        ) -> Result<Vec<String>, Report<TrustedServerError>> {
+            self.record("list_keys_with_prefix");
+            self.inner.list_keys_with_prefix(prefix, limit)
+        }
+
+        fn count_keys_with_prefix(
+            &self,
+            prefix: &str,
+            limit: u32,
+        ) -> Result<u32, Report<TrustedServerError>> {
+            self.record("count_keys_with_prefix");
+            self.inner.count_keys_with_prefix(prefix, limit)
+        }
+
+        fn delete(&self, key: &str) -> Result<(), Report<TrustedServerError>> {
+            self.record("delete");
+            self.inner.delete(key)
+        }
+
+        fn pause(&self, duration: Duration) {
+            self.record("pause");
+            self.inner.pause(duration);
+        }
+    }
+
+    #[test]
+    fn request_timing_preserves_shared_graph_state_and_pause() {
+        let calls = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+        let graph = crate::ec::kv::KvIdentityGraph::new(DelayingCountingEcKv {
+            inner: InMemoryEcKv::new("test-store"),
+            calls: std::sync::Arc::clone(&calls),
+        });
+        let timings = RequestTimings::new();
+        let timed = graph.clone().with_request_timings(&timings);
+        timed
+            .write_key(
+                "shared-key",
+                "{}",
+                Duration::from_secs(60),
+                crate::ec::kv_backend::EcKvWriteMode::Add,
+            )
+            .expect("should write through the timed graph");
+        assert!(
+            graph
+                .lookup_key("shared-key")
+                .expect("should read shared store")
+                .is_some(),
+            "should preserve the original store instead of reconstructing it"
+        );
+        assert!(
+            timed
+                .lookup_key("shared-key")
+                .expect("should read timed store")
+                .is_some(),
+            "should preserve the timed graph's store"
+        );
+        let before_pause = timings.snapshot().kv_ms;
+        assert!(before_pause.is_some(), "should record store latency");
+        timed.pause(Duration::from_millis(7));
+        assert_eq!(
+            timings.snapshot().kv_ms,
+            before_pause,
+            "should not count rate-limit pauses as KV operation latency"
+        );
+        assert_eq!(
+            *calls.lock().expect("should lock store calls"),
+            vec!["insert", "lookup", "lookup", "pause"],
+            "should forward operations and the identity flush pause exactly once"
+        );
+    }
+
+    #[test]
+    fn ec_kv_store_operations_accumulate_into_ec_kv_phase() {
+        let timings = RequestTimings::new();
+        let store = TimedKvStore::new(InMemoryEcKv::new("test-store"), timings.clone());
+
+        store
+            .insert(
+                "key-a",
+                EcKvWrite {
+                    body: "{}",
+                    metadata: "{}",
+                    ttl: Duration::from_secs(60),
+                    mode: crate::ec::kv_backend::EcKvWriteMode::Add,
+                },
+            )
+            .expect("should insert into the in-memory store");
+        store.lookup("key-a").expect("should read back the entry");
+        assert!(store.key_exists("key-a").expect("should check key"));
+        assert_eq!(
+            store
+                .list_keys_with_prefix("key-", 10)
+                .expect("should list keys"),
+            vec!["key-a".to_string()]
+        );
+        assert_eq!(
+            store
+                .count_keys_with_prefix("key-", 10)
+                .expect("should count keys"),
+            1
+        );
+        store.delete("key-a").expect("should delete key");
+        assert!(!store.key_exists("key-a").expect("should check deletion"));
+
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().kv_ms.is_some(),
+            "should accumulate Phase::EcKv across lookup, key_exists, insert, list, count, and delete"
+        );
+    }
+
+    #[test]
+    fn every_store_operation_contributes_a_separate_timed_span() {
+        let calls = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+        let timings = RequestTimings::new();
+        let store = TimedKvStore::new(
+            DelayingCountingEcKv {
+                inner: InMemoryEcKv::new("test-store"),
+                calls: std::sync::Arc::clone(&calls),
+            },
+            timings.clone(),
+        );
+        let mut previous_ms = 0;
+        let mut assert_span_added = |operation: &str| {
+            let current_ms = timings
+                .snapshot()
+                .kv_ms
+                .expect("each store operation should record an EcKv span");
+            assert!(
+                current_ms > previous_ms,
+                "{operation} should add its own delayed span: previous={previous_ms}ms current={current_ms}ms"
+            );
+            previous_ms = current_ms;
+        };
+
+        store
+            .insert(
+                "key-a",
+                EcKvWrite {
+                    body: "{}",
+                    metadata: "{}",
+                    ttl: Duration::from_secs(60),
+                    mode: crate::ec::kv_backend::EcKvWriteMode::Add,
+                },
+            )
+            .expect("should insert into the delaying store");
+        assert_span_added("insert");
+        store.lookup("key-a").expect("should look up key");
+        assert_span_added("lookup");
+        store.key_exists("key-a").expect("should check key");
+        assert_span_added("key_exists");
+        store
+            .list_keys_with_prefix("key-", 10)
+            .expect("should list keys");
+        assert_span_added("list_keys_with_prefix");
+        store
+            .count_keys_with_prefix("key-", 10)
+            .expect("should count keys");
+        assert_span_added("count_keys_with_prefix");
+        store.delete("key-a").expect("should delete key");
+        assert_span_added("delete");
+
+        assert_eq!(
+            *calls.lock().expect("should lock KV operation calls"),
+            vec![
+                "insert",
+                "lookup",
+                "key_exists",
+                "list_keys_with_prefix",
+                "count_keys_with_prefix",
+                "delete",
+            ],
+            "the wrapper should forward every operation exactly once"
+        );
+    }
+
+    #[test]
+    fn store_name_is_not_timed() {
+        let timings = RequestTimings::new();
+        let store = TimedKvStore::new(InMemoryEcKv::new("test-store"), timings.clone());
+
+        assert_eq!(store.store_name(), "test-store");
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().kv_ms.is_none(),
+            "store_name is a metadata accessor, not a store operation"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/platform/types.rs b/crates/trusted-server-core/src/platform/types.rs
index 760dba0e52..6c81451a26 100644
--- a/crates/trusted-server-core/src/platform/types.rs
+++ b/crates/trusted-server-core/src/platform/types.rs
@@ -143,6 +143,10 @@ pub struct PlatformBackendSpec {
     pub first_byte_timeout: Duration,
     /// Maximum time to wait between response body bytes.
     pub between_bytes_timeout: Duration,
+    /// Maximum time to wait for the connection, or `None` for the adapter's
+    /// default (one second on Fastly). Only the Fastly adapter applies it;
+    /// the others have no per-backend connect timer.
+    pub connect_timeout: Option<Duration>,
     /// Optional stable discriminator folded into the backend name.
     ///
     /// Two callers can target the same origin (scheme, host, port, TLS) with
diff --git a/crates/trusted-server-core/src/proxy.rs b/crates/trusted-server-core/src/proxy.rs
index 54901ae412..01beff411e 100644
--- a/crates/trusted-server-core/src/proxy.rs
+++ b/crates/trusted-server-core/src/proxy.rs
@@ -1136,6 +1136,7 @@ pub async fn handle_asset_proxy_request(
             certificate_check: settings.proxy.certificate_check,
             first_byte_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
             between_bytes_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
+            connect_timeout: None,
             discriminator: None,
         })
         .change_context(TrustedServerError::Proxy {
@@ -1337,6 +1338,7 @@ async fn proxy_with_redirects(
                 certificate_check: settings.proxy.certificate_check,
                 first_byte_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
                 between_bytes_timeout: DEFAULT_FIRST_BYTE_TIMEOUT,
+                connect_timeout: None,
                 discriminator: None,
             })
             .change_context(TrustedServerError::Proxy {
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index a670d31416..0ddb4a7459 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -41,7 +41,7 @@ use sha2::Digest as _;
 use web_time::Instant;
 
 use crate::auction::endpoints::{
-    merge_auction_eids, resolve_auction_eids, resolve_client_auction_eids,
+    AuctionIdentity, auction_identity, mirror_enabled, mirror_member, resolve_client_auction_eids,
 };
 use crate::auction::formats::sanitize_publisher_page_url;
 use crate::auction::orchestrator::{
@@ -61,13 +61,19 @@ use crate::cache_policy::{
     CachePolicy, EdgeCacheHeader, cache_control_headers_are_private_or_no_store,
 };
 use crate::consent::{consent_allows_server_side_auction, gate_eids_by_consent};
-use crate::constants::{COOKIE_SHAREDID, COOKIE_TS_EIDS, HEADER_X_COMPRESS_HINT};
-use crate::cookies::handle_request_cookies;
+use crate::constants::{COOKIE_TS_EIDS, HEADER_X_COMPRESS_HINT};
 use crate::cookies::template_cache_policy::{TemplateCookieDecision, evaluate_cookie_policy};
+use crate::cookies::{
+    TS_ORIGIN_STRIPPED_COOKIE_NAMES, TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS,
+    handle_request_cookies, strip_cookie_headers,
+};
 use crate::creative_opportunities::{
     AdStackGateInput, AssemblyMode, CreativeOpportunitiesConfig, RuntimeAdStackExpected,
     evaluate_ad_stack_gate,
 };
+use crate::ec::identity::coordinator::{HoldResults, hold_before_auction};
+use crate::ec::identity::mirror::MirrorPayload;
+use crate::ec::identity::policy::PolicySignals;
 use crate::ec::kv::KvIdentityGraph;
 use crate::ec::registry::PartnerRegistry;
 use crate::ec::{EcContext, EidSyncSource};
@@ -75,7 +81,9 @@ use crate::error::TrustedServerError;
 use crate::html_processor::{
     BodyCloseInjection, HtmlProcessorConfig, create_html_processor_with_document_state,
 };
-use crate::http_util::{RequestInfo, is_navigation_request, serve_static_with_etag};
+use crate::http_util::{
+    RequestInfo, is_navigation_request, is_prefetch_request, serve_static_with_etag,
+};
 use crate::integrations::{IntegrationDocumentState, IntegrationRegistry};
 use crate::platform::{
     ClientInfo, GeoInfo, PlatformBackendSpec, PlatformHttpRequest, RuntimeServices,
@@ -83,6 +91,7 @@ use crate::platform::{
     reader_url_surrogate_key,
 };
 use crate::price_bucket::{PriceGranularity, price_bucket};
+use crate::request_timing::{AuctionWaitPlacement, Phase, RequestTimings};
 use crate::response_header_rewrite::{OriginHeaderRewrite, rewrite_origin_urls_in_headers};
 use crate::response_privacy::{
     apply_inactive_ad_stack_browser_cache_policy, cache_control_forbids_shared_storage,
@@ -111,21 +120,44 @@ const DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT: Duration = Duration::from_secs(15);
 const HEADER_X_TS_TEMPLATE_CACHE: &str = "x-ts-template-cache";
 const HEADER_X_TS_ASSEMBLY: &str = "x-ts-assembly";
 
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum TemplateCacheResponseState {
+/// Outcome of a template-cache lookup/store attempt for one response.
+///
+/// Set on every response that passes through the assembly pipeline via
+/// [`set_template_cache_response_state`], which writes both the
+/// `x-ts-template-cache` response header and this same value as a typed
+/// response extension, so the two can never drift. Access telemetry reads
+/// the extension rather than the header, since operator-configured response
+/// headers can override a managed header but cannot touch extensions.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TemplateCacheResponseState {
+    /// The cached template was found and reused.
     Hit,
+    /// No cached template existed; the cache store is reserved for this
+    /// content type.
     MissReserved,
+    /// No cached template existed; one was stored after assembly.
     MissStored,
+    /// No cached template existed; storing the freshly assembled template
+    /// failed.
     MissStoreError,
+    /// The request bypassed the cache lookup.
     BypassRequest,
+    /// The response bypassed the cache store.
     BypassResponse,
+    /// The response's content type is not supported by the template cache.
     Unsupported,
+    /// The cached template entry was invalid and could not be reused.
     Invalid,
+    /// A backend error prevented the cache lookup or store.
     BackendError,
 }
 
 impl TemplateCacheResponseState {
-    const fn as_str(self) -> &'static str {
+    /// Renders this variant as the string written to the
+    /// `x-ts-template-cache` header and the `template_cache_state` access
+    /// telemetry column.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
         match self {
             Self::Hit => "hit",
             Self::MissReserved => "miss-reserved",
@@ -148,6 +180,7 @@ fn set_template_cache_response_state(
         HEADER_X_TS_TEMPLATE_CACHE,
         HeaderValue::from_static(state.as_str()),
     );
+    response.extensions_mut().insert(state);
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -1796,6 +1829,12 @@ pub struct OwnedProcessResponseParams {
     /// rescanned from the output, which cannot tell a `nonce` attribute from the same
     /// word inside a script.
     pub(crate) csp_nonce_observed: Option<Arc<AtomicBool>>,
+    /// Per-request phase-timing handle, carried into the streaming/buffered
+    /// finalizers so the `</body>` seam wait can be recorded with the right
+    /// [`AuctionWaitPlacement`]. Cheap to clone (an `Arc` handle); a request that
+    /// never attached one to its extensions gets a fresh, unattached collector
+    /// that nothing ever renders.
+    pub(crate) timings: RequestTimings,
 }
 
 impl OwnedProcessResponseParams {
@@ -2068,6 +2107,8 @@ pub async fn buffer_publisher_response_async(
                             &params.request_scheme,
                             &params.request_host,
                         ),
+                        timings: params.timings.clone(),
+                        placement: AuctionWaitPlacement::PreHeader,
                     },
                 )
                 .await;
@@ -2234,6 +2275,7 @@ fn build_template_assembly_params(
     request_scheme: &str,
     price_granularity: PriceGranularity,
     ad_bids_state: AdBidsState,
+    timings: RequestTimings,
 ) -> OwnedProcessResponseParams {
     OwnedProcessResponseParams {
         response_status: StatusCode::OK,
@@ -2259,6 +2301,7 @@ fn build_template_assembly_params(
         gpt_diagnostics: None,
         trace_bootstrap: None,
         suppress_datadome_client_side_tag: false,
+        timings,
     }
 }
 
@@ -2611,6 +2654,8 @@ pub async fn publisher_response_into_streaming_response(
                                 &params.request_scheme,
                                 &params.request_host,
                             ),
+                            timings: params.timings.clone(),
+                            placement: AuctionWaitPlacement::InStream,
                         },
                     )
                     .await;
@@ -2710,6 +2755,8 @@ pub async fn publisher_response_into_streaming_response(
                             &params.request_scheme,
                             &params.request_host,
                         ),
+                        timings: params.timings.clone(),
+                        placement: AuctionWaitPlacement::InStream,
                     };
                     while let Some(step) = driver
                         .next_step(&deps)
@@ -2786,6 +2833,7 @@ pub async fn publisher_response_into_streaming_response(
                             &orchestrator,
                             &services,
                             &settings,
+                            AuctionWaitPlacement::InStream,
                         )
                         .await;
                         // Collection reached a terminal result; disarm only now
@@ -2811,6 +2859,8 @@ pub async fn publisher_response_into_streaming_response(
                             &params.request_scheme,
                             &params.request_host,
                         ),
+                        timings: params.timings.clone(),
+                        placement: AuctionWaitPlacement::InStream,
                     };
 
                     while let Some(step) = hold_step_next_chunk(
@@ -3186,6 +3236,8 @@ async fn stream_html_eof<W: Write>(
         services,
         settings,
         request_origin: request_origin(&params.request_scheme, &params.request_host),
+        timings: params.timings.clone(),
+        placement: AuctionWaitPlacement::PreHeader,
     };
     while let Some(step) = driver.next_step(&deps).await? {
         for segment in step.ready {
@@ -3321,6 +3373,7 @@ pub async fn stream_publisher_body_async<W: Write>(
             orchestrator,
             services,
             settings,
+            AuctionWaitPlacement::PreHeader,
         )
         .await;
         if body.is_stream() {
@@ -3396,6 +3449,8 @@ pub async fn stream_publisher_body_async<W: Write>(
                 services,
                 settings,
                 request_origin: request_origin(&params.request_scheme, &params.request_host),
+                timings: params.timings.clone(),
+                placement: AuctionWaitPlacement::PreHeader,
             },
         },
     )
@@ -3450,30 +3505,29 @@ struct EcSnapshotPreloadInput {
     is_get: bool,
     has_ec_id: bool,
     has_kv: bool,
-    marker_valid: bool,
+    /// A returning EC's writer navigation: phase 1 reads the row on every
+    /// one (spec 5.2, 6.3).
+    returning_writer: bool,
     auction_needs_row: bool,
-    eid_cookie_may_need_persistence: bool,
     privacy_needs_row: bool,
 }
 
 fn should_preload_ec_snapshot(input: &EcSnapshotPreloadInput) -> bool {
     let eligible = input.is_navigation && input.is_get && input.has_ec_id && input.has_kv;
-    let marker_can_skip = input.marker_valid
-        && !input.auction_needs_row
-        && !input.eid_cookie_may_need_persistence
-        && !input.privacy_needs_row;
-    eligible && !marker_can_skip
+    eligible && (input.returning_writer || input.auction_needs_row || input.privacy_needs_row)
 }
 
 /// Rewrites a downstream request into an outbound publisher-origin request.
 ///
 /// Restricts advertised encodings to those the rewrite pipeline can handle,
 /// strips the internal `fastly-ssl` scheme signal so it never leaks to the
-/// backend, and retargets the URI and `Host` header at the origin.
+/// backend, strips the `ts-eids-s` mirror (and `ts-eids` too when
+/// `strip_eids`), and retargets the URI and `Host` header at the origin.
 fn rewrite_origin_request(
     req: &mut Request<EdgeBody>,
     target_uri: Uri,
     origin_host_header: &str,
+    strip_eids: bool,
 ) -> Result<(), Report<TrustedServerError>> {
     restrict_accept_encoding(req);
     // Layering wart: `fastly-ssl` is a vendor-specific header name. Core only
@@ -3485,6 +3539,15 @@ fn rewrite_origin_request(
     // separate change. Until then we strip it here so the edge signal never
     // reaches publisher backends.
     req.headers_mut().remove("fastly-ssl");
+    // The publisher origin keeps `ts-ec`, and `ts-eids` unless the operator
+    // strips it too. It never receives the mirror, which would push its
+    // `Cookie` header past its size before this spec (spec 6.2).
+    let stripped = if strip_eids {
+        TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS
+    } else {
+        TS_ORIGIN_STRIPPED_COOKIE_NAMES
+    };
+    strip_cookie_headers(req.headers_mut(), stripped);
     *req.uri_mut() = target_uri;
     req.headers_mut().insert(
         header::HOST,
@@ -3544,18 +3607,6 @@ pub(crate) fn is_bot_user_agent(req: &Request<EdgeBody>) -> bool {
         .any(|frag| ua.contains(frag))
 }
 
-/// Returns true when the request advertises itself as a prefetch via either
-/// the standard `Sec-Purpose` or the legacy `Purpose` header.
-pub(crate) fn is_prefetch_request(req: &Request<EdgeBody>) -> bool {
-    let header = |name: &str| {
-        req.headers()
-            .get(name)
-            .and_then(|v| v.to_str().ok())
-            .is_some_and(|v| v.contains("prefetch"))
-    };
-    header("sec-purpose") || header("purpose")
-}
-
 /// Returns whether request-scoped signals permit an ad-eligible navigation.
 ///
 /// This is the request half of the shared ad-stack gate: the configuration
@@ -3585,6 +3636,47 @@ fn request_origin(scheme: &str, host: &str) -> String {
     }
 }
 
+/// Request-clock auction facts exposed only to an active browser diagnostics session.
+#[derive(Clone, Debug, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+struct BrowserAuctionDiagnostics {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_dispatched_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_resolved_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_committed_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_wait_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_wait_placement: Option<&'static str>,
+}
+
+const fn auction_wait_placement_wire(placement: AuctionWaitPlacement) -> &'static str {
+    match placement {
+        AuctionWaitPlacement::PreHeader => "pre_header",
+        AuctionWaitPlacement::InStream => "in_stream",
+    }
+}
+
+impl BrowserAuctionDiagnostics {
+    fn from_request_timings(timings: &RequestTimings) -> Option<Self> {
+        let snapshot = timings.snapshot();
+        if snapshot.auction_dispatched_ms.is_none() && snapshot.auction_wait_ms.is_none() {
+            return None;
+        }
+        Some(Self {
+            auction_dispatched_ms: snapshot.auction_dispatched_ms,
+            auction_resolved_ms: snapshot.auction_resolved_ms,
+            auction_committed_ms: snapshot.auction_committed_ms,
+            auction_wait_ms: snapshot.auction_wait_ms,
+            auction_wait_placement: snapshot
+                .auction_wait_placement
+                .map(auction_wait_placement_wire),
+        })
+    }
+}
+
 /// This request's auction result, in both forms the seams need.
 ///
 /// The inline `</body>` seam injects a rendered `<script>`; the shared-template seam
@@ -3613,6 +3705,12 @@ pub(crate) struct AdBidsState {
     trace: Option<TraceAuctionCarry>,
     /// Withheld ad-slot injection permits only trace observation at the body seam.
     trace_only: bool,
+    /// Server auction facts handed to the generation-guarded client scheduler.
+    auction_diagnostics: Arc<Mutex<Option<BrowserAuctionDiagnostics>>>,
+    /// Whether this request activated the private diagnostics module.
+    diagnostics_active: bool,
+    /// Whether the request arrived with an adapter-owned timing collector.
+    request_timing_collector_attached: bool,
 }
 
 #[cfg(test)]
@@ -3627,6 +3725,14 @@ impl AdBidsState {
 }
 
 impl AdBidsState {
+    fn with_diagnostics(diagnostics_active: bool, request_timing_collector_attached: bool) -> Self {
+        Self {
+            diagnostics_active,
+            request_timing_collector_attached,
+            ..Self::default()
+        }
+    }
+
     /// The cell the HTML processor reads at the `</body>` seam.
     pub(crate) fn script_cell(&self) -> &Arc<Mutex<Option<String>>> {
         &self.script
@@ -3635,15 +3741,38 @@ impl AdBidsState {
     /// Record one auction result, rendering the script from the same map that is
     /// stored, so the two representations cannot drift.
     fn set(&self, bid_map: serde_json::Map<String, serde_json::Value>) {
+        let auction_diagnostics = self
+            .auction_diagnostics
+            .lock()
+            .expect("should lock auction diagnostics")
+            .clone();
         let bids_script = if self.trace_only {
             build_trace_only_script(self.trace())
         } else {
-            build_bids_script_with_trace(&bid_map, self.trace())
+            build_bids_script_with_context(&bid_map, self.trace(), auction_diagnostics.as_ref())
         };
         *self.script.lock().expect("should lock bid script") = Some(bids_script);
         *self.bids.lock().expect("should lock bid map") = bid_map;
     }
 
+    /// Attach server auction facts to the rendered bid script.
+    ///
+    /// This rebuilds the script cell, so callers must run it before
+    /// [`Self::prepend_to_script`] to preserve an existing debug prefix.
+    fn set_auction_diagnostics(&self, timings: &RequestTimings) {
+        if !self.diagnostics_active || !self.request_timing_collector_attached {
+            return;
+        }
+        let Some(diagnostics) = BrowserAuctionDiagnostics::from_request_timings(timings) else {
+            return;
+        };
+        *self
+            .auction_diagnostics
+            .lock()
+            .expect("should lock auction diagnostics") = Some(diagnostics);
+        self.set(self.bids());
+    }
+
     /// The structured bids the shared-template seam splices into the marker.
     ///
     /// Empty when no auction has been collected, which is the same payload the inline
@@ -3668,10 +3797,17 @@ impl AdBidsState {
 
     /// Build the shared-template seam, retaining the same debug prefix as inline.
     fn build_seam_script(&self, slots_json: &str) -> String {
-        let seam = match self.trace() {
-            Some(trace) => build_seam_script_with_trace(slots_json, &self.bids(), Some(trace)),
-            None => build_seam_script(slots_json, &self.bids()),
-        };
+        let auction_diagnostics = self
+            .auction_diagnostics
+            .lock()
+            .expect("should lock auction diagnostics")
+            .clone();
+        let seam = build_seam_script_with_context(
+            slots_json,
+            &self.bids(),
+            self.trace(),
+            auction_diagnostics.as_ref(),
+        );
         let prefix = self
             .debug_prefix
             .lock()
@@ -4045,6 +4181,12 @@ struct AuctionCollectDeps<'a> {
     settings: &'a Settings,
     /// Trusted request origin (`scheme://host`) for absolute inline creative URLs.
     request_origin: String,
+    /// Phase-timing handle the collect step records the auction wait into.
+    timings: RequestTimings,
+    /// Where this collect call sits relative to response headers: streaming
+    /// callers await inside the body already handed to the client, buffered
+    /// callers await before anything has been sent.
+    placement: AuctionWaitPlacement,
 }
 
 /// Run the inline seam loop for HTML bodies, collecting the auction after the
@@ -4636,6 +4778,11 @@ async fn emit_abandoned_auction(
 /// Collect a dispatched auction before a non-HTML body streams: there is no
 /// `</body>` to inject into, so bids are written to state up front and the
 /// auction telemetry completes immediately.
+///
+/// `placement` records where this wait sits relative to response headers — the
+/// caller decides, since this collector runs from both the buffered finalizer
+/// (headers not yet committed) and the true streaming path (headers already
+/// sent, this body only just started being polled).
 async fn collect_non_html_auction(
     dispatched: DispatchedAuction,
     telemetry: AuctionTelemetryCarry,
@@ -4643,8 +4790,9 @@ async fn collect_non_html_auction(
     orchestrator: &AuctionOrchestrator,
     services: &RuntimeServices,
     settings: &Settings,
+    placement: AuctionWaitPlacement,
 ) {
-    let auction_id = params
+    let diagnostics_request_id = params
         .ad_bids_state
         .trace()
         .map(|trace| trace.token().to_string())
@@ -4656,13 +4804,16 @@ async fn collect_non_html_auction(
         });
     let placeholder = mediator_placeholder_request();
     // Auction collection nests deadline and trace futures. Keep its future off
-    // the WASI call stack.
-    let result = Box::pin(orchestrator.collect_dispatched_auction(
-        dispatched,
-        services,
-        &make_collect_context(settings, services, &placeholder),
-    ))
-    .await;
+    // the WASI call stack, including the measured collection wrapper.
+    let (result, auction_work_started) =
+        Box::pin(orchestrator.collect_dispatched_auction_with_timings(
+            dispatched,
+            services,
+            &make_collect_context(settings, services, &placeholder),
+            &params.timings,
+            placement,
+        ))
+        .await;
     let delivered_winner_slots = write_bids_to_state(
         &result.winning_bids,
         params.price_granularity,
@@ -4670,8 +4821,16 @@ async fn collect_non_html_auction(
         settings,
         &request_origin(&params.request_scheme, &params.request_host),
         settings.debug.inject_adm_for_testing,
-        auction_id.as_deref(),
+        diagnostics_request_id.as_deref(),
     );
+    // T0-anchored timeline mark (spec section 18): winning bids are in page
+    // state, available to the response pipeline.
+    if auction_work_started {
+        params.timings.mark_auction_committed();
+    }
+    params
+        .ad_bids_state
+        .set_auction_diagnostics(&params.timings);
     if let (Some(observation), Some(auction_request)) =
         (telemetry.observation, telemetry.auction_request.as_ref())
     {
@@ -4704,8 +4863,10 @@ async fn collect_stream_auction(
         services,
         settings,
         request_origin,
+        timings,
+        placement,
     } = deps;
-    let auction_id = ad_bids_state
+    let diagnostics_request_id = ad_bids_state
         .trace()
         .map(|trace| trace.token().to_string())
         .or_else(|| {
@@ -4718,9 +4879,16 @@ async fn collect_stream_auction(
     let placeholder = mediator_placeholder_request();
     let collect_ctx = make_collect_context(settings, services, &placeholder);
     // Auction collection nests deadline and trace futures. Keep its future off
-    // the WASI call stack.
-    let result =
-        Box::pin(orchestrator.collect_dispatched_auction(dispatched, services, &collect_ctx)).await;
+    // the WASI call stack, including the measured collection wrapper.
+    let (result, auction_work_started) =
+        Box::pin(orchestrator.collect_dispatched_auction_with_timings(
+            dispatched,
+            services,
+            &collect_ctx,
+            timings,
+            *placement,
+        ))
+        .await;
     log::info!(
         "body_close_hold_loop: collect complete - {} winning bid(s)",
         result.winning_bids.len()
@@ -4732,8 +4900,14 @@ async fn collect_stream_auction(
         settings,
         request_origin,
         settings.debug.inject_adm_for_testing,
-        auction_id.as_deref(),
+        diagnostics_request_id.as_deref(),
     );
+    // T0-anchored timeline mark (spec section 18): winning bids are in page
+    // state, available to the response pipeline.
+    if auction_work_started {
+        timings.mark_auction_committed();
+    }
+    ad_bids_state.set_auction_diagnostics(timings);
     if let (Some(observation), Some(auction_request)) =
         (telemetry.observation, telemetry.auction_request.as_ref())
     {
@@ -4906,6 +5080,12 @@ pub async fn handle_publisher_request(
     log::debug!("Proxying request to publisher_origin");
     let async_html_finish_present = auction.integration_registry.has_async_html_finish();
 
+    // A defaulted handle records into nothing that ever renders, so tests
+    // that don't populate the request extension are unaffected.
+    let request_timings = RequestTimings::from_extensions(req.extensions());
+    let request_timing_collector_attached = request_timings.is_some();
+    let timings = request_timings.unwrap_or_default();
+
     // Adapter fallbacks prepare this before EC/cookie handling. Keep this
     // idempotent call as a direct-handler safety net and for focused tests.
     let gpt_diagnostics =
@@ -4961,9 +5141,6 @@ pub async fn handle_publisher_request(
     let ec_id_owned = active_ec_id_owned.clone().filter(|_| ec_allowed);
     let ec_id = ec_id_owned.as_deref();
     let cookie_jar = handle_request_cookies(&req)?;
-    if let Some(registry) = auction.registry {
-        ec_context.validate_pull_sync_marker(settings, registry);
-    }
     let geo = ec_context.geo_info().cloned();
 
     let parsed_origin = url::Url::parse(&settings.publisher.origin_url).change_context(
@@ -4987,6 +5164,7 @@ pub async fn handle_publisher_request(
             certificate_check: settings.proxy.certificate_check,
             first_byte_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
             between_bytes_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
+            connect_timeout: None,
             discriminator: None,
         })
         .change_context(TrustedServerError::Proxy {
@@ -5071,7 +5249,8 @@ pub async fn handle_publisher_request(
         .and_then(|co| co.auction_timeout_ms)
         .unwrap_or(settings.auction.timeout_ms);
 
-    let mut ad_bids_state = AdBidsState::default();
+    let mut ad_bids_state =
+        AdBidsState::with_diagnostics(gpt_diagnostics.active(), request_timing_collector_attached);
 
     let price_granularity = settings
         .creative_opportunities
@@ -5284,28 +5463,28 @@ pub async fn handle_publisher_request(
         });
     let mut template_cache_response_state = matches!(assembly_mode, AssemblyMode::Esi)
         .then_some(TemplateCacheResponseState::BypassRequest);
-    rewrite_origin_request(&mut req, target_uri, &origin_host_header)?;
+    rewrite_origin_request(
+        &mut req,
+        target_uri,
+        &origin_host_header,
+        settings.ec.strip_eids_cookie_from_origin,
+    )?;
 
     let request_method = req.method().clone();
     let mut origin_request = Some(req);
-    let eid_cookie_may_need_persistence = cookie_jar
-        .as_ref()
-        .is_some_and(|jar| jar.get(COOKIE_TS_EIDS).is_some() || jar.get(COOKIE_SHAREDID).is_some());
-    // This decision also gates the concurrent origin send below. A marker skip
-    // cannot currently delay the origin behind an auction because marker
-    // validation requires a non-empty registry, and every such auction sets
-    // `auction_needs_row` and retains the preload.
+    // This decision also gates the concurrent origin send below.
     let should_preload_ec = should_preload_ec_snapshot(&EcSnapshotPreloadInput {
         is_navigation,
         is_get,
         has_ec_id: active_ec_id.is_some(),
         has_kv: kv.is_some(),
-        marker_valid: ec_context.pull_sync_marker().is_valid(),
+        returning_writer: ec_context.identity().writer()
+            && ec_context.ec_was_present()
+            && !ec_context.ec_generated(),
         auction_needs_row: should_run_auction
             && auction
                 .registry
                 .is_some_and(|registry| !registry.is_empty()),
-        eid_cookie_may_need_persistence,
         privacy_needs_row: crate::ec::consent::ec_consent_withdrawn(&consent_context),
     });
     let mut pending_origin = None;
@@ -5348,6 +5527,18 @@ pub async fn handle_publisher_request(
                 })?,
         );
     }
+    // A new visitor's row is created now, after the hold-mode providers its
+    // auction waits for, so their answers ride the one create (spec 4.7).
+    let mut new_visitor_hold = None;
+    if ec_context.has_deferred_create() {
+        if should_run_auction && !matched_slots.is_empty() {
+            ec_context.identity_mut().set_runs_auction(true);
+            new_visitor_hold = hold_before_auction(settings, services, ec_context).await;
+        }
+        if let Err(err) = ec_context.complete_deferred_create(settings, kv) {
+            log::warn!("EC generation failed for publisher proxy: {err:?}");
+        }
+    }
     if should_preload_ec && let (Some(graph), Some(active_ec_id)) = (kv, active_ec_id) {
         let refreshed = graph.load_snapshot(active_ec_id);
         // Never downgrade an in-request Add-confirmed Present snapshot: a
@@ -5427,8 +5618,21 @@ pub async fn handle_publisher_request(
         // Written on the value, before it is moved into `auction_observation` below. Sites
         // after that move reach it through `auction_observation.as_mut()` instead.
         observation.set_origin_cache_shareable(origin_response_is_shareable && request_is_document);
+        // Disabled auctions are unattempted and keep a null access join key;
+        // enabled auctions stamp the ID before dispatch so failed/skipped rows
+        // remain joinable to their summary event.
+        if auction.orchestrator.is_enabled() {
+            timings.set_auction_id(observation.auction_id);
+        }
 
         if should_run_auction {
+            // This navigation runs an auction: hold-mode providers run now,
+            // within their budget, and phase 4 leaves them alone (spec 4.7).
+            ec_context.identity_mut().set_runs_auction(true);
+            let hold = match new_visitor_hold.take() {
+                Some(hold) => Some(hold),
+                None => hold_before_auction(settings, services, ec_context).await,
+            };
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
                 request_path: &request_path,
@@ -5451,8 +5655,10 @@ pub async fn handle_publisher_request(
                     kv_snapshot: ec_context.kv_snapshot(),
                     partner_registry: auction.registry,
                     ec_context,
+                    signals: PolicySignals::from_headers(auction_client_request.headers()),
                     services,
                     geo: geo.as_ref(),
+                    hold: hold.as_ref(),
                     path_label: "Server-side",
                 },
             );
@@ -5470,17 +5676,26 @@ pub async fn handle_publisher_request(
                 .await
             {
                 DispatchAuctionOutcome::Dispatched(dispatched) => {
+                    // The outcome can also carry skipped-provider diagnostics;
+                    // only a started provider request establishes dispatch.
+                    if dispatched.has_provider_launch() {
+                        timings.mark_auction_dispatched();
+                    }
                     auction_request_for_telemetry = Some(auction_request);
                     auction_observation = Some(observation);
                     Some(dispatched)
                 }
                 DispatchAuctionOutcome::DispatchFailed {
+                    provider_launched,
                     request,
                     provider_responses,
                     fatal_admission_error,
                     metadata,
                     elapsed_ms,
                 } => {
+                    if provider_launched {
+                        timings.mark_auction_dispatched();
+                    }
                     if let Some(error) = fatal_admission_error {
                         log::warn!(
                             "Auction admission failed before publisher dispatch; continuing without bids: {error:?}"
@@ -5585,7 +5800,10 @@ pub async fn handle_publisher_request(
     // not be served a shared template even if that template is perfectly cacheable.
     let mut template_cache_reservation = None;
     if let Some(key) = template_cache_key.as_ref() {
-        match services.template_cache().lookup_or_reserve(key).await {
+        let template_cache_span = timings.span(Phase::TemplateCacheLookup);
+        let template_cache_lookup = services.template_cache().lookup_or_reserve(key).await;
+        drop(template_cache_span);
+        match template_cache_lookup {
             Ok(crate::platform::TemplateCacheLookup::Hit(entry)) => {
                 log::debug!("template_cache hit: {} bytes", entry.body.len());
 
@@ -5635,6 +5853,7 @@ pub async fn handle_publisher_request(
                         request_scheme,
                         price_granularity,
                         ad_bids_state.clone(),
+                        timings.clone(),
                     );
                     params.seam_ad_slots = seam_ad_slots.clone();
                     params.dispatched_auction = dispatched_auction.take();
@@ -5672,6 +5891,13 @@ pub async fn handle_publisher_request(
 
     // Provider operations are already running while the origin loads. Collection
     // retains buffered results, then waits only for the original remaining budget.
+    //
+    // The span must end when the origin responds (or fails), before any
+    // abandonment-telemetry await below — otherwise `ts-origin` would
+    // absorb Tinybird emission time on the error path. When the origin
+    // fetch was dispatched early (`pending_origin`), the span covers the
+    // remaining wait for its response headers rather than the full fetch.
+    let origin_span = timings.span(Phase::Origin);
     let origin_result = if let Some(pending) = pending_origin {
         services.http_client().wait(pending).await
     } else {
@@ -5680,6 +5906,11 @@ pub async fn handle_publisher_request(
                 message: "publisher origin request was already consumed".to_owned(),
             })
         })?;
+        // Streaming is gated on the capability (unlike the asset-proxy
+        // path, which sets the flag unconditionally and tolerates buffered
+        // fallback): adapters without streaming support may reject the
+        // flag outright rather than silently buffering, which would fail
+        // every publisher fetch.
         let mut platform_request = PlatformHttpRequest::new(origin_req, backend_name);
         if services.http_client().supports_streaming_responses() {
             platform_request = platform_request.with_stream_response();
@@ -5696,6 +5927,7 @@ pub async fn handle_publisher_request(
         );
         services.http_client().send(platform_request).await
     };
+    drop(origin_span);
     let mut response = match origin_result {
         Ok(platform_response) => platform_response.response,
         Err(err) => {
@@ -6097,6 +6329,7 @@ pub async fn handle_publisher_request(
                     price_granularity,
                     gpt_diagnostics: Some(gpt_diagnostics),
                     trace_bootstrap,
+                    timings: timings.clone(),
                 }),
             })
         }
@@ -6121,8 +6354,14 @@ struct AuctionEidTargeting<'a> {
     kv_snapshot: &'a crate::ec::EcKvSnapshot,
     partner_registry: Option<&'a PartnerRegistry>,
     ec_context: &'a EcContext,
+    /// Policy signals the consent context does not carry, read from the
+    /// request's headers.
+    signals: PolicySignals,
     services: &'a RuntimeServices,
     geo: Option<&'a GeoInfo>,
+    /// What the hold dispatch before this auction learned, on a writer
+    /// navigation that dispatched one. Page-bids and the tests pass `None`.
+    hold: Option<&'a HoldResults>,
     /// Prefix for the consent-stripped warning (e.g. `"Server-side"`).
     path_label: &'a str,
 }
@@ -6132,11 +6371,12 @@ struct AuctionEidTargeting<'a> {
 ///
 /// Shared verbatim by the initial-page and page-bids dispatch paths so the EID
 /// resolution and consent gating live in one place; `path_label` only varies
-/// the consent-stripped warning message.
+/// the consent-stripped warning message. Returns the request's
+/// [`AuctionIdentity`], so the page-bids mirror reads the same server set.
 fn apply_auction_eids_and_device(
     auction_request: &mut AuctionRequest,
     targeting: &AuctionEidTargeting<'_>,
-) {
+) -> AuctionIdentity {
     let ts_eids_value = targeting
         .cookie_jar
         .and_then(|j| j.get(COOKIE_TS_EIDS))
@@ -6146,12 +6386,20 @@ fn apply_auction_eids_and_device(
     } else {
         None
     };
-    let kv_eids = resolve_auction_eids(
+    let mut identity = auction_identity(
         targeting.kv_snapshot,
         targeting.partner_registry,
         targeting.ec_context,
+        targeting.signals,
     );
-    let merged_eids = merge_auction_eids(client_eids, kv_eids);
+    if let (Some(hold), Some(registry), Some(runtime)) = (
+        targeting.hold,
+        targeting.partner_registry,
+        targeting.ec_context.identity_runtime(),
+    ) {
+        identity.add_hold_results(hold.clone(), registry, runtime.catalog());
+    }
+    let merged_eids = identity.merge(client_eids.as_deref());
     let had_eids = merged_eids.as_ref().is_some_and(|v| !v.is_empty());
     auction_request.user.eids =
         gate_eids_by_consent(merged_eids, auction_request.user.consent.as_ref());
@@ -6175,6 +6423,7 @@ fn apply_auction_eids_and_device(
         device.ip = client_ip;
         device.geo = targeting.geo.cloned();
     }
+    identity
 }
 
 /// Build an [`AuctionRequest`] from matched creative opportunity slots.
@@ -6581,24 +6830,20 @@ pub(crate) fn build_bid_map_with_auction_id(
 /// The JSON is embedded via `JSON.parse(…)` so the browser parser never sees
 /// raw `</script>` sequences inside the string.
 pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Value>) -> String {
-    build_bids_script_with_trace(bid_map, None)
+    build_bids_script_with_context(bid_map, None, None)
 }
 
-fn build_bids_script_with_trace(
+fn build_bids_script_with_context(
     bid_map: &serde_json::Map<String, serde_json::Value>,
     trace: Option<&TraceAuctionCarry>,
+    auction_diagnostics: Option<&BrowserAuctionDiagnostics>,
 ) -> String {
-    let json = serde_json::to_string(bid_map)
-        .expect("serde_json::to_string of Map<String,Value> should be infallible");
+    let json = serde_json::to_string(bid_map).expect("should serialize the bids map");
     let escaped = html_escape_for_script(&json);
     let transport = trace_transport_script(trace);
-    let (transport_script, scheduler_arguments) =
-        transport.as_ref().map_or((String::new(), "b"), |json| {
-            (
-                format!("var x=JSON.parse(\"{}\");", html_escape_for_script(json)),
-                "b,undefined,x",
-            )
-        });
+    let transport_script = transport.as_ref().map_or_else(String::new, |json| {
+        format!("var x=JSON.parse(\"{}\");", html_escape_for_script(json))
+    });
     // adInit() defines GPT slots on the publisher's `-container` wrappers, which
     // mutates those ad-slot subtrees. Calling it synchronously here (this script
     // runs at body-parse time) lands those mutations inside React's hydration
@@ -6630,16 +6875,34 @@ fn build_bids_script_with_trace(
     // payload. Only when no scheduler exists at all (GPT integration active
     // without its head bootstrap — not an expected deployment) does the script
     // fall back to a plain assignment, where no SPA hook exists to race with.
+    let diagnostics_script = auction_diagnostics.map_or_else(String::new, |diagnostics| {
+        let json =
+            serde_json::to_string(diagnostics).expect("should serialize BrowserAuctionDiagnostics");
+        format!("var d=JSON.parse(\"{}\");", html_escape_for_script(&json))
+    });
+    // Keep trace in main's third scheduler argument. Timing diagnostics travel
+    // independently in the fourth argument behind the same generation guard.
+    let scheduler_arguments = match (transport.is_some(), auction_diagnostics.is_some()) {
+        (false, false) => "b",
+        (true, false) => "b,undefined,x",
+        (false, true) => "b,void 0,void 0,d",
+        (true, true) => "b,void 0,x,d",
+    };
+    let fallback = if auction_diagnostics.is_some() {
+        "else{t.bids=b;t.auctionDiagnostics=d;}"
+    } else {
+        "else t.bids=b;"
+    };
     format!(
         "<script>(function(){{\
 var t=window.tsjs=window.tsjs||{{}};\
 var b=JSON.parse(\"{}\");\
-{}\
+{}{}\
 var s=t.scheduleInitialAdInit;\
 if(typeof s===\"function\")s({});\
-else t.bids=b;\
+{}\
 }})();</script>",
-        escaped, transport_script, scheduler_arguments
+        escaped, transport_script, diagnostics_script, scheduler_arguments, fallback
     )
 }
 
@@ -6662,11 +6925,12 @@ else t.bids=b;\
 ///
 /// Slots are applied before bids inside the scheduler, because the scheduler may fire
 /// `adInit` and `adInit` reads `ts.adSlots`.
+#[cfg(test)]
 pub(crate) fn build_seam_script(
     slots_json: &str,
     bid_map: &serde_json::Map<String, serde_json::Value>,
 ) -> String {
-    build_seam_script_with_trace(slots_json, bid_map, None)
+    build_seam_script_with_context(slots_json, bid_map, None, None)
 }
 
 fn trace_transport_script(trace: Option<&TraceAuctionCarry>) -> Option<String> {
@@ -6707,38 +6971,52 @@ fn trace_serialization_unavailable() -> serde_json::Value {
     serde_json::json!({"schema_version":1,"unavailable_reason":"evidence_projection_failed"})
 }
 
-fn build_seam_script_with_trace(
+fn build_seam_script_with_context(
     slots_json: &str,
     bid_map: &serde_json::Map<String, serde_json::Value>,
     trace: Option<&TraceAuctionCarry>,
+    auction_diagnostics: Option<&BrowserAuctionDiagnostics>,
 ) -> String {
     // The local test script probes the minified `var a=JSON.parse`,
     // `var b=JSON.parse`, and `s(b,a)` literals below. Update the harness with any
     // semantically equivalent rewrite so its black-box checks keep matching output.
-    let bids = serde_json::to_string(bid_map)
-        .expect("serde_json::to_string of Map<String,Value> should be infallible");
+    let bids = serde_json::to_string(bid_map).expect("should serialize the bids map");
     let transport = trace_transport_script(trace);
-    let (transport_script, scheduler_arguments) =
-        transport.as_ref().map_or((String::new(), "b,a"), |json| {
-            (
-                format!("var x=JSON.parse(\"{}\");", html_escape_for_script(json)),
-                "b,a,x",
-            )
-        });
+    let transport_script = transport.as_ref().map_or_else(String::new, |json| {
+        format!("var x=JSON.parse(\"{}\");", html_escape_for_script(json))
+    });
+    let diagnostics_script = auction_diagnostics.map_or_else(String::new, |diagnostics| {
+        let json =
+            serde_json::to_string(diagnostics).expect("should serialize BrowserAuctionDiagnostics");
+        format!("var d=JSON.parse(\"{}\");", html_escape_for_script(&json))
+    });
+    let scheduler_arguments = match (transport.is_some(), auction_diagnostics.is_some()) {
+        (false, false) => "b,a",
+        (true, false) => "b,a,x",
+        (false, true) => "b,a,void 0,d",
+        (true, true) => "b,a,x,d",
+    };
+    let fallback_diagnostics = if auction_diagnostics.is_some() {
+        "t.auctionDiagnostics=d;"
+    } else {
+        ""
+    };
     format!(
         "<script>(function(){{\
 var t=window.tsjs=window.tsjs||{{}};\
 var a=JSON.parse(\"{}\");\
 var b=JSON.parse(\"{}\");\
-{}\
+{}{}\
 var s=t.scheduleInitialAdInit;\
 if(typeof s===\"function\")s({});\
-else{{t.adSlots=a;t.bids=b;}}\
+else{{t.adSlots=a;t.bids=b;{}}}\
 }})();</script>",
         html_escape_for_script(slots_json),
         html_escape_for_script(&bids),
         transport_script,
-        scheduler_arguments
+        diagnostics_script,
+        scheduler_arguments,
+        fallback_diagnostics
     )
 }
 
@@ -7639,9 +7917,9 @@ pub async fn handle_page_bids(
     ec_context: &mut EcContext,
     mut req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    // CSRF-style gate: refuse cross-site invocations before any other work —
-    // including the not-configured 404 below, which would otherwise tell a
-    // cross-site caller whether this deployment has creative opportunities.
+    // Reject cross-site invocations before diagnostics preparation or the
+    // not-configured 404 below, which would otherwise tell a cross-site caller
+    // whether this deployment has creative opportunities.
     if !page_bids_request_allowed(&req) {
         log::debug!(
             "page-bids: rejecting request (sec-fetch-site={:?}, tsjs header present={})",
@@ -7652,7 +7930,23 @@ pub async fn handle_page_bids(
         );
         return Ok(page_bids_preflight_denied());
     }
+
+    // Keep a local collector for direct-handler callers, but only expose
+    // browser timings from an adapter-attached request clock. Otherwise an
+    // adapter that forgets the extension would silently report a different
+    // handler-entry timing origin.
+    let request_timings = RequestTimings::from_extensions(req.extensions());
+    let request_timing_collector_attached = request_timings.is_some();
+    let timings = request_timings.unwrap_or_default();
+
+    // Adapter fallbacks prepare this before routing. Keep this idempotent call as
+    // a direct-handler safety net and retain the session decision after the
+    // private activation cookie is stripped.
+    let gpt_diagnostics =
+        crate::integrations::gpt_diagnostics::prepare_request(settings, &mut req)?;
+
     ec_context.set_eid_sync_source(EidSyncSource::PageBids);
+    ec_context.decide_spa_writer(&req, settings.ec.identity.spa_writer_interval_sec);
 
     // Deprecation signal for the transition alias. Evaluated after the
     // cross-site gate, so the count reflects genuine SPA clients still running a
@@ -7815,6 +8109,10 @@ pub async fn handle_page_bids(
         .as_ref()
         .map(TraceAuctionCarry::cancellation_guard);
 
+    let mut auction_diagnostics = None;
+    // What the auction's KV read gave it, for the `ts-eids-s` mirror. It stays
+    // `None` when no auction runs, so the mirror is then absent.
+    let mut auction_identity_read: Option<AuctionIdentity> = None;
     let (winning_bids, prebuilt_bid_map) = if matched_slots.is_empty() {
         (std::collections::HashMap::new(), None)
     } else {
@@ -7832,6 +8130,12 @@ pub async fn handle_page_bids(
             user_agent,
             ec_context,
         );
+        // Same T0-anchored timeline as the navigation path (spec section 18).
+        // This route uses the dispatch/collect split without an intervening
+        // origin fetch. Only a started provider request stamps the milestones.
+        if auction.orchestrator.is_enabled() {
+            timings.set_auction_id(observation.auction_id);
+        }
         if ad_stack_enabled && !is_bot && !is_prefetch {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
@@ -7847,9 +8151,9 @@ pub async fn handle_page_bids(
                 _ => crate::ec::EcKvSnapshot::NotRead,
             };
             // Hand the loaded row to the request context so response
-            // finalization — which runs on an EC context the adapter owns,
-            // after this handler returns — ingests `ts-eids`/`sharedId` updates
-            // from this read instead of paying for a second lookup.
+            // finalization, which runs on an EC context the adapter owns after
+            // this handler returns, reuses this read instead of paying for a
+            // second lookup.
             if !matches!(page_bids_kv_snapshot, crate::ec::EcKvSnapshot::NotRead) {
                 ec_context.set_kv_snapshot(page_bids_kv_snapshot.clone());
             }
@@ -7863,7 +8167,7 @@ pub async fn handle_page_bids(
                     user_agent,
                 )
             });
-            apply_auction_eids_and_device(
+            let identity = apply_auction_eids_and_device(
                 &mut auction_request,
                 &AuctionEidTargeting {
                     cookie_jar: cookie_jar.as_ref(),
@@ -7871,11 +8175,14 @@ pub async fn handle_page_bids(
                     kv_snapshot: &page_bids_kv_snapshot,
                     partner_registry: auction.registry,
                     ec_context,
+                    signals: PolicySignals::from_headers(req.headers()),
                     services,
                     geo: geo.as_ref(),
+                    hold: None,
                     path_label: "Page-bids",
                 },
             );
+            auction_identity_read = Some(identity);
             let timeout_ms = co_config
                 .auction_timeout_ms
                 .unwrap_or(settings.auction.timeout_ms);
@@ -7887,14 +8194,19 @@ pub async fn handle_page_bids(
                 provider_responses: None,
                 services,
             };
-            match auction
+            let mut dispatch_failure_responses = Vec::new();
+            let result = auction
                 .orchestrator
-                .run_auction(&auction_request, &auction_context)
+                .run_auction_with_timings(&auction_request, &auction_context, &timings)
                 .await
-            {
-                Ok(result) => {
+                .map_err(|failure| {
+                    dispatch_failure_responses = failure.provider_responses;
+                    failure.error
+                });
+            match result {
+                Ok((result, auction_work_started)) => {
                     let winning_bids = result.winning_bids.clone();
-                    let auction_id = trace_auction
+                    let diagnostics_request_id = trace_auction
                         .as_ref()
                         .map(|trace| trace.token().to_string())
                         .or_else(|| diagnostics_auction_id(settings));
@@ -7904,8 +8216,17 @@ pub async fn handle_page_bids(
                         settings,
                         &page_bids_request_origin,
                         settings.debug.inject_adm_for_testing,
-                        auction_id.as_deref(),
+                        diagnostics_request_id.as_deref(),
                     );
+                    // Targeting is available to the response pipeline.
+                    if auction_work_started {
+                        timings.mark_auction_committed();
+                    }
+                    if gpt_diagnostics.browser_session_active() && request_timing_collector_attached
+                    {
+                        auction_diagnostics =
+                            BrowserAuctionDiagnostics::from_request_timings(&timings);
+                    }
                     let delivered_winner_slots = bid_map.keys().cloned().collect();
                     if let Some(trace) = &trace_auction {
                         trace.observe_delivery(&winning_bids, &delivered_winner_slots);
@@ -7931,7 +8252,7 @@ pub async fn handle_page_bids(
                             observation,
                             AuctionTerminalOutcome::ExecutionFailed {
                                 request: Some(&auction_request),
-                                provider_responses: &[],
+                                provider_responses: &dispatch_failure_responses,
                                 reason: "execution_failed",
                                 elapsed_ms,
                             },
@@ -8006,6 +8327,30 @@ pub async fn handle_page_bids(
                 .unwrap_or_else(crate::trace::TraceAuctionTransportV1::unavailable),
         );
     }
+    if let Some(diagnostics) = auction_diagnostics {
+        body["auctionDiagnostics"] =
+            serde_json::to_value(diagnostics).change_context(TrustedServerError::Proxy {
+                message: "Failed to serialize page-bids diagnostics".to_string(),
+            })?;
+    }
+    // A consent denial clears the mirror, as `/auction` does, so a
+    // withdrawal reaches the cookie (spec 5.6).
+    let mirror = if consent_allows_auction {
+        match &auction_identity_read {
+            Some(identity) => identity.mirror_member(ec_context),
+            None => mirror_member(
+                &crate::ec::EcKvSnapshot::NotRead,
+                None,
+                ec_context,
+                PolicySignals::from_headers(req.headers()),
+            ),
+        }
+    } else {
+        mirror_enabled(ec_context).then(|| MirrorPayload::Clear.to_json())
+    };
+    if let Some(mirror) = mirror {
+        body["ts_eids_s"] = mirror;
+    }
     let body = serde_json::to_string(&body).change_context(TrustedServerError::Proxy {
         message: "Failed to serialize page-bids response".to_string(),
     })?;
@@ -8077,6 +8422,83 @@ mod tests {
         }
     }
 
+    /// The `Cookie` header `rewrite_origin_request` leaves, with the
+    /// operator's `strip_eids` choice.
+    fn origin_cookies_after_rewrite(strip_eids: bool) -> Vec<String> {
+        let mut req = Request::builder()
+            .uri("https://www.example.com/article")
+            .header(header::COOKIE, "ts-ec=abc; ts-eids=W10; session=1")
+            .header(
+                header::COOKIE,
+                "__Host-ts-eids-s=eyJ2IjoxfQ; ts-ec-pull-complete=v1",
+            )
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        rewrite_origin_request(
+            &mut req,
+            "https://origin.example.com/article"
+                .parse()
+                .expect("should parse uri"),
+            "origin.example.com",
+            strip_eids,
+        )
+        .expect("should rewrite request");
+
+        req.headers()
+            .get_all(header::COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should be ASCII").to_owned())
+            .collect()
+    }
+
+    #[test]
+    fn rewrite_origin_request_strips_only_the_mirror_by_default() {
+        assert_eq!(
+            origin_cookies_after_rewrite(false),
+            vec!["ts-ec=abc; ts-eids=W10; session=1; ts-ec-pull-complete=v1"],
+            "should keep ts-ec and ts-eids, as before the mirror existed, and drop the mirror"
+        );
+    }
+
+    #[test]
+    fn rewrite_origin_request_strips_ts_eids_when_the_operator_asks() {
+        assert_eq!(
+            origin_cookies_after_rewrite(true),
+            vec!["ts-ec=abc; session=1; ts-ec-pull-complete=v1"],
+            "should keep ts-ec, the pull marker and unrelated cookies, and drop the ID cookies"
+        );
+    }
+
+    #[test]
+    fn rewrite_origin_request_drops_cookie_header_when_only_id_cookies() {
+        let mut req = Request::builder()
+            .uri("https://www.example.com/")
+            .header(header::COOKIE, "ts-eids=W10; __Host-ts-eids-s=eyJ2IjoxfQ")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        rewrite_origin_request(
+            &mut req,
+            "https://origin.example.com/"
+                .parse()
+                .expect("should parse uri"),
+            "origin.example.com",
+            true,
+        )
+        .expect("should rewrite request");
+
+        assert!(
+            req.headers().get(header::COOKIE).is_none(),
+            "should drop the empty Cookie header"
+        );
+        assert_eq!(
+            req.headers()[header::HOST],
+            "origin.example.com",
+            "should still set Host"
+        );
+    }
+
     #[test]
     fn runtime_origin_snapshot_preserves_https_fallback() {
         let mut request = Request::builder()
@@ -8385,9 +8807,8 @@ mod tests {
             is_get: true,
             has_ec_id: true,
             has_kv: true,
-            marker_valid: false,
+            returning_writer: true,
             auction_needs_row: false,
-            eid_cookie_may_need_persistence: false,
             privacy_needs_row: false,
         };
         assert!(should_preload_ec_snapshot(&baseline));
@@ -8410,35 +8831,35 @@ mod tests {
     }
 
     #[test]
-    fn valid_marker_skips_only_when_no_other_consumer_needs_snapshot() {
-        let marker_only = EcSnapshotPreloadInput {
+    fn stager_navigation_preloads_only_for_an_auction_or_a_withdrawal() {
+        let stager = EcSnapshotPreloadInput {
             is_navigation: true,
             is_get: true,
             has_ec_id: true,
             has_kv: true,
-            marker_valid: true,
+            returning_writer: false,
             auction_needs_row: false,
-            eid_cookie_may_need_persistence: false,
             privacy_needs_row: false,
         };
-        assert!(!should_preload_ec_snapshot(&marker_only));
+        assert!(!should_preload_ec_snapshot(&stager));
         assert!(should_preload_ec_snapshot(&EcSnapshotPreloadInput {
             auction_needs_row: true,
-            ..marker_only
-        }));
-        assert!(should_preload_ec_snapshot(&EcSnapshotPreloadInput {
-            eid_cookie_may_need_persistence: true,
-            ..marker_only
+            ..stager
         }));
         assert!(should_preload_ec_snapshot(&EcSnapshotPreloadInput {
             privacy_needs_row: true,
-            ..marker_only
+            ..stager
         }));
     }
+    use crate::auction::test_support::canonical_parity_auction_request;
     use crate::auction::types::{AdFormat, AdSlot, MediaType};
     use crate::consent::ConsentContext;
+    use crate::consent::jurisdiction::Jurisdiction;
+    use crate::cookies::parse_cookies_to_jar;
+    use crate::ec::EcKvSnapshot;
     use crate::ec::kv_backend::test_support::InMemoryEcKv;
     use crate::ec::kv_backend::{EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteOutcome};
+    use crate::ec::kv_types::{KvEntry, KvPartnerId};
     use crate::integrations::IntegrationRegistry;
     use crate::platform::test_support::{
         NoopSecretStore, StubHttpClient, build_services_with_http_client,
@@ -8446,6 +8867,7 @@ mod tests {
         noop_services_with_telemetry_sink,
     };
     use crate::test_support::tests::{crate_test_settings_str, create_test_settings};
+    use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
     use edgezero_core::body::Body as EdgeBody;
     use http::{Method, Request as HttpRequest, StatusCode, header};
     use std::sync::Arc;
@@ -8679,11 +9101,21 @@ mod tests {
             Arc::clone(&http) as Arc<dyn crate::platform::PlatformHttpClient>
         );
         let ec_id = format!("{}.CkId01", "b".repeat(64));
-        let mut ec_context = EcContext::new_for_test_with_ip(
+        let mut ec_context = EcContext::new_writer_for_test_with_ip(
             Some(ec_id),
             scheduling_consent(),
             Some("203.0.113.7".to_owned()),
         );
+        // A returning visitor's writer navigation, which phase 1 always reads.
+        ec_context.identity_mut().set_writer_decision(
+            crate::ec::identity::request::WriterDecision {
+                writer: true,
+                is_real_browser: true,
+                user_agent: None,
+                dnt: false,
+                page_url: None,
+            },
+        );
         assert!(
             ec_context.ec_allowed() && ec_context.ec_value().is_some(),
             "test precondition: an active, consent-allowed EC must exist"
@@ -8805,175 +9237,788 @@ mod tests {
         }
     }
 
-    #[derive(Clone, Copy)]
-    enum MarkerProbe {
-        Valid,
-        Malformed,
-        WrongEc,
-        Expired,
-        PartnerSetMismatch,
-    }
-
-    fn marker_partner(source_domain: &str) -> crate::settings::EcPartner {
-        crate::settings::EcPartner {
-            name: format!("Marker partner {source_domain}"),
-            source_domain: source_domain.to_owned(),
-            openrtb_atype: crate::settings::EcPartner::default_openrtb_atype(),
-            bidstream_enabled: true,
-            api_token: Some(crate::redacted::Redacted::new(format!(
-                "marker-{source_domain}-api-token-32-bytes-minimum"
-            ))),
-            batch_rate_limit: crate::settings::EcPartner::default_batch_rate_limit(),
-            pull_sync_enabled: true,
-            pull_sync_url: Some(format!("https://sync.{source_domain}/pull")),
-            pull_sync_allowed_domains: vec![format!("sync.{source_domain}")],
-            pull_sync_ttl_sec: crate::settings::EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: crate::settings::EcPartner::default_pull_sync_rate_limit(),
-            ts_pull_token: Some(crate::redacted::Redacted::new("pull-token".to_owned())),
-        }
-    }
-
-    async fn run_marker_lookup_probe(
-        probe: MarkerProbe,
-        has_eid_cookie: bool,
-        has_matched_auction_slot: bool,
-    ) -> usize {
-        let mut settings = if has_matched_auction_slot {
-            scheduling_settings()
-        } else {
-            create_test_settings()
-        };
-        settings.ec.partners = vec![marker_partner("ssp.example.com")];
-        let registry = PartnerRegistry::from_config(&settings.ec.partners)
-            .expect("should build pull partner registry");
-        let http = Arc::new(StubHttpClient::new());
-        http.set_concurrent_fanout(true);
-        http.push_response(200, b"<html><body>ok</body></html>".to_vec());
-        let lookups = Arc::new(AtomicUsize::new(0));
-        let graph = KvIdentityGraph::new(OrderRecordingKv {
-            inner: InMemoryEcKv::new("marker-store"),
-            http: Arc::clone(&http),
-            http_calls_at_lookup: Arc::new(AtomicUsize::new(0)),
-            lookups: Arc::clone(&lookups),
-        });
-        let services = build_services_with_http_client(
-            Arc::clone(&http) as Arc<dyn crate::platform::PlatformHttpClient>
-        );
-        let ec_id = format!("{}.CkId01", "b".repeat(64));
-        let marker = match probe {
-            MarkerProbe::Valid => {
-                crate::ec::pull_sync_marker::create_marker_for_test(&settings, &registry, &ec_id)
-            }
-            MarkerProbe::Malformed => "not-a-marker".to_owned(),
-            MarkerProbe::WrongEc => crate::ec::pull_sync_marker::create_marker_for_test(
-                &settings,
-                &registry,
-                &format!("{}.Other1", "c".repeat(64)),
-            ),
-            MarkerProbe::Expired => {
-                crate::ec::pull_sync_marker::create_marker_for_test_with_expiry(
-                    &settings,
-                    &registry,
-                    &ec_id,
-                    crate::ec::current_timestamp().saturating_sub(1),
-                )
-            }
-            MarkerProbe::PartnerSetMismatch => {
-                let other_registry =
-                    PartnerRegistry::from_config(&[marker_partner("other.example.com")])
-                        .expect("should build alternate registry");
-                crate::ec::pull_sync_marker::create_marker_for_test(
-                    &settings,
-                    &other_registry,
-                    &ec_id,
-                )
-            }
+    #[test]
+    fn body_less_auction_eids_put_cookie_entries_first_and_kv_only_sources_after() {
+        let ec_id = format!("{}.navmrg", "a".repeat(64));
+        let registry = PartnerRegistry::from_config(&[
+            pull_partner_config("ids.example.com"),
+            pull_partner_config("other.example.com"),
+        ])
+        .expect("should build partner registry");
+        let mut entry = KvEntry::minimal("ids.example.com", "kv-stale", 1000);
+        entry
+            .ids
+            .insert("other.example.com".to_owned(), KvPartnerId::new("kv-other"));
+        let snapshot = EcKvSnapshot::Present {
+            ec_id: ec_id.clone(),
+            entry: Box::new(entry),
+            generation: None,
         };
-        let mut ec_context = EcContext::new_for_test_with_ip(
-            Some(ec_id),
-            scheduling_consent(),
-            Some("203.0.113.7".to_owned()),
-        );
-        ec_context.set_pull_sync_marker_for_test(
-            crate::ec::pull_sync_marker::PullSyncMarkerState::from_cookie(Some(marker)),
+        let ec_context = EcContext::new_for_test(
+            Some(ec_id.clone()),
+            ConsentContext {
+                jurisdiction: Jurisdiction::NonRegulated,
+                ..ConsentContext::default()
+            },
         );
-        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-        let slots = has_matched_auction_slot
-            .then(scheduling_slot)
-            .into_iter()
-            .collect::<Vec<_>>();
-        let mut request = navigation_request();
-        if has_eid_cookie {
-            request
-                .headers_mut()
-                .insert(header::COOKIE, HeaderValue::from_static("ts-eids=present"));
-        }
-
-        let result = handle_publisher_request(
-            &settings,
-            &services,
-            Some(&graph),
-            &mut ec_context,
-            AuctionDispatch {
-                integration_registry: &IntegrationRegistry::empty_for_tests(),
-                orchestrator: &orchestrator,
-                slots: &slots,
-                registry: Some(&registry),
+        let cookie_entries = serde_json::json!([{
+            "source": "ids.example.com",
+            "inserter": "inserter-1.example.com",
+            "mm": 1,
+            "uids": [{ "id": "browser-fresh", "atype": 1 }]
+        }]);
+        let cookie =
+            BASE64.encode(serde_json::to_vec(&cookie_entries).expect("should serialize cookie"));
+        let jar = parse_cookies_to_jar(&format!("{COOKIE_TS_EIDS}={cookie}"));
+        let services = noop_services();
+        let mut auction_request = canonical_parity_auction_request();
+        // No TCF signal and no GDPR, so the consent gate passes the merged set.
+        auction_request.user.consent = None;
+        auction_request.user.eids = None;
+
+        apply_auction_eids_and_device(
+            &mut auction_request,
+            &AuctionEidTargeting {
+                cookie_jar: Some(&jar),
+                ec_id: Some(ec_id.as_str()),
+                kv_snapshot: &snapshot,
+                partner_registry: Some(&registry),
+                ec_context: &ec_context,
+                signals: PolicySignals::default(),
+                services: &services,
+                geo: None,
+                hold: None,
+                path_label: "Test",
             },
-            request,
-            EdgeCacheHeader::SurrogateControl,
-        )
-        .await;
-
-        assert!(result.is_ok(), "should proxy the origin response");
-        lookups.load(Ordering::SeqCst)
-    }
+        );
 
-    #[tokio::test]
-    async fn valid_completeness_marker_skips_pull_only_snapshot_lookup() {
         assert_eq!(
-            run_marker_lookup_probe(MarkerProbe::Valid, false, false).await,
-            0
+            serde_json::to_value(&auction_request.user.eids).expect("should serialize EIDs"),
+            serde_json::json!([
+                {
+                    "source": "ids.example.com",
+                    "inserter": "inserter-1.example.com",
+                    "mm": 1,
+                    "uids": [{ "id": "browser-fresh", "atype": 1 }]
+                },
+                {
+                    "source": "other.example.com",
+                    "uids": [{ "id": "kv-other", "atype": crate::settings::EcPartner::default_openrtb_atype() }]
+                }
+            ]),
+            "navigation and page-bids auctions should forward the cookie entry as sent, then KV-only sources"
         );
     }
 
-    #[tokio::test]
-    async fn invalid_markers_fall_back_to_snapshot_lookup() {
-        for probe in [
-            MarkerProbe::Malformed,
-            MarkerProbe::WrongEc,
-            MarkerProbe::Expired,
-            MarkerProbe::PartnerSetMismatch,
-        ] {
-            assert_eq!(
-                run_marker_lookup_probe(probe, false, false).await,
-                1,
-                "invalid marker should retain the normal preload"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn valid_marker_does_not_skip_eid_cookie_persistence_lookup() {
-        assert_eq!(
-            run_marker_lookup_probe(MarkerProbe::Valid, true, false).await,
-            1
-        );
+    /// Sends the origin's requests to a [`StubHttpClient`] and a hold
+    /// provider's to a [`FakeHttpClient`], so one navigation can reach both.
+    struct HoldRoutingClient {
+        origin: Arc<StubHttpClient>,
+        providers: Arc<crate::ec::identity::test_support::fake_http::FakeHttpClient>,
+        provider_hosts: Vec<String>,
     }
 
-    #[tokio::test]
-    async fn valid_marker_does_not_skip_auction_snapshot_lookup() {
-        assert_eq!(
-            run_marker_lookup_probe(MarkerProbe::Valid, false, true).await,
-            1
-        );
+    struct RoutedPending {
+        provider: bool,
+        inner: crate::platform::PlatformPendingRequest,
     }
 
-    #[tokio::test]
-    async fn concurrent_client_starts_origin_before_ec_lookup() {
-        let outcome = run_scheduling_probe(true, true, true, true).await;
+    #[async_trait::async_trait(?Send)]
+    impl crate::platform::PlatformHttpClient for HoldRoutingClient {
+        fn supports_concurrent_fanout(&self) -> bool {
+            false
+        }
 
-        assert!(outcome.ok, "should proxy the origin response");
+        async fn send(
+            &self,
+            request: crate::platform::PlatformHttpRequest,
+        ) -> Result<crate::platform::PlatformResponse, Report<crate::platform::PlatformError>>
+        {
+            self.origin.send(request).await
+        }
+
+        async fn send_async(
+            &self,
+            request: crate::platform::PlatformHttpRequest,
+        ) -> Result<crate::platform::PlatformPendingRequest, Report<crate::platform::PlatformError>>
+        {
+            let host = request.request.uri().host().unwrap_or_default().to_owned();
+            let provider = self.provider_hosts.contains(&host);
+            let inner = if provider {
+                self.providers.send_async(request).await?
+            } else {
+                self.origin.send_async(request).await?
+            };
+            Ok(crate::platform::PlatformPendingRequest::new(
+                RoutedPending { provider, inner },
+            ))
+        }
+
+        async fn select(
+            &self,
+            mut pending_requests: Vec<crate::platform::PlatformPendingRequest>,
+        ) -> Result<crate::platform::PlatformSelectResult, Report<crate::platform::PlatformError>>
+        {
+            let first = pending_requests.remove(0);
+            let ready = self.wait(first).await;
+            Ok(crate::platform::PlatformSelectResult {
+                ready,
+                remaining: pending_requests,
+                failed_backend_name: None,
+            })
+        }
+
+        async fn wait(
+            &self,
+            pending: crate::platform::PlatformPendingRequest,
+        ) -> Result<crate::platform::PlatformResponse, Report<crate::platform::PlatformError>>
+        {
+            let routed = pending
+                .downcast::<RoutedPending>()
+                .map_err(|_| Report::new(crate::platform::PlatformError::HttpClient))?;
+            if routed.provider {
+                self.providers.wait(routed.inner).await
+            } else {
+                self.origin.wait(routed.inner).await
+            }
+        }
+    }
+
+    /// What one writer navigation with a hold provider did.
+    struct HoldNavigation {
+        provider_hosts: Vec<String>,
+        auction_eids: serde_json::Value,
+        set_cookies: Vec<String>,
+        runs_auction: bool,
+        staged_sources: Vec<String>,
+    }
+
+    /// Drives a returning writer navigation that runs an auction, with one
+    /// hold-mode provider that answers `found` for `ids.example.com`.
+    async fn run_hold_navigation(with_limiter: bool) -> HoldNavigation {
+        use crate::ec::identity::test_support::fake_http::{
+            AnsweringProvider, FakeBackend, FakeHttpClient,
+        };
+
+        let mut settings = scheduling_settings();
+        settings.ec.identity.providers.insert(
+            "hold-provider".to_owned(),
+            crate::settings::ProviderSettings {
+                mode: crate::settings::ProviderMode::Hold,
+                ..crate::settings::ProviderSettings::default()
+            },
+        );
+        let origin = Arc::new(StubHttpClient::new());
+        origin.push_response_with_headers(
+            200,
+            b"<html><body>ok</body></html>".to_vec(),
+            vec![("content-type", "text/html; charset=utf-8")],
+        );
+        let providers = Arc::new(FakeHttpClient::new());
+        providers.respond(
+            "hold.example.com",
+            200,
+            &serde_json::to_vec(&serde_json::json!({
+                "answer": "found",
+                "entries": [{ "uids": [{ "id": "nav-uid", "atype": 1 }] }]
+            }))
+            .expect("should serialize the answer"),
+        );
+        let client = Arc::new(HoldRoutingClient {
+            origin: Arc::clone(&origin),
+            providers: Arc::clone(&providers),
+            provider_hosts: vec!["hold.example.com".to_owned()],
+        });
+        let services = crate::platform::RuntimeServices::builder()
+            .config_store(Arc::new(crate::platform::test_support::NoopConfigStore))
+            .secret_store(Arc::new(NoopSecretStore))
+            .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+            .backend(Arc::new(FakeBackend::new()))
+            .http_client(client)
+            .geo(Arc::new(crate::platform::test_support::NoopGeo))
+            .client_info(crate::platform::ClientInfo::default())
+            .build();
+
+        let ec_id = format!("{}.CkId01", "b".repeat(64));
+        let (graph, _store) = KvIdentityGraph::write_counting("hold-navigation-store");
+        graph
+            .create(
+                &ec_id,
+                &KvEntry::new(&scheduling_consent(), None, 1_000, "test-publisher.com"),
+            )
+            .expect("should seed the row");
+        let mut ec_context = EcContext::new_writer_for_test_with_ip(
+            Some(ec_id),
+            scheduling_consent(),
+            Some("203.0.113.7".to_owned()),
+        );
+        ec_context.identity_mut().set_writer_decision(
+            crate::ec::identity::request::WriterDecision {
+                writer: true,
+                is_real_browser: true,
+                user_agent: None,
+                dnt: false,
+                page_url: None,
+            },
+        );
+        ec_context.set_identity_runtime(Arc::new(
+            crate::ec::identity::IdentityRuntime::from_settings_with_providers(
+                &settings,
+                vec![
+                    AnsweringProvider::new(
+                        "hold-provider",
+                        "hold.example.com",
+                        "ids.example.com",
+                        None,
+                    )
+                    .into_provider(),
+                ],
+                std::collections::BTreeMap::new(),
+            )
+            .expect("should build the runtime"),
+        ));
+        if with_limiter {
+            ec_context.set_identity_rate_limiter(Arc::new(
+                crate::ec::identity::test_support::FakeRateLimiter::new(),
+            ));
+        }
+        let registry = PartnerRegistry::from_config(&[pull_partner_config("ids.example.com")])
+            .expect("should build partner registry");
+        let captured = Arc::new(Mutex::new(None));
+        let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+        orchestrator.register_provider(Arc::new(SchedulingCaptureProvider {
+            captured: Arc::clone(&captured),
+            http: Arc::clone(&origin),
+            lookups: Arc::new(AtomicUsize::new(0)),
+        }));
+        let slots = [scheduling_slot()];
+
+        let response = handle_publisher_request(
+            &settings,
+            &services,
+            Some(&graph),
+            &mut ec_context,
+            AuctionDispatch {
+                integration_registry: &IntegrationRegistry::empty_for_tests(),
+                orchestrator: &orchestrator,
+                slots: &slots,
+                registry: Some(&registry),
+            },
+            navigation_request(),
+            EdgeCacheHeader::SurrogateControl,
+        )
+        .await
+        .expect("should proxy the origin response");
+
+        let headers = match &response {
+            PublisherResponse::PassThrough { response, .. }
+            | PublisherResponse::Stream { response, .. }
+            | PublisherResponse::AssembleTemplate { response, .. }
+            | PublisherResponse::Buffered(response) => response.headers().clone(),
+        };
+        let auction_eids = captured
+            .lock()
+            .expect("should lock captured auction")
+            .take()
+            .map(|captured| {
+                serde_json::to_value(&captured.request.user.eids)
+                    .expect("should serialize the EIDs")
+            })
+            .expect("should have dispatched the auction");
+        HoldNavigation {
+            provider_hosts: providers.sent_hosts(),
+            auction_eids,
+            set_cookies: headers
+                .get_all(header::SET_COOKIE)
+                .iter()
+                .map(|value| value.to_str().unwrap_or_default().to_owned())
+                .collect(),
+            runs_auction: ec_context.identity().runs_auction(),
+            staged_sources: ec_context
+                .identity()
+                .mutation()
+                .positive_changes()
+                .iter()
+                .filter_map(|change| match change {
+                    crate::ec::identity::mutation::PartnerIdChange::FillMissing {
+                        source, ..
+                    } => Some(source.to_string()),
+                    _ => None,
+                })
+                .collect(),
+        }
+    }
+
+    #[tokio::test]
+    async fn hold_answer_reaches_the_navigation_auction_and_the_writer_mutation() {
+        let navigation = run_hold_navigation(true).await;
+
+        assert_eq!(
+            navigation.provider_hosts,
+            ["hold.example.com"],
+            "should call the hold provider once, before the auction"
+        );
+        assert_eq!(
+            navigation.auction_eids,
+            serde_json::json!([
+                { "source": "ids.example.com", "uids": [{ "id": "nav-uid", "atype": 1 }] }
+            ]),
+            "should send the hold answer in this navigation's auction"
+        );
+        assert!(
+            navigation.runs_auction,
+            "should record that the navigation ran an auction, so phase 4 skips hold providers"
+        );
+        assert_eq!(
+            navigation.staged_sources,
+            ["ids.example.com"],
+            "should stage the answer in the writer's mutation"
+        );
+    }
+
+    #[tokio::test]
+    async fn hold_without_a_rate_limiter_dispatches_nothing() {
+        let navigation = run_hold_navigation(false).await;
+
+        assert!(
+            navigation.provider_hosts.is_empty(),
+            "should fail closed and call no provider without a limiter: {:?}",
+            navigation.provider_hosts
+        );
+        assert_eq!(
+            navigation.auction_eids,
+            serde_json::Value::Null,
+            "should run the auction without a hold answer"
+        );
+        assert!(
+            navigation.runs_auction && navigation.staged_sources.is_empty(),
+            "control: the navigation still ran its auction and staged nothing"
+        );
+    }
+
+    #[tokio::test]
+    async fn hold_sets_no_cookie() {
+        let navigation = run_hold_navigation(true).await;
+
+        assert_eq!(
+            navigation.provider_hosts,
+            ["hold.example.com"],
+            "control: should have run the hold provider"
+        );
+        assert!(
+            navigation.set_cookies.is_empty(),
+            "should set no cookie from a hold answer: {:?}",
+            navigation.set_cookies
+        );
+    }
+
+    #[test]
+    fn full_set_hold_answer_is_sent_in_order_and_flushed_whole() {
+        use crate::ec::identity::descriptor::EidProvenance;
+        use crate::ec::identity::test_support::fake_http::AnsweringProvider;
+        use crate::ec::identity::test_support::hold_fixture::{HoldFixture, live_row};
+        use crate::ec::kv_types::{KvEid, KvUid};
+
+        let provider = AnsweringProvider::new(
+            "hold-provider",
+            "hold.example.com",
+            "ids.example.com",
+            Some(
+                EidProvenance::new()
+                    .with_inserter("default.example.com")
+                    .with_mm(2),
+            ),
+        )
+        .into_provider();
+        let mut fixture = HoldFixture::new(
+            vec![(provider, crate::settings::ProviderMode::Hold)],
+            &live_row(),
+            true,
+        );
+        fixture.client.respond(
+            "hold.example.com",
+            200,
+            &serde_json::to_vec(&serde_json::json!({
+                "answer": "found",
+                "entries": [
+                    {
+                        "uids": [{ "id": "uid-a", "atype": 1 }, { "id": "uid-b", "atype": 3 }],
+                        "inserter": "vendor.example.com"
+                    },
+                    { "uids": [{ "id": "uid-c", "atype": 1 }] }
+                ]
+            }))
+            .expect("should serialize the answer"),
+        );
+        let snapshot = fixture.context.kv_snapshot().clone();
+        let ec_id = fixture
+            .context
+            .ec_value()
+            .expect("should hold an EC ID")
+            .to_owned();
+        let registry = PartnerRegistry::from_config(&[pull_partner_config("ids.example.com")])
+            .expect("should build partner registry");
+
+        let hold = fixture.run_hold();
+        let services = noop_services();
+        let mut auction_request = canonical_parity_auction_request();
+        auction_request.user.consent = None;
+        auction_request.user.eids = None;
+        apply_auction_eids_and_device(
+            &mut auction_request,
+            &AuctionEidTargeting {
+                cookie_jar: None,
+                ec_id: Some(ec_id.as_str()),
+                kv_snapshot: &snapshot,
+                partner_registry: Some(&registry),
+                ec_context: &fixture.context,
+                signals: PolicySignals::default(),
+                services: &services,
+                geo: None,
+                hold: Some(&hold),
+                path_label: "Test",
+            },
+        );
+        let outcome = fixture.flush(http::StatusCode::OK);
+
+        assert_eq!(
+            serde_json::to_value(&auction_request.user.eids).expect("should serialize EIDs"),
+            serde_json::json!([
+                {
+                    "source": "ids.example.com",
+                    "inserter": "vendor.example.com",
+                    "uids": [{ "id": "uid-a", "atype": 1 }, { "id": "uid-b", "atype": 3 }]
+                },
+                {
+                    "source": "ids.example.com",
+                    "inserter": "default.example.com",
+                    "mm": 2,
+                    "uids": [{ "id": "uid-c", "atype": 1 }]
+                }
+            ]),
+            "should send both entries in order, the first as returned and the second with the provenance default"
+        );
+        assert_eq!(
+            outcome,
+            crate::ec::identity::flush::FlushOutcome::Written,
+            "should flush the answer"
+        );
+        let uid = |id: &str, atype: i32| KvUid {
+            id: id.to_owned(),
+            atype: Some(atype),
+            ext: None,
+        };
+        assert_eq!(
+            fixture.row().ids["ids.example.com"].eids,
+            vec![
+                KvEid {
+                    uids: vec![uid("uid-a", 1), uid("uid-b", 3)],
+                    inserter: Some("vendor.example.com".to_owned()),
+                    matcher: None,
+                    mm: None,
+                    ext: None,
+                },
+                KvEid {
+                    uids: vec![uid("uid-c", 1)],
+                    inserter: None,
+                    matcher: None,
+                    mm: None,
+                    ext: None,
+                },
+            ],
+            "should store the set as returned, without the default"
+        );
+        assert_eq!(
+            fixture.store.writes().total(),
+            1,
+            "should make the one flush write"
+        );
+    }
+
+    /// The navigation and page-bids merge for `snapshot` and a `ts-eids`
+    /// cookie holding `cookie_entries`, plus any `extra_cookie`.
+    fn publisher_merge(
+        snapshot: &EcKvSnapshot,
+        registry: &PartnerRegistry,
+        ec_context: &EcContext,
+        cookie_entries: &serde_json::Value,
+        extra_cookie: Option<&str>,
+    ) -> Option<Vec<crate::openrtb::Eid>> {
+        let cookie =
+            BASE64.encode(serde_json::to_vec(cookie_entries).expect("should serialize cookie"));
+        let mut header = format!("{COOKIE_TS_EIDS}={cookie}");
+        if let Some(extra) = extra_cookie {
+            header.push_str("; ");
+            header.push_str(extra);
+        }
+        let jar = parse_cookies_to_jar(&header);
+        let services = noop_services();
+        let mut auction_request = canonical_parity_auction_request();
+        auction_request.user.consent = None;
+        auction_request.user.eids = None;
+        apply_auction_eids_and_device(
+            &mut auction_request,
+            &AuctionEidTargeting {
+                cookie_jar: Some(&jar),
+                ec_id: ec_context.ec_value(),
+                kv_snapshot: snapshot,
+                partner_registry: Some(registry),
+                ec_context,
+                signals: PolicySignals::default(),
+                services: &services,
+                geo: None,
+                hold: None,
+                path_label: "Test",
+            },
+        );
+        auction_request.user.eids
+    }
+
+    fn publisher_merge_fixture(entry: KvEntry) -> (EcKvSnapshot, PartnerRegistry, EcContext) {
+        let ec_id = format!("{}.navmrg", "a".repeat(64));
+        let registry = PartnerRegistry::from_config(&[
+            pull_partner_config("ids.example.com"),
+            pull_partner_config("other.example.com"),
+        ])
+        .expect("should build partner registry");
+        let snapshot = EcKvSnapshot::Present {
+            ec_id: ec_id.clone(),
+            entry: Box::new(entry),
+            generation: None,
+        };
+        let ec_context = EcContext::new_for_test(
+            Some(ec_id),
+            ConsentContext {
+                jurisdiction: Jurisdiction::NonRegulated,
+                ..ConsentContext::default()
+            },
+        );
+        (snapshot, registry, ec_context)
+    }
+
+    fn publisher_eid(source: &str, id: &str, atype: i32) -> crate::openrtb::Eid {
+        crate::openrtb::Eid {
+            source: source.to_owned(),
+            uids: vec![crate::openrtb::Uid {
+                id: id.to_owned(),
+                atype: Some(atype),
+                ext: None,
+            }],
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
+    }
+
+    #[test]
+    fn merge_publisher_never_reads_the_mirror_cookie() {
+        let entry = KvEntry::minimal("other.example.com", "kv-other", 1000);
+        let (snapshot, registry, ec_context) = publisher_merge_fixture(entry);
+        let cookie_entries = serde_json::json!([{ "source": "ids.example.com", "uids": [{ "id": "b", "atype": 1 }] }]);
+        let mirror = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(
+            serde_json::to_vec(&serde_json::json!({ "v": 1, "eids": [
+                { "source": "mirror-only.example.com", "uids": [{ "id": "m", "atype": 1 }] }
+            ] }))
+            .expect("should serialize the mirror"),
+        );
+
+        let without = publisher_merge(&snapshot, &registry, &ec_context, &cookie_entries, None);
+        let with = publisher_merge(
+            &snapshot,
+            &registry,
+            &ec_context,
+            &cookie_entries,
+            Some(&format!("__Host-ts-eids-s={mirror}")),
+        );
+
+        assert_eq!(
+            with,
+            Some(vec![
+                publisher_eid("ids.example.com", "b", 1),
+                publisher_eid(
+                    "other.example.com",
+                    "kv-other",
+                    crate::settings::EcPartner::default_openrtb_atype()
+                ),
+            ]),
+            "should merge the cookie and KV only"
+        );
+        assert_eq!(with, without, "the mirror cookie should change nothing");
+    }
+
+    #[test]
+    fn merge_publisher_denial_drops_a_browser_uid_in_a_claimants_iv_for_an_unowned_source() {
+        let mut entry = KvEntry::minimal("other.example.com", "kv-other", 1000);
+        entry.ps.insert(
+            "pull-ids-example-com".to_owned(),
+            crate::ec::kv_types::KvProviderState {
+                iv: vec![crate::ec::identity::revision::uid_hash("invalidated")],
+                ..Default::default()
+            },
+        );
+        let (snapshot, registry, mut ec_context) = publisher_merge_fixture(entry);
+        let mut settings = create_test_settings();
+        settings.ec.partners = vec![pull_partner_config("ids.example.com")];
+        ec_context.set_identity_runtime(Arc::new(
+            crate::ec::identity::IdentityRuntime::from_settings(
+                &settings,
+                &IntegrationRegistry::default(),
+            )
+            .expect("should build the runtime"),
+        ));
+        let cookie_entries = serde_json::json!([
+            { "source": "ids.example.com", "uids": [{ "id": "invalidated", "atype": 1 }] }
+        ]);
+
+        let merged = publisher_merge(&snapshot, &registry, &ec_context, &cookie_entries, None);
+
+        assert_eq!(
+            merged,
+            Some(vec![publisher_eid(
+                "other.example.com",
+                "kv-other",
+                crate::settings::EcPartner::default_openrtb_atype()
+            )]),
+            "the invalidated browser UID should not be sent"
+        );
+    }
+
+    #[test]
+    fn merge_publisher_owner_value_beats_the_browser_cookie_value() {
+        let mut entry = KvEntry::minimal("other.example.com", "kv-other", 1000);
+        entry.ids.insert(
+            "ids.example.com".to_owned(),
+            crate::ec::kv_types::KvPartnerId {
+                w: Some("owner".to_owned()),
+                ..crate::ec::kv_types::KvPartnerId::new("owner-uid")
+            },
+        );
+        let (snapshot, registry, mut ec_context) = publisher_merge_fixture(entry);
+        let owner =
+            crate::ec::identity::test_support::fixed_provider("owner", &["ids.example.com"]);
+        ec_context.set_identity_runtime(Arc::new(
+            crate::ec::identity::IdentityRuntime::from_settings_with_providers(
+                &create_test_settings(),
+                vec![owner],
+                std::collections::BTreeMap::from([(
+                    crate::ec::identity::test_support::source("ids.example.com"),
+                    crate::ec::identity::test_support::pid("owner"),
+                )]),
+            )
+            .expect("should build the runtime"),
+        ));
+        let cookie_entries = serde_json::json!([
+            { "source": "ids.example.com", "uids": [{ "id": "browser-uid", "atype": 1 }] },
+            { "source": "other.example.com", "uids": [{ "id": "browser-other", "atype": 1 }] }
+        ]);
+
+        let merged = publisher_merge(&snapshot, &registry, &ec_context, &cookie_entries, None);
+
+        let atype = crate::settings::EcPartner::default_openrtb_atype();
+        assert_eq!(
+            merged,
+            Some(vec![
+                publisher_eid("other.example.com", "browser-other", 1),
+                publisher_eid("ids.example.com", "owner-uid", atype),
+            ]),
+            "the owner's value should replace the browser's, and the unowned browser value should still win"
+        );
+    }
+
+    fn pull_partner_config(source_domain: &str) -> crate::settings::EcPartner {
+        crate::settings::EcPartner {
+            name: format!("Partner {source_domain}"),
+            source_domain: source_domain.to_owned(),
+            openrtb_atype: crate::settings::EcPartner::default_openrtb_atype(),
+            bidstream_enabled: true,
+            api_token: Some(crate::redacted::Redacted::new(format!(
+                "partner-{source_domain}-api-token-32-bytes-minimum"
+            ))),
+            batch_rate_limit: crate::settings::EcPartner::default_batch_rate_limit(),
+            pull_sync_enabled: true,
+            // The interpolated suffix is a reserved fixture domain.
+            pull_sync_url: Some(format!("https://sync.{source_domain}/pull")), // allow-domain: sync
+            pull_sync_allowed_domains: vec![format!("sync.{source_domain}")],
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
+            ts_pull_token: Some(crate::redacted::Redacted::new("pull-token".to_owned())),
+        }
+    }
+
+    /// Runs a navigation without an auction and counts its KV reads.
+    async fn run_navigation_lookup_probe(writer: bool) -> usize {
+        let settings = create_test_settings();
+        let http = Arc::new(StubHttpClient::new());
+        http.set_concurrent_fanout(true);
+        http.push_response(200, b"<html><body>ok</body></html>".to_vec());
+        let lookups = Arc::new(AtomicUsize::new(0));
+        let graph = KvIdentityGraph::new(OrderRecordingKv {
+            inner: InMemoryEcKv::new("probe-store"),
+            http: Arc::clone(&http),
+            http_calls_at_lookup: Arc::new(AtomicUsize::new(0)),
+            lookups: Arc::clone(&lookups),
+        });
+        let services = build_services_with_http_client(
+            Arc::clone(&http) as Arc<dyn crate::platform::PlatformHttpClient>
+        );
+        let ec_id = format!("{}.CkId01", "b".repeat(64));
+        let mut ec_context = EcContext::new_writer_for_test_with_ip(
+            Some(ec_id),
+            scheduling_consent(),
+            Some("203.0.113.7".to_owned()),
+        );
+        ec_context.identity_mut().set_writer_decision(
+            crate::ec::identity::request::WriterDecision {
+                writer,
+                is_real_browser: true,
+                user_agent: None,
+                dnt: false,
+                page_url: None,
+            },
+        );
+        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+
+        let result = handle_publisher_request(
+            &settings,
+            &services,
+            Some(&graph),
+            &mut ec_context,
+            AuctionDispatch {
+                integration_registry: &IntegrationRegistry::empty_for_tests(),
+                orchestrator: &orchestrator,
+                slots: &[],
+                registry: None,
+            },
+            navigation_request(),
+            EdgeCacheHeader::SurrogateControl,
+        )
+        .await;
+
+        assert!(result.is_ok(), "should proxy the origin response");
+        lookups.load(Ordering::SeqCst)
+    }
+
+    #[tokio::test]
+    async fn returning_writer_navigation_reads_kv_without_an_auction() {
+        assert_eq!(
+            run_navigation_lookup_probe(true).await,
+            1,
+            "should read the row once in phase 1"
+        );
+        assert_eq!(
+            run_navigation_lookup_probe(false).await,
+            0,
+            "control: a stager navigation without an auction should read nothing"
+        );
+    }
+
+    #[tokio::test]
+    async fn concurrent_client_starts_origin_before_ec_lookup() {
+        let outcome = run_scheduling_probe(true, true, true, true).await;
+
+        assert!(outcome.ok, "should proxy the origin response");
         assert_eq!(outcome.lookups, 1, "should perform exactly one EC lookup");
         assert_eq!(
             outcome.http_calls_at_lookup, 1,
@@ -9950,6 +10995,7 @@ mod tests {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         }
     }
 
@@ -10858,6 +11904,83 @@ mod tests {
         .expect("should proxy publisher request")
     }
 
+    #[tokio::test]
+    async fn origin_span_covers_the_publisher_fetch() {
+        let settings = create_test_settings();
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response_with_headers(
+            200,
+            b"<html><head></head><body>origin</body></html>".to_vec(),
+            vec![(header::CONTENT_TYPE.as_str(), "text/html; charset=utf-8")],
+        );
+        let services =
+            build_services_with_http_client(stub as Arc<dyn crate::platform::PlatformHttpClient>);
+        let mut request = HttpRequest::builder()
+            .method(Method::GET)
+            .uri("https://publisher.example/some-page")
+            .header(header::HOST, "publisher.example")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        let timings = RequestTimings::new();
+        request.extensions_mut().insert(timings.handle().clone());
+
+        let _response = run_publisher_proxy(&settings, &services, request).await;
+
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().origin_ms.is_some(),
+            "should record the Origin phase span around the publisher fetch"
+        );
+    }
+
+    #[tokio::test]
+    async fn origin_span_is_recorded_when_the_origin_send_fails() {
+        // Regression guard for the review finding that the origin span
+        // guard stayed alive through the error branch (and its
+        // abandonment-telemetry await): the span must close when the send
+        // resolves, so a failed fetch still records `origin_ms` and the
+        // error branch's own work is excluded from it.
+        let settings = create_test_settings();
+        // No queued response: the stub client fails the origin send.
+        let stub = Arc::new(StubHttpClient::new());
+        let services =
+            build_services_with_http_client(stub as Arc<dyn crate::platform::PlatformHttpClient>);
+        let mut request = HttpRequest::builder()
+            .method(Method::GET)
+            .uri("https://publisher.example/some-page")
+            .header(header::HOST, "publisher.example")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        let timings = RequestTimings::new();
+        request.extensions_mut().insert(timings.handle().clone());
+
+        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+        let mut ec_context = EcContext::read_from_request(&settings, &request, &services)
+            .expect("should read EC context");
+        let result = handle_publisher_request(
+            &settings,
+            &services,
+            None,
+            &mut ec_context,
+            AuctionDispatch {
+                integration_registry: &IntegrationRegistry::empty_for_tests(),
+                orchestrator: &orchestrator,
+                slots: &[],
+                registry: None,
+            },
+            request,
+            EdgeCacheHeader::SurrogateControl,
+        )
+        .await;
+
+        assert!(result.is_err(), "should surface the origin failure");
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().origin_ms.is_some(),
+            "should record the Origin span even when the origin send fails"
+        );
+    }
+
     mod rendered_template_identity_tests {
         //! The gate the plan's Task 3 Step 2 actually asks for.
         //!
@@ -11532,6 +12655,7 @@ mod tests {
         //! link; this tests that they connect.
 
         use super::*;
+        use crate::auction::provider::test_support::LaunchEvidenceProvider as Mediator;
         use crate::platform::ClientInfo;
         use crate::platform::test_support::{
             NoopConfigStore, NoopGeo, NoopSecretStore, StubBackend, StubHttpClient,
@@ -11990,6 +13114,47 @@ mod tests {
             price: f64,
         }
 
+        struct FailingNavigationProvider;
+
+        #[async_trait::async_trait(?Send)]
+        impl crate::auction::provider::AuctionProvider for FailingNavigationProvider {
+            fn provider_name(&self) -> &'static str {
+                STUB_BIDDER
+            }
+
+            async fn request_bids(
+                &self,
+                _request: &AuctionRequest,
+                _context: &crate::auction::types::AuctionContext<'_>,
+            ) -> Result<crate::auction::provider::ProviderRequestOutcome, Report<TrustedServerError>>
+            {
+                Err(Report::new(TrustedServerError::Auction {
+                    message: "navigation provider admission failed".to_string(),
+                }))
+            }
+
+            async fn parse_response(
+                &self,
+                _response: crate::platform::PlatformResponse,
+                _response_time_ms: u64,
+            ) -> Result<crate::auction::types::AuctionResponse, Report<TrustedServerError>>
+            {
+                panic!("should not parse a response after navigation dispatch failure");
+            }
+
+            fn timeout_ms(&self) -> u32 {
+                2_000
+            }
+
+            fn backend_name(
+                &self,
+                _services: &RuntimeServices,
+                _timeout_ms: u32,
+            ) -> Option<String> {
+                Some("stub-bidder-backend".to_string())
+            }
+        }
+
         #[async_trait::async_trait(?Send)]
         impl crate::auction::provider::AuctionProvider for WinningBidProvider {
             fn provider_name(&self) -> &'static str {
@@ -12741,6 +13906,236 @@ mod tests {
             }
         }
 
+        #[tokio::test]
+        async fn disabled_navigation_keeps_access_auction_id_null() {
+            let stub = Arc::new(StubHttpClient::new());
+            let services = services_with_cache_and_telemetry(
+                Arc::clone(&stub),
+                Arc::new(MemoryTemplateCache::default()),
+                Arc::new(RecordingTelemetrySink::default()),
+            );
+            let mut disabled_settings = settings_with_mode("esi");
+            disabled_settings.auction.enabled = false;
+            let settings = Arc::new(disabled_settings);
+            queue_shareable_html(&stub);
+            let mut request = navigation_request();
+            let timings = RequestTimings::new();
+            request.extensions_mut().insert(timings.handle().clone());
+
+            let response = run(&settings, &services, request).await;
+            let _ = body_of(response).await;
+
+            assert!(
+                timings.snapshot().auction_id.is_none(),
+                "should keep the disabled navigation access join key null"
+            );
+        }
+
+        #[tokio::test]
+        async fn skipped_navigation_joins_summary_without_milestones() {
+            let stub = Arc::new(StubHttpClient::new());
+            let sink = Arc::new(RecordingTelemetrySink::default());
+            let services = services_with_cache_and_telemetry(
+                Arc::clone(&stub),
+                Arc::new(MemoryTemplateCache::default()),
+                Arc::clone(&sink),
+            );
+            let settings = Arc::new(settings_with_mode("esi"));
+            queue_shareable_html(&stub);
+            let mut request = prefetch_navigation_request();
+            let timings = RequestTimings::new();
+            request.extensions_mut().insert(timings.handle().clone());
+
+            let response = run(&settings, &services, request).await;
+            let _ = body_of(response).await;
+            let summary =
+                last_summary_row(&sink).expect("should emit a skipped summary for prefetch");
+            assert_eq!(summary.terminal_reason.as_deref(), Some("prefetch"));
+            assert_eq!(
+                timings
+                    .snapshot()
+                    .auction_id
+                    .map(|id| id.to_string())
+                    .as_deref(),
+                Some(summary.auction_id.as_str()),
+                "should join the enabled skipped navigation to its summary"
+            );
+            assert!(timings.snapshot().auction_dispatched_ms.is_none());
+            assert!(timings.snapshot().auction_resolved_ms.is_none());
+            assert!(timings.snapshot().auction_committed_ms.is_none());
+        }
+
+        #[tokio::test]
+        async fn routing_only_navigation_times_only_mediator_requests_that_started() {
+            // Shared-template cache misses intentionally buffer even with a streaming
+            // finalizer. Inline assembly exercises the actual lazy collection path.
+            let toml = format!(
+                "{}\n[auction]\nenabled = true\n\n\
+                 [auction.providers.skipped]\nprotocol = \"openrtb-2.6\"\nprofile = \"standard\"\nendpoint = \"https://bidder.example.com/auction\"\nrouting = \"explicit\"\n\n\
+                 [creative_opportunities]\ngam_network_id = \"99999\"\nassembly_mode = \"inline\"\n\n\
+                 [[creative_opportunities.slot]]\nid = \"test-slot\"\npage_patterns = [\"/article\"]\nformats = [{{ width = 728, height = 90 }}]\n",
+                crate_test_settings_str()
+            );
+            let mut parsed_settings = Settings::from_toml(&toml)
+                .expect("should parse explicit-routing navigation settings");
+            parsed_settings.proxy.allowed_domains =
+                vec!["*.example".to_string(), "*.example.com".to_string()];
+            let settings = Arc::new(parsed_settings);
+            let plan = Arc::new(
+                crate::auction::compile_auction_plan(&settings)
+                    .expect("should compile explicit-routing navigation plan"),
+            );
+            for (finalizer, placement) in [
+                (Finalizer::Buffered, AuctionWaitPlacement::PreHeader),
+                (Finalizer::Streaming, AuctionWaitPlacement::InStream),
+            ] {
+                for mediator in [
+                    None,
+                    Some(Mediator::Immediate),
+                    Some(Mediator::FailBeforeStart),
+                    Some(Mediator::FailAfterStart),
+                    Some(Mediator::Pending),
+                ] {
+                    let launched =
+                        matches!(mediator, Some(Mediator::FailAfterStart | Mediator::Pending));
+                    let orchestrator = AuctionOrchestrator::from_plan(
+                        Arc::clone(&plan),
+                        mediator.map(|mediator| Arc::new(mediator) as Arc<dyn AuctionProvider>),
+                    );
+                    let stub = Arc::new(StubHttpClient::new());
+                    stub.set_streaming_responses_supported(true);
+                    queue_shareable_html(&stub);
+                    stub.push_response(204, Vec::new());
+                    let sink = Arc::new(RecordingTelemetrySink::default());
+                    let services = services_with_cache_and_telemetry(
+                        Arc::clone(&stub),
+                        Arc::new(MemoryTemplateCache::default()),
+                        Arc::clone(&sink),
+                    );
+                    let mut request = navigation_request();
+                    let timings = RequestTimings::new();
+                    request.extensions_mut().insert(timings.handle().clone());
+
+                    let response = run_with_orchestrator(
+                        &settings,
+                        &services,
+                        request,
+                        orchestrator,
+                        finalizer,
+                    )
+                    .await;
+                    if matches!(finalizer, Finalizer::Streaming) {
+                        assert!(
+                            response.body().is_stream(),
+                            "should return a lazy response body"
+                        );
+                        let before_poll = timings.snapshot();
+                        assert_eq!(
+                            before_poll.auction_wait_ms, None,
+                            "should not collect before the lazy body is polled"
+                        );
+                        assert_eq!(
+                            before_poll.auction_resolved_ms, None,
+                            "should not resolve before the lazy body is polled"
+                        );
+                        assert_eq!(
+                            stub.recorded_request_uris(),
+                            // Keep the host aligned with the shared settings fixture.
+                            vec!["https://origin.test-publisher.com/article"], // allow-domain: origin.test-publisher.com
+                            "should defer the mediator request until the lazy body is polled"
+                        );
+                    }
+                    let _ = body_of(response).await;
+                    let summary = last_summary_row(&sink)
+                        .expect("should emit a summary for the routing-only dispatch");
+                    assert_eq!(summary.terminal_status.as_deref(), Some("completed"));
+                    assert_eq!(
+                        timings
+                            .snapshot()
+                            .auction_id
+                            .map(|id| id.to_string())
+                            .as_deref(),
+                        Some(summary.auction_id.as_str()),
+                        "should join the routing-only dispatch to its navigation summary"
+                    );
+                    let snapshot = timings.snapshot();
+                    assert!(
+                        snapshot.auction_dispatched_ms.is_none(),
+                        "must not fabricate provider dispatch for a mediator launched during collection"
+                    );
+                    assert_eq!(
+                        snapshot.auction_resolved_ms.is_some(),
+                        launched,
+                        "{mediator:?}"
+                    );
+                    assert_eq!(
+                        snapshot.auction_committed_ms.is_some(),
+                        launched,
+                        "{mediator:?}"
+                    );
+                    assert_eq!(snapshot.auction_wait_ms.is_some(), launched, "{mediator:?}");
+                    assert_eq!(
+                        snapshot.auction_wait_placement,
+                        launched.then_some(placement)
+                    );
+                    let expected = if launched {
+                        vec![
+                            // Keep the host aligned with the shared settings fixture.
+                            "https://origin.test-publisher.com/article", // allow-domain: origin.test-publisher.com
+                            "https://mediator.example.com/auction",
+                        ]
+                    } else {
+                        // Keep the host aligned with the shared settings fixture.
+                        vec!["https://origin.test-publisher.com/article"] // allow-domain: origin.test-publisher.com
+                    };
+                    assert_eq!(stub.recorded_request_uris(), expected, "{mediator:?}");
+                }
+            }
+        }
+
+        #[tokio::test]
+        async fn failed_navigation_joins_summary_without_launch_milestones() {
+            let stub = Arc::new(StubHttpClient::new());
+            let sink = Arc::new(RecordingTelemetrySink::default());
+            let services = services_with_cache_and_telemetry(
+                Arc::clone(&stub),
+                Arc::new(MemoryTemplateCache::default()),
+                Arc::clone(&sink),
+            );
+            let settings = Arc::new(settings_with_bidder("esi"));
+            queue_shareable_html(&stub);
+            let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            orchestrator.register_provider(Arc::new(FailingNavigationProvider));
+            let mut request = navigation_request();
+            let timings = RequestTimings::new();
+            request.extensions_mut().insert(timings.handle().clone());
+
+            let response = run_with_orchestrator(
+                &settings,
+                &services,
+                request,
+                orchestrator,
+                Finalizer::Streaming,
+            )
+            .await;
+            let _ = body_of(response).await;
+            let summary = last_summary_row(&sink)
+                .expect("should emit a dispatch-failed summary for failed navigation");
+            assert_eq!(summary.terminal_reason.as_deref(), Some("dispatch_failed"));
+            assert_eq!(
+                timings
+                    .snapshot()
+                    .auction_id
+                    .map(|id| id.to_string())
+                    .as_deref(),
+                Some(summary.auction_id.as_str()),
+                "should join the enabled failed navigation to its summary"
+            );
+            assert!(timings.snapshot().auction_dispatched_ms.is_none());
+            assert!(timings.snapshot().auction_resolved_ms.is_none());
+            assert!(timings.snapshot().auction_committed_ms.is_none());
+        }
+
         #[tokio::test]
         async fn harness_emits_a_summary_row_for_an_ad_serving_navigation() {
             let stub = Arc::new(StubHttpClient::new());
@@ -12750,15 +14145,30 @@ mod tests {
                 Arc::new(MemoryTemplateCache::default()),
                 Arc::clone(&sink),
             );
-            let settings = Arc::new(settings_with_mode("esi"));
+            let settings = Arc::new(settings_with_bidder("esi"));
+            queue_bid_response(&stub);
             queue_shareable_html(&stub);
+            let mut request = navigation_request();
+            let timings = RequestTimings::new();
+            request.extensions_mut().insert(timings.handle().clone());
 
-            let _ = run(&settings, &services, navigation_request()).await;
-
-            assert!(
-                last_summary_row(&sink).is_some(),
-                "the harness must emit a summary row, or every assertion built on it is vacuous"
+            let response = run_bidding(&settings, &services, request).await;
+            let _ = body_of(response).await;
+            let summary = last_summary_row(&sink)
+                .expect("should emit a summary row for the navigation handler");
+            assert_eq!(
+                timings
+                    .snapshot()
+                    .auction_id
+                    .map(|id| id.to_string())
+                    .as_deref(),
+                Some(summary.auction_id.as_str()),
+                "the installed navigation collector must join its summary row"
             );
+            let snapshot = timings.snapshot();
+            assert!(snapshot.auction_dispatched_ms.is_some());
+            assert!(snapshot.auction_resolved_ms.is_some());
+            assert!(snapshot.auction_committed_ms.is_some());
         }
 
         /// Drive `handle_publisher_request` through the **EC-preload** fetch path.
@@ -13454,6 +14864,108 @@ mod tests {
             );
         }
 
+        #[tokio::test]
+        async fn template_cache_response_extension_matches_the_header_on_every_transition() {
+            // The typed extension and the `x-ts-template-cache` header are written
+            // together by a single setter, so they must always agree — access
+            // telemetry reads the extension precisely because it cannot drift from
+            // what an operator-configured header override might otherwise show.
+            let stub = Arc::new(StubHttpClient::new());
+            let cache = Arc::new(MemoryTemplateCache::default());
+            let settings = Arc::new(settings_with_mode("esi"));
+            let services = services(Arc::clone(&stub), Arc::clone(&cache));
+
+            queue_shareable_html(&stub);
+
+            let cold = run(&settings, &services, navigation_request()).await;
+            let cold_header = cold
+                .headers()
+                .get(HEADER_X_TS_TEMPLATE_CACHE)
+                .and_then(|value| value.to_str().ok())
+                .map(str::to_owned);
+            let cold_extension = cold
+                .extensions()
+                .get::<TemplateCacheResponseState>()
+                .map(|state| state.as_str());
+            assert_eq!(
+                cold_extension,
+                cold_header.as_deref(),
+                "the cold-fill extension must match the header"
+            );
+            assert_eq!(cold_extension, Some("miss-stored"));
+
+            let warm = run(&settings, &services, navigation_request()).await;
+            let warm_header = warm
+                .headers()
+                .get(HEADER_X_TS_TEMPLATE_CACHE)
+                .and_then(|value| value.to_str().ok())
+                .map(str::to_owned);
+            let warm_extension = warm
+                .extensions()
+                .get::<TemplateCacheResponseState>()
+                .map(|state| state.as_str());
+            assert_eq!(
+                warm_extension,
+                warm_header.as_deref(),
+                "the warm-hit extension must match the header"
+            );
+            assert_eq!(warm_extension, Some("hit"));
+        }
+
+        #[tokio::test]
+        async fn template_cache_span_recorded_only_when_lookup_runs() {
+            // Inline mode: no shared-cache key is ever computed, so the lookup
+            // never runs and the span is never recorded.
+            let inline_settings = create_test_settings();
+            let inline_stub = Arc::new(StubHttpClient::new());
+            inline_stub.push_response_with_headers(
+                200,
+                b"<html><head></head><body>origin</body></html>".to_vec(),
+                vec![(header::CONTENT_TYPE.as_str(), "text/html; charset=utf-8")],
+            );
+            let inline_services = build_services_with_http_client(
+                inline_stub as Arc<dyn crate::platform::PlatformHttpClient>,
+            );
+            let mut inline_request = HttpRequest::builder()
+                .method(Method::GET)
+                .uri("https://publisher.example/some-page")
+                .header(header::HOST, "publisher.example")
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            let inline_timings = RequestTimings::new();
+            inline_request
+                .extensions_mut()
+                .insert(inline_timings.handle().clone());
+
+            let _inline_response =
+                run_publisher_proxy(&inline_settings, &inline_services, inline_request).await;
+
+            inline_timings.mark_headers_ready();
+            assert!(
+                inline_timings.snapshot().template_cache_ms.is_none(),
+                "inline mode should never run the template-cache lookup"
+            );
+
+            // Shared-mode eligible: a matched slot plus a template-cache-eligible
+            // assembly mode compute a cache key, so the lookup runs and is timed.
+            let stub = Arc::new(StubHttpClient::new());
+            let cache = Arc::new(MemoryTemplateCache::default());
+            let settings = Arc::new(settings_with_mode("esi"));
+            let services = services(Arc::clone(&stub), Arc::clone(&cache));
+            queue_shareable_html(&stub);
+            let mut request = navigation_request();
+            let timings = RequestTimings::new();
+            request.extensions_mut().insert(timings.handle().clone());
+
+            let _response = run(&settings, &services, request).await;
+
+            timings.mark_headers_ready();
+            assert!(
+                timings.snapshot().template_cache_ms.is_some(),
+                "a shared-cache-eligible request should record the TemplateCacheLookup span"
+            );
+        }
+
         #[tokio::test]
         async fn a_pass_through_authorization_never_reaches_the_shared_template() {
             let stub = Arc::new(StubHttpClient::new());
@@ -13650,7 +15162,7 @@ mod tests {
             queue_shareable_html(&stub);
 
             for (index, cache_status) in ["miss-stored", "hit"].into_iter().enumerate() {
-                let mut ec_context = EcContext::new_for_test_with_ip(
+                let mut ec_context = EcContext::new_writer_for_test_with_ip(
                     Some(format!("{}.CkId01", "b".repeat(64))),
                     scheduling_consent(),
                     Some("203.0.113.7".to_owned()),
@@ -19810,6 +21322,16 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
         #[derive(Default)]
         struct RecordingTelemetrySink {
             batches: Mutex<Vec<AuctionEventBatch>>,
+            delay: std::time::Duration,
+        }
+
+        impl RecordingTelemetrySink {
+            fn with_delay(delay: std::time::Duration) -> Self {
+                Self {
+                    batches: Mutex::new(Vec::new()),
+                    delay,
+                }
+            }
         }
 
         #[async_trait::async_trait(?Send)]
@@ -19819,6 +21341,9 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 _services: &RuntimeServices,
                 batch: AuctionEventBatch,
             ) -> Result<(), Report<TrustedServerError>> {
+                if !self.delay.is_zero() {
+                    tokio::time::sleep(self.delay).await;
+                }
                 self.batches
                     .lock()
                     .expect("should lock telemetry batches")
@@ -20044,12 +21569,23 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 .map(|(_, value)| value.as_str())
         }
 
+        /// A returning visitor's writer navigation, which phase 1 reads.
         fn active_ec_context() -> EcContext {
-            EcContext::new_for_test_with_ip(
+            let mut context = EcContext::new_writer_for_test_with_ip(
                 Some(format!("{}.CkId01", "b".repeat(64))),
                 scheduling_consent(),
                 Some("203.0.113.7".to_owned()),
-            )
+            );
+            context.identity_mut().set_writer_decision(
+                crate::ec::identity::request::WriterDecision {
+                    writer: true,
+                    is_real_browser: true,
+                    user_agent: None,
+                    dnt: false,
+                    page_url: None,
+                },
+            );
+            context
         }
 
         #[tokio::test]
@@ -20057,7 +21593,8 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             let settings = settings_with_dispatching_provider();
             let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
             orchestrator.register_provider(Arc::new(DispatchingTestProvider));
-            let telemetry_sink = Arc::new(RecordingTelemetrySink::default());
+            let telemetry_delay = std::time::Duration::from_millis(250);
+            let telemetry_sink = Arc::new(RecordingTelemetrySink::with_delay(telemetry_delay));
             let stub = Arc::new(StubHttpClient::new());
             stub.set_streaming_responses_supported(true);
             stub.set_pending_streaming_responses_supported(true);
@@ -20071,6 +21608,10 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             let graph = KvIdentityGraph::new(InMemoryEcKv::new("wait-error-store"));
             let mut ec_context = active_ec_context();
             let slots = [article_slot()];
+            let mut request = conditional_navigation_request();
+            let timings = RequestTimings::new();
+            request.extensions_mut().insert(timings.handle().clone());
+            let started = std::time::Instant::now();
 
             let error = match handle_publisher_request(
                 &settings,
@@ -20083,7 +21624,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                     slots: &slots,
                     registry: None,
                 },
-                conditional_navigation_request(),
+                request,
                 EdgeCacheHeader::SurrogateControl,
             )
             .await
@@ -20117,7 +21658,21 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             );
             assert_eq!(
                 summaries[0].publisher_domain, settings.publisher.domain,
-                "reordered path should retain configured publisher attribution"
+                "should retain configured publisher attribution"
+            );
+            drop(batches);
+            let elapsed_ms = started.elapsed().as_millis() as u64;
+            assert!(elapsed_ms >= telemetry_delay.as_millis() as u64);
+            timings.mark_headers_ready();
+            let origin_ms = u64::from(
+                timings
+                    .snapshot()
+                    .origin_ms
+                    .expect("should record origin timing before abandonment telemetry"),
+            );
+            assert!(
+                origin_ms + telemetry_delay.as_millis() as u64 / 2 < elapsed_ms,
+                "origin span must exclude the deliberately slow abandonment sink: origin={origin_ms}ms total={elapsed_ms}ms"
             );
         }
 
@@ -21286,7 +22841,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             ..Default::default()
         };
         let mut ec_context =
-            EcContext::new_for_test_with_ip(None, consent, Some("203.0.113.7".to_string()));
+            EcContext::new_writer_for_test_with_ip(None, consent, Some("203.0.113.7".to_string()));
         assert!(
             ec_context.ec_allowed(),
             "test precondition: consent must allow EC creation"
@@ -21788,6 +23343,8 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 services: &services,
                 settings: &settings,
                 request_origin: String::new(),
+                timings: RequestTimings::new(),
+                placement: AuctionWaitPlacement::PreHeader,
             },
         };
         let mut output = Vec::new();
@@ -21864,6 +23421,8 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 services: &services,
                 settings: &settings,
                 request_origin: String::new(),
+                timings: RequestTimings::new(),
+                placement: AuctionWaitPlacement::InStream,
             },
         };
         let mut processor = RecordingProcessor {
@@ -21944,6 +23503,8 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                         services: &services,
                         settings: &settings,
                         request_origin: String::new(),
+                        timings: RequestTimings::new(),
+                        placement: AuctionWaitPlacement::InStream,
                     },
                 };
                 let mut processor = RecordingProcessor {
@@ -22038,6 +23599,8 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             services: &services,
             settings: &settings,
             request_origin: String::new(),
+            timings: RequestTimings::new(),
+            placement: AuctionWaitPlacement::PreHeader,
         };
         // Passthrough processor: the ordering contract is about collection, not
         // HTML rewriting, so keep the emitted bytes verbatim.
@@ -23069,6 +24632,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
 
         let mut output = Vec::new();
@@ -23131,6 +24695,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
 
         let mut output = Vec::new();
@@ -23182,6 +24747,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
         let body = EdgeBody::from_stream(futures::stream::iter(vec![Ok::<_, io::Error>(
             bytes::Bytes::from_static(b"<html><body>live</body></html>"),
@@ -23311,6 +24877,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let body = EdgeBody::stream(futures::stream::iter(vec![
                 bytes::Bytes::from_static(b"body{background:url('https://origin.example.com/"),
@@ -23378,6 +24945,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let compressed =
                 gzip_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -23448,6 +25016,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let compressed =
                 deflate_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -23518,6 +25087,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let compressed =
                 brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -23588,6 +25158,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let compressed =
                 brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -23640,6 +25211,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         }
     }
 
@@ -23866,6 +25438,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let body = EdgeBody::stream(futures::stream::iter(vec![
                 bytes::Bytes::from_static(b"<html><head></head><body>hello"),
@@ -23944,6 +25517,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             // The `</body>` that triggers bid injection lives in the SECOND gzip
             // member. `flate2::read::GzDecoder` decodes only the first member, so
@@ -24021,6 +25595,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             };
             let body = EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
                 b"body{background:url('https://origin.example.com/asset.png')}",
@@ -24092,6 +25667,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
         let publisher_response = PublisherResponse::Stream {
             response,
@@ -24529,10 +26105,10 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             None,
             &mut EcContext::default(),
             AuctionDispatch {
+                integration_registry: &registry,
                 orchestrator: &orchestrator,
                 slots: &[],
                 registry: None,
-                integration_registry: &registry,
             },
             request,
             EdgeCacheHeader::SurrogateControl,
@@ -26059,6 +27635,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         }
     }
 
@@ -26782,6 +28359,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 gpt_diagnostics: None,
                 trace_bootstrap: None,
                 suppress_datadome_client_side_tag: false,
+                timings: RequestTimings::new(),
             }
         };
         let make_stream_response = || PublisherResponse::Stream {
@@ -26828,20 +28406,361 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
         assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
         assert_bodiless_abandoned(&streaming_sink);
 
-        // Buffered finalizer (Axum/Cloudflare/Spin).
-        let buffered_sink = Arc::new(RecordingTelemetrySink::default());
-        let buffered_services = noop_services_with_telemetry_sink(Arc::clone(&buffered_sink) as _);
+        // Buffered finalizer (Axum/Cloudflare/Spin).
+        let buffered_sink = Arc::new(RecordingTelemetrySink::default());
+        let buffered_services = noop_services_with_telemetry_sink(Arc::clone(&buffered_sink) as _);
+        let response = futures::executor::block_on(buffer_publisher_response_async(
+            make_stream_response(),
+            &Method::GET,
+            settings.as_ref(),
+            &registry,
+            orchestrator.as_ref(),
+            &buffered_services,
+        ))
+        .expect("buffered finalize should succeed");
+        assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
+        assert_bodiless_abandoned(&buffered_sink);
+    }
+
+    #[test]
+    fn streaming_seam_wait_records_in_stream_placement() {
+        // The true Fastly streaming path: `publisher_response_into_streaming_response`
+        // hands back a lazy body after headers have already been committed by
+        // `stream_to_client()`. The `</body>` seam wait polled from inside that body
+        // must therefore be attributed `InStream`, never `PreHeader`.
+        let settings = Arc::new(create_test_settings());
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
+        let timings = RequestTimings::new();
+
+        let mut params = make_stream_params(&settings, "");
+        params.content_type = "text/html; charset=utf-8".to_string();
+        params.dispatched_auction = Some(DispatchedAuction::launched_no_bid_for_test(
+            test_auction_request(),
+            500,
+        ));
+        params.auction_request = Some(test_auction_request());
+        params.timings = timings.clone();
+
+        let response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        let body = EdgeBody::stream(futures::stream::iter(vec![
+            bytes::Bytes::from_static(b"<html><head></head><body>hello"),
+            bytes::Bytes::from_static(b"</body></html>"),
+        ]));
+
+        let response = futures::executor::block_on(publisher_response_into_streaming_response(
+            PublisherResponse::Stream {
+                response,
+                body,
+                params: Box::new(params),
+            },
+            &Method::GET,
+            Arc::clone(&settings),
+            &registry,
+            Arc::clone(&orchestrator),
+            noop_services(),
+        ))
+        .expect("streaming finalize should succeed");
+
+        // The wait is only recorded once the lazy body is actually polled — the
+        // finalizer call above only constructs it.
+        let drained = futures::executor::block_on(
+            response
+                .into_body()
+                .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
+        )
+        .expect("body should drain");
+        assert!(
+            String::from_utf8_lossy(&drained).contains("hello"),
+            "should still stream the document"
+        );
+
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::InStream),
+            "the streaming seam wait must be attributed InStream"
+        );
+        assert!(
+            snapshot.auction_wait_ms.is_some(),
+            "should record an auction wait duration"
+        );
+        // The T0 marks are recorded at this same collect site, so a collect
+        // path that stops calling them fails here rather than silently
+        // emitting null columns.
+        assert!(
+            snapshot.auction_resolved_ms.is_some(),
+            "should mark the auction resolved at the streaming collect site"
+        );
+        assert!(
+            snapshot.auction_committed_ms.is_some(),
+            "should mark the auction committed at the streaming collect site"
+        );
+    }
+
+    #[test]
+    fn template_hit_streaming_finalizer_records_in_stream_placement() {
+        let settings = Arc::new(create_test_settings());
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
+        let timings = RequestTimings::new();
+        let mut params = make_stream_params(&settings, "");
+        params.dispatched_auction = Some(DispatchedAuction::launched_no_bid_for_test(
+            test_auction_request(),
+            500,
+        ));
+        params.auction_request = Some(test_auction_request());
+        params.timings = timings.clone();
+        let response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .body(EdgeBody::empty())
+            .expect("should build template-hit response");
+        let template = format!("<html><body>cached{}</body></html>", AD_ASSEMBLY_SEAM).into_bytes();
+        let response = futures::executor::block_on(publisher_response_into_streaming_response(
+            PublisherResponse::AssembleTemplate {
+                response,
+                template,
+                params: Box::new(params),
+            },
+            &Method::GET,
+            Arc::clone(&settings),
+            &registry,
+            Arc::clone(&orchestrator),
+            noop_services(),
+        ))
+        .expect("should build lazy template-hit response");
+        let body = futures::executor::block_on(
+            response
+                .into_body()
+                .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
+        )
+        .expect("should drain the template-hit body");
+        assert!(
+            !String::from_utf8_lossy(&body).contains(AD_ASSEMBLY_SEAM),
+            "should replace the cached template seam while streaming"
+        );
+
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::InStream),
+            "should attribute the template-hit wait to the committed stream"
+        );
+        assert!(snapshot.auction_resolved_ms.is_some());
+        assert!(snapshot.auction_committed_ms.is_some());
+    }
+
+    #[test]
+    fn streamed_non_html_auction_wait_records_in_stream_placement() {
+        let settings = Arc::new(create_test_settings());
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let orchestrator = Arc::new(AuctionOrchestrator::new(settings.auction.clone()));
+        let timings = RequestTimings::new();
+        let mut params = make_stream_params(&settings, "");
+        params.dispatched_auction = Some(DispatchedAuction::launched_no_bid_for_test(
+            test_auction_request(),
+            500,
+        ));
+        params.auction_request = Some(test_auction_request());
+        params.timings = timings.clone();
+        let response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "application/json")
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        let body = EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
+            b"{\"ok\":true}",
+        )]));
+
+        let response = futures::executor::block_on(publisher_response_into_streaming_response(
+            PublisherResponse::Stream {
+                response,
+                body,
+                params: Box::new(params),
+            },
+            &Method::GET,
+            Arc::clone(&settings),
+            &registry,
+            Arc::clone(&orchestrator),
+            noop_services(),
+        ))
+        .expect("streaming finalize should succeed");
+        let _ = futures::executor::block_on(
+            response
+                .into_body()
+                .into_bytes_bounded(settings.publisher.max_buffered_body_bytes),
+        )
+        .expect("non-HTML body should drain");
+
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::InStream)
+        );
+        assert!(snapshot.auction_resolved_ms.is_some());
+        assert!(snapshot.auction_committed_ms.is_some());
+    }
+
+    #[test]
+    fn empty_collector_tokens_do_not_mark_resolved_or_committed() {
+        let settings = create_test_settings();
+        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+        let services = noop_services();
+        let request = test_auction_request();
+        let streamed_timings = RequestTimings::new();
+        let state = AdBidsState::default();
+        let deps = AuctionCollectDeps {
+            price_granularity: PriceGranularity::default(),
+            ad_bids_state: &state,
+            orchestrator: &orchestrator,
+            services: &services,
+            settings: &settings,
+            request_origin: String::new(),
+            timings: streamed_timings.clone(),
+            placement: AuctionWaitPlacement::InStream,
+        };
+        futures::executor::block_on(collect_stream_auction(
+            DispatchedAuction::empty_for_test(request.clone(), 10),
+            AuctionTelemetryCarry {
+                observation: None,
+                auction_request: None,
+            },
+            &deps,
+        ));
+        let streamed = streamed_timings.snapshot();
+        assert!(streamed.auction_resolved_ms.is_none());
+        assert!(streamed.auction_committed_ms.is_none());
+        assert_eq!(
+            streamed.auction_wait_ms, None,
+            "should leave empty stream collection untimed"
+        );
+        assert_eq!(
+            streamed.auction_wait_placement, None,
+            "should omit empty stream wait placement"
+        );
+
+        for placement in [
+            AuctionWaitPlacement::PreHeader,
+            AuctionWaitPlacement::InStream,
+        ] {
+            let mut params = make_stream_params(&settings, "");
+            params.timings = RequestTimings::new();
+            let buffered_timings = params.timings.clone();
+            futures::executor::block_on(collect_non_html_auction(
+                DispatchedAuction::empty_for_test(request.clone(), 10),
+                AuctionTelemetryCarry {
+                    observation: None,
+                    auction_request: None,
+                },
+                &params,
+                &orchestrator,
+                &services,
+                &settings,
+                placement,
+            ));
+            let buffered = buffered_timings.snapshot();
+            assert!(buffered.auction_resolved_ms.is_none());
+            assert!(buffered.auction_committed_ms.is_none());
+            assert_eq!(
+                buffered.auction_wait_ms, None,
+                "should leave empty non-HTML collection untimed"
+            );
+            assert_eq!(
+                buffered.auction_wait_placement, None,
+                "should omit empty non-HTML wait placement"
+            );
+        }
+    }
+
+    #[test]
+    fn buffered_template_miss_records_pre_header_placement() {
+        // The buffered finalizer materializes the entire response — headers and
+        // body — before any of it reaches the client. Even though the wait runs
+        // through the same `</body>` seam code path as the streaming finalizer
+        // above, headers have not committed here, so it must be attributed
+        // `PreHeader`. (This exercises the same collect step a shared-template
+        // authorized miss rides through: `template_cache_key`'s presence only
+        // changes what happens *after* collection — whether the transformed bytes
+        // are stored — not where the wait itself is measured.)
+        let settings = create_test_settings();
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+        let services = noop_services();
+        let timings = RequestTimings::new();
+
+        let mut params = make_stream_params(&settings, "");
+        params.content_type = "text/html; charset=utf-8".to_string();
+        params.dispatched_auction = Some(DispatchedAuction::launched_no_bid_for_test(
+            test_auction_request(),
+            500,
+        ));
+        params.auction_request = Some(test_auction_request());
+        params.timings = timings.clone();
+
+        let response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .body(EdgeBody::empty())
+            .expect("should build response");
+        let body = EdgeBody::stream(futures::stream::iter(vec![
+            bytes::Bytes::from_static(b"<html><head></head><body>hello"),
+            bytes::Bytes::from_static(b"</body></html>"),
+        ]));
+
         let response = futures::executor::block_on(buffer_publisher_response_async(
-            make_stream_response(),
+            PublisherResponse::Stream {
+                response,
+                body,
+                params: Box::new(params),
+            },
             &Method::GET,
-            settings.as_ref(),
+            &settings,
             &registry,
-            orchestrator.as_ref(),
-            &buffered_services,
+            &orchestrator,
+            &services,
         ))
         .expect("buffered finalize should succeed");
-        assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
-        assert_bodiless_abandoned(&buffered_sink);
+
+        let html = String::from_utf8(
+            response
+                .into_body()
+                .into_bytes()
+                .unwrap_or_default()
+                .to_vec(),
+        )
+        .expect("should be valid UTF-8");
+        assert!(html.contains("hello"), "should still assemble the document");
+
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::PreHeader),
+            "the buffered finalizer's wait must be attributed PreHeader even though \
+             it shares the </body> seam code path with the streaming finalizer"
+        );
+        assert!(
+            snapshot.auction_wait_ms.is_some(),
+            "should record an auction wait duration"
+        );
+        // Same guard as the streaming test: both collect sites must mark, or
+        // one body mode quietly reports null offsets.
+        assert!(
+            snapshot.auction_resolved_ms.is_some(),
+            "should mark the auction resolved at the buffered collect site"
+        );
+        assert!(
+            snapshot.auction_committed_ms.is_some(),
+            "should mark the auction committed at the buffered collect site"
+        );
     }
 
     #[test]
@@ -26976,6 +28895,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
         let publisher_response = PublisherResponse::Stream {
             response,
@@ -27057,6 +28977,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
         let mut output = Vec::new();
 
@@ -27121,6 +29042,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
 
         let bogus_body = EdgeBody::from(b"<html>not gzip</html>".to_vec());
@@ -27242,6 +29164,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
         let mut output = Vec::new();
         stream_publisher_body(body, &mut output, &params, &settings, &registry)
@@ -27312,6 +29235,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             gpt_diagnostics: None,
             trace_bootstrap: None,
             suppress_datadome_client_side_tag: false,
+            timings: RequestTimings::new(),
         };
 
         let mut output = Vec::new();
@@ -27342,10 +29266,11 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
     #[cfg(test)]
     mod creative_opportunities_tests {
         use super::super::{
-            AdBidsState, MatchedSlotsContext, build_ad_slots_script, build_auction_request,
-            build_bid_map, build_bids_script, diagnostics_auction_id, html_escape_for_script,
-            write_bids_to_state,
+            AdBidsState, BrowserAuctionDiagnostics, MatchedSlotsContext, build_ad_slots_script,
+            build_auction_request, build_bid_map, build_bids_script, diagnostics_auction_id,
+            html_escape_for_script, write_bids_to_state,
         };
+        use super::test_auction_request;
         use crate::auction::types::{ApsRendererV1, ApsTagType, Bid, BidRenderer, MediaType};
         use crate::consent::ConsentContext;
         use crate::creative_opportunities::{
@@ -27353,8 +29278,11 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
         };
         use crate::http_util::RequestInfo;
         use crate::price_bucket::PriceGranularity;
+        use crate::request_timing::{AuctionWaitPlacement, RequestTimings};
         use crate::settings::Settings;
+        use crate::trace::{TraceAuctionCarry, TraceAuctionSource, TraceAuctionTerminalStatus};
         use std::collections::HashMap;
+        use std::time::Duration;
 
         // Default settings are enough for the creative boundary: the sanitize
         // pass needs no config, and `rewrite_creative_html` only signs URLs it
@@ -28736,6 +30664,168 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             );
         }
 
+        #[test]
+        fn active_diagnostics_hands_auction_timing_to_the_generation_guarded_scheduler() {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.record_auction_wait(AuctionWaitPlacement::InStream, Duration::from_millis(12));
+            timings.mark_auction_resolved();
+            timings.mark_auction_committed();
+            let state = AdBidsState::with_diagnostics(true, true);
+            state.set(serde_json::Map::new());
+
+            state.set_auction_diagnostics(&timings);
+
+            let script = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render bid script");
+            assert!(script.contains("s(b,void 0,void 0,d)"));
+            assert!(script.contains("auctionDispatchedMs"));
+            assert!(script.contains("auctionResolvedMs"));
+            assert!(script.contains("auctionCommittedMs"));
+            assert!(script.contains("auctionWaitMs"));
+            assert!(script.contains("in_stream"));
+        }
+
+        #[test]
+        fn timing_updates_preserve_trace_transport_in_both_scheduler_seams() {
+            let trace = TraceAuctionCarry::capture_if_enabled(
+                true,
+                TraceAuctionSource::InitialNavigationSsat,
+                &test_auction_request().slots,
+            )
+            .expect("should capture the enabled auction");
+            trace.finish(TraceAuctionTerminalStatus::Completed, None);
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.record_auction_wait(AuctionWaitPlacement::InStream, Duration::ZERO);
+            timings.mark_auction_resolved();
+            timings.mark_auction_committed();
+            let mut state = AdBidsState::with_diagnostics(true, true);
+            state.attach_trace(trace);
+            state.set_auction_diagnostics(&timings);
+            state.prepend_to_script("<!-- auction debug -->");
+
+            let inline = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render bid script");
+            let shared = state.build_seam_script("[]");
+            for (script, scheduler) in [(&inline, "s(b,void 0,x,d)"), (&shared, "s(b,a,x,d)")] {
+                assert!(
+                    script.contains(scheduler),
+                    "should carry both scheduler payloads"
+                );
+                assert!(
+                    script.contains("terminal_status"),
+                    "should retain trace transport"
+                );
+                assert!(
+                    script.contains("auctionWaitMs"),
+                    "should retain measured timing"
+                );
+                assert!(script.starts_with("<!-- auction debug -->"));
+            }
+        }
+
+        #[test]
+        fn timing_updates_cannot_reenable_withheld_ad_initialization() {
+            let trace = TraceAuctionCarry::capture_if_enabled(
+                true,
+                TraceAuctionSource::InitialNavigationSsat,
+                &test_auction_request().slots,
+            )
+            .expect("should capture the enabled auction");
+            trace.finish(TraceAuctionTerminalStatus::Completed, None);
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.mark_auction_resolved();
+            let mut state = AdBidsState::with_diagnostics(true, true);
+            state.attach_trace(trace);
+            state.withhold_ad_initialization();
+
+            state.set_auction_diagnostics(&timings);
+
+            let script = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render trace-only script");
+            assert!(
+                script.contains("observeTransport"),
+                "should keep trace observation"
+            );
+            assert!(
+                !script.contains("scheduleInitialAdInit"),
+                "should not initialize withheld ads"
+            );
+            assert!(
+                !script.contains("auctionDiagnostics"),
+                "should keep the trace-only seam"
+            );
+        }
+
+        #[test]
+        fn browser_auction_diagnostics_preserve_measured_zero_wait_instead_of_offset_difference() {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            std::thread::sleep(Duration::from_millis(5));
+            timings.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::ZERO);
+            timings.mark_auction_resolved();
+            let diagnostics = BrowserAuctionDiagnostics::from_request_timings(&timings)
+                .expect("should expose measured auction timing");
+            assert_eq!(diagnostics.auction_wait_ms, Some(0));
+            assert_eq!(diagnostics.auction_wait_placement, Some("pre_header"));
+            assert!(diagnostics.auction_resolved_ms > diagnostics.auction_dispatched_ms);
+        }
+
+        #[test]
+        fn active_diagnostics_without_attached_collector_omits_auction_timing() {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.mark_auction_resolved();
+            let state = AdBidsState::with_diagnostics(true, false);
+            state.set(serde_json::Map::new());
+
+            state.set_auction_diagnostics(&timings);
+
+            let script = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render bid script");
+            assert!(!script.contains("auctionDispatchedMs"));
+            assert!(!script.contains("auctionResolvedMs"));
+        }
+
+        #[test]
+        fn inactive_diagnostics_omits_auction_timing_from_the_bid_script() {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.mark_auction_resolved();
+            timings.mark_auction_committed();
+            let state = AdBidsState::default();
+            state.set(serde_json::Map::new());
+
+            state.set_auction_diagnostics(&timings);
+
+            let script = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render bid script");
+            assert!(!script.contains("auctionDiagnostics"));
+            assert!(!script.contains("auctionDispatchedMs"));
+        }
+
         #[test]
         fn bids_script_defers_ad_init_until_after_hydration() {
             let mut map = serde_json::Map::new();
@@ -28988,12 +31078,14 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
         use super::super::*;
         use super::build_services_with_http_client;
         use crate::auction::AuctionOrchestrator;
+        use crate::auction::provider::test_support::LaunchEvidenceProvider as Mediator;
         use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
         use crate::auction::types::{AuctionRequest, AuctionResponse, Bid};
         use crate::creative_opportunities::{CreativeOpportunityFormat, CreativeOpportunitySlot};
         use crate::platform::test_support::{StubHttpClient, noop_services};
         use crate::platform::{PlatformHttpRequest, PlatformResponse};
         use crate::test_support::tests::crate_test_settings_str;
+        use base64::Engine as _;
         use error_stack::{Report, ResultExt};
         use http::Method;
         use std::sync::{Arc, Mutex};
@@ -29153,37 +31245,354 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 .expect("should be json")
         }
 
-        /// Builds an [`EcContext`] whose consent context permits the server-side
-        /// auction (known non-GDPR jurisdiction, no EU TCF signal).
-        fn consent_allowing_ec_context() -> EcContext {
-            let consent = crate::consent::ConsentContext {
+        /// Builds an [`EcContext`] whose consent context permits the server-side
+        /// auction (known non-GDPR jurisdiction, no EU TCF signal).
+        fn consent_allowing_ec_context() -> EcContext {
+            let consent = crate::consent::ConsentContext {
+                jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                ..Default::default()
+            };
+            EcContext::new_for_test(None, consent)
+        }
+
+        fn article_slot() -> Vec<CreativeOpportunitySlot> {
+            vec![CreativeOpportunitySlot {
+                id: "atf".to_string(),
+                gam_unit_path: None,
+                div_id: None,
+                page_patterns: vec!["/20**".to_string()],
+                formats: vec![CreativeOpportunityFormat {
+                    width: 300,
+                    height: 250,
+                    media_type: crate::auction::types::MediaType::Banner,
+                }],
+                floor_price: Some(0.50),
+                targeting: Default::default(),
+                providers: Default::default(),
+                compiled_patterns: Vec::new(),
+                compiled_unit: None,
+            }]
+        }
+
+        fn make_page_bids_request(path: &str) -> Request<EdgeBody> {
+            make_page_bids_request_on(PAGE_BIDS_PATH, path)
+        }
+
+        fn make_active_page_bids_request(path: &str) -> Request<EdgeBody> {
+            let mut req = make_page_bids_request(path);
+            set_test_header(&mut req, "cookie", "__Host-ts-console=1");
+            req
+        }
+
+        const MIRROR_SOURCE: &str = "mirror.example.com";
+
+        fn mirror_registry() -> PartnerRegistry {
+            let mut partner = crate::ec::identity::test_support::ec_partner(
+                MIRROR_SOURCE,
+                "https://sync.mirror.example.com/pull",
+                "example-token-value-0123456789abcdef",
+            );
+            partner.pull_sync_enabled = false;
+            partner.pull_sync_url = None;
+            partner.pull_sync_allowed_domains = Vec::new();
+            partner.ts_pull_token = None;
+            partner.api_token = Some(crate::redacted::Redacted::new(
+                "token-mirror-example-com-32-bytes-minimum".to_owned(),
+            ));
+            PartnerRegistry::from_config(&[partner]).expect("should build partner registry")
+        }
+
+        fn mirror_ec_id() -> String {
+            format!("{}.mirror", "a".repeat(64))
+        }
+
+        fn seeded_graph(records: &[(&str, &str)]) -> KvIdentityGraph {
+            let graph = KvIdentityGraph::in_memory("test_store");
+            let mut entry =
+                crate::ec::kv_types::KvEntry::minimal("unregistered.example.com", "x", 1);
+            entry.ids.clear();
+            for (source, uid) in records {
+                entry.ids.insert(
+                    (*source).to_owned(),
+                    crate::ec::kv_types::KvPartnerId::browser(*uid, Some(1)),
+                );
+            }
+            graph
+                .create(&mirror_ec_id(), &entry)
+                .expect("should seed the live row");
+            graph
+        }
+
+        fn consenting_context_with_ec() -> EcContext {
+            let mut context = EcContext::new_for_test(
+                Some(mirror_ec_id()),
+                crate::consent::ConsentContext {
+                    jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                    ..Default::default()
+                },
+            );
+            context.enable_mirror_for_test();
+            context
+        }
+
+        async fn page_bids_body(
+            settings: &Settings,
+            graph: &KvIdentityGraph,
+            ec_context: &mut EcContext,
+            req: Request<EdgeBody>,
+        ) -> serde_json::Value {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"no bid".to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            let orchestrator =
+                auction_id_test_orchestrator(settings, Arc::new(Mutex::new(None)), false);
+            let registry = mirror_registry();
+            let slots = article_slot();
+            let response = handle_page_bids(
+                settings,
+                &services,
+                Some(graph),
+                AuctionDispatch {
+                    integration_registry: &IntegrationRegistry::empty_for_tests(),
+                    orchestrator: &orchestrator,
+                    slots: &slots,
+                    registry: Some(&registry),
+                },
+                ec_context,
+                req,
+            )
+            .await
+            .expect("should return ok response");
+            serde_json::from_slice(
+                &response
+                    .into_body()
+                    .into_bytes()
+                    .expect("should read the page-bids body"),
+            )
+            .expect("should parse the page-bids body")
+        }
+
+        fn auction_settings() -> Settings {
+            let mut settings = settings_with_co();
+            settings.auction.providers =
+                crate::auction::AuctionConfig::legacy_provider_map(&[AUCTION_ID_TEST_PROVIDER]);
+            settings
+        }
+
+        #[tokio::test]
+        async fn page_bids_never_writes_kv() {
+            let settings = auction_settings();
+            let (graph, store) = KvIdentityGraph::write_counting("test_store");
+            let mut entry =
+                crate::ec::kv_types::KvEntry::minimal("unregistered.example.com", "x", 1);
+            entry.ids.clear();
+            graph
+                .create(&mirror_ec_id(), &entry)
+                .expect("should seed the live row");
+            store.reset_counts();
+            let cookie = base64::engine::general_purpose::STANDARD.encode(
+                serde_json::to_vec(&serde_json::json!([
+                    { "source": MIRROR_SOURCE, "uids": [{ "id": "cookie-uid" }] }
+                ]))
+                .expect("should serialize the cookie"),
+            );
+            let mut req = make_page_bids_request("/2024/01/my-article/");
+            req.headers_mut().insert(
+                header::COOKIE,
+                HeaderValue::from_str(&format!("ts-eids={cookie}"))
+                    .expect("should build the cookie header"),
+            );
+            let mut ec_context = consenting_context_with_ec();
+
+            let _ = page_bids_body(&settings, &graph, &mut ec_context, req).await;
+            let mut response = Response::new(EdgeBody::empty());
+            crate::ec::finalize::ec_finalize_response(
+                &settings,
+                &mut ec_context,
+                Some(&graph),
+                &mirror_registry(),
+                Some(&cookie),
+                None,
+                &mut response,
+            );
+
+            let writes = store.writes();
+            assert_eq!(
+                (writes.add, writes.if_generation_match, writes.overwrite),
+                (0, 0, 0),
+                "should write nothing to KV"
+            );
+            assert!(
+                ec_context.identity().mutation().is_empty(),
+                "should queue nothing for a writer"
+            );
+        }
+
+        #[tokio::test]
+        async fn page_bids_returns_the_mirror_payload() {
+            let settings = auction_settings();
+            let graph = seeded_graph(&[(MIRROR_SOURCE, "uid-mirror")]);
+            let mut ec_context = consenting_context_with_ec();
+
+            let body = page_bids_body(
+                &settings,
+                &graph,
+                &mut ec_context,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await;
+
+            let mirror = &body["ts_eids_s"];
+            let decoded: serde_json::Value = serde_json::from_slice(
+                &base64::engine::general_purpose::URL_SAFE_NO_PAD
+                    .decode(mirror["value"].as_str().expect("should hold a value"))
+                    .expect("should be unpadded base64url"),
+            )
+            .expect("should be JSON");
+            let atype = crate::settings::EcPartner::default_openrtb_atype();
+            assert_eq!(
+                decoded,
+                serde_json::json!({ "v": 1, "eids": [{
+                    "source": MIRROR_SOURCE,
+                    "uids": [{ "id": "uid-mirror", "atype": atype }]
+                }] }),
+                "should hold the servable record's EID"
+            );
+            assert_eq!(
+                mirror["max_age"], 86_400,
+                "should live a day without an exp"
+            );
+        }
+
+        #[tokio::test]
+        async fn page_bids_preserves_identity_mirror_alongside_trace_and_timings() {
+            let mut settings = auction_settings();
+            settings
+                .integrations
+                .insert_config(
+                    "gpt_diagnostics",
+                    &serde_json::json!({"enabled": true, "trace_page_enabled": true}),
+                )
+                .expect("should enable trace capture");
+            let settings = Arc::new(settings);
+            let graph = seeded_graph(&[(MIRROR_SOURCE, "uid-mirror")]);
+            let mut ec_context = consenting_context_with_ec();
+            let mut req = make_active_page_bids_request("/2024/01/my-article/");
+            let timings = RequestTimings::new();
+            req.extensions_mut().insert(timings.handle().clone());
+            let hook = crate::trace::TracePreDispatchHook::new(
+                Arc::clone(&settings),
+                Arc::new(|_| panic!("should not load SPA setup metadata")),
+            );
+            edgezero_core::router::PreDispatchHook::handle(&hook, &mut req)
+                .await
+                .expect("should freeze SPA trace gate");
+
+            let body = page_bids_body(&settings, &graph, &mut ec_context, req).await;
+
+            assert_eq!(
+                body["trace_auction"]["evidence"]["source"], "spa_page_bids",
+                "should retain trace alongside the identity mirror"
+            );
+            assert!(
+                body["ts_eids_s"]["value"].is_string(),
+                "should retain the live mirror alongside trace"
+            );
+            assert!(
+                body["auctionDiagnostics"].is_object(),
+                "should retain request-clock diagnostics alongside trace and identity"
+            );
+        }
+
+        #[tokio::test]
+        async fn page_bids_omits_the_mirror_while_it_is_disabled() {
+            let settings = auction_settings();
+            let graph = seeded_graph(&[(MIRROR_SOURCE, "uid-mirror")]);
+            let consent = |gdpr_applies| crate::consent::ConsentContext {
                 jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                gdpr_applies,
                 ..Default::default()
             };
-            EcContext::new_for_test(None, consent)
+            let mut granted = EcContext::new_for_test(Some(mirror_ec_id()), consent(false));
+            let mut denied = EcContext::new_for_test(Some(mirror_ec_id()), consent(true));
+
+            let granted_body = page_bids_body(
+                &settings,
+                &graph,
+                &mut granted,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await;
+            let denied_body = page_bids_body(
+                &settings,
+                &graph,
+                &mut denied,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await;
+
+            assert!(
+                granted_body.get("ts_eids_s").is_none(),
+                "should return no mirror value while the mirror is off"
+            );
+            assert!(
+                denied_body.get("ts_eids_s").is_none(),
+                "should return no mirror clear while the mirror is off"
+            );
         }
 
-        fn article_slot() -> Vec<CreativeOpportunitySlot> {
-            vec![CreativeOpportunitySlot {
-                id: "atf".to_string(),
-                gam_unit_path: None,
-                div_id: None,
-                page_patterns: vec!["/20**".to_string()],
-                formats: vec![CreativeOpportunityFormat {
-                    width: 300,
-                    height: 250,
-                    media_type: crate::auction::types::MediaType::Banner,
-                }],
-                floor_price: Some(0.50),
-                targeting: Default::default(),
-                providers: Default::default(),
-                compiled_patterns: Vec::new(),
-                compiled_unit: None,
-            }]
+        #[tokio::test]
+        async fn page_bids_clears_the_mirror_when_consent_denies_the_auction() {
+            let settings = auction_settings();
+            let graph = seeded_graph(&[(MIRROR_SOURCE, "uid-mirror")]);
+            // GDPR applies without a TC string: EC use stays allowed outside a
+            // GDPR jurisdiction, but the server-side auction gate denies.
+            let mut ec_context = EcContext::new_for_test(
+                Some(mirror_ec_id()),
+                crate::consent::ConsentContext {
+                    jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                    gdpr_applies: true,
+                    ..Default::default()
+                },
+            );
+            ec_context.enable_mirror_for_test();
+            assert!(ec_context.ec_allowed(), "should allow EC use");
+
+            let body = page_bids_body(
+                &settings,
+                &graph,
+                &mut ec_context,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await;
+
+            assert_eq!(
+                body["ts_eids_s"],
+                serde_json::json!({ "clear": true }),
+                "should clear the mirror as /auction does on a consent denial"
+            );
         }
 
-        fn make_page_bids_request(path: &str) -> Request<EdgeBody> {
-            make_page_bids_request_on(PAGE_BIDS_PATH, path)
+        #[tokio::test]
+        async fn page_bids_without_an_auction_omits_the_mirror() {
+            let settings = settings_with_co_auction_disabled();
+            let graph = seeded_graph(&[(MIRROR_SOURCE, "uid-mirror")]);
+            let mut ec_context = consenting_context_with_ec();
+
+            let body = page_bids_body(
+                &settings,
+                &graph,
+                &mut ec_context,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await;
+
+            assert!(
+                body.get("ts_eids_s").is_none(),
+                "should leave the mirror cookie as it is"
+            );
         }
 
         #[tokio::test]
@@ -29504,53 +31913,351 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
         }
 
         #[tokio::test]
-        async fn public_origin_spa_creatives_use_public_port_and_preserve_publisher_identity() {
-            let mut settings = settings_with_co();
-            settings.publisher.domain = "publisher.example.com".to_owned();
-            settings.proxy.allowed_domains = vec!["*.example.com".to_owned()];
-            settings.auction.providers =
-                crate::auction::AuctionConfig::legacy_provider_map(&[AUCTION_ID_TEST_PROVIDER]);
-            settings.auction.rewrite_creatives = true;
-            settings.trusted_forwarder = Some(crate::settings::TrustedForwarderConfig {
-                auth_header: crate::forwarder::FORWARDER_AUTH_HEADER.to_owned(),
-                shared_secret: crate::redacted::Redacted::new(
-                    "fictional-forwarder-secret-0123456789".to_owned(),
-                ),
-            });
-            for endpoint in [PAGE_BIDS_PATH, PAGE_BIDS_LEGACY_PATH] {
-                let captured = Arc::new(Mutex::new(None));
-                let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
-                orchestrator.register_provider(Arc::new(AuctionIdTestProvider {
-                    captured_request: Arc::clone(&captured), winning_bid: true,
-                    creative: Some("<a href=\"https://ads.example.com/click\"><img src=\"https://ads.example.com/banner.png\"></a>".to_owned()),
-                }));
-                let stub = Arc::new(StubHttpClient::new());
-                stub.push_response(200, b"winner".to_vec());
-                let services = build_services_with_http_client(
-                    Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
-                );
-                let mut request = Request::builder()
-                    .uri(format!(
-                        "http://internal.example.com{endpoint}?path=/2024/article"
-                    ))
-                    .header(header::HOST, "internal.example.com")
-                    .header("sec-fetch-site", "same-origin")
-                    .header(
-                        crate::forwarder::FORWARDER_AUTH_HEADER,
-                        "fictional-forwarder-secret-0123456789",
-                    )
-                    .header("x-forwarded-host", "reader.publisher.example.com:8443")
-                    .header("x-forwarded-proto", "https")
-                    .body(EdgeBody::empty())
-                    .expect("should construct SPA request");
-                crate::forwarder::prepare_trusted_forwarder(&mut request, &settings);
-                let mut ec_context = EcContext::new_for_test(
+        async fn public_origin_spa_creatives_use_public_port_and_preserve_publisher_identity() {
+            let mut settings = settings_with_co();
+            settings.publisher.domain = "publisher.example.com".to_owned();
+            settings.proxy.allowed_domains = vec!["*.example.com".to_owned()];
+            settings.auction.providers =
+                crate::auction::AuctionConfig::legacy_provider_map(&[AUCTION_ID_TEST_PROVIDER]);
+            settings.auction.rewrite_creatives = true;
+            settings.trusted_forwarder = Some(crate::settings::TrustedForwarderConfig {
+                auth_header: crate::forwarder::FORWARDER_AUTH_HEADER.to_owned(),
+                shared_secret: crate::redacted::Redacted::new(
+                    "fictional-forwarder-secret-0123456789".to_owned(),
+                ),
+            });
+            for endpoint in [PAGE_BIDS_PATH, PAGE_BIDS_LEGACY_PATH] {
+                let captured = Arc::new(Mutex::new(None));
+                let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+                orchestrator.register_provider(Arc::new(AuctionIdTestProvider {
+                    captured_request: Arc::clone(&captured), winning_bid: true,
+                    creative: Some("<a href=\"https://ads.example.com/click\"><img src=\"https://ads.example.com/banner.png\"></a>".to_owned()),
+                }));
+                let stub = Arc::new(StubHttpClient::new());
+                stub.push_response(200, b"winner".to_vec());
+                let services = build_services_with_http_client(
+                    Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+                );
+                let mut request = Request::builder()
+                    .uri(format!(
+                        "http://internal.example.com{endpoint}?path=/2024/article"
+                    ))
+                    .header(header::HOST, "internal.example.com")
+                    .header("sec-fetch-site", "same-origin")
+                    .header(
+                        crate::forwarder::FORWARDER_AUTH_HEADER,
+                        "fictional-forwarder-secret-0123456789",
+                    )
+                    .header("x-forwarded-host", "reader.publisher.example.com:8443")
+                    .header("x-forwarded-proto", "https")
+                    .body(EdgeBody::empty())
+                    .expect("should construct SPA request");
+                crate::forwarder::prepare_trusted_forwarder(&mut request, &settings);
+                let mut ec_context = EcContext::new_for_test(
+                    None,
+                    crate::consent::ConsentContext {
+                        jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                        ..Default::default()
+                    },
+                );
+                let response = handle_page_bids(
+                    &settings,
+                    &services,
+                    None,
+                    AuctionDispatch {
+                        integration_registry: &IntegrationRegistry::empty_for_tests(),
+                        orchestrator: &orchestrator,
+                        slots: &article_slot(),
+                        registry: None,
+                    },
+                    &mut ec_context,
+                    request,
+                )
+                .await
+                .expect("should serve SPA bids");
+                let json: serde_json::Value = serde_json::from_slice(
+                    &response
+                        .into_body()
+                        .into_bytes()
+                        .expect("should read SPA bids"),
+                )
+                .expect("should decode SPA bids JSON");
+                let creative = json["bids"]["atf"]["adm"]
+                    .as_str()
+                    .expect("should return rewritten winning creative");
+                assert!(
+                    creative
+                        .contains("https://reader.publisher.example.com:8443/first-party/proxy?"),
+                    "should proxy assets through authenticated public authority: {creative}"
+                );
+                assert!(
+                    creative
+                        .contains("https://reader.publisher.example.com:8443/first-party/click?"),
+                    "should proxy clicks through authenticated public authority: {creative}"
+                );
+                assert!(
+                    !creative.contains("internal.example.com"),
+                    "should not leak transport authority into SPA creative"
+                );
+                let auction = captured
+                    .lock()
+                    .expect("should lock captured request")
+                    .clone()
+                    .expect("should dispatch SPA auction");
+                assert_eq!(
+                    auction.publisher.domain, "publisher.example.com",
+                    "should retain configured publisher identity"
+                );
+                assert_eq!(
+                    auction.publisher.page_url.as_deref(),
+                    Some("https://publisher.example.com/2024/article"),
+                    "should use public scheme with configured publisher page identity"
+                );
+            }
+        }
+
+        #[tokio::test]
+        async fn active_page_bids_omits_timings_when_no_provider_dispatches() {
+            let mut settings = settings_with_co();
+            settings.auction.providers =
+                crate::auction::AuctionConfig::legacy_provider_map(&["missing-provider"]);
+            settings
+                .integrations
+                .insert_config("gpt_diagnostics", &serde_json::json!({ "enabled": true }))
+                .expect("should enable diagnostics");
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            let slots = article_slot();
+            let mut req = make_active_page_bids_request("/2024/01/my-article/");
+            let timings = RequestTimings::new();
+            req.extensions_mut().insert(timings.handle().clone());
+            let mut ec_context = consent_allowing_ec_context();
+            let response = handle_page_bids(
+                &settings,
+                &noop_services(),
+                None,
+                AuctionDispatch {
+                    integration_registry: &IntegrationRegistry::empty_for_tests(),
+                    orchestrator: &orchestrator,
+                    slots: &slots,
+                    registry: None,
+                },
+                &mut ec_context,
+                req,
+            )
+            .await
+            .expect("should produce a no-bid response");
+            let body_bytes = response
+                .into_body()
+                .into_bytes()
+                .expect("should read page-bids response body");
+            let body: serde_json::Value =
+                serde_json::from_slice(&body_bytes).expect("should parse page-bids response");
+
+            assert!(
+                body.get("auctionDiagnostics").is_none(),
+                "should omit diagnostics when no provider dispatched"
+            );
+            let snapshot = timings.snapshot();
+            assert!(snapshot.auction_id.is_some());
+            assert!(snapshot.auction_dispatched_ms.is_none());
+            assert!(snapshot.auction_resolved_ms.is_none());
+            assert!(snapshot.auction_committed_ms.is_none());
+        }
+
+        #[tokio::test]
+        async fn active_page_bids_zero_provider_path_leaves_handler_collector_unresolved() {
+            let mut settings = settings_with_co();
+            settings
+                .integrations
+                .insert_config("gpt_diagnostics", &serde_json::json!({ "enabled": true }))
+                .expect("should enable diagnostics");
+            let orchestrator = AuctionOrchestrator::from_plan(
+                Arc::new(
+                    crate::auction::compile_auction_plan(&settings)
+                        .expect("should compile empty planned auction"),
+                ),
+                None,
+            );
+            let slots = article_slot();
+            let mut req = make_active_page_bids_request("/2024/01/my-article/");
+            let timings = RequestTimings::new();
+            req.extensions_mut().insert(timings.handle().clone());
+            let mut ec_context = consent_allowing_ec_context();
+
+            let response = handle_page_bids(
+                &settings,
+                &noop_services(),
+                None,
+                AuctionDispatch {
+                    integration_registry: &IntegrationRegistry::empty_for_tests(),
+                    orchestrator: &orchestrator,
+                    slots: &slots,
+                    registry: None,
+                },
+                &mut ec_context,
+                req,
+            )
+            .await
+            .expect("should produce a no-bid response without providers");
+
+            assert_eq!(response.status(), StatusCode::OK);
+            let body_bytes = response
+                .into_body()
+                .into_bytes()
+                .expect("should read zero-provider page-bids body");
+            let body: serde_json::Value = serde_json::from_slice(&body_bytes)
+                .expect("should parse zero-provider page-bids body");
+            assert!(
+                body.get("auctionDiagnostics").is_none(),
+                "should omit diagnostics when no provider launched"
+            );
+            let snapshot = timings.snapshot();
+            assert!(snapshot.auction_dispatched_ms.is_none());
+            assert!(snapshot.auction_resolved_ms.is_none());
+            assert!(snapshot.auction_committed_ms.is_none());
+        }
+
+        #[tokio::test]
+        async fn page_bids_mediator_collection_requires_actual_launch_evidence() {
+            for configured_provider in [false, true] {
+                for (mediator, wait_failure) in [
+                    (Mediator::Immediate, false),
+                    (Mediator::FailBeforeStart, false),
+                    (Mediator::FailAfterStart, false),
+                    (Mediator::Pending, false),
+                    (Mediator::Pending, true),
+                ] {
+                    let mut settings = settings_with_co();
+                    let provider = if configured_provider {
+                        "[providers.skipped]\nprotocol = \"openrtb-2.6\"\nprofile = \"standard\"\nendpoint = \"https://bidder.example.com/auction\"\nrouting = \"explicit\"\n"
+                    } else {
+                        ""
+                    };
+                    settings.auction = toml::from_str(&format!(
+                        "enabled = true\nmediator = \"adserver_mock\"\n{provider}"
+                    ))
+                    .expect("should parse mediator-only collection settings");
+                    settings
+                        .integrations
+                        .insert_config("gpt_diagnostics", &serde_json::json!({"enabled": true}))
+                        .expect("should enable diagnostics");
+                    let orchestrator = AuctionOrchestrator::from_plan(
+                        Arc::new(
+                            crate::auction::compile_auction_plan(&settings)
+                                .expect("should compile mediator collection plan"),
+                        ),
+                        Some(Arc::new(mediator)),
+                    );
+                    let http = Arc::new(StubHttpClient::new());
+                    http.push_response(204, Vec::new());
+                    if wait_failure {
+                        http.push_wait_error();
+                    }
+                    let services = build_services_with_http_client(http.clone());
+                    let slots = article_slot();
+                    let mut req = make_active_page_bids_request("/2024/01/my-article/");
+                    let timings = RequestTimings::new();
+                    req.extensions_mut().insert(timings.handle().clone());
+                    let mut ec_context = consent_allowing_ec_context();
+                    let response = handle_page_bids(
+                        &settings,
+                        &services,
+                        None,
+                        AuctionDispatch {
+                            integration_registry: &IntegrationRegistry::empty_for_tests(),
+                            orchestrator: &orchestrator,
+                            slots: &slots,
+                            registry: None,
+                        },
+                        &mut ec_context,
+                        req,
+                    )
+                    .await
+                    .expect("should return mediator page-bids response");
+                    let body: serde_json::Value = serde_json::from_slice(
+                        &response
+                            .into_body()
+                            .into_bytes()
+                            .expect("should read page-bids response"),
+                    )
+                    .expect("should parse mediator page-bids response");
+                    let launched = configured_provider
+                        && matches!(mediator, Mediator::FailAfterStart | Mediator::Pending);
+                    assert_eq!(
+                        http.recorded_backend_names().len(),
+                        usize::from(launched),
+                        "{configured_provider} {mediator:?}"
+                    );
+                    let snapshot = timings.snapshot();
+                    assert!(snapshot.auction_dispatched_ms.is_none());
+                    assert_eq!(snapshot.auction_resolved_ms.is_some(), launched);
+                    assert_eq!(snapshot.auction_committed_ms.is_some(), launched);
+                    assert_eq!(snapshot.auction_wait_ms.is_some(), launched);
+                    assert_eq!(
+                        snapshot.auction_wait_placement,
+                        launched.then_some(AuctionWaitPlacement::PreHeader)
+                    );
+                    assert_eq!(
+                        body.get("auctionDiagnostics").is_some(),
+                        launched,
+                        "{configured_provider} {mediator:?}"
+                    );
+                    if launched {
+                        let diagnostics = &body["auctionDiagnostics"];
+                        assert!(diagnostics.get("auctionDispatchedMs").is_none());
+                        assert_eq!(
+                            diagnostics["auctionWaitMs"].as_u64(),
+                            snapshot.auction_wait_ms.map(u64::from)
+                        );
+                        assert_eq!(diagnostics["auctionWaitPlacement"], "pre_header");
+                    }
+                }
+            }
+        }
+
+        #[tokio::test]
+        async fn planned_page_bids_keeps_installed_collector_after_launch_and_transport_failure() {
+            for (transport_failure, metadata_missing) in
+                [(false, false), (true, false), (false, true)]
+            {
+                let mut settings = settings_with_co();
+                settings.auction = toml::from_str(
+                    r#"
+                    enabled = true
+                    [providers.example]
+                    protocol = "openrtb-2.6"
+                    profile = "standard"
+                    endpoint = "https://bidder.example.com/auction"
+                    routing = "all_eligible"
+                "#,
+                )
+                .expect("should parse a production provider plan");
+                settings
+                    .integrations
+                    .insert_config("gpt_diagnostics", &serde_json::json!({ "enabled": true }))
+                    .expect("should enable diagnostics");
+                let orchestrator = AuctionOrchestrator::from_plan(
+                    Arc::new(
+                        crate::auction::compile_auction_plan(&settings)
+                            .expect("should compile page-bids provider plan"),
+                    ),
                     None,
-                    crate::consent::ConsentContext {
-                        jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
-                        ..Default::default()
-                    },
                 );
+                let stub = Arc::new(StubHttpClient::new());
+                stub.push_response(204, Vec::new());
+                if transport_failure {
+                    stub.push_select_error();
+                }
+                if metadata_missing {
+                    stub.push_pending_backend_name_override(None);
+                }
+                let services = build_services_with_http_client(stub.clone());
+                let slots = article_slot();
+                let mut req = make_active_page_bids_request("/2024/01/my-article/");
+                let timings = RequestTimings::new();
+                req.extensions_mut().insert(timings.handle().clone());
+                let mut ec_context = consent_allowing_ec_context();
+
                 let response = handle_page_bids(
                     &settings,
                     &services,
@@ -29558,55 +32265,134 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                     AuctionDispatch {
                         integration_registry: &IntegrationRegistry::empty_for_tests(),
                         orchestrator: &orchestrator,
-                        slots: &article_slot(),
+                        slots: &slots,
                         registry: None,
                     },
                     &mut ec_context,
-                    request,
+                    req,
                 )
                 .await
-                .expect("should serve SPA bids");
-                let json: serde_json::Value = serde_json::from_slice(
-                    &response
-                        .into_body()
-                        .into_bytes()
-                        .expect("should read SPA bids"),
-                )
-                .expect("should decode SPA bids JSON");
-                let creative = json["bids"]["atf"]["adm"]
-                    .as_str()
-                    .expect("should return rewritten winning creative");
-                assert!(
-                    creative
-                        .contains("https://reader.publisher.example.com:8443/first-party/proxy?"),
-                    "should proxy assets through authenticated public authority: {creative}"
+                .expect("should complete page-bids after a real launch");
+
+                assert_eq!(
+                    response.status(),
+                    StatusCode::OK,
+                    "should retain a no-bid response after transport failure"
                 );
-                assert!(
-                    creative
-                        .contains("https://reader.publisher.example.com:8443/first-party/click?"),
-                    "should proxy clicks through authenticated public authority: {creative}"
+                assert_eq!(
+                    stub.recorded_backend_names().len(),
+                    1,
+                    "should launch the planned provider"
                 );
+                let snapshot = timings.snapshot();
                 assert!(
-                    !creative.contains("internal.example.com"),
-                    "should not leak transport authority into SPA creative"
-                );
-                let auction = captured
-                    .lock()
-                    .expect("should lock captured request")
-                    .clone()
-                    .expect("should dispatch SPA auction");
-                assert_eq!(
-                    auction.publisher.domain, "publisher.example.com",
-                    "should retain configured publisher identity"
+                    snapshot.auction_id.is_some(),
+                    "should stamp the observation UUID in the original handle"
                 );
+                assert_eq!(snapshot.auction_wait_ms.is_some(), !metadata_missing);
                 assert_eq!(
-                    auction.publisher.page_url.as_deref(),
-                    Some("https://publisher.example.com/2024/article"),
-                    "should use public scheme with configured publisher page identity"
+                    snapshot.auction_wait_placement,
+                    (!metadata_missing).then_some(AuctionWaitPlacement::PreHeader)
                 );
+                let dispatched = snapshot
+                    .auction_dispatched_ms
+                    .expect("should mark dispatch");
+                let body: serde_json::Value = serde_json::from_slice(
+                    &response
+                        .into_body()
+                        .into_bytes()
+                        .expect("should read page-bids response body"),
+                )
+                .expect("should parse page-bids response");
+                if metadata_missing {
+                    assert!(
+                        snapshot.auction_resolved_ms.is_none(),
+                        "should not fabricate collection after losing the pending handle"
+                    );
+                    assert!(
+                        snapshot.auction_committed_ms.is_none(),
+                        "should not commit a failed dispatch"
+                    );
+                    assert!(
+                        body.get("auctionDiagnostics").is_none(),
+                        "should omit completed-auction diagnostics after dispatch failure"
+                    );
+                } else {
+                    let resolved = snapshot
+                        .auction_resolved_ms
+                        .expect("should mark collection");
+                    let committed = snapshot
+                        .auction_committed_ms
+                        .expect("should commit targeting");
+                    assert!(
+                        dispatched <= resolved && resolved <= committed,
+                        "should preserve ordering after success or transport failure"
+                    );
+                    assert_eq!(
+                        body["auctionDiagnostics"]["auctionDispatchedMs"].as_u64(),
+                        Some(u64::from(dispatched)),
+                        "should expose the installed collector rather than a handler-local clock"
+                    );
+                    assert_eq!(
+                        body["auctionDiagnostics"]["auctionWaitMs"].as_u64(),
+                        snapshot.auction_wait_ms.map(u64::from)
+                    );
+                    assert_eq!(
+                        body["auctionDiagnostics"]["auctionWaitPlacement"],
+                        "pre_header"
+                    );
+                }
             }
         }
 
+        #[tokio::test]
+        async fn active_page_bids_omits_timings_without_adapter_collector() {
+            let mut settings = settings_with_co();
+            settings.auction.providers =
+                crate::auction::AuctionConfig::legacy_provider_map(&[AUCTION_ID_TEST_PROVIDER]);
+            settings
+                .integrations
+                .insert_config("gpt_diagnostics", &serde_json::json!({ "enabled": true }))
+                .expect("should enable diagnostics");
+            let slots = article_slot();
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"winner".to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            let orchestrator =
+                auction_id_test_orchestrator(&settings, Arc::new(Mutex::new(None)), true);
+            let mut ec_context = consent_allowing_ec_context();
+
+            let response = handle_page_bids(
+                &settings,
+                &services,
+                None,
+                AuctionDispatch {
+                    integration_registry: &IntegrationRegistry::empty_for_tests(),
+                    orchestrator: &orchestrator,
+                    slots: &slots,
+                    registry: None,
+                },
+                &mut ec_context,
+                make_active_page_bids_request("/2024/01/my-article/"),
+            )
+            .await
+            .expect("should return page-bids response");
+            let body: serde_json::Value = serde_json::from_slice(
+                &response
+                    .into_body()
+                    .into_bytes()
+                    .expect("should read page-bids response body"),
+            )
+            .expect("should serialize page-bids response as JSON");
+
+            assert!(
+                body.get("auctionDiagnostics").is_none(),
+                "missing adapter timing context must not emit handler-local timing facts"
+            );
+        }
+
         #[tokio::test]
         async fn page_bids_response_includes_auction_id_only_for_winning_bids() {
             let mut settings = settings_with_co();
@@ -29619,6 +32405,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             let slots = article_slot();
             let winning_stub = Arc::new(StubHttpClient::new());
             winning_stub.push_response(200, b"winner".to_vec());
+            winning_stub.push_response(200, b"winner".to_vec());
             let winning_services = build_services_with_http_client(
                 Arc::clone(&winning_stub) as Arc<dyn crate::platform::PlatformHttpClient>
             );
@@ -29633,6 +32420,14 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 },
             );
 
+            let mut winning_page_bids_request =
+                make_active_page_bids_request("/2024/01/my-article/");
+            let request_timings = RequestTimings::new();
+            winning_page_bids_request
+                .extensions_mut()
+                .insert(request_timings.handle().clone());
+            std::thread::sleep(std::time::Duration::from_millis(2));
+
             let winning_response = handle_page_bids(
                 &settings,
                 &winning_services,
@@ -29644,7 +32439,7 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                     registry: None,
                 },
                 &mut ec_context,
-                make_page_bids_request("/2024/01/my-article/"),
+                winning_page_bids_request,
             )
             .await
             .expect("should return winning page-bids response");
@@ -29665,10 +32460,45 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 auction_request.id, "ts-page-auction-example-123",
                 "test EC ID should produce a deterministic auction request ID"
             );
+            let timing_snapshot = request_timings.snapshot();
+            assert!(timing_snapshot.auction_dispatched_ms.is_some());
+            assert!(timing_snapshot.auction_resolved_ms.is_some());
+            assert!(timing_snapshot.auction_committed_ms.is_some());
             let winning_auction_id = winning_body["bids"]["atf"]["hb_auction_id"]
                 .as_str()
                 .expect("page-bids should expose an auction ID on the winner")
                 .to_string();
+            let auction_diagnostics = winning_body["auctionDiagnostics"]
+                .as_object()
+                .expect("an active session should expose page-bids auction diagnostics");
+            let timing = |field| {
+                auction_diagnostics
+                    .get(field)
+                    .and_then(serde_json::Value::as_u64)
+                    .unwrap_or_else(|| panic!("page-bids diagnostics should include {field}"))
+            };
+            let dispatched_ms = timing("auctionDispatchedMs");
+            let resolved_ms = timing("auctionResolvedMs");
+            let committed_ms = timing("auctionCommittedMs");
+            let wait_ms = timing("auctionWaitMs");
+            assert!(
+                dispatched_ms > 0,
+                "page-bids dispatch should include time since adapter request entry"
+            );
+            assert!(
+                dispatched_ms <= resolved_ms && resolved_ms <= committed_ms,
+                "page-bids auction milestones should be monotonic"
+            );
+            assert_eq!(
+                wait_ms,
+                u64::from(
+                    timing_snapshot
+                        .auction_wait_ms
+                        .expect("should measure collection wait")
+                ),
+                "browser wait should use the measured collection interval"
+            );
+            assert_eq!(auction_diagnostics["auctionWaitPlacement"], "pre_header");
             assert!(
                 winning_auction_id.starts_with("ts-auc-"),
                 "page-bids should expose a freshly minted diagnostics token, got `{winning_auction_id}`"
@@ -29682,6 +32512,33 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                 "browser-visible auction ID must not embed the EC ID"
             );
 
+            let inactive_winning_response = handle_page_bids(
+                &settings,
+                &winning_services,
+                None,
+                AuctionDispatch {
+                    integration_registry: &IntegrationRegistry::empty_for_tests(),
+                    orchestrator: &winning_orchestrator,
+                    slots: &slots,
+                    registry: None,
+                },
+                &mut ec_context,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await
+            .expect("should return inactive winning page-bids response");
+            let inactive_winning_body: serde_json::Value = serde_json::from_slice(
+                &inactive_winning_response
+                    .into_body()
+                    .into_bytes()
+                    .expect("should read inactive winning page-bids response body"),
+            )
+            .expect("should serialize inactive winning page-bids response as JSON");
+            assert!(
+                inactive_winning_body.get("auctionDiagnostics").is_none(),
+                "an inactive session should not receive successful auction diagnostics"
+            );
+
             let no_winner_stub = Arc::new(StubHttpClient::new());
             no_winner_stub.push_response(200, b"no-bid".to_vec());
             let no_winner_services = build_services_with_http_client(
@@ -29719,6 +32576,10 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
                     .is_empty(),
                 "page-bids should not fabricate auction metadata without a winner"
             );
+            assert!(
+                no_winner_body.get("auctionDiagnostics").is_none(),
+                "an inactive session should not receive page-bids auction diagnostics"
+            );
         }
 
         /// The browser-visible auction ID is minted per auction and only for
@@ -29935,6 +32796,39 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             );
         }
 
+        #[tokio::test]
+        async fn cross_site_request_is_denied_before_diagnostics_configuration_errors() {
+            let mut settings = settings_with_co();
+            settings
+                .integrations
+                .insert_config(
+                    "gpt_diagnostics",
+                    &serde_json::json!({ "enabled": true, "unexpected": true }),
+                )
+                .expect("should insert invalid diagnostics configuration");
+            let mut probe = make_page_bids_request("/2024/01/my-article/");
+            assert!(
+                crate::integrations::gpt_diagnostics::prepare_request(&settings, &mut probe)
+                    .is_err(),
+                "should exercise a diagnostics configuration error"
+            );
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+
+            for endpoint in [PAGE_BIDS_PATH, PAGE_BIDS_LEGACY_PATH] {
+                let mut req = make_page_bids_request_on(endpoint, "/2024/01/my-article/");
+                set_test_header(&mut req, "sec-fetch-site", "cross-site");
+
+                let response =
+                    run_page_bids_response(&settings, &orchestrator, &article_slot(), req).await;
+
+                assert_eq!(
+                    response.status(),
+                    StatusCode::FORBIDDEN,
+                    "should deny cross-site requests before diagnostics preparation on {endpoint}"
+                );
+            }
+        }
+
         #[tokio::test]
         async fn cross_site_fetch_metadata_is_rejected() {
             let settings = settings_with_co();
@@ -30207,9 +33101,28 @@ for (const mode of ['ready', 'queued', 'stale', 'inactive', 'throws']) {
             let settings = settings_with_co_auction_disabled();
             let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
             let slots = article_slot();
-            let req = make_page_bids_request("/2024/01/my-article/");
-
-            let body = run_page_bids_consent_allowed(&settings, &orchestrator, &slots, req).await;
+            let mut req = make_page_bids_request("/2024/01/my-article/");
+            let timings = RequestTimings::new();
+            req.extensions_mut().insert(timings.handle().clone());
+            let mut ec_context = consent_allowing_ec_context();
+            let response = run_page_bids_response_with_ec(
+                &settings,
+                &orchestrator,
+                &slots,
+                &mut ec_context,
+                req,
+            )
+            .await;
+            let body_bytes = response
+                .into_body()
+                .into_bytes()
+                .expect("should read disabled page-bids response body");
+            let body: serde_json::Value = serde_json::from_slice(&body_bytes)
+                .expect("should parse disabled page-bids response");
+            assert!(
+                timings.snapshot().auction_id.is_none(),
+                "should keep the disabled page-bids access join key null"
+            );
 
             assert_eq!(
                 body["slots"]
diff --git a/crates/trusted-server-core/src/request_timing.rs b/crates/trusted-server-core/src/request_timing.rs
new file mode 100644
index 0000000000..6c8d2f99eb
--- /dev/null
+++ b/crates/trusted-server-core/src/request_timing.rs
@@ -0,0 +1,974 @@
+//! Per-request phase timing collection and Server-Timing rendering.
+//!
+//! Collection delegates to `EdgeZero` with saturating math and nonblocking
+//! updates. Contention drops the whole sample; poisoned locks recover
+//! best-effort without rollback. TS callbacks only assign plain optional facts
+//! under the shared clock and mutex. Rendering and exposure remain TS policy.
+//! See the design spec
+//! `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md`.
+
+use std::time::Duration;
+
+use http::{Extensions, HeaderName, HeaderValue, Response};
+use uuid::Uuid;
+
+use crate::cache_policy::{
+    EDGE_CACHE_HEADER_NAMES, cache_control_headers_have_bare_private_or_no_store,
+};
+
+/// `Server-Timing` header name. Not present in the `http` crate's `header`
+/// module (unlike `CACHE_CONTROL` etc.), so declared locally following the
+/// same `HeaderName::from_static` pattern used in
+/// `trusted_server_core::constants`.
+const HEADER_SERVER_TIMING: HeaderName = HeaderName::from_static("server-timing");
+
+/// Number of [`Phase`] variants; sizes the fixed-slot duration array in
+/// the shared `EdgeZero` collector.
+const PHASE_COUNT: usize = 8;
+
+/// A distinct stage of request handling that duration can be attributed to.
+///
+/// Variants map to fixed slots in [`RequestTimings`], in declaration order.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Phase {
+    /// Time spent constructing the app/handler before request processing
+    /// begins.
+    AppBuild,
+    /// Time spent in request/response filtering (e.g. HTML rewriting).
+    Filter,
+    /// Time spent resolving geographic signals for the request.
+    Geo,
+    /// Time spent reading or writing the Edge Cookie key-value store.
+    EcKv,
+    /// Time spent waiting on the origin fetch.
+    Origin,
+    /// Time spent looking up a cached template.
+    TemplateCacheLookup,
+    /// Time spent waiting on the auction. Row-only: never rendered as a
+    /// `Server-Timing` header entry.
+    AuctionWait,
+    /// Time spent streaming the response body. Row-only: never rendered as
+    /// a `Server-Timing` header entry.
+    Stream,
+}
+
+impl Phase {
+    /// Maps this variant to its fixed slot in the generic phase array.
+    fn index(self) -> usize {
+        match self {
+            Self::AppBuild => 0,
+            Self::Filter => 1,
+            Self::Geo => 2,
+            Self::EcKv => 3,
+            Self::Origin => 4,
+            Self::TemplateCacheLookup => 5,
+            Self::AuctionWait => 6,
+            Self::Stream => 7,
+        }
+    }
+
+    /// `Server-Timing` header entry name; row-only phases return `None`.
+    fn header_name(self) -> Option<&'static str> {
+        match self {
+            Self::AppBuild => Some("ts-appbuild"),
+            Self::Filter => Some("ts-filter"),
+            Self::Geo => Some("ts-geo"),
+            Self::EcKv => Some("ts-kv"),
+            Self::Origin => Some("ts-origin"),
+            Self::TemplateCacheLookup => Some("ts-template-cache"),
+            Self::AuctionWait | Self::Stream => None,
+        }
+    }
+}
+
+/// Where in the response the auction wait occurred.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuctionWaitPlacement {
+    /// The auction was awaited before response headers were sent.
+    PreHeader,
+    /// The auction was awaited while streaming the response body.
+    InStream,
+}
+
+/// Auction facts sharing the generic collector's origin and mutex.
+///
+/// Updates only assign plain optional facts, preserving validity on unwind.
+#[derive(Default)]
+pub struct AuctionTimingData {
+    auction_wait_placement: Option<AuctionWaitPlacement>,
+    auction_dispatched: Option<Duration>,
+    auction_resolved: Option<Duration>,
+    auction_committed: Option<Duration>,
+    auction_id: Option<Uuid>,
+}
+
+/// The sole timing type installed in request extensions on every adapter.
+pub type RequestTimingHandle =
+    edgezero_core::request_timing::RequestTimings<PHASE_COUNT, AuctionTimingData>;
+
+/// Shared attachment middleware specialized to Trusted Server's timing payload.
+/// Exclusion policy belongs at each adapter's registration site.
+pub type RequestTimingMiddleware =
+    edgezero_core::middleware::RequestTimingMiddleware<PHASE_COUNT, AuctionTimingData>;
+
+/// Typed application facade over the installed `EdgeZero` handle, not an extension.
+///
+/// Clones share one origin and mutex. Contention drops samples or yields missing
+/// facts. `EdgeZero` recovers poisoned locks best-effort, without rollback; the
+/// callbacks here only update plain optional facts and cannot invalidate payloads.
+#[derive(Clone)]
+pub struct RequestTimings(RequestTimingHandle);
+
+impl RequestTimings {
+    /// Starts a new collector with its clock reference (`t0`) set to now.
+    #[must_use]
+    pub fn new() -> Self {
+        Self(RequestTimingHandle::new())
+    }
+
+    /// Wraps the installed generic handle without creating a clock or copying facts.
+    #[must_use]
+    pub fn from_extensions(extensions: &Extensions) -> Option<Self> {
+        extensions.get::<RequestTimingHandle>().cloned().map(Self)
+    }
+
+    /// Returns the shared generic handle for insertion into request extensions.
+    #[must_use]
+    pub fn handle(&self) -> &RequestTimingHandle {
+        &self.0
+    }
+
+    /// Accumulates `dur` into `phase`'s running total.
+    ///
+    /// Repeated calls for the same phase saturate-add rather than overwrite.
+    /// Drops the sample silently on lock contention; a poisoned lock is recovered.
+    pub fn record(&self, phase: Phase, dur: Duration) {
+        let _ = self.0.record(phase.index(), dur);
+    }
+
+    /// Records an auction wait duration under [`Phase::AuctionWait`] and
+    /// stores its placement.
+    ///
+    /// Callers record only when at least one provider request actually started.
+    /// A measured zero duration is retained; no-launch collection leaves the
+    /// duration and placement unset. Publisher collectors and the `/auction`
+    /// and `/_ts/page-bids` endpoints measure the collection interval here,
+    /// including mediator-only collection when an upstream request started.
+    /// Drops the sample silently on lock contention; a poisoned lock is recovered.
+    pub fn record_auction_wait(&self, placement: AuctionWaitPlacement, dur: Duration) {
+        let _ = self
+            .0
+            .record_with(Phase::AuctionWait.index(), dur, |data, _| {
+                data.auction_wait_placement = Some(placement);
+            });
+    }
+
+    /// Starts a guard that records elapsed time into `phase` when dropped.
+    ///
+    /// # Panics
+    /// Panics only if the internal exhaustive phase-to-slot mapping is invalid.
+    pub fn span(&self, phase: Phase) -> PhaseSpan {
+        self.0
+            .span(phase.index())
+            .expect("should map every Phase to a valid slot")
+    }
+
+    /// Stamps the elapsed time since `t0` as `headers_ready_total`, the
+    /// first time this is called.
+    ///
+    /// Subsequent calls are no-ops (first call wins). Drops the sample
+    /// silently on lock contention; a poisoned lock is recovered.
+    pub fn mark_headers_ready(&self) {
+        let _ = self.0.mark_headers_ready();
+    }
+
+    /// Stamps the elapsed time since `t0` as `request_elapsed`, the first
+    /// time this is called.
+    ///
+    /// Subsequent calls are no-ops (first call wins). Drops the sample
+    /// silently on lock contention; a poisoned lock is recovered.
+    pub fn mark_request_elapsed(&self) {
+        let _ = self.0.mark_request_complete();
+    }
+
+    /// Records the telemetry auction id, the first time this is called.
+    ///
+    /// Called where an enabled auction's observation is built, before any skip,
+    /// dispatch-failure or launch outcome, so the access row can be joined to the
+    /// `auction_events_raw` row even when the auction was skipped or failed to
+    /// dispatch. Disabled auctions are not stamped, so their `auction_disabled`
+    /// summary rows have no access join key. Kept separate from
+    /// [`RequestTimings::mark_auction_dispatched`] so a dropped dispatch
+    /// sample cannot also lose the join key. Subsequent calls are no-ops
+    /// (first call wins). Drops the sample silently on lock contention; a
+    /// poisoned lock is recovered.
+    pub fn set_auction_id(&self, auction_id: Uuid) {
+        let _ = self.0.update_data(|data, _| {
+            data.auction_id.get_or_insert(auction_id);
+        });
+    }
+
+    /// Stamps the elapsed time since `t0` as the auction dispatch offset,
+    /// the first time this is called.
+    ///
+    /// Called after at least one provider starts a request.
+    /// Routing-only skipped outcomes and zero-launch
+    /// failures do not stamp it. A null offset alongside a non-null
+    /// `auction_id` means no provider launch was observed during dispatch.
+    /// A mediator started later during collection does not stamp this offset.
+    /// Subsequent calls
+    /// are no-ops (first call wins).
+    /// Drops the sample silently on lock contention; a poisoned lock is
+    /// recovered.
+    pub fn mark_auction_dispatched(&self) {
+        let _ = self.0.update_data(|data, elapsed| {
+            data.auction_dispatched.get_or_insert(elapsed);
+        });
+    }
+
+    /// Stamps the elapsed time since `t0` when auction collection returns,
+    /// the first time this is called.
+    ///
+    /// Collection may follow transport completion on streaming paths. This
+    /// measures the caller's collection point, not the final network reply.
+    ///
+    /// Stays `None` when a dispatched auction is abandoned before collection
+    /// (origin error, bodiless response, reader disconnect), so a non-null
+    /// dispatch offset with a null resolve offset is the "dispatched, never
+    /// collected" case rather than "no auction ran". Subsequent calls are
+    /// no-ops (first call wins). Drops the sample silently on lock
+    /// contention; a poisoned lock is recovered.
+    pub fn mark_auction_resolved(&self) {
+        let _ = self.0.update_data(|data, elapsed| {
+            data.auction_resolved.get_or_insert(elapsed);
+        });
+    }
+
+    /// Stamps the elapsed time since `t0` as the auction commit offset
+    /// (winning bids available to the response pipeline), the first time
+    /// this is called.
+    ///
+    /// Subsequent calls are no-ops (first call wins). Drops the sample
+    /// silently on lock contention; a poisoned lock is recovered.
+    pub fn mark_auction_committed(&self) {
+        let _ = self.0.update_data(|data, elapsed| {
+            data.auction_committed.get_or_insert(elapsed);
+        });
+    }
+
+    /// Records the response body size in bytes.
+    ///
+    /// Drops the sample silently on lock contention; a poisoned lock is recovered.
+    pub fn set_resp_bytes(&self, bytes: u64) {
+        let _ = self.0.set_response_bytes(bytes);
+    }
+
+    /// Renders a `Server-Timing` header value, or `None` before
+    /// [`RequestTimings::mark_headers_ready`] has been called.
+    ///
+    /// `ts-total` is rendered first from `headers_ready_total`, followed by
+    /// the recorded header-bearing phases (`ts-appbuild`, `ts-filter`,
+    /// `ts-geo`, `ts-kv`, `ts-origin`, `ts-template-cache`) in enum
+    /// declaration order. Unrecorded phases are omitted. Durations are
+    /// rendered as milliseconds with one decimal place. Drops the sample
+    /// silently (returning `None`) on lock contention; poison is recovered.
+    #[must_use]
+    pub fn server_timing_value(&self) -> Option<String> {
+        self.0
+            .snapshot(|inner| {
+                let total = inner.headers_ready?;
+                let mut entries = vec![format_entry("ts-total", total)];
+                for phase in HEADER_PHASES {
+                    let Some(name) = phase.header_name() else {
+                        continue;
+                    };
+                    if let Some(dur) = inner.phases[phase.index()] {
+                        entries.push(format_entry(name, dur));
+                    }
+                }
+                Some(entries.join(", "))
+            })
+            .ok()
+            .flatten()
+    }
+
+    /// Captures the current state as a [`TimingSnapshot`].
+    ///
+    /// Returns an all-`None` snapshot on lock contention,
+    /// consistent with the infallibility of every other method.
+    #[must_use]
+    pub fn snapshot(&self) -> TimingSnapshot {
+        self.0
+            .snapshot(|inner| TimingSnapshot {
+                time_elapsed_ms: duration_ms(inner.headers_ready),
+                request_elapsed_ms: duration_ms(inner.request_complete),
+                appbuild_ms: duration_ms(inner.phases[Phase::AppBuild.index()]),
+                filter_ms: duration_ms(inner.phases[Phase::Filter.index()]),
+                geo_ms: duration_ms(inner.phases[Phase::Geo.index()]),
+                kv_ms: duration_ms(inner.phases[Phase::EcKv.index()]),
+                origin_ms: duration_ms(inner.phases[Phase::Origin.index()]),
+                template_cache_ms: duration_ms(inner.phases[Phase::TemplateCacheLookup.index()]),
+                auction_wait_ms: duration_ms(inner.phases[Phase::AuctionWait.index()]),
+                stream_ms: duration_ms(inner.phases[Phase::Stream.index()]),
+                auction_wait_placement: inner.data.auction_wait_placement,
+                resp_bytes: inner.response_bytes,
+                auction_dispatched_ms: duration_ms(inner.data.auction_dispatched),
+                auction_resolved_ms: duration_ms(inner.data.auction_resolved),
+                auction_committed_ms: duration_ms(inner.data.auction_committed),
+                auction_id: inner.data.auction_id,
+            })
+            .unwrap_or_default()
+    }
+}
+
+impl Default for RequestTimings {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Stamps [`RequestTimings::mark_headers_ready`] and, when `enabled` and the
+/// response is conclusively private, appends the rendered `Server-Timing`
+/// header.
+///
+/// Always stamps `mark_headers_ready` regardless of whether the header is
+/// rendered, so the collector's `ts-total` reflects the moment headers
+/// commit. Appends rather than overwrites so a pre-existing `Server-Timing`
+/// value set upstream survives alongside the TS-owned set. A response is
+/// never promoted to shared-cacheable just because the header would
+/// otherwise be omitted: this only gates emission, it does not touch
+/// `Cache-Control`. Emission is also suppressed when a recognized CDN or
+/// surrogate cache-control header is present, since it may allow shared
+/// caching despite a private `Cache-Control` value. Privacy requires a bare
+/// `private` or `no-store` directive; field-qualified `private="..."` protects
+/// only named headers and does not authorize request-specific timing emission.
+///
+/// Generic over the response body type so every adapter's terminal layer can
+/// call the same emission logic regardless of which body type its HTTP stack
+/// uses.
+pub fn append_server_timing_if_private<B>(
+    response: &mut Response<B>,
+    timings: &RequestTimings,
+    enabled: bool,
+) {
+    timings.mark_headers_ready();
+    if !enabled {
+        return;
+    }
+
+    let headers = response.headers();
+    let conclusively_private = cache_control_headers_have_bare_private_or_no_store(headers)
+        && !EDGE_CACHE_HEADER_NAMES
+            .iter()
+            .any(|name| headers.contains_key(*name));
+    if !conclusively_private {
+        return;
+    }
+
+    let Some(value) = timings.server_timing_value() else {
+        return;
+    };
+    match HeaderValue::from_str(&value) {
+        Ok(header_value) => {
+            response
+                .headers_mut()
+                .append(HEADER_SERVER_TIMING, header_value);
+        }
+        Err(error) => log::warn!("skipping server-timing header: {error}"),
+    }
+}
+
+/// The header-bearing phases (see [`Phase::header_name`]), in the enum
+/// declaration order [`RequestTimings::server_timing_value`] renders them in.
+const HEADER_PHASES: [Phase; 6] = [
+    Phase::AppBuild,
+    Phase::Filter,
+    Phase::Geo,
+    Phase::EcKv,
+    Phase::Origin,
+    Phase::TemplateCacheLookup,
+];
+
+/// Formats one `Server-Timing` entry as `name;dur=<ms with one decimal>`.
+fn format_entry(name: &str, dur: Duration) -> String {
+    format!("{name};dur={:.1}", dur.as_secs_f64() * 1000.0)
+}
+
+/// Converts a recorded [`Duration`] to whole milliseconds, saturating to
+/// [`u32::MAX`] instead of overflowing.
+fn duration_ms(dur: Option<Duration>) -> Option<u32> {
+    dur.map(|dur| u32::try_from(dur.as_millis()).unwrap_or(u32::MAX))
+}
+
+/// RAII guard returned by [`RequestTimings::span`] that records its own
+/// elapsed lifetime into the originating phase when dropped.
+pub type PhaseSpan = edgezero_core::request_timing::PhaseSpan<PHASE_COUNT, AuctionTimingData>;
+
+/// A point-in-time, plain-data view of a [`RequestTimings`] collector.
+///
+/// All durations are whole milliseconds; unrecorded phases are `None`.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct TimingSnapshot {
+    /// Elapsed time from request start to
+    /// [`RequestTimings::mark_headers_ready`], in milliseconds.
+    pub time_elapsed_ms: Option<u32>,
+    /// Elapsed time from request start to
+    /// [`RequestTimings::mark_request_elapsed`], in milliseconds.
+    pub request_elapsed_ms: Option<u32>,
+    /// Accumulated [`Phase::AppBuild`] duration, in milliseconds.
+    pub appbuild_ms: Option<u32>,
+    /// Accumulated [`Phase::Filter`] duration, in milliseconds.
+    pub filter_ms: Option<u32>,
+    /// Accumulated [`Phase::Geo`] duration, in milliseconds.
+    pub geo_ms: Option<u32>,
+    /// Accumulated [`Phase::EcKv`] duration, in milliseconds.
+    pub kv_ms: Option<u32>,
+    /// Accumulated [`Phase::Origin`] duration, in milliseconds.
+    pub origin_ms: Option<u32>,
+    /// Accumulated [`Phase::TemplateCacheLookup`] duration, in milliseconds.
+    pub template_cache_ms: Option<u32>,
+    /// Accumulated [`Phase::AuctionWait`] duration, in milliseconds.
+    pub auction_wait_ms: Option<u32>,
+    /// Accumulated [`Phase::Stream`] duration, in milliseconds.
+    pub stream_ms: Option<u32>,
+    /// Placement recorded by the most recent
+    /// [`RequestTimings::record_auction_wait`] call.
+    pub auction_wait_placement: Option<AuctionWaitPlacement>,
+    /// Response body size in bytes, set via
+    /// [`RequestTimings::set_resp_bytes`].
+    pub resp_bytes: Option<u64>,
+    /// T0 offset at which the auction dispatched (bid requests left the
+    /// edge). `None` when no bid request went out, which covers both "no
+    /// auction was attempted" and "the auction was skipped or failed to
+    /// dispatch" — `auction_id` separates the two.
+    pub auction_dispatched_ms: Option<u32>,
+    /// T0 offset at which the auction resolved (final bid or timeout).
+    /// `None` when the milestone was never reached, including a dispatched
+    /// auction abandoned before collection.
+    pub auction_resolved_ms: Option<u32>,
+    /// T0 offset at which winning bids became available to the response
+    /// pipeline. `None` when the milestone was never reached.
+    pub auction_committed_ms: Option<u32>,
+    /// Telemetry auction UUID joining this row to the auction dataset.
+    /// `None` only when no auction was attempted at all; an attempted
+    /// auction carries the id whatever its outcome, matching the row it
+    /// emits to `auction_events_raw`.
+    pub auction_id: Option<Uuid>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn snapshot_and_header_compatibility_fixture() {
+        let timings = RequestTimings::new();
+        let clone = timings.clone();
+        clone.record(Phase::AppBuild, Duration::ZERO);
+        clone.record(Phase::Filter, Duration::from_micros(9_100));
+        clone.record(Phase::Geo, Duration::MAX);
+        clone.record(Phase::Geo, Duration::from_secs(1));
+        clone.record(Phase::EcKv, Duration::from_millis(3));
+        clone.record(Phase::Origin, Duration::from_millis(4));
+        clone.record(Phase::TemplateCacheLookup, Duration::from_millis(5));
+        clone.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::from_millis(6));
+        clone.record_auction_wait(AuctionWaitPlacement::InStream, Duration::from_millis(7));
+        clone.record(Phase::Stream, Duration::from_millis(8));
+        clone.set_resp_bytes(42);
+        clone.set_resp_bytes(99);
+        let snapshot = timings.snapshot();
+        assert_eq!(snapshot.appbuild_ms, Some(0));
+        assert_eq!(snapshot.filter_ms, Some(9));
+        assert_eq!(snapshot.geo_ms, Some(u32::MAX));
+        assert_eq!(snapshot.auction_wait_ms, Some(13));
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::InStream)
+        );
+        assert_eq!(snapshot.stream_ms, Some(8));
+        assert_eq!(snapshot.resp_bytes, Some(99));
+        assert_eq!(snapshot.request_elapsed_ms, None);
+        assert_eq!(RequestTimings::new().snapshot(), TimingSnapshot::default());
+        timings.mark_headers_ready();
+        let value = timings
+            .server_timing_value()
+            .expect("should render fixture");
+        let entries: Vec<_> = value.split(", ").collect();
+        assert_eq!(entries.len(), 7, "should omit row-only phases");
+        assert!(entries[0].starts_with("ts-total;dur="));
+        assert_eq!(entries[1], "ts-appbuild;dur=0.0");
+        assert_eq!(entries[2], "ts-filter;dur=9.1");
+        assert_eq!(entries[3], format_entry("ts-geo", Duration::MAX));
+        assert_eq!(
+            &entries[4..],
+            &[
+                "ts-kv;dur=3.0",
+                "ts-origin;dur=4.0",
+                "ts-template-cache;dur=5.0"
+            ]
+        );
+    }
+
+    #[test]
+    fn contention_drops_compound_update_and_omits_reads() {
+        let timings = RequestTimings::new();
+        timings.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::from_millis(3));
+        timings.mark_headers_ready();
+        assert!(timings.server_timing_value().is_some());
+        let before = timings.snapshot();
+        // Deliberately hold the lock while probing unavailable operations in this
+        // test. Production callbacks only assign facts and never reenter.
+        timings
+            .0
+            .update_data(|_, _| {
+                timings
+                    .record_auction_wait(AuctionWaitPlacement::InStream, Duration::from_millis(7));
+                timings.mark_request_elapsed();
+                assert_eq!(timings.snapshot(), TimingSnapshot::default());
+                assert_eq!(timings.server_timing_value(), None);
+            })
+            .expect("should hold collector lock");
+        assert_eq!(
+            timings.snapshot(),
+            before,
+            "should drop entire compound update"
+        );
+    }
+
+    #[test]
+    fn request_completion_is_first_write_and_header_append_preserves_upstream() {
+        let timings = RequestTimings::new();
+        timings.mark_request_elapsed();
+        let first = timings.snapshot().request_elapsed_ms;
+        std::thread::sleep(Duration::from_millis(5));
+        timings.mark_request_elapsed();
+        assert_eq!(timings.snapshot().request_elapsed_ms, first);
+        let mut response = Response::builder()
+            .header("cache-control", "private")
+            .header("server-timing", "upstream;dur=1.0")
+            .body(())
+            .expect("should build private response");
+        append_server_timing_if_private(&mut response, &timings, false);
+        assert!(
+            timings.snapshot().time_elapsed_ms.is_some(),
+            "should mark even when disabled"
+        );
+        assert_eq!(
+            response.headers().get_all("server-timing").iter().count(),
+            1
+        );
+        append_server_timing_if_private(&mut response, &timings, true);
+        let values: Vec<_> = response.headers().get_all("server-timing").iter().collect();
+        assert_eq!(values.len(), 2);
+        assert_eq!(values[0], "upstream;dur=1.0");
+        assert_eq!(response.headers()["cache-control"], "private");
+    }
+
+    #[test]
+    fn every_phase_index_is_unique_and_in_bounds() {
+        // `PHASE_COUNT` and `Phase::index()` are hand-synced; nothing at
+        // compile time ties them together. A new variant whose `index()`
+        // returns `PHASE_COUNT` would silently lose records or panic when
+        // starting a span, so this test fails first instead. (A variant missing from this list is a compile
+        // error via the exhaustive `match` in `index()` once added there.)
+        let phases = [
+            Phase::AppBuild,
+            Phase::Filter,
+            Phase::Geo,
+            Phase::EcKv,
+            Phase::Origin,
+            Phase::TemplateCacheLookup,
+            Phase::AuctionWait,
+            Phase::Stream,
+        ];
+        let mut seen = [false; PHASE_COUNT];
+        for phase in phases {
+            let index = phase.index();
+            assert!(
+                index < PHASE_COUNT,
+                "should be in bounds: {phase:?} -> {index}"
+            );
+            assert!(!seen[index], "should be unique: {phase:?} -> {index}");
+            seen[index] = true;
+        }
+        assert!(
+            seen.iter().all(|slot| *slot),
+            "should cover every phases-array slot"
+        );
+
+        // `HEADER_PHASES` is a second hand-synced list: a phase that gains
+        // a `header_name()` but is never added there silently renders
+        // nothing in the `Server-Timing` value.
+        let header_bearing: Vec<Phase> = phases
+            .into_iter()
+            .filter(|phase| phase.header_name().is_some())
+            .collect();
+        assert_eq!(
+            header_bearing,
+            HEADER_PHASES.to_vec(),
+            "should render every header-bearing phase, in declaration order"
+        );
+    }
+
+    #[test]
+    fn auction_marks_are_first_call_wins_and_snapshot_maps_them() {
+        let timings = RequestTimings::new();
+        timings.set_auction_id(uuid::uuid!("11111111-1111-1111-1111-111111111111"));
+        timings.mark_auction_dispatched();
+        timings.mark_auction_resolved();
+        timings.mark_auction_committed();
+        let first = timings.snapshot();
+
+        // Sleep so a restamp would land on a different millisecond: without
+        // it both stamps fall in the same millisecond and an equality
+        // assertion would hold even under last-call-wins.
+        std::thread::sleep(Duration::from_millis(5));
+        timings.set_auction_id(uuid::uuid!("22222222-2222-2222-2222-222222222222"));
+        timings.mark_auction_dispatched();
+        timings.mark_auction_resolved();
+        timings.mark_auction_committed();
+
+        let second = timings.snapshot();
+        assert_eq!(
+            second.auction_dispatched_ms, first.auction_dispatched_ms,
+            "should not restamp the dispatch offset"
+        );
+        assert_eq!(
+            second.auction_resolved_ms, first.auction_resolved_ms,
+            "should not restamp the resolve offset"
+        );
+        assert_eq!(
+            second.auction_committed_ms, first.auction_committed_ms,
+            "should not restamp the commit offset"
+        );
+        assert_eq!(
+            second.auction_id,
+            Some(uuid::uuid!("11111111-1111-1111-1111-111111111111")),
+            "should keep the first-recorded auction id"
+        );
+    }
+
+    #[test]
+    fn auction_id_survives_a_dropped_dispatch_mark() {
+        // The join key is stamped where the observation is built, so an
+        // auction that is skipped or fails to dispatch still carries the id
+        // that its `auction_events_raw` row was emitted under.
+        let timings = RequestTimings::new();
+        timings.set_auction_id(uuid::uuid!("44444444-4444-4444-4444-444444444444"));
+
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_id,
+            Some(uuid::uuid!("44444444-4444-4444-4444-444444444444")),
+            "should carry the join key without a dispatch mark"
+        );
+        assert_eq!(
+            snapshot.auction_dispatched_ms, None,
+            "should leave the dispatch offset null when nothing was sent"
+        );
+    }
+
+    #[test]
+    fn snapshot_without_auction_marks_yields_none_for_all_offsets() {
+        let timings = RequestTimings::new();
+        timings.mark_headers_ready();
+        let snapshot = timings.snapshot();
+        assert_eq!(
+            snapshot.auction_dispatched_ms, None,
+            "should stay None when no auction dispatched"
+        );
+        assert_eq!(
+            snapshot.auction_resolved_ms, None,
+            "should stay None when no auction resolved"
+        );
+        assert_eq!(
+            snapshot.auction_committed_ms, None,
+            "should stay None when no auction committed"
+        );
+        assert_eq!(
+            snapshot.auction_id, None,
+            "should carry no auction id when no auction ran"
+        );
+    }
+
+    #[test]
+    fn render_omits_unrecorded_phases_and_orders_total_first() {
+        let timings = RequestTimings::new();
+        timings.record(Phase::Filter, Duration::from_micros(9_100));
+        timings.mark_headers_ready();
+        let value = timings
+            .server_timing_value()
+            .expect("should render after mark_headers_ready");
+        assert!(
+            value.starts_with("ts-total;dur="),
+            "should lead with ts-total: {value}"
+        );
+        assert!(
+            value.contains("ts-filter;dur=9.1"),
+            "should render one decimal: {value}"
+        );
+        assert!(
+            !value.contains("ts-geo"),
+            "should omit unrecorded phases: {value}"
+        );
+    }
+
+    #[test]
+    fn render_returns_none_before_headers_ready() {
+        let timings = RequestTimings::new();
+        timings.record(Phase::Geo, Duration::from_millis(1));
+        assert!(
+            timings.server_timing_value().is_none(),
+            "should require the snapshot"
+        );
+    }
+
+    #[test]
+    fn repeated_phases_accumulate_saturating() {
+        let timings = RequestTimings::new();
+        timings.record(Phase::Geo, Duration::from_millis(2));
+        timings.record(Phase::Geo, Duration::from_millis(3));
+        timings.mark_headers_ready();
+        let snapshot = timings.snapshot();
+        assert_eq!(snapshot.geo_ms, Some(5), "should accumulate repeats");
+    }
+
+    #[test]
+    fn mark_headers_ready_is_first_call_wins() {
+        let timings = RequestTimings::new();
+        timings.mark_headers_ready();
+        let first = timings.snapshot().time_elapsed_ms;
+        std::thread::sleep(Duration::from_millis(5));
+        timings.mark_headers_ready();
+        assert_eq!(
+            timings.snapshot().time_elapsed_ms,
+            first,
+            "should not restamp"
+        );
+    }
+
+    #[test]
+    fn span_guard_records_on_drop() {
+        let timings = RequestTimings::new();
+        {
+            let _span = timings.span(Phase::Origin);
+            std::thread::sleep(Duration::from_millis(2));
+        }
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().origin_ms.expect("should record on drop") >= 1,
+            "should measure elapsed span time"
+        );
+    }
+
+    #[test]
+    fn auction_wait_keeps_zero_duration_and_placement() {
+        for placement in [
+            AuctionWaitPlacement::PreHeader,
+            AuctionWaitPlacement::InStream,
+        ] {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.record_auction_wait(placement, Duration::ZERO);
+
+            let snapshot = timings.snapshot();
+            assert_eq!(
+                snapshot.auction_wait_ms,
+                Some(0),
+                "should preserve a measured zero wait"
+            );
+            assert_eq!(
+                snapshot.auction_wait_placement,
+                Some(placement),
+                "should retain placement for a measured zero wait"
+            );
+        }
+    }
+
+    #[test]
+    fn auction_wait_records_placement() {
+        let timings = RequestTimings::new();
+        timings.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::from_millis(40));
+        let snapshot = timings.snapshot();
+        assert_eq!(snapshot.auction_wait_ms, Some(40), "should record wait");
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::PreHeader),
+            "should record placement"
+        );
+    }
+
+    #[test]
+    fn rendered_names_never_include_vendor_terms() {
+        let timings = RequestTimings::new();
+        for phase in [
+            Phase::AppBuild,
+            Phase::Filter,
+            Phase::Geo,
+            Phase::EcKv,
+            Phase::Origin,
+            Phase::TemplateCacheLookup,
+        ] {
+            timings.record(phase, Duration::from_millis(1));
+        }
+        timings.mark_headers_ready();
+        let value = timings.server_timing_value().expect("should render");
+        assert!(
+            !value.to_ascii_lowercase().contains("datadome"),
+            "should mask vendors"
+        );
+    }
+
+    #[test]
+    fn append_server_timing_emits_on_private_response_when_enabled() {
+        let mut response = Response::builder()
+            .header("cache-control", "private, no-store")
+            .body(())
+            .expect("should build a private response fixture");
+        let timings = RequestTimings::new();
+
+        append_server_timing_if_private(&mut response, &timings, true);
+
+        let header = response
+            .headers()
+            .get("server-timing")
+            .and_then(|value| value.to_str().ok())
+            .expect("should emit a Server-Timing header");
+        assert!(
+            header.starts_with("ts-total;dur="),
+            "should lead with the stored total: {header}"
+        );
+    }
+
+    #[test]
+    fn append_server_timing_rejects_edge_cache_header_collisions() {
+        for cache_control in ["private", "no-store"] {
+            for edge_header in EDGE_CACHE_HEADER_NAMES {
+                let mut response = Response::builder()
+                    .header("cache-control", cache_control)
+                    .header(*edge_header, "max-age=60")
+                    .body(())
+                    .expect("should build a response with conflicting cache directives");
+                let timings = RequestTimings::new();
+
+                append_server_timing_if_private(&mut response, &timings, true);
+
+                assert!(
+                    response.headers().get("server-timing").is_none(),
+                    "should suppress Server-Timing with {edge_header} and Cache-Control: {cache_control}"
+                );
+                assert!(
+                    timings.snapshot().time_elapsed_ms.is_some(),
+                    "should still stamp headers-ready"
+                );
+            }
+        }
+
+        for (cache_control, enabled) in [(None, true), (Some("public, max-age=60"), true)] {
+            let mut builder = Response::builder();
+            if let Some(cache_control) = cache_control {
+                builder = builder.header("cache-control", cache_control);
+            }
+            let mut response = builder.body(()).expect("should build response");
+            append_server_timing_if_private(&mut response, &RequestTimings::new(), enabled);
+            assert!(
+                response.headers().get("server-timing").is_none(),
+                "should suppress Server-Timing without private/no-store Cache-Control"
+            );
+        }
+    }
+
+    #[test]
+    fn append_server_timing_requires_a_bare_privacy_directive() {
+        for cache_control in [
+            "private=\"Set-Cookie\", max-age=600",
+            "public, s-maxage=600, private=\"Set-Cookie\"",
+            "private = \"Set-Cookie\"",
+            "private=Set-Cookie",
+            "private=\"cache-control, no-store\"",
+            "private=\"\"",
+            "private; extension",
+            "no-store=\"field\"",
+            "not-private, no-storey",
+            "ext=\"private,no-store\", max-age=600",
+            r#"ext="escaped\",private,no-store", max-age=600"#,
+        ] {
+            let mut response = Response::builder()
+                .header("cache-control", cache_control)
+                .header("server-timing", "upstream;dur=1.0")
+                .body(())
+                .expect("should build a response without whole-response privacy");
+            let timings = RequestTimings::new();
+
+            append_server_timing_if_private(&mut response, &timings, true);
+
+            assert_eq!(
+                response.headers().get_all("server-timing").iter().count(),
+                1,
+                "should not append timing for Cache-Control: {cache_control}"
+            );
+            assert_eq!(
+                response.headers()["server-timing"],
+                "upstream;dur=1.0",
+                "should preserve upstream timing"
+            );
+            assert_eq!(
+                response.headers()["cache-control"],
+                cache_control,
+                "should not rewrite the cache policy"
+            );
+            assert!(
+                timings.snapshot().time_elapsed_ms.is_some(),
+                "should freeze timing even when the policy suppresses emission"
+            );
+        }
+    }
+
+    #[test]
+    fn append_server_timing_accepts_bare_privacy_among_qualified_directives() {
+        for cache_control in [
+            "private",
+            " No-Store ",
+            "PRIVATE, max-age=60",
+            "private=\"Set-Cookie\", no-store",
+            "ext=\"private,no-store\", private",
+            r#"ext="escaped\",private,no-store", PRIVATE"#,
+        ] {
+            let mut response = Response::builder()
+                .header("cache-control", "private=\"Set-Cookie\"")
+                .body(())
+                .expect("should build a field-qualified response");
+            response.headers_mut().append(
+                http::header::CACHE_CONTROL,
+                HeaderValue::from_str(cache_control).expect("should build a cache-control value"),
+            );
+
+            append_server_timing_if_private(&mut response, &RequestTimings::new(), true);
+
+            assert!(
+                response.headers().get("server-timing").is_some(),
+                "should recognize whole-response privacy across all header values: {cache_control}"
+            );
+        }
+    }
+
+    #[test]
+    fn append_server_timing_marks_headers_ready_even_when_not_emitted() {
+        let mut response = Response::builder()
+            .header("cache-control", "max-age=60")
+            .body(())
+            .expect("should build a shared-cacheable response fixture");
+        let timings = RequestTimings::new();
+
+        append_server_timing_if_private(&mut response, &timings, true);
+
+        assert!(
+            response.headers().get("server-timing").is_none(),
+            "should not emit on a shared-cacheable response"
+        );
+        assert!(
+            timings.server_timing_value().is_some(),
+            "should still stamp mark_headers_ready so ts-total reflects the freeze point"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 754acfc262..0e67292a6e 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -6,7 +6,7 @@ use regex::Regex;
 use serde::{Deserialize, Deserializer, Serialize, de::DeserializeOwned};
 use serde_json::Value as JsonValue;
 use sha2::{Digest as _, Sha256};
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::ops::{Deref, DerefMut};
 use std::str::FromStr;
 use std::sync::OnceLock;
@@ -20,6 +20,7 @@ use crate::cache_policy::{CachePolicy, CacheVisibility};
 use crate::consent_config::ConsentConfig;
 use crate::constants::INTERNAL_HEADERS;
 use crate::creative_opportunities::CreativeOpportunitiesConfig;
+use crate::ec::identity::IdentityProviderId;
 use crate::error::TrustedServerError;
 use crate::host_header::validate_host_header_override_value;
 use crate::http_util::SPOOFABLE_FORWARDED_HEADERS;
@@ -467,22 +468,27 @@ pub struct EcPartner {
     /// Allowlist of domains TS may call for this partner's pull sync.
     #[serde(default, deserialize_with = "vec_from_seq_or_map")]
     pub pull_sync_allowed_domains: Vec<String>,
-    /// Legacy pull-sync refresh interval retained for config compatibility.
+    /// Catches the removed `pull_sync_ttl_sec` key.
     ///
-    /// EC identity entries no longer store per-partner sync timestamps, so
-    /// this value is not used by the current fill-missing-only pull sync
-    /// behavior.
-    #[serde(
-        default = "EcPartner::default_pull_sync_ttl_sec",
-        deserialize_with = "from_value_or_str"
-    )]
-    pub pull_sync_ttl_sec: u64,
-    /// Max pull sync calls per EC hash per partner per hour.
-    #[serde(
-        default = "EcPartner::default_pull_sync_rate_limit",
-        deserialize_with = "from_value_or_str"
-    )]
-    pub pull_sync_rate_limit: u32,
+    /// The key was replaced by `refresh_after_sec` in
+    /// `[ec.identity.providers.<pull-id>]`. It is parsed only so validation
+    /// can name its replacement instead of failing with a generic
+    /// unknown-field message, and it is never serialized.
+    #[serde(default, rename = "pull_sync_ttl_sec", skip_serializing)]
+    pub removed_pull_sync_ttl_sec: Option<serde_json::Value>,
+    /// Catches the removed `pull_sync_rate_limit` key.
+    ///
+    /// The key was replaced by `max_calls_per_minute` in
+    /// `[ec.identity.providers.<pull-id>]`. It is parsed only so validation
+    /// can name its replacement, and it is never serialized.
+    #[serde(default, rename = "pull_sync_rate_limit", skip_serializing)]
+    pub removed_pull_sync_rate_limit: Option<serde_json::Value>,
+    /// The identity provider that owns this partner's source domain.
+    ///
+    /// The owner refreshes the source and wins in the auction (spec 7.2). It
+    /// must name an enabled provider that resolves the source.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub owner: Option<String>,
     /// Outbound bearer token for pull sync requests.
     #[serde(default)]
     pub ts_pull_token: Option<Redacted<String>>,
@@ -567,16 +573,6 @@ impl EcPartner {
     pub const fn default_batch_rate_limit() -> u32 {
         60
     }
-
-    #[must_use]
-    pub const fn default_pull_sync_ttl_sec() -> u64 {
-        86400
-    }
-
-    #[must_use]
-    pub const fn default_pull_sync_rate_limit() -> u32 {
-        10
-    }
 }
 
 /// Edge Cookie (EC) configuration.
@@ -594,9 +590,24 @@ pub struct Ec {
     #[serde(default)]
     pub ec_store: Option<String>,
 
-    /// Maximum number of concurrent pull-sync requests.
-    #[serde(default = "Ec::default_pull_sync_concurrency")]
-    pub pull_sync_concurrency: usize,
+    /// Server-side identity provider policy (`[ec.identity]`).
+    #[serde(default)]
+    pub identity: IdentitySettings,
+
+    /// Strips the `ts-eids` cookie from publisher-origin requests, as well as
+    /// the `ts-eids-s` mirror that is always stripped. Off by default, so an
+    /// origin that reads `ts-eids` keeps receiving it. An operator whose
+    /// origin rejects large `Cookie` headers turns it on.
+    #[serde(default)]
+    pub strip_eids_cookie_from_origin: bool,
+
+    /// Catches the removed `pull_sync_concurrency` key.
+    ///
+    /// The key was replaced by `[ec.identity].max_concurrency`. It is parsed
+    /// only so validation can name its replacement instead of failing with a
+    /// generic unknown-field message, and it is never serialized.
+    #[serde(default, rename = "pull_sync_concurrency", skip_serializing)]
+    pub removed_pull_sync_concurrency: Option<serde_json::Value>,
 
     /// Entries with `cluster_size` at or below this value are treated as
     /// individual users for identity resolution. B2B publishers should
@@ -628,12 +639,6 @@ impl Ec {
         "replace-with-random-ec-passphrase",
     ];
 
-    /// Default maximum concurrent pull-sync requests.
-    #[must_use]
-    pub const fn default_pull_sync_concurrency() -> usize {
-        3
-    }
-
     /// Default cluster trust threshold.
     #[must_use]
     pub const fn default_cluster_trust_threshold() -> u32 {
@@ -679,6 +684,241 @@ impl Ec {
     }
 }
 
+/// Server-side identity provider policy.
+///
+/// Mapped from the `[ec.identity]` TOML section. Unlike the rest of the
+/// settings, this table and its provider tables accept unknown keys, so a
+/// rollback to an earlier release still loads a config written for a later one.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct IdentitySettings {
+    /// Maximum providers dispatched at once.
+    #[serde(default = "IdentitySettings::default_max_concurrency")]
+    pub max_concurrency: usize,
+
+    /// Total time a navigation may wait for hold-mode providers.
+    #[serde(default = "IdentitySettings::default_hold_budget_ms")]
+    pub hold_budget_ms: u64,
+
+    /// Seconds before a provider that timed out in hold mode is held again.
+    #[serde(default = "IdentitySettings::default_hold_retry_sec")]
+    pub hold_retry_sec: u64,
+
+    /// Largest provider response body accepted, in bytes.
+    #[serde(default = "IdentitySettings::default_max_response_bytes")]
+    pub max_response_bytes: usize,
+
+    /// Most backend requests one platform execution may start, counting the
+    /// origin, the auction and every provider call. A provider call that
+    /// would pass it is not sent, and is not a failure. Fastly allows 32
+    /// (10 on trial accounts).
+    #[serde(default = "IdentitySettings::default_max_backend_requests")]
+    pub max_backend_requests: usize,
+
+    /// Whether `/auction` and `/_ts/page-bids` return the `ts-eids-s` mirror
+    /// payload the shim writes. Off until a page script that reads the
+    /// mirror is named (spec 15, question 5).
+    #[serde(default)]
+    pub mirror_enabled: bool,
+
+    /// Seconds a same-origin `/_ts/page-bids` call from a real browser waits
+    /// after the row's last writer flush before it may be the writer itself,
+    /// for single-page apps (spec 5.1). 0 turns the SPA writer off.
+    #[serde(default = "IdentitySettings::default_spa_writer_interval_sec")]
+    pub spa_writer_interval_sec: u64,
+
+    /// Per-provider policy, keyed by identity provider ID.
+    #[serde(default)]
+    pub providers: BTreeMap<String, ProviderSettings>,
+}
+
+impl IdentitySettings {
+    /// Default maximum concurrent providers.
+    #[must_use]
+    pub const fn default_max_concurrency() -> usize {
+        4
+    }
+
+    /// Default backend request budget: Fastly's per-execution limit.
+    #[must_use]
+    pub const fn default_max_backend_requests() -> usize {
+        32
+    }
+
+    /// Default SPA writer interval: five minutes.
+    #[must_use]
+    pub const fn default_spa_writer_interval_sec() -> u64 {
+        300
+    }
+
+    /// Default hold budget in milliseconds.
+    #[must_use]
+    pub const fn default_hold_budget_ms() -> u64 {
+        100
+    }
+
+    /// Default hold retry interval in seconds.
+    #[must_use]
+    pub const fn default_hold_retry_sec() -> u64 {
+        300
+    }
+
+    /// Default provider response cap in bytes.
+    #[must_use]
+    pub const fn default_max_response_bytes() -> usize {
+        65_536
+    }
+
+    /// Returns the policy for `id`, or the defaults when it has no table.
+    #[must_use]
+    pub fn provider(&self, id: &IdentityProviderId) -> ProviderSettings {
+        self.providers.get(id.as_str()).cloned().unwrap_or_default()
+    }
+}
+
+impl Default for IdentitySettings {
+    fn default() -> Self {
+        Self {
+            max_concurrency: Self::default_max_concurrency(),
+            hold_budget_ms: Self::default_hold_budget_ms(),
+            hold_retry_sec: Self::default_hold_retry_sec(),
+            max_response_bytes: Self::default_max_response_bytes(),
+            max_backend_requests: Self::default_max_backend_requests(),
+            mirror_enabled: false,
+            spa_writer_interval_sec: Self::default_spa_writer_interval_sec(),
+            providers: BTreeMap::new(),
+        }
+    }
+}
+
+/// How a provider's lookup interacts with the navigation response.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ProviderMode {
+    /// Wait for the provider, within the hold budget, before responding.
+    Hold,
+    /// Dispatch after the response is sent.
+    #[default]
+    AfterSend,
+}
+
+/// How far a revoke signal from a provider reaches.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RevokeScope {
+    /// Revoke only the signalling provider's identifiers.
+    Provider,
+    /// Revoke every identifier of the user.
+    Global,
+}
+
+/// Policy for one identity provider (`[ec.identity.providers.<id>]`).
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ProviderSettings {
+    /// Hold or after-send dispatch.
+    #[serde(default)]
+    pub mode: ProviderMode,
+
+    /// Hold-mode timeout; the hold budget when unset.
+    #[serde(default)]
+    pub timeout_ms: Option<u64>,
+
+    /// Timeout for any dispatch after the response is sent.
+    #[serde(default = "ProviderSettings::default_after_send_timeout_ms")]
+    pub after_send_timeout_ms: u64,
+
+    /// Source domains this provider may write; the descriptor's when unset.
+    #[serde(default)]
+    pub sources: Option<Vec<String>>,
+
+    /// Seconds before a stored ID is refreshed.
+    #[serde(default = "ProviderSettings::default_refresh_after_sec")]
+    pub refresh_after_sec: u64,
+
+    /// Provider calls allowed per minute.
+    #[serde(default = "ProviderSettings::default_max_calls_per_minute")]
+    pub max_calls_per_minute: u32,
+
+    /// Calls per minute from one client address, across every visitor
+    /// behind it. `0` turns the ceiling off.
+    #[serde(default = "ProviderSettings::default_max_calls_per_ip_per_minute")]
+    pub max_calls_per_ip_per_minute: u32,
+
+    /// Failures per minute that open the circuit breaker.
+    #[serde(default = "ProviderSettings::default_breaker_failures_per_minute")]
+    pub breaker_failures_per_minute: u32,
+
+    /// Ordering of this provider's ID in the cookie when it must be trimmed.
+    #[serde(default)]
+    pub cookie_priority: i32,
+
+    /// Scope of this provider's revoke signals; `Provider` when unset.
+    #[serde(default)]
+    pub revoke_scope: Option<RevokeScope>,
+}
+
+impl ProviderSettings {
+    /// Default after-send timeout in milliseconds.
+    #[must_use]
+    pub const fn default_after_send_timeout_ms() -> u64 {
+        1000
+    }
+
+    /// Default refresh interval in seconds.
+    #[must_use]
+    pub const fn default_refresh_after_sec() -> u64 {
+        86_400
+    }
+
+    /// Default provider calls per minute.
+    #[must_use]
+    pub const fn default_max_calls_per_minute() -> u32 {
+        1
+    }
+
+    /// Default calls per minute from one client address.
+    #[must_use]
+    pub const fn default_max_calls_per_ip_per_minute() -> u32 {
+        10
+    }
+
+    /// Default breaker failures per minute.
+    #[must_use]
+    pub const fn default_breaker_failures_per_minute() -> u32 {
+        50
+    }
+
+    /// Hold-mode timeout: `timeout_ms`, else the hold budget.
+    ///
+    /// The coordinator caps it at the remaining hold budget.
+    #[must_use]
+    pub fn hold_timeout_ms(&self, identity: &IdentitySettings) -> u64 {
+        self.timeout_ms.unwrap_or(identity.hold_budget_ms)
+    }
+
+    /// The revoke scope, defaulting to [`RevokeScope::Provider`].
+    #[must_use]
+    pub fn revoke_scope(&self) -> RevokeScope {
+        self.revoke_scope.unwrap_or(RevokeScope::Provider)
+    }
+}
+
+impl Default for ProviderSettings {
+    fn default() -> Self {
+        Self {
+            mode: ProviderMode::default(),
+            timeout_ms: None,
+            after_send_timeout_ms: Self::default_after_send_timeout_ms(),
+            sources: None,
+            refresh_after_sec: Self::default_refresh_after_sec(),
+            max_calls_per_minute: Self::default_max_calls_per_minute(),
+            max_calls_per_ip_per_minute: Self::default_max_calls_per_ip_per_minute(),
+            breaker_failures_per_minute: Self::default_breaker_failures_per_minute(),
+            cookie_priority: 0,
+            revoke_scope: None,
+        }
+    }
+}
+
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
 #[serde(deny_unknown_fields)]
 pub struct Rewrite {
@@ -2049,9 +2289,19 @@ impl Proxy {
 /// Direct Tinybird Events API telemetry configuration.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct TinybirdSettings {
-    /// Master enablement for auction telemetry ingestion.
+    /// Master enablement for Tinybird telemetry. Required by both auction and
+    /// access-log emission; each is independently toggled below.
     #[serde(default)]
     pub enabled: bool,
+    /// Emit auction telemetry when `enabled`. Defaults to `true` so existing
+    /// configs preserve their current auction-emission behavior after
+    /// upgrading; set `false` to silence auction events while keeping
+    /// `enabled` on for other Tinybird telemetry (e.g. `access_enabled`).
+    /// The default `true` is omitted from serialized config; `false` is an
+    /// explicit opt-out for binaries that support this field. Older binaries
+    /// may ignore that opt-out and resume auction telemetry on rollback.
+    #[serde(default = "default_true", skip_serializing_if = "is_true")]
+    pub auction_enabled: bool,
     /// Regional Tinybird API host, without scheme or path.
     #[serde(default)]
     pub api_host: String,
@@ -2064,19 +2314,26 @@ pub struct TinybirdSettings {
     /// Secret reference containing the auction datasource APPEND token.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub auction_token_secret: Option<Redacted<String>>,
-    /// Reserved for future access-log telemetry.
+    /// Emit access-log telemetry when `enabled`, independent of
+    /// `auction_enabled`.
     ///
-    /// `true` is rejected until an access-log emitter is wired, so operators
-    /// cannot enable a setting that silently emits nothing.
+    /// `true` requires `enabled`, non-empty `api_host`/`access_dataset`, a
+    /// resolved `access_token_secret`, `max_body_bytes >= 1024`, and
+    /// `access_sample_rate > 0.0`. This prevents an armed-but-silent sampler
+    /// that enables the flag but emits nothing.
     #[serde(default)]
     pub access_enabled: bool,
-    /// Future access-log Events API datasource name.
+    /// Access-log Events API datasource name. Required non-empty when
+    /// `access_enabled`.
     #[serde(default = "default_tinybird_access_dataset")]
     pub access_dataset: String,
-    /// Deprecated placeholder for the unwired access-log APPEND token.
-    #[serde(default, skip_serializing)]
+    /// Secret reference containing the access-log datasource APPEND token.
+    /// Required when `access_enabled`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub access_token_secret: Option<Redacted<String>>,
-    /// Future fraction of requests to emit for optional access telemetry.
+    /// Fraction of requests to emit for access telemetry. Must be greater
+    /// than `0.0` when `access_enabled`, so an operator cannot enable access
+    /// telemetry while sampling it away entirely.
     #[serde(default)]
     pub access_sample_rate: f64,
     /// Defensive maximum NDJSON body size for one Events API request.
@@ -2089,7 +2346,7 @@ fn default_tinybird_auction_dataset() -> String {
 }
 
 fn default_tinybird_access_dataset() -> String {
-    "access_logs_raw".to_owned()
+    "access_logs_v2".to_owned()
 }
 
 fn default_tinybird_max_body_bytes() -> usize {
@@ -2100,6 +2357,7 @@ impl Default for TinybirdSettings {
     fn default() -> Self {
         Self {
             enabled: false,
+            auction_enabled: default_true(),
             api_host: String::new(),
             secret_store: None,
             auction_dataset: default_tinybird_auction_dataset(),
@@ -2122,14 +2380,17 @@ impl TinybirdSettings {
             );
         }
         self.auction_dataset = self.auction_dataset.trim().to_owned();
-        self.auction_token_secret = self.auction_token_secret.take().and_then(|value| {
-            let value = value.expose().trim().to_owned();
-            (!value.is_empty()).then(|| Redacted::new(value))
-        });
+        self.auction_token_secret = normalize_secret(self.auction_token_secret.take());
         self.access_dataset = self.access_dataset.trim().to_owned();
-        self.access_token_secret = None;
+        self.access_token_secret = normalize_secret(self.access_token_secret.take());
     }
 
+    /// Validate this settings block, including the access-telemetry matrix:
+    /// `access_enabled` requires `enabled`, a non-empty `api_host` and
+    /// `access_dataset`, a resolved `access_token_secret`, a `max_body_bytes`
+    /// above the defensive floor enforced below, and an `access_sample_rate`
+    /// greater than `0.0`. Auction emission is independently gated by
+    /// `auction_enabled` and validated the same way.
     fn prepare_runtime(&mut self) -> Result<(), Report<TrustedServerError>> {
         self.normalize();
         if !(0.0..=1.0).contains(&self.access_sample_rate) {
@@ -2142,27 +2403,59 @@ impl TinybirdSettings {
                 message: "tinybird.max_body_bytes must be at least 1024".to_owned(),
             }));
         }
-        if self.access_enabled {
+        if self.access_enabled && !self.enabled {
             return Err(Report::new(TrustedServerError::Configuration {
-                message: "tinybird.access_enabled is reserved for future access-log telemetry; no emitter is currently wired".to_owned(),
+                message: "tinybird.access_enabled requires tinybird.enabled".to_owned(),
             }));
         }
         if !self.enabled {
             return Ok(());
         }
         validate_tinybird_api_host(&self.api_host)?;
-        validate_tinybird_dataset(&self.auction_dataset, "tinybird.auction_dataset")?;
-        let token = self.auction_token_secret.as_ref().ok_or_else(|| {
-            Report::new(TrustedServerError::Configuration {
-                message:
-                    "tinybird.auction_token_secret is required when Tinybird telemetry is enabled"
-                        .to_owned(),
-            })
-        })?;
-        validate_tinybird_secret(token.expose(), "tinybird.auction_token_secret")
+        if self.auction_enabled {
+            validate_tinybird_dataset(&self.auction_dataset, "tinybird.auction_dataset")?;
+            let token = self.auction_token_secret.as_ref().ok_or_else(|| {
+                Report::new(TrustedServerError::Configuration {
+                    message:
+                        "tinybird.auction_token_secret is required when tinybird.auction_enabled is true"
+                            .to_owned(),
+                })
+            })?;
+            validate_tinybird_secret(token.expose(), "tinybird.auction_token_secret")?;
+        }
+        if self.access_enabled {
+            validate_tinybird_dataset(&self.access_dataset, "tinybird.access_dataset")?;
+            if self.access_dataset == "access_logs_raw" {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "tinybird.access_dataset must not be access_logs_raw when access telemetry is enabled; use access_logs_v2 or a datasource with the v2 schema".to_owned(),
+                }));
+            }
+            let token = self.access_token_secret.as_ref().ok_or_else(|| {
+                Report::new(TrustedServerError::Configuration {
+                    message:
+                        "tinybird.access_token_secret is required when tinybird.access_enabled is true"
+                            .to_owned(),
+                })
+            })?;
+            validate_tinybird_secret(token.expose(), "tinybird.access_token_secret")?;
+            if self.access_sample_rate <= 0.0 {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "tinybird.access_sample_rate must be > 0 when tinybird.access_enabled is true".to_owned(),
+                }));
+            }
+        }
+        Ok(())
     }
 }
 
+/// Trim a resolved secret, dropping it entirely when nothing is left.
+fn normalize_secret(value: Option<Redacted<String>>) -> Option<Redacted<String>> {
+    value.and_then(|value| {
+        let value = value.expose().trim().to_owned();
+        (!value.is_empty()).then(|| Redacted::new(value))
+    })
+}
+
 fn validate_tinybird_api_host(host: &str) -> Result<(), Report<TrustedServerError>> {
     if host.is_empty()
         || host.contains('/')
@@ -2183,6 +2476,17 @@ fn validate_tinybird_api_host(host: &str) -> Result<(), Report<TrustedServerErro
     })
 }
 
+// Takes the resolved secret VALUE, so the error message names only the
+// setting: formatting the value itself would disclose the credential.
+fn validate_tinybird_secret(value: &str, setting: &str) -> Result<(), Report<TrustedServerError>> {
+    if value.is_empty() || value.chars().any(char::is_control) {
+        return Err(Report::new(TrustedServerError::Configuration {
+            message: format!("{setting} must be non-empty after secret resolution"),
+        }));
+    }
+    Ok(())
+}
+
 fn validate_tinybird_dataset(value: &str, setting: &str) -> Result<(), Report<TrustedServerError>> {
     if value.is_empty()
         || value.len() > 128
@@ -2197,15 +2501,6 @@ fn validate_tinybird_dataset(value: &str, setting: &str) -> Result<(), Report<Tr
     Ok(())
 }
 
-fn validate_tinybird_secret(value: &str, setting: &str) -> Result<(), Report<TrustedServerError>> {
-    if value.is_empty() || value.chars().any(char::is_control) {
-        return Err(Report::new(TrustedServerError::Configuration {
-            message: format!("{setting} must be non-empty after secret resolution"),
-        }));
-    }
-    Ok(())
-}
-
 /// Cache behavior configuration.
 #[derive(Debug, Default, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -2805,6 +3100,14 @@ pub(crate) const AUCTION_DEBUG_UPSTREAM_METADATA_KEYS: &[&str] = &[
     "upstream_message_truncated",
 ];
 
+/// `skip_serializing_if` helper: true is the serde default for the fields
+/// that use it, so serializing it would only widen the pushed config's
+/// rollback surface.
+#[allow(clippy::trivially_copy_pass_by_ref)]
+fn is_true(value: &bool) -> bool {
+    *value
+}
+
 fn default_true() -> bool {
     true
 }
@@ -2952,6 +3255,81 @@ pub enum AuctionDebugCommentFormat {
     Pretty,
 }
 
+/// Request-observability toggles exposed to operators.
+///
+/// The default table must stay omitted from serialized config blobs. Older
+/// binaries deny unknown fields on [`Settings`], so a blob carrying the new
+/// `[observability]` table would fail to load and break rollback. See
+/// [`Settings::observability`].
+#[derive(Debug, Clone, Default, PartialEq, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ObservabilitySettings {
+    /// Emit the `Server-Timing` response header with per-phase request
+    /// timing. Defaults to `false` (off).
+    #[serde(default)]
+    pub server_timing_enabled: bool,
+    /// Section names whose publisher paths keep a named route template in
+    /// access telemetry (`/{section}/*`); everything else collapses to
+    /// `/other/*`. Matching is ASCII case-insensitive on the first path
+    /// segment, and a match requires at least one further segment. Defaults
+    /// to empty, which collapses every publisher path. Names are trimmed and
+    /// must be non-empty, contain no `/` or control characters, fit within 128
+    /// UTF-8 bytes, and number at most 32.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub route_sections: Vec<String>,
+}
+
+impl ObservabilitySettings {
+    const MAX_ROUTE_SECTIONS: usize = 32;
+    const MAX_ROUTE_SECTION_BYTES: usize = 128;
+
+    fn normalize(&mut self) {
+        self.route_sections = self
+            .route_sections
+            .iter()
+            .map(|section| {
+                section
+                    .trim_matches(|character: char| {
+                        character.is_whitespace() && !character.is_control()
+                    })
+                    .to_owned()
+            })
+            .collect();
+    }
+
+    fn prepare_runtime(&self) -> Result<(), Report<TrustedServerError>> {
+        if self.route_sections.len() > Self::MAX_ROUTE_SECTIONS {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "observability.route_sections must contain at most {} entries",
+                    Self::MAX_ROUTE_SECTIONS
+                ),
+            }));
+        }
+        for section in &self.route_sections {
+            if section.is_empty()
+                || section.len() > Self::MAX_ROUTE_SECTION_BYTES
+                || section.contains('/')
+                || section.chars().any(char::is_control)
+            {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: format!(
+                        "observability.route_sections entries must be non-empty, contain no slash or control characters, and fit within {} UTF-8 bytes",
+                        Self::MAX_ROUTE_SECTION_BYTES
+                    ),
+                }));
+            }
+        }
+        Ok(())
+    }
+
+    /// True when every field is at its default, i.e. observability is fully
+    /// disabled and the table can be omitted from serialized output.
+    fn is_default(&self) -> bool {
+        *self == Self::default()
+    }
+}
+
 /// Tester-cookie endpoint configuration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
 pub struct TesterCookieConfig {
@@ -3274,6 +3652,12 @@ pub struct Settings {
     pub tinybird: TinybirdSettings,
     #[serde(default)]
     pub debug: DebugConfig,
+    /// Request-observability toggles. The default table is omitted from
+    /// serialized config blobs so a config round-tripped without change
+    /// still parses under a prior binary's schema; see
+    /// [`ObservabilitySettings`].
+    #[serde(default, skip_serializing_if = "ObservabilitySettings::is_default")]
+    pub observability: ObservabilitySettings,
 }
 
 impl Settings {
@@ -3364,6 +3748,7 @@ impl Settings {
         self.rewrite.normalize();
         self.image_optimizer.normalize()?;
         self.debug.auction_html_comment_options.normalize();
+        self.observability.normalize();
         self.tinybird.normalize();
         self.integrations
             .remove_legacy_static_secret_store_selectors();
@@ -3406,6 +3791,7 @@ impl Settings {
         self.cache.prepare_runtime()?;
         self.proxy.prepare_runtime()?;
         self.tinybird.prepare_runtime()?;
+        self.observability.prepare_runtime()?;
         self.debug
             .auction_html_comment_options
             .validate_metadata_keys()?;
@@ -3636,6 +4022,7 @@ impl Settings {
         "/_ts/admin/keys/deactivate",
         "/_ts/admin/ec",
         "/_ts/admin/ec/{id}",
+        "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
         "/_ts/admin/eids",
         "/_ts/admin/cache/purge",
     ];
@@ -3663,9 +4050,28 @@ impl Settings {
         ),
     ];
 
+    /// Probes for the dynamic provider opt-out route: two concrete IDs and
+    /// providers, so a handler anchored to one shape does not count as
+    /// covering the route.
+    const ADMIN_OPT_OUT_AUTH_PROBES: [&str; 2] = [
+        concat!(
+            "/_ts/admin/ec/",
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            ".Ab12Z9",
+            "/providers/pull-ssp-example-com/opt-out",
+        ),
+        concat!(
+            "/_ts/admin/ec/",
+            "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            ".Zz09aB",
+            "/providers/other_provider-2/opt-out",
+        ),
+    ];
+
     fn admin_auth_probes(path: &'static str) -> [&'static str; 2] {
         match path {
             "/_ts/admin/ec/{id}" => Self::ADMIN_EC_ID_AUTH_PROBES,
+            "/_ts/admin/ec/{id}/providers/{provider}/opt-out" => Self::ADMIN_OPT_OUT_AUTH_PROBES,
             path => [path, path],
         }
     }
@@ -4201,6 +4607,7 @@ where
 mod tests {
     use super::*;
     use crate::auction::build_orchestrator;
+    use crate::config::validate_identity_settings;
     use crate::integrations::{
         IntegrationRegistry, gpt::GptConfig, nextjs::NextJsIntegrationConfig,
         prebid::PrebidIntegrationConfig,
@@ -4562,6 +4969,14 @@ mod tests {
         serde_json::from_value::<BaseRevisionSettings>(value)
             .expect("should preserve backward compatibility without forwarder configuration");
     }
+    /// Parses `extra` appended to the shared test fixture TOML, mirroring the
+    /// `format!("{}\n...", crate_test_settings_str())` pattern used throughout
+    /// this module's other tests.
+    fn settings_from_toml_with(extra: &str) -> Result<Settings, Report<TrustedServerError>> {
+        let toml = format!("{}\n{extra}", crate_test_settings_str());
+        Settings::from_toml(&toml)
+    }
+
     fn trusted_client_ip_toml(ip_header: &str, auth_header: &str, shared_secret: &str) -> String {
         format!(
             "{}\n[trusted_client_ip]\nip_header = \"{ip_header}\"\nauth_header = \"{auth_header}\"\nshared_secret = \"{shared_secret}\"\n",
@@ -4731,8 +5146,9 @@ mod tests {
             pull_sync_enabled: false,
             pull_sync_url: None,
             pull_sync_allowed_domains: Vec::new(),
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: Some(Redacted::new(CANARY_EC_PARTNER_TS_PULL_TOKEN.to_string())),
         }];
 
@@ -4761,6 +5177,7 @@ mod tests {
             auction_token_secret: Some(Redacted::new(CANARY_TINYBIRD_AUCTION_TOKEN.to_string())),
             access_token_secret: Some(Redacted::new(CANARY_TINYBIRD_ACCESS_TOKEN.to_string())),
             enabled: false,
+            auction_enabled: true,
             api_host: String::new(),
             secret_store: None,
             auction_dataset: String::new(),
@@ -5481,6 +5898,17 @@ mod tests {
         );
     }
 
+    #[test]
+    fn tinybird_deployment_validation_requires_default_on_auction_secret() {
+        let error =
+            settings_from_toml_with("[tinybird]\nenabled = true\napi_host = \"api.example.com\"\n")
+                .expect_err("should reject a missing default-on auction token");
+        assert!(
+            error.to_string().contains("tinybird.auction_token_secret"),
+            "should match runtime blob validation: {error:?}"
+        );
+    }
+
     #[test]
     fn tinybird_accepts_region_host_without_scheme() {
         let toml = format!(
@@ -5494,17 +5922,224 @@ mod tests {
     }
 
     #[test]
-    fn tinybird_access_enabled_is_rejected_until_emitter_is_wired() {
-        let toml = format!(
-            "{}\n[tinybird]\naccess_enabled = true\n",
-            crate_test_settings_str()
+    fn tinybird_access_enabled_with_full_config_is_accepted() {
+        let settings = settings_from_toml_with(
+            "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_token_secret = \"test-auction-token\"\naccess_enabled = true\naccess_token_secret = \"test-access-token\"\naccess_sample_rate = 1.0\n",
+        )
+        .expect("should accept a fully-specified access telemetry config");
+        assert!(
+            settings.tinybird.access_enabled,
+            "should enable access emission"
         );
+    }
 
-        let err = Settings::from_toml(&toml)
-            .expect_err("should reject access telemetry before emitter exists");
+    #[test]
+    fn access_enabled_rejects_legacy_dataset_after_normalization() {
+        for dataset in ["access_logs_raw", " access_logs_raw "] {
+            let config = format!(
+                "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_enabled = false\naccess_enabled = true\naccess_dataset = \"{dataset}\"\naccess_token_secret = \"test-access-token\"\naccess_sample_rate = 1.0\n"
+            );
+            let error = settings_from_toml_with(&config)
+                .expect_err("should reject v2 access rows targeting the legacy datasource");
+            assert!(
+                error.to_string().contains("tinybird.access_dataset"),
+                "should identify the invalid access dataset: {error:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn disabled_access_accepts_legacy_dataset() {
+        let settings = settings_from_toml_with(
+            "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_token_secret = \"test-auction-token\"\naccess_dataset = \"access_logs_raw\"\n",
+        )
+        .expect("should retain legacy dataset settings while access emission is disabled");
+        assert_eq!(settings.tinybird.access_dataset, "access_logs_raw");
+        assert!(!settings.tinybird.access_enabled);
+    }
+
+    #[test]
+    fn access_enabled_accepts_custom_versioned_dataset() {
+        let settings = settings_from_toml_with(
+            "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_enabled = false\naccess_enabled = true\naccess_dataset = \"custom_access_v2\"\naccess_token_secret = \"test-access-token\"\naccess_sample_rate = 1.0\n",
+        )
+        .expect("should allow custom access datasource names");
+        assert_eq!(settings.tinybird.access_dataset, "custom_access_v2");
+    }
+
+    #[test]
+    fn access_enabled_requires_tinybird_enabled() {
+        // access_enabled = true with tinybird.enabled omitted (defaults
+        // false) must be rejected: access telemetry cannot run without the
+        // master toggle on.
+        let err = settings_from_toml_with(
+            "[tinybird]\napi_host = \"api.example.com\"\naccess_enabled = true\naccess_sample_rate = 1.0\n",
+        )
+        .expect_err("should reject access telemetry without tinybird.enabled");
         assert!(
             format!("{err:?}").contains("tinybird.access_enabled"),
-            "should report unsupported tinybird.access_enabled setting: {err:?}"
+            "should name the field: {err:?}"
+        );
+    }
+
+    #[test]
+    fn access_enabled_requires_positive_sample_rate() {
+        // access_enabled = true with access_sample_rate = 0 is armed-but-silent: an error.
+        let err = settings_from_toml_with(
+            "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_token_secret = \"test-auction-token\"\naccess_enabled = true\naccess_token_secret = \"test-access-token\"\naccess_sample_rate = 0.0\n",
+        )
+        .expect_err("should reject armed-but-silent access telemetry");
+        assert!(
+            format!("{err:?}").contains("access_sample_rate"),
+            "should name the field"
+        );
+    }
+
+    #[test]
+    fn access_and_auction_emission_are_independent() {
+        let settings = settings_from_toml_with(
+            "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_enabled = false\naccess_enabled = true\naccess_token_secret = \"test-access-token\"\naccess_sample_rate = 1.0\n",
+        )
+        .expect("should accept access without auction");
+        assert!(
+            !settings.tinybird.auction_enabled,
+            "should disable auction emission"
+        );
+        assert!(
+            settings.tinybird.access_enabled,
+            "should enable access emission"
+        );
+    }
+
+    #[test]
+    fn access_dataset_defaults_to_versioned_schema() {
+        assert_eq!(
+            TinybirdSettings::default().access_dataset,
+            "access_logs_v2",
+            "should target the versioned access schema rather than the reserved legacy datasource"
+        );
+        let settings = settings_from_toml_with("[tinybird]\nenabled = false\n")
+            .expect("should parse settings without an explicit access dataset");
+        assert_eq!(
+            settings.tinybird.access_dataset, "access_logs_v2",
+            "should apply the same versioned default during deserialization"
+        );
+    }
+
+    #[test]
+    fn auction_enabled_defaults_true_for_existing_configs() {
+        let settings =
+            settings_from_toml_with(
+                "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_token_secret = \"test-auction-token\"\n",
+            )
+                .expect("should parse a pre-decoupling config");
+        assert!(
+            settings.tinybird.auction_enabled,
+            "should preserve current behavior"
+        );
+    }
+
+    #[test]
+    fn observability_defaults_off_and_serializes_away() {
+        let settings = create_test_settings();
+        assert!(
+            !settings.observability.server_timing_enabled,
+            "should default off"
+        );
+        let toml = toml::to_string(&settings).expect("should serialize settings");
+        assert!(
+            !toml.contains("[observability]"),
+            "should omit the default table so a prior binary can parse the config"
+        );
+    }
+
+    #[test]
+    fn auction_enabled_serializes_only_when_disabled() {
+        let mut settings = create_test_settings();
+        assert!(settings.tinybird.auction_enabled, "should default on");
+        let toml = toml::to_string(&settings).expect("should serialize settings");
+        assert!(
+            !toml.contains("auction_enabled"),
+            "should omit the default-true key: a rollback must not silently \
+             re-enable auction telemetry an operator disabled"
+        );
+
+        settings.tinybird.auction_enabled = false;
+        let toml = toml::to_string(&settings).expect("should serialize settings");
+        assert!(
+            toml.contains("auction_enabled = false"),
+            "should serialize the operator's explicit disable"
+        );
+    }
+
+    #[test]
+    fn route_sections_normalize_and_enforce_finite_limits() {
+        let mut settings = create_test_settings();
+        settings.observability.route_sections = vec!["  news  ".to_owned()];
+        settings
+            .normalize_deserialized()
+            .expect("should normalize a valid route section");
+        settings
+            .prepare_runtime()
+            .expect("should accept and normalize a valid route section");
+        assert_eq!(settings.observability.route_sections, ["news"]);
+
+        for invalid in ["", "  ", "news/archive", "news\narchive", "news\n"] {
+            let mut settings = create_test_settings();
+            settings.observability.route_sections = vec![invalid.to_owned()];
+            settings
+                .normalize_deserialized()
+                .expect("should normalize settings before validating route sections");
+            let error = settings
+                .prepare_runtime()
+                .expect_err("should reject an invalid route section");
+            assert!(error.to_string().contains("observability.route_sections"));
+        }
+
+        let mut boundary = create_test_settings();
+        boundary.observability.route_sections = vec!["x".repeat(128)];
+        settings_normalize_and_prepare(&mut boundary);
+        boundary.observability.route_sections = vec!["x".repeat(129)];
+        assert!(boundary.prepare_runtime().is_err(), "129 bytes must fail");
+
+        let mut boundary = create_test_settings();
+        boundary.observability.route_sections = (0..32).map(|index| format!("s{index}")).collect();
+        settings_normalize_and_prepare(&mut boundary);
+        boundary
+            .observability
+            .route_sections
+            .push("extra".to_owned());
+        assert!(boundary.prepare_runtime().is_err(), "33 entries must fail");
+    }
+
+    fn settings_normalize_and_prepare(settings: &mut Settings) {
+        settings
+            .normalize_deserialized()
+            .expect("should normalize route-section limits at the boundary");
+        settings
+            .prepare_runtime()
+            .expect("should accept route-section limits at the boundary");
+    }
+
+    #[test]
+    fn route_sections_serialize_only_when_configured() {
+        let mut settings = create_test_settings();
+        assert!(
+            settings.observability.route_sections.is_empty(),
+            "should default to the collapse-everything allowlist"
+        );
+        settings.observability.server_timing_enabled = true;
+        let toml = toml::to_string(&settings).expect("should serialize settings");
+        assert!(
+            !toml.contains("route_sections"),
+            "should omit the empty allowlist so a prior binary can parse the config"
+        );
+
+        settings.observability.route_sections = vec!["news".to_owned()];
+        let toml = toml::to_string(&settings).expect("should serialize settings");
+        assert!(
+            toml.contains("route_sections"),
+            "should serialize a configured allowlist"
         );
     }
 
@@ -6551,8 +7186,9 @@ source_domain = "partner.example.com"
             pull_sync_enabled: true,
             pull_sync_url: Some("https://partner.example.com/sync".to_owned()),
             pull_sync_allowed_domains: vec!["partner.example.com".to_owned()],
-            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
-            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            removed_pull_sync_ttl_sec: None,
+            removed_pull_sync_rate_limit: None,
+            owner: None,
             ts_pull_token: Some(Redacted::new(ts_pull_token.to_owned())),
         }
     }
@@ -8991,6 +9627,7 @@ source_domain = "partner.example.com"
                 "/_ts/admin/keys/deactivate",
                 "/_ts/admin/ec",
                 "/_ts/admin/ec/{id}",
+                "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
                 "/_ts/admin/eids",
                 "/_ts/admin/cache/purge",
             ],
@@ -8998,6 +9635,36 @@ source_domain = "partner.example.com"
         );
     }
 
+    #[test]
+    fn admin_opt_out_route_is_in_admin_endpoints() {
+        assert!(
+            Settings::ADMIN_ENDPOINTS.contains(&"/_ts/admin/ec/{id}/providers/{provider}/opt-out"),
+            "should list the provider opt-out clear route"
+        );
+        let narrow = settings_str_without_admin_handler()
+            + r#"
+            [[handlers]]
+            path = "^/_ts/admin/ec/[^/]+$"
+            username = "admin"
+            password = "secret"
+            "#;
+        let settings: Settings = toml::from_str(&narrow).expect("should deserialize TOML");
+        let uncovered = settings
+            .uncovered_admin_endpoints()
+            .expect("should check admin coverage");
+        assert!(
+            uncovered.contains(&"/_ts/admin/ec/{id}/providers/{provider}/opt-out"),
+            "should require auth coverage of the opt-out route"
+        );
+        assert!(
+            create_test_settings()
+                .uncovered_admin_endpoints()
+                .expect("should check admin coverage")
+                .is_empty(),
+            "control: the admin prefix handler should cover the opt-out route"
+        );
+    }
+
     #[test]
     fn uncovered_admin_endpoints_returns_empty_when_handler_covers_admin() {
         let settings = create_test_settings();
@@ -9031,6 +9698,7 @@ source_domain = "partner.example.com"
                 "/_ts/admin/keys/deactivate",
                 "/_ts/admin/ec",
                 "/_ts/admin/ec/{id}",
+                "/_ts/admin/ec/{id}/providers/{provider}/opt-out",
                 "/_ts/admin/eids",
                 "/_ts/admin/cache/purge",
             ],
@@ -9604,4 +10272,160 @@ formats = [{{ width = 300, height = 250 }}]
             );
         }
     }
+
+    #[test]
+    fn identity_settings_defaults_without_any_table() {
+        let settings: IdentitySettings = toml::from_str("").expect("should parse an empty table");
+        assert_eq!(
+            settings.max_concurrency, 4,
+            "should default the concurrency to 4"
+        );
+        assert_eq!(
+            settings.hold_budget_ms, 100,
+            "should default the hold budget to 100 ms"
+        );
+        assert_eq!(
+            settings.hold_retry_sec, 300,
+            "should default the hold retry to 300 s"
+        );
+        assert_eq!(
+            settings.max_response_bytes, 65_536,
+            "should default the response cap to 64 KiB"
+        );
+        let provider =
+            settings.provider(&"anything".parse().expect("should parse the provider id"));
+        assert_eq!(
+            provider.mode,
+            ProviderMode::AfterSend,
+            "should default to after-send mode"
+        );
+        assert_eq!(
+            provider.after_send_timeout_ms, 1000,
+            "should default the after-send timeout to 1 s"
+        );
+        assert_eq!(
+            provider.hold_timeout_ms(&settings),
+            100,
+            "should default the hold timeout to the budget"
+        );
+        assert_eq!(
+            (
+                provider.refresh_after_sec,
+                provider.max_calls_per_minute,
+                provider.breaker_failures_per_minute,
+                provider.cookie_priority
+            ),
+            (86_400, 1, 50, 0),
+            "should use the spec 10.1 provider defaults"
+        );
+        assert_eq!(
+            provider.revoke_scope(),
+            RevokeScope::Provider,
+            "should scope revokes to the provider by default"
+        );
+        validate_identity_settings(&settings).expect("should accept the defaults");
+    }
+
+    #[test]
+    fn identity_settings_default_matches_an_empty_table() {
+        let parsed: IdentitySettings = toml::from_str("").expect("should parse an empty table");
+        assert_eq!(
+            serde_json::to_value(IdentitySettings::default())
+                .expect("should serialize the default"),
+            serde_json::to_value(parsed).expect("should serialize the parsed value"),
+            "should give Default the serde defaults, not zeros"
+        );
+        let provider: ProviderSettings =
+            toml::from_str("").expect("should parse an empty provider table");
+        assert_eq!(
+            serde_json::to_value(ProviderSettings::default())
+                .expect("should serialize the default"),
+            serde_json::to_value(provider).expect("should serialize the parsed value"),
+            "should give the provider Default the serde defaults"
+        );
+    }
+
+    #[test]
+    fn identity_settings_timeouts_and_bounds_are_enforced() {
+        let settings: IdentitySettings = toml::from_str(
+            "hold_budget_ms = 120\n[providers.id5]\nmode = \"hold\"\nafter_send_timeout_ms = 2500\n",
+        )
+        .expect("should parse a hold-mode table");
+        let provider = settings.provider(&"id5".parse().expect("should parse the provider id"));
+        assert_eq!(
+            provider.hold_timeout_ms(&settings),
+            120,
+            "should use the budget as the hold timeout"
+        );
+        assert_eq!(
+            provider.after_send_timeout_ms, 2500,
+            "should read the after-send timeout"
+        );
+        validate_identity_settings(&settings).expect("should accept a 2.5 s after-send timeout");
+
+        for (name, toml_text) in [
+            ("budget over 1000", "hold_budget_ms = 1001"),
+            ("zero concurrency", "max_concurrency = 0"),
+            ("zero refresh", "[providers.p]\nrefresh_after_sec = 0"),
+            (
+                "zero after-send timeout",
+                "[providers.p]\nafter_send_timeout_ms = 0",
+            ),
+            (
+                "after-send timeout over 10 s",
+                "[providers.p]\nafter_send_timeout_ms = 10001",
+            ),
+            (
+                "hold timeout over budget",
+                "[providers.p]\nmode = \"hold\"\ntimeout_ms = 101",
+            ),
+        ] {
+            let settings: IdentitySettings =
+                toml::from_str(toml_text).expect("should parse before validation");
+            assert!(
+                validate_identity_settings(&settings).is_err(),
+                "should reject {name}"
+            );
+        }
+        let edge: IdentitySettings = toml::from_str("[providers.p]\nafter_send_timeout_ms = 10000")
+            .expect("should parse the upper bound");
+        validate_identity_settings(&edge).expect("control: should accept exactly 10 s");
+        toml::from_str::<IdentitySettings>("[providers.p]\nmode = \"sometimes\"")
+            .expect_err("should reject an unknown mode");
+        toml::from_str::<IdentitySettings>("[providers.p]\nrevoke_scope = \"everyone\"")
+            .expect_err("should reject an unknown revoke scope");
+    }
+
+    #[test]
+    fn identity_settings_revoke_scope_parses_and_keeps_its_default_when_unset() {
+        let settings: IdentitySettings =
+            toml::from_str("[providers.lockr]\nrevoke_scope = \"global\"\n")
+                .expect("should parse the revoke scope");
+        let lockr = settings.provider(&"lockr".parse().expect("should parse the provider id"));
+        assert_eq!(
+            lockr.revoke_scope(),
+            RevokeScope::Global,
+            "should read a global revoke scope"
+        );
+        let other = settings.provider(&"other".parse().expect("should parse the provider id"));
+        assert_eq!(
+            other.revoke_scope(),
+            RevokeScope::Provider,
+            "control: another provider should keep the provider scope"
+        );
+        toml::from_str::<IdentitySettings>("[providers.lockr]\ncapture_enabled = true\n")
+            .expect("should still load a key this build does not know");
+    }
+
+    #[test]
+    fn identity_settings_ec_without_identity_table_parses() {
+        let settings = Settings::from_toml(&crate::test_support::tests::crate_test_settings_str())
+            .expect("should parse settings without an identity table");
+        assert_eq!(
+            serde_json::to_value(&settings.ec.identity).expect("should serialize the parsed table"),
+            serde_json::to_value(IdentitySettings::default())
+                .expect("should serialize the default"),
+            "should give an Ec without [ec.identity] the defaults"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/test_support.rs b/crates/trusted-server-core/src/test_support.rs
index 37d54614c0..6e05931071 100644
--- a/crates/trusted-server-core/src/test_support.rs
+++ b/crates/trusted-server-core/src/test_support.rs
@@ -605,3 +605,9 @@ pub mod nextjs_auction {
 
 #[cfg(feature = "test-utils")]
 pub(crate) mod async_html_finalization;
+/// Shared log capture for identity tests, using the same process-wide logger
+/// as thread-local warning captures.
+#[cfg(test)]
+pub mod logs {
+    pub(crate) use super::logging::{captured_logs, install_capturing_logger};
+}
diff --git a/crates/trusted-server-core/src/test_support/async_html_finalization.rs b/crates/trusted-server-core/src/test_support/async_html_finalization.rs
index 9e488c4eff..cf4d9f2835 100644
--- a/crates/trusted-server-core/src/test_support/async_html_finalization.rs
+++ b/crates/trusted-server-core/src/test_support/async_html_finalization.rs
@@ -150,6 +150,7 @@ impl StreamProcessor for FixtureSession {
                     port: url.port(),
                     host_header_override: None,
                     certificate_check: true,
+                    connect_timeout: None,
                     first_byte_timeout: timeout,
                     between_bytes_timeout: timeout,
                     discriminator: Some(ID.to_string()),
diff --git a/crates/trusted-server-core/src/test_support/logging.rs b/crates/trusted-server-core/src/test_support/logging.rs
index 9c0f09657b..cbd649f64c 100644
--- a/crates/trusted-server-core/src/test_support/logging.rs
+++ b/crates/trusted-server-core/src/test_support/logging.rs
@@ -1,7 +1,9 @@
 //! Thread-local warning capture behind the single process-wide test logger.
 
 use std::cell::RefCell;
-use std::sync::Once;
+use std::sync::{Mutex, Once};
+
+static CAPTURED_LOGS: Mutex<Vec<String>> = Mutex::new(Vec::new());
 
 thread_local! {
     static WARNINGS: RefCell<Option<Vec<CapturedWarning>>> = const { RefCell::new(None) };
@@ -16,11 +18,17 @@ struct TestLogger;
 
 impl log::Log for TestLogger {
     fn enabled(&self, metadata: &log::Metadata<'_>) -> bool {
-        metadata.level() == log::Level::Warn
+        metadata.level() <= log::Level::Debug
     }
 
     fn log(&self, record: &log::Record<'_>) {
         if self.enabled(record.metadata()) {
+            CAPTURED_LOGS
+                .lock()
+                .expect("should lock captured logs")
+                .push(record.args().to_string());
+        }
+        if record.level() == log::Level::Warn {
             WARNINGS.with(|warnings| {
                 if let Some(warnings) = warnings.borrow_mut().as_mut() {
                     warnings.push(CapturedWarning {
@@ -35,16 +43,29 @@ impl log::Log for TestLogger {
     fn flush(&self) {}
 }
 
+/// Installs the one process-wide logger shared by all log assertions.
+pub(crate) fn install_capturing_logger() {
+    static INIT: Once = Once::new();
+    INIT.call_once(|| {
+        log::set_logger(&TestLogger).expect("should install the shared test logger");
+        // Leave the level enabled: restoring it races captures on other threads.
+        log::set_max_level(log::LevelFilter::Debug);
+    });
+}
+
+/// Returns all captured messages. Tests match their own unique evidence.
+pub(crate) fn captured_logs() -> Vec<String> {
+    CAPTURED_LOGS
+        .lock()
+        .expect("should lock captured logs")
+        .clone()
+}
+
 pub(crate) struct WarningCapture;
 
 impl WarningCapture {
     pub fn start() -> Self {
-        static INIT: Once = Once::new();
-        INIT.call_once(|| {
-            log::set_logger(&TestLogger).expect("should install the shared test logger");
-            // Leave the level enabled: restoring it races captures on other threads.
-            log::set_max_level(log::LevelFilter::Warn);
-        });
+        install_capturing_logger();
         WARNINGS.with(|warnings| {
             assert!(
                 warnings.borrow().is_none(),
diff --git a/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts b/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts
index 55996306aa..568928ecf6 100644
--- a/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts
+++ b/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts
@@ -24,6 +24,32 @@ async function waitForApi(page: Page): Promise<void> {
     );
 }
 
+async function captureClosedShadowRoots(page: Page): Promise<void> {
+    await page.addInitScript(() => {
+        const roots = new WeakMap<Element, ShadowRoot>();
+        const attachShadow = Element.prototype.attachShadow;
+        Object.defineProperty(Element.prototype, "attachShadow", {
+            configurable: true,
+            value(this: Element, init: ShadowRootInit): ShadowRoot {
+                const root = attachShadow.call(this, init);
+                roots.set(this, root);
+                return root;
+            },
+        });
+        (window as any).__gptDiagnosticsClosedRoots = roots;
+    });
+}
+
+async function diagnosticsText(page: Page): Promise<string> {
+    return page.evaluate((hostId) => {
+        const host = document.getElementById(hostId);
+        const roots = (window as any).__gptDiagnosticsClosedRoots as
+            | WeakMap<Element, ShadowRoot>
+            | undefined;
+        return host && roots ? (roots.get(host)?.textContent ?? "") : "";
+    }, HOST_ID);
+}
+
 async function emit(
     page: Page,
     name: string,
@@ -188,6 +214,20 @@ test.describe("GPT runtime diagnostics", () => {
     }, testInfo) => {
         const pageErrors: string[] = [];
         const diagnosticNetworkRequests: string[] = [];
+        await captureClosedShadowRoots(page);
+        await page.addInitScript(() => {
+            const originalAttachShadow = Element.prototype.attachShadow;
+            Element.prototype.attachShadow = function (init: ShadowRootInit) {
+                const root = originalAttachShadow.call(this, init);
+                if (
+                    (this as HTMLElement).id ===
+                    "trusted-server-gpt-diagnostics"
+                ) {
+                    (window as any).__gptDiagnosticsTestRoot = root;
+                }
+                return root;
+            };
+        });
         page.on("pageerror", (error) => pageErrors.push(error.message));
         page.on("request", (request) => {
             if (
@@ -224,6 +264,9 @@ test.describe("GPT runtime diagnostics", () => {
             isBackfill: true,
             slotContentChanged: true,
         });
+        await expect
+            .poll(() => diagnosticsText(page))
+            .toContain("Fill 300×250");
         await emit(page, "slotOnload", "gpt-diagnostics-slot-primary");
         await emit(page, "impressionViewable", "gpt-diagnostics-slot-primary");
         await emit(
@@ -271,6 +314,9 @@ test.describe("GPT runtime diagnostics", () => {
                 slot.slotElementId === "gpt-diagnostics-slot-secondary",
         );
         expect(primary.binding).toEqual({ status: "bound" });
+        expect(snapshot.slots.map((slot: any) => slot.runtimeSlotNumber)).toEqual([
+            1, 2,
+        ]);
         expect(
             primary.requests.map((cycle: any) => cycle.requestNumber),
         ).toEqual([1, 2, 3]);
@@ -331,17 +377,142 @@ test.describe("GPT runtime diagnostics", () => {
         await page.evaluate(() => (window as any).tsjs.gptDiagnostics.hide());
         await expect(page.locator(`#${HOST_ID}`)).toHaveCount(0);
         await emit(page, "slotRequested", "gpt-diagnostics-slot-secondary");
+        await emit(
+            page,
+            "slotResponseReceived",
+            "gpt-diagnostics-slot-secondary",
+        );
+        await emit(page, "slotRenderEnded", "gpt-diagnostics-slot-secondary", {
+            isEmpty: false,
+            size: [1, 1],
+        });
         await page.evaluate(() => (window as any).tsjs.gptDiagnostics.show());
         await expect(page.locator(`#${HOST_ID}`)).toHaveCount(1);
         const hiddenPeriodSnapshot = await page.evaluate(() =>
             (window as any).tsjs.gptDiagnostics.snapshot(),
         );
-        expect(
-            hiddenPeriodSnapshot.slots.find(
-                (slot: any) =>
-                    slot.slotElementId === "gpt-diagnostics-slot-secondary",
-            ).requests,
-        ).toHaveLength(2);
+        await page.waitForFunction(() =>
+            Boolean(
+                (window as any).__gptDiagnosticsTestRoot?.querySelector(
+                    ".tsgd-badge-handle:not([hidden])",
+                ),
+            ),
+        );
+        const badgeIdentity = await page.evaluate(() => {
+            const handle = (
+                window as any
+            ).__gptDiagnosticsTestRoot.querySelector(
+                ".tsgd-badge-handle:not([hidden])",
+            ) as HTMLButtonElement;
+            const badge = handle.closest(".tsgd-badge") as HTMLElement;
+            const evidence = badge.querySelector(
+                ".tsgd-badge-evidence",
+            ) as HTMLElement;
+            const handleRect = handle.getBoundingClientRect();
+            const creativeRectangles = (window as any).tsjs.gptDiagnostics
+                .snapshot()
+                .slots.flatMap((slot: any) => {
+                    const element = document.getElementById(slot.slotElementId);
+                    return slot.binding.status === "bound" && element
+                        ? [element.getBoundingClientRect()]
+                        : [];
+                });
+            handle.focus();
+            return {
+                tagName: handle.tagName,
+                text: handle.textContent,
+                ariaLabel: handle.getAttribute("aria-label"),
+                badgeTagName: badge.tagName,
+                badgePointerEvents: getComputedStyle(badge).pointerEvents,
+                evidencePointerEvents: getComputedStyle(evidence).pointerEvents,
+                handlePointerEvents: getComputedStyle(handle).pointerEvents,
+                evidence: evidence.textContent,
+                overlapsCreative: creativeRectangles.some(
+                    (creative: DOMRect) =>
+                        handleRect.left < creative.right &&
+                        handleRect.right > creative.left &&
+                        handleRect.top < creative.bottom &&
+                        handleRect.bottom > creative.top,
+                ),
+                runtimeSlotNumber: badge.dataset.runtimeSlot,
+                requestNumber: badge.dataset.requestNumber,
+            };
+        });
+        expect(badgeIdentity).toMatchObject({
+            tagName: "BUTTON",
+            text: expect.stringMatching(/^Ad #\d+$/),
+            ariaLabel: expect.stringMatching(
+                /^Open diagnostics for Ad #\d+, Request #\d+:/,
+            ),
+            badgeTagName: "DIV",
+            badgePointerEvents: "none",
+            evidencePointerEvents: "none",
+            handlePointerEvents: "auto",
+            evidence: expect.stringMatching(/^Request #\d+ · /),
+            overlapsCreative: false,
+        });
+        await page.keyboard.press("Enter");
+        await page.waitForFunction(
+            ({ runtimeSlotNumber, requestNumber }) => {
+                const root = (window as any)
+                    .__gptDiagnosticsTestRoot as ShadowRoot;
+                const selected = root?.querySelector<HTMLElement>(
+                    `[aria-current="true"][data-runtime-slot="${runtimeSlotNumber}"][data-request-number="${requestNumber}"]`,
+                );
+                return selected !== null && root.activeElement === selected;
+            },
+            {
+                runtimeSlotNumber: badgeIdentity.runtimeSlotNumber,
+                requestNumber: badgeIdentity.requestNumber,
+            },
+        );
+        await page.evaluate(
+            ({ runtimeSlotNumber, requestNumber }) => {
+                const root = (window as any)
+                    .__gptDiagnosticsTestRoot as ShadowRoot;
+                const selected = root.querySelector<HTMLElement>(
+                    `[aria-current="true"][data-runtime-slot="${runtimeSlotNumber}"][data-request-number="${requestNumber}"]`,
+                );
+                const locate = Array.from(
+                    selected
+                        ?.closest(".tsgd-slot")
+                        ?.querySelectorAll("button") ?? [],
+                ).find(
+                    (candidate) =>
+                        candidate.textContent === "Locate on page",
+                );
+                locate?.click();
+            },
+            {
+                runtimeSlotNumber: badgeIdentity.runtimeSlotNumber,
+                requestNumber: badgeIdentity.requestNumber,
+            },
+        );
+        await page.waitForFunction(() =>
+            Boolean(
+                (window as any).__gptDiagnosticsTestRoot?.querySelector(
+                    ".tsgd-highlight",
+                ),
+            ),
+        );
+        const secondaryRequests = hiddenPeriodSnapshot.slots.find(
+            (slot: any) =>
+                slot.slotElementId === "gpt-diagnostics-slot-secondary",
+        ).requests;
+        expect(secondaryRequests).toHaveLength(2);
+        expect(secondaryRequests[1]).toMatchObject({
+            isEmpty: false,
+            size: [1, 1],
+        });
+        await page.evaluate(
+            () =>
+                new Promise<void>((resolve) =>
+                    requestAnimationFrame(() =>
+                        requestAnimationFrame(() => resolve()),
+                    ),
+                ),
+        );
+        expect(await diagnosticsText(page)).not.toContain("1×1");
 
         const downloadPromise = page.waitForEvent("download");
         await page.evaluate(() => (window as any).tsjs.gptDiagnostics.export());
@@ -355,6 +526,16 @@ test.describe("GPT runtime diagnostics", () => {
         const exported = JSON.parse(Buffer.concat(chunks).toString("utf8"));
         expect(exported.version).toBe(1);
         expect(exported.slots).toHaveLength(hiddenPeriodSnapshot.slots.length);
+        const exportedPrimary = exported.slots.find(
+            (slot: any) =>
+                slot.slotElementId === "gpt-diagnostics-slot-primary",
+        );
+        const exportedSecondary = exported.slots.find(
+            (slot: any) =>
+                slot.slotElementId === "gpt-diagnostics-slot-secondary",
+        );
+        expect(exportedPrimary.requests[0].size).toEqual([300, 250]);
+        expect(exportedSecondary.requests[1].size).toEqual([1, 1]);
         expect(exported.callbackIssues).toHaveLength(
             hiddenPeriodSnapshot.callbackIssues.length,
         );
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index c3d9ff53d8..02f597a134 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -12,7 +12,9 @@ proxy_secret = "integration_proxy_secret"
 [ec]
 passphrase = "integration_ec_passphrase"
 ec_store = "ec_identity_store"
-pull_sync_concurrency = 3
+
+[ec.identity]
+max_concurrency = 3
 
 [[ec.partners]]
 name = "Integration Test Partner"
diff --git a/crates/trusted-server-integration-tests/src/bin/generate-viceroy-config.rs b/crates/trusted-server-integration-tests/src/bin/generate-viceroy-config.rs
index 741c4237cd..c1c2a8391c 100644
--- a/crates/trusted-server-integration-tests/src/bin/generate-viceroy-config.rs
+++ b/crates/trusted-server-integration-tests/src/bin/generate-viceroy-config.rs
@@ -173,6 +173,7 @@ fn inject_controlled_bidder_backends(
                 port: endpoint.port(),
                 host_header_override: None,
                 certificate_check: true,
+                connect_timeout: None,
                 first_byte_timeout: duration,
                 between_bytes_timeout: duration,
                 discriminator: Some(provider.id.as_str().to_owned()),
diff --git a/crates/trusted-server-js/lib/src/core/auction.ts b/crates/trusted-server-js/lib/src/core/auction.ts
index 4d2e0fb3a0..77cfa36bfb 100644
--- a/crates/trusted-server-js/lib/src/core/auction.ts
+++ b/crates/trusted-server-js/lib/src/core/auction.ts
@@ -27,18 +27,14 @@ export interface AdRequestUnit {
   bids: Array<{ bidder: string; params: Record<string, unknown> }>;
 }
 
-/** A user identifier within an auction-level EID entry. */
-export interface AuctionUid {
-  id: string;
-  atype?: number;
-  ext?: Record<string, unknown>;
-}
-
-/** An auction-level EID entry forwarded to the server. */
-export interface AuctionEid {
-  source: string;
-  uids: AuctionUid[];
-}
+/**
+ * An auction-level EID entry forwarded to the server.
+ *
+ * TSJS forwards the entries Prebid placed in the `trustedServer` bidder
+ * request as plain data and the server validates each one, so the server
+ * defines the contract.
+ */
+export type AuctionEid = unknown;
 
 /** The payload POSTed to the /auction orchestrator. */
 export interface AdRequest {
diff --git a/crates/trusted-server-js/lib/src/core/eids_mirror.ts b/crates/trusted-server-js/lib/src/core/eids_mirror.ts
new file mode 100644
index 0000000000..0f5f6c4e13
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/core/eids_mirror.ts
@@ -0,0 +1,61 @@
+// Writes the client-only `__Host-ts-eids-s` cookie from the mirror payload
+// `/auction` and `/_ts/page-bids` return (spec 6.2).
+//
+// The cookie is read by page scripts, never by TS: the only read here is the
+// comparison that skips an unchanged write. Nothing is copied into `ts-eids`
+// or the `/auction` body, so a mirror ID never becomes a browser candidate.
+
+const MIRROR_COOKIE_NAME = '__Host-ts-eids-s';
+
+// base64url without padding, the only alphabet the server emits.
+const MIRROR_VALUE_PATTERN = /^[A-Za-z0-9_-]+$/;
+
+const ATTRIBUTES = 'Path=/; Secure; SameSite=Lax';
+
+function currentMirrorValue(): string | undefined {
+  const prefix = `${MIRROR_COOKIE_NAME}=`;
+  for (const part of document.cookie.split(';')) {
+    const candidate = part.trim();
+    if (candidate.startsWith(prefix)) {
+      return candidate.slice(prefix.length);
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Applies a mirror payload to `__Host-ts-eids-s`.
+ *
+ * `{ value, max_age }` writes the cookie unless it already holds `value`.
+ * `{ clear: true }` expires it. Anything else, an absent payload included,
+ * leaves the cookie as it is.
+ *
+ * @param payload the `ts_eids_s` member of an `/auction` or page-bids response
+ */
+export function writeEidsMirror(payload: unknown): void {
+  if (payload === null || typeof payload !== 'object') {
+    return;
+  }
+  const { value, max_age: maxAge, clear } = payload as Record<string, unknown>;
+  try {
+    if (clear === true) {
+      document.cookie = `${MIRROR_COOKIE_NAME}=; ${ATTRIBUTES}; Max-Age=0`;
+      return;
+    }
+    if (
+      typeof value !== 'string' ||
+      !MIRROR_VALUE_PATTERN.test(value) ||
+      typeof maxAge !== 'number' ||
+      !Number.isInteger(maxAge) ||
+      maxAge < 0
+    ) {
+      return;
+    }
+    if (currentMirrorValue() === value) {
+      return;
+    }
+    document.cookie = `${MIRROR_COOKIE_NAME}=${value}; ${ATTRIBUTES}; Max-Age=${maxAge}`;
+  } catch {
+    // Cookie access can throw in sandboxed frames; the mirror is optional.
+  }
+}
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 9d29f96622..48c632f6e8 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -95,10 +95,6 @@ export interface AuctionBidData {
   hb_cache_path?: string;
   /** Opaque server-auction correlation ID used only by GPT diagnostics. */
   hb_auction_id?: string;
-  /** Winning creative width; the bridge sizes the inline render from this. */
-  w?: number;
-  /** Winning creative height; the bridge sizes the inline render from this. */
-  h?: number;
   nurl?: string;
   burl?: string;
   /** Typed winning-bid renderer capability. */
@@ -116,6 +112,43 @@ export interface AuctionBidData {
   debug_bid?: AuctionDebugBidData;
 }
 
+/** Server-measured auction timings relative to their documented server-side origin. */
+export interface AuctionDiagnosticsData {
+  auctionDispatchedMs?: number;
+  auctionResolvedMs?: number;
+  auctionCommittedMs?: number;
+  auctionWaitMs?: number;
+  auctionWaitPlacement?: 'pre_header' | 'in_stream';
+}
+
+/** Auction path presented by GPT diagnostics. */
+export type GptDiagnosticsAuctionType = 'ssat' | 'trusted_server' | 'client_side' | 'competing';
+
+/** Clock origin for server auction timings, independent of aggregate auction classification. */
+export type GptDiagnosticsServerAuctionTimingOrigin = 'navigation' | 'spa_auction';
+
+/** Sanitized bid facts already exposed as bucketed ad-server targeting. */
+export interface GptDiagnosticsAuctionWinner {
+  bidder: string;
+  priceBucket: string;
+  /** ISO currency supplied by the evidence source; absent means not supplied. */
+  currency?: string;
+}
+
+/** A completed, exactly correlated client-side Prebid auction. */
+export interface GptDiagnosticsPrebidAuctionEvidence {
+  auctionId: string;
+  targetingCandidate?: GptDiagnosticsAuctionWinner;
+  win?: GptDiagnosticsAuctionWinner;
+}
+
+/** Internal Trusted Server auction evidence attached to the next GPT request. */
+export interface GptDiagnosticsAuctionFacts {
+  auctionType?: Extract<GptDiagnosticsAuctionType, 'ssat' | 'trusted_server'>;
+  winner?: GptDiagnosticsAuctionWinner;
+  serverTimings?: AuctionDiagnosticsData;
+}
+
 export type GptDiagnosticsCallbackKind =
   | 'slotRequested'
   | 'slotResponseReceived'
@@ -262,6 +295,14 @@ export interface GptDiagnosticsRequestCycle {
   requestPath?: GptDiagnosticsRequestPath;
   requestIntentId?: number;
   trustedServerAuctionId?: string;
+  auctionType?: GptDiagnosticsAuctionType;
+  /** Compatibility field: winner of the observed server auction, not necessarily the served creative. */
+  auctionWinner?: GptDiagnosticsAuctionWinner;
+  /** Completed Prebid facts, correlated to this exact slot, request, and auction attempt. */
+  prebidAuction?: GptDiagnosticsPrebidAuctionEvidence;
+  serverAuctionTimings?: AuctionDiagnosticsData;
+  /** Retained separately because `auctionType` can become `competing`. */
+  serverAuctionTimingOrigin?: GptDiagnosticsServerAuctionTimingOrigin;
   opportunityToRequestMs?: number;
   replacedRequestNumber?: number;
   previousRenderToRequestMs?: number;
@@ -371,10 +412,33 @@ export interface GptDiagnosticsRecorder {
     opportunity: GptDiagnosticsTrustedServerOpportunity,
     trustedServerAuctionId?: string,
     requestedSlotSizes?: ReadonlyArray<Size>,
+    auctionFacts?: GptDiagnosticsAuctionFacts,
     traceIdentity?: TraceGptIdentity
   ): void;
   /** Mark slots whose next observed GPT request follows the Prebid refresh path. */
   recordPrebidRefresh(slots: GptDiagnosticsSlotHandle[]): void;
+  /** Observe the exact Prebid instance and slots after its targeting succeeds. */
+  recordCompletedPrebidAuction?(
+    prebid: {
+      onEvent?: (event: 'bidWon', listener: (bid: unknown) => void) => void;
+      offEvent?: (event: 'bidWon', listener: (bid: unknown) => void) => void;
+    },
+    rawAuctionId: unknown,
+    slots: Array<GptDiagnosticsSlotHandle & { getTargeting?: (key: string) => string[] }>,
+    adUnitCodes: string[]
+  ): void;
+  /** Record a completed Prebid attempt at its targeting boundary for one exact GPT slot. */
+  recordPrebidAuction(
+    slot: GptDiagnosticsSlotHandle,
+    auctionId: string,
+    targetingCandidate?: GptDiagnosticsAuctionWinner
+  ): void;
+  /** Record Prebid's documented `bidWon` observation for that exact attempt. */
+  recordPrebidWin(
+    slot: GptDiagnosticsSlotHandle,
+    auctionId: string,
+    winner: GptDiagnosticsAuctionWinner
+  ): void;
   /** Record a creative markup request and return its opaque attempt ID. */
   recordTrustedServerCreativeRequest(auctionSlotId: string): number | undefined;
   /** Record that a creative attempt successfully posted markup. */
@@ -473,6 +537,8 @@ export interface TsjsApi {
   adSlots?: AuctionSlot[];
   /** Winning bid targeting data injected before </body>. */
   bids?: Record<string, AuctionBidData>;
+  /** Server-measured timing evidence for the auction that populated `bids`. */
+  auctionDiagnostics?: AuctionDiagnosticsData;
   /**
    * Bounded client-side Prebid APS renderer capabilities keyed by Prebid's generated
    * `hb_adid`. The Universal Creative bridge consumes each entry at most once.
@@ -559,7 +625,8 @@ export interface TsjsApi {
   scheduleInitialAdInit?: (
     initialBids?: Record<string, AuctionBidData>,
     initialSlots?: AuctionSlot[],
-    traceAuctionTransport?: unknown
+    traceAuctionTransport?: unknown,
+    initialAuctionDiagnostics?: AuctionDiagnosticsData
   ) => void;
   /** Read-only GPT lifecycle diagnostics API, present only in an activated tab. */
   gptDiagnostics?: GptDiagnosticsApi;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index e4b46fcba2..3abd80fd6b 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -6,6 +6,7 @@ import {
   releaseTrustedServerFirstImpressionClaim,
   reservePublisherFirstImpressionFallback,
 } from '../../core/first_impression';
+import { writeEidsMirror } from '../../core/eids_mirror';
 import { log } from '../../core/log';
 import { resolveSlotElementByDivId } from '../../core/slot_element';
 import { getActiveTraceGptBridge } from '../../trace/runtime';
@@ -13,6 +14,8 @@ import type { TraceGptOpportunity } from '../../trace/gpt';
 import type {
   AuctionSlot,
   AuctionBidData,
+  AuctionDiagnosticsData,
+  GptDiagnosticsAuctionFacts,
   GptDiagnosticsCreativeFailure,
   GptDiagnosticsTrustedServerOpportunity,
   GptSlotHandoff,
@@ -79,6 +82,25 @@ function trustedServerOpportunity(bid: AuctionBidData): GptDiagnosticsTrustedSer
   return hasAdId && (hasInline || hasCache) ? 'renderable_candidate' : 'unrenderable_candidate';
 }
 
+function diagnosticsAuctionFacts(
+  generation: number,
+  auctionDiagnostics: AuctionDiagnosticsData | undefined,
+  bid: AuctionBidData
+): GptDiagnosticsAuctionFacts | undefined {
+  const isSpaAuction = generation > 0;
+  const winner =
+    isNonEmptyString(bid.hb_bidder) && isNonEmptyString(bid.hb_pb)
+      ? { bidder: bid.hb_bidder, priceBucket: bid.hb_pb }
+      : undefined;
+  if (!winner && auctionDiagnostics === undefined) return undefined;
+
+  return {
+    auctionType: isSpaAuction ? 'trusted_server' : 'ssat',
+    ...(winner ? { winner } : {}),
+    ...(auctionDiagnostics ? { serverTimings: auctionDiagnostics } : {}),
+  };
+}
+
 // ------------------------------------------------------------------
 // googletag type stubs (minimal surface needed by the shim)
 // ------------------------------------------------------------------
@@ -816,12 +838,16 @@ function installScheduleInitialAdInit(ts: TsjsApi): void {
   ts.scheduleInitialAdInit = function (
     initialBids?: Record<string, AuctionBidData>,
     initialSlots?: AuctionSlot[],
-    traceAuctionTransport?: unknown
+    traceAuctionTransport?: unknown,
+    initialAuctionDiagnostics?: AuctionDiagnosticsData
   ) {
     if ((ts.navGeneration ?? 0) !== 0 || ts.initialAdInitScheduled) return;
     ts.initialAdInitScheduled = true;
     if (initialSlots !== undefined) ts.adSlots = initialSlots;
     if (initialBids !== undefined) ts.bids = initialBids;
+    if (initialAuctionDiagnostics !== undefined) {
+      ts.auctionDiagnostics = initialAuctionDiagnostics;
+    }
     const runUnlessNavigated = (): void => {
       if ((ts.navGeneration ?? 0) !== 0) return;
       try {
@@ -1137,7 +1163,8 @@ function schedulePublisherFirstImpressionFallback(
   slot: AuctionSlot,
   bid: AuctionBidData,
   element: HTMLElement,
-  generation: number
+  generation: number,
+  auctionDiagnostics: AuctionDiagnosticsData | undefined
 ): void {
   if (!reservePublisherFirstImpressionFallback(ts, element)) return;
 
@@ -1211,12 +1238,14 @@ function schedulePublisherFirstImpressionFallback(
 
       try {
         const trace = traceOpportunity(slot, bid.hb_auction_id);
+        const auctionFacts = diagnosticsAuctionFacts(generation, auctionDiagnostics, bid);
         ts.gptDiagnosticsRecorder?.recordTrustedServerOpportunity(
           gptSlot,
           slot.id,
           trustedServerOpportunity(bid),
           trace.auctionId,
           slot.formats,
+          auctionFacts,
           ...(trace.identity ? ([trace.identity] as const) : [])
         );
       } catch {
@@ -1265,6 +1294,7 @@ export function installTsAdInit(): void {
     // first act and stands down rather than applying this invocation's
     // slots/bids to the newer route's DOM and double-requesting it.
     const generation = ts.navGeneration ?? 0;
+    const auctionDiagnostics = ts.auctionDiagnostics ? { ...ts.auctionDiagnostics } : undefined;
     const g = (window as GptWindow).googletag;
     if (!g) return;
     installFirstImpressionLifecycleObservers(ts, g);
@@ -1360,7 +1390,15 @@ export function installTsAdInit(): void {
         if (!firstImpression) {
           const claim = firstImpressionClaim(ts, el);
           if (claim?.owner === 'publisher') {
-            schedulePublisherFirstImpressionFallback(ts, g, slot, bid, el, generation);
+            schedulePublisherFirstImpressionFallback(
+              ts,
+              g,
+              slot,
+              bid,
+              el,
+              generation,
+              auctionDiagnostics
+            );
           }
           return;
         }
@@ -1408,12 +1446,14 @@ export function installTsAdInit(): void {
           const requestedSlotSizes = ts.gptSlotHandoffs?.[slotDivId2]?.formats;
           const opportunity = trustedServerOpportunity(bid);
           const trace = traceOpportunity(slot, bid.hb_auction_id);
+          const auctionFacts = diagnosticsAuctionFacts(generation, auctionDiagnostics, bid);
           ts.gptDiagnosticsRecorder?.recordTrustedServerOpportunity(
             gptSlot,
             slot.id,
             opportunity,
             trace.auctionId,
             requestedSlotSizes,
+            auctionFacts,
             ...(trace.identity ? ([trace.identity] as const) : [])
           );
         } catch {
@@ -1518,6 +1558,9 @@ interface PageBidsResponse {
   slots: AuctionSlot[];
   bids: Record<string, AuctionBidData>;
   trace_auction?: unknown;
+  auctionDiagnostics?: AuctionDiagnosticsData;
+  /** The `__Host-ts-eids-s` mirror payload; absent when the request read no KV. */
+  ts_eids_s?: unknown;
 }
 
 /** Canonical SPA re-auction endpoint. Mirrors `PAGE_BIDS_PATH` in Rust. */
@@ -1726,6 +1769,9 @@ export function installSpaAuctionHook(): void {
     if (g) clearPreviousNavigationTargeting(ts, g);
     ts.navGeneration = (ts.navGeneration ?? 0) + 1;
     delete ts.firstImpression;
+    // Server timings belong to the route that produced them. Clear them before
+    // page-bids starts so failure or supersession cannot relabel stale offsets.
+    ts.auctionDiagnostics = undefined;
     // A route change invalidates hydration aliases before the new route's
     // publisher can define a same-prefix slot while page-bids is in flight.
     for (const [elementId, handoff] of Object.entries(ts.gptSlotHandoffs ?? {})) {
@@ -1745,6 +1791,12 @@ export function installSpaAuctionHook(): void {
         if (inflight === controller) currentPath = lastAppliedPath;
         return;
       }
+      // The mirror comes from the row this response read, so it is written
+      // even when a newer navigation has superseded the route. Absent means
+      // no KV read and the cookie stays as it is.
+      if (data.ts_eids_s !== undefined) {
+        writeEidsMirror(data.ts_eids_s);
+      }
       if (inflight !== controller) return;
       // Defer applying bids until the new route's ad containers exist, so a
       // fast edge response cannot beat the DOM and drop server-side bids.
@@ -1757,6 +1809,7 @@ export function installSpaAuctionHook(): void {
       } catch {
         // A diagnostic bridge cannot block the accepted navigation.
       }
+      ts.auctionDiagnostics = data.auctionDiagnostics;
       // This route is now the committed, loaded state — a later failed
       // navigation rolls back here, and a return trip no-ops correctly.
       lastAppliedPath = path;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
index 1388b8f6b0..8076a7e7eb 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
@@ -1,5 +1,7 @@
 import type {
   GptDiagnosticsApi,
+  GptDiagnosticsAuctionFacts,
+  GptDiagnosticsAuctionWinner,
   GptDiagnosticsCreativeFailure,
   GptDiagnosticsExportV1,
   GptDiagnosticsRecorder,
@@ -9,6 +11,7 @@ import type {
 import type { TraceGptIdentity } from '../../trace/types';
 
 import type { GptDiagnosticsBindingManager } from './binding';
+import { clonePrebidAuctionEvidence } from './evidence';
 import type { GptDiagnosticsStoreSnapshot } from './store';
 
 interface ApiStore {
@@ -20,9 +23,20 @@ interface ApiStore {
     opportunity: GptDiagnosticsTrustedServerOpportunity,
     trustedServerAuctionId?: string,
     requestedSlotSizes?: ReadonlyArray<readonly [number, number]>,
+    auctionFacts?: GptDiagnosticsAuctionFacts,
     traceIdentity?: TraceGptIdentity
   ): void;
   recordPrebidRefresh(slots: GptDiagnosticsSlotHandle[]): void;
+  recordPrebidAuction(
+    slot: GptDiagnosticsSlotHandle,
+    auctionId: string,
+    targetingCandidate?: GptDiagnosticsAuctionWinner
+  ): void;
+  recordPrebidWin(
+    slot: GptDiagnosticsSlotHandle,
+    auctionId: string,
+    winner: GptDiagnosticsAuctionWinner
+  ): void;
   recordTrustedServerCreativeRequest(auctionSlotId: string): number | undefined;
   recordTrustedServerCreativeResponse(attemptId: number): void;
   recordTrustedServerCreativeFailure(
@@ -69,6 +83,13 @@ function cloneExportSnapshot(snapshot: GptDiagnosticsExportV1): GptDiagnosticsEx
         requestedSlotSizes: cycle.requestedSlotSizes?.map((size) => [...size]),
         size: cycle.size ? [...cycle.size] : undefined,
         observedSlotSize: cycle.observedSlotSize ? [...cycle.observedSlotSize] : undefined,
+        ...(cycle.auctionWinner ? { auctionWinner: { ...cycle.auctionWinner } } : {}),
+        ...(cycle.prebidAuction
+          ? { prebidAuction: clonePrebidAuctionEvidence(cycle.prebidAuction) }
+          : {}),
+        ...(cycle.serverAuctionTimings
+          ? { serverAuctionTimings: { ...cycle.serverAuctionTimings } }
+          : {}),
         adManager: cycle.adManager
           ? {
               ...cycle.adManager,
@@ -160,6 +181,7 @@ export class GptDiagnosticsApiController {
         opportunity,
         trustedServerAuctionId,
         requestedSlotSizes,
+        auctionFacts,
         traceIdentity
       ) =>
         safelyRecord(() => {
@@ -169,10 +191,15 @@ export class GptDiagnosticsApiController {
             opportunity,
             trustedServerAuctionId,
             requestedSlotSizes,
+            auctionFacts,
             ...(traceIdentity ? ([traceIdentity] as const) : [])
           );
         }),
       recordPrebidRefresh: (slots) => safelyRecord(() => this.store.recordPrebidRefresh(slots)),
+      recordPrebidAuction: (slot, auctionId, targetingCandidate) =>
+        safelyRecord(() => this.store.recordPrebidAuction(slot, auctionId, targetingCandidate)),
+      recordPrebidWin: (slot, auctionId, winner) =>
+        safelyRecord(() => this.store.recordPrebidWin(slot, auctionId, winner)),
       recordTrustedServerCreativeRequest: (auctionSlotId) =>
         safelyCreateAttempt(() => this.store.recordTrustedServerCreativeRequest(auctionSlotId)),
       recordTrustedServerCreativeResponse: (attemptId) =>
@@ -204,6 +231,13 @@ export class GptDiagnosticsApiController {
           requestedSlotSizes: cycle.requestedSlotSizes?.map((size) => [...size]),
           size: cycle.size ? [...cycle.size] : undefined,
           observedSlotSize: cycle.observedSlotSize ? [...cycle.observedSlotSize] : undefined,
+          ...(cycle.auctionWinner ? { auctionWinner: { ...cycle.auctionWinner } } : {}),
+          ...(cycle.prebidAuction
+            ? { prebidAuction: clonePrebidAuctionEvidence(cycle.prebidAuction) }
+            : {}),
+          ...(cycle.serverAuctionTimings
+            ? { serverAuctionTimings: { ...cycle.serverAuctionTimings } }
+            : {}),
           adManager: cycle.adManager
             ? {
                 ...cycle.adManager,
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts
index 643dc355a3..fbc370ff93 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts
@@ -2,7 +2,12 @@ import type { GptDiagnosticsRequestCycle } from '../../core/types';
 
 import type { GptDiagnosticsBindingManager } from './binding';
 import { unhandledCase } from './exhaustive';
-import { formatSizes, scheduleFrame } from './presentation_helpers';
+import {
+  auctionTypeBadgeLabel,
+  displayableGptFillSize,
+  formatSizes,
+  scheduleFrame,
+} from './presentation_helpers';
 import type {
   GptDiagnosticsBindingInput,
   GptDiagnosticsStoreSlotSnapshot,
@@ -27,12 +32,15 @@ type BadgeWindow = Window & {
 
 const BADGE_MAX_WIDTH_PX = 260;
 const BADGE_EDGE_GUTTER_PX = 4;
+const HANDLE_WIDTH_PX = 72;
+const HANDLE_HEIGHT_PX = 26;
 const MAX_BADGE_REQUESTED_SLOT_SIZES = 3;
 
 interface BadgeOptions {
   window?: BadgeWindow;
   document?: Document;
   scheduleFrame?: (callback: () => void) => void;
+  onActivate?: (runtimeSlotNumber: number, requestNumber: number) => void;
 }
 
 function intersectsViewport(rectangle: DOMRect, window: Window): boolean {
@@ -106,9 +114,12 @@ function badgeText(cycle: GptDiagnosticsRequestCycle): string {
   else if (cycle.isEmpty === false) firstLine.push('Filled');
   else if (cycle.renderAtMs !== undefined) firstLine.push('Rendered (fill unknown)');
   else firstLine.push('Pending');
+  if (cycle.auctionType) firstLine.push(auctionTypeBadgeLabel(cycle.auctionType));
   const delivery = deliveryLabel(cycle);
   if (delivery) firstLine.push(delivery);
-  if (cycle.requestPath === 'competing') firstLine.push('Competing paths');
+  if (cycle.requestPath === 'competing' && cycle.auctionType !== 'competing') {
+    firstLine.push('Competing paths');
+  }
   if (cycle.requestedSlotSizes) {
     const displayedSizes = cycle.requestedSlotSizes.slice(0, MAX_BADGE_REQUESTED_SLOT_SIZES);
     const remainingSizeCount = cycle.requestedSlotSizes.length - displayedSizes.length;
@@ -116,16 +127,17 @@ function badgeText(cycle: GptDiagnosticsRequestCycle): string {
       `Req ${formatSizes(displayedSizes)}${remainingSizeCount > 0 ? ` +${remainingSizeCount}` : ''}`
     );
   }
-  if (cycle.size) firstLine.push(`Fill ${cycle.size[0]}×${cycle.size[1]}`);
+  const fillSize = displayableGptFillSize(cycle.size);
+  if (fillSize) firstLine.push(`Fill ${fillSize[0]}×${fillSize[1]}`);
   if (cycle.observedSlotSize) {
-    firstLine.push(`Box ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
+    firstLine.push(`Size filled ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
   }
 
   const timingLine: string[] = [];
   const response = formatMilliseconds(cycle.durations.requestToResponseMs);
   const render = formatMilliseconds(cycle.durations.responseToRenderMs);
-  if (response) timingLine.push(`Response ${response}`);
-  if (render) timingLine.push(`Render ${render}`);
+  if (response) timingLine.push(`GAM request → response ${response}`);
+  if (render) timingLine.push(`GAM response → render ${render}`);
 
   const lines = [firstLine.join(' · ')];
   if (timingLine.length > 0) lines.push(timingLine.join(' · '));
@@ -148,6 +160,7 @@ export class GptDiagnosticsBadgeManager {
   private readonly window: BadgeWindow;
   private readonly document: Document;
   private readonly scheduleFrame: (callback: () => void) => void;
+  private readonly onActivate: (runtimeSlotNumber: number, requestNumber: number) => void;
   private readonly unsubscribeStore: () => void;
   private readonly unsubscribeBindings: () => void;
   private readonly slotElementIds = new Set<string>();
@@ -165,6 +178,7 @@ export class GptDiagnosticsBadgeManager {
     this.document = options.document ?? document;
     this.scheduleFrame =
       options.scheduleFrame ?? ((callback) => scheduleFrame(this.window, callback));
+    this.onActivate = options.onActivate ?? (() => undefined);
     this.refreshSlotElementIds();
     this.unsubscribeStore = this.store.subscribe(() => {
       this.refreshSlotElementIds();
@@ -188,7 +202,18 @@ export class GptDiagnosticsBadgeManager {
   update(): void {
     if (this.destroyed || !this.layer?.isConnected) return;
     const observedElements: HTMLElement[] = [];
-    const badges: HTMLElement[] = [];
+    const existingBadges = new Map(
+      Array.from(this.layer.querySelectorAll<HTMLDivElement>('.tsgd-badge')).map((badge) => [
+        badge.dataset.runtimeSlot,
+        badge,
+      ])
+    );
+    const badges = new Set<HTMLDivElement>();
+    const creativeRectangles = this.slots.flatMap((slot) => {
+      const binding = this.bindings.get(slot.runtimeSlotNumber);
+      if (binding.binding.status !== 'bound' || !binding.element?.isConnected) return [];
+      return [binding.element.getBoundingClientRect()];
+    });
 
     for (const slot of this.slots) {
       const cycle = latestCycle(slot);
@@ -201,28 +226,72 @@ export class GptDiagnosticsBadgeManager {
       if (!intersectsViewport(rectangle, this.window)) continue;
       observedElements.push(element);
 
-      const badge = this.document.createElement('div');
-      badge.className = 'tsgd-badge';
-      badge.dataset.runtimeSlot = String(slot.runtimeSlotNumber);
-      badge.textContent = badgeText(cycle);
-      badge.style.maxWidth = `${BADGE_MAX_WIDTH_PX}px`;
+      const runtimeSlot = String(slot.runtimeSlotNumber);
+      let badge = existingBadges.get(runtimeSlot);
+      if (!badge) {
+        const createdBadge = this.document.createElement('div');
+        createdBadge.className = 'tsgd-badge';
+        const evidence = this.document.createElement('span');
+        evidence.className = 'tsgd-badge-evidence';
+        const handle = this.document.createElement('button');
+        handle.type = 'button';
+        handle.className = 'tsgd-badge-handle';
+        createdBadge.append(evidence, handle);
+        handle.addEventListener('click', () => {
+          const runtimeSlotNumber = Number(createdBadge.dataset.runtimeSlot);
+          const requestNumber = Number(createdBadge.dataset.requestNumber);
+          if (!Number.isSafeInteger(runtimeSlotNumber) || !Number.isSafeInteger(requestNumber)) {
+            return;
+          }
+          this.onActivate(runtimeSlotNumber, requestNumber);
+        });
+        badge = createdBadge;
+      }
+      const text = badgeText(cycle);
+      badge.dataset.runtimeSlot = runtimeSlot;
+      badge.dataset.requestNumber = String(cycle.requestNumber);
+      const evidence = badge.querySelector<HTMLElement>('.tsgd-badge-evidence')!;
+      evidence.textContent = `Request #${cycle.requestNumber} · ${text}`;
+      const handle = badge.querySelector<HTMLButtonElement>('.tsgd-badge-handle')!;
+      handle.textContent = `Ad #${slot.runtimeSlotNumber}`;
+      handle.setAttribute(
+        'aria-label',
+        `Open diagnostics for Ad #${slot.runtimeSlotNumber}, Request #${cycle.requestNumber}: ${text}`
+      );
+      badge.style.maxWidth = `${Math.max(
+        0,
+        Math.min(BADGE_MAX_WIDTH_PX, this.window.innerWidth - 2 * BADGE_EDGE_GUTTER_PX)
+      )}px`;
       badge.style.left = `${Math.max(
         BADGE_EDGE_GUTTER_PX,
         Math.min(rectangle.left, this.window.innerWidth - BADGE_MAX_WIDTH_PX - BADGE_EDGE_GUTTER_PX)
       )}px`;
-      if (rectangle.top >= 56) {
-        badge.style.top = `${rectangle.top - 8}px`;
-        badge.style.transform = 'translateY(-100%)';
-      } else {
-        badge.style.top = `${Math.max(
-          BADGE_EDGE_GUTTER_PX,
-          rectangle.top + BADGE_EDGE_GUTTER_PX
-        )}px`;
+      if (!badge.isConnected) this.layer.append(badge);
+      const evidenceHeight = evidence.getBoundingClientRect().height;
+      badge.style.top = `${Math.max(
+        BADGE_EDGE_GUTTER_PX,
+        Math.min(
+          rectangle.top - evidenceHeight - BADGE_EDGE_GUTTER_PX,
+          this.window.innerHeight - evidenceHeight - BADGE_EDGE_GUTTER_PX
+        )
+      )}px`;
+      const handlePosition = this.handlePosition(rectangle, creativeRectangles);
+      handle.hidden = !handlePosition;
+      handle.style.width = `${HANDLE_WIDTH_PX}px`;
+      handle.style.height = `${HANDLE_HEIGHT_PX}px`;
+      if (handlePosition) {
+        handle.style.left = `${handlePosition.left}px`;
+        handle.style.top = `${handlePosition.top}px`;
       }
-      badges.push(badge);
+      badges.add(badge);
     }
 
-    this.layer.replaceChildren(...badges);
+    for (const badge of Array.from(this.layer.querySelectorAll<HTMLDivElement>('.tsgd-badge'))) {
+      if (!badges.has(badge)) badge.remove();
+    }
+    for (const badge of badges) {
+      if (!badge.isConnected) this.layer.append(badge);
+    }
     this.resizeObserver?.disconnect();
     for (const element of observedElements) this.resizeObserver?.observe(element);
   }
@@ -240,6 +309,37 @@ export class GptDiagnosticsBadgeManager {
     this.layer = undefined;
   }
 
+  private handlePosition(
+    rectangle: DOMRect,
+    creativeRectangles: DOMRect[]
+  ): { left: number; top: number } | undefined {
+    const gutter = BADGE_EDGE_GUTTER_PX;
+    const maxLeft = this.window.innerWidth - HANDLE_WIDTH_PX - gutter;
+    const maxTop = this.window.innerHeight - HANDLE_HEIGHT_PX - gutter;
+    const left = Math.max(gutter, Math.min(rectangle.left, maxLeft));
+    const top = Math.max(gutter, Math.min(rectangle.top, maxTop));
+    const candidates = [
+      { left, top: rectangle.top - HANDLE_HEIGHT_PX - gutter },
+      { left, top: rectangle.bottom + gutter },
+      { left: rectangle.right + gutter, top },
+      { left: rectangle.left - HANDLE_WIDTH_PX - gutter, top },
+    ];
+    return candidates.find(
+      (candidate) =>
+        candidate.left >= gutter &&
+        candidate.top >= gutter &&
+        candidate.left <= maxLeft &&
+        candidate.top <= maxTop &&
+        creativeRectangles.every(
+          (creative) =>
+            candidate.left + HANDLE_WIDTH_PX <= creative.left ||
+            candidate.left >= creative.right ||
+            candidate.top + HANDLE_HEIGHT_PX <= creative.top ||
+            candidate.top >= creative.bottom
+        )
+    );
+  }
+
   private readonly scheduleUpdate = (): void => {
     if (this.destroyed || this.scheduled) return;
     this.scheduled = true;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/evidence.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/evidence.ts
new file mode 100644
index 0000000000..af9779597a
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/evidence.ts
@@ -0,0 +1,14 @@
+import type { GptDiagnosticsPrebidAuctionEvidence } from '../../core/types';
+
+/** Return a mutable copy of retained Prebid auction evidence. */
+export function clonePrebidAuctionEvidence(
+  evidence: GptDiagnosticsPrebidAuctionEvidence
+): GptDiagnosticsPrebidAuctionEvidence {
+  return {
+    ...evidence,
+    ...(evidence.targetingCandidate
+      ? { targetingCandidate: { ...evidence.targetingCandidate } }
+      : {}),
+    ...(evidence.win ? { win: { ...evidence.win } } : {}),
+  };
+}
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/index.ts
index ac8a0de4cd..d1f7f605e3 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/index.ts
@@ -10,6 +10,7 @@ import { GptDiagnosticsBindingManager } from './binding';
 import { GptDiagnosticsObserver } from './observer';
 import type { GptObserverWindow } from './observer';
 import { GptDiagnosticsOverlay } from './overlay';
+import { GptDiagnosticsPrebidRecorder } from './prebid';
 import { GptDiagnosticsSlotSizeObserver } from './slot_size_observer';
 import { GptDiagnosticsStore } from './store';
 
@@ -51,6 +52,7 @@ export function installGptDiagnosticsRuntime(
   let slotSizeObserver: GptDiagnosticsSlotSizeObserver | undefined;
   let apiController: GptDiagnosticsApiController | undefined;
   let traceHandoff: TraceHandoff | undefined;
+  let prebidRecorder: GptDiagnosticsPrebidRecorder | undefined;
 
   try {
     if (!target.tsjs) throw new Error('TSJS core API unavailable');
@@ -71,6 +73,8 @@ export function installGptDiagnosticsRuntime(
     badges = new GptDiagnosticsBadgeManager(store, bindings, {
       window: target,
       document: target.document,
+      onActivate: (runtimeSlotNumber, requestNumber) =>
+        overlay?.selectRequest(runtimeSlotNumber, requestNumber),
     });
     slotSizeObserver = new GptDiagnosticsSlotSizeObserver(store, bindings, { window: target });
     overlay = new GptDiagnosticsOverlay(store, bindings, {
@@ -93,6 +97,8 @@ export function installGptDiagnosticsRuntime(
     observer.install();
     const api = apiController.api;
     const recorder = apiController.recorder;
+    prebidRecorder = new GptDiagnosticsPrebidRecorder(target, recorder);
+    recorder.recordCompletedPrebidAuction = prebidRecorder.recordCompletedPrebidAuction;
     const runtime: GptDiagnosticsRuntime = {
       api,
       destroy: () => {
@@ -102,6 +108,7 @@ export function installGptDiagnosticsRuntime(
         if (target.tsjs?.gptDiagnosticsRecorder === recorder) {
           delete target.tsjs.gptDiagnosticsRecorder;
         }
+        prebidRecorder?.destroy();
         apiController?.destroy();
         overlay?.destroy();
         badges?.destroy();
@@ -123,6 +130,7 @@ export function installGptDiagnosticsRuntime(
   } catch (error) {
     traceHandoff?.destroy();
     traceHandoff = undefined;
+    prebidRecorder?.destroy();
     apiController?.destroy();
     overlay?.destroy();
     badges?.destroy();
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
index 8512bfe128..72e23005ee 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
@@ -4,7 +4,12 @@ import type { TraceHandoffState } from '../../trace/handoff';
 
 import type { GptDiagnosticsBindingManager } from './binding';
 import { unhandledCase } from './exhaustive';
-import { formatSizes, scheduleFrame } from './presentation_helpers';
+import {
+  auctionTypeLabel,
+  displayableGptFillSize,
+  formatSizes,
+  scheduleFrame,
+} from './presentation_helpers';
 import type { GptDiagnosticsStoreSlotSnapshot, GptDiagnosticsStoreSnapshot } from './store';
 
 export const GPT_DIAGNOSTICS_HOST_ID = 'trusted-server-gpt-diagnostics';
@@ -72,7 +77,7 @@ const PANEL_STYLES = `
     font: inherit;
   }
   button { cursor: pointer; }
-  button:focus-visible, select:focus-visible, summary:focus-visible { outline: 2px solid #60a5fa; outline-offset: 2px; }
+  button:focus-visible, select:focus-visible, summary:focus-visible, a:focus-visible { outline: 2px solid #60a5fa; outline-offset: 2px; }
   .tsgd-toolbar { display: flex; gap: 8px; align-items: center; border-bottom: 1px solid #334155; }
   .tsgd-toolbar { flex-wrap: wrap; }
   .tsgd-trace-action { min-height: 44px; background: #1d4ed8; font-weight: 700; }
@@ -84,6 +89,13 @@ const PANEL_STYLES = `
   .tsgd-empty { padding: 18px 12px; color: #94a3b8; }
   .tsgd-slot { border-bottom: 1px solid #334155; }
   .tsgd-slot:last-child { border-bottom: 0; }
+  .tsgd-slot[aria-current="true"], .tsgd-cycle[aria-current="true"] { outline: 2px solid #60a5fa; outline-offset: -2px; }
+  .tsgd-group { margin-top: 8px; }
+  .tsgd-group h3 { margin: 0; color: #e2e8f0; font-size: 12px; }
+  .tsgd-help { padding: 0 12px 8px; color: #cbd5e1; }
+  .tsgd-help p { margin: 6px 0 0; }
+  .tsgd-locate { margin-top: 8px; }
+  .tsgd-selection-note { padding: 8px 12px; color: #fde68a; border-bottom: 1px solid #334155; }
   .tsgd-slot-title { display: flex; gap: 8px; align-items: baseline; }
   .tsgd-slot-title strong { overflow-wrap: anywhere; }
   .tsgd-state { margin-left: auto; color: #fde68a; white-space: nowrap; }
@@ -93,8 +105,12 @@ const PANEL_STYLES = `
   summary { cursor: pointer; color: #93c5fd; }
   .tsgd-cycle { margin: 6px 0 0; padding: 6px 8px; background: #0f172a; border-radius: 5px; }
   .tsgd-badge-layer { position: fixed; z-index: 2147483646; inset: 0; pointer-events: none; }
-  .tsgd-badge {
-    position: fixed;
+  .tsgd-badge { position: fixed; pointer-events: none; }
+  .tsgd-badge-evidence {
+    display: block;
+    max-height: calc(100vh - 8px);
+    overflow: hidden;
+    pointer-events: none;
     padding: 5px 7px;
     color: #fff;
     background: rgb(15 23 42 / 94%);
@@ -103,6 +119,25 @@ const PANEL_STYLES = `
     box-shadow: 0 2px 8px rgb(0 0 0 / 35%);
     font: 11px/1.35 ui-sans-serif, system-ui, sans-serif;
     white-space: pre-line;
+    text-align: left;
+  }
+  .tsgd-badge-handle {
+    position: fixed;
+    pointer-events: auto;
+    min-height: 0;
+    padding: 2px 4px;
+    overflow: hidden;
+    white-space: nowrap;
+    font: 11px/1.35 ui-sans-serif, system-ui, sans-serif;
+    border-color: #60a5fa;
+  }
+  .tsgd-badge-handle[hidden] { display: none; }
+  .tsgd-highlight {
+    position: fixed;
+    border: 3px solid #fbbf24;
+    background: rgb(251 191 36 / 18%);
+    box-shadow: 0 0 0 3px rgb(15 23 42 / 75%);
+    pointer-events: none;
   }
 `;
 
@@ -126,28 +161,34 @@ function formatMilliseconds(value: number | undefined): string | undefined {
   return `${Math.round(value * 10) / 10} ms`;
 }
 
-function deliveryFact(cycle: GptDiagnosticsRequestCycle): string | undefined {
+function deliveryFact(cycle: GptDiagnosticsRequestCycle): string {
   switch (cycle.delivery) {
     case 'trusted_server_response_sent':
-      return 'Trusted Server selected; markup response sent to PUC';
+      return 'Creative markup sent; execution not confirmed';
     case 'trusted_server_selected':
-      return 'Trusted Server selected; no markup response confirmed';
+      return 'Server bid selected by the creative bridge; response not confirmed';
     case 'candidate_unconfirmed':
-      return 'Trusted Server candidate unconfirmed — another GAM result or a creative/bridge failure is possible';
+      return 'Server bid available; selection not confirmed';
     case 'no_candidate':
-      return 'adInit observed no direct Trusted Server candidate for this request';
+      return 'No direct Trusted Server candidate';
     case 'unknown':
-      return 'Delivery status unknown — required GPT or direct-candidate evidence was not observed';
+      return 'Delivery status unknown — required evidence was not observed';
     case 'pending':
       return 'Waiting for Trusted Server creative evidence';
     case 'not_applicable':
+      return 'Delivery evidence: Not applicable';
     case undefined:
-      return undefined;
+      return 'Delivery evidence: Not observed';
     default:
-      return unhandledCase(cycle.delivery);
+      unhandledCase(cycle.delivery);
+      return 'Delivery evidence: Not observed';
   }
 }
 
+function servedBidderFact(cycle: GptDiagnosticsRequestCycle): string | undefined {
+  return cycle.isEmpty === false ? 'Served bidder not confirmed' : undefined;
+}
+
 function requestPathFact(cycle: GptDiagnosticsRequestCycle): string {
   switch (cycle.requestPath) {
     case 'trusted_server_direct':
@@ -157,24 +198,24 @@ function requestPathFact(cycle: GptDiagnosticsRequestCycle): string {
     case 'publisher_refresh':
       return 'Request path: Publisher refresh';
     case 'competing':
-      return 'Request path: Competing paths';
+      return 'Request path: Multiple paths observed';
     case 'unattributed':
-      return 'Request path: Unattributed';
+      return 'Request path: Not observed';
     case undefined:
-      return 'Request path: Unknown (not observed)';
+      return 'Request path: Not observed';
   }
 }
 
 function trustedServerOpportunityFact(cycle: GptDiagnosticsRequestCycle): string {
   switch (cycle.trustedServerOpportunity) {
     case 'renderable_candidate':
-      return 'Direct opportunity: Renderable candidate';
+      return 'Server bid available; creative source present';
     case 'unrenderable_candidate':
-      return 'Direct opportunity: Unrenderable candidate';
+      return 'Server bid available; creative source incomplete';
     case 'no_candidate':
       return 'Direct opportunity: No candidate';
     case undefined:
-      return 'Direct opportunity: Unknown (not observed)';
+      return 'Direct opportunity: Not observed';
   }
 }
 
@@ -247,16 +288,126 @@ function responseClassFact(cycle: GptDiagnosticsRequestCycle): string | undefine
   }
 }
 
-function cycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
-  const facts: string[] = [requestPathFact(cycle), trustedServerOpportunityFact(cycle)];
+function priceBucket(value: { priceBucket: string; currency?: string }): string {
+  return `${value.priceBucket}${value.currency ? ` ${value.currency}` : ''}`;
+}
+
+function auctionFacts(cycle: GptDiagnosticsRequestCycle): string[] {
+  const facts = [
+    requestPathFact(cycle),
+    `Auction evidence: ${cycle.auctionType ? auctionTypeLabel(cycle.auctionType) : 'Auction not observed'}`,
+  ];
+  if (cycle.auctionWinner) {
+    facts.push(`Server auction winner: ${cycle.auctionWinner.bidder}`);
+    facts.push(`Server bid price bucket: ${priceBucket(cycle.auctionWinner)}`);
+  }
+  if (cycle.prebidAuction?.targetingCandidate) {
+    const candidate = cycle.prebidAuction.targetingCandidate;
+    facts.push(`Prebid targeting candidate: ${candidate.bidder}`);
+    facts.push(`Prebid candidate price bucket: ${priceBucket(candidate)}`);
+  }
+  if (cycle.prebidAuction?.win) {
+    const win = cycle.prebidAuction.win;
+    facts.push(`Prebid bidWon observation: ${win.bidder}`);
+    facts.push(`Prebid win price bucket: ${priceBucket(win)}`);
+  }
+  const servedBidder = servedBidderFact(cycle);
+  if (servedBidder) facts.push(servedBidder);
+  return facts;
+}
+
+function timingFacts(cycle: GptDiagnosticsRequestCycle): string[] {
+  const serverTimingApplies =
+    cycle.auctionType === 'ssat' ||
+    cycle.auctionType === 'trusted_server' ||
+    cycle.auctionType === 'competing';
+  const missingServerTiming = serverTimingApplies ? 'Unavailable' : 'Not applicable';
+  const timingAnchor =
+    cycle.serverAuctionTimingOrigin === 'spa_auction'
+      ? 'SPA page-bids request T0'
+      : cycle.serverAuctionTimingOrigin === 'navigation'
+        ? 'Initial document request T0'
+        : 'Server request T0';
+  const serverTimings = [
+    [`${timingAnchor} → auction dispatched`, cycle.serverAuctionTimings?.auctionDispatchedMs],
+    [`${timingAnchor} → auction collected`, cycle.serverAuctionTimings?.auctionResolvedMs],
+    [`${timingAnchor} → bids ready`, cycle.serverAuctionTimings?.auctionCommittedMs],
+  ] as const;
+  const facts = serverTimings.map(
+    ([label, timing]) => `${label} ${formatMilliseconds(timing) ?? missingServerTiming}`
+  );
+  const wait = formatMilliseconds(cycle.serverAuctionTimings?.auctionWaitMs);
+  if (wait) {
+    const placement =
+      cycle.serverAuctionTimings?.auctionWaitPlacement === 'pre_header'
+        ? 'pre-header'
+        : cycle.serverAuctionTimings?.auctionWaitPlacement === 'in_stream'
+          ? 'in stream'
+          : 'placement unknown';
+    facts.push(`Auction collection wait (${placement}) ${wait}`);
+  } else {
+    facts.push(`Auction collection wait ${missingServerTiming}`);
+  }
+  facts.push(
+    `Opportunity → request ${formatMilliseconds(cycle.opportunityToRequestMs) ?? 'Unavailable'}`
+  );
+  const durations = [
+    ['GAM request → response', cycle.durations.requestToResponseMs],
+    ['GAM response → render', cycle.durations.responseToRenderMs],
+    ['GAM request → render', cycle.durations.requestToRenderMs],
+    ['Render → load', cycle.durations.renderToLoadMs],
+    ['Render → viewable', cycle.durations.renderToViewableMs],
+  ] as const;
+  for (const [label, duration] of durations) {
+    facts.push(`${label} ${formatMilliseconds(duration) ?? 'Unavailable'}`);
+  }
+  return facts;
+}
+
+function deliveryFacts(cycle: GptDiagnosticsRequestCycle): string[] {
+  const facts = [
+    deliveryFact(cycle),
+    responseClassFact(cycle) ?? 'Ad Manager response class: Not observed',
+    adManagerFact(cycle) ?? 'Ad Manager fields: Not observed',
+  ];
+  if (cycle.loadAtMs !== undefined) facts.push('GPT slot onload observed');
+  if (cycle.viewableAtMs !== undefined) facts.push('GPT impressionViewable observed');
+  if (cycle.incompleteSequence) facts.push('Incomplete sequence');
+  if (cycle.isBackfill !== undefined) facts.push(`Backfill ${cycle.isBackfill ? 'yes' : 'no'}`);
+  if (cycle.slotContentChanged !== undefined) {
+    facts.push(`Slot content changed ${cycle.slotContentChanged ? 'yes' : 'no'}`);
+  }
+  return facts;
+}
+
+function sizeFacts(cycle: GptDiagnosticsRequestCycle): string[] {
+  const fillSize = displayableGptFillSize(cycle.size);
+  return [
+    cycle.requestedSlotSizes
+      ? `Requested sizes ${formatSizes(cycle.requestedSlotSizes)}`
+      : 'Requested sizes: Not observed',
+    fillSize
+      ? `GPT-reported size ${formatSizes([fillSize])}`
+      : cycle.size?.[0] === 1 && cycle.size[1] === 1
+        ? 'GPT-reported size: placeholder hidden'
+        : 'GPT-reported size: Not observed',
+    cycle.observedSlotSize
+      ? `Size filled ${formatSizes([cycle.observedSlotSize])} · Measured outer slot size`
+      : 'Size filled: Not observed · Measured outer slot size',
+  ];
+}
+
+function technicalCycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
+  const facts = [trustedServerOpportunityFact(cycle)];
   if (Number.isSafeInteger(cycle.requestIntentId) && cycle.requestIntentId! > 0) {
     facts.push(`Request intent: ${cycle.requestIntentId}`);
   }
   if (typeof cycle.trustedServerAuctionId === 'string' && cycle.trustedServerAuctionId.length > 0) {
     facts.push(`Trusted Server auction: ${cycle.trustedServerAuctionId}`);
   }
-  const opportunityToRequest = formatMilliseconds(cycle.opportunityToRequestMs);
-  if (opportunityToRequest) facts.push(`Opportunity → request ${opportunityToRequest}`);
+  if (cycle.prebidAuction?.auctionId) {
+    facts.push(`Prebid auction: ${cycle.prebidAuction.auctionId}`);
+  }
   const previousRenderToRequest = formatMilliseconds(cycle.previousRenderToRequestMs);
   if (cycle.replacedRequestNumber !== undefined && previousRenderToRequest) {
     facts.push(
@@ -287,41 +438,19 @@ function cycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
   for (const failure of new Set(cycle.trustedServerCreativeFailures ?? [])) {
     facts.push(creativeFailureFact(failure));
   }
-  const deliveryLine = deliveryFact(cycle);
-  if (deliveryLine) facts.push(deliveryLine);
-  const responseClassLine = responseClassFact(cycle);
-  if (responseClassLine) facts.push(responseClassLine);
-  const adManagerLine = adManagerFact(cycle);
-  if (adManagerLine) facts.push(adManagerLine);
-  if (cycle.loadAtMs !== undefined) facts.push('GPT slot onload observed');
-  if (cycle.viewableAtMs !== undefined) facts.push('GPT impressionViewable observed');
-  if (cycle.incompleteSequence) facts.push('Incomplete sequence');
-  if (cycle.requestedSlotSizes) {
-    facts.push(`Requested slot sizes ${formatSizes(cycle.requestedSlotSizes)}`);
-  }
-  if (cycle.size) facts.push(`GPT-reported fill size ${cycle.size[0]}×${cycle.size[1]}`);
-  if (cycle.observedSlotSize) {
-    facts.push(`Observed outer slot box ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
-  }
-  if (cycle.isBackfill !== undefined) facts.push(`Backfill ${cycle.isBackfill ? 'yes' : 'no'}`);
-  if (cycle.slotContentChanged !== undefined) {
-    facts.push(`Slot content changed ${cycle.slotContentChanged ? 'yes' : 'no'}`);
-  }
-
-  const durations = [
-    ['Request → response', cycle.durations.requestToResponseMs],
-    ['Response → render', cycle.durations.responseToRenderMs],
-    ['Request → render', cycle.durations.requestToRenderMs],
-    ['Render → load', cycle.durations.renderToLoadMs],
-    ['Render → viewable', cycle.durations.renderToViewableMs],
-  ] as const;
-  for (const [label, duration] of durations) {
-    const formatted = formatMilliseconds(duration);
-    if (formatted) facts.push(`${label} ${formatted}`);
-  }
   return facts;
 }
 
+function cycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
+  return [
+    ...auctionFacts(cycle),
+    ...deliveryFacts(cycle),
+    ...timingFacts(cycle),
+    ...sizeFacts(cycle),
+    ...technicalCycleFacts(cycle),
+  ];
+}
+
 function cycleLabel(cycle: GptDiagnosticsRequestCycle): string {
   return cycle.requestNumber === 1 ? 'Initial request' : `Refresh ${cycle.requestNumber - 1}`;
 }
@@ -353,6 +482,21 @@ function appendFacts(document: Document, parent: HTMLElement, facts: string[]):
   parent.append(list);
 }
 
+function appendGroup(
+  document: Document,
+  parent: HTMLElement,
+  heading: string,
+  facts: string[]
+): void {
+  const section = document.createElement('section');
+  section.className = 'tsgd-group';
+  const title = document.createElement('h3');
+  title.textContent = heading;
+  section.append(title);
+  appendFacts(document, section, facts);
+  parent.append(section);
+}
+
 /** Owns hydration-safe mounting and the closed-shadow diagnostics panel. */
 export class GptDiagnosticsOverlay {
   private readonly store: OverlayStore;
@@ -370,6 +514,7 @@ export class GptDiagnosticsOverlay {
   private readonly unsubscribeBindings: () => void;
   private host?: HTMLElement;
   private panel?: HTMLElement;
+  private badgeLayer?: HTMLElement;
   private lifecycleObserver?: MutationObserver;
   private visualReady = false;
   private mountWaitStarted = false;
@@ -380,6 +525,9 @@ export class GptDiagnosticsOverlay {
   private dismissed = false;
   private destroyed = false;
   private filter: GptDiagnosticsFilter = 'all';
+  private selectedRequest?: { runtimeSlotNumber: number; requestNumber: number };
+  private historySlotToOpenOnce?: number;
+  private selectedRequestHasFocus = false;
 
   constructor(store: OverlayStore, bindings: OverlayBindings, options: OverlayOptions = {}) {
     this.store = store;
@@ -419,6 +567,28 @@ export class GptDiagnosticsOverlay {
     this.scheduleRender();
   }
 
+  /** Open and focus the exact retained request selected from an on-page badge. */
+  selectRequest(runtimeSlotNumber: number, requestNumber: number): void {
+    if (this.destroyed) return;
+    this.selectedRequest = { runtimeSlotNumber, requestNumber };
+    const slot = this.store
+      .snapshot()
+      .slots.find((candidate) => candidate.runtimeSlotNumber === runtimeSlotNumber);
+    this.historySlotToOpenOnce =
+      slot && latestCycle(slot)?.requestNumber !== requestNumber ? runtimeSlotNumber : undefined;
+    this.filter = 'all';
+    this.collapsed = false;
+    this.show();
+    this.render();
+    this.scheduleFrame(() => {
+      const selected = this.panel?.querySelector<HTMLElement>(
+        `[data-runtime-slot="${runtimeSlotNumber}"][data-request-number="${requestNumber}"]`
+      );
+      selected?.focus();
+      selected?.scrollIntoView?.({ block: 'nearest' });
+    });
+  }
+
   destroy(): void {
     if (this.destroyed) return;
     this.destroyed = true;
@@ -477,11 +647,11 @@ export class GptDiagnosticsOverlay {
     panel.setAttribute('aria-label', 'GPT runtime diagnostics');
     const badgeLayer = this.document.createElement('div');
     badgeLayer.className = 'tsgd-badge-layer';
-    badgeLayer.setAttribute('aria-hidden', 'true');
     root.append(style, badgeLayer, panel);
 
     this.host = host;
     this.panel = panel;
+    this.badgeLayer = badgeLayer;
     (this.document.body ?? this.document.documentElement).append(host);
     this.onShadowRoot?.(root);
     this.onBadgeLayerChange?.(badgeLayer);
@@ -493,6 +663,7 @@ export class GptDiagnosticsOverlay {
     const host = this.host;
     this.host = undefined;
     this.panel = undefined;
+    this.badgeLayer = undefined;
     host?.remove();
   }
 
@@ -540,11 +711,20 @@ export class GptDiagnosticsOverlay {
     const panel = this.panel;
     const previousContent = panel.querySelector<HTMLElement>('.tsgd-content');
     const previousScrollTop = previousContent?.scrollTop ?? 0;
+    const selectedRequestWasFocused = this.selectedRequestHasFocus;
+    const helpOpen = panel.querySelector<HTMLDetailsElement>('.tsgd-help')?.open ?? false;
     const openHistorySlots = new Set(
-      Array.from(panel.querySelectorAll<HTMLDetailsElement>('.tsgd-slot details[open]'))
+      Array.from(panel.querySelectorAll<HTMLDetailsElement>('.tsgd-history[open]'))
         .map((details) => details.closest<HTMLElement>('.tsgd-slot')?.dataset.runtimeSlot)
         .filter((runtimeSlot): runtimeSlot is string => runtimeSlot !== undefined)
     );
+    const openTechnicalSlots = new Set(
+      Array.from(panel.querySelectorAll<HTMLDetailsElement>('.tsgd-technical[open]'))
+        .map((details) => details.closest<HTMLElement>('.tsgd-slot')?.dataset.runtimeSlot)
+        .filter((runtimeSlot): runtimeSlot is string => runtimeSlot !== undefined)
+    );
+    const historySlotToOpenOnce = this.historySlotToOpenOnce;
+    this.historySlotToOpenOnce = undefined;
     const retainedToolbar =
       this.onViewTrace && !this.collapsed
         ? panel.querySelector<HTMLElement>('.tsgd-toolbar')
@@ -577,6 +757,8 @@ export class GptDiagnosticsOverlay {
 
     const toolbar = retainedToolbar ?? this.document.createElement('div');
     toolbar.className = 'tsgd-toolbar';
+    const retainedFilter = retainedToolbar?.querySelector('select');
+    if (retainedFilter) retainedFilter.value = this.filter;
     if (!retainedToolbar) {
       const filterLabel = this.document.createElement('label');
       filterLabel.textContent = 'Filter';
@@ -603,7 +785,14 @@ export class GptDiagnosticsOverlay {
       });
       const exportButton = this.button('Export JSON', () => this.onExport());
       filterLabel.append(select);
-      toolbar.append(filterLabel, exportButton);
+      const dictionaryLink = this.document.createElement('a');
+      dictionaryLink.href =
+        'https://iabtechlab.github.io/trusted-server/guide/integrations/gpt-diagnostics-dictionary';
+      dictionaryLink.target = '_blank';
+      dictionaryLink.rel = 'noopener noreferrer';
+      dictionaryLink.textContent = 'Label dictionary';
+      dictionaryLink.setAttribute('aria-label', 'Open GPT diagnostics label dictionary');
+      toolbar.append(filterLabel, exportButton, dictionaryLink);
     }
     if (this.onViewTrace) {
       const viewTrace =
@@ -650,6 +839,17 @@ export class GptDiagnosticsOverlay {
       if (!retainedTraceStatus) panel.append(traceStatus);
     }
 
+    const help = this.document.createElement('details');
+    help.className = 'tsgd-help';
+    help.open = helpOpen;
+    const helpSummary = this.document.createElement('summary');
+    helpSummary.textContent = 'How to read this evidence';
+    const helpText = this.document.createElement('p');
+    helpText.textContent =
+      'Auction winners, Prebid candidates, and GPT render results are separate observations. “Filled” does not identify the served bidder. Browser and server timings use separate clocks.';
+    help.append(helpSummary, helpText);
+    panel.append(help);
+
     const summary = this.document.createElement('div');
     summary.className = 'tsgd-summary';
     summary.textContent = `${snapshot.slots.length} slots · ${snapshot.callbackIssues.length} callback issues · ${snapshot.attributionIssues?.length ?? 0} attribution issues`;
@@ -664,6 +864,23 @@ export class GptDiagnosticsOverlay {
     summary.append(coverage);
     panel.append(summary);
 
+    if (
+      this.selectedRequest &&
+      !snapshot.slots.some(
+        (slot) =>
+          slot.runtimeSlotNumber === this.selectedRequest?.runtimeSlotNumber &&
+          slot.requests.some((cycle) => cycle.requestNumber === this.selectedRequest?.requestNumber)
+      )
+    ) {
+      const note = this.document.createElement('div');
+      note.className = 'tsgd-selection-note';
+      note.setAttribute('role', 'status');
+      note.textContent = `Ad #${this.selectedRequest.runtimeSlotNumber}, Request #${this.selectedRequest.requestNumber} is no longer retained.`;
+      panel.append(note);
+      this.selectedRequest = undefined;
+      this.selectedRequestHasFocus = false;
+    }
+
     const content = this.document.createElement('div');
     content.className = 'tsgd-content';
     const filteredSlots = snapshot.slots.filter((slot) =>
@@ -677,22 +894,47 @@ export class GptDiagnosticsOverlay {
       content.append(empty);
     } else {
       for (const slot of filteredSlots) {
-        content.append(this.renderSlot(slot, openHistorySlots.has(String(slot.runtimeSlotNumber))));
+        const runtimeSlot = String(slot.runtimeSlotNumber);
+        content.append(
+          this.renderSlot(
+            slot,
+            openHistorySlots.has(runtimeSlot) || historySlotToOpenOnce === slot.runtimeSlotNumber,
+            openTechnicalSlots.has(runtimeSlot)
+          )
+        );
       }
     }
     panel.append(content);
     content.scrollTop = previousScrollTop;
+    if (selectedRequestWasFocused) {
+      panel.querySelector<HTMLElement>('[aria-current="true"]')?.focus({ preventScroll: true });
+    }
   }
 
-  private renderSlot(slot: GptDiagnosticsStoreSlotSnapshot, historyOpen: boolean): HTMLElement {
+  private renderSlot(
+    slot: GptDiagnosticsStoreSlotSnapshot,
+    historyOpen: boolean,
+    technicalOpen: boolean
+  ): HTMLElement {
     const container = this.document.createElement('article');
     container.className = 'tsgd-slot';
+    const latest = latestCycle(slot);
     container.dataset.runtimeSlot = String(slot.runtimeSlotNumber);
+    if (latest) container.dataset.requestNumber = String(latest.requestNumber);
+    const latestSelected =
+      latest !== undefined &&
+      this.selectedRequest?.runtimeSlotNumber === slot.runtimeSlotNumber &&
+      this.selectedRequest.requestNumber === latest.requestNumber;
+    if (latestSelected) {
+      container.tabIndex = -1;
+      container.setAttribute('aria-current', 'true');
+      this.trackSelectedRequestFocus(container);
+    }
+
     const title = this.document.createElement('div');
     title.className = 'tsgd-slot-title';
     const name = this.document.createElement('strong');
-    name.textContent = slot.slotElementId ?? `Unbound GPT slot ${slot.runtimeSlotNumber}`;
-    const latest = latestCycle(slot);
+    name.textContent = `Ad #${slot.runtimeSlotNumber}${latest ? ` · Request #${latest.requestNumber}` : ''} · ${slot.slotElementId ?? 'Unbound GPT slot'}`;
     const state = this.document.createElement('span');
     state.className = 'tsgd-state';
     state.textContent = primaryState(latest);
@@ -700,41 +942,117 @@ export class GptDiagnosticsOverlay {
     container.append(title);
 
     const binding = this.bindings.get(slot.runtimeSlotNumber);
-    const facts = [
-      slot.adUnitPath ? `Ad unit ${slot.adUnitPath}` : undefined,
-      binding.binding.status === 'bound'
-        ? `Bound · ${binding.visible ? 'Visible' : 'Outside viewport'}`
-        : binding.binding.status === 'ambiguous'
-          ? `Ambiguous binding · ${binding.binding.reason ?? 'unknown'}`
-          : `Unbound · ${binding.binding.reason ?? 'unknown'}`,
-      slot.currentVisibilityPercentage !== undefined
-        ? `GPT visibility ${slot.currentVisibilityPercentage}% (maximum ${slot.maximumVisibilityPercentage ?? slot.currentVisibilityPercentage}%)`
-        : undefined,
-      latest ? cycleLabel(latest) : undefined,
-      ...(latest ? cycleFacts(latest) : []),
-    ].filter((fact): fact is string => fact !== undefined);
-    appendFacts(this.document, container, facts);
+    if (binding.binding.status === 'bound' && binding.element?.isConnected) {
+      const locate = this.button('Locate on page', () => this.locateOnPage(slot.runtimeSlotNumber));
+      locate.className = 'tsgd-locate';
+      container.append(locate);
+    }
+
+    if (latest) {
+      const summaryFacts = [
+        `Ad #${slot.runtimeSlotNumber} · Request #${latest.requestNumber}`,
+        `GPT result: ${primaryState(latest)}`,
+        `Observed auction path: ${latest.auctionType ? auctionTypeLabel(latest.auctionType) : 'Auction not observed'}`,
+        deliveryFact(latest),
+      ];
+      const servedBidder = servedBidderFact(latest);
+      if (servedBidder) summaryFacts.push(servedBidder);
+      appendGroup(this.document, container, 'Summary', summaryFacts);
+      appendGroup(this.document, container, 'Auction evidence', auctionFacts(latest));
+      appendGroup(this.document, container, 'Delivery evidence', deliveryFacts(latest));
+      appendGroup(this.document, container, 'Timing', timingFacts(latest));
+      appendGroup(this.document, container, 'Size and visibility', [
+        ...sizeFacts(latest),
+        binding.binding.status === 'bound'
+          ? `Binding: Bound · ${binding.visible ? 'Visible' : 'Outside viewport'}`
+          : `Binding: ${binding.binding.status} · ${binding.binding.reason ?? 'reason unavailable'}`,
+        slot.currentVisibilityPercentage !== undefined
+          ? `GPT visibility ${slot.currentVisibilityPercentage}% (maximum ${slot.maximumVisibilityPercentage ?? slot.currentVisibilityPercentage}%)`
+          : 'GPT visibility: Not observed',
+      ]);
+    }
 
     if (slot.requests.length > 1) {
       const history = this.document.createElement('details');
+      history.className = 'tsgd-history';
       history.open = historyOpen;
       const summary = this.document.createElement('summary');
-      summary.textContent = `Previous requests (${slot.requests.length - 1})`;
+      summary.textContent = `Request history (${slot.requests.length - 1} previous)`;
       history.append(summary);
       for (const cycle of slot.requests.slice(0, -1).reverse()) {
         const previous = this.document.createElement('div');
         previous.className = 'tsgd-cycle';
+        previous.dataset.runtimeSlot = String(slot.runtimeSlotNumber);
+        previous.dataset.requestNumber = String(cycle.requestNumber);
+        const selected =
+          this.selectedRequest?.runtimeSlotNumber === slot.runtimeSlotNumber &&
+          this.selectedRequest.requestNumber === cycle.requestNumber;
+        if (selected) {
+          previous.tabIndex = -1;
+          previous.setAttribute('aria-current', 'true');
+          this.trackSelectedRequestFocus(previous);
+        }
         const heading = this.document.createElement('strong');
-        heading.textContent = `${cycleLabel(cycle)} · ${primaryState(cycle)}`;
+        heading.textContent = `Request #${cycle.requestNumber} · ${cycleLabel(cycle)} · ${primaryState(cycle)}`;
         previous.append(heading);
         appendFacts(this.document, previous, cycleFacts(cycle));
         history.append(previous);
       }
       container.append(history);
     }
+
+    const technical = this.document.createElement('details');
+    technical.className = 'tsgd-technical';
+    technical.open = technicalOpen;
+    const technicalSummary = this.document.createElement('summary');
+    technicalSummary.textContent = 'Technical details';
+    technical.append(technicalSummary);
+    appendFacts(this.document, technical, [
+      slot.adUnitPath ? `Ad unit ${slot.adUnitPath}` : 'Ad unit: Unavailable',
+      ...(latest
+        ? []
+        : [
+            binding.binding.status === 'bound'
+              ? `Bound · ${binding.visible ? 'Visible' : 'Outside viewport'}`
+              : binding.binding.status === 'ambiguous'
+                ? `Ambiguous binding · ${binding.binding.reason ?? 'reason unavailable'}`
+                : `Unbound · ${binding.binding.reason ?? 'reason unavailable'}`,
+          ]),
+      ...(latest ? technicalCycleFacts(latest) : []),
+    ]);
+    container.append(technical);
     return container;
   }
 
+  private trackSelectedRequestFocus(element: HTMLElement): void {
+    element.addEventListener('focus', () => {
+      this.selectedRequestHasFocus = true;
+    });
+    element.addEventListener('blur', () => {
+      this.selectedRequestHasFocus = false;
+    });
+  }
+
+  private locateOnPage(runtimeSlotNumber: number): void {
+    const binding = this.bindings.get(runtimeSlotNumber);
+    const element = binding.element;
+    if (binding.binding.status !== 'bound' || !element?.isConnected) return;
+    element.scrollIntoView({ behavior: 'auto', block: 'center', inline: 'nearest' });
+    this.scheduleFrame(() => {
+      if (!this.badgeLayer?.isConnected || !element.isConnected) return;
+      const rectangle = element.getBoundingClientRect();
+      const highlight = this.document.createElement('div');
+      highlight.className = 'tsgd-highlight';
+      highlight.setAttribute('aria-hidden', 'true');
+      highlight.style.left = `${rectangle.left}px`;
+      highlight.style.top = `${rectangle.top}px`;
+      highlight.style.width = `${rectangle.width}px`;
+      highlight.style.height = `${rectangle.height}px`;
+      this.badgeLayer.append(highlight);
+      this.window.setTimeout(() => highlight.remove(), 1500);
+    });
+  }
+
   private button(label: string, action: () => void): HTMLButtonElement {
     const button = this.document.createElement('button');
     button.type = 'button';
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/prebid.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/prebid.ts
new file mode 100644
index 0000000000..8db150dbb6
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/prebid.ts
@@ -0,0 +1,179 @@
+import type {
+  GptDiagnosticsAuctionWinner,
+  GptDiagnosticsRecorder,
+  GptDiagnosticsSlotHandle,
+  TsjsApi,
+} from '../../core/types';
+
+type DiagnosticSlot = GptDiagnosticsSlotHandle & {
+  getTargeting?: (key: string) => string[];
+};
+type DiagnosticPrebid = Parameters<
+  NonNullable<GptDiagnosticsRecorder['recordCompletedPrebidAuction']>
+>[0];
+type DiagnosticWindow = {
+  performance: Pick<Performance, 'now'>;
+  tsjs?: Pick<TsjsApi, 'navGeneration'>;
+};
+
+const MAX_PREBID_DIAGNOSTIC_ATTEMPTS = 128;
+const PREBID_DIAGNOSTIC_WINDOW_MS = 30_000;
+
+interface PrebidDiagnosticAttempt {
+  prebid: DiagnosticPrebid;
+  slot: DiagnosticSlot;
+  generation: number;
+  expiresAtMs: number;
+}
+
+function prebidDiagnosticKey(auctionId: string, adUnitCode: string): string {
+  return `${auctionId}\u0000${adUnitCode}`;
+}
+
+function boundedTargetingValue(
+  slot: DiagnosticSlot,
+  key: string,
+  maxBytes: number
+): string | undefined {
+  let values: string[] | undefined;
+  try {
+    values = slot.getTargeting?.(key);
+  } catch {
+    return undefined;
+  }
+  if (!Array.isArray(values) || values.length !== 1) return undefined;
+  const value = values[0]?.trim();
+  if (!value || new TextEncoder().encode(value).length > maxBytes) return undefined;
+  return value;
+}
+
+function targetingCandidate(slot: DiagnosticSlot): GptDiagnosticsAuctionWinner | undefined {
+  const bidder = boundedTargetingValue(slot, 'hb_bidder', 128);
+  const priceBucket = boundedTargetingValue(slot, 'hb_pb', 64);
+  if (!bidder || !priceBucket || !/^\d+(?:\.\d+)?$/.test(priceBucket)) return undefined;
+  return { bidder, priceBucket };
+}
+
+/** Correlates targeting and bidWon only in the optional diagnostics bundle. */
+export class GptDiagnosticsPrebidRecorder {
+  private readonly attempts = new Map<string, PrebidDiagnosticAttempt>();
+  private readonly installed = new Map<DiagnosticPrebid, (bid: unknown) => void>();
+  private destroyed = false;
+
+  constructor(
+    private readonly target: DiagnosticWindow,
+    private recorder:
+      | Pick<GptDiagnosticsRecorder, 'recordPrebidAuction' | 'recordPrebidWin'>
+      | undefined
+  ) {}
+
+  destroy(): void {
+    if (this.destroyed) return;
+    this.destroyed = true;
+    this.recorder = undefined;
+    this.attempts.clear();
+    for (const [prebid, listener] of this.installed) {
+      try {
+        prebid.offEvent?.('bidWon', listener);
+      } catch {
+        // A missing or failing unsubscribe leaves an inert listener, not the store.
+      }
+    }
+    this.installed.clear();
+  }
+
+  recordCompletedPrebidAuction = (
+    pbjs: DiagnosticPrebid,
+    rawAuctionId: unknown,
+    auctionSlots: DiagnosticSlot[],
+    adUnitCodes: string[]
+  ): void => {
+    if (this.destroyed) return;
+    const recorder = this.recorder;
+    if (!recorder || typeof rawAuctionId !== 'string') return;
+    const auctionId = rawAuctionId;
+    if (
+      !auctionId ||
+      auctionId !== auctionId.trim() ||
+      new TextEncoder().encode(auctionId).length > 256
+    )
+      return;
+    if (auctionSlots.length !== adUnitCodes.length) return;
+    this.installWinListener(pbjs);
+    const counts = new Map<string, number>();
+    for (const code of adUnitCodes) counts.set(code, (counts.get(code) ?? 0) + 1);
+    const nowMs = this.target.performance.now();
+    for (const [key, attempt] of this.attempts) {
+      if (nowMs > attempt.expiresAtMs) this.attempts.delete(key);
+    }
+    const generation = this.target.tsjs?.navGeneration ?? 0;
+    for (let index = 0; index < auctionSlots.length; index += 1) {
+      const slot = auctionSlots[index];
+      const code = adUnitCodes[index];
+      if (!slot || !code || counts.get(code) !== 1) continue;
+      try {
+        recorder.recordPrebidAuction(slot, auctionId, targetingCandidate(slot));
+      } catch {
+        // Diagnostics must not suppress the GAM request.
+      }
+      const key = prebidDiagnosticKey(auctionId, code);
+      this.attempts.delete(key);
+      this.attempts.set(key, {
+        prebid: pbjs,
+        slot,
+        generation,
+        expiresAtMs: nowMs + PREBID_DIAGNOSTIC_WINDOW_MS,
+      });
+      while (this.attempts.size > MAX_PREBID_DIAGNOSTIC_ATTEMPTS) {
+        const oldest = this.attempts.keys().next().value;
+        if (oldest === undefined) break;
+        this.attempts.delete(oldest);
+      }
+    }
+  };
+
+  private installWinListener(pbjs: DiagnosticPrebid): void {
+    if (this.installed.has(pbjs) || typeof pbjs.onEvent !== 'function') return;
+    const listener = (rawBid: unknown): void => {
+      if (this.destroyed) return;
+      if (typeof rawBid !== 'object' || rawBid === null) return;
+      const bid = rawBid as Record<string, unknown>;
+      const auctionId = typeof bid.auctionId === 'string' ? bid.auctionId : undefined;
+      const adUnitCode = typeof bid.adUnitCode === 'string' ? bid.adUnitCode : undefined;
+      if (
+        !auctionId ||
+        !adUnitCode ||
+        (bid.latestTargetedAuctionId !== undefined && bid.latestTargetedAuctionId !== auctionId)
+      )
+        return;
+      const key = prebidDiagnosticKey(auctionId, adUnitCode);
+      const attempt = this.attempts.get(key);
+      if (attempt?.prebid !== pbjs) return;
+      this.attempts.delete(key);
+      if (
+        this.target.performance.now() > attempt.expiresAtMs ||
+        (this.target.tsjs?.navGeneration ?? 0) !== attempt.generation
+      ) {
+        return;
+      }
+      const adserverTargeting =
+        typeof bid.adserverTargeting === 'object' && bid.adserverTargeting !== null
+          ? (bid.adserverTargeting as Record<string, unknown>)
+          : {};
+      const winner = targetingCandidate({
+        getTargeting: (targetingKey) => {
+          const value = adserverTargeting[targetingKey];
+          return typeof value === 'string' ? [value] : [];
+        },
+      });
+      if (!winner) return;
+      try {
+        this.recorder?.recordPrebidWin(attempt.slot, auctionId, winner);
+      } catch {
+        // Diagnostics must not alter delivery.
+      }
+    };
+    pbjs.onEvent('bidWon', listener);
+    this.installed.set(pbjs, listener);
+  }
+}
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts
index b601833b8f..42ce496c66 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts
@@ -1,10 +1,43 @@
-import type { Size } from '../../core/types';
+import type { GptDiagnosticsAuctionType, Size } from '../../core/types';
 
 /** Formats CSS sizes consistently across diagnostics presentation surfaces. */
 export function formatSizes(sizes: ReadonlyArray<Size>): string {
   return sizes.map((size) => `${size[0]}×${size[1]}`).join(', ');
 }
 
+/** Hide GPT's ubiquitous 1×1 placeholder from presentation while retaining it in exports. */
+export function displayableGptFillSize(size: Size | undefined): Size | undefined {
+  return size?.[0] === 1 && size[1] === 1 ? undefined : size;
+}
+
+/** Human-readable auction classification shared by the badge and side panel. */
+export function auctionTypeLabel(type: GptDiagnosticsAuctionType): string {
+  switch (type) {
+    case 'ssat':
+      return 'SSAT: initial-page server auction';
+    case 'trusted_server':
+      return 'TS auction: SPA server auction';
+    case 'client_side':
+      return 'Client-side Prebid auction';
+    case 'competing':
+      return 'Multiple auction paths observed';
+  }
+}
+
+/** Compact auction classification shared by on-page badges. */
+export function auctionTypeBadgeLabel(type: GptDiagnosticsAuctionType): string {
+  switch (type) {
+    case 'ssat':
+      return 'SSAT';
+    case 'trusted_server':
+      return 'TS auction';
+    case 'client_side':
+      return 'Prebid auction';
+    case 'competing':
+      return 'Multiple paths';
+  }
+}
+
 /** Schedules presentation work in the target window's next animation frame. */
 export function scheduleFrame(
   window: Pick<Window, 'requestAnimationFrame'>,
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts
index 3f6fff45a8..d83c0b86a9 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts
@@ -1,4 +1,5 @@
 import type {
+  AuctionDiagnosticsData,
   GptDiagnosticsAdManagerIdentity,
   GptDiagnosticsAttributionIssue,
   GptDiagnosticsAttributionIssueReason,
@@ -8,10 +9,15 @@ import type {
   GptDiagnosticsCoverageCounters,
   GptDiagnosticsCreativeFailure,
   GptDiagnosticsDelivery,
+  GptDiagnosticsAuctionFacts,
+  GptDiagnosticsAuctionType,
+  GptDiagnosticsAuctionWinner,
+  GptDiagnosticsPrebidAuctionEvidence,
   GptDiagnosticsDurations,
   GptDiagnosticsRequestCycle,
   GptDiagnosticsRequestPath,
   GptDiagnosticsResponseClass,
+  GptDiagnosticsServerAuctionTimingOrigin,
   GptDiagnosticsSlotHandle,
   GptDiagnosticsTrustedServerOpportunity,
   Size,
@@ -42,6 +48,8 @@ function normalizedTraceIdentity(
   }
 }
 
+import { clonePrebidAuctionEvidence } from './evidence';
+
 export const MAX_DIAGNOSTIC_SLOTS = 64;
 export const MAX_REQUEST_CYCLES_PER_SLOT = 10;
 export const MAX_CALLBACK_ISSUES = 128;
@@ -135,6 +143,10 @@ interface PendingSourceEvidence {
   trustedServerAuctionId?: string;
   requestedSlotSizes?: ReadonlyArray<Size>;
   traceIdentity?: TraceGptIdentity;
+  auctionType?: Extract<GptDiagnosticsAuctionType, 'ssat' | 'trusted_server'>;
+  auctionWinner?: GptDiagnosticsAuctionWinner;
+  prebidAuction?: GptDiagnosticsPrebidAuctionEvidence;
+  serverAuctionTimings?: AuctionDiagnosticsData;
 }
 
 interface PendingRequestIntent {
@@ -254,6 +266,78 @@ function normalizedRequestedSlotSizes(value: unknown): ReadonlyArray<Size> | und
   return requestedSlotSizes.length > 0 ? Object.freeze(requestedSlotSizes) : undefined;
 }
 
+function normalizedBoundedString(value: unknown, maxBytes: number): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || new TextEncoder().encode(trimmed).length > maxBytes) return undefined;
+  return trimmed;
+}
+
+function normalizedAuctionWinner(value: unknown): GptDiagnosticsAuctionWinner | undefined {
+  if (typeof value !== 'object' || value === null) return undefined;
+  const candidate = value as Partial<GptDiagnosticsAuctionWinner>;
+  const bidder = normalizedBoundedString(candidate.bidder, 128);
+  const priceBucket = normalizedBoundedString(candidate.priceBucket, 64);
+  if (!bidder || !priceBucket || !/^\d+(?:\.\d+)?$/.test(priceBucket)) return undefined;
+  const currency = normalizedBoundedString(candidate.currency, 3)?.toUpperCase();
+  return Object.freeze({
+    bidder,
+    priceBucket,
+    ...(currency && /^[A-Z]{3}$/.test(currency) ? { currency } : {}),
+  });
+}
+
+const MAX_SERVER_AUCTION_TIMING_MS = 0xffffffff;
+
+function normalizedTiming(value: unknown): number | undefined {
+  return typeof value === 'number' &&
+    Number.isFinite(value) &&
+    value >= 0 &&
+    value <= MAX_SERVER_AUCTION_TIMING_MS
+    ? value
+    : undefined;
+}
+
+function normalizedServerAuctionTimings(value: unknown): AuctionDiagnosticsData | undefined {
+  if (typeof value !== 'object' || value === null) return undefined;
+  const candidate = value as AuctionDiagnosticsData;
+  const timings: AuctionDiagnosticsData = {
+    auctionDispatchedMs: normalizedTiming(candidate.auctionDispatchedMs),
+    auctionResolvedMs: normalizedTiming(candidate.auctionResolvedMs),
+    auctionCommittedMs: normalizedTiming(candidate.auctionCommittedMs),
+    auctionWaitMs: normalizedTiming(candidate.auctionWaitMs),
+    auctionWaitPlacement:
+      candidate.auctionWaitPlacement === 'pre_header' ||
+      candidate.auctionWaitPlacement === 'in_stream'
+        ? candidate.auctionWaitPlacement
+        : undefined,
+  };
+  return Object.values(timings).some((entry) => entry !== undefined)
+    ? Object.freeze(timings)
+    : undefined;
+}
+
+function normalizedAuctionFacts(
+  value: unknown
+): Omit<
+  PendingSourceEvidence,
+  'observedAtMs' | 'trustedServerOpportunity' | 'trustedServerAuctionId' | 'requestedSlotSizes'
+> {
+  if (typeof value !== 'object' || value === null) return {};
+  const candidate = value as GptDiagnosticsAuctionFacts;
+  const auctionType =
+    candidate.auctionType === 'ssat' || candidate.auctionType === 'trusted_server'
+      ? candidate.auctionType
+      : undefined;
+  const auctionWinner = normalizedAuctionWinner(candidate.winner);
+  const serverAuctionTimings = normalizedServerAuctionTimings(candidate.serverTimings);
+  return {
+    ...(auctionType ? { auctionType } : {}),
+    ...(auctionWinner ? { auctionWinner } : {}),
+    ...(serverAuctionTimings ? { serverAuctionTimings } : {}),
+  };
+}
+
 function responseClass(cycle: MutableRequestCycle): GptDiagnosticsResponseClass | undefined {
   if (cycle.renderAtMs === undefined) return undefined;
   if (cycle.isEmpty === true) return 'empty';
@@ -309,6 +393,13 @@ function copyCycle(cycle: MutableRequestCycle, nowMs: number): GptDiagnosticsReq
           companyIds: cycle.adManager.companyIds ? [...cycle.adManager.companyIds] : undefined,
         }
       : undefined,
+    ...(cycle.auctionWinner ? { auctionWinner: { ...cycle.auctionWinner } } : {}),
+    ...(cycle.prebidAuction
+      ? { prebidAuction: clonePrebidAuctionEvidence(cycle.prebidAuction) }
+      : {}),
+    ...(cycle.serverAuctionTimings
+      ? { serverAuctionTimings: { ...cycle.serverAuctionTimings } }
+      : {}),
     trustedServerCreativeFailures: cycle.trustedServerCreativeFailures
       ? [...cycle.trustedServerCreativeFailures]
       : undefined,
@@ -364,6 +455,7 @@ export class GptDiagnosticsStore {
     opportunity: GptDiagnosticsTrustedServerOpportunity,
     trustedServerAuctionId?: string,
     requestedSlotSizes?: ReadonlyArray<Size>,
+    auctionFacts?: GptDiagnosticsAuctionFacts,
     traceIdentity?: TraceGptIdentity
   ): void {
     if (
@@ -396,6 +488,7 @@ export class GptDiagnosticsStore {
       trustedServerAuctionId: auctionId,
       requestedSlotSizes: normalizedRequestedSlotSizes(requestedSlotSizes),
       ...(correlatedIdentity ? { traceIdentity: correlatedIdentity } : {}),
+      ...normalizedAuctionFacts(auctionFacts),
     });
   }
 
@@ -409,6 +502,47 @@ export class GptDiagnosticsStore {
     }
   }
 
+  /** Record a completed Prebid attempt for one exact slot's next request. */
+  recordPrebidAuction(
+    slot: GptDiagnosticsSlotLike,
+    auctionId: string,
+    targetingCandidate?: GptDiagnosticsAuctionWinner
+  ): void {
+    if (!isSlotObject(slot)) return;
+    const normalizedId = normalizedAuctionId(auctionId);
+    if (!normalizedId) return;
+    const candidate = normalizedAuctionWinner(targetingCandidate);
+    this.recordRequestIntentSource(slot, 'prebid_refresh', {
+      prebidAuction: Object.freeze({
+        auctionId: normalizedId,
+        ...(candidate ? { targetingCandidate: candidate } : {}),
+      }),
+    });
+  }
+
+  /** Attach a documented Prebid win only to its retained exact slot and attempt. */
+  recordPrebidWin(
+    slot: GptDiagnosticsSlotLike,
+    auctionId: string,
+    winner: GptDiagnosticsAuctionWinner
+  ): void {
+    if (!isSlotObject(slot)) return;
+    const normalizedId = normalizedAuctionId(auctionId);
+    const normalizedWinner = normalizedAuctionWinner(winner);
+    if (!normalizedId || !normalizedWinner) return;
+    const runtimeSlotNumber = this.slotNumbers.get(slot);
+    const record = runtimeSlotNumber === undefined ? undefined : this.slots.get(runtimeSlotNumber);
+    const matches = record?.requests.filter(
+      (cycle) => cycle.prebidAuction?.auctionId === normalizedId
+    );
+    if (!matches || matches.length !== 1 || !matches[0]?.prebidAuction) return;
+    matches[0].prebidAuction = Object.freeze({
+      ...matches[0].prebidAuction,
+      win: normalizedWinner,
+    });
+    this.notify();
+  }
+
   /** Record publisher refresh observation from the private GPT diagnostics observer. */
   recordPublisherRefresh(slots: GptDiagnosticsSlotLike[]): void {
     if (!Array.isArray(slots)) return;
@@ -630,6 +764,13 @@ export class GptDiagnosticsStore {
     const intent = this.consumeRequestIntent(slot, timestampMs);
     const trustedServerEvidence = intent?.sources.get('trusted_server_direct');
     const requestPath = this.requestPath(intent);
+    const auctionType = this.auctionType(intent, trustedServerEvidence);
+    const serverAuctionTimingOrigin: GptDiagnosticsServerAuctionTimingOrigin | undefined =
+      trustedServerEvidence?.auctionType === 'trusted_server'
+        ? 'spa_auction'
+        : trustedServerEvidence?.auctionType === 'ssat'
+          ? 'navigation'
+          : undefined;
     record.requests.push({
       requestNumber,
       requestedAtMs: timestampMs,
@@ -643,6 +784,17 @@ export class GptDiagnosticsStore {
       ...(trustedServerEvidence?.trustedServerAuctionId !== undefined
         ? { trustedServerAuctionId: trustedServerEvidence.trustedServerAuctionId }
         : {}),
+      ...(auctionType !== undefined ? { auctionType } : {}),
+      ...(trustedServerEvidence?.auctionWinner !== undefined
+        ? { auctionWinner: trustedServerEvidence.auctionWinner }
+        : {}),
+      ...(intent?.sources.get('prebid_refresh')?.prebidAuction !== undefined
+        ? { prebidAuction: intent.sources.get('prebid_refresh')?.prebidAuction }
+        : {}),
+      ...(trustedServerEvidence?.serverAuctionTimings !== undefined
+        ? { serverAuctionTimings: trustedServerEvidence.serverAuctionTimings }
+        : {}),
+      ...(serverAuctionTimingOrigin !== undefined ? { serverAuctionTimingOrigin } : {}),
       ...(trustedServerEvidence?.requestedSlotSizes !== undefined
         ? { requestedSlotSizes: trustedServerEvidence.requestedSlotSizes }
         : {}),
@@ -987,10 +1139,7 @@ export class GptDiagnosticsStore {
   private recordRequestIntentSource(
     slot: object,
     source: RequestIntentSource,
-    facts: Pick<
-      PendingSourceEvidence,
-      'trustedServerOpportunity' | 'trustedServerAuctionId' | 'requestedSlotSizes' | 'traceIdentity'
-    > = {}
+    facts: Omit<PendingSourceEvidence, 'observedAtMs'> = {}
   ): void {
     const observedAtMs = this.now();
     let intent = this.pendingRequestIntents.get(slot);
@@ -1005,6 +1154,8 @@ export class GptDiagnosticsStore {
       this.nextRequestIntentId += 1;
       this.pendingRequestIntents.set(slot, intent);
     }
+    // Replace rather than merge: a later bare refresh must not carry an
+    // earlier auction's evidence into the next GPT request.
     intent.sources.set(source, { observedAtMs, ...facts });
   }
 
@@ -1078,6 +1229,17 @@ export class GptDiagnosticsStore {
     return source ?? 'unattributed';
   }
 
+  private auctionType(
+    intent: PendingRequestIntent | undefined,
+    trustedServerEvidence: PendingSourceEvidence | undefined
+  ): GptDiagnosticsAuctionType | undefined {
+    const trustedServerAuction = trustedServerEvidence?.auctionType;
+    const hasClientSideAuction = intent?.sources.get('prebid_refresh')?.prebidAuction !== undefined;
+    if (trustedServerAuction && hasClientSideAuction) return 'competing';
+    if (hasClientSideAuction) return 'client_side';
+    return trustedServerAuction;
+  }
+
   private recordReplacement(record: MutableSlotRecord, cycle: MutableRequestCycle): void {
     const currentIndex = record.requests.indexOf(cycle);
     if (currentIndex <= 0) return;
@@ -1146,13 +1308,15 @@ export class GptDiagnosticsStore {
       }
     }
 
-    const runtimeSlotNumber = this.nextRuntimeSlotNumber;
-    this.nextRuntimeSlotNumber += 1;
+    const runtimeSlotNumber = existingNumber ?? this.nextRuntimeSlotNumber;
+    if (existingNumber === undefined) {
+      this.nextRuntimeSlotNumber += 1;
+      this.slotNumbers.set(slot, runtimeSlotNumber);
+    }
     const record: MutableSlotRecord = {
       runtimeSlotNumber,
       requests: [],
     };
-    this.slotNumbers.set(slot, runtimeSlotNumber);
     this.refreshSlotMetadata(record, slot);
     this.slots.set(runtimeSlotNumber, record);
     this.slotOrder.push(runtimeSlotNumber);
diff --git a/crates/trusted-server-js/lib/src/integrations/lockr/script_guard.ts b/crates/trusted-server-js/lib/src/integrations/lockr/script_guard.ts
index 77a6363677..559a0b8ef4 100644
--- a/crates/trusted-server-js/lib/src/integrations/lockr/script_guard.ts
+++ b/crates/trusted-server-js/lib/src/integrations/lockr/script_guard.ts
@@ -1,4 +1,5 @@
 import { createScriptGuard } from '../../shared/script_guard';
+import { parseSdkNetworkUrl } from '../../shared/sdk_url';
 
 /**
  * Lockr SDK Script Interception Guard
@@ -17,28 +18,18 @@ import { createScriptGuard } from '../../shared/script_guard';
 
 /**
  * Check if a URL is a Lockr SDK URL.
- * Matches the logic from lockr.rs:79-86
+ * Browser/Rust ownership cases live in test/fixtures/sdk-url-ownership.json.
  */
 function isLockrSdkUrl(url: string): boolean {
-  if (!url) return false;
-
-  const lower = url.toLowerCase();
-
-  // Check for aim.loc.kr domain
-  if (lower.includes('aim.loc.kr')) {
-    return true;
-  }
-
-  // Check for identity.loc.kr with identity-lockr and .js extension
-  if (
-    lower.includes('identity.loc.kr') &&
-    lower.includes('identity-lockr') &&
-    lower.endsWith('.js')
-  ) {
-    return true;
-  }
-
-  return false;
+  const parsed = parseSdkNetworkUrl(url);
+  if (!parsed) return false;
+
+  const path = parsed.pathname.toLowerCase();
+  return (
+    (parsed.hostname === 'aim.loc.kr' || parsed.hostname === 'identity.loc.kr') &&
+    path.includes('identity-lockr') &&
+    path.endsWith('.js')
+  );
 }
 
 const guard = createScriptGuard({
diff --git a/crates/trusted-server-js/lib/src/integrations/permutive/script_guard.ts b/crates/trusted-server-js/lib/src/integrations/permutive/script_guard.ts
index 31891db9bb..f9885792a9 100644
--- a/crates/trusted-server-js/lib/src/integrations/permutive/script_guard.ts
+++ b/crates/trusted-server-js/lib/src/integrations/permutive/script_guard.ts
@@ -1,16 +1,20 @@
 import { createScriptGuard } from '../../shared/script_guard';
+import { parseSdkNetworkUrl } from '../../shared/sdk_url';
 
 /**
  * Check if a URL is a Permutive SDK URL.
- * Matches the logic from permutive.rs:97-101
+ * Browser/Rust ownership cases live in test/fixtures/sdk-url-ownership.json.
  */
 function isPermutiveSdkUrl(url: string): boolean {
-  if (!url) return false;
+  const parsed = parseSdkNetworkUrl(url);
+  if (!parsed) return false;
 
-  const lower = url.toLowerCase();
+  const host = parsed.hostname;
+  const edgeSuffix = '.edge.permutive.app';
   return (
-    (lower.includes('.edge.permutive.app') || lower.includes('cdn.permutive.com')) &&
-    lower.endsWith('-web.js')
+    (host === 'cdn.permutive.com' ||
+      (host.endsWith(edgeSuffix) && host.length > edgeSuffix.length)) &&
+    parsed.pathname.toLowerCase().endsWith('-web.js')
   );
 }
 
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/eids.ts b/crates/trusted-server-js/lib/src/integrations/prebid/eids.ts
new file mode 100644
index 0000000000..8e4139fbad
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/eids.ts
@@ -0,0 +1,301 @@
+// Plain-data copies of the EIDs Prebid placed in the `trustedServer` bidder
+// request, and the `ts-eids` cookie value built from them.
+//
+// Pure functions: nothing here reads `pbjs`, the DOM or the clock. The server
+// validates every entry of the body and the cookie alike (spec 4.4), so this
+// module checks nothing beyond what serialization needs.
+
+/** UTF-8 byte budget for the EIDs forwarded in one `/auction` body. */
+export const MAX_AUCTION_EIDS_BYTES = 65_536;
+
+/** Maximum length of the base64 `ts-eids` cookie value. */
+export const MAX_EID_COOKIE_BYTES = 3072;
+
+/** Counts reported by {@link collectBidderEids} for debug logging. */
+export interface EidCollectionStats {
+  /** Entries copied into the result. */
+  forwarded: number;
+  /** Entries dropped because they could not be serialized. */
+  unserializable: number;
+  /** Entries dropped because the byte budget was exhausted. */
+  overBudget: number;
+}
+
+/** A fitted `ts-eids` cookie value and the sources trimming touched. */
+export interface FittedEidCookie {
+  /** Base64 cookie value, or `undefined` when nothing fits. */
+  value: string | undefined;
+  /** Sources removed whole. */
+  droppedSources: string[];
+  /** Sources that lost UIDs but stayed in the cookie. */
+  trimmedSources: string[];
+}
+
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+/**
+ * Returns the arrays Prebid may hold EIDs in, in reading order:
+ * `ortb2.user.ext.eids`, then `ortb2.user.eids`. RTD modules write after
+ * Prebid normalizes first-party data, so `user.eids` can hold entries too.
+ * Prebid redacts both paths for the bidder, so reading both does not widen
+ * what `trustedServer` receives.
+ */
+function bidderEidArrays(bidderRequest: unknown): unknown[][] {
+  if (!isRecord(bidderRequest) || !isRecord(bidderRequest.ortb2)) {
+    return [];
+  }
+  const user = bidderRequest.ortb2.user;
+  if (!isRecord(user)) {
+    return [];
+  }
+  const arrays: unknown[][] = [];
+  if (isRecord(user.ext) && Array.isArray(user.ext.eids)) {
+    arrays.push(user.ext.eids);
+  }
+  if (Array.isArray(user.eids)) {
+    arrays.push(user.eids);
+  }
+  return arrays;
+}
+
+function serializeEntry(entry: unknown): string | undefined {
+  try {
+    // `undefined` and functions serialize to `undefined`; treat them as
+    // unserializable like a circular object or a BigInt.
+    return JSON.stringify(entry);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Copies the EIDs Prebid placed in a `trustedServer` bidder request.
+ *
+ * Reads `ortb2.user.ext.eids` then `ortb2.user.eids`, copies each entry
+ * through a JSON round trip so the result is plain data (`undefined` fields
+ * disappear), drops entries that cannot be serialized, and keeps entries in
+ * order while their serializations total at most
+ * {@link MAX_AUCTION_EIDS_BYTES} UTF-8 bytes, dropping the rest. Entries are
+ * not merged and not validated.
+ *
+ * @param bidderRequest the second `buildRequests` argument
+ * @param stats filled with counts for debug logging, when given
+ * @returns the copied entries, or `undefined` when none remain
+ */
+export function collectBidderEids(
+  bidderRequest: unknown,
+  stats?: EidCollectionStats
+): unknown[] | undefined {
+  const collected: unknown[] = [];
+  let usedBytes = 0;
+  let budgetExhausted = false;
+  let unserializable = 0;
+  let overBudget = 0;
+
+  for (const entries of bidderEidArrays(bidderRequest)) {
+    for (const entry of entries) {
+      const serialized = serializeEntry(entry);
+      if (serialized === undefined) {
+        unserializable += 1;
+        continue;
+      }
+      const bytes = utf8Encoder.encode(serialized).length;
+      if (budgetExhausted || usedBytes + bytes > MAX_AUCTION_EIDS_BYTES) {
+        budgetExhausted = true;
+        overBudget += 1;
+        continue;
+      }
+      usedBytes += bytes;
+      collected.push(JSON.parse(serialized));
+    }
+  }
+
+  if (stats) {
+    stats.forwarded = collected.length;
+    stats.unserializable = unserializable;
+    stats.overBudget = overBudget;
+  }
+  return collected.length > 0 ? collected : undefined;
+}
+
+function withoutEidExt(entry: unknown): unknown {
+  if (!isRecord(entry) || !('ext' in entry)) {
+    return entry;
+  }
+  const copy: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(entry)) {
+    if (key !== 'ext') {
+      copy[key] = value;
+    }
+  }
+  return copy;
+}
+
+/** JSON with object keys sorted at every level, for equality checks. */
+function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(',')}]`;
+  }
+  if (isRecord(value)) {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+      .join(',')}}`;
+  }
+  return JSON.stringify(value) ?? 'null';
+}
+
+function cookieLabel(entry: unknown): string {
+  return isRecord(entry) && typeof entry.source === 'string' ? entry.source : '(malformed entry)';
+}
+
+/** An entry's source lowercased without a trailing dot, or `undefined` when it has none. */
+function normalizedSource(entry: unknown): string | undefined {
+  if (!isRecord(entry) || typeof entry.source !== 'string') {
+    return undefined;
+  }
+  return entry.source.trim().toLowerCase().replace(/\.$/, '');
+}
+
+function isRegistered(entry: unknown, registeredSources: ReadonlySet<string>): boolean {
+  const source = normalizedSource(entry);
+  return source !== undefined && registeredSources.has(source);
+}
+
+function decodeUtf8Base64(value: string): string {
+  return utf8Decoder.decode(Uint8Array.from(atob(value), (char) => char.charCodeAt(0)));
+}
+
+/**
+ * Reads the entries of a `ts-eids` cookie value.
+ *
+ * @param value the base64 cookie value, if any
+ * @returns the decoded entries, or an empty array when the value is absent
+ *   or is not base64 of a JSON array
+ */
+export function decodeEidCookie(value: string | undefined): unknown[] {
+  if (!value) {
+    return [];
+  }
+  try {
+    const parsed: unknown = JSON.parse(decodeUtf8Base64(value));
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Merges a request's EIDs into the entries `ts-eids` already holds, keeping
+ * only `[[ec.partners]]` sources.
+ *
+ * Every registered entry of `current` is kept, in order. A registered entry
+ * of `previous` that has a `uids` array follows them when `current` has no
+ * entry for its source, so a request that lacks a source does not remove it
+ * from the cookie. Unregistered and malformed entries of either set are
+ * dropped. The inputs are not modified.
+ *
+ * @param current the entries forwarded in this request's `/auction` body
+ * @param previous the entries the `ts-eids` cookie holds now
+ * @param registeredSources the `[[ec.partners]]` source domains the server
+ *   injected
+ * @returns the entries to fit into the cookie
+ */
+export function mergeEidCookieEntries(
+  current: readonly unknown[],
+  previous: readonly unknown[],
+  registeredSources: ReadonlySet<string>
+): unknown[] {
+  const merged = current.filter((entry) => isRegistered(entry, registeredSources));
+  const currentSources = new Set(merged.map(normalizedSource));
+  for (const entry of previous) {
+    if (
+      isRegistered(entry, registeredSources) &&
+      isRecord(entry) &&
+      Array.isArray(entry.uids) &&
+      !currentSources.has(normalizedSource(entry))
+    ) {
+      merged.push(entry);
+    }
+  }
+  return merged;
+}
+
+function encodeUtf8Base64(text: string): string {
+  let binary = '';
+  for (const byte of utf8Encoder.encode(text)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+
+/**
+ * Builds the `ts-eids` cookie value from the entries
+ * {@link mergeEidCookieEntries} kept.
+ *
+ * Removes each entry's EID-level `ext`, drops entries that become identical
+ * (compared with sorted keys), then trims from the tail until the standard
+ * padded base64 of the JSON array's UTF-8 bytes is at most
+ * {@link MAX_EID_COOKIE_BYTES} long: drop UIDs from the last entry, then the
+ * entry itself, and repeat. A last entry that is not an object with a `uids`
+ * array is removed whole. A set that fits keeps its order. The input is not
+ * modified.
+ *
+ * @param eids the entries to write
+ * @returns the cookie value, or `undefined` when nothing fits, and the
+ *   sources trimming touched
+ */
+export function fitEidCookie(eids: readonly unknown[]): FittedEidCookie {
+  const seen = new Set<string>();
+  const payload: unknown[] = [];
+  for (const entry of eids) {
+    const stripped = withoutEidExt(entry);
+    const key = canonicalJson(stripped);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    payload.push(
+      isRecord(stripped) && Array.isArray(stripped.uids)
+        ? { ...stripped, uids: [...stripped.uids] }
+        : stripped
+    );
+  }
+
+  const dropped = new Set<string>();
+  const trimmed = new Set<string>();
+  while (payload.length > 0) {
+    const value = encodeUtf8Base64(JSON.stringify(payload));
+    if (value.length <= MAX_EID_COOKIE_BYTES) {
+      return {
+        value,
+        droppedSources: [...dropped],
+        trimmedSources: [...trimmed],
+      };
+    }
+
+    const last = payload[payload.length - 1];
+    if (isRecord(last) && Array.isArray(last.uids) && last.uids.length > 1) {
+      last.uids = last.uids.slice(0, -1);
+      trimmed.add(cookieLabel(last));
+      continue;
+    }
+
+    payload.pop();
+    const label = cookieLabel(last);
+    dropped.add(label);
+    // A source trimmed and then dropped is reported once, as dropped.
+    trimmed.delete(label);
+  }
+
+  return {
+    value: undefined,
+    droppedSources: [...dropped],
+    trimmedSources: [...trimmed],
+  };
+}
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index 288653c1bb..a788f41c38 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -24,27 +24,29 @@ import {
 } from '../../core/first_impression';
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
+import { writeEidsMirror } from '../../core/eids_mirror';
 import { registerApsPrebidRenderer, validateApsRenderer } from '../aps/render';
-import type { AuctionBid, AuctionEid } from '../../core/auction';
+import type { AuctionBid } from '../../core/auction';
 import type { AuctionSlot, TsjsApi } from '../../core/types';
 import { getActiveTraceCollector, prepareTraceAuctionRequest } from '../../trace/runtime';
 import { createTracePending, type TracePendingHandle } from '../../trace/pending';
 
+import {
+  collectBidderEids,
+  decodeEidCookie,
+  fitEidCookie,
+  MAX_EID_COOKIE_BYTES,
+  mergeEidCookieEntries,
+  type EidCollectionStats,
+} from './eids';
 import {
   PREBID_USER_ID_MODULE_REGISTRY,
   userIdConfigNameAliases,
   userIdSubmoduleKey,
 } from './user_id_modules';
 
-/**
- * Prebid.js public API surface (type-only; erased at build time).
- *
- * `getUserIdsAsEids` is added by the userId module at runtime, which the base
- * package typing does not model.
- */
-type PbjsGlobal = typeof _pbjsDefault & {
-  getUserIdsAsEids?: () => unknown[];
-};
+/** Prebid.js public API surface (type-only; erased at build time). */
+type PbjsGlobal = typeof _pbjsDefault;
 
 // Prebid.js itself is NOT bundled into this module. It is served as the
 // external bundle configured via `integrations.prebid.external_bundle_url`
@@ -150,9 +152,6 @@ const APS_BIDDER_CODE = 'aps';
 // both after the registration attempt.
 const APS_RENDERER_FIELD = 'trustedServerRenderer';
 const APS_BID_RESPONSE_LISTENER_SENTINEL = '__tsApsBidResponseListenerInstalled';
-// OpenRTB permits vendor-specific agent types; PAIR uses 571187.
-// Keep this range aligned with the signed 32-bit Rust/OpenRTB representation.
-const MAX_OPENRTB_ATYPE = 2_147_483_647;
 const BIDDER_PARAMS_KEY = 'bidderParams';
 const STORED_REQUEST_KEY = 'storedRequest';
 const ZONE_KEY = 'zone';
@@ -195,6 +194,8 @@ interface InjectedPrebidConfig {
   excludedGamAdUnitPathSuffixes?: string[];
   /** Operator-owned Prebid User ID module entries, forwarded verbatim. */
   managedUserIds?: InjectedManagedUserId[];
+  /** `[[ec.partners]]` source domains, the only sources `ts-eids` keeps. */
+  registeredSources?: string[];
 }
 
 /**
@@ -1016,11 +1017,6 @@ type TrustedServerRequest = {
   tracePending?: TracePendingHandle;
 };
 
-type PrebidUserIdEid = {
-  source?: unknown;
-  uids?: Array<{ id?: unknown; atype?: unknown; ext?: unknown }>;
-};
-
 type RefreshGptSlot = {
   getSlotElementId?: () => string;
   getAdUnitPath?: () => string;
@@ -1080,33 +1076,6 @@ const DEFAULT_REFRESH_SIZES: BannerSize[] = [
   [300, 250],
 ];
 
-function sanitizeAuctionUid(uid: {
-  id?: unknown;
-  atype?: unknown;
-  ext?: unknown;
-}): AuctionEid['uids'][number] | undefined {
-  if (typeof uid?.id !== 'string' || uid.id.length === 0) {
-    return undefined;
-  }
-
-  const sanitizedUid: AuctionEid['uids'][number] = { id: uid.id };
-
-  if (
-    typeof uid.atype === 'number' &&
-    Number.isInteger(uid.atype) &&
-    uid.atype >= 0 &&
-    uid.atype <= MAX_OPENRTB_ATYPE
-  ) {
-    sanitizedUid.atype = uid.atype;
-  }
-
-  if (uid.ext && typeof uid.ext === 'object' && !Array.isArray(uid.ext)) {
-    sanitizedUid.ext = uid.ext as Record<string, unknown>;
-  }
-
-  return sanitizedUid;
-}
-
 function isDefined<T>(value: T | undefined): value is T {
   return value !== undefined;
 }
@@ -1895,31 +1864,6 @@ function removePublisherState(adUnitCode?: string | string[]): void {
   }
 }
 
-function collectAuctionEids(): AuctionEid[] | undefined {
-  if (typeof pbjs.getUserIdsAsEids !== 'function') {
-    return undefined;
-  }
-
-  const rawEids = (pbjs.getUserIdsAsEids() ?? []) as PrebidUserIdEid[];
-  const eids: AuctionEid[] = [];
-
-  for (const eid of rawEids) {
-    if (typeof eid?.source !== 'string' || eid.source.length === 0) {
-      continue;
-    }
-
-    const uids = Array.isArray(eid.uids) ? eid.uids.map(sanitizeAuctionUid).filter(isDefined) : [];
-
-    if (uids.length === 0) {
-      continue;
-    }
-
-    eids.push({ source: eid.source, uids });
-  }
-
-  return eids.length > 0 ? eids : undefined;
-}
-
 /**
  * Install the Prebid integration.
  *
@@ -2410,14 +2354,13 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
       return true; // All requests are valid — orchestrator handles filtering
     },
 
-    buildRequests(validBidRequests: TrustedServerBidRequest[]): TrustedServerRequest {
+    buildRequests(
+      validBidRequests: TrustedServerBidRequest[],
+      bidderRequest?: unknown
+    ): TrustedServerRequest {
       log.debug('[tsjs-prebid] buildRequests', { count: validBidRequests.length });
       const requestScopedBidRequests = [...validBidRequests];
-      const hasUserIdApi = typeof pbjs.getUserIdsAsEids === 'function';
-      const auctionEids = collectAuctionEids();
-      if (hasUserIdApi && !auctionEids) {
-        clearPrebidEidsCookie();
-      }
+      const auctionEids = forwardBidderEids(bidderRequest);
       const payload = buildAdRequest(validBidRequests, { eids: auctionEids });
       const traceCarry = activeTracePending ? prepareTraceAuctionRequest(payload) : undefined;
       let traceHandle: TracePendingHandle | undefined;
@@ -2471,12 +2414,33 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
         /* Optional diagnostic handles cannot interrupt ordinary bid parsing. */
       }
       log.debug('[tsjs-prebid] interpretResponse', { hasSeatbid: !!body?.seatbid });
+      // The mirror is client-only state for page scripts; absent means the
+      // request read no KV and the cookie stays as it is.
+      if (body?.ext?.ts_eids_s !== undefined) {
+        writeEidsMirror(body.ext.ts_eids_s);
+      }
       const auctionBids = parseAuctionResponse(body);
       const bidRequests = request?.tsjsBidRequests ?? request?.bidRequests ?? [];
       return auctionBidsToPrebidBids(auctionBids, bidRequests, apsRendererSupported);
     },
   });
 
+  // Prebid never calls buildRequests for a bidder its TCF rules block, so
+  // without this a ts-eids cookie written before consent changed would live
+  // for its full day. Prebid emits the event at AUCTION_END, before
+  // bidsBackHandler.
+  const prebidEvents = pbjs as unknown as {
+    onEvent?: (event: string, handler: (payload: unknown) => void) => void;
+  };
+  if (typeof prebidEvents.onEvent === 'function') {
+    prebidEvents.onEvent('tcf2Enforcement', (payload) => {
+      if (tcfBlocksTrustedServer(payload)) {
+        clearPrebidEidsCookie();
+        log.debug('[tsjs-prebid] cleared ts-eids: Prebid TCF rules blocked trustedServer');
+      }
+    });
+  }
+
   const originalRequestBids = pbjs.requestBids.bind(pbjs);
 
   // Browser demand ownership is explicit. Only validated auction-plan route
@@ -2623,11 +2587,9 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
       },
     };
 
-    // Chain a bidsBackHandler to collect Prebid User ID Module EIDs
-    // and persist them as a cookie for backend sync.
+    // Chain a bidsBackHandler to register this auction's publisher bids before the publisher's handler runs.
     const originalBidsBack = opts.bidsBackHandler;
     opts.bidsBackHandler = function (...args: unknown[]) {
-      syncPrebidEidsCookie();
       const registrationId = isSyntheticRefresh
         ? undefined
         : registerPendingPublisherBids(publisherAdUnitCodes, args[0], firstImpressionTokens);
@@ -2882,11 +2844,10 @@ export function installRefreshHandler(timeoutMs = 1500): void {
       // slots, and a late callback cannot issue a second GAM request.
       let completed = false;
       let fallbackTimer: ReturnType<typeof setTimeout> | undefined;
-      function completeRefresh(applyTargeting: boolean): void {
+      function completeRefresh(applyTargeting: boolean, completedAuctionId?: string): void {
         if (completed) return;
         completed = true;
         if (fallbackTimer !== undefined) clearTimeout(fallbackTimer);
-
         // The publisher refresh itself started before this asynchronous auction.
         // Reconcile its per-slot token only when the callback is ready to issue
         // GPT: TS may have won an already-overlapping first impression while the
@@ -2921,15 +2882,32 @@ export function installRefreshHandler(timeoutMs = 1500): void {
         const completedAdUnitCodes = refreshAdUnitCodes.filter(
           (_code, index) => !callbackFilteredSlots.has(auctionSlots[index])
         );
-        if (applyTargeting) {
+        const completedAuctionSlots = auctionSlots.filter(
+          (slot) => !callbackFilteredSlots.has(slot)
+        );
+        let targetingApplied = false;
+        if (applyTargeting && typeof pbjs.setTargetingForGPTAsync === 'function') {
           try {
-            pbjs.setTargetingForGPTAsync?.(completedAdUnitCodes);
+            pbjs.setTargetingForGPTAsync(completedAdUnitCodes);
+            targetingApplied = true;
           } catch (error) {
             log.error('[tsjs-prebid] refresh targeting failed', error);
           }
         }
         completedSlots.forEach(consumeGptPublisherRefreshSuppression);
         recordPrebidRefreshForDiagnostics(completedSlots);
+        if (targetingApplied) {
+          try {
+            window.tsjs?.gptDiagnosticsRecorder?.recordCompletedPrebidAuction?.(
+              pbjs,
+              completedAuctionId,
+              completedAuctionSlots,
+              completedAdUnitCodes
+            );
+          } catch {
+            // Auction diagnostics must not suppress the publisher's GAM refresh.
+          }
+        }
         // Preserve the publisher's original refresh form unless one losing
         // first-impression slot was filtered. A delayed bare call must also
         // become explicit so slots added after the auction snapshot cannot join.
@@ -2941,7 +2919,7 @@ export function installRefreshHandler(timeoutMs = 1500): void {
       try {
         pbjs.requestBids({
           adUnits,
-          bidsBackHandler: () => completeRefresh(true),
+          bidsBackHandler: (_bids, _timedOut, auctionId) => completeRefresh(true, auctionId),
           timeout: timeoutMs,
         });
         // A one-shot watchdog completes the GAM request even if Prebid never
@@ -2960,103 +2938,80 @@ export function installRefreshHandler(timeoutMs = 1500): void {
   });
 }
 
-/**
- * Configure identity sync behavior for the generated Prebid User ID modules.
- *
- * The external bundle generator statically imports the selected modules into
- * its generated entry. This post-window-load configuration controls when
- * those modules synchronize identities; it does not select or register modules.
- */
-export function installUserIdModules(): void {
-  try {
-    pbjs.setConfig({
-      userSync: {
-        syncEnabled: true,
-        filterSettings: {
-          all: { bidders: '*', filter: 'include' },
-        },
-        auctionDelay: 0,
-        syncsPerBidder: 5,
-        syncDelay: 3000,
-      },
-    });
-    log.info('[tsjs-prebid] userID modules configured');
-  } catch {
-    // pbjs not ready — userID modules will use defaults
-  }
-}
-
 // ---------------------------------------------------------------------------
-// Prebid EID cookie sync
+// Prebid EID forwarding and the ts-eids cookie
 // ---------------------------------------------------------------------------
 
-/** Maximum cookie payload size in bytes (leave room for other cookies). */
-const MAX_EID_COOKIE_BYTES = 3072;
-
 /** Cookie name for persisted Prebid EIDs. */
 const EID_COOKIE_NAME = 'ts-eids';
 
 /** Cookie max-age in seconds (1 day). */
 const EID_COOKIE_MAX_AGE = 86400;
 
-/** Clears any previously persisted Prebid EIDs cookie. */
-function clearPrebidEidsCookie(): void {
-  document.cookie = `${EID_COOKIE_NAME}=; Path=/; Secure; SameSite=Lax; Max-Age=0`;
-}
+/** What `buildRequests` did with `ts-eids`, for debug logs. */
+type EidCookieDecision = 'written' | 'trimmed' | 'cleared' | 'cleared: no consent';
 
 /**
- * Trims an EID payload so its base64-encoded cookie fits `MAX_EID_COOKIE_BYTES`,
- * dropping UIDs then whole sources from the tail. `/auction` requests still
- * forward the untrimmed set in the request body (see `buildAdRequest`); this
- * cap only bounds what the `ts-eids` cookie carries for routes without a body
- * (e.g. `GET /_ts/page-bids`) and for backend ingestion at response finalize.
+ * Whether the consent Prebid attached to this bidder request permits storing
+ * `ts-eids`.
+ *
+ * Where GDPR applies, writing the cookie needs TCF Purpose 1 (store and/or
+ * access information on a device) and Purpose 4 (personalized ads), the rule
+ * the server applies before it uses or stores these EIDs
+ * (`allows_eid_persistence`). A cookie written on Purpose 1 alone would hold
+ * IDs no server path reads. Prebid lets `trustedServer` see `ortb2` EIDs on
+ * any purpose from 2 to 10, so forwarding them does not establish either.
+ * GDPR data without a TCF purpose record fails closed. Without GDPR data, or
+ * with `gdprApplies: false`, nothing restricts the write.
  */
-function fitAuctionEidsToCookie(eids: AuctionEid[]): AuctionEid[] | undefined {
-  const payload = eids.map((eid) => ({ source: eid.source, uids: [...eid.uids] }));
-  const droppedSources = new Set<string>();
-  const trimmedSources = new Set<string>();
-
-  while (payload.length > 0) {
-    const encoded = btoa(JSON.stringify(payload));
-    if (encoded.length <= MAX_EID_COOKIE_BYTES) {
-      logTrimmedEidSources(droppedSources, trimmedSources);
-      return payload;
-    }
-
-    const last = payload[payload.length - 1];
-    if (last && last.uids.length > 1) {
-      last.uids = last.uids.slice(0, last.uids.length - 1);
-      trimmedSources.add(last.source);
-      continue;
-    }
+function hasEidPersistenceConsent(bidderRequest: object): boolean {
+  const { gdprConsent } = bidderRequest as { gdprConsent?: unknown };
+  if (!isRecord(gdprConsent) || gdprConsent.gdprApplies !== true) {
+    return true;
+  }
+  const { vendorData } = gdprConsent;
+  if (!isRecord(vendorData) || !isRecord(vendorData.purpose)) {
+    return false;
+  }
+  const { consents } = vendorData.purpose;
+  return isRecord(consents) && consents[1] === true && consents[4] === true;
+}
 
-    const dropped = payload.pop();
-    if (dropped) {
-      droppedSources.add(dropped.source);
-      // A source trimmed and then dropped is reported once, as dropped.
-      trimmedSources.delete(dropped.source);
+/** The current `ts-eids` cookie value, if any. */
+function readPrebidEidsCookie(): string | undefined {
+  for (const part of document.cookie.split(';')) {
+    const [name, ...value] = part.trim().split('=');
+    if (name === EID_COOKIE_NAME) {
+      return value.join('=') || undefined;
     }
   }
-
-  logTrimmedEidSources(droppedSources, trimmedSources);
   return undefined;
 }
 
+/** Clears any previously persisted Prebid EIDs cookie. */
+function clearPrebidEidsCookie(): void {
+  try {
+    document.cookie = `${EID_COOKIE_NAME}=; Path=/; Secure; SameSite=Lax; Max-Age=0`;
+  } catch {
+    log.warn('[tsjs-prebid] failed to clear the ts-eids cookie');
+  }
+}
+
 /**
- * Logs which EID sources `fitAuctionEidsToCookie` had to drop or trim UIDs
- * from, if any. Debug level: `/auction` sends the untrimmed set in the request
- * body, so a trimmed cookie is expected steady state rather than a warning.
+ * Logs which EID sources the cookie had to drop or trim UIDs from, if any.
+ * Debug level: `/auction` sends the untrimmed set in the request body, so a
+ * trimmed cookie is expected steady state rather than a warning.
  */
-function logTrimmedEidSources(droppedSources: Set<string>, trimmedSources: Set<string>): void {
-  if (droppedSources.size === 0 && trimmedSources.size === 0) {
+function logTrimmedEidSources(droppedSources: string[], trimmedSources: string[]): void {
+  if (droppedSources.length === 0 && trimmedSources.length === 0) {
     return;
   }
   const parts: string[] = [];
-  if (droppedSources.size > 0) {
-    parts.push(`dropped sources: ${[...droppedSources].join(', ')}`);
+  if (droppedSources.length > 0) {
+    parts.push(`dropped sources: ${droppedSources.join(', ')}`);
   }
-  if (trimmedSources.size > 0) {
-    parts.push(`trimmed uids from sources: ${[...trimmedSources].join(', ')}`);
+  if (trimmedSources.length > 0) {
+    parts.push(`trimmed uids from sources: ${trimmedSources.join(', ')}`);
   }
   log.debug(
     `[tsjs-prebid] ts-eids cookie exceeded ${MAX_EID_COOKIE_BYTES} bytes; ${parts.join('; ')}`
@@ -3064,37 +3019,87 @@ function logTrimmedEidSources(droppedSources: Set<string>, trimmedSources: Set<s
 }
 
 /**
- * Collects EIDs from Prebid's User ID Module and writes them as a
- * base64-encoded OpenRTB-style JSON cookie (`ts-eids`) for backend ingestion
- * and auction fallback on later requests.
+ * Merges the EIDs of the `trustedServer` request being built into `ts-eids`:
+ * only `[[ec.partners]]` sources, this request's entries replacing the
+ * cookie's for the same source and the cookie's other sources kept, without
+ * EID-level `ext` and fitted to the cookie size cap. Clears the cookie when
+ * nothing remains or encoding fails.
  */
-function syncPrebidEidsCookie(): void {
+function writePrebidEidsCookie(eids: readonly unknown[]): EidCookieDecision {
   try {
-    if (typeof pbjs.getUserIdsAsEids !== 'function') {
-      // Without Prebid EIDs to forward, stale auction fallback IDs must not persist.
-      clearPrebidEidsCookie();
-      return;
-    }
-
-    const eids = collectAuctionEids();
-    if (!eids) {
+    const merged = mergeEidCookieEntries(
+      eids,
+      decodeEidCookie(readPrebidEidsCookie()),
+      new Set(getInjectedConfig()?.registeredSources ?? [])
+    );
+    const fitted = fitEidCookie(merged);
+    logTrimmedEidSources(fitted.droppedSources, fitted.trimmedSources);
+    if (fitted.value === undefined) {
       clearPrebidEidsCookie();
-      return;
+      return 'cleared';
     }
+    document.cookie = `${EID_COOKIE_NAME}=${fitted.value}; Path=/; Secure; SameSite=Lax; Max-Age=${EID_COOKIE_MAX_AGE}`;
+    return fitted.droppedSources.length > 0 || fitted.trimmedSources.length > 0
+      ? 'trimmed'
+      : 'written';
+  } catch {
+    log.warn('[tsjs-prebid] failed to write the ts-eids cookie; clearing it');
+    clearPrebidEidsCookie();
+    return 'cleared';
+  }
+}
 
-    const payload = fitAuctionEidsToCookie(eids);
-    if (!payload) {
-      clearPrebidEidsCookie();
-      return;
-    }
+/**
+ * Collects the EIDs Prebid placed in this `trustedServer` bidder request and
+ * merges them into `ts-eids` synchronously, before Prebid sends the request.
+ * A request without EIDs leaves the cookie's registered sources in place.
+ * Without persistence consent the EIDs are still forwarded and `ts-eids`
+ * is cleared instead; a TCF block also clears it (`tcf2Enforcement`).
+ *
+ * `bidderRequest.ortb2` is what Prebid lets `trustedServer` see: global
+ * first-party data merged with its own bidder fragment, IDs restricted to
+ * other bidders excluded, activity controls applied. Nothing else is read:
+ * not `getUserIdsAsEids()`, not the `ortb2` config, not `auctionId`.
+ */
+function forwardBidderEids(bidderRequest: unknown): unknown[] | undefined {
+  if (bidderRequest === null || typeof bidderRequest !== 'object') {
+    log.debug(
+      '[tsjs-prebid] buildRequests got no bidder request; sending no EIDs and leaving ts-eids unchanged'
+    );
+    return undefined;
+  }
 
-    const encoded = btoa(JSON.stringify(payload));
-    document.cookie = `${EID_COOKIE_NAME}=${encoded}; Path=/; Secure; SameSite=Lax; Max-Age=${EID_COOKIE_MAX_AGE}`;
+  const stats: EidCollectionStats = {
+    forwarded: 0,
+    unserializable: 0,
+    overBudget: 0,
+  };
+  const eids = collectBidderEids(bidderRequest, stats);
+  let cookie: EidCookieDecision;
+  if (!hasEidPersistenceConsent(bidderRequest)) {
+    // Forwarding still follows Prebid's transmit decision; only the copy that
+    // outlives the page needs persistence consent.
+    clearPrebidEidsCookie();
+    cookie = 'cleared: no consent';
+  } else {
+    cookie = writePrebidEidsCookie(eids ?? []);
+  }
+  log.debug('[tsjs-prebid] forwarding bidder EIDs', { ...stats, cookie });
+  return eids;
+}
 
-    log.debug(`[tsjs-prebid] synced ${payload.length} EID sources to cookie`);
-  } catch (err) {
-    log.warn('[tsjs-prebid] failed to sync EIDs cookie', err);
+/** Whether a `tcf2Enforcement` payload says Prebid blocked `trustedServer` or its EIDs. */
+function tcfBlocksTrustedServer(payload: unknown): boolean {
+  if (payload === null || typeof payload !== 'object') {
+    return false;
   }
+  const { biddersBlocked, eidsBlocked } = payload as {
+    biddersBlocked?: unknown;
+    eidsBlocked?: unknown;
+  };
+  return [biddersBlocked, eidsBlocked].some(
+    (blocked) => Array.isArray(blocked) && blocked.includes(ADAPTER_CODE)
+  );
 }
 
 // Self-initialize when loaded in a browser (same pattern as other integrations).
@@ -3106,21 +3111,10 @@ if (typeof window !== 'undefined') {
   // fail to run the replacement auction — leave GPT untouched instead.
   if (hasPrebidJsApi()) {
     installRefreshHandler();
-    // The slim-Prebid lazy loader appends this bundle from a window.load
-    // handler, so `load` may already have fired by the time this code runs —
-    // waiting for it again would skip user ID setup entirely on that path.
-    if (document.readyState === 'complete') {
-      installUserIdModules();
-    } else {
-      window.addEventListener(
-        'load',
-        () => {
-          installUserIdModules();
-        },
-        { once: true }
-      );
-    }
   }
+  // TS writes no userSync values beyond managed userIds (and autoRefresh on a
+  // late seed), so the publisher's or Prebid's auctionDelay applies from the
+  // first auction.
 }
 
 export { pbjs };
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json b/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json
index 38061761d3..32f2db4b1d 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json
@@ -13,75 +13,48 @@
   "modules": [
     {
       "moduleName": "connectIdSystem",
-      "configNames": ["connectId"],
-      "eidSources": ["yahoo.com"]
+      "configNames": ["connectId"]
     },
     {
       "moduleName": "criteoIdSystem",
-      "configNames": ["criteo"],
-      "eidSources": ["criteo.com"]
+      "configNames": ["criteo"]
     },
     {
       "moduleName": "id5IdSystem",
-      "configNames": ["id5Id"],
-      "eidSources": ["id5-sync.com"]
+      "configNames": ["id5Id"]
     },
     {
       "moduleName": "identityLinkIdSystem",
-      "configNames": ["identityLink"],
-      "eidSources": ["liveramp.com"]
+      "configNames": ["identityLink"]
     },
     {
       "moduleName": "liveIntentIdSystem",
       "configNames": ["liveIntentId"],
-      "eidSources": [
-        "liveintent.com",
-        "bidswitch.net",
-        "liveintent.triplelift.com",
-        "rubiconproject.com",
-        "liveintent.indexexchange.com",
-        "openx.net",
-        "pubmatic.com",
-        "liveintent.sovrn.com",
-        "liveintent.unrulymedia.com",
-        "media.net",
-        "zeta-ssp.liveintent.com",
-        "fpid.liveintent.com",
-        "sharethrough.com",
-        "liveintent.sonobi.com",
-        "liveintent.vidazoo.com"
-      ],
       "notes": "Imported through a local ESM shim because the public Prebid wrapper contains CommonJS require()."
     },
     {
       "moduleName": "lockrAIMIdSystem",
-      "configNames": ["lockrAIMId"],
-      "eidSources": []
+      "configNames": ["lockrAIMId"]
     },
     {
       "moduleName": "pairIdSystem",
-      "configNames": ["pairId"],
-      "eidSources": ["google.com"]
+      "configNames": ["pairId"]
     },
     {
       "moduleName": "pubProvidedIdSystem",
-      "configNames": ["pubProvidedId"],
-      "eidSources": []
+      "configNames": ["pubProvidedId"]
     },
     {
       "moduleName": "sharedIdSystem",
-      "configNames": ["sharedId", "pubCommonId"],
-      "eidSources": ["pubcid.org"]
+      "configNames": ["sharedId", "pubCommonId"]
     },
     {
       "moduleName": "uid2IdSystem",
-      "configNames": ["uid2"],
-      "eidSources": ["uidapi.com"]
+      "configNames": ["uid2"]
     },
     {
       "moduleName": "unifiedIdSystem",
-      "configNames": ["unifiedId"],
-      "eidSources": ["adserver.org"]
+      "configNames": ["unifiedId"]
     }
   ]
 }
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts b/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts
index b463e22026..40da6b36aa 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts
@@ -3,7 +3,6 @@ import registryJson from './user_id_modules.json';
 export interface PrebidUserIdModuleRegistryEntry {
   moduleName: string;
   configNames: string[];
-  eidSources: string[];
   notes?: string;
 }
 
@@ -12,54 +11,10 @@ interface PrebidUserIdModuleRegistryFile {
   modules: PrebidUserIdModuleRegistryEntry[];
 }
 
-export interface PrebidUserIdEidLike {
-  source?: unknown;
-  uids?: Array<{ id?: unknown; atype?: unknown; ext?: unknown }>;
-}
-
-export interface PrebidUserIdModuleResolution {
-  modules: string[];
-  missingSources: string[];
-}
-
 const registry = registryJson as PrebidUserIdModuleRegistryFile;
 
-const DEFAULT_PREBID_USER_ID_MODULES = [...registry.defaultPreset];
 export const PREBID_USER_ID_MODULE_REGISTRY = [...registry.modules];
 
-const MODULE_SORT_ORDER = new Map(
-  ['userId', ...DEFAULT_PREBID_USER_ID_MODULES].map((moduleName, index) => [moduleName, index])
-);
-
-function stableModuleSort(a: string, b: string): number {
-  return (
-    (MODULE_SORT_ORDER.get(a) ?? Number.MAX_SAFE_INTEGER) -
-      (MODULE_SORT_ORDER.get(b) ?? Number.MAX_SAFE_INTEGER) || a.localeCompare(b)
-  );
-}
-
-function normalizeSource(source: unknown): string | undefined {
-  if (typeof source !== 'string') {
-    return undefined;
-  }
-  const normalized = source.trim().toLowerCase();
-  return normalized.length > 0 ? normalized : undefined;
-}
-
-function hasLiveIntentProvider(eid: PrebidUserIdEidLike): boolean {
-  return Array.isArray(eid.uids)
-    ? eid.uids.some((uid) => {
-        const ext = uid.ext;
-        return (
-          ext !== null &&
-          typeof ext === 'object' &&
-          !Array.isArray(ext) &&
-          (ext as Record<string, unknown>).provider === 'liveintent.com'
-        );
-      })
-    : false;
-}
-
 export function knownUserIdConfigNames(): string[] {
   return [...new Set(PREBID_USER_ID_MODULE_REGISTRY.flatMap((entry) => entry.configNames))].sort();
 }
@@ -100,46 +55,3 @@ export function userIdConfigNameAliases(configName: string): string[] {
 export function userIdSubmoduleKey(configName: string): string {
   return findUserIdModuleEntry(configName)?.moduleName ?? configName.toLowerCase();
 }
-
-export function resolvePrebidUserIdModulesFromEids(
-  eids: PrebidUserIdEidLike[]
-): PrebidUserIdModuleResolution {
-  const modules = new Set<string>();
-  const missingSources = new Set<string>();
-  const modulesBySource = new Map<string, string>();
-
-  for (const entry of PREBID_USER_ID_MODULE_REGISTRY) {
-    for (const source of entry.eidSources) {
-      modulesBySource.set(source.toLowerCase(), entry.moduleName);
-    }
-  }
-
-  for (const eid of eids) {
-    const source = normalizeSource(eid.source);
-    if (!source) {
-      continue;
-    }
-
-    const moduleName = modulesBySource.get(source);
-    if (moduleName) {
-      modules.add(moduleName);
-      continue;
-    }
-
-    if (hasLiveIntentProvider(eid)) {
-      modules.add('liveIntentIdSystem');
-      continue;
-    }
-
-    missingSources.add(source);
-  }
-
-  if (modules.size > 0) {
-    modules.add('userId');
-  }
-
-  return {
-    modules: [...modules].sort(stableModuleSort),
-    missingSources: [...missingSources].sort(),
-  };
-}
diff --git a/crates/trusted-server-js/lib/src/shared/sdk_url.ts b/crates/trusted-server-js/lib/src/shared/sdk_url.ts
new file mode 100644
index 0000000000..ab6fc04237
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/shared/sdk_url.ts
@@ -0,0 +1,20 @@
+/**
+ * Parse an HTTP(S) SDK URL with an explicit authority, or a protocol-relative URL.
+ *
+ * Uses the same C0/space, tab/CR/LF, and authority policy as Rust's SDK URL parser.
+ * Literal NULs, relative paths, and base-dependent shorthand stay unowned.
+ * Browser/Rust ownership cases live in test/fixtures/sdk-url-ownership.json.
+ */
+export function parseSdkNetworkUrl(url: string): URL | null {
+  // HTML replaces NULs rather than treating them as URL whitespace.
+  if (url.includes('\0')) return null;
+  // eslint-disable-next-line no-control-regex -- Match WHATWG C0 control and space trimming.
+  const value = url.replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, '').replace(/[\t\n\r]/g, '');
+  if (!/^(?:https?:)?[/\\]{2}/i.test(value)) return null;
+
+  try {
+    return new URL(/^[/\\]{2}/.test(value) ? `https:${value}` : value);
+  } catch {
+    return null;
+  }
+}
diff --git a/crates/trusted-server-js/lib/src/trace/projection.ts b/crates/trusted-server-js/lib/src/trace/projection.ts
index 862973d359..85b77b212f 100644
--- a/crates/trusted-server-js/lib/src/trace/projection.ts
+++ b/crates/trusted-server-js/lib/src/trace/projection.ts
@@ -86,7 +86,17 @@ function cycleProjection(value: unknown, omissions: { value: number }): Record<s
   const source = sourceObject(
     value,
     ['requestNumber', 'durations', 'incompleteSequence'],
-    [...TRACE_CYCLE_KEYS, 'adManager', 'previousCreativeId']
+    [
+      ...TRACE_CYCLE_KEYS,
+      'adManager',
+      'previousCreativeId',
+      // GPT-only auction evidence is recognized but excluded from the v1 mobile report.
+      'auctionType',
+      'auctionWinner',
+      'prebidAuction',
+      'serverAuctionTimings',
+      'serverAuctionTimingOrigin',
+    ]
   );
   const output: Record<string, unknown> = {
     requestNumber: data(source, 'requestNumber'),
diff --git a/crates/trusted-server-js/lib/test/core/eids_mirror.test.ts b/crates/trusted-server-js/lib/test/core/eids_mirror.test.ts
new file mode 100644
index 0000000000..3f64bbf822
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/core/eids_mirror.test.ts
@@ -0,0 +1,81 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { writeEidsMirror } from '../../src/core/eids_mirror';
+
+const NAME = '__Host-ts-eids-s';
+
+describe('core/eids_mirror', () => {
+  let writes: string[];
+  let stored: string;
+
+  beforeEach(() => {
+    writes = [];
+    stored = '';
+    Object.defineProperty(document, 'cookie', {
+      configurable: true,
+      get: () => stored,
+      set: (assignment: string) => {
+        writes.push(assignment);
+      },
+    });
+  });
+
+  afterEach(() => {
+    delete (document as unknown as { cookie?: string }).cookie;
+    vi.restoreAllMocks();
+  });
+
+  it('writes the value with the given Max-Age and the __Host- attributes', () => {
+    writeEidsMirror({ value: 'eyJ2IjoxfQ', max_age: 600 });
+
+    expect(writes).toEqual([`${NAME}=eyJ2IjoxfQ; Path=/; Secure; SameSite=Lax; Max-Age=600`]);
+  });
+
+  it('skips the write when the cookie already holds that value', () => {
+    stored = `other=1; ${NAME}=eyJ2IjoxfQ; ts-eids=abc`;
+
+    writeEidsMirror({ value: 'eyJ2IjoxfQ', max_age: 600 });
+
+    expect(writes).toEqual([]);
+  });
+
+  it('rewrites when the stored value differs', () => {
+    stored = `${NAME}=old`;
+
+    writeEidsMirror({ value: 'new', max_age: 60 });
+
+    expect(writes).toHaveLength(1);
+  });
+
+  it('expires the cookie on clear', () => {
+    writeEidsMirror({ clear: true });
+
+    expect(writes).toEqual([`${NAME}=; Path=/; Secure; SameSite=Lax; Max-Age=0`]);
+  });
+
+  it.each([
+    ['absent', undefined],
+    ['null', null],
+    ['a string', 'eyJ2IjoxfQ'],
+    ['an empty object', {}],
+    ['a clear that is not true', { clear: 'yes' }],
+    ['a value without max_age', { value: 'abc' }],
+    ['a non-numeric max_age', { value: 'abc', max_age: '60' }],
+    ['a negative max_age', { value: 'abc', max_age: -1 }],
+    ['a value with cookie separators', { value: 'a; Domain=example.com', max_age: 60 }],
+    ['an empty value', { value: '', max_age: 60 }],
+  ])('does nothing for %s', (_label, payload) => {
+    writeEidsMirror(payload);
+
+    expect(writes).toEqual([]);
+  });
+
+  it('never touches ts-eids', () => {
+    stored = 'ts-eids=abc';
+
+    writeEidsMirror({ value: 'abc', max_age: 60 });
+    writeEidsMirror({ clear: true });
+
+    expect(writes.every((write) => write.startsWith(`${NAME}=`))).toBe(true);
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/core/request.test.ts b/crates/trusted-server-js/lib/test/core/request.test.ts
index e88ed520cd..ee33130af3 100644
--- a/crates/trusted-server-js/lib/test/core/request.test.ts
+++ b/crates/trusted-server-js/lib/test/core/request.test.ts
@@ -25,6 +25,36 @@ describe('request.requestAds', () => {
     vi.restoreAllMocks();
   });
 
+  it('sends no eids in the /auction body', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({ seatbid: [] }),
+    });
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+
+    requestAds();
+    await flushRequestAds();
+
+    const [, init] = (globalThis.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [
+      string,
+      RequestInit,
+    ];
+    const body = JSON.parse(String(init.body)) as Record<string, unknown>;
+    expect(body.adUnits, 'the body should carry the ad unit').toEqual([
+      {
+        code: 'slot1',
+        mediaTypes: { banner: { sizes: [[300, 250]] } },
+        bids: [],
+      },
+    ]);
+    expect(body, 'requestAds should leave EIDs to the ts-eids cookie').not.toHaveProperty('eids');
+  });
+
   it('sends fetch and renders creatives via iframe from response', async () => {
     // mock fetch - returns creative HTML inline in adm field
     const creativeHtml = '<div>Test Creative</div>';
diff --git a/crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt b/crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt
new file mode 100644
index 0000000000..cec8a54bc9
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt
@@ -0,0 +1 @@
+{"adUnits":[{"code":"div-gpt-1","mediaTypes":{"banner":{"sizes":[[300,250]]}},"bids":[{"bidder":"trustedServer","params":{}}]}],"eids":[{"source":"first.example.com","inserter":"inserter-€.example.com","matcher":"first.example.com","mm":3,"uids":[{"id":"first-uid","atype":1,"ext":{"label":"日本"}}]},{"source":"bad.example.com","uids":[{"id":"bad-\ud800-uid","atype":1}]},{"source":"last.example.com","ext":{"segments":["s1"]},"uids":[{"id":"last-uid","atype":3}]}]}
\ No newline at end of file
diff --git a/crates/trusted-server-js/lib/test/fixtures/eid-fixture-input.ts b/crates/trusted-server-js/lib/test/fixtures/eid-fixture-input.ts
new file mode 100644
index 0000000000..6c905a568e
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/eid-fixture-input.ts
@@ -0,0 +1,23 @@
+/**
+ * The fixed input behind `auction-body-eids.txt` and `ts-eids-cookie.txt`
+ * (spec 7.1 rule 8). The middle entry's UID `id` holds a lone UTF-16
+ * surrogate, which `JSON.stringify` writes as the escape `\ud800` and the
+ * server drops for that entry only. The first entry has non-Latin-1 text in
+ * `inserter` and in a UID `ext`. The last has an EID-level `ext`, which the
+ * cookie omits. Key order matters: the fixtures are exact bytes.
+ */
+export const FIXTURE_EIDS = [
+  {
+    source: 'first.example.com',
+    inserter: 'inserter-€.example.com',
+    matcher: 'first.example.com',
+    mm: 3,
+    uids: [{ id: 'first-uid', atype: 1, ext: { label: '日本' } }],
+  },
+  { source: 'bad.example.com', uids: [{ id: 'bad-\ud800-uid', atype: 1 }] },
+  {
+    source: 'last.example.com',
+    ext: { segments: ['s1'] },
+    uids: [{ id: 'last-uid', atype: 3 }],
+  },
+];
diff --git a/crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json b/crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json
new file mode 100644
index 0000000000..d7f7545a37
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json
@@ -0,0 +1,537 @@
+[
+  {
+    "name": "Lockr aim SDK",
+    "url": "https://aim.loc.kr/identity-lockr-trust-server.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr identity SDK",
+    "url": "https://identity.loc.kr/identity-lockr-v2.0.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr aim query",
+    "url": "https://aim.loc.kr/identity-lockr-trust-server.js?v=2",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr identity query",
+    "url": "https://identity.loc.kr/identity-lockr.js?v=2",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr aim fragment",
+    "url": "https://aim.loc.kr/identity-lockr.js#sdk",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr identity fragment",
+    "url": "https://identity.loc.kr/identity-lockr.js#sdk",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr protocol relative",
+    "url": "//aim.loc.kr/identity-lockr.js?v=2#sdk",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr identity protocol relative",
+    "url": "//identity.loc.kr/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr uppercase",
+    "url": "HTTPS://AIM.LOC.KR/IDENTITY-LOCKR.JS",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr HTTP port",
+    "url": "http://identity.loc.kr:8080/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr ASCII whitespace",
+    "url": " \t\r\n\f\u000bhttps://aim.loc.kr/identity-lockr.js \t\r\n\f\u000b",
+    "owner": "lockr"
+  },
+  {
+    "name": "Lockr nested path family",
+    "url": "https://aim.loc.kr/sdk/identity-lockr-v3.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive CDN SDK",
+    "url": "https://cdn.permutive.com/abc123-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive edge SDK",
+    "url": "https://example.edge.permutive.app/workspace-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive CDN query",
+    "url": "https://cdn.permutive.com/abc123-web.js?v=2",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive edge query",
+    "url": "https://example.edge.permutive.app/workspace-web.js?v=2",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive CDN fragment",
+    "url": "https://cdn.permutive.com/abc123-web.js#sdk",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive edge fragment",
+    "url": "https://example.edge.permutive.app/workspace-web.js#sdk",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive protocol relative",
+    "url": "//cdn.permutive.com/abc123-web.js?v=2#sdk",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive edge protocol relative",
+    "url": "//example.edge.permutive.app/workspace-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive uppercase",
+    "url": "HTTPS://EXAMPLE.EDGE.PERMUTIVE.APP/ABC-WEB.JS",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive HTTP port",
+    "url": "http://cdn.permutive.com:8080/abc123-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive ASCII whitespace",
+    "url": " \t\r\n\f\u000b//cdn.permutive.com/abc123-web.js \t\r\n\f\u000b",
+    "owner": "permutive"
+  },
+  {
+    "name": "GPT canonical",
+    "url": "https://securepubads.g.doubleclick.net/tag/js/gpt.js",
+    "owner": "gpt"
+  },
+  {
+    "name": "GTM canonical",
+    "url": "https://www.googletagmanager.com/gtm.js?id=GTM-TEST",
+    "owner": "google_tag_manager"
+  },
+  {
+    "name": "DataDome canonical",
+    "url": "https://js.datadome.co/tags.js",
+    "owner": "datadome"
+  },
+  {
+    "name": "Sourcepoint canonical",
+    "url": "https://cdn.privacy-mgmt.com/unified/wrapperMessagingWithoutDetection.js",
+    "owner": "sourcepoint"
+  },
+  {
+    "name": "GPT query mentions Lockr",
+    "url": "https://securepubads.g.doubleclick.net/tag/js/gpt.js?ref=aim.loc.kr",
+    "owner": "gpt"
+  },
+  {
+    "name": "GTM query mentions Lockr",
+    "url": "https://www.googletagmanager.com/gtm.js?id=GTM-TEST&ref=aim.loc.kr",
+    "owner": "google_tag_manager"
+  },
+  {
+    "name": "DataDome query mentions Lockr",
+    "url": "https://js.datadome.co/tags.js?ref=aim.loc.kr",
+    "owner": "datadome"
+  },
+  {
+    "name": "Sourcepoint query mentions Lockr",
+    "url": "https://cdn.privacy-mgmt.com/wrapper.js?ref=aim.loc.kr",
+    "owner": "sourcepoint"
+  },
+  {
+    "name": "GPT path mentions Permutive",
+    "url": "https://securepubads.g.doubleclick.net/cdn.permutive.com/app-web.js",
+    "owner": "gpt"
+  },
+  {
+    "name": "GTM query mentions Permutive",
+    "url": "https://www.googletagmanager.com/gtm.js?id=GTM-TEST&ref=cdn.permutive.com/app-web.js",
+    "owner": "google_tag_manager"
+  },
+  {
+    "name": "DataDome path mentions Permutive",
+    "url": "https://js.datadome.co/cdn.permutive.com/app-web.js",
+    "owner": "datadome"
+  },
+  {
+    "name": "Sourcepoint path mentions Permutive",
+    "url": "https://cdn.privacy-mgmt.com/cdn.permutive.com/app-web.js",
+    "owner": "sourcepoint"
+  },
+  {
+    "name": "loader query mentions Lockr",
+    "url": "https://ads.example.com/loader.js?page=https%3A%2F%2Fpublisher.example.com%2F%3Futm_source%3Daim.loc.kr",
+    "owner": null
+  },
+  {
+    "name": "Lockr prefix host",
+    "url": "https://aim.loc.kr.example.com/loader.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr SDK prefix host",
+    "url": "https://aim.loc.kr.example.com/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr identity lookalike",
+    "url": "https://identity.loc.kr.example.com/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr host substring",
+    "url": "https://notaim.loc.kr.example.com/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr host in path",
+    "url": "https://static.example.com/aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr host in query",
+    "url": "https://static.example.com/identity-lockr.js?ref=aim.loc.kr",
+    "owner": null
+  },
+  {
+    "name": "Lockr other script",
+    "url": "https://aim.loc.kr/some-other-script.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr other identity script",
+    "url": "https://identity.loc.kr/some-other-script.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr wrong extension",
+    "url": "https://aim.loc.kr/identity-lockr.css",
+    "owner": null
+  },
+  {
+    "name": "Lockr query spoofs extension",
+    "url": "https://identity.loc.kr/identity-lockr.css?fake=.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr query spoofs SDK name",
+    "url": "https://identity.loc.kr/loader.js?file=identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr trailing path",
+    "url": "https://aim.loc.kr/identity-lockr.js/other",
+    "owner": null
+  },
+  {
+    "name": "Lockr userinfo lookalike",
+    "url": "https://aim.loc.kr@static.example.com/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr trailing dot",
+    "url": "https://aim.loc.kr./identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr encoded SDK path",
+    "url": "https://aim.loc.kr/%69dentity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr encoded extension",
+    "url": "https://aim.loc.kr/identity-lockr%2ejs",
+    "owner": null
+  },
+  {
+    "name": "Permutive prefix host",
+    "url": "https://cdn.permutive.com.example.com/abc123-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive host substring",
+    "url": "https://notcdn.permutive.com.example.com/abc123-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive host in path",
+    "url": "https://static.example.com/mirror/cdn.permutive.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive edge lookalike",
+    "url": "https://example.edge.permutive.app.example.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive edge in path",
+    "url": "https://static.example.com/example.edge.permutive.app/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive bare edge host",
+    "url": "https://edge.permutive.app/abc123-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive empty edge subdomain",
+    "url": "https://.edge.permutive.app/abc123-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive other script",
+    "url": "https://cdn.permutive.com/other.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive edge other script",
+    "url": "https://example.edge.permutive.app/other.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive query spoofs extension",
+    "url": "https://cdn.permutive.com/other.js?fake=-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive userinfo lookalike",
+    "url": "https://cdn.permutive.com@static.example.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive trailing dot",
+    "url": "https://cdn.permutive.com./app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive encoded extension",
+    "url": "https://cdn.permutive.com/app-web%2ejs",
+    "owner": null
+  },
+  {
+    "name": "already proxied GPT",
+    "url": "http://localhost:3000/integrations/gpt/tag/js/gpt.js?ref=aim.loc.kr",
+    "owner": null
+  },
+  {
+    "name": "relative proxied GPT",
+    "url": "/integrations/gpt/tag/js/gpt.js?ref=cdn.permutive.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "relative path mentions Lockr",
+    "url": "/aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "relative SDK path",
+    "url": "identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "bare Lockr hostname",
+    "url": "aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "bare Permutive hostname",
+    "url": "cdn.permutive.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "empty input",
+    "url": "",
+    "owner": null
+  },
+  {
+    "name": "malformed Lockr authority",
+    "url": "https://[aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "malformed Permutive authority",
+    "url": "https://[cdn.permutive.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "malformed URL",
+    "url": "https://[",
+    "owner": null
+  },
+  {
+    "name": "Lockr non-network scheme",
+    "url": "ftp://aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive non-network scheme",
+    "url": "ftp://cdn.permutive.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "embedded URL in data",
+    "url": "data:text/plain,https://aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr shorthand scheme",
+    "url": "https:aim.loc.kr/identity-lockr.js",
+    "owner": null,
+    "insertionOwner": "lockr"
+  },
+  {
+    "name": "Permutive shorthand scheme",
+    "url": "https:/cdn.permutive.com/app-web.js",
+    "owner": null,
+    "insertionOwner": "permutive"
+  },
+  {
+    "name": "Lockr BOM whitespace",
+    "url": "\ufeffhttps://aim.loc.kr/identity-lockr.js",
+    "owner": null,
+    "serverHtmlOwner": "lockr"
+  },
+  {
+    "name": "Permutive NEL whitespace",
+    "url": "\u0085https://cdn.permutive.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "unrelated script",
+    "url": "https://static.example.com/loader.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr leading C0 controls",
+    "url": "\u0001\u001fhttps://aim.loc.kr/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive leading C0 controls",
+    "url": "\u0001\u001fhttps://cdn.permutive.com/app-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr trailing C0 controls",
+    "url": "https://aim.loc.kr/identity-lockr.js\u0001\u001f",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive trailing C0 controls",
+    "url": "https://cdn.permutive.com/app-web.js\u0001\u001f",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr tabs in scheme",
+    "url": "ht\ttps://aim.loc.kr/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive newline in scheme",
+    "url": "ht\ntps://cdn.permutive.com/app-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Permutive CR in scheme",
+    "url": "ht\rtps://cdn.permutive.com/app-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr CR between slashes",
+    "url": "https:/\r/aim.loc.kr/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive tab between slashes",
+    "url": "https:/\t/cdn.permutive.com/app-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr newline after hostname",
+    "url": "https://aim.loc.kr\n/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive CR in pathname",
+    "url": "https://cdn.permutive.com/app-\rweb.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr backslash authority",
+    "url": "https:\\\\aim.loc.kr/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive mixed slash authority",
+    "url": "https:/\\cdn.permutive.com/app-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr backslash protocol relative",
+    "url": "\\\\aim.loc.kr/identity-lockr.js",
+    "owner": "lockr"
+  },
+  {
+    "name": "Permutive mixed protocol relative",
+    "url": "\\/cdn.permutive.com/app-web.js",
+    "owner": "permutive"
+  },
+  {
+    "name": "Lockr normalized userinfo lookalike",
+    "url": "ht\ttps:/\\aim.loc.kr@static.example.com/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive normalized lookalike",
+    "url": "ht\ntps:\\\\cdn.permutive.com.example.com/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr normalized host in path",
+    "url": "ht\ttps:/\\static.example.com/aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive normalized host in query",
+    "url": "ht\ttps:/\\static.example.com/app-web.js?ref=cdn.permutive.com",
+    "owner": null
+  },
+  {
+    "name": "Lockr internal C0 control",
+    "url": "htt\u0001ps://aim.loc.kr/identity-lockr.js",
+    "owner": null
+  },
+  {
+    "name": "Permutive internal C0 control",
+    "url": "https://cdn.permutive.com\u001f/app-web.js",
+    "owner": null
+  },
+  {
+    "name": "Lockr leading NUL differs in HTML and URL properties",
+    "url": "\u0000https://aim.loc.kr/identity-lockr.js",
+    "owner": null,
+    "insertionOwner": "lockr"
+  },
+  {
+    "name": "Permutive trailing NUL differs in HTML and URL properties",
+    "url": "https://cdn.permutive.com/app-web.js\u0000",
+    "owner": null,
+    "insertionOwner": "permutive"
+  }
+]
diff --git a/crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt b/crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt
new file mode 100644
index 0000000000..732424d1c1
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt
@@ -0,0 +1 @@
+W3sic291cmNlIjoiZmlyc3QuZXhhbXBsZS5jb20iLCJpbnNlcnRlciI6Imluc2VydGVyLeKCrC5leGFtcGxlLmNvbSIsIm1hdGNoZXIiOiJmaXJzdC5leGFtcGxlLmNvbSIsIm1tIjozLCJ1aWRzIjpbeyJpZCI6ImZpcnN0LXVpZCIsImF0eXBlIjoxLCJleHQiOnsibGFiZWwiOiLml6XmnKwifX1dfSx7InNvdXJjZSI6ImJhZC5leGFtcGxlLmNvbSIsInVpZHMiOlt7ImlkIjoiYmFkLVx1ZDgwMC11aWQiLCJhdHlwZSI6MX1dfSx7InNvdXJjZSI6Imxhc3QuZXhhbXBsZS5jb20iLCJ1aWRzIjpbeyJpZCI6Imxhc3QtdWlkIiwiYXR5cGUiOjN9XX1d
\ No newline at end of file
diff --git a/crates/trusted-server-js/lib/test/fixtures/ts-eids-golden.txt b/crates/trusted-server-js/lib/test/fixtures/ts-eids-golden.txt
new file mode 100644
index 0000000000..24991f0ade
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/ts-eids-golden.txt
@@ -0,0 +1 @@
+W3sic291cmNlIjoiaWQ1LXN5bmMuY29tIiwiaW5zZXJ0ZXIiOiJpbnNlcnRlci5leGFtcGxlLmNvbSIsIm1hdGNoZXIiOiJpZDUtc3luYy5jb20iLCJtbSI6MiwidWlkcyI6W3siaWQiOiJnb2xkZW4taWQ1LWEiLCJhdHlwZSI6MSwiZXh0Ijp7ImxpbmtUeXBlIjoyfX0seyJpZCI6ImdvbGRlbi1pZDUtYiIsImF0eXBlIjoxfV19LHsic291cmNlIjoic2hhcmVkaWQub3JnIiwidWlkcyI6W3siaWQiOiJnb2xkZW4tc2hhcmVkIiwiYXR5cGUiOjF9XX1d
diff --git a/crates/trusted-server-js/lib/test/fixtures/ts-eids-ortb2-only.txt b/crates/trusted-server-js/lib/test/fixtures/ts-eids-ortb2-only.txt
new file mode 100644
index 0000000000..e9e9113453
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/ts-eids-ortb2-only.txt
@@ -0,0 +1 @@
+W3sic291cmNlIjoiaWQ1LXN5bmMuY29tIiwiaW5zZXJ0ZXIiOiJpbnNlcnRlci5leGFtcGxlLmNvbSIsIm1tIjoyLCJ1aWRzIjpbeyJpZCI6ImZpY3Rpb25hbC1pZDUiLCJhdHlwZSI6MX1dfV0=
diff --git a/crates/trusted-server-js/lib/test/fixtures/ts-eids-registered-only.txt b/crates/trusted-server-js/lib/test/fixtures/ts-eids-registered-only.txt
new file mode 100644
index 0000000000..20d50d9171
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/ts-eids-registered-only.txt
@@ -0,0 +1 @@
+W3sic291cmNlIjoicmVnaXN0ZXJlZC5leGFtcGxlLmNvbSIsInVpZHMiOlt7ImlkIjoieHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eCIsImF0eXBlIjoxfV19XQ==
diff --git a/crates/trusted-server-js/lib/test/gpt-diagnostics-artifact-integration.test.mjs b/crates/trusted-server-js/lib/test/gpt-diagnostics-artifact-integration.test.mjs
new file mode 100644
index 0000000000..c81fb8bdfb
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/gpt-diagnostics-artifact-integration.test.mjs
@@ -0,0 +1,236 @@
+// @vitest-environment node
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { JSDOM } from 'jsdom';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+
+import { moduleBuildOptions } from '../build-module-options.mjs';
+
+const libDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+let outputDirectory;
+const bundles = {};
+
+beforeAll(async () => {
+  outputDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'tsjs-diagnostics-artifacts-'));
+  const { build } = await import('vite');
+  for (const name of ['prebid', 'gpt_diagnostics']) {
+    await build(
+      moduleBuildOptions({
+        name,
+        entryPath: path.join(libDir, 'src', 'integrations', name, 'index.ts'),
+        outDir: outputDirectory,
+      })
+    );
+    bundles[name] = fs.readFileSync(path.join(outputDirectory, `tsjs-${name}.js`), 'utf8');
+  }
+}, 60_000);
+
+afterAll(() => fs.rmSync(outputDirectory, { recursive: true, force: true }));
+
+function page() {
+  const dom = new JSDOM('<!doctype html><div id="ad-slot"></div>', {
+    url: 'https://publisher.example/article',
+    runScripts: 'outside-only',
+    pretendToBeVisual: true,
+  });
+  const target = dom.window;
+  target.TextEncoder = TextEncoder;
+  target.CSS = { escape: (value) => value };
+  target.tsjs = { navGeneration: 1 };
+  target.__tsjs_gpt_diagnostics_active = true;
+  target.__tsjs_prebid = { serverSideBidders: [] };
+  target.__tsjs_prebid_bundle = {
+    schemaVersion: 1,
+    modules: { bidder: [], userId: [], analytics: [] },
+    runtimeCodes: { bidder: [], analytics: [] },
+  };
+  const events = new Map();
+  const targeting = new Map();
+  const slot = {
+    getSlotElementId: () => 'ad-slot',
+    getAdUnitPath: () => '/example/ad-slot',
+    getSizes: () => [[300, 250]],
+    getTargeting: vi.fn((key) => targeting.get(key) ?? []),
+    clearTargeting: (key) => targeting.delete(key),
+  };
+  const refresh = vi.fn(() => {
+    for (const callback of events.get('slotRequested') ?? []) callback({ slot });
+  });
+  const pubads = {
+    getSlots: () => [slot],
+    refresh,
+    addEventListener: (name, callback) => {
+      events.set(name, [...(events.get(name) ?? []), callback]);
+    },
+  };
+  target.googletag = { cmd: { push: (callback) => callback() }, pubads: () => pubads };
+  let auctionSequence = 0;
+  const prebidEvents = new Map();
+  const prebid = (target.pbjs = {
+    que: [],
+    cmd: [],
+    adUnits: [],
+    registerBidAdapter: vi.fn(),
+    setConfig: vi.fn(),
+    getConfig: () => ({}),
+    getBidderCodes: () => ['trustedServer'],
+    processQueue: vi.fn(),
+    requestBids: vi.fn((options) =>
+      options.bidsBackHandler({}, false, `auction-${++auctionSequence}`)
+    ),
+    setTargetingForGPTAsync: vi.fn(() => {
+      targeting.set('hb_bidder', ['client']);
+      targeting.set('hb_pb', ['2.40']);
+    }),
+    onEvent: vi.fn((name, callback) => {
+      const listeners = prebidEvents.get(name) ?? new Set();
+      listeners.add(callback);
+      prebidEvents.set(name, listeners);
+    }),
+    offEvent: vi.fn((name, callback) => {
+      prebidEvents.get(name)?.delete(callback);
+    }),
+  });
+  return {
+    dom,
+    target,
+    prebid,
+    prebidEvents,
+    pubads,
+    refresh,
+    slot,
+    emitPrebid: (name, bid) => {
+      for (const callback of prebidEvents.get(name) ?? []) callback(bid);
+    },
+  };
+}
+
+function bidWonSubscriptions(prebid) {
+  return prebid.onEvent.mock.calls.filter(([name]) => name === 'bidWon');
+}
+
+describe('separately built Prebid shim and diagnostics artifacts', () => {
+  it('does not subscribe or read diagnostic targeting when only the shim is loaded', () => {
+    const p = page();
+    try {
+      p.target.eval(bundles.prebid);
+      p.pubads.refresh([p.slot]);
+      expect(p.refresh).toHaveBeenCalledOnce();
+      // The EID lifecycle listens for TCF blocks even without diagnostics.
+      expect(p.prebid.onEvent).toHaveBeenCalledExactlyOnceWith(
+        'tcf2Enforcement',
+        expect.any(Function)
+      );
+      expect(bidWonSubscriptions(p.prebid)).toEqual([]);
+      expect(p.slot.getTargeting).not.toHaveBeenCalledWith('hb_bidder');
+      expect(p.slot.getTargeting).not.toHaveBeenCalledWith('hb_pb');
+      expect(p.target.tsjs.gptDiagnosticsRecorder).toBeUndefined();
+    } finally {
+      p.dom.window.close();
+    }
+  });
+
+  it.each([
+    ['gpt_diagnostics', 'prebid'],
+    ['prebid', 'gpt_diagnostics'],
+  ])('records targeting and bidWon with %s loaded before %s', (first, second) => {
+    const p = page();
+    try {
+      p.target.eval(bundles[first]);
+      p.target.eval(bundles[second]);
+      // The shim captured this instance before a publisher replaced its global.
+      const decoy = { onEvent: vi.fn() };
+      p.target.pbjs = decoy;
+      p.pubads.refresh([p.slot]);
+      expect(p.refresh).toHaveBeenCalledExactlyOnceWith([p.slot], undefined);
+      expect(p.prebid.setTargetingForGPTAsync).toHaveBeenCalledWith(['ad-slot']);
+      expect(decoy.onEvent).not.toHaveBeenCalled();
+      expect(bidWonSubscriptions(p.prebid)).toEqual([['bidWon', expect.any(Function)]]);
+      let cycle = p.target.tsjs.gptDiagnostics.snapshot().slots[0].requests[0];
+      expect(cycle.prebidAuction).toMatchObject({
+        auctionId: 'auction-1',
+        targetingCandidate: { bidder: 'client', priceBucket: '2.40' },
+      });
+      p.emitPrebid('bidWon', {
+        auctionId: 'auction-1',
+        adUnitCode: 'ad-slot',
+        latestTargetedAuctionId: 'auction-1',
+        adserverTargeting: { hb_bidder: 'client', hb_pb: '2.40' },
+      });
+      cycle = p.target.tsjs.gptDiagnostics.snapshot().slots[0].requests[0];
+      expect(cycle.prebidAuction.win).toMatchObject({ bidder: 'client', priceBucket: '2.40' });
+    } finally {
+      p.target.__tsjs_gpt_diagnostics_runtime?.destroy();
+      p.dom.window.close();
+    }
+  });
+
+  it('removes only its own listener across runtime destroy and reinstall', () => {
+    const p = page();
+    try {
+      const publisher = vi.fn();
+      p.prebid.onEvent('bidWon', publisher);
+      p.target.eval(bundles.gpt_diagnostics);
+      p.target.eval(bundles.prebid);
+      const previousRecorder = p.target.tsjs.gptDiagnosticsRecorder;
+      const previousWin = vi.spyOn(previousRecorder, 'recordPrebidWin');
+      p.pubads.refresh([p.slot]);
+      const previousListener = bidWonSubscriptions(p.prebid).find(
+        ([, handler]) => handler !== publisher
+      )[1];
+      expect(p.prebidEvents.get('bidWon').size).toBe(2);
+      p.target.__tsjs_gpt_diagnostics_runtime.destroy();
+      expect(p.prebid.offEvent).toHaveBeenCalledExactlyOnceWith('bidWon', previousListener);
+      expect([...p.prebidEvents.get('bidWon')]).toEqual([publisher]);
+
+      p.target.eval(bundles.gpt_diagnostics);
+      const currentWin = vi.spyOn(p.target.tsjs.gptDiagnosticsRecorder, 'recordPrebidWin');
+      p.pubads.refresh([p.slot]);
+      expect(p.prebidEvents.get('bidWon').size).toBe(2);
+      const bid = {
+        auctionId: 'auction-2',
+        adUnitCode: 'ad-slot',
+        adserverTargeting: { hb_bidder: 'client', hb_pb: '2.40' },
+      };
+      previousListener(bid);
+      p.emitPrebid('bidWon', bid);
+      expect(previousWin).not.toHaveBeenCalled();
+      expect(currentWin).toHaveBeenCalledExactlyOnceWith(p.slot, 'auction-2', {
+        bidder: 'client',
+        priceBucket: '2.40',
+      });
+      expect(publisher).toHaveBeenCalledExactlyOnceWith(bid);
+    } finally {
+      p.target.__tsjs_gpt_diagnostics_runtime?.destroy();
+      p.dom.window.close();
+    }
+  });
+
+  it('keeps targeting and GAM refresh fail-open when recorder or subscription throws', () => {
+    const p = page();
+    try {
+      p.target.eval(bundles.gpt_diagnostics);
+      p.target.eval(bundles.prebid);
+      p.prebid.onEvent.mockImplementationOnce(() => {
+        throw new Error('registration failed');
+      });
+      p.pubads.refresh([p.slot]);
+      expect(p.refresh).toHaveBeenCalledTimes(1);
+      p.pubads.refresh([p.slot]);
+      expect(bidWonSubscriptions(p.prebid)).toHaveLength(2);
+      p.target.tsjs.gptDiagnosticsRecorder.recordCompletedPrebidAuction = () => {
+        throw new Error('diagnostics failed');
+      };
+      p.pubads.refresh([p.slot]);
+      expect(p.prebid.setTargetingForGPTAsync).toHaveBeenCalledTimes(3);
+      expect(p.refresh).toHaveBeenCalledTimes(3);
+    } finally {
+      p.target.__tsjs_gpt_diagnostics_runtime?.destroy();
+      p.dom.window.close();
+    }
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 7b818229a2..38fd903ecc 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -21,7 +21,6 @@ import {
   APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
   RENDERER_READY_TIMEOUT_MS,
 } from '../../../src/integrations/aps/render';
-import { GptDiagnosticsStore } from '../../../src/integrations/gpt_diagnostics/store';
 
 let publisherNativeScript: HTMLScriptElement | undefined;
 
@@ -410,22 +409,72 @@ describe('installTsAdInit', () => {
     try {
       const recordTrustedServerOpportunity = vi.fn();
       const { mockPubads, mockSlot } = configureOpportunityDiagnostics(
-        { hb_pb: '1.10', hb_adid: 'example-fallback-ad', adm: '<div>Fallback</div>' },
+        {
+          hb_pb: '1.10',
+          hb_bidder: 'example-bidder',
+          hb_adid: 'example-fallback-ad',
+          hb_auction_id: 'example-fallback-auction',
+          adm: '<div>Fallback</div>',
+        },
         recordTrustedServerOpportunity
       );
       const ts = (window as TestWindow).tsjs as TsjsApi;
+      ts.navGeneration = 1;
+      ts.auctionDiagnostics = { auctionDispatchedMs: 17, auctionResolvedMs: 93 };
       registerPublisherFirstImpressionAuctions(ts, ['div-atf-sidebar']);
       const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
       installTsAdInit();
       ts.adInit!();
 
       expect(mockPubads.refresh).not.toHaveBeenCalled();
+      ts.auctionDiagnostics = { auctionDispatchedMs: 31, auctionResolvedMs: 144 };
       vi.advanceTimersByTime(5001);
 
       expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1');
       expect(mockPubads.refresh).toHaveBeenCalledOnce();
       expect(mockPubads.refresh).toHaveBeenCalledWith([mockSlot]);
       expect(recordTrustedServerOpportunity).toHaveBeenCalledOnce();
+      expect(recordTrustedServerOpportunity).toHaveBeenCalledWith(
+        mockSlot,
+        'atf_sidebar_ad',
+        'renderable_candidate',
+        'example-fallback-auction',
+        [[300, 250]],
+        {
+          auctionType: 'trusted_server',
+          winner: { bidder: 'example-bidder', priceBucket: '1.10' },
+          serverTimings: { auctionDispatchedMs: 17, auctionResolvedMs: 93 },
+        }
+      );
+
+      vi.advanceTimersByTime(10_000);
+      expect(mockPubads.refresh).toHaveBeenCalledOnce();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('keeps fallback delivery when the diagnostics recorder throws', async () => {
+    vi.useFakeTimers();
+    try {
+      const recordTrustedServerOpportunity = vi.fn(() => {
+        throw new Error('fallback diagnostics unavailable');
+      });
+      const { mockPubads, mockSlot } = configureOpportunityDiagnostics(
+        { hb_pb: '1.10', hb_adid: 'example-fallback-ad', adm: '<div>Fallback</div>' },
+        recordTrustedServerOpportunity
+      );
+      const ts = (window as TestWindow).tsjs as TsjsApi;
+      registerPublisherFirstImpressionAuctions(ts, ['div-atf-sidebar']);
+      const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+      installTsAdInit();
+      ts.adInit!();
+
+      expect(() => vi.advanceTimersByTime(5001)).not.toThrow();
+      expect(recordTrustedServerOpportunity).toHaveBeenCalledOnce();
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1');
+      expect(mockPubads.refresh).toHaveBeenCalledOnce();
+      expect(mockPubads.refresh).toHaveBeenCalledWith([mockSlot]);
 
       vi.advanceTimersByTime(10_000);
       expect(mockPubads.refresh).toHaveBeenCalledOnce();
@@ -534,6 +583,7 @@ describe('installTsAdInit', () => {
         'atf_sidebar_ad',
         expectedOpportunity,
         undefined,
+        undefined,
         undefined
       );
     }
@@ -560,6 +610,99 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'unrenderable_candidate',
       'auction-123',
+      undefined,
+      {
+        auctionType: 'ssat',
+        winner: { bidder: 'example', priceBucket: '1.00' },
+      }
+    );
+  });
+
+  it('classifies a winning SPA auction and snapshots its server timings', async () => {
+    const recordTrustedServerOpportunity = vi.fn();
+    const { mockSlot } = configureOpportunityDiagnostics(
+      {
+        hb_pb: '1.00',
+        hb_bidder: 'example',
+        hb_adid: 'creative-1',
+        hb_auction_id: 'auction-spa-123',
+      },
+      recordTrustedServerOpportunity
+    );
+    const ts = (window as TestWindow).tsjs!;
+    ts.navGeneration = 1;
+    ts.auctionDiagnostics = { auctionDispatchedMs: 12, auctionResolvedMs: 84 };
+
+    const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+    installTsAdInit();
+    ts.adInit!();
+
+    expect(recordTrustedServerOpportunity).toHaveBeenCalledWith(
+      mockSlot,
+      'atf_sidebar_ad',
+      'unrenderable_candidate',
+      'auction-spa-123',
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        winner: { bidder: 'example', priceBucket: '1.00' },
+        serverTimings: { auctionDispatchedMs: 12, auctionResolvedMs: 84 },
+      }
+    );
+  });
+
+  it('snapshots auction timing with the bids before queued GPT work runs', async () => {
+    const recordTrustedServerOpportunity = vi.fn();
+    const { mockSlot } = configureOpportunityDiagnostics(
+      { hb_pb: '1.00', hb_bidder: 'example', hb_adid: 'creative-1' },
+      recordTrustedServerOpportunity
+    );
+    const ts = (window as TestWindow).tsjs!;
+    ts.auctionDiagnostics = { auctionResolvedMs: 84 };
+
+    const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+    installTsAdInit();
+    let queued: (() => void) | undefined;
+    const googletag = (window as TestWindow).googletag as {
+      cmd: { push(callback: () => void): void };
+    };
+    googletag.cmd.push = (callback) => {
+      queued = callback;
+    };
+
+    ts.adInit!();
+    ts.auctionDiagnostics.auctionResolvedMs = 99;
+    queued?.();
+
+    expect(recordTrustedServerOpportunity).toHaveBeenCalledWith(
+      mockSlot,
+      'atf_sidebar_ad',
+      'unrenderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'ssat',
+        winner: { bidder: 'example', priceBucket: '1.00' },
+        serverTimings: { auctionResolvedMs: 84 },
+      }
+    );
+  });
+
+  it('does not infer an SPA auction from navigation generation alone', async () => {
+    const recordTrustedServerOpportunity = vi.fn();
+    const { mockSlot } = configureOpportunityDiagnostics(undefined, recordTrustedServerOpportunity);
+    (window as TestWindow).tsjs!.navGeneration = 1;
+
+    const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(recordTrustedServerOpportunity).toHaveBeenCalledWith(
+      mockSlot,
+      'atf_sidebar_ad',
+      'no_candidate',
+      undefined,
+      undefined,
       undefined
     );
   });
@@ -597,7 +740,8 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'no_candidate',
       undefined,
-      formats
+      formats,
+      undefined
     );
   });
 
@@ -623,7 +767,8 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'no_candidate',
       undefined,
-      formats
+      formats,
+      undefined
     );
   });
 
@@ -663,6 +808,7 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'no_candidate',
       undefined,
+      undefined,
       undefined
     );
   });
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts
index 46ba778dc9..e82a211c93 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts
@@ -781,10 +781,14 @@ describe('gpt_bootstrap.js fallback', () => {
     const adInit = vi.fn();
     ts.adInit = adInit;
     ts.bids = { live_slot: { hb_pb: '2.50' } };
+    ts.auctionDiagnostics = { auctionResolvedMs: 10 };
     ts.navGeneration = 1;
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } });
+    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, undefined, undefined, {
+      auctionResolvedMs: 99,
+    });
     expect(ts.bids).toEqual({ live_slot: { hb_pb: '2.50' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 10 });
 
     window.dispatchEvent(new Event('load'));
     flushFrame();
@@ -813,8 +817,15 @@ describe('gpt_bootstrap.js fallback', () => {
       formats: [[728, 90]] as Array<[number, number]>,
     };
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, [ssrSlot]);
+    const auctionDiagnostics = { auctionResolvedMs: 84 };
+    ts.scheduleInitialAdInit!(
+      { ssr_slot: { hb_pb: '1.00' } },
+      [ssrSlot],
+      undefined,
+      auctionDiagnostics
+    );
     expect(ts.adSlots).toEqual([ssrSlot]);
+    expect(ts.auctionDiagnostics).toEqual(auctionDiagnostics);
 
     ts.adSlots = [liveSlot];
     ts.navGeneration = 1;
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
index a68b41ffe6..cc33e10fc7 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
@@ -135,12 +135,14 @@ describe('scheduleInitialAdInit', () => {
       },
     ];
     const bids = { example: { hb_pb: '1.00' } };
+    const auctionDiagnostics = { auctionResolvedMs: 84 };
     ts.adInit = vi.fn(() => {
       expect(ts.traceEvidence!.snapshot().value?.serverAuctions).toEqual([evidence]);
       expect(ts.adSlots).toBe(slots);
       expect(ts.bids).toBe(bids);
+      expect(ts.auctionDiagnostics).toBe(auctionDiagnostics);
     });
-    ts.scheduleInitialAdInit!(bids, slots, { schema_version: 1, evidence });
+    ts.scheduleInitialAdInit!(bids, slots, { schema_version: 1, evidence }, auctionDiagnostics);
     expect(ts.traceEvidence!.snapshot().value?.serverAuctions).toEqual([]);
     flushFrame();
     flushFrame();
@@ -205,10 +207,13 @@ describe('scheduleInitialAdInit', () => {
       const ts = (window as TestWindow).tsjs!;
       installTraceRuntime(ts);
       ts.adInit = vi.fn();
-      ts.scheduleInitialAdInit!(undefined, [], {
-        schema_version: 1,
-        unavailable_reason: 'evidence_projection_failed',
-      });
+      const auctionDiagnostics = { auctionResolvedMs: 84 };
+      ts.scheduleInitialAdInit!(
+        undefined,
+        [],
+        { schema_version: 1, unavailable_reason: 'evidence_projection_failed' },
+        auctionDiagnostics
+      );
       if (mode === 'bootstrap-to-bundle') {
         await importGptModule();
         ts.adInit = vi.fn();
@@ -218,6 +223,7 @@ describe('scheduleInitialAdInit', () => {
       flushFrame();
       expect(ts.adInit).toHaveBeenCalledOnce();
       expect(ts.traceEvidence!.snapshot().value?.issues).toEqual(['evidence_projection_failed']);
+      expect(ts.auctionDiagnostics).toBe(auctionDiagnostics);
     }
   );
 
@@ -445,9 +451,13 @@ describe('scheduleInitialAdInit', () => {
     await flushAsync();
     expect(ts.navGeneration).toBe(1);
     ts.bids = { live_slot: { hb_pb: '2.50' } };
+    ts.auctionDiagnostics = { auctionResolvedMs: 10 };
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } });
+    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, undefined, undefined, {
+      auctionResolvedMs: 99,
+    });
     expect(ts.bids).toEqual({ live_slot: { hb_pb: '2.50' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 10 });
 
     window.dispatchEvent(new Event('load'));
     flushFrame();
@@ -466,6 +476,7 @@ describe('scheduleInitialAdInit', () => {
       json: async () => ({
         slots: [{ id: 's1', div_id: 'div-s1' }],
         bids: { s1: { hb_pb: '3.00' } },
+        auctionDiagnostics: { auctionResolvedMs: 84 },
       }),
     });
     await importGptModule();
@@ -476,6 +487,7 @@ describe('scheduleInitialAdInit', () => {
     history.pushState({}, '', '/b');
     await flushAsync();
     expect(ts.bids).toEqual({ s1: { hb_pb: '3.00' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 84 });
     expect(adInit).toHaveBeenCalledTimes(1);
 
     ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } });
@@ -484,6 +496,7 @@ describe('scheduleInitialAdInit', () => {
     flushFrame();
 
     expect(ts.bids).toEqual({ s1: { hb_pb: '3.00' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 84 });
     expect(adInit).toHaveBeenCalledTimes(1);
   });
 
@@ -501,10 +514,23 @@ describe('scheduleInitialAdInit', () => {
       formats: [[728, 90]] as Array<[number, number]>,
     };
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, [ssrSlot]);
+    const auctionDiagnostics = {
+      auctionDispatchedMs: 4,
+      auctionResolvedMs: 84,
+      auctionCommittedMs: 85,
+      auctionWaitMs: 80,
+      auctionWaitPlacement: 'pre_header' as const,
+    };
+    ts.scheduleInitialAdInit!(
+      { ssr_slot: { hb_pb: '1.00' } },
+      [ssrSlot],
+      undefined,
+      auctionDiagnostics
+    );
 
     expect(ts.adSlots).toEqual([ssrSlot]);
     expect(ts.bids).toEqual({ ssr_slot: { hb_pb: '1.00' } });
+    expect(ts.auctionDiagnostics).toEqual(auctionDiagnostics);
   });
 
   it('preserves head-injected slots when initialSlots is omitted', async () => {
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 3474be84b8..39ebf7854d 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -9,6 +9,10 @@ import { GptDiagnosticsStore } from '../../../src/integrations/gpt_diagnostics/s
 import { gptTransport, joinedGptStore } from '../../trace/gpt-fixtures';
 import { AUCTION_TOKEN, SLOT_TOKEN } from '../../trace/fixtures';
 
+const { mockWriteEidsMirror } = vi.hoisted(() => ({ mockWriteEidsMirror: vi.fn() }));
+
+vi.mock('../../../src/core/eids_mirror', () => ({ writeEidsMirror: mockWriteEidsMirror }));
+
 type TestWindow = Window & {
   googletag?: unknown;
   tsjs?: TsjsApi;
@@ -42,6 +46,7 @@ describe('installSpaAuctionHook', () => {
   const realAddEventListener = window.addEventListener.bind(window);
 
   beforeEach(() => {
+    mockWriteEidsMirror.mockClear();
     vi.resetModules();
     delete (window as TestWindow).tsjs;
     // Restore unwrapped history methods so each module import wraps exactly
@@ -369,6 +374,50 @@ describe('installSpaAuctionHook', () => {
     expect(adInit).toHaveBeenCalledTimes(1);
   });
 
+  it('writes the ts-eids-s mirror from a page-bids response that carries one', async () => {
+    const mirror = { value: 'eyJ2IjoxfQ', max_age: 600 };
+    fetchStub.mockResolvedValue({
+      ok: true,
+      json: async () => ({ slots: [], bids: {}, ts_eids_s: mirror }),
+    });
+    const { installSpaAuctionHook } = await importGptModule();
+    installSpaAuctionHook();
+
+    history.pushState({}, '', '/mirrored-route');
+    await flushAsync();
+
+    expect(mockWriteEidsMirror).toHaveBeenCalledTimes(1);
+    expect(mockWriteEidsMirror).toHaveBeenCalledWith(mirror);
+  });
+
+  it('passes a clear payload through to the mirror writer', async () => {
+    fetchStub.mockResolvedValue({
+      ok: true,
+      json: async () => ({ slots: [], bids: {}, ts_eids_s: { clear: true } }),
+    });
+    const { installSpaAuctionHook } = await importGptModule();
+    installSpaAuctionHook();
+
+    history.pushState({}, '', '/cleared-route');
+    await flushAsync();
+
+    expect(mockWriteEidsMirror).toHaveBeenCalledWith({ clear: true });
+  });
+
+  it('leaves the mirror alone when the page-bids response has none', async () => {
+    fetchStub.mockResolvedValue({
+      ok: true,
+      json: async () => ({ slots: [], bids: {} }),
+    });
+    const { installSpaAuctionHook } = await importGptModule();
+    installSpaAuctionHook();
+
+    history.pushState({}, '', '/unmirrored-route');
+    await flushAsync();
+
+    expect(mockWriteEidsMirror).not.toHaveBeenCalled();
+  });
+
   it('skips adInit on an empty page-bids response with no prior TS state', async () => {
     // A gated page-bids response (template switch, auction gate, or consent
     // denial) returns no slots. With no prior TS state to sweep, the hook must
@@ -816,9 +865,13 @@ describe('installSpaAuctionHook', () => {
     const ts = (window as TestWindow).tsjs!;
     const adInit = vi.fn();
     ts.adInit = adInit;
+    ts.auctionDiagnostics = { auctionResolvedMs: 84 };
 
     history.pushState({}, '', '/first');
+    expect(ts.auctionDiagnostics).toBeUndefined();
+    ts.auctionDiagnostics = { auctionResolvedMs: 40 };
     history.pushState({}, '', '/second');
+    expect(ts.auctionDiagnostics).toBeUndefined();
     await flushAsync();
 
     expect(ts.adSlots).toEqual([{ id: 'newer', div_id: 'div-newer' }]);
@@ -842,13 +895,16 @@ describe('installSpaAuctionHook', () => {
     installSpaAuctionHook();
     const ts = (window as TestWindow).tsjs!;
     ts.adSlots = [{ id: 'existing' } as never];
+    ts.auctionDiagnostics = { auctionResolvedMs: 84 };
     const adInit = vi.fn();
     ts.adInit = adInit;
 
     history.pushState({}, '', '/error-page');
+    expect(ts.auctionDiagnostics).toBeUndefined();
     await flushAsync();
 
     expect(ts.adSlots).toEqual([{ id: 'existing' }]);
+    expect(ts.auctionDiagnostics).toBeUndefined();
     expect(adInit).not.toHaveBeenCalled();
   });
 
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts
index abbdeca692..68f4a9f9a7 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts
@@ -66,6 +66,8 @@ function fakeApiStore() {
     subscribe: vi.fn(() => () => undefined),
     recordTrustedServerOpportunity: vi.fn(),
     recordPrebidRefresh: vi.fn(),
+    recordPrebidAuction: vi.fn(),
+    recordPrebidWin: vi.fn(),
     recordTrustedServerCreativeRequest: vi.fn((_auctionSlotId: string) => 41),
     recordTrustedServerCreativeResponse: vi.fn(),
     recordTrustedServerCreativeFailure: vi.fn(),
@@ -92,7 +94,9 @@ describe('GptDiagnosticsApiController', () => {
       'subscribe',
     ]);
     expect(Object.keys(controller.recorder).sort()).toEqual([
+      'recordPrebidAuction',
       'recordPrebidRefresh',
+      'recordPrebidWin',
       'recordTrustedServerCreativeFailure',
       'recordTrustedServerCreativeRequest',
       'recordTrustedServerCreativeResponse',
@@ -112,7 +116,10 @@ describe('GptDiagnosticsApiController', () => {
     controller.recorder.recordTrustedServerOpportunity(
       slot,
       'auction-slot-example',
-      'renderable_candidate'
+      'renderable_candidate',
+      undefined,
+      undefined,
+      { auctionType: 'ssat' }
     );
     controller.recorder.recordPrebidRefresh(slots);
     const attemptId =
@@ -126,7 +133,8 @@ describe('GptDiagnosticsApiController', () => {
       'auction-slot-example',
       'renderable_candidate',
       undefined,
-      undefined
+      undefined,
+      { auctionType: 'ssat' }
     );
     expect(store.recordPrebidRefresh).toHaveBeenCalledTimes(1);
     expect(store.recordPrebidRefresh).toHaveBeenCalledWith(slots);
@@ -159,6 +167,7 @@ describe('GptDiagnosticsApiController', () => {
       'auction-slot-example',
       'renderable_candidate',
       'auction-123',
+      undefined,
       undefined
     );
   });
@@ -225,6 +234,9 @@ describe('GptDiagnosticsApiController', () => {
                 yieldGroupIds: [10],
                 companyIds: [20],
               },
+              auctionWinner: { bidder: 'example', priceBucket: '1.20' },
+              serverAuctionTimings: { auctionResolvedMs: 84 },
+              serverAuctionTimingOrigin: 'spa_auction' as const,
               trustedServerCreativeFailures: ['cache_fetch_failed' as const],
             },
           ],
@@ -280,6 +292,13 @@ describe('GptDiagnosticsApiController', () => {
     expect(cycle?.adManager?.companyIds).not.toBe(
       source.slots[0]?.requests[0]?.adManager.companyIds
     );
+    expect(cycle?.auctionWinner).toEqual({ bidder: 'example', priceBucket: '1.20' });
+    expect(cycle?.auctionWinner).not.toBe(source.slots[0]?.requests[0]?.auctionWinner);
+    expect(cycle?.serverAuctionTimings).toEqual({ auctionResolvedMs: 84 });
+    expect(cycle?.serverAuctionTimings).not.toBe(
+      source.slots[0]?.requests[0]?.serverAuctionTimings
+    );
+    expect(cycle?.serverAuctionTimingOrigin).toBe('spa_auction');
     expect(snapshot.metadata).not.toBe(source.metadata);
     expect(snapshot.metadata.droppedAttributionIssues).toBe(2);
   });
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts
index 329c4d2990..7cdb8a01c2 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts
@@ -112,6 +112,138 @@ describe('GptDiagnosticsBadgeManager', () => {
 
     expect(layer.querySelectorAll('.tsgd-badge')).toHaveLength(1);
     expect(layer.querySelector<HTMLElement>('.tsgd-badge')?.dataset.runtimeSlot).toBe('1');
+    expect(layer.querySelector<HTMLElement>('.tsgd-badge')?.textContent).toContain('Ad #1');
+    manager.destroy();
+  });
+
+  it('renders an accessible request-scoped control and activates its exact request', () => {
+    const frames: Array<() => void> = [];
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    const bindings = new FakeBindings();
+    const element = document.createElement('div');
+    document.body.append(element);
+    vi.spyOn(element, 'getBoundingClientRect').mockReturnValue(rectangle(10, 100, 300, 250));
+    const observedSlot = slot('accessible');
+    store.recordSlotRequested(observedSlot);
+    store.recordSlotRequested(observedSlot);
+    bindings.set(1, { status: 'bound' }, element, true);
+    const activate = vi.fn();
+    const layer = document.createElement('div');
+    document.body.append(layer);
+    const manager = new GptDiagnosticsBadgeManager(store, bindings, {
+      scheduleFrame: (callback) => frames.push(callback),
+      onActivate: activate,
+    });
+    manager.setLayer(layer);
+    runFrame(frames);
+
+    const badge = layer.querySelector<HTMLButtonElement>('.tsgd-badge-handle');
+    expect(badge).toBeInstanceOf(HTMLButtonElement);
+    expect(badge?.textContent).toBe('Ad #1');
+    expect(layer.querySelector('.tsgd-badge-evidence')?.textContent).toBe('Request #2 · Pending');
+    layer.querySelector<HTMLElement>('.tsgd-badge')?.click();
+    expect(activate).not.toHaveBeenCalled();
+    expect(badge?.getAttribute('aria-label')).toBe(
+      'Open diagnostics for Ad #1, Request #2: Pending'
+    );
+    badge?.click();
+    expect(activate).toHaveBeenCalledWith(1, 2);
+
+    badge?.focus();
+    store.recordSlotRequested(observedSlot);
+    runFrame(frames);
+    const updatedBadge = layer.querySelector<HTMLButtonElement>('.tsgd-badge-handle');
+    expect(updatedBadge).toBe(badge);
+    expect(document.activeElement).toBe(badge);
+    expect(updatedBadge?.textContent).toBe('Ad #1');
+    expect(layer.querySelector('.tsgd-badge-evidence')?.textContent).toBe('Request #3 · Pending');
+    updatedBadge?.click();
+    expect(activate).toHaveBeenLastCalledWith(1, 3);
+
+    const highlight = document.createElement('div');
+    highlight.className = 'tsgd-highlight';
+    layer.append(highlight);
+    manager.update();
+    expect(layer.querySelector('.tsgd-highlight')).toBe(highlight);
+    manager.destroy();
+  });
+
+  it.each([
+    { name: 'top-left clipping', bounds: rectangle(-100, -20, 500, 500), hidden: false },
+    { name: 'bottom-right clipping', bounds: rectangle(900, 700, 300, 250), hidden: false },
+    { name: 'full viewport creative', bounds: rectangle(0, 0, 1024, 768), hidden: true },
+    { name: 'creative larger than viewport', bounds: rectangle(-10, -10, 1044, 788), hidden: true },
+    { name: 'viewport narrower than handle', bounds: rectangle(10, 100, 30, 250), hidden: true },
+  ])('keeps the handle outside creative bounds with $name', ({ name, bounds, hidden }) => {
+    if (name === 'viewport narrower than handle') {
+      Object.defineProperty(window, 'innerWidth', { configurable: true, value: 60 });
+    }
+    const frames: Array<() => void> = [];
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    const bindings = new FakeBindings();
+    const creative = document.createElement('div');
+    const originalMarkup = creative.outerHTML;
+    document.body.append(creative);
+    vi.spyOn(creative, 'getBoundingClientRect').mockReturnValue(bounds);
+    store.recordSlotRequested(slot('geometry'));
+    bindings.set(1, { status: 'bound' }, creative, true);
+    const layer = document.createElement('div');
+    document.body.append(layer);
+    const manager = new GptDiagnosticsBadgeManager(store, bindings, {
+      scheduleFrame: (callback) => frames.push(callback),
+    });
+    manager.setLayer(layer);
+    runFrame(frames);
+    const handle = layer.querySelector<HTMLButtonElement>('.tsgd-badge-handle')!;
+    expect(handle.hidden).toBe(hidden);
+    if (!hidden) {
+      const left = Number.parseFloat(handle.style.left);
+      const top = Number.parseFloat(handle.style.top);
+      const right = left + Number.parseFloat(handle.style.width);
+      const bottom = top + Number.parseFloat(handle.style.height);
+      expect(left).toBeGreaterThanOrEqual(4);
+      expect(top).toBeGreaterThanOrEqual(4);
+      expect(right).toBeLessThanOrEqual(window.innerWidth - 4);
+      expect(bottom).toBeLessThanOrEqual(window.innerHeight - 4);
+      expect(
+        right <= bounds.left || left >= bounds.right || bottom <= bounds.top || top >= bounds.bottom
+      ).toBe(true);
+      handle.focus();
+      expect(document.activeElement).toBe(handle);
+    }
+    expect(layer.querySelector('.tsgd-badge-evidence')).not.toBeNull();
+    expect(creative.outerHTML).toBe(originalMarkup);
+    manager.destroy();
+  });
+
+  it('avoids neighboring creatives and clamps tall evidence to the viewport', () => {
+    const frames: Array<() => void> = [];
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    const bindings = new FakeBindings();
+    const creative = document.createElement('div');
+    const neighbor = document.createElement('div');
+    document.body.append(creative, neighbor);
+    vi.spyOn(creative, 'getBoundingClientRect').mockReturnValue(rectangle(100, 100, 300, 250));
+    vi.spyOn(neighbor, 'getBoundingClientRect').mockReturnValue(rectangle(0, 0, 1024, 100));
+    store.recordSlotRequested(slot('geometry'));
+    store.recordSlotRequested(slot('neighbor'));
+    bindings.set(1, { status: 'bound' }, creative, true);
+    bindings.set(2, { status: 'bound' }, neighbor, true);
+    const layer = document.createElement('div');
+    document.body.append(layer);
+    const manager = new GptDiagnosticsBadgeManager(store, bindings, {
+      scheduleFrame: (callback) => frames.push(callback),
+    });
+    manager.setLayer(layer);
+    runFrame(frames);
+    const badge = layer.querySelector<HTMLElement>('.tsgd-badge')!;
+    const evidence = badge.querySelector<HTMLElement>('.tsgd-badge-evidence')!;
+    vi.spyOn(evidence, 'getBoundingClientRect').mockReturnValue(rectangle(0, 0, 260, 700));
+    manager.update();
+    expect(badge.style.top).toBe('4px');
+    const handle = badge.querySelector<HTMLButtonElement>('.tsgd-badge-handle')!;
+    expect(handle.style.top).toBe('354px');
+    expect(handle.hidden).toBe(false);
     manager.destroy();
   });
 
@@ -155,6 +287,36 @@ describe('GptDiagnosticsBadgeManager', () => {
     expect(emptyBadge, 'an empty cycle must not claim a Trusted Server response').toBe('Empty');
   });
 
+  it('shows Multiple paths for a competing SPA auction without a redundant path badge', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const observedSlot = slot('competing-spa-badge');
+
+    store.recordTrustedServerOpportunity(
+      observedSlot,
+      'auction-slot',
+      'renderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        serverTimings: { auctionDispatchedMs: 12, auctionResolvedMs: 84 },
+      }
+    );
+    store.recordPrebidRefresh([observedSlot]);
+    store.recordPrebidAuction(observedSlot, 'client-auction');
+    store.recordSlotRequested(observedSlot);
+
+    const cycle = store.snapshot().slots[0].requests[0];
+    expect(cycle).toMatchObject({
+      auctionType: 'competing',
+      serverAuctionTimingOrigin: 'spa_auction',
+      serverAuctionTimings: { auctionDispatchedMs: 12, auctionResolvedMs: 84 },
+    });
+    const badge = gptDiagnosticsBadgeTextForTest(cycle);
+    expect(badge).toContain('Multiple paths');
+    expect(badge).not.toContain('Competing paths');
+  });
+
   it('renders compact evidence-safe labels for every delivery state', () => {
     const responseSentBadge = gptDiagnosticsBadgeTextForTest({
       requestNumber: 1,
@@ -266,7 +428,7 @@ describe('GptDiagnosticsBadgeManager', () => {
         },
       })
     ).toBe(
-      'Filled · Req 728×90, 970×250 · Fill 728×90 · Box 980×270\nResponse 276 ms · Render 42 ms\nViewable after 1 s'
+      'Filled · Req 728×90, 970×250 · Fill 728×90 · Size filled 980×270\nGAM request → response 276 ms · GAM response → render 42 ms\nViewable after 1 s'
     );
     expect(
       gptDiagnosticsBadgeTextForTest({
@@ -282,6 +444,17 @@ describe('GptDiagnosticsBadgeManager', () => {
         durations: {},
       })
     ).toBe('Filled · Req 300×250, 320×50, 728×90 +1');
+    expect(
+      gptDiagnosticsBadgeTextForTest({
+        requestNumber: 1,
+        isEmpty: false,
+        size: [1, 1],
+        observedSlotSize: [728, 90],
+        auctionType: 'ssat',
+        incompleteSequence: false,
+        durations: {},
+      })
+    ).toBe('Filled · SSAT · Size filled 728×90');
     expect(
       gptDiagnosticsBadgeTextForTest({
         requestNumber: 1,
@@ -364,8 +537,11 @@ describe('GptDiagnosticsBadgeManager', () => {
 
     const firstBadge = layer.querySelector<HTMLElement>('.tsgd-badge')!;
     expect(firstBadge.style.left).toBe('100px');
-    expect(firstBadge.style.top).toBe('112px');
+    expect(firstBadge.style.top).toBe('116px');
     expect(firstBadge.style.maxWidth).toBe('260px');
+    const handle = firstBadge.querySelector<HTMLButtonElement>('button')!;
+    handle.focus();
+    expect(document.activeElement).toBe(handle);
 
     currentRectangle = rectangle(220, 260, 300, 250);
     window.dispatchEvent(new Event('scroll'));
@@ -373,8 +549,10 @@ describe('GptDiagnosticsBadgeManager', () => {
     expect(frames).toHaveLength(1);
     runFrame(frames);
     const movedBadge = layer.querySelector<HTMLElement>('.tsgd-badge')!;
+    expect(movedBadge).toBe(firstBadge);
+    expect(document.activeElement).toBe(handle);
     expect(movedBadge.style.left).toBe('220px');
-    expect(movedBadge.style.top).toBe('252px');
+    expect(movedBadge.style.top).toBe('256px');
     expect(element.getAttributeNames().map((name) => [name, element.getAttribute(name)])).toEqual(
       originalAttributes
     );
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/index.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/index.test.ts
index 7775f306bc..f97b1ac2eb 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/index.test.ts
@@ -177,7 +177,10 @@ describe('GPT diagnostics integration composition', () => {
     // Evidence writers live on their own channel; the operator API stays read-only.
     expect(Object.keys(first!).sort()).toEqual(['export', 'hide', 'show', 'snapshot', 'subscribe']);
     expect(Object.keys(target.tsjs!.gptDiagnosticsRecorder!).sort()).toEqual([
+      'recordCompletedPrebidAuction',
+      'recordPrebidAuction',
       'recordPrebidRefresh',
+      'recordPrebidWin',
       'recordTrustedServerCreativeFailure',
       'recordTrustedServerCreativeRequest',
       'recordTrustedServerCreativeResponse',
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts
index 9f24c7dfad..f2279253ce 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts
@@ -87,6 +87,37 @@ afterEach(() => {
 });
 
 describe('GptDiagnosticsOverlay', () => {
+  it('resets the retained mobile filter when a badge selects a request', () => {
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    let root: ShadowRoot | undefined;
+    const overlay = new GptDiagnosticsOverlay(store, new FakeBindings(), {
+      scheduleFrame: (callback) => callback(),
+      onShadowRoot: (created) => {
+        root = created;
+      },
+      onViewTrace: vi.fn(),
+    });
+    if (!root) throw new Error('should mount diagnostics');
+    try {
+      store.recordSlotRequested(slot('example-slot'));
+      const filter = root.querySelector('select')!;
+      const traceControl = button(root, 'View trace results');
+      const dictionary = root.querySelector('a');
+      filter.value = 'empty';
+      filter.dispatchEvent(new Event('change'));
+      expect(root.textContent).toContain('No slots match.');
+      overlay.selectRequest(1, 1);
+      expect(root.querySelector('select')).toBe(filter);
+      expect(filter.value).toBe('all');
+      expect(root.querySelector('[aria-current="true"]')).not.toBeNull();
+      expect(button(root, 'View trace results')).toBe(traceControl);
+      expect(root.querySelector('a')).toBe(dictionary);
+      expect(root.querySelectorAll('a')).toHaveLength(1);
+    } finally {
+      overlay.destroy();
+    }
+  });
+
   it.each(['View trace results', 'Download trace report'])(
     'retains focused %s and the live region across GPT updates',
     (label) => {
@@ -207,7 +238,7 @@ describe('GptDiagnosticsOverlay', () => {
     overlay.destroy();
   });
 
-  it('presents the request path and Trusted Server delivery evidence without winner claims', () => {
+  it('presents request-path, auction, winner, timing, and delivery evidence', () => {
     const frames: Array<() => void> = [];
     let now = 10;
     const store = new GptDiagnosticsStore({
@@ -222,7 +253,19 @@ describe('GptDiagnosticsOverlay', () => {
       responseSentSlot,
       'auction-response-sent',
       'renderable_candidate',
-      'auction-123'
+      'auction-123',
+      undefined,
+      {
+        auctionType: 'ssat',
+        winner: { bidder: 'example-bidder', priceBucket: '1.20', currency: 'usd' },
+        serverTimings: {
+          auctionDispatchedMs: 4,
+          auctionResolvedMs: 84,
+          auctionCommittedMs: 85,
+          auctionWaitMs: 80,
+          auctionWaitPlacement: 'in_stream',
+        },
+      }
     );
     store.recordSlotRequested(responseSentSlot);
     now = 11;
@@ -259,7 +302,19 @@ describe('GptDiagnosticsOverlay', () => {
     store.recordTrustedServerOpportunity(
       selectedSlot,
       'auction-selected',
-      'unrenderable_candidate'
+      'unrenderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        serverTimings: {
+          auctionDispatchedMs: 0,
+          auctionResolvedMs: 40,
+          auctionCommittedMs: 41,
+          auctionWaitMs: 40,
+          auctionWaitPlacement: 'pre_header',
+        },
+      }
     );
     store.recordPrebidRefresh([selectedSlot]);
     store.recordSlotRequested(selectedSlot);
@@ -290,6 +345,10 @@ describe('GptDiagnosticsOverlay', () => {
     const prebidSlot = slot('prebid-slot');
     now = 50;
     store.recordPrebidRefresh([prebidSlot]);
+    store.recordPrebidAuction(prebidSlot, 'example-client-auction', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
     store.recordSlotRequested(prebidSlot);
     now = 51;
     store.recordSlotResponseReceived(prebidSlot);
@@ -345,8 +404,16 @@ describe('GptDiagnosticsOverlay', () => {
     expect(responseSentArticle).toContain('Request path: Trusted Server direct');
     expect(responseSentArticle).toContain('Request intent: 1');
     expect(responseSentArticle).toContain('Trusted Server auction: auction-123');
+    expect(responseSentArticle).toContain('Auction evidence: SSAT: initial-page server auction');
+    expect(responseSentArticle).toContain('Server auction winner: example-bidder');
+    expect(responseSentArticle).toContain('Server bid price bucket: 1.20 USD');
+    expect(responseSentArticle).not.toContain('(currency not supplied)');
+    expect(responseSentArticle).toContain('Initial document request T0 → auction dispatched 4 ms');
+    expect(responseSentArticle).toContain('Initial document request T0 → auction collected 84 ms');
+    expect(responseSentArticle).toContain('Initial document request T0 → bids ready 85 ms');
+    expect(responseSentArticle).toContain('Auction collection wait (in stream) 80 ms');
     expect(responseSentArticle).toContain('Opportunity → request 0 ms');
-    expect(responseSentArticle).toContain('Direct opportunity: Renderable candidate');
+    expect(responseSentArticle).toContain('Server bid available; creative source present');
     expect(responseSentArticle).toContain('Trusted Server creative request observed at 13 ms');
     expect(responseSentArticle).toContain('Trusted Server markup response sent at 14 ms');
     expect(
@@ -355,7 +422,7 @@ describe('GptDiagnosticsOverlay', () => {
     expect(responseSentArticle).toContain('Creative bridge failure: cache fetch failed');
     expect(responseSentArticle).toContain('Creative bridge failure: invalid cache payload');
     expect(responseSentArticle).toContain('Creative bridge failure: response post failed');
-    expect(responseSentArticle).toContain('Trusted Server selected; markup response sent to PUC');
+    expect(responseSentArticle).toContain('Creative markup sent; execution not confirmed');
     expect(responseSentArticle).toContain(
       'Ad Manager reported line item 6543210987 · order 2345678901'
     );
@@ -367,48 +434,49 @@ describe('GptDiagnosticsOverlay', () => {
     expect(responseSentArticle).not.toMatch(/creative rendered|ad visible|pixels confirmed/i);
 
     const selectedArticle = slotArticle(root!, 'selected-slot').textContent ?? '';
-    expect(selectedArticle).toContain('Request path: Competing paths');
-    expect(selectedArticle).toContain('Direct opportunity: Unrenderable candidate');
+    expect(selectedArticle).toContain('Request path: Multiple paths observed');
+    expect(selectedArticle).toContain('Auction evidence: TS auction: SPA server auction');
+    expect(selectedArticle).toContain('SPA page-bids request T0 → auction dispatched 0 ms');
+    expect(selectedArticle).toContain('SPA page-bids request T0 → auction collected 40 ms');
+    expect(selectedArticle).toContain('Server bid available; creative source incomplete');
     expect(selectedArticle).toContain('Trusted Server creative request observed at 23 ms');
     expect(selectedArticle).not.toContain('Trusted Server markup response sent');
-    expect(selectedArticle).toContain('Trusted Server selected; no markup response confirmed');
+    expect(selectedArticle).toContain(
+      'Server bid selected by the creative bridge; response not confirmed'
+    );
 
     const noCandidateArticle = slotArticle(root!, 'no-candidate-slot').textContent ?? '';
     expect(noCandidateArticle).toContain('Request path: Trusted Server direct');
     expect(noCandidateArticle).toContain('Direct opportunity: No candidate');
-    expect(noCandidateArticle).toContain(
-      'adInit observed no direct Trusted Server candidate for this request'
-    );
+    expect(noCandidateArticle).toContain('No direct Trusted Server candidate');
 
     const unattributedArticle = slotArticle(root!, 'unattributed-slot').textContent ?? '';
-    expect(unattributedArticle).toContain('Request path: Unattributed');
-    expect(unattributedArticle).toContain('Direct opportunity: Unknown (not observed)');
+    expect(unattributedArticle).toContain('Request path: Not observed');
+    expect(unattributedArticle).toContain('Direct opportunity: Not observed');
     expect(unattributedArticle).toContain(
-      'Delivery status unknown — required GPT or direct-candidate evidence was not observed'
+      'Delivery status unknown — required evidence was not observed'
     );
 
     const prebidArticle = slotArticle(root!, 'prebid-slot').textContent ?? '';
     expect(prebidArticle).toContain('Request path: Prebid refresh');
-    expect(prebidArticle).toContain('Direct opportunity: Unknown (not observed)');
-    expect(prebidArticle).toContain(
-      'Delivery status unknown — required GPT or direct-candidate evidence was not observed'
-    );
+    expect(prebidArticle).toContain('Prebid candidate price bucket: 2.40');
+    expect(prebidArticle).not.toContain('(currency not supplied)');
+    expect(prebidArticle).toContain('Direct opportunity: Not observed');
+    expect(prebidArticle).toContain('Delivery status unknown — required evidence was not observed');
 
     const unconfirmedArticle = slotArticle(root!, 'unconfirmed-slot').textContent ?? '';
     expect(unconfirmedArticle).toContain('Request path: Trusted Server direct');
-    expect(unconfirmedArticle).toContain('Direct opportunity: Renderable candidate');
-    expect(unconfirmedArticle).toContain(
-      'Trusted Server candidate unconfirmed — another GAM result or a creative/bridge failure is possible'
-    );
+    expect(unconfirmedArticle).toContain('Server bid available; creative source present');
+    expect(unconfirmedArticle).toContain('Server bid available; selection not confirmed');
 
     const pendingArticle = slotArticle(root!, 'candidate-pending-slot').textContent ?? '';
     expect(pendingArticle).toContain('Request path: Trusted Server direct');
-    expect(pendingArticle).toContain('Direct opportunity: Renderable candidate');
+    expect(pendingArticle).toContain('Server bid available; creative source present');
     expect(pendingArticle).toContain('Waiting for Trusted Server creative evidence');
 
     const notApplicableArticle = slotArticle(root!, 'not-applicable-slot').textContent ?? '';
     expect(notApplicableArticle).toContain('Request path: Trusted Server direct');
-    expect(notApplicableArticle).toContain('Direct opportunity: Renderable candidate');
+    expect(notApplicableArticle).toContain('Server bid available; creative source present');
     expect(notApplicableArticle).not.toMatch(
       /Trusted Server selected|candidate unconfirmed|no direct Trusted Server candidate|Delivery status unknown|Waiting for Trusted Server creative evidence/
     );
@@ -563,22 +631,41 @@ describe('GptDiagnosticsOverlay', () => {
     expect(root!.textContent).toContain('GPT observed');
     expect(root!.textContent).toContain('callback issues');
     expect(root!.textContent).toContain('attribution issues');
-    expect(root!.textContent).toContain('filled-slot');
+    expect(root!.textContent).toContain('Ad #1 · Request #2 · filled-slot');
     expect(root!.textContent).toContain('/example/site/filled-slot');
     expect(root!.textContent).toContain('Empty');
-    expect(root!.textContent).toContain('Previous requests (1)');
-    expect(root!.textContent).toContain('Requested slot sizes 300×250, 728×90, 320×50, 970×250');
-    expect(root!.textContent).toContain('GPT-reported fill size 300×250');
-    expect(root!.textContent).toContain('Observed outer slot box 320×270');
+    expect(root!.textContent).toContain('Request history (1 previous)');
+    expect(root!.textContent).toContain('Requested sizes 300×250, 728×90, 320×50, 970×250');
+    expect(root!.textContent).toContain('GPT-reported size 300×250');
+    expect(root!.textContent).toContain('Size filled 320×270');
     expect(root!.textContent).toContain('Backfill yes');
     expect(root!.textContent).toContain('GPT slot onload observed');
     expect(root!.textContent).toContain('GPT impressionViewable observed');
-    expect(root!.textContent).toContain('Request → response 10 ms');
+    expect(root!.textContent).toContain('GAM request → response 10 ms');
     expect(root!.textContent).toContain('GPT visibility 60%');
     expect(root!.textContent).toContain('Requesting');
-    expect(root!.textContent).toContain('Ambiguous binding');
+    expect(root!.textContent).toContain('Ambiguous binding · duplicate_dom_id');
+    expect(slotArticle(root!, 'filled-slot').textContent?.match(/Bound · Visible/g)).toHaveLength(
+      1
+    );
     expect(root!.textContent).toContain('Incomplete sequence');
-
+    expect(slotArticle(root!, 'pending-slot').textContent).toContain(
+      'Delivery evidence: Not applicable'
+    );
+    expect(slotArticle(root!, 'pending-slot').textContent).not.toContain(
+      'Served bidder not confirmed'
+    );
+    const emptySummary = slotArticle(root!, 'filled-slot').querySelector('.tsgd-group');
+    expect(emptySummary?.textContent).toContain('Delivery evidence: Not applicable');
+    expect(emptySummary?.textContent).not.toContain('Served bidder not confirmed');
+
+    expect(root!.textContent).toContain('How to read this evidence');
+    const dictionaryLink = root!.querySelector<HTMLAnchorElement>('a');
+    expect(dictionaryLink?.href).toBe(
+      'https://iabtechlab.github.io/trusted-server/guide/integrations/gpt-diagnostics-dictionary'
+    );
+    expect(dictionaryLink?.relList.contains('noopener')).toBe(true);
+    expect(dictionaryLink?.relList.contains('noreferrer')).toBe(true);
     button(root!, 'Export JSON').click();
     expect(exportSnapshot).toHaveBeenCalledTimes(1);
 
@@ -619,6 +706,177 @@ describe('GptDiagnosticsOverlay', () => {
     overlay.destroy();
   });
 
+  it.each(['prebid', 'unattributed'])(
+    'uses neutral server timing labels for a %s request without a server origin',
+    (requestKind) => {
+      const frames: Array<() => void> = [];
+      const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+      const diagnosticSlot = slot(`${requestKind}-without-server-origin`);
+      if (requestKind === 'prebid') {
+        store.recordPrebidRefresh([diagnosticSlot]);
+        store.recordPrebidAuction(diagnosticSlot, 'example-prebid-auction');
+      }
+      store.recordSlotRequested(diagnosticSlot);
+      let root: ShadowRoot | undefined;
+      const overlay = new GptDiagnosticsOverlay(store, new FakeBindings(), {
+        scheduleFrame: (callback) => frames.push(callback),
+        onShadowRoot: (createdRoot) => {
+          root = createdRoot;
+        },
+      });
+      runNextFrame(frames);
+      runNextFrame(frames);
+
+      const text = slotArticle(root!, `${requestKind}-without-server-origin`).textContent ?? '';
+      expect(text).toContain(
+        `Auction evidence: ${requestKind === 'prebid' ? 'Client-side Prebid auction' : 'Auction not observed'}`
+      );
+      for (const boundary of ['auction dispatched', 'auction collected', 'bids ready']) {
+        expect(text).toContain(`Server request T0 → ${boundary} Not applicable`);
+      }
+      expect(text).not.toContain('Initial document request T0');
+      expect(text).not.toContain('SPA page-bids request T0');
+      overlay.destroy();
+    }
+  );
+
+  it('labels unavailable SPA auction timing with the SPA request clock', () => {
+    const frames: Array<() => void> = [];
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    const diagnosticSlot = slot('spa-without-timings');
+    store.recordTrustedServerOpportunity(
+      diagnosticSlot,
+      'auction-spa-without-timings',
+      'renderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        winner: { bidder: 'example-bidder', priceBucket: '1.20' },
+      }
+    );
+    store.recordSlotRequested(diagnosticSlot);
+    let root: ShadowRoot | undefined;
+    const overlay = new GptDiagnosticsOverlay(store, new FakeBindings(), {
+      scheduleFrame: (callback) => frames.push(callback),
+      onShadowRoot: (createdRoot) => {
+        root = createdRoot;
+      },
+    });
+    runNextFrame(frames);
+    runNextFrame(frames);
+
+    expect(root?.textContent).toContain(
+      'SPA page-bids request T0 → auction dispatched Unavailable'
+    );
+    expect(root?.textContent).not.toContain(
+      'Initial document request T0 → auction dispatched Unavailable'
+    );
+    overlay.destroy();
+  });
+
+  it('announces an evicted request selection once and then clears it', () => {
+    const frames: Array<() => void> = [];
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    const diagnosticSlot = slot('evicted-selection');
+    store.recordSlotRequested(diagnosticSlot);
+    let root: ShadowRoot | undefined;
+    const overlay = new GptDiagnosticsOverlay(store, new FakeBindings(), {
+      scheduleFrame: (callback) => frames.push(callback),
+      onShadowRoot: (createdRoot) => {
+        root = createdRoot;
+      },
+    });
+    runNextFrame(frames);
+    runNextFrame(frames);
+
+    overlay.selectRequest(1, 1);
+    runNextFrame(frames);
+    let requestsToRecord = 10;
+    while (requestsToRecord > 0) {
+      store.recordSlotRequested(diagnosticSlot);
+      requestsToRecord -= 1;
+    }
+    runNextFrame(frames);
+
+    expect(root?.textContent).toContain('Ad #1, Request #1 is no longer retained.');
+    store.recordSlotResponseReceived(diagnosticSlot);
+    runNextFrame(frames);
+    expect(root?.textContent).not.toContain('Ad #1, Request #1 is no longer retained.');
+    overlay.destroy();
+  });
+
+  it('reveals an exact request and locates it without mutating publisher markup', () => {
+    const frames: Array<() => void> = [];
+    const store = new GptDiagnosticsStore({ schedule: (callback) => callback() });
+    const bindings = new FakeBindings();
+    const publisherSlot = document.createElement('div');
+    publisherSlot.id = 'locatable-slot';
+    publisherSlot.className = 'publisher-class';
+    publisherSlot.style.minHeight = '250px';
+    document.body.append(publisherSlot);
+    const originalMarkup = publisherSlot.outerHTML;
+    const scrollIntoView = vi.fn();
+    publisherSlot.scrollIntoView = scrollIntoView;
+    vi.spyOn(publisherSlot, 'getBoundingClientRect').mockReturnValue({
+      left: 10,
+      top: 20,
+      width: 300,
+      height: 250,
+    } as DOMRect);
+    const observedSlot = slot('locatable-slot');
+    store.recordSlotRequested(observedSlot);
+    store.recordSlotRequested(observedSlot);
+    bindings.set(1, { status: 'bound' }, publisherSlot, true);
+    let root: ShadowRoot | undefined;
+    const overlay = new GptDiagnosticsOverlay(store, bindings, {
+      scheduleFrame: (callback) => frames.push(callback),
+      onShadowRoot: (createdRoot) => {
+        root = createdRoot;
+      },
+    });
+    runNextFrame(frames);
+    runNextFrame(frames);
+
+    overlay.selectRequest(1, 2);
+    runNextFrame(frames);
+    const current = root?.querySelector<HTMLElement>('.tsgd-slot');
+    expect(current?.getAttribute('aria-current')).toBe('true');
+    expect(root?.activeElement).toBe(current);
+    expect(root?.querySelector<HTMLDetailsElement>('.tsgd-history')?.open).toBe(false);
+
+    overlay.selectRequest(1, 1);
+    runNextFrame(frames);
+    const selected = root?.querySelector<HTMLElement>(
+      '[data-runtime-slot="1"][data-request-number="1"]'
+    );
+    expect(selected?.getAttribute('aria-current')).toBe('true');
+    expect(root?.activeElement).toBe(selected);
+    expect(root?.textContent).toContain('Request history (1 previous)');
+    const focus = vi.spyOn(HTMLElement.prototype, 'focus');
+    selected?.focus();
+    const focusCallsBeforeUpdate = focus.mock.calls.length;
+    const history = root?.querySelector<HTMLDetailsElement>('.tsgd-history');
+    expect(history?.open).toBe(true);
+    if (history) history.open = false;
+
+    store.recordSlotResponseReceived(observedSlot);
+    runNextFrame(frames);
+    expect(focus.mock.calls.length).toBeGreaterThan(focusCallsBeforeUpdate);
+    expect(root?.querySelector<HTMLDetailsElement>('.tsgd-history')?.open).toBe(false);
+
+    button(root!, 'Locate on page').click();
+    expect(scrollIntoView).toHaveBeenCalledWith({
+      behavior: 'auto',
+      block: 'center',
+      inline: 'nearest',
+    });
+    runNextFrame(frames);
+    expect(root?.querySelector('.tsgd-highlight')).not.toBeNull();
+    expect(publisherSlot.outerHTML).toBe(originalMarkup);
+    overlay.destroy();
+  });
+
   it('does not remove a publisher element that collides with the host ID', async () => {
     const frames: Array<() => void> = [];
     const publisherElement = document.createElement('div');
@@ -665,14 +923,20 @@ describe('GptDiagnosticsOverlay', () => {
     runNextFrame(frames);
 
     const content = root!.querySelector<HTMLElement>('.tsgd-content')!;
-    const history = root!.querySelector<HTMLDetailsElement>('details')!;
+    const history = root!.querySelector<HTMLDetailsElement>('.tsgd-history')!;
+    const help = root!.querySelector<HTMLDetailsElement>('.tsgd-help')!;
+    const technical = root!.querySelector<HTMLDetailsElement>('.tsgd-technical')!;
     history.open = true;
+    help.open = true;
+    technical.open = true;
     content.scrollTop = 42;
     store.recordSlotResponseReceived(diagnosticSlot);
     runNextFrame(frames);
 
     expect(root!.textContent).toContain('Rendered (fill unknown)');
-    expect(root!.querySelector<HTMLDetailsElement>('details')?.open).toBe(true);
+    expect(root!.querySelector<HTMLDetailsElement>('.tsgd-history')?.open).toBe(true);
+    expect(root!.querySelector<HTMLDetailsElement>('.tsgd-help')?.open).toBe(true);
+    expect(root!.querySelector<HTMLDetailsElement>('.tsgd-technical')?.open).toBe(true);
     expect(root!.querySelector<HTMLElement>('.tsgd-content')?.scrollTop).toBe(42);
     overlay.destroy();
   });
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/prebid.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/prebid.test.ts
new file mode 100644
index 0000000000..0e4d6d25f6
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/prebid.test.ts
@@ -0,0 +1,205 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { GptDiagnosticsPrebidRecorder } from '../../../src/integrations/gpt_diagnostics/prebid';
+
+function fixture() {
+  let now = 0;
+  const target = { performance: { now: () => now }, tsjs: { navGeneration: 1 } };
+  const recorder = { recordPrebidAuction: vi.fn(), recordPrebidWin: vi.fn() };
+  const diagnostics = new GptDiagnosticsPrebidRecorder(target, recorder);
+  let listener: ((bid: unknown) => void) | undefined;
+  const prebid = {
+    onEvent: vi.fn((_event: 'bidWon', callback: (bid: unknown) => void) => {
+      listener = callback;
+    }),
+  };
+  const slot = {
+    getTargeting: (key: string) => (key === 'hb_bidder' ? ['client'] : ['1.20']),
+  };
+  return {
+    diagnostics,
+    recorder,
+    prebid,
+    slot,
+    target,
+    setNow: (value: number) => {
+      now = value;
+    },
+    win: (auctionId: string, adUnitCode = 'slot') =>
+      listener?.({
+        auctionId,
+        adUnitCode,
+        adserverTargeting: { hb_bidder: 'client', hb_pb: '1.20' },
+      }),
+  };
+}
+
+describe('optional Prebid diagnostics recorder', () => {
+  it('evicts the oldest attempt after 128 entries and consumes wins once', () => {
+    const f = fixture();
+    for (let index = 0; index < 129; index += 1) {
+      f.diagnostics.recordCompletedPrebidAuction(f.prebid, `auction-${index}`, [f.slot], ['slot']);
+    }
+    expect(f.prebid.onEvent).toHaveBeenCalledOnce();
+    f.win('auction-0');
+    expect(f.recorder.recordPrebidWin).not.toHaveBeenCalled();
+    f.win('auction-1');
+    f.win('auction-1');
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledExactlyOnceWith(f.slot, 'auction-1', {
+      bidder: 'client',
+      priceBucket: '1.20',
+    });
+  });
+
+  it('accepts the 30-second boundary, rejects expired and destroyed attempts', () => {
+    const f = fixture();
+    f.diagnostics.recordCompletedPrebidAuction(f.prebid, 'boundary', [f.slot], ['slot']);
+    f.diagnostics.recordCompletedPrebidAuction(f.prebid, 'expired', [f.slot], ['slot']);
+    f.setNow(30_000);
+    f.win('boundary');
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledOnce();
+    f.setNow(30_001);
+    f.win('expired');
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledOnce();
+    f.diagnostics.recordCompletedPrebidAuction(f.prebid, 'destroyed', [f.slot], ['slot']);
+    f.diagnostics.destroy();
+    f.win('destroyed');
+    f.diagnostics.recordCompletedPrebidAuction(f.prebid, 'later', [f.slot], ['slot']);
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledOnce();
+    expect(f.recorder.recordPrebidAuction).toHaveBeenCalledTimes(3);
+  });
+
+  it.each(['available', 'absent', 'throws'] as const)(
+    'releases its recorder on destroy and reinstalls with offEvent %s',
+    (unsubscribe) => {
+      const f = fixture();
+      const publisher = vi.fn();
+      const listeners = new Set<(bid: unknown) => void>([publisher]);
+      const offEvent = vi.fn((_event: 'bidWon', listener: (bid: unknown) => void) => {
+        if (unsubscribe === 'throws') throw new Error('unsubscribe failed');
+        listeners.delete(listener);
+      });
+      const prebid = {
+        onEvent: (_event: 'bidWon', listener: (bid: unknown) => void) => listeners.add(listener),
+        offEvent: unsubscribe === 'absent' ? undefined : offEvent,
+      };
+      f.diagnostics.recordCompletedPrebidAuction(prebid, 'old-auction', [f.slot], ['slot']);
+      const oldListener = [...listeners].find((listener) => listener !== publisher)!;
+      f.diagnostics.destroy();
+      f.diagnostics.destroy();
+      expect(Reflect.get(f.diagnostics, 'recorder')).toBeUndefined();
+      expect(listeners.has(publisher)).toBe(true);
+      expect(listeners.has(oldListener)).toBe(unsubscribe !== 'available');
+      if (unsubscribe !== 'absent') {
+        expect(offEvent).toHaveBeenCalledExactlyOnceWith('bidWon', oldListener);
+      }
+      oldListener({
+        auctionId: 'old-auction',
+        adUnitCode: 'slot',
+        adserverTargeting: { hb_bidder: 'client', hb_pb: '1.20' },
+      });
+      expect(f.recorder.recordPrebidWin).not.toHaveBeenCalled();
+
+      const currentRecorder = { recordPrebidAuction: vi.fn(), recordPrebidWin: vi.fn() };
+      const current = new GptDiagnosticsPrebidRecorder(f.target, currentRecorder);
+      current.recordCompletedPrebidAuction(prebid, 'new-auction', [f.slot], ['slot']);
+      for (const listener of listeners) {
+        listener({
+          auctionId: 'new-auction',
+          adUnitCode: 'slot',
+          adserverTargeting: { hb_bidder: 'client', hb_pb: '1.20' },
+        });
+      }
+      expect(publisher).toHaveBeenCalledOnce();
+      expect(f.recorder.recordPrebidWin).not.toHaveBeenCalled();
+      expect(currentRecorder.recordPrebidWin).toHaveBeenCalledExactlyOnceWith(
+        f.slot,
+        'new-auction',
+        {
+          bidder: 'client',
+          priceBucket: '1.20',
+        }
+      );
+      expect(listeners.size).toBe(unsubscribe === 'available' ? 2 : 3);
+      current.destroy();
+    }
+  );
+
+  it('continues cleanup on other exact instances after one offEvent throws', () => {
+    const f = fixture();
+    const failed = {
+      onEvent: vi.fn(),
+      offEvent: vi.fn(() => {
+        throw new Error('failed');
+      }),
+    };
+    const working = { onEvent: vi.fn(), offEvent: vi.fn() };
+    f.diagnostics.recordCompletedPrebidAuction(failed, 'failed', [f.slot], ['slot']);
+    f.diagnostics.recordCompletedPrebidAuction(working, 'working', [f.slot], ['slot']);
+    expect(() => f.diagnostics.destroy()).not.toThrow();
+    expect(failed.offEvent).toHaveBeenCalledExactlyOnceWith(
+      'bidWon',
+      failed.onEvent.mock.calls[0][1]
+    );
+    expect(working.offEvent).toHaveBeenCalledExactlyOnceWith(
+      'bidWon',
+      working.onEvent.mock.calls[0][1]
+    );
+  });
+
+  it('retries when the API arrives later and subscribes to the passed instance only', () => {
+    const f = fixture();
+    const delayed: { onEvent?: typeof f.prebid.onEvent } = {};
+    f.diagnostics.recordCompletedPrebidAuction(delayed, 'stub', [f.slot], ['slot']);
+    delayed.onEvent = f.prebid.onEvent;
+    f.diagnostics.recordCompletedPrebidAuction(delayed, 'ready', [f.slot], ['slot']);
+    f.diagnostics.recordCompletedPrebidAuction(delayed, 'ready-again', [f.slot], ['slot']);
+    expect(delayed.onEvent).toHaveBeenCalledOnce();
+    f.win('ready');
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledOnce();
+  });
+
+  it("does not let a different subscribed instance consume another instance's attempt", () => {
+    const f = fixture();
+    let otherWin: ((bid: unknown) => void) | undefined;
+    const other = {
+      onEvent: (_event: 'bidWon', listener: (bid: unknown) => void) => {
+        otherWin = listener;
+      },
+    };
+    f.diagnostics.recordCompletedPrebidAuction(f.prebid, 'shared-id', [f.slot], ['slot']);
+    f.diagnostics.recordCompletedPrebidAuction(other, 'shared-id', [f.slot], ['slot']);
+    f.win('shared-id');
+    expect(f.recorder.recordPrebidWin).not.toHaveBeenCalled();
+    otherWin?.({
+      auctionId: 'shared-id',
+      adUnitCode: 'slot',
+      adserverTargeting: { hb_bidder: 'client', hb_pb: '1.20' },
+    });
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledOnce();
+  });
+
+  it.each([undefined, '', ' padded ', 'é'.repeat(129)])(
+    'rejects invalid auction ID %s',
+    (auctionId) => {
+      const f = fixture();
+      f.diagnostics.recordCompletedPrebidAuction(f.prebid, auctionId, [f.slot], ['slot']);
+      expect(f.recorder.recordPrebidAuction).not.toHaveBeenCalled();
+      expect(f.prebid.onEvent).not.toHaveBeenCalled();
+    }
+  );
+
+  it.each([
+    { bidder: ['é'.repeat(65)], bucket: ['1.20'] },
+    { bidder: ['one', 'two'], bucket: ['1.20'] },
+    { bidder: ['client'], bucket: ['1'.repeat(65)] },
+    { bidder: ['client'], bucket: ['NaN'] },
+  ])('omits invalid targeting candidates without dropping the attempt', ({ bidder, bucket }) => {
+    const f = fixture();
+    const slot = { getTargeting: (key: string) => (key === 'hb_bidder' ? bidder : bucket) };
+    f.diagnostics.recordCompletedPrebidAuction(f.prebid, 'valid-id', [slot], ['slot']);
+    expect(f.recorder.recordPrebidAuction).toHaveBeenCalledWith(slot, 'valid-id', undefined);
+    f.win('valid-id');
+    expect(f.recorder.recordPrebidWin).toHaveBeenCalledOnce();
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts
index a357ecfc48..454becf720 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts
@@ -81,6 +81,7 @@ describe('GptDiagnosticsStore', () => {
         'no_candidate',
         marker,
         undefined,
+        undefined,
         {
           diagnostic_auction_id: AUCTION_TOKEN,
           slot_ref: SLOT_TOKEN,
@@ -105,6 +106,7 @@ describe('GptDiagnosticsStore', () => {
       'no_candidate',
       ` ${AUCTION_TOKEN} `,
       undefined,
+      { auctionType: 'ssat', serverTimings: { auctionResolvedMs: 84 } },
       {
         diagnostic_auction_id: AUCTION_TOKEN,
         slot_ref: SLOT_TOKEN,
@@ -112,7 +114,11 @@ describe('GptDiagnosticsStore', () => {
     );
     store.recordSlotRequested(slot);
     expect(onTraceCorrelation).toHaveBeenCalledOnce();
-    expect(store.snapshot().slots[0]!.requests[0]!.trustedServerAuctionId).toBe(AUCTION_TOKEN);
+    expect(store.snapshot().slots[0]!.requests[0]).toMatchObject({
+      trustedServerAuctionId: AUCTION_TOKEN,
+      auctionType: 'ssat',
+      serverAuctionTimings: { auctionResolvedMs: 84 },
+    });
   });
   it.each(['renderable_candidate', 'unrenderable_candidate', 'no_candidate'] as const)(
     'emits a trace identity only at the concrete %s request binding',
@@ -126,6 +132,7 @@ describe('GptDiagnosticsStore', () => {
         opportunity,
         AUCTION_TOKEN,
         [[300, 250]],
+        undefined,
         { diagnostic_auction_id: AUCTION_TOKEN, slot_ref: SLOT_TOKEN }
       );
       expect(onTraceCorrelation).not.toHaveBeenCalled();
@@ -168,6 +175,7 @@ describe('GptDiagnosticsStore', () => {
       'no_candidate',
       AUCTION_TOKEN,
       undefined,
+      undefined,
       identity
     );
     store.recordPrebidRefresh([slot]);
@@ -181,6 +189,7 @@ describe('GptDiagnosticsStore', () => {
       'no_candidate',
       AUCTION_TOKEN,
       undefined,
+      undefined,
       identity
     );
     now += REQUEST_PATH_ATTRIBUTION_WINDOW_MS;
@@ -202,6 +211,7 @@ describe('GptDiagnosticsStore', () => {
       'no_candidate',
       AUCTION_TOKEN,
       undefined,
+      undefined,
       identity
     );
     identity.slot_ref = 'private-mutated';
@@ -232,6 +242,7 @@ describe('GptDiagnosticsStore', () => {
       'no_candidate',
       undefined,
       undefined,
+      undefined,
       identity
     );
     store.recordSlotRequested(slot);
@@ -587,7 +598,7 @@ describe('GptDiagnosticsStore', () => {
     assertCoverageEquation(store);
   });
 
-  it('evicts least-recently-active slots and re-enters only on a new request', () => {
+  it('evicts least-recently-active slots and preserves their number on re-entry', () => {
     let now = 0;
     const store = new GptDiagnosticsStore({ now: () => ++now });
     const slots = Array.from({ length: MAX_DIAGNOSTIC_SLOTS + 1 }, (_, index) =>
@@ -611,7 +622,7 @@ describe('GptDiagnosticsStore', () => {
     store.recordSlotRequested(slots[1]);
     store.recordSlotResponseReceived(slots[1]);
     const reentered = store.snapshot().slots.find((slot) => slot.slotElementId === 'lru-1');
-    expect(reentered).toMatchObject({ runtimeSlotNumber: 66 });
+    expect(reentered).toMatchObject({ runtimeSlotNumber: 2 });
     expect(reentered?.requests[0]).toMatchObject({ requestNumber: 2 });
     expect(reentered?.requests[0].responseAtMs).toBeDefined();
     expect(store.snapshot().slots).toHaveLength(MAX_DIAGNOSTIC_SLOTS);
@@ -737,8 +748,10 @@ describe('GptDiagnosticsStore', () => {
       direct: 'renderable_candidate',
       prebid: false,
       publisher: false,
+      auctionFacts: { auctionType: 'trusted_server' as const },
       expectedPath: 'trusted_server_direct',
       expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: 'trusted_server' as const,
     },
     {
       name: 'a direct unrenderable candidate',
@@ -747,6 +760,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'trusted_server_direct',
       expectedOpportunity: 'unrenderable_candidate',
+      expectedAuctionType: undefined,
     },
     {
       name: 'a direct request without a candidate',
@@ -755,22 +769,28 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'trusted_server_direct',
       expectedOpportunity: 'no_candidate',
+      expectedAuctionType: undefined,
     },
     {
-      name: 'a Prebid refresh',
+      name: 'a completed Prebid auction',
       direct: undefined,
       prebid: true,
+      completedPrebid: true,
       publisher: false,
       expectedPath: 'prebid_refresh',
       expectedOpportunity: undefined,
+      expectedAuctionType: 'client_side' as const,
     },
     {
-      name: 'competing direct and Prebid evidence',
+      name: 'competing Trusted Server and Prebid auctions',
       direct: 'renderable_candidate',
       prebid: true,
+      completedPrebid: true,
       publisher: false,
+      auctionFacts: { auctionType: 'trusted_server' as const },
       expectedPath: 'competing',
       expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: 'competing' as const,
     },
     {
       name: 'an unattributed request',
@@ -779,6 +799,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'unattributed',
       expectedOpportunity: undefined,
+      expectedAuctionType: undefined,
     },
     {
       name: 'a publisher refresh',
@@ -787,14 +808,25 @@ describe('GptDiagnosticsStore', () => {
       publisher: true,
       expectedPath: 'publisher_refresh',
       expectedOpportunity: undefined,
+      expectedAuctionType: undefined,
+    },
+    {
+      name: 'direct auction with publisher refresh evidence',
+      direct: 'renderable_candidate',
+      prebid: false,
+      publisher: true,
+      expectedPath: 'competing',
+      expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: undefined,
     },
     {
-      name: 'competing Prebid and publisher evidence',
+      name: 'client-side auction with publisher refresh evidence',
       direct: undefined,
       prebid: true,
       publisher: true,
       expectedPath: 'competing',
       expectedOpportunity: undefined,
+      expectedAuctionType: undefined,
     },
     {
       name: 'competing all source evidence',
@@ -803,26 +835,222 @@ describe('GptDiagnosticsStore', () => {
       publisher: true,
       expectedPath: 'competing',
       expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: undefined,
     },
   ] as const)(
     'attributes $name without inferring demand ownership',
-    ({ direct, prebid, publisher, expectedPath, expectedOpportunity }) => {
+    ({
+      direct,
+      prebid,
+      completedPrebid,
+      publisher,
+      auctionFacts,
+      expectedPath,
+      expectedOpportunity,
+      expectedAuctionType,
+    }) => {
       const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
       const slot = fakeSlot('path-slot');
 
       if (direct !== undefined) {
-        store.recordTrustedServerOpportunity(slot, 'auction-slot', direct);
+        store.recordTrustedServerOpportunity(
+          slot,
+          'auction-slot',
+          direct,
+          undefined,
+          undefined,
+          auctionFacts
+        );
       }
       if (prebid) store.recordPrebidRefresh([slot]);
+      if (completedPrebid) store.recordPrebidAuction(slot, 'path-auction');
       if (publisher) store.recordPublisherRefresh([slot]);
       store.recordSlotRequested(slot);
 
       const cycle = store.snapshot().slots[0].requests[0];
       expect(cycle.requestPath).toBe(expectedPath);
       expect(cycle.trustedServerOpportunity).toBe(expectedOpportunity);
+      expect(cycle.auctionType).toBe(expectedAuctionType);
     }
   );
 
+  it('retains a completed Prebid candidate and only an exact correlated win', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('prebid-facts');
+
+    store.recordPrebidRefresh([slot]);
+    store.recordPrebidAuction(slot, 'auction-client-1', {
+      bidder: ' example-client ',
+      priceBucket: '2.40',
+      currency: 'eur',
+    });
+    store.recordSlotRequested(slot);
+    store.recordPrebidWin(slot, 'other-auction', {
+      bidder: 'wrong',
+      priceBucket: '9.99',
+    });
+    store.recordPrebidWin(slot, 'auction-client-1', {
+      bidder: ' example-client ',
+      priceBucket: '2.40',
+      currency: 'eur',
+    });
+
+    expect(store.snapshot().slots[0].requests[0]).toMatchObject({
+      auctionType: 'client_side',
+      prebidAuction: {
+        auctionId: 'auction-client-1',
+        targetingCandidate: {
+          bidder: 'example-client',
+          priceBucket: '2.40',
+          currency: 'EUR',
+        },
+        win: { bidder: 'example-client', priceBucket: '2.40', currency: 'EUR' },
+      },
+    });
+  });
+
+  it('drops a Prebid win when the same auction ID matches multiple retained cycles', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('prebid-ambiguous-auction');
+
+    store.recordPrebidAuction(slot, 'reused-auction-id', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+    store.recordSlotRequested(slot);
+    store.recordPrebidAuction(slot, 'reused-auction-id', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+    store.recordSlotRequested(slot);
+
+    store.recordPrebidWin(slot, 'reused-auction-id', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+
+    expect(store.snapshot().slots[0].requests).toHaveLength(2);
+    expect(store.snapshot().slots[0].requests.map((cycle) => cycle.prebidAuction?.win)).toEqual([
+      undefined,
+      undefined,
+    ]);
+  });
+
+  it('does not carry an earlier auction into a later bare Prebid refresh', () => {
+    let now = 10;
+    const store = new GptDiagnosticsStore({ now: () => now, defer: () => undefined });
+    const slot = fakeSlot('prebid-replaced-intent');
+    store.recordPrebidRefresh([slot]);
+    store.recordPrebidAuction(slot, 'auction-client-1', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+
+    now = 20;
+    store.recordPrebidRefresh([slot]);
+    store.recordSlotRequested(slot);
+    store.recordPrebidWin(slot, 'auction-client-1', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+
+    const cycle = store.snapshot().slots[0].requests[0];
+    expect(cycle.requestPath).toBe('prebid_refresh');
+    expect(cycle.auctionType).toBeUndefined();
+    expect(cycle.prebidAuction).toBeUndefined();
+  });
+
+  it('retains bounded winner and server timing facts for a Trusted Server auction', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('auction-facts');
+
+    store.recordTrustedServerOpportunity(
+      slot,
+      'auction-slot',
+      'renderable_candidate',
+      'auction-123',
+      [[300, 250]],
+      {
+        auctionType: 'trusted_server',
+        winner: { bidder: ' example-bidder ', priceBucket: '1.20' },
+        serverTimings: {
+          auctionDispatchedMs: 4,
+          auctionResolvedMs: 84,
+          auctionCommittedMs: 85,
+          auctionWaitMs: 80,
+          auctionWaitPlacement: 'pre_header',
+        },
+      }
+    );
+    store.recordSlotRequested(slot);
+
+    expect(store.snapshot().slots[0].requests[0]).toMatchObject({
+      auctionType: 'trusted_server',
+      auctionWinner: { bidder: 'example-bidder', priceBucket: '1.20' },
+      serverAuctionTimings: {
+        auctionDispatchedMs: 4,
+        auctionResolvedMs: 84,
+        auctionCommittedMs: 85,
+        auctionWaitMs: 80,
+        auctionWaitPlacement: 'pre_header',
+      },
+    });
+  });
+
+  it('does not treat a Prebid refresh route as client-auction evidence', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('competing-spa-auction');
+
+    store.recordTrustedServerOpportunity(
+      slot,
+      'auction-slot',
+      'renderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        serverTimings: { auctionDispatchedMs: 0, auctionResolvedMs: 84 },
+      }
+    );
+    store.recordPrebidRefresh([slot]);
+    store.recordSlotRequested(slot);
+
+    expect(store.snapshot().slots[0].requests[0]).toMatchObject({
+      auctionType: 'trusted_server',
+      serverAuctionTimingOrigin: 'spa_auction',
+      serverAuctionTimings: { auctionDispatchedMs: 0, auctionResolvedMs: 84 },
+    });
+  });
+
+  it('drops malformed winner and auction timing fields at the diagnostics boundary', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('invalid-auction-facts');
+
+    store.recordTrustedServerOpportunity(
+      slot,
+      'auction-slot',
+      'renderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'invalid' as never,
+        winner: { bidder: 'example-bidder', priceBucket: 'not-a-price' },
+        serverTimings: {
+          auctionDispatchedMs: -1,
+          auctionResolvedMs: Number.NaN,
+          auctionCommittedMs: 0x1_0000_0000,
+          auctionWaitPlacement: 'elsewhere' as never,
+        },
+      }
+    );
+    store.recordSlotRequested(slot);
+
+    const cycle = store.snapshot().slots[0].requests[0];
+    expect(cycle.auctionType).toBeUndefined();
+    expect(cycle.auctionWinner).toBeUndefined();
+    expect(cycle.serverAuctionTimings).toBeUndefined();
+  });
+
   it('consumes direct and Prebid markers exactly once', () => {
     let now = 10;
     const store = new GptDiagnosticsStore({ now: () => now, defer: () => undefined });
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts
index f4f4c74864..5ac0044570 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts
@@ -81,6 +81,9 @@ describe('GPT diagnostics public types', () => {
     expectTypeOf<keyof GptDiagnosticsRecorder>().toEqualTypeOf<
       | 'recordTrustedServerOpportunity'
       | 'recordPrebidRefresh'
+      | 'recordCompletedPrebidAuction'
+      | 'recordPrebidAuction'
+      | 'recordPrebidWin'
       | 'recordTrustedServerCreativeRequest'
       | 'recordTrustedServerCreativeResponse'
       | 'recordTrustedServerCreativeFailure'
diff --git a/crates/trusted-server-js/lib/test/integrations/lockr/script_guard.test.ts b/crates/trusted-server-js/lib/test/integrations/lockr/script_guard.test.ts
index 2f53c06b27..a32fae8c0e 100644
--- a/crates/trusted-server-js/lib/test/integrations/lockr/script_guard.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/lockr/script_guard.test.ts
@@ -67,6 +67,20 @@ describe('Lockr SDK Script Interception Guard', () => {
   });
 
   describe('appendChild interception', () => {
+    it.each([
+      'https://notaim.loc.kr/identity-lockr.js', // allow-domain: notaim.loc.kr
+      'https://notidentity.loc.kr/identity-lockr.js', // allow-domain: notidentity.loc.kr
+    ])('should require an exact Lockr hostname for %s', (url) => {
+      installLockrGuard();
+
+      const script = document.createElement('script');
+      script.setAttribute('src', url);
+      document.head.appendChild(script);
+
+      expect(script.getAttribute('src')).toBe(url);
+      script.remove();
+    });
+
     it('should rewrite Lockr SDK URL from aim.loc.kr', () => {
       installLockrGuard();
 
diff --git a/crates/trusted-server-js/lib/test/integrations/lockr/url_collision.test.ts b/crates/trusted-server-js/lib/test/integrations/lockr/url_collision.test.ts
new file mode 100644
index 0000000000..92f8a54f3e
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/lockr/url_collision.test.ts
@@ -0,0 +1,149 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import {
+  installDataDomeGuard,
+  resetGuardState as resetDataDomeGuard,
+} from '../../../src/integrations/datadome/script_guard';
+import {
+  installGtmGuard,
+  resetGuardState as resetGtmGuard,
+} from '../../../src/integrations/google_tag_manager/script_guard';
+import {
+  installGptGuard,
+  resetGuardState as resetGptGuard,
+} from '../../../src/integrations/gpt/script_guard';
+import {
+  installLockrGuard,
+  resetGuardState as resetLockrGuard,
+} from '../../../src/integrations/lockr/script_guard';
+import {
+  installPermutiveGuard,
+  resetGuardState as resetPermutiveGuard,
+} from '../../../src/integrations/permutive/script_guard';
+import {
+  installSourcepointGuard,
+  resetGuardState as resetSourcepointGuard,
+} from '../../../src/integrations/sourcepoint/script_guard';
+import {
+  type DomInsertionHandler,
+  resetDomInsertionDispatcherForTests,
+} from '../../../src/shared/dom_insertion_dispatcher';
+import fixture from '../../fixtures/sdk-url-ownership.json';
+
+interface UrlCase {
+  name: string;
+  url: string;
+  owner: string | null;
+  insertionOwner?: string;
+}
+
+const corpus: UrlCase[] = fixture;
+const nativeSetAttribute = Element.prototype.setAttribute;
+
+function resetGuards(): void {
+  resetGptGuard();
+  resetDataDomeGuard();
+  resetGtmGuard();
+  resetLockrGuard();
+  resetPermutiveGuard();
+  resetSourcepointGuard();
+  resetDomInsertionDispatcherForTests();
+}
+
+function dispatcherState(): { orderedHandlers: DomInsertionHandler[] } {
+  return (globalThis as Record<PropertyKey, unknown>)[
+    Symbol.for('trusted-server.domInsertionDispatcher')
+  ] as { orderedHandlers: DomInsertionHandler[] };
+}
+
+function expectedSrc({ url, owner, insertionOwner }: UrlCase): string {
+  // jsdom's http: page resolves https: shorthand to an absolute vendor URL before insertion;
+  // on an https: page the same input would resolve to a same-origin path and stay unowned.
+  const actualOwner = insertionOwner ?? owner;
+  if (!actualOwner) return url;
+  const origin = window.location.origin;
+  if (actualOwner === 'lockr' || actualOwner === 'permutive') {
+    return `${origin}/integrations/${actualOwner}/sdk`;
+  }
+  const parsed = new URL(url, window.location.href);
+  const prefix = actualOwner === 'sourcepoint' ? 'sourcepoint/cdn' : actualOwner;
+  const fragment = actualOwner === 'gpt' ? parsed.hash : '';
+  return `${origin}/integrations/${prefix}${parsed.pathname}${parsed.search}${fragment}`;
+}
+
+describe.each(['normal order', 'Lockr first'])('SDK URL ownership with %s', (order) => {
+  beforeEach(() => {
+    resetGuards();
+    installPermutiveGuard();
+    installLockrGuard();
+    installSourcepointGuard();
+    installGtmGuard();
+    installDataDomeGuard();
+    installGptGuard();
+
+    if (order === 'Lockr first') {
+      // Change real dispatch order, not installation order, only for this test.
+      dispatcherState().orderedHandlers.sort(
+        (left, right) => Number(right.id === 'lockr') - Number(left.id === 'lockr')
+      );
+    }
+  });
+
+  afterEach(resetGuards);
+
+  it('installs all six guards', () => {
+    expect(
+      dispatcherState()
+        .orderedHandlers.map(({ id }) => id)
+        .sort()
+    ).toEqual(['datadome', 'google_tag_manager', 'gpt', 'lockr', 'permutive', 'sourcepoint']);
+  });
+
+  it.each(corpus)('$name has only its expected raw claimant', ({ url, owner }) => {
+    const claimants = dispatcherState()
+      .orderedHandlers.filter((handler) => {
+        // Do not set src: GPT's assignment patch would hide its raw ownership.
+        const element = document.createElement('script');
+        return handler.handle({ element, kind: 'script', url });
+      })
+      .map(({ id }) => id);
+
+    expect(claimants).toEqual(owner ? [owner] : []);
+  });
+
+  describe.each(['script.src', 'native setAttribute'])('insertion through %s', (mode) => {
+    it.each(corpus)('leaves $name to its owner', (row) => {
+      const script = document.createElement('script');
+      if (mode === 'script.src') {
+        script.src = row.url;
+      } else {
+        nativeSetAttribute.call(script, 'src', row.url);
+      }
+      document.head.appendChild(script);
+      expect(script.getAttribute('src')).toBe(expectedSrc(row));
+      script.remove();
+    });
+  });
+
+  describe.each(['preload', 'prefetch'])('%s script links', (rel) => {
+    describe.each(['appendChild', 'insertBefore'])('through %s', (method) => {
+      const affectedCases = corpus.filter(
+        ({ owner }) => owner === null || owner === 'lockr' || owner === 'permutive'
+      );
+
+      it.each(affectedCases)('leaves $name to its owner', (row) => {
+        const link = document.createElement('link');
+        link.setAttribute('rel', rel);
+        link.setAttribute('as', 'script');
+        link.href = row.url;
+        if (method === 'appendChild') {
+          document.head.appendChild(link);
+        } else {
+          document.head.insertBefore(link, null);
+        }
+        expect(link.getAttribute('href')).toBe(expectedSrc(row));
+        link.remove();
+      });
+    });
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/eids.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/eids.test.ts
new file mode 100644
index 0000000000..399d07a4fe
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/eids.test.ts
@@ -0,0 +1,602 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { describe, expect, it } from 'vitest';
+
+import {
+  collectBidderEids,
+  decodeEidCookie,
+  fitEidCookie,
+  MAX_AUCTION_EIDS_BYTES,
+  MAX_EID_COOKIE_BYTES,
+  mergeEidCookieEntries,
+  type EidCollectionStats,
+} from '../../../src/integrations/prebid/eids';
+import { FIXTURE_EIDS } from '../../fixtures/eid-fixture-input';
+
+function deepFreeze<T>(value: T, seen = new WeakSet<object>()): T {
+  if (value !== null && typeof value === 'object' && !seen.has(value)) {
+    seen.add(value);
+    for (const child of Object.values(value)) {
+      deepFreeze(child, seen);
+    }
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/** A bidder request shaped as Prebid passes it: frozen `ortb2`, `auctionId` hidden. */
+function bidderRequest(user: unknown): unknown {
+  return deepFreeze({
+    bidderCode: 'trustedServer',
+    auctionId: null,
+    ortb2: { user },
+  });
+}
+
+function freshStats(): EidCollectionStats {
+  return { forwarded: 0, unserializable: 0, overBudget: 0 };
+}
+
+function utf8Length(text: string): number {
+  return new TextEncoder().encode(text).length;
+}
+
+/** An entry whose `JSON.stringify` is exactly `bytes` UTF-8 bytes long. */
+function entryOfBytes(source: string, bytes: number, filler = 'x'): unknown {
+  const base = JSON.stringify({ source, uids: [{ id: '' }] });
+  const fillerBytes = utf8Length(filler);
+  return {
+    source,
+    uids: [{ id: filler.repeat((bytes - utf8Length(base)) / fillerBytes) }],
+  };
+}
+
+function decodeCookie(value: string | undefined): unknown {
+  expect(value, 'should produce a cookie value').toBeDefined();
+  return JSON.parse(
+    new TextDecoder().decode(Uint8Array.from(atob(value!), (char) => char.charCodeAt(0)))
+  );
+}
+
+function readFixture(name: string): string {
+  return fs
+    .readFileSync(
+      path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../fixtures', name),
+      'utf8'
+    )
+    .trimEnd();
+}
+
+const EXT_EID = {
+  source: 'ext.example.com',
+  uids: [{ id: 'ext-uid', atype: 1 }],
+};
+const USER_EID = {
+  source: 'user.example.com',
+  uids: [{ id: 'user-uid', atype: 1 }],
+};
+
+describe('collectBidderEids', () => {
+  it('reads ortb2.user.ext.eids', () => {
+    expect(collectBidderEids(bidderRequest({ ext: { eids: [EXT_EID] } }))).toEqual([EXT_EID]);
+  });
+
+  it('reads ortb2.user.eids, where RTD modules can write after normalization', () => {
+    expect(collectBidderEids(bidderRequest({ eids: [USER_EID] }))).toEqual([USER_EID]);
+  });
+
+  it('reads user.ext.eids before user.eids', () => {
+    const request = bidderRequest({
+      ext: { eids: [EXT_EID] },
+      eids: [USER_EID],
+    });
+    expect(
+      Object.isFrozen((request as { ortb2: { user: object } }).ortb2.user),
+      'the input should be frozen as Prebid passes it'
+    ).toBe(true);
+
+    expect(collectBidderEids(request)).toEqual([EXT_EID, USER_EID]);
+  });
+
+  it.each([
+    ['no user', bidderRequest(undefined)],
+    ['an empty user', bidderRequest({})],
+    ['non-array paths', bidderRequest({ ext: { eids: 'x' }, eids: { source: 'x' } })],
+    ['no ortb2', deepFreeze({ bidderCode: 'trustedServer' })],
+  ])('returns undefined for %s', (_label, request) => {
+    expect(collectBidderEids(request)).toBeUndefined();
+  });
+
+  it.each([undefined, null, 'request', 7])(
+    'returns undefined for a bidder request that is not an object: %s',
+    (request) => {
+      expect(collectBidderEids(request)).toBeUndefined();
+    }
+  );
+
+  it('returns plain-data copies without undefined fields', () => {
+    const openPair = {
+      source: 'openpair.example.com',
+      inserter: undefined,
+      matcher: undefined,
+      mm: 3,
+      uids: [{ id: 'pair-uid', atype: 571187 }],
+    };
+
+    const result = collectBidderEids(bidderRequest({ ext: { eids: [openPair] } }));
+
+    expect(result, 'undefined provenance fields should disappear').toStrictEqual([
+      {
+        source: 'openpair.example.com',
+        mm: 3,
+        uids: [{ id: 'pair-uid', atype: 571187 }],
+      },
+    ]);
+    expect(result![0], 'the result should be a copy, not Prebid’s object').not.toBe(openPair);
+  });
+
+  it('drops an entry whose serialization throws and keeps the others', () => {
+    const circular: Record<string, unknown> = {};
+    circular.self = circular;
+    const stats = freshStats();
+
+    const result = collectBidderEids(
+      bidderRequest({
+        ext: {
+          eids: [
+            EXT_EID,
+            {
+              source: 'circular.example.com',
+              ext: circular,
+              uids: [{ id: 'c' }],
+            },
+            {
+              source: 'bigint.example.com',
+              uids: [{ id: 'b', atype: BigInt(10) }],
+            },
+            USER_EID,
+          ],
+        },
+      }),
+      stats
+    );
+
+    expect(result).toEqual([EXT_EID, USER_EID]);
+    expect(stats).toEqual({ forwarded: 2, unserializable: 2, overBudget: 0 });
+  });
+
+  it('keeps a set that fits the UTF-8 budget exactly', () => {
+    const first = entryOfBytes('first.example.com', MAX_AUCTION_EIDS_BYTES - 100);
+    const second = entryOfBytes('second.example.com', 100);
+    const stats = freshStats();
+
+    expect(collectBidderEids(bidderRequest({ ext: { eids: [first, second] } }), stats)).toEqual([
+      first,
+      second,
+    ]);
+    expect(stats).toEqual({ forwarded: 2, unserializable: 0, overBudget: 0 });
+  });
+
+  it('drops the entry that crosses the budget and every entry after it', () => {
+    const first = entryOfBytes('first.example.com', MAX_AUCTION_EIDS_BYTES - 100);
+    const second = entryOfBytes('second.example.com', 101);
+    const third = entryOfBytes('third.example.com', 60);
+    const stats = freshStats();
+
+    expect(
+      collectBidderEids(bidderRequest({ ext: { eids: [first, second, third] } }), stats)
+    ).toEqual([first]);
+    expect(stats).toEqual({ forwarded: 1, unserializable: 0, overBudget: 2 });
+  });
+
+  it('measures the budget in UTF-8 bytes, not JavaScript string length', () => {
+    const ascii = entryOfBytes('ascii.example.com', 40_000);
+    // `€` is one UTF-16 code unit and three UTF-8 bytes: 53 bytes of JSON
+    // around 10,000 of them.
+    const multibyte = entryOfBytes('multibyte.example.com', 30_053, '€');
+    expect(
+      JSON.stringify(ascii).length + JSON.stringify(multibyte).length,
+      'precondition: the set fits by JavaScript length'
+    ).toBeLessThan(MAX_AUCTION_EIDS_BYTES);
+
+    expect(collectBidderEids(bidderRequest({ ext: { eids: [ascii, multibyte] } }))).toEqual([
+      ascii,
+    ]);
+  });
+
+  it('keeps order and repeated sources', () => {
+    const a1 = { source: 'a.example.com', mm: 1, uids: [{ id: 'u' }] };
+    const b = { source: 'b.example.com', uids: [{ id: 'u' }] };
+    const a2 = { source: 'a.example.com', mm: 2, uids: [{ id: 'u' }] };
+
+    expect(collectBidderEids(bidderRequest({ ext: { eids: [a1, b, a2] } }))).toEqual([a1, b, a2]);
+  });
+
+  it('forwards a lone surrogate unchanged for the server to drop', () => {
+    const result = collectBidderEids(bidderRequest({ ext: { eids: FIXTURE_EIDS } }));
+
+    expect(result).toEqual(FIXTURE_EIDS);
+    expect(JSON.stringify(result), 'JSON.stringify should write the escape').toContain(
+      '"bad-\\ud800-uid"'
+    );
+  });
+
+  it('passes the Prebid module shapes from spec 3.5 through as plain data', () => {
+    const fiftyOneDegrees = [
+      { source: '51d.es', mm: 1, uids: [{ id: 'device-1', atype: 1 }] },
+      { source: '51d.es', mm: 2, uids: [{ id: 'device-2', atype: 1 }] },
+    ];
+    const openPair = {
+      source: 'openpair.example.com',
+      inserter: undefined,
+      matcher: undefined,
+      uids: [{ id: 'p' }],
+    };
+    const liveIntent = {
+      source: 'liveintent.com',
+      ext: { segments: ['s1', 's2'] },
+      uids: [{ id: 'li', atype: 3 }],
+    };
+    const oneKey = {
+      source: 'paf.example.com',
+      ext: { preferences: { use_browsing_for_personalization: true } },
+      uids: [{ id: 'ok', atype: 1 }],
+    };
+    const pair = {
+      source: 'google.com',
+      uids: [{ id: 'pair-id', atype: 571187 }],
+    };
+
+    const result = collectBidderEids(
+      bidderRequest({
+        ext: { eids: [openPair, liveIntent, oneKey, pair] },
+        eids: fiftyOneDegrees,
+      })
+    );
+
+    expect(result).toStrictEqual([
+      { source: 'openpair.example.com', uids: [{ id: 'p' }] },
+      liveIntent,
+      oneKey,
+      pair,
+      ...fiftyOneDegrees,
+    ]);
+  });
+});
+
+describe('mergeEidCookieEntries', () => {
+  const registered = new Set(['a.example.com', 'b.example.com', 'c.example.com']);
+  const entry = (source: string, id: string) => ({ source, uids: [{ id, atype: 1 }] });
+
+  it('keeps only registered sources from both sets', () => {
+    const merged = mergeEidCookieEntries(
+      [entry('a.example.com', 'a1'), entry('media.example.com', 'm1')],
+      [entry('b.example.com', 'b0'), entry('other.example.com', 'o0')],
+      registered
+    );
+
+    expect(merged, 'unregistered sources should never reach the cookie').toEqual([
+      entry('a.example.com', 'a1'),
+      entry('b.example.com', 'b0'),
+    ]);
+  });
+
+  it('lets the request replace the cookie entry for the same source', () => {
+    const merged = mergeEidCookieEntries(
+      [entry('a.example.com', 'new')],
+      [entry('a.example.com', 'old'), entry('c.example.com', 'c0')],
+      registered
+    );
+
+    expect(merged, 'the request should win per source').toEqual([
+      entry('a.example.com', 'new'),
+      entry('c.example.com', 'c0'),
+    ]);
+  });
+
+  it('keeps every entry the request has for a repeated source', () => {
+    const first = { source: 'a.example.com', inserter: 'one.example.com', uids: [{ id: 'a1' }] };
+    const second = { source: 'a.example.com', inserter: 'two.example.com', uids: [{ id: 'a2' }] };
+
+    const merged = mergeEidCookieEntries(
+      [first, second],
+      [entry('a.example.com', 'old')],
+      registered
+    );
+
+    expect(merged, 'both request entries should stay, the old one should go').toEqual([
+      first,
+      second,
+    ]);
+  });
+
+  it('keeps the cookie sources when the request has no EIDs', () => {
+    const previous = [entry('a.example.com', 'a0'), entry('b.example.com', 'b0')];
+
+    expect(mergeEidCookieEntries([], previous, registered)).toEqual(previous);
+  });
+
+  it('matches sources after lowercasing and removing a trailing dot', () => {
+    const merged = mergeEidCookieEntries(
+      [entry('A.Example.com.', 'a1')],
+      [entry('a.example.com', 'a0')],
+      registered
+    );
+
+    expect(merged, 'the spellings should name one source').toEqual([entry('A.Example.com.', 'a1')]);
+  });
+
+  it('drops malformed cookie entries and keeps nothing without registered sources', () => {
+    const legacy = { source: 'b.example.com', id: 'flat', atype: 1 };
+
+    expect(mergeEidCookieEntries([], [legacy, null, 'x'], registered)).toEqual([]);
+    expect(mergeEidCookieEntries([entry('a.example.com', 'a1')], [], new Set())).toEqual([]);
+  });
+
+  it('puts the request entries first, then the kept cookie entries in cookie order', () => {
+    const merged = mergeEidCookieEntries(
+      [entry('c.example.com', 'c1'), entry('a.example.com', 'a1')],
+      [entry('b.example.com', 'b0'), entry('a.example.com', 'a0'), entry('c.example.com', 'c0')],
+      registered
+    );
+
+    expect(merged, 'request order first, then the cookie sources the request lacks').toEqual([
+      entry('c.example.com', 'c1'),
+      entry('a.example.com', 'a1'),
+      entry('b.example.com', 'b0'),
+    ]);
+  });
+
+  it('keeps every cookie entry of a repeated source the request lacks', () => {
+    const first = { source: 'b.example.com', inserter: 'one.example.com', uids: [{ id: 'b1' }] };
+    const second = { source: 'b.example.com', inserter: 'two.example.com', uids: [{ id: 'b2' }] };
+
+    const merged = mergeEidCookieEntries([], [first, second], registered);
+
+    expect(merged, 'both cookie entries for the source should stay').toEqual([first, second]);
+  });
+
+  it('matches a source with surrounding whitespace', () => {
+    const merged = mergeEidCookieEntries(
+      [entry(' a.example.com ', 'a1')],
+      [entry('a.example.com', 'a0')],
+      registered
+    );
+
+    expect(merged, 'whitespace should not make a second source').toEqual([
+      entry(' a.example.com ', 'a1'),
+    ]);
+  });
+
+  it.each([
+    ['a missing source', { uids: [{ id: 'x' }] }],
+    ['a numeric source', { source: 42, uids: [{ id: 'x' }] }],
+    ['an empty source', { source: '', uids: [{ id: 'x' }] }],
+    ['an array', [{ source: 'a.example.com' }]],
+    ['null', null],
+  ])('drops a request entry with %s', (_label, bad) => {
+    expect(mergeEidCookieEntries([bad], [], registered)).toEqual([]);
+  });
+
+  it('drops a cookie entry whose uids is not an array', () => {
+    const notArray = { source: 'b.example.com', uids: { id: 'b0' } };
+
+    expect(mergeEidCookieEntries([], [notArray], registered)).toEqual([]);
+  });
+
+  it('a registered source does not match a subdomain or a parent domain', () => {
+    const merged = mergeEidCookieEntries(
+      [entry('sub.a.example.com', 's1'), entry('example.com', 'p1')],
+      [],
+      registered
+    );
+
+    expect(merged, 'only the exact registered domain should match').toEqual([]);
+  });
+
+  it('when the merge overflows the cookie, trims kept cookie entries before request ones', () => {
+    const big = (source: string, id: string) => ({
+      source,
+      uids: [{ id: id + 'x'.repeat(900), atype: 1 }],
+    });
+    const current = [big('a.example.com', 'fresh-a'), big('b.example.com', 'fresh-b')];
+    const previous = [big('c.example.com', 'stale-c'), big('a.example.com', 'stale-a')];
+
+    const fitted = fitEidCookie(mergeEidCookieEntries(current, previous, registered));
+    const sources = decodeEidCookie(fitted.value).map(
+      (kept) => (kept as { source: string }).source
+    );
+
+    expect(sources, 'the fresh request sources should survive the trim').toEqual([
+      'a.example.com',
+      'b.example.com',
+    ]);
+  });
+
+  it('does not modify its inputs', () => {
+    const current = [entry('a.example.com', 'a1')];
+    const previous = [entry('b.example.com', 'b0')];
+    const snapshot = structuredClone([current, previous]);
+
+    mergeEidCookieEntries(current, previous, registered);
+
+    expect([current, previous]).toEqual(snapshot);
+  });
+});
+
+describe('decodeEidCookie', () => {
+  it('round-trips a value fitEidCookie wrote, including non-Latin-1 text', () => {
+    const entries = [{ source: 'a.example.com', inserter: 'inserter-€', uids: [{ id: '日本' }] }];
+
+    expect(decodeEidCookie(fitEidCookie(entries).value)).toEqual(entries);
+  });
+
+  it.each([
+    ['absent', undefined],
+    ['empty', ''],
+    ['not base64', '%%%'],
+    ['not JSON', btoa('not json')],
+    ['not an array', btoa('{"source":"a.example.com"}')],
+  ])('returns no entries when the value is %s', (_label, value) => {
+    expect(decodeEidCookie(value)).toEqual([]);
+  });
+});
+
+describe('fitEidCookie', () => {
+  it('removes EID-level ext and drops the duplicates that creates, comparing with sorted keys', () => {
+    const withExt = {
+      source: 'a.example.com',
+      ext: { segments: ['s1'] },
+      uids: [{ id: 'a' }],
+    };
+    const reordered = { uids: [{ id: 'a' }], source: 'a.example.com' };
+    const other = {
+      source: 'b.example.com',
+      uids: [{ id: 'b', ext: { kept: true } }],
+    };
+
+    const fitted = fitEidCookie([withExt, reordered, other]);
+
+    expect(decodeCookie(fitted.value)).toEqual([
+      { source: 'a.example.com', uids: [{ id: 'a' }] },
+      other,
+    ]);
+    expect(fitted.droppedSources).toEqual([]);
+    expect(fitted.trimmedSources).toEqual([]);
+  });
+
+  it('does not modify the entries it is given', () => {
+    const entry = {
+      source: 'a.example.com',
+      ext: { segments: ['s1'] },
+      uids: [{ id: 'a' }, { id: 'b' }],
+    };
+    const snapshot = structuredClone(entry);
+
+    fitEidCookie([entry]);
+
+    expect(entry).toEqual(snapshot);
+  });
+
+  it('drops whole tail sources until the cookie fits', () => {
+    const long = 'x'.repeat(400);
+    const entries = [0, 1, 2, 3, 4, 5, 6].map((index) => ({
+      source: `s${index}.example.com`,
+      uids: [{ id: long, atype: 1 }],
+    }));
+
+    const fitted = fitEidCookie(entries);
+
+    expect(fitted.value!.length).toBeLessThanOrEqual(MAX_EID_COOKIE_BYTES);
+    expect(decodeCookie(fitted.value)).toEqual(entries.slice(0, 5));
+    expect(fitted.droppedSources).toEqual(['s6.example.com', 's5.example.com']);
+    expect(fitted.trimmedSources).toEqual([]);
+  });
+
+  it('trims UIDs from the last source before dropping it', () => {
+    const long = 'x'.repeat(400);
+    const uids = Array.from({ length: 10 }, (_, index) => ({
+      id: `${long}${index}`,
+      atype: 1,
+    }));
+
+    const fitted = fitEidCookie([{ source: 'ids.example.com', uids }]);
+
+    expect(decodeCookie(fitted.value)).toEqual([
+      { source: 'ids.example.com', uids: uids.slice(0, 5) },
+    ]);
+    expect(fitted.droppedSources).toEqual([]);
+    expect(fitted.trimmedSources).toEqual(['ids.example.com']);
+  });
+
+  it('reports a source trimmed and then dropped only as dropped', () => {
+    const huge = 'y'.repeat(2500);
+    const kept = {
+      source: 'kept.example.com',
+      uids: [{ id: 'kept', atype: 1 }],
+    };
+
+    const fitted = fitEidCookie([
+      kept,
+      {
+        source: 'dropped.example.com',
+        uids: Array.from({ length: 3 }, (_, index) => ({
+          id: `${huge}${index}`,
+          atype: 1,
+        })),
+      },
+    ]);
+
+    expect(decodeCookie(fitted.value)).toEqual([kept]);
+    expect(fitted.droppedSources).toEqual(['dropped.example.com']);
+    expect(fitted.trimmedSources).toEqual([]);
+  });
+
+  it.each([
+    ['a string', 'x'.repeat(4000), '(malformed entry)'],
+    [
+      'an object without a uids array',
+      { source: 'no-uids.example.com', blob: 'x'.repeat(4000) },
+      'no-uids.example.com',
+    ],
+  ])('removes a last entry that is %s whole', (_label, last, droppedLabel) => {
+    const small = { source: 'small.example.com', uids: [{ id: 's' }] };
+
+    const fitted = fitEidCookie([small, last]);
+
+    expect(decodeCookie(fitted.value)).toEqual([small]);
+    expect(fitted.droppedSources).toEqual([droppedLabel]);
+  });
+
+  it('removes a null last entry whole before trimming the entry before it', () => {
+    const big = {
+      source: 'big.example.com',
+      uids: [{ id: 'y'.repeat(1500) }, { id: 'z'.repeat(1500) }],
+    };
+
+    const fitted = fitEidCookie([big, null]);
+
+    expect(decodeCookie(fitted.value)).toEqual([
+      { source: 'big.example.com', uids: [big.uids[0]] },
+    ]);
+    expect(fitted.droppedSources).toEqual(['(malformed entry)']);
+    expect(fitted.trimmedSources).toEqual(['big.example.com']);
+  });
+
+  it('returns no value when nothing fits', () => {
+    const fitted = fitEidCookie([{ source: 'huge.example.com', uids: [{ id: 'h'.repeat(5000) }] }]);
+
+    expect(fitted).toEqual({
+      value: undefined,
+      droppedSources: ['huge.example.com'],
+      trimmedSources: [],
+    });
+  });
+
+  it('encodes non-Latin-1 text as UTF-8 base64 that round-trips', () => {
+    const entries = [
+      {
+        source: 'ids.example.com',
+        inserter: 'inserter-€',
+        uids: [{ id: '日本' }],
+      },
+    ];
+    expect(() => btoa(JSON.stringify(entries)), 'precondition: btoa alone throws here').toThrow();
+
+    expect(decodeCookie(fitEidCookie(entries).value)).toEqual(entries);
+  });
+
+  it('matches btoa output for ASCII payloads', () => {
+    const entries = [{ source: 'ids.example.com', uids: [{ id: 'ascii-uid', atype: 1 }] }];
+
+    expect(fitEidCookie(entries).value).toBe(btoa(JSON.stringify(entries)));
+  });
+
+  it('produces exactly the ts-eids-cookie fixture for the fixture input', () => {
+    const collected = collectBidderEids(bidderRequest({ ext: { eids: FIXTURE_EIDS } }));
+
+    expect(fitEidCookie(collected!).value).toBe(readFixture('ts-eids-cookie.txt'));
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 8f1e1126c8..1ac62fb8c2 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -1,4 +1,8 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
 
 function apsRenderer() {
   const bid = envelope.seatbid[0].bid[0];
@@ -174,6 +178,7 @@ interface InjectedPrebidTestConfig {
   clientSideBidders?: string[];
   excludedGamAdUnitPathSuffixes?: unknown;
   managedUserIds?: Array<typeof MANAGED_USER_ID>;
+  registeredSources?: string[];
 }
 
 interface TestGoogletag {
@@ -236,11 +241,17 @@ interface TestAdapterSpec {
   ) => Array<Record<string, unknown>>;
 }
 
+const { mockWriteEidsMirror } = vi.hoisted(() => ({ mockWriteEidsMirror: vi.fn() }));
+
+vi.mock('../../../src/core/eids_mirror', () => ({ writeEidsMirror: mockWriteEidsMirror }));
+
 // Define mocks using vi.hoisted so they exist before the module under test is
 // imported. The shim reads Prebid.js from the `window.pbjs` global (owned by
 // the external bundle in production), so tests install the mock there instead
 // of mocking module imports.
 const {
+  CANARY_EID,
+  auctionBodyLog,
   mockSetConfig,
   mockMergeConfig,
   mockProcessQueue,
@@ -259,11 +270,39 @@ const {
   const mockMergeConfig = vi.fn((config: unknown) => mockSetConfig(config));
   const mockProcessQueue = vi.fn();
   const mockRequestBids = vi.fn();
-  const mockRegisterBidAdapter = vi.fn();
+  const mockRegisterBidAdapter = vi.fn(
+    (
+      _bidder: unknown,
+      code: string,
+      spec: { buildRequests?: (...args: unknown[]) => { data?: unknown } }
+    ) => {
+      if (code !== 'trustedServer' || typeof spec?.buildRequests !== 'function') return;
+      const buildRequests = spec.buildRequests;
+      spec.buildRequests = function (this: unknown, ...args: unknown[]) {
+        const request = buildRequests.apply(this, args);
+        auctionBodyLog.bodies.push(String(request?.data));
+        auctionBodyLog.total += 1;
+        return request;
+      };
+    }
+  );
   const mockMarkWinningBidAsUsed = vi.fn();
   const mockOnEvent = vi.fn();
+  // D1 canary (spec 7.1 rule 3): an ID only pbjs.getUserIdsAsEids() knows. It
+  // must never reach an /auction body or ts-eids.
+  const CANARY_EID = {
+    source: 'canary.example.com',
+    uids: [{ id: 'canary-uid', atype: 1 }],
+  };
+  // Every /auction body the trustedServer adapter builds, recorded at the
+  // adapter so no test can bypass the canary check.
+  const auctionBodyLog = { bodies: [] as string[], total: 0 };
   const mockGetUserIdsAsEids = vi.fn(
-    () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
+    () =>
+      [CANARY_EID] as Array<{
+        source: string;
+        uids?: Array<{ id: string; atype?: number }>;
+      }>
   );
   const mockGetConfig = vi.fn();
 
@@ -331,6 +370,8 @@ const {
   };
 
   return {
+    CANARY_EID,
+    auctionBodyLog,
     mockSetConfig,
     mockMergeConfig,
     mockProcessQueue,
@@ -367,11 +408,13 @@ import {
 import { log } from '../../../src/core/log';
 import type { TsjsApi } from '../../../src/core/types';
 import { GptDiagnosticsObserver } from '../../../src/integrations/gpt_diagnostics/observer';
+import { GptDiagnosticsPrebidRecorder } from '../../../src/integrations/gpt_diagnostics/prebid';
 import { GptDiagnosticsStore } from '../../../src/integrations/gpt_diagnostics/store';
 import envelope from '../../fixtures/aps-renderer-v1.json';
 import { installTraceRuntime } from '../../../src/trace/runtime';
 import { gptTransport } from '../../trace/gpt-fixtures';
 import { SLOT_TOKEN } from '../../trace/fixtures';
+import { FIXTURE_EIDS } from '../../fixtures/eid-fixture-input';
 
 // installPrebidNpm is a per-page no-op once the sentinel is set (the module
 // self-init above already set it), so every test starts from a clean page.
@@ -383,6 +426,127 @@ beforeEach(() => {
   delete mockPbjs['__tsManagedUserIdsSetConfigInstalled'];
 });
 
+function readTsEidsCookie(): string | undefined {
+  return document.cookie.match(/(?:^|; )ts-eids=([^;]*)/)?.[1] || undefined;
+}
+
+function decodeBase64Utf8(value: string): string {
+  return new TextDecoder().decode(Uint8Array.from(atob(value), (char) => char.charCodeAt(0)));
+}
+
+function decodedTsEidsCookie(): unknown {
+  const value = readTsEidsCookie();
+  return value === undefined ? undefined : JSON.parse(decodeBase64Utf8(value));
+}
+
+/** Runs `run` with `sources` injected as the `[[ec.partners]]` source domains. */
+function withRegisteredSources(sources: string[], run: () => void): void {
+  testWindow.__tsjs_prebid = { registeredSources: sources };
+  try {
+    run();
+  } finally {
+    delete testWindow.__tsjs_prebid;
+  }
+}
+
+function encodeBase64Utf8(value: unknown): string {
+  let binary = '';
+  for (const byte of new TextEncoder().encode(JSON.stringify(value))) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+
+function presetTsEidsCookie(value: string): void {
+  document.cookie = `ts-eids=${value}; Path=/; Secure; SameSite=Lax; Max-Age=60`;
+  expect(readTsEidsCookie(), 'the preset ts-eids cookie should read back').toBe(value);
+}
+
+beforeAll(() => {
+  // jsdom silently drops a Secure cookie on a non-HTTPS URL other than
+  // localhost (spec 7.1 rule 5). Prove the shim's attributes survive here.
+  document.cookie = 'ts-eids-probe=1; Path=/; Secure; SameSite=Lax; Max-Age=60';
+  expect(document.cookie, 'shim cookie attributes should be readable here').toContain(
+    'ts-eids-probe=1'
+  );
+  document.cookie = 'ts-eids-probe=; Path=/; Max-Age=0';
+});
+
+afterEach(() => {
+  // Drain first so one leaking test cannot cascade into the next.
+  const bodies = auctionBodyLog.bodies.splice(0);
+  expect(mockGetUserIdsAsEids(), 'a test switched the getUserIdsAsEids canary off').toEqual([
+    CANARY_EID,
+  ]);
+  for (const body of bodies) {
+    expect(body, 'the getUserIdsAsEids canary leaked into an /auction body').not.toContain(
+      CANARY_EID.source
+    );
+  }
+  const cookie = readTsEidsCookie();
+  if (cookie !== undefined) {
+    let readable = cookie;
+    try {
+      readable = decodeBase64Utf8(cookie);
+    } catch {
+      // A preset non-base64 test value; check it as written.
+    }
+    expect(readable, 'the getUserIdsAsEids canary leaked into ts-eids').not.toContain(
+      CANARY_EID.source
+    );
+  }
+});
+
+afterAll(() => {
+  expect(
+    auctionBodyLog.total,
+    'the canary should have inspected at least one /auction body'
+  ).toBeGreaterThan(0);
+});
+
+function deepFreeze<T>(value: T, seen = new WeakSet<object>()): T {
+  if (value !== null && typeof value === 'object' && !seen.has(value)) {
+    seen.add(value);
+    for (const child of Object.values(value)) {
+      deepFreeze(child, seen);
+    }
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/**
+ * A bidder request shaped as Prebid passes it to buildRequests: a frozen
+ * `ortb2` and `auctionId: null`, as Prebid's proxy hides it by default.
+ */
+function prebidBidderRequest(user: Record<string, unknown>): Record<string, unknown> {
+  return deepFreeze({
+    bidderCode: 'trustedServer',
+    auctionId: null,
+    ortb2: { user },
+  });
+}
+
+function trustedServerBidRequests(): Array<Record<string, unknown>> {
+  return [
+    {
+      adUnitCode: 'div-gpt-1',
+      bidder: 'trustedServer',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      params: {},
+    },
+  ];
+}
+
+function readFixture(name: string): string {
+  return fs
+    .readFileSync(
+      path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../fixtures', name),
+      'utf8'
+    )
+    .trimEnd();
+}
+
 describe('prebid/collectBidders', () => {
   it('returns empty array for empty ad units', () => {
     expect(collectBidders([])).toEqual([]);
@@ -586,7 +750,7 @@ describe('prebid/installPrebidNpm', () => {
     mockPbjs.que = [];
     mockPbjs.getConfig = mockGetConfig;
     mockGetUserIdsAsEids.mockReset();
-    mockGetUserIdsAsEids.mockReturnValue([]);
+    mockGetUserIdsAsEids.mockReturnValue([CANARY_EID]);
     mockGetConfig.mockReset();
     document.cookie = 'ts-eids=; Path=/; Max-Age=0';
     testWindow.__tsjs_prebid_bundle = DEFAULT_BUNDLE_MANIFEST;
@@ -1328,7 +1492,14 @@ describe('prebid/installPrebidNpm', () => {
     'preserves publisher userSync and autoRefresh=%s when seeding late IDs',
     (autoRefresh) => {
       testWindow.__tsjs_prebid = { managedUserIds: [MANAGED_USER_ID] };
-      const userSync = { userIds: [], auctionDelay: 300, syncEnabled: false, autoRefresh };
+      const userSync = {
+        userIds: [],
+        auctionDelay: 300,
+        syncDelay: 50,
+        filterSettings: { image: { bidders: '*', filter: 'include' } },
+        syncEnabled: false,
+        autoRefresh,
+      };
       mockGetConfig.mockImplementation((key?: string) => {
         if (key === 'userSync.userIds') return [];
         if (key === 'userSync') return userSync;
@@ -2424,203 +2595,597 @@ describe('prebid/installPrebidNpm', () => {
       expect(payload.eids).toBeUndefined();
     });
 
-    it('buildRequests includes current Prebid EIDs in the /auction payload', () => {
+    it('forwards an opaque LiveRamp envelope from the bidder request unchanged', () => {
       const spec = getAdapterSpec();
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'id5-sync.com',
-          uids: [{ id: 'ID5_abc', atype: 1 }],
-        },
-        {
-          source: 'sharedid.org',
-          uids: [{ id: 'shared_123' }, { id: 'shared_456', atype: 3 }],
-        },
-        {
-          source: 'google.com',
-          uids: [{ id: 'pair_123', atype: 571187 }],
-        },
-      ]);
+      const liveramp = {
+        source: 'liveramp.com',
+        uids: [{ id: 'opaque-test-envelope', atype: 3 }],
+      };
 
-      const result = spec.buildRequests([
-        {
-          adUnitCode: 'div-gpt-1',
-          bidder: 'trustedServer',
-          mediaTypes: { banner: { sizes: [[300, 250]] } },
-          params: {},
-        },
-      ]);
+      const request = spec.buildRequests(
+        trustedServerBidRequests(),
+        prebidBidderRequest({ ext: { eids: [liveramp] } })
+      );
 
-      const payload = JSON.parse(result.data);
-      expect(payload.eids).toEqual([
-        {
-          source: 'id5-sync.com',
-          uids: [{ id: 'ID5_abc', atype: 1 }],
-        },
-        {
-          source: 'sharedid.org',
-          uids: [{ id: 'shared_123' }, { id: 'shared_456', atype: 3 }],
-        },
-        {
-          source: 'google.com',
-          uids: [{ id: 'pair_123', atype: 571187 }],
-        },
-      ]);
+      expect(JSON.parse(String(request.data)).eids).toEqual([liveramp]);
     });
 
-    it('forwards the opaque LiveRamp envelope as a liveramp.com EID', () => {
+    it('forwards bidderRequest.ortb2 EIDs with EID-level fields, user.ext.eids first', () => {
       const spec = getAdapterSpec();
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'liveramp.com',
-          uids: [{ id: 'opaque-test-envelope', atype: 3 }],
-        },
-      ]);
+      const extEid = {
+        source: 'adserver.org',
+        inserter: 'adserver.org',
+        matcher: 'adserver.org',
+        mm: 4,
+        uids: [{ id: 'fictional-tdid', atype: 1, ext: { rtiPartner: 'TDID' } }],
+      };
+      const userEid = {
+        source: '51d.es',
+        mm: 1,
+        uids: [{ id: 'fictional-device', atype: 1 }],
+      };
 
-      const request = spec.buildRequests([
-        {
-          adUnitCode: 'div-gpt-1',
-          bidId: 'bid-1',
-          bidder: 'trustedServer',
-          mediaTypes: { banner: { sizes: [[300, 250]] } },
-          params: {},
-        },
-      ]);
+      const result = spec.buildRequests(
+        trustedServerBidRequests(),
+        prebidBidderRequest({ ext: { eids: [extEid] }, eids: [userEid] })
+      );
 
-      expect(JSON.parse(request.data).eids).toEqual([
-        {
-          source: 'liveramp.com',
-          uids: [{ id: 'opaque-test-envelope', atype: 3 }],
-        },
+      expect(JSON.parse(String(result.data)).eids, 'should forward both paths as sent').toEqual([
+        extEid,
+        userEid,
       ]);
+      expect(mockGetUserIdsAsEids, 'should never read getUserIdsAsEids').not.toHaveBeenCalled();
+      expect(
+        mockGetConfig.mock.calls.some(([key]) => key === 'ortb2'),
+        'should never read the global ortb2 config'
+      ).toBe(false);
     });
 
-    it('drops empty and malformed LiveRamp envelope values', () => {
+    it('sends exactly the auction-body fixture for the fixture input', () => {
       const spec = getAdapterSpec();
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'liveramp.com',
-          uids: [
-            { id: '' },
-            { id: undefined as unknown as string },
-            { id: 'opaque-valid-envelope', atype: 3 },
-          ],
-        },
-        { source: '', uids: [{ id: 'opaque-invalid-source' }] },
-      ]);
 
-      const request = spec.buildRequests([
-        {
-          adUnitCode: 'div-gpt-1',
-          bidder: 'trustedServer',
-          mediaTypes: { banner: { sizes: [[300, 250]] } },
-          params: {},
-        },
-      ]);
+      const result = spec.buildRequests(
+        trustedServerBidRequests(),
+        prebidBidderRequest({ ext: { eids: FIXTURE_EIDS } })
+      );
 
-      expect(JSON.parse(request.data).eids).toEqual([
-        {
-          source: 'liveramp.com',
-          uids: [{ id: 'opaque-valid-envelope', atype: 3 }],
-        },
-      ]);
+      expect(String(result.data), 'TSJS should produce the Rust fixture byte for byte').toBe(
+        readFixture('auction-body-eids.txt')
+      );
     });
 
-    it('never writes an opaque LiveRamp envelope to logs', () => {
-      const sentinel = 'opaque-envelope-must-not-be-logged';
-      const spies = [
-        vi.spyOn(log, 'debug').mockImplementation(() => {}),
-        vi.spyOn(log, 'info').mockImplementation(() => {}),
-        vi.spyOn(log, 'warn').mockImplementation(() => {}),
-        vi.spyOn(log, 'error').mockImplementation(() => {}),
-      ];
+    it('writes exactly the ts-eids fixture for the fixture input', () => {
       const spec = getAdapterSpec();
-      mockGetUserIdsAsEids.mockReturnValue([
-        { source: 'liveramp.com', uids: [{ id: sentinel, atype: 3 }] },
-      ]);
 
-      spec.buildRequests([
-        {
-          adUnitCode: 'div-gpt-1',
-          bidder: 'trustedServer',
-          mediaTypes: { banner: { sizes: [[300, 250]] } },
-          params: {},
-        },
-      ]);
+      withRegisteredSources(
+        FIXTURE_EIDS.map((eid) => eid.source),
+        () => {
+          spec.buildRequests(
+            trustedServerBidRequests(),
+            prebidBidderRequest({ ext: { eids: FIXTURE_EIDS } })
+          );
+        }
+      );
 
-      const logged = spies.flatMap((spy) => spy.mock.calls).flat();
-      expect(logged.some((value) => JSON.stringify(value).includes(sentinel))).toBe(false);
+      expect(readTsEidsCookie()).toBe(readFixture('ts-eids-cookie.txt'));
     });
 
-    it('buildRequests clears stale ts-eids cookie when current Prebid EIDs are absent', () => {
+    it('writes ts-eids from the body set without EID-level ext', () => {
       const spec = getAdapterSpec();
-      document.cookie = 'ts-eids=stale-value';
-      mockGetUserIdsAsEids.mockReturnValue([]);
+      const withExt = {
+        source: 'liveintent.example.com',
+        ext: { segments: ['s1'] },
+        uids: [{ id: 'li-uid', atype: 3 }],
+      };
+      const plain = {
+        source: 'ids.example.com',
+        uids: [{ id: 'ids-uid', atype: 1 }],
+      };
 
-      spec.buildRequests([
-        {
-          adUnitCode: 'div-gpt-1',
-          bidder: 'trustedServer',
-          mediaTypes: { banner: { sizes: [[300, 250]] } },
-          params: {},
-        },
+      let result: { data: unknown } = { data: '' };
+      withRegisteredSources(['liveintent.example.com', 'ids.example.com'], () => {
+        result = spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [withExt, plain] } })
+        );
+      });
+
+      expect(JSON.parse(String(result.data)).eids, 'the body keeps EID-level ext').toEqual([
+        withExt,
+        plain,
       ]);
+      expect(decodedTsEidsCookie(), 'the cookie copies the body set without EID-level ext').toEqual(
+        [{ source: 'liveintent.example.com', uids: [{ id: 'li-uid', atype: 3 }] }, plain]
+      );
+    });
+
+    it('keeps the ts-eids sources when the bidder request holds no EIDs', () => {
+      const spec = getAdapterSpec();
+      const stored = [{ source: 'ids.example.com', uids: [{ id: 'stored-uid', atype: 1 }] }];
+      presetTsEidsCookie(encodeBase64Utf8(stored));
+
+      let result: { data: unknown } = { data: '' };
+      withRegisteredSources(['ids.example.com'], () => {
+        result = spec.buildRequests(trustedServerBidRequests(), prebidBidderRequest({}));
+      });
 
-      expect(document.cookie).toBe('');
+      const payload = JSON.parse(String(result.data));
+      expect(payload.adUnits[0].code, 'the request should still be built').toBe('div-gpt-1');
+      expect(payload.eids, 'the body should carry no eids').toBeUndefined();
+      expect(decodedTsEidsCookie(), 'the cookie should keep its sources').toEqual(stored);
     });
 
-    it('buildRequests preserves uid ext and sanitizes invalid atype values', () => {
+    it('drops unregistered sources from ts-eids but keeps them in the body', () => {
       const spec = getAdapterSpec();
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'adserver.org',
-          uids: [
-            {
-              id: 'uid-with-ext',
-              atype: 1,
-              ext: { provider: 'liveintent.com', rtiPartner: 'TDID' },
-            },
-            {
-              id: 'uid-bad-atype',
-              atype: 2_147_483_648,
-              ext: { keep: true },
-            },
-            {
-              id: 'uid-float-atype',
-              atype: 1.5,
+      const registered = { source: 'ids.example.com', uids: [{ id: 'ids-uid', atype: 1 }] };
+      const unregistered = { source: 'media.example.com', uids: [{ id: 'm-uid', atype: 3 }] };
+      presetTsEidsCookie(
+        encodeBase64Utf8([{ source: 'stale.example.com', uids: [{ id: 's-uid' }] }])
+      );
+
+      let result: { data: unknown } = { data: '' };
+      withRegisteredSources(['ids.example.com'], () => {
+        result = spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [unregistered, registered] } })
+        );
+      });
+
+      expect(JSON.parse(String(result.data)).eids, 'the body forwards every entry').toEqual([
+        unregistered,
+        registered,
+      ]);
+      expect(decodedTsEidsCookie(), 'the cookie holds registered sources only').toEqual([
+        registered,
+      ]);
+    });
+
+    it('clears ts-eids when no registered source is injected', () => {
+      const spec = getAdapterSpec();
+      presetTsEidsCookie(
+        encodeBase64Utf8([{ source: 'ids.example.com', uids: [{ id: 'stored-uid' }] }])
+      );
+
+      spec.buildRequests(
+        trustedServerBidRequests(),
+        prebidBidderRequest({
+          ext: { eids: [{ source: 'ids.example.com', uids: [{ id: 'ids-uid' }] }] },
+        })
+      );
+
+      expect(readTsEidsCookie(), 'the cookie should be cleared').toBeUndefined();
+    });
+
+    describe('storage consent', () => {
+      const storedEid = { source: 'ids.example.com', uids: [{ id: 'ids-uid', atype: 1 }] };
+
+      beforeEach(() => {
+        testWindow.__tsjs_prebid = { registeredSources: [storedEid.source] };
+      });
+
+      afterEach(() => {
+        delete testWindow.__tsjs_prebid;
+      });
+
+      function consentedBidderRequest(gdprConsent: unknown): Record<string, unknown> {
+        return deepFreeze({
+          bidderCode: 'trustedServer',
+          auctionId: null,
+          ortb2: { user: { ext: { eids: [storedEid] } } },
+          gdprConsent,
+        });
+      }
+
+      function gdprConsentWithPurposes(
+        purposeOne: boolean,
+        purposeFour: boolean
+      ): Record<string, unknown> {
+        return {
+          gdprApplies: true,
+          consentString: 'CPexampleTCStringForTests',
+          vendorData: {
+            purpose: {
+              consents: { 1: purposeOne, 2: true, 4: purposeFour },
+              legitimateInterests: {},
             },
-          ],
-        },
+          },
+        };
+      }
+
+      it.each([
+        ['Purpose 1 is denied', gdprConsentWithPurposes(false, true)],
+        ['Purpose 4 is denied', gdprConsentWithPurposes(true, false)],
+        ['GDPR applies without a TCF purpose record', { gdprApplies: true, consentString: '' }],
+      ])('forwards EIDs but clears ts-eids when %s', (_case, gdprConsent) => {
+        const spec = getAdapterSpec();
+        presetTsEidsCookie(encodeBase64Utf8([storedEid]));
+
+        const result = spec.buildRequests(
+          trustedServerBidRequests(),
+          consentedBidderRequest(gdprConsent)
+        );
+
+        expect(JSON.parse(String(result.data)).eids, 'should still forward the EIDs').toEqual([
+          storedEid,
+        ]);
+        expect(
+          readTsEidsCookie(),
+          'should clear ts-eids without persistence consent'
+        ).toBeUndefined();
+      });
+
+      it.each([
+        ['Purpose 1 is denied', gdprConsentWithPurposes(false, true)],
+        ['Purpose 4 is denied', gdprConsentWithPurposes(true, false)],
+        ['GDPR applies without a TCF purpose record', { gdprApplies: true, consentString: '' }],
+      ])('clears registered cookie sources without EIDs when %s', (_case, gdprConsent) => {
+        const spec = getAdapterSpec();
+        presetTsEidsCookie(encodeBase64Utf8([storedEid]));
+
+        const result = spec.buildRequests(trustedServerBidRequests(), {
+          ...consentedBidderRequest(gdprConsent),
+          ortb2: { user: {} },
+        });
+
+        expect(JSON.parse(String(result.data)).eids).toBeUndefined();
+        expect(readTsEidsCookie()).toBeUndefined();
+      });
+
+      it.each([
+        ['Purposes 1 and 4 are granted', gdprConsentWithPurposes(true, true)],
+        ['GDPR does not apply', { gdprApplies: false }],
+      ])('writes ts-eids when %s', (_case, gdprConsent) => {
+        const spec = getAdapterSpec();
+
+        spec.buildRequests(trustedServerBidRequests(), consentedBidderRequest(gdprConsent));
+
+        expect(decodedTsEidsCookie(), 'should write ts-eids with persistence consent').toEqual([
+          storedEid,
+        ]);
+      });
+    });
+
+    it('clears ts-eids when no EID fits the cookie budget but still sends the body', () => {
+      const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {});
+      const spec = getAdapterSpec();
+      presetTsEidsCookie('preset-value');
+      const entry = { source: 'huge.example.com', uids: [{ id: 'h'.repeat(5000) }] };
+
+      let result: { data: unknown } = { data: '' };
+      withRegisteredSources(['huge.example.com'], () => {
+        result = spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [entry] } })
+        );
+      });
+
+      expect(JSON.parse(String(result.data)).eids, 'the body keeps the entry').toEqual([entry]);
+      expect(readTsEidsCookie(), 'the cookie should be cleared').toBeUndefined();
+      expect(debugSpy).toHaveBeenCalledWith('[tsjs-prebid] forwarding bidder EIDs', {
+        forwarded: 1,
+        unserializable: 0,
+        overBudget: 0,
+        cookie: 'cleared',
+      });
+    });
+
+    describe('when document.cookie writes throw', () => {
+      function withBlockedCookieWrites(run: () => void): void {
+        const descriptor = Object.getOwnPropertyDescriptor(Document.prototype, 'cookie')!;
+        Object.defineProperty(document, 'cookie', {
+          configurable: true,
+          get: () => descriptor.get!.call(document),
+          set: () => {
+            throw new Error('cookies blocked');
+          },
+        });
+        try {
+          run();
+        } finally {
+          delete (document as unknown as Record<string, unknown>).cookie;
+        }
+      }
+
+      it('still builds the request with the entry when the cookie write fails', () => {
+        vi.spyOn(log, 'warn').mockImplementation(() => {});
+        const spec = getAdapterSpec();
+        const entry = { source: 'liveramp.com', uids: [{ id: 'lr-uid', atype: 3 }] };
+
+        withBlockedCookieWrites(() => {
+          const result = spec.buildRequests(
+            trustedServerBidRequests(),
+            prebidBidderRequest({ ext: { eids: [entry] } })
+          );
+
+          const payload = JSON.parse(String(result.data));
+          expect(payload.adUnits[0].code, 'the request should still be built').toBe('div-gpt-1');
+          expect(payload.eids, 'the body should carry the entry').toEqual([entry]);
+        });
+      });
+
+      it('still builds the request without eids when the cookie clear fails', () => {
+        vi.spyOn(log, 'warn').mockImplementation(() => {});
+        const spec = getAdapterSpec();
+
+        withBlockedCookieWrites(() => {
+          const result = spec.buildRequests(trustedServerBidRequests(), prebidBidderRequest({}));
+
+          const payload = JSON.parse(String(result.data));
+          expect(payload.adUnits[0].code, 'the request should still be built').toBe('div-gpt-1');
+          expect(payload.eids, 'the body should carry no eids').toBeUndefined();
+        });
+      });
+    });
+
+    it('sends no eids and leaves ts-eids alone without a bidder request object', () => {
+      const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {});
+      const spec = getAdapterSpec();
+      presetTsEidsCookie('preset-value');
+
+      const result = spec.buildRequests(trustedServerBidRequests());
+
+      expect(JSON.parse(String(result.data)).adUnits[0].code).toBe('div-gpt-1');
+      expect(JSON.parse(String(result.data)).eids).toBeUndefined();
+      expect(readTsEidsCookie(), 'the cookie should be unchanged').toBe('preset-value');
+      expect(
+        debugSpy.mock.calls.some(
+          ([message]) => typeof message === 'string' && message.includes('no bidder request')
+        ),
+        'should explain at debug level'
+      ).toBe(true);
+    });
+
+    it('replaces a ts-eids value it cannot decode with the request entries', () => {
+      const spec = getAdapterSpec();
+      const fresh = { source: 'first.example.com', uids: [{ id: 'first-uid' }] };
+      presetTsEidsCookie('%%%not-base64%%%');
+
+      withRegisteredSources(['first.example.com'], () => {
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [fresh] } })
+        );
+      });
+
+      expect(decodedTsEidsCookie(), 'a corrupt cookie should not block the write').toEqual([fresh]);
+    });
+
+    it('drops a source from an old ts-eids once it is no longer registered', () => {
+      const spec = getAdapterSpec();
+      const kept = { source: 'first.example.com', uids: [{ id: 'first-uid' }] };
+      const retired = { source: 'retired.example.com', uids: [{ id: 'retired-uid' }] };
+      const fresh = { source: 'second.example.com', uids: [{ id: 'second-uid' }] };
+      presetTsEidsCookie(btoa(JSON.stringify([retired, kept])));
+
+      withRegisteredSources(['first.example.com', 'second.example.com'], () => {
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [fresh] } })
+        );
+      });
+
+      expect(
+        decodedTsEidsCookie(),
+        'the unregistered source should leave the cookie on the next write'
+      ).toEqual([fresh, kept]);
+    });
+
+    it('merges a later request into ts-eids per source', () => {
+      const spec = getAdapterSpec();
+      const first = { source: 'first.example.com', uids: [{ id: 'first-uid' }] };
+      const second = { source: 'second.example.com', uids: [{ id: 'second-uid' }] };
+      const replaced = { source: 'first.example.com', uids: [{ id: 'first-uid-2' }] };
+
+      withRegisteredSources(['first.example.com', 'second.example.com'], () => {
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [first] } })
+        );
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [second] } })
+        );
+        expect(decodedTsEidsCookie(), 'a source the later request lacks should stay').toEqual([
+          second,
+          first,
+        ]);
+
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [replaced] } })
+        );
+      });
+
+      expect(decodedTsEidsCookie(), 'the later request should win for its source').toEqual([
+        replaced,
+        second,
       ]);
+    });
 
-      const result = spec.buildRequests([
-        {
-          adUnitCode: 'div-gpt-1',
-          bidder: 'trustedServer',
-          mediaTypes: { banner: { sizes: [[300, 250]] } },
-          params: {},
-        },
+    it('forwards ortb2 EIDs and writes ts-eids without the User ID module', () => {
+      const spec = getAdapterSpec();
+      const original = mockPbjs.getUserIdsAsEids;
+      mockPbjs.getUserIdsAsEids = undefined as unknown as typeof mockGetUserIdsAsEids;
+      try {
+        const lockrId5 = {
+          source: 'id5-sync.com',
+          inserter: 'inserter.example.com',
+          mm: 2,
+          uids: [{ id: 'fictional-id5', atype: 1 }],
+        };
+
+        let result: { data: unknown } = { data: '' };
+        withRegisteredSources(['id5-sync.com'], () => {
+          result = spec.buildRequests(
+            trustedServerBidRequests(),
+            prebidBidderRequest({ ext: { eids: [lockrId5] } })
+          );
+        });
+
+        expect(JSON.parse(String(result.data)).eids).toEqual([lockrId5]);
+        expect(decodedTsEidsCookie()).toEqual([lockrId5]);
+      } finally {
+        mockPbjs.getUserIdsAsEids = original;
+      }
+    });
+
+    it('ortb2_config_only_eid_reaches_ts_eids_and_the_auction_body', () => {
+      // Lockr writes its ID5 into Prebid's ortb2 config only, so
+      // getUserIdsAsEids() (the canary) never returns it. The Rust identity
+      // tests carry the same cookie value as a fixture.
+      const spec = getAdapterSpec();
+      const lockrId5 = {
+        source: 'id5-sync.com',
+        inserter: 'inserter.example.com',
+        mm: 2,
+        uids: [{ id: 'fictional-id5', atype: 1 }],
+      };
+      expect(
+        mockGetUserIdsAsEids().map((eid: { source: string }) => eid.source),
+        'control: getUserIdsAsEids should not hold the ID5 entry'
+      ).not.toContain('id5-sync.com');
+
+      let result: { data: unknown } = { data: '' };
+      withRegisteredSources(['id5-sync.com'], () => {
+        result = spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [lockrId5] } })
+        );
+      });
+
+      expect(JSON.parse(String(result.data)).eids, 'the /auction body carries the entry').toEqual([
+        lockrId5,
       ]);
+      expect(readTsEidsCookie(), 'ts-eids carries the entry, as this exact value').toBe(
+        readFixture('ts-eids-ortb2-only.txt')
+      );
+    });
 
-      const payload = JSON.parse(result.data);
-      expect(payload.eids).toEqual([
-        {
-          source: 'adserver.org',
-          uids: [
-            {
-              id: 'uid-with-ext',
-              atype: 1,
-              ext: { provider: 'liveintent.com', rtiPartner: 'TDID' },
-            },
-            {
-              id: 'uid-bad-atype',
-              ext: { keep: true },
-            },
-            {
-              id: 'uid-float-atype',
+    it('ts_eids_cookie_golden', () => {
+      // Every source is registered, so the cookie keeps the whole set.
+      // EID-level ext never reaches the cookie.
+      testWindow.__tsjs_prebid = { registeredSources: ['id5-sync.com', 'sharedid.org'] };
+      try {
+        const spec = getAdapterSpec();
+
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({
+            ext: {
+              eids: [
+                {
+                  source: 'id5-sync.com',
+                  inserter: 'inserter.example.com',
+                  matcher: 'id5-sync.com',
+                  mm: 2,
+                  ext: { segments: ['s1'] },
+                  uids: [
+                    { id: 'golden-id5-a', atype: 1, ext: { linkType: 2 } },
+                    { id: 'golden-id5-b', atype: 1 },
+                  ],
+                },
+                { source: 'sharedid.org', uids: [{ id: 'golden-shared', atype: 1 }] },
+              ],
             },
-          ],
-        },
-      ]);
+          })
+        );
+
+        expect(readTsEidsCookie()).toBe(readFixture('ts-eids-golden.txt'));
+      } finally {
+        delete testWindow.__tsjs_prebid;
+      }
+    });
+
+    it('writes only the registered source into ts-eids as this exact value', () => {
+      // The Rust identity tests ingest this value: its registered source is
+      // the eighth entry, which the pre-G10 trim dropped.
+      withRegisteredSources(['registered.example.com'], () => {
+        const spec = getAdapterSpec();
+        const long = 'x'.repeat(400);
+        const unregistered = [0, 1, 2, 3, 4, 5, 6].map((index) => ({
+          source: `u${index}.example.com`,
+          uids: [{ id: long, atype: 1 }],
+        }));
+        const registered = { source: 'registered.example.com', uids: [{ id: long, atype: 1 }] };
+
+        spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [...unregistered, registered] } })
+        );
+
+        expect(readTsEidsCookie()).toBe(readFixture('ts-eids-registered-only.txt'));
+      });
+    });
+
+    it('logs EID counts and the cookie decision at debug level, never values', () => {
+      log.setLevel('debug');
+      const spies = [
+        vi.spyOn(log, 'debug').mockImplementation(() => {}),
+        vi.spyOn(log, 'info').mockImplementation(() => {}),
+        vi.spyOn(log, 'warn').mockImplementation(() => {}),
+        vi.spyOn(log, 'error').mockImplementation(() => {}),
+      ];
+      try {
+        const spec = getAdapterSpec();
+
+        withRegisteredSources(['ids.example.com'], () => {
+          spec.buildRequests(
+            trustedServerBidRequests(),
+            prebidBidderRequest({
+              ext: {
+                eids: [{ source: 'ids.example.com', uids: [{ id: 'secret-uid-value' }] }],
+              },
+            })
+          );
+        });
+
+        expect(spies[0]).toHaveBeenCalledWith('[tsjs-prebid] forwarding bidder EIDs', {
+          forwarded: 1,
+          unserializable: 0,
+          overBudget: 0,
+          cookie: 'written',
+        });
+        const logged = spies.flatMap((spy) => spy.mock.calls).flat();
+        expect(
+          logged.some((value) => String(JSON.stringify(value)).includes('secret-uid-value')),
+          'no log argument may contain a UID value'
+        ).toBe(false);
+      } finally {
+        log.setLevel('warn');
+      }
+    });
+
+    it('keeps the trim log when the cookie had to drop sources', () => {
+      const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {});
+      const spec = getAdapterSpec();
+      const long = 'x'.repeat(400);
+      const entries = [0, 1, 2, 3, 4, 5, 6].map((index) => ({
+        source: `s${index}.example.com`,
+        uids: [{ id: long, atype: 1 }],
+      }));
+
+      let result: { data: unknown } = { data: '' };
+      withRegisteredSources(
+        entries.map((entry) => entry.source),
+        () => {
+          result = spec.buildRequests(
+            trustedServerBidRequests(),
+            prebidBidderRequest({ ext: { eids: entries } })
+          );
+        }
+      );
+
+      expect(JSON.parse(String(result.data)).eids, 'the body keeps every entry').toEqual(entries);
+      expect(decodedTsEidsCookie(), 'the cookie keeps what fits').toEqual(entries.slice(0, 5));
+      expect(debugSpy).toHaveBeenCalledWith(
+        '[tsjs-prebid] ts-eids cookie exceeded 3072 bytes; dropped sources: s6.example.com, s5.example.com'
+      );
+      expect(debugSpy).toHaveBeenCalledWith('[tsjs-prebid] forwarding bidder EIDs', {
+        forwarded: 7,
+        unserializable: 0,
+        overBudget: 0,
+        cookie: 'trimmed',
+      });
     });
 
     it('buildRequests uses custom endpoint when configured', () => {
@@ -2689,6 +3254,54 @@ describe('prebid/installPrebidNpm', () => {
       );
     });
 
+    it('interpretResponse writes the ts-eids-s mirror the response carries', () => {
+      mockWriteEidsMirror.mockClear();
+      const spec = getAdapterSpec();
+      const built = spec.buildRequests([]);
+      const mirror = { value: 'eyJ2IjoxfQ', max_age: 600 };
+
+      spec.interpretResponse({ body: { seatbid: [], ext: { ts_eids_s: mirror } } }, built);
+      spec.interpretResponse({ body: { seatbid: [], ext: { ts_eids_s: { clear: true } } } }, built);
+
+      expect(mockWriteEidsMirror).toHaveBeenCalledTimes(2);
+      expect(mockWriteEidsMirror).toHaveBeenNthCalledWith(1, mirror);
+      expect(mockWriteEidsMirror).toHaveBeenNthCalledWith(2, { clear: true });
+    });
+
+    it('interpretResponse leaves the mirror alone when the response has none', () => {
+      mockWriteEidsMirror.mockClear();
+      const spec = getAdapterSpec();
+      const built = spec.buildRequests([]);
+
+      spec.interpretResponse({ body: { seatbid: [], ext: {} } }, built);
+      spec.interpretResponse({ body: { seatbid: [] } }, built);
+      spec.interpretResponse({ body: null }, built);
+
+      expect(mockWriteEidsMirror).not.toHaveBeenCalled();
+    });
+
+    it('keeps only injected registered sources in ts-eids', () => {
+      withRegisteredSources(['registered.example.com'], () => {
+        const spec = getAdapterSpec();
+        const long = 'x'.repeat(400);
+        const unregistered = [0, 1, 2, 3, 4, 5, 6].map((index) => ({
+          source: `u${index}.example.com`,
+          uids: [{ id: long, atype: 1 }],
+        }));
+        const registered = { source: 'registered.example.com', uids: [{ id: long, atype: 1 }] };
+
+        const result = spec.buildRequests(
+          trustedServerBidRequests(),
+          prebidBidderRequest({ ext: { eids: [...unregistered, registered] } })
+        );
+
+        expect(JSON.parse(String(result.data)).eids, 'the body keeps every entry').toHaveLength(8);
+        expect(decodedTsEidsCookie(), 'the cookie holds the registered source only').toEqual([
+          registered,
+        ]);
+      });
+    });
+
     it('interpretResponse handles empty/missing seatbid', () => {
       const spec = getAdapterSpec();
       const built = spec.buildRequests([]);
@@ -2747,6 +3360,66 @@ describe('prebid/installPrebidNpm', () => {
     });
   });
 
+  it('exposes the getUserIdsAsEids canary on the pbjs the shim uses', () => {
+    const pbjs = installPrebidNpm() as unknown as {
+      getUserIdsAsEids?: () => unknown;
+    };
+
+    expect(pbjs.getUserIdsAsEids).toBe(mockGetUserIdsAsEids);
+    expect(pbjs.getUserIdsAsEids?.()).toEqual([CANARY_EID]);
+  });
+
+  function tcfEnforcementHandler(): (event: unknown) => void {
+    installPrebidNpm();
+    const registration = mockOnEvent.mock.calls.find(([event]) => event === 'tcf2Enforcement');
+    expect(registration, 'the shim should listen for tcf2Enforcement').toBeDefined();
+    return registration![1] as (event: unknown) => void;
+  }
+
+  it.each([
+    ['biddersBlocked', { biddersBlocked: ['trustedServer'], eidsBlocked: [] }],
+    ['eidsBlocked', { biddersBlocked: [], eidsBlocked: ['trustedServer'] }],
+  ])('clears ts-eids when tcf2Enforcement lists trustedServer in %s', (_list, blocked) => {
+    const handler = tcfEnforcementHandler();
+    presetTsEidsCookie('preset-value');
+
+    handler({
+      storageBlocked: [],
+      analyticsBlocked: [],
+      ufpdBlocked: [],
+      geoBlocked: [],
+      ...blocked,
+    });
+
+    expect(readTsEidsCookie()).toBeUndefined();
+  });
+
+  it('leaves ts-eids alone when tcf2Enforcement lists only other bidders', () => {
+    const handler = tcfEnforcementHandler();
+    presetTsEidsCookie('preset-value');
+
+    handler({ biddersBlocked: ['appnexus'], eidsBlocked: ['appnexus'] });
+
+    expect(readTsEidsCookie()).toBe('preset-value');
+  });
+
+  it('leaves ts-eids alone when an auction builds no trustedServer request', () => {
+    mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
+      opts?.bidsBackHandler?.();
+    });
+    presetTsEidsCookie('preset-value');
+    const pbjs = installPrebidNpm();
+
+    pbjs.requestBids({
+      adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
+    } as unknown as RequestBidsArg);
+
+    expect(mockRequestBids, 'the auction should have run').toHaveBeenCalled();
+    expect(readTsEidsCookie(), 'only buildRequests may write or clear the cookie').toBe(
+      'preset-value'
+    );
+  });
+
   describe('requestBids shim', () => {
     beforeEach(() => {
       testWindow.__tsjs_prebid = {
@@ -3164,202 +3837,6 @@ describe('prebid/installPrebidNpm', () => {
       );
       expect(hasTsBidder).toBe(true);
     });
-
-    it('syncs a structured ts-eids cookie after bidsBackHandler', () => {
-      mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
-        opts?.bidsBackHandler?.();
-      });
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'sharedid.org',
-          uids: [
-            { id: 'shared_123', atype: 3 },
-            { id: 'shared_456', ext: { provider: 'example' } },
-          ],
-        },
-      ]);
-
-      const pbjs = installPrebidNpm();
-      pbjs.requestBids({
-        adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
-      } as unknown as RequestBidsArg);
-
-      const cookieValue = document.cookie.match(/(?:^|; )ts-eids=([^;]+)/)?.[1];
-      expect(cookieValue).toBeDefined();
-      expect(JSON.parse(atob(cookieValue!))).toEqual([
-        {
-          source: 'sharedid.org',
-          uids: [
-            { id: 'shared_123', atype: 3 },
-            { id: 'shared_456', ext: { provider: 'example' } },
-          ],
-        },
-      ]);
-    });
-
-    it('preserves an opaque LiveRamp envelope in the ts-eids cookie', () => {
-      mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
-        opts?.bidsBackHandler?.();
-      });
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'liveramp.com',
-          uids: [{ id: 'opaque-test-envelope', atype: 3 }],
-        },
-      ]);
-
-      const pbjs = installPrebidNpm();
-      pbjs.requestBids({
-        adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
-      } as unknown as RequestBidsArg);
-
-      const cookieValue = document.cookie.match(/(?:^|; )ts-eids=([^;]+)/)?.[1];
-      expect(cookieValue).toBeDefined();
-      expect(JSON.parse(atob(cookieValue!))).toEqual([
-        {
-          source: 'liveramp.com',
-          uids: [{ id: 'opaque-test-envelope', atype: 3 }],
-        },
-      ]);
-    });
-
-    it('trims an oversized ts-eids cookie deterministically and logs which sources were dropped', () => {
-      const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {});
-      const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
-      mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
-        opts?.bidsBackHandler?.();
-      });
-      // A long uid value per source makes the encoded payload exceed
-      // MAX_EID_COOKIE_BYTES (3072) once several sources are present, the
-      // same way a real page with many ID modules would.
-      const longUid = 'x'.repeat(400);
-      mockGetUserIdsAsEids.mockReturnValue([
-        { source: 'id5-sync.com', uids: [{ id: longUid, atype: 1 }] },
-        { source: 'liveramp.com', uids: [{ id: longUid, atype: 3 }] },
-        { source: 'criteo.com', uids: [{ id: longUid, atype: 1 }] },
-        { source: 'uidapi.com', uids: [{ id: longUid, atype: 3 }] },
-        { source: 'pubcid.org', uids: [{ id: longUid, atype: 1 }] },
-        { source: 'sharedid.org', uids: [{ id: longUid, atype: 1 }] },
-        { source: 'dropped.example', uids: [{ id: longUid, atype: 1 }] },
-      ]);
-
-      const pbjs = installPrebidNpm();
-      pbjs.requestBids({
-        adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
-      } as unknown as RequestBidsArg);
-
-      const cookieValue = document.cookie.match(/(?:^|; )ts-eids=([^;]+)/)?.[1];
-      expect(cookieValue).toBeDefined();
-      expect(cookieValue!.length).toBeLessThanOrEqual(3072);
-
-      const persistedSources = (JSON.parse(atob(cookieValue!)) as Array<{ source: string }>).map(
-        (eid) => eid.source
-      );
-      expect(persistedSources).not.toContain('dropped.example');
-      expect(persistedSources).toContain('id5-sync.com');
-
-      const loggedMessage = debugSpy.mock.calls
-        .map((call) => call.at(-1))
-        .find(
-          (arg): arg is string => typeof arg === 'string' && arg.includes('ts-eids cookie exceeded')
-        );
-      expect(loggedMessage).toBeDefined();
-      expect(loggedMessage).toContain('dropped.example');
-      expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining('ts-eids cookie exceeded'));
-    });
-
-    it('logs a source whose UIDs were partially trimmed but retained', () => {
-      const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {});
-      mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
-        opts?.bidsBackHandler?.();
-      });
-      // A single source with many UIDs is trimmed down to fit rather than
-      // dropped outright — it stays in the payload, but with fewer UIDs.
-      const longUid = 'x'.repeat(400);
-      mockGetUserIdsAsEids.mockReturnValue([
-        {
-          source: 'id5-sync.com',
-          uids: Array.from({ length: 10 }, (_, i) => ({ id: `${longUid}${i}`, atype: 1 })),
-        },
-      ]);
-
-      const pbjs = installPrebidNpm();
-      pbjs.requestBids({
-        adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
-      } as unknown as RequestBidsArg);
-
-      const cookieValue = document.cookie.match(/(?:^|; )ts-eids=([^;]+)/)?.[1];
-      expect(cookieValue).toBeDefined();
-
-      const persisted = JSON.parse(atob(cookieValue!)) as Array<{
-        source: string;
-        uids: unknown[];
-      }>;
-      expect(persisted.map((eid) => eid.source)).toContain('id5-sync.com');
-      const persistedSource = persisted.find((eid) => eid.source === 'id5-sync.com');
-      expect(persistedSource!.uids.length).toBeLessThan(10);
-
-      const loggedMessage = debugSpy.mock.calls
-        .map((call) => call.at(-1))
-        .find(
-          (arg): arg is string => typeof arg === 'string' && arg.includes('ts-eids cookie exceeded')
-        );
-      expect(loggedMessage).toBeDefined();
-      expect(loggedMessage).toContain('trimmed uids from sources: id5-sync.com');
-    });
-
-    it('reports a source trimmed and then dropped only as dropped', () => {
-      const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {});
-      mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
-        opts?.bidsBackHandler?.();
-      });
-      // The tail source has several UIDs that are each too large to fit: the
-      // trimmer first removes UIDs from it, then drops it entirely.
-      const hugeUid = 'y'.repeat(2500);
-      mockGetUserIdsAsEids.mockReturnValue([
-        { source: 'id5-sync.com', uids: [{ id: 'kept', atype: 1 }] },
-        {
-          source: 'dropped.example',
-          uids: Array.from({ length: 3 }, (_, i) => ({ id: `${hugeUid}${i}`, atype: 1 })),
-        },
-      ]);
-
-      const pbjs = installPrebidNpm();
-      pbjs.requestBids({
-        adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
-      } as unknown as RequestBidsArg);
-
-      const cookieValue = document.cookie.match(/(?:^|; )ts-eids=([^;]+)/)?.[1];
-      expect(cookieValue).toBeDefined();
-      const persistedSources = (JSON.parse(atob(cookieValue!)) as Array<{ source: string }>).map(
-        (eid) => eid.source
-      );
-      expect(persistedSources).toEqual(['id5-sync.com']);
-
-      const loggedMessage = debugSpy.mock.calls
-        .map((call) => call.at(-1))
-        .find(
-          (arg): arg is string => typeof arg === 'string' && arg.includes('ts-eids cookie exceeded')
-        );
-      expect(loggedMessage).toBeDefined();
-      expect(loggedMessage).toContain('dropped sources: dropped.example');
-      expect(loggedMessage).not.toContain('trimmed uids from sources');
-    });
-
-    it('clears ts-eids cookie after bidsBackHandler when no current EIDs remain', () => {
-      document.cookie = `ts-eids=${btoa(JSON.stringify([{ source: 'sharedid.org', uids: [{ id: 'stale' }] }]))}`;
-      mockRequestBids.mockImplementation((opts?: { bidsBackHandler?: () => void }) => {
-        opts?.bidsBackHandler?.();
-      });
-      mockGetUserIdsAsEids.mockReturnValue([]);
-
-      const pbjs = installPrebidNpm();
-      pbjs.requestBids({
-        adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
-      } as unknown as RequestBidsArg);
-
-      expect(document.cookie).toBe('');
-    });
   });
 });
 
@@ -3369,7 +3846,7 @@ describe('prebid/installPrebidNpm with server-injected config', () => {
     mockPbjs.requestBids = mockRequestBids;
     mockPbjs.adUnits = [];
     mockGetUserIdsAsEids.mockReset();
-    mockGetUserIdsAsEids.mockReturnValue([]);
+    mockGetUserIdsAsEids.mockReturnValue([CANARY_EID]);
     document.cookie = 'ts-eids=; Path=/; Max-Age=0';
     delete testWindow.__tsjs_prebid;
   });
@@ -4469,9 +4946,10 @@ describe('prebid publisher snapshots and delivery refreshes', () => {
     mockPbjs.requestBids = mockRequestBids;
     mockPbjs.removeAdUnit = mockRemoveAdUnit;
     delete (mockPbjs as unknown as Record<string, unknown>).__tsRemoveAdUnitWrapped;
+    delete (mockPbjs as unknown as Record<string, unknown>).__tsDiagnosticsBidWonInstalled;
     mockPbjs.adUnits = [];
     mockGetUserIdsAsEids.mockReset();
-    mockGetUserIdsAsEids.mockReturnValue([]);
+    mockGetUserIdsAsEids.mockReturnValue([CANARY_EID]);
     // By default the manifest declares all adapters compiled in.
     (window as unknown as { __tsjs_prebid_bundle?: unknown }).__tsjs_prebid_bundle =
       DEFAULT_BUNDLE_MANIFEST;
@@ -4488,10 +4966,22 @@ describe('prebid publisher snapshots and delivery refreshes', () => {
     delete testWindow.__tsjs_prebid;
     testWindow.tsjs = undefined;
     delete testWindow.googletag;
+    vi.restoreAllMocks();
     document.body.replaceChildren();
   });
 
+  function attachPrebidDiagnostics() {
+    const recorder = testWindow.tsjs?.gptDiagnosticsRecorder;
+    if (recorder) {
+      recorder.recordCompletedPrebidAuction = new GptDiagnosticsPrebidRecorder(
+        window,
+        recorder
+      ).recordCompletedPrebidAuction;
+    }
+  }
+
   function installGpt(slots: Array<Record<string, unknown>>) {
+    attachPrebidDiagnostics();
     installedGptSlots = slots;
     for (const slot of slots) {
       if (!slot || typeof slot !== 'object') continue;
@@ -4522,6 +5012,68 @@ describe('prebid publisher snapshots and delivery refreshes', () => {
     return { originalRefresh, pubads };
   }
 
+  it.each(['onEvent registration', 'diagnostics recorder access'])(
+    'issues one GAM refresh when %s throws during auction diagnostics setup',
+    (failure) => {
+      vi.useFakeTimers();
+      mockOnEvent.mockReset();
+      try {
+        const code = `example-diagnostics-${failure.replaceAll(' ', '-')}`;
+        const slot = {
+          getSlotElementId: () => code,
+          getTargeting: () => [],
+          getSizes: () => [[300, 250]],
+          clearTargeting: vi.fn(),
+        };
+        const { originalRefresh, pubads } = installGpt([slot]);
+        const element = document.createElement('div');
+        element.id = code;
+        document.body.appendChild(element);
+        installPrebidNpm();
+        mockPbjs.setTargetingForGPTAsync = vi.fn();
+        let bidsBackHandler: ((...args: unknown[]) => void) | undefined;
+        mockRequestBids.mockImplementation((options) => {
+          bidsBackHandler = options.bidsBackHandler;
+        });
+        if (failure === 'onEvent registration') {
+          testWindow.tsjs = {
+            gptDiagnosticsRecorder: {
+              recordPrebidAuction: vi.fn(),
+            } as unknown as TsjsApi['gptDiagnosticsRecorder'],
+          };
+          attachPrebidDiagnostics();
+          mockOnEvent.mockImplementation(() => {
+            throw new Error('publisher onEvent failed');
+          });
+        } else {
+          testWindow.tsjs = {};
+          Object.defineProperty(testWindow.tsjs, 'gptDiagnosticsRecorder', {
+            configurable: true,
+            get: () => {
+              throw new Error('diagnostics recorder unavailable');
+            },
+          });
+        }
+
+        pubads.refresh([slot]);
+        expect(bidsBackHandler).toBeTypeOf('function');
+
+        bidsBackHandler!({}, false, 'example-diagnostics-auction');
+        if (failure === 'onEvent registration') {
+          expect(mockOnEvent).toHaveBeenCalledWith('bidWon', expect.any(Function));
+        }
+        vi.advanceTimersByTime(640);
+        bidsBackHandler!({}, false, 'example-diagnostics-auction');
+
+        expect(originalRefresh).toHaveBeenCalledOnce();
+        expect(originalRefresh).toHaveBeenCalledWith([slot], undefined);
+      } finally {
+        mockOnEvent.mockReset();
+        vi.useRealTimers();
+      }
+    }
+  );
+
   function refreshAdUnitFromLastRequest():
     | (Record<string, unknown> & { code?: string; bids?: TestBid[] })
     | undefined {
@@ -5701,6 +6253,220 @@ describe('prebid publisher snapshots and delivery refreshes', () => {
     return recordPrebidRefresh;
   }
 
+  it('leaves Prebid auction identity and event listeners unchanged when diagnostics is inactive', () => {
+    const getTargeting = vi.fn(() => []);
+    const slot = {
+      getSlotElementId: () => 'example-inactive-slot',
+      getTargeting,
+      clearTargeting: vi.fn(),
+    };
+    const { pubads } = installGpt([slot]);
+    mockPbjs.setTargetingForGPTAsync = vi.fn();
+    mockRequestBids.mockImplementation((opts) => {
+      opts.bidsBackHandler?.({}, false, 'example-inactive-auction');
+    });
+
+    pubads.refresh([slot]);
+
+    const request = mockRequestBids.mock.calls[0][0];
+    expect(request).not.toHaveProperty('auctionId');
+    expect(mockOnEvent).not.toHaveBeenCalledWith('bidWon', expect.any(Function));
+    expect(getTargeting).not.toHaveBeenCalledWith('hb_bidder');
+    expect(getTargeting).not.toHaveBeenCalledWith('hb_pb');
+    expect(getTargeting).not.toHaveBeenCalledWith('hb_cur');
+  });
+
+  it('records completed client auction evidence only for the exact Prebid attempt', () => {
+    const getTargeting = vi.fn((key: string) =>
+      key === 'hb_bidder' ? ['example-client'] : key === 'hb_pb' ? ['2.40'] : []
+    );
+    const slot = {
+      getSlotElementId: () => 'example-client-slot',
+      getTargeting,
+      clearTargeting: vi.fn(),
+    };
+    const recordPrebidRefresh = vi.fn();
+    const recordPrebidAuction = vi.fn();
+    const recordPrebidWin = vi.fn();
+    testWindow.tsjs = {
+      gptDiagnosticsRecorder: {
+        recordPrebidRefresh,
+        recordPrebidAuction,
+        recordPrebidWin,
+      },
+    };
+    const { pubads } = installGpt([slot]);
+    mockPbjs.setTargetingForGPTAsync = vi.fn();
+    mockRequestBids.mockImplementation((opts) => {
+      opts.bidsBackHandler?.({}, false, 'example-client-auction');
+    });
+
+    pubads.refresh([slot]);
+
+    expect(mockRequestBids.mock.calls[0][0]).not.toHaveProperty('auctionId');
+    expect(mockOnEvent).toHaveBeenCalledWith('bidWon', expect.any(Function));
+    expect(recordPrebidRefresh).toHaveBeenCalledWith([slot]);
+    expect(recordPrebidAuction).toHaveBeenCalledWith(slot, 'example-client-auction', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+    expect(recordPrebidRefresh.mock.invocationCallOrder[0]).toBeLessThan(
+      recordPrebidAuction.mock.invocationCallOrder[0]
+    );
+    expect(getTargeting).not.toHaveBeenCalledWith('hb_cur');
+    const bidWon = mockOnEvent.mock.calls.find(([event]) => event === 'bidWon')?.[1];
+    expect(bidWon).toBeTypeOf('function');
+    bidWon?.({
+      auctionId: 'other-auction',
+      adUnitCode: 'example-client-slot',
+      adserverTargeting: { hb_bidder: 'wrong-client', hb_pb: '9.99' },
+    });
+    expect(recordPrebidWin).not.toHaveBeenCalled();
+    bidWon?.({
+      auctionId: 'example-client-auction',
+      latestTargetedAuctionId: 'later-client-auction',
+      adUnitCode: 'example-client-slot',
+      adserverTargeting: { hb_bidder: 'stale-client', hb_pb: '9.99' },
+    });
+    expect(recordPrebidWin).not.toHaveBeenCalled();
+    bidWon?.({
+      auctionId: 'example-client-auction',
+      latestTargetedAuctionId: 'example-client-auction',
+      adUnitCode: 'example-client-slot',
+      adserverTargeting: { hb_bidder: 'example-client', hb_pb: '2.40' },
+    });
+    expect(recordPrebidWin).toHaveBeenCalledWith(slot, 'example-client-auction', {
+      bidder: 'example-client',
+      priceBucket: '2.40',
+    });
+  });
+
+  it('retries failed bidWon registration without duplicating a successful listener', () => {
+    const slot = {
+      getSlotElementId: () => 'example-retry-slot',
+      getTargeting: () => [],
+      clearTargeting: vi.fn(),
+    };
+    const recordPrebidWin = vi.fn();
+    testWindow.tsjs = {
+      gptDiagnosticsRecorder: {
+        recordPrebidRefresh: vi.fn(),
+        recordPrebidAuction: vi.fn(),
+        recordPrebidWin,
+      },
+    };
+    const { originalRefresh, pubads } = installGpt([slot]);
+    installPrebidNpm();
+    mockPbjs.setTargetingForGPTAsync = vi.fn();
+    let auctionSequence = 0;
+    mockRequestBids.mockImplementation((opts) => {
+      opts.bidsBackHandler?.({}, false, `example-retry-auction-${++auctionSequence}`);
+    });
+    mockOnEvent.mockClear();
+    mockOnEvent.mockImplementationOnce(() => {
+      throw new Error('publisher onEvent failed once');
+    });
+
+    try {
+      pubads.refresh([slot]);
+      expect(mockOnEvent).toHaveBeenCalledExactlyOnceWith('bidWon', expect.any(Function));
+      expect(mockOnEvent.mock.results[0].type).toBe('throw');
+
+      pubads.refresh([slot]);
+      expect(mockOnEvent).toHaveBeenCalledTimes(2);
+      expect(mockOnEvent.mock.results[1].type).toBe('return');
+      const bidWon = mockOnEvent.mock.calls[1][1];
+      bidWon({
+        auctionId: 'example-retry-auction-2',
+        adUnitCode: 'example-retry-slot',
+        adserverTargeting: { hb_bidder: 'example-client', hb_pb: '2.40' },
+      });
+      expect(recordPrebidWin).toHaveBeenCalledExactlyOnceWith(slot, 'example-retry-auction-2', {
+        bidder: 'example-client',
+        priceBucket: '2.40',
+      });
+
+      pubads.refresh([slot]);
+      expect(mockOnEvent).toHaveBeenCalledTimes(2);
+      expect(originalRefresh).toHaveBeenCalledTimes(3);
+    } finally {
+      mockOnEvent.mockReset();
+    }
+  });
+
+  it('does not record a completed auction for duplicate ad-unit element IDs', () => {
+    const code = 'duplicate-client-slot';
+    const firstSlot = {
+      getSlotElementId: () => code,
+      getTargeting: () => ['example-client'],
+      clearTargeting: vi.fn(),
+    };
+    const secondSlot = {
+      getSlotElementId: () => code,
+      getTargeting: () => ['example-client'],
+      clearTargeting: vi.fn(),
+    };
+    const recordPrebidAuction = vi.fn();
+    testWindow.tsjs = {
+      gptDiagnosticsRecorder: {
+        recordPrebidRefresh: vi.fn(),
+        recordPrebidAuction,
+      },
+    };
+    const { originalRefresh, pubads } = installGpt([firstSlot, secondSlot]);
+    mockPbjs.setTargetingForGPTAsync = vi.fn();
+    mockRequestBids.mockImplementation((opts) => {
+      opts.bidsBackHandler?.({}, false, 'duplicate-client-auction');
+    });
+    installPrebidNpm();
+
+    pubads.refresh([firstSlot, secondSlot]);
+
+    expect(recordPrebidAuction).not.toHaveBeenCalled();
+    expect(originalRefresh).toHaveBeenCalledWith([firstSlot, secondSlot], undefined);
+  });
+
+  it.each(['expiry', 'navigation change'] as const)(
+    'rejects a Prebid bidWon observation after %s',
+    (reason) => {
+      let now = 0;
+      vi.spyOn(performance, 'now').mockImplementation(() => now);
+      const adUnitCode = `example-${reason.replace(' ', '-')}`;
+      const slot = {
+        getSlotElementId: () => adUnitCode,
+        getTargeting: (key: string) =>
+          key === 'hb_bidder' ? ['example-client'] : key === 'hb_pb' ? ['2.40'] : [],
+        clearTargeting: vi.fn(),
+      };
+      const recordPrebidWin = vi.fn();
+      testWindow.tsjs = {
+        navGeneration: 1,
+        gptDiagnosticsRecorder: {
+          recordPrebidRefresh: vi.fn(),
+          recordPrebidAuction: vi.fn(),
+          recordPrebidWin,
+        },
+      };
+      const { pubads } = installGpt([slot]);
+      mockPbjs.setTargetingForGPTAsync = vi.fn();
+      mockRequestBids.mockImplementation((opts) => {
+        opts.bidsBackHandler?.({}, false, 'example-client-auction');
+      });
+
+      pubads.refresh([slot]);
+      const bidWon = mockOnEvent.mock.calls.find(([event]) => event === 'bidWon')?.[1];
+      expect(bidWon).toBeTypeOf('function');
+      if (reason === 'expiry') now = 30_001;
+      else testWindow.tsjs!.navGeneration = 2;
+      bidWon?.({
+        auctionId: 'example-client-auction',
+        adUnitCode,
+        adserverTargeting: { hb_bidder: 'example-client', hb_pb: '2.40' },
+      });
+
+      expect(recordPrebidWin).not.toHaveBeenCalled();
+    }
+  );
   it('suppresses one publisher delivery after TS claims first and allows a later refresh', () => {
     const code = 'example-ts-first-slot';
     const element = document.createElement('div');
@@ -7432,12 +8198,17 @@ describe('prebid publisher snapshots and delivery refreshes', () => {
     }
   });
 
-  it('completes a synthetic refresh when targeting throws', () => {
+  it('completes a synthetic refresh without recording auction evidence when targeting throws', () => {
     const slot = {
       getSlotElementId: () => 'example-throwing-targeting',
       getTargeting: () => [],
       clearTargeting: vi.fn(),
     };
+    const recordPrebidRefresh = vi.fn();
+    const recordPrebidAuction = vi.fn();
+    testWindow.tsjs = {
+      gptDiagnosticsRecorder: { recordPrebidRefresh, recordPrebidAuction },
+    };
     const { originalRefresh, pubads } = installGpt([slot]);
     mockPbjs.setTargetingForGPTAsync = vi.fn(() => {
       throw new Error('example targeting failure');
@@ -7447,6 +8218,8 @@ describe('prebid publisher snapshots and delivery refreshes', () => {
 
     pubads.refresh([slot]);
 
+    expect(recordPrebidRefresh).toHaveBeenCalledWith([slot]);
+    expect(recordPrebidAuction).not.toHaveBeenCalled();
     expect(originalRefresh).toHaveBeenCalledTimes(1);
     expect(originalRefresh).toHaveBeenCalledWith([slot], undefined);
   });
@@ -7558,7 +8331,7 @@ describe('prebid/client-side bidders', () => {
     mockPbjs.requestBids = mockRequestBids;
     mockPbjs.adUnits = [];
     mockGetUserIdsAsEids.mockReset();
-    mockGetUserIdsAsEids.mockReturnValue([]);
+    mockGetUserIdsAsEids.mockReturnValue([CANARY_EID]);
     // By default the manifest declares all adapters compiled in.
     testWindow.__tsjs_prebid_bundle = DEFAULT_BUNDLE_MANIFEST;
     delete testWindow.__tsjs_prebid;
@@ -8054,10 +8827,11 @@ describe('prebid/self-init without the external bundle', () => {
   });
 });
 
-describe('prebid self-init user ID module timing', () => {
-  const userSyncCallCount = () =>
-    mockSetConfig.mock.calls.filter(([arg]) => arg && typeof arg === 'object' && 'userSync' in arg)
-      .length;
+describe('prebid self-init writes no Prebid userSync settings', () => {
+  const userSyncCalls = () =>
+    mockSetConfig.mock.calls.filter(
+      ([arg]) => arg !== null && typeof arg === 'object' && 'userSync' in arg
+    );
 
   const setReadyState = (value: DocumentReadyState) => {
     Object.defineProperty(document, 'readyState', { value, configurable: true });
@@ -8072,29 +8846,27 @@ describe('prebid self-init user ID module timing', () => {
     setReadyState('complete');
   });
 
-  it('installs user ID modules immediately when the bundle loads after window load', async () => {
-    // The GPT slim loader appends this bundle from a window.load handler, so
-    // the document is already complete — a load listener would never fire.
+  it('writes no userSync when the bundle loads after window load', async () => {
     setReadyState('complete');
 
     await import('../../../src/integrations/prebid/index');
 
-    expect(userSyncCallCount()).toBeGreaterThan(0);
+    expect(mockSetConfig, 'the shim should still apply its own config').toHaveBeenCalledWith({
+      debug: false,
+    });
+    expect(userSyncCalls(), 'TS should leave userSync to the publisher and Prebid').toEqual([]);
   });
 
-  it('defers user ID modules to window load when the document is still loading', async () => {
+  it('writes no userSync when window load fires after install', async () => {
     setReadyState('loading');
 
     await import('../../../src/integrations/prebid/index');
-
-    expect(userSyncCallCount()).toBe(0);
-
     window.dispatchEvent(new Event('load'));
-    expect(userSyncCallCount()).toBe(1);
 
-    // { once: true } — a second load event must not reinstall.
-    window.dispatchEvent(new Event('load'));
-    expect(userSyncCallCount()).toBe(1);
+    expect(mockSetConfig, 'the shim should still apply its own config').toHaveBeenCalledWith({
+      debug: false,
+    });
+    expect(userSyncCalls(), 'TS should leave userSync to the publisher and Prebid').toEqual([]);
   });
 });
 
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts
index 06c1c33d87..3467f2b200 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts
@@ -2,128 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import {
   knownUserIdConfigNames,
-  resolvePrebidUserIdModulesFromEids,
   userIdSubmoduleKey,
 } from '../../../src/integrations/prebid/user_id_modules';
 import registry from '../../../src/integrations/prebid/user_id_modules.json';
 
-const sampleEids = [
-  { source: 'yahoo.com', uids: [{ id: 'connect-id', atype: 3 }] },
-  { source: 'criteo.com', uids: [{ id: 'criteo-id', atype: 1 }] },
-  { source: 'liveintent.com', uids: [{ id: 'liveintent-id', atype: 3 }] },
-  {
-    source: 'bidswitch.net',
-    uids: [{ id: 'bidswitch-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'liveintent.triplelift.com',
-    uids: [{ id: 'triplelift-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'rubiconproject.com',
-    uids: [{ id: 'rubicon-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'liveintent.indexexchange.com',
-    uids: [{ id: 'index-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'openx.net',
-    uids: [{ id: 'openx-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'pubmatic.com',
-    uids: [{ id: 'pubmatic-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'liveintent.sovrn.com',
-    uids: [{ id: 'sovrn-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  {
-    source: 'liveintent.unrulymedia.com',
-    uids: [{ id: 'unruly-id', atype: 3, ext: { provider: 'liveintent.com' } }],
-  },
-  { source: 'pubcid.org', uids: [{ id: 'pubcid-id', atype: 1 }] },
-  {
-    source: 'adserver.org',
-    uids: [{ id: 'tdid', atype: 1, ext: { rtiPartner: 'TDID' } }],
-    inserter: 'adserver.org',
-    matcher: 'adserver.org',
-    mm: 4,
-  },
-];
-
 describe('prebid user ID module registry', () => {
-  it('resolves the target-site EID sample to deterministic Prebid user ID modules', () => {
-    const result = resolvePrebidUserIdModulesFromEids(sampleEids);
-
-    expect(result).toEqual({
-      modules: [
-        'userId',
-        'connectIdSystem',
-        'criteoIdSystem',
-        'liveIntentIdSystem',
-        'sharedIdSystem',
-        'unifiedIdSystem',
-      ],
-      missingSources: [],
-    });
-  });
-
   it('exposes config names for modules that do not map EID sources', () => {
     expect(knownUserIdConfigNames()).toEqual(
       expect.arrayContaining(['lockrAIMId', 'pubProvidedId'])
     );
   });
 
-  it('maps the Google PAIR EID source to pairIdSystem', () => {
-    const result = resolvePrebidUserIdModulesFromEids([
-      { source: 'google.com', uids: [{ id: 'pair-id' }] },
-    ]);
-
-    expect(result).toEqual({
-      modules: ['userId', 'pairIdSystem'],
-      missingSources: [],
-    });
-  });
-
-  it('maps LiveRamp EIDs to identityLinkIdSystem', () => {
-    expect(
-      resolvePrebidUserIdModulesFromEids([
-        { source: 'liveramp.com', uids: [{ id: 'opaque-envelope', atype: 3 }] },
-      ])
-    ).toEqual({
-      modules: ['userId', 'identityLinkIdSystem'],
-      missingSources: [],
-    });
-  });
-
   it('includes identityLinkIdSystem in the checked-in default preset', () => {
     expect(registry.defaultPreset).toContain('identityLinkIdSystem');
   });
 
-  it('maps unknown LiveIntent provider-backed sources to liveIntentIdSystem', () => {
-    const result = resolvePrebidUserIdModulesFromEids([
-      {
-        source: 'new-liveintent-partner.example',
-        uids: [{ ext: { provider: 'liveintent.com' } }],
-      },
-    ]);
-
-    expect(result).toEqual({
-      modules: ['userId', 'liveIntentIdSystem'],
-      missingSources: [],
-    });
-  });
-
-  it('reports unknown non-LiveIntent sources', () => {
-    const result = resolvePrebidUserIdModulesFromEids([
-      { source: 'unknown.example', uids: [{ id: 'abc' }] },
-    ]);
-
-    expect(result).toEqual({ modules: [], missingSources: ['unknown.example'] });
-  });
-
   it('keys every alias of one module on the same submodule', () => {
     expect(userIdSubmoduleKey('pubCommonId')).toBe(userIdSubmoduleKey('sharedId'));
     expect(userIdSubmoduleKey('SHAREDID')).toBe(userIdSubmoduleKey('sharedId'));
@@ -136,6 +29,14 @@ describe('prebid user ID module registry', () => {
     expect(userIdSubmoduleKey('NotARegisteredModule')).toBe('notaregisteredmodule');
   });
 
+  it('carries no EID source metadata', () => {
+    expect(registry.modules.length, 'the registry should still list modules').toBeGreaterThan(0);
+    expect(
+      registry.modules.filter((entry) => 'eidSources' in entry).map((entry) => entry.moduleName),
+      'no entry should keep eidSources'
+    ).toEqual([]);
+  });
+
   it('keeps submodule keys and config names unique across registry entries', () => {
     // Actual registrations are checked by prebid-user-id-registry.test.mjs;
     // these checks prevent separate entries from sharing an ownership key.
diff --git a/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs b/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs
index 80ba90580c..26867d5e99 100644
--- a/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs
+++ b/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs
@@ -331,11 +331,17 @@ describe('tsjs-prebid production artifacts', () => {
     expect(shimCode).not.toContain(analyticsArtifact.manifest.prebidVersion);
     expect(shimCode).not.toContain('_pbjsGlobals');
     expect(analyticsArtifact.bundleCode.length).toBeGreaterThan(200_000);
-    // The original shim measures 40,354 characters. Shared strict trace JSON
-    // validation, request-ID hook association, and bounded pending lifecycle add
-    // 11,676 characters (52,030 total). Keep a narrow 52.5 KB guard: Prebid remains a separate artifact above 200 KB, and importing
-    // its runtime or private rendering helpers must still fail this regression.
-    expect(shimCode.length).toBeLessThan(52_500);
+    // The RC shim measures 53,175 bytes. Server identity mirroring and the
+    // registered-source EID cookie merge bring it to 54,447 bytes on Node 24.20.0.
+    // Round to the next 100 bytes; diagnostics listeners must still stay separate.
+    expect(Buffer.byteLength(shimCode)).toBeLessThan(54_500);
+    // The optional diagnostics bundle owns subscription, correlation, and
+    // candidate reads. Only its completed-auction bridge remains in the shim.
+    expect(shimCode).not.toContain('bidWon');
+    expect(shimCode).not.toContain('latestTargetedAuctionId');
+    expect(shimCode).not.toContain('recordPrebidAuction');
+    expect(shimCode).not.toContain('recordPrebidWin');
+    expect(shimCode).toContain('recordCompletedPrebidAuction');
     expect(shimCode).toContain('markWinningBidAsUsed');
   });
 
diff --git a/crates/trusted-server-js/lib/test/prebid-eid-fidelity.test.mjs b/crates/trusted-server-js/lib/test/prebid-eid-fidelity.test.mjs
new file mode 100644
index 0000000000..d12d4078ab
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/prebid-eid-fidelity.test.mjs
@@ -0,0 +1,528 @@
+// @vitest-environment node
+
+// Real Prebid.js arms for the trustedServer EID contract (spec 7.5). Unit
+// tests mock window.pbjs; this suite evaluates the generated external bundle
+// and the served shim together in a JSDOM page and captures /auction bodies.
+// Every arm except the D4 control fails against a shim built from main.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { JSDOM, requestInterceptor } from 'jsdom';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+
+import { moduleBuildOptions } from '../build-module-options.mjs';
+import { main } from '../build-prebid-external.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const libDir = path.resolve(__dirname, '..');
+
+const PAGE_ORIGIN = 'https://pub.example.com';
+const HOLD_LOAD_PATH = '/hold-window-load.css';
+const UNIFIED_ID_PATH = '/unified-id';
+const UNIFIED_ID_DELAY_MS = 200;
+const IDENTITY_LINK_GVL_ID = 97;
+
+const CONTROL_EID = {
+  source: 'control.example.com',
+  uids: [{ id: 'control-uid', atype: 1 }],
+};
+// The `[[ec.partners]]` sources the server injects; `ts-eids` keeps only these.
+const REGISTERED_SOURCES = ['control.example.com', 'ids.example.com', 'preset.example.com'];
+const PRESET_COOKIE_EIDS = [{ source: 'preset.example.com', uids: [{ id: 'preset-uid' }] }];
+const LIVERAMP_EID = {
+  source: 'liveramp.com',
+  uids: [{ id: 'fictional-idl-envelope', atype: 3 }],
+};
+const UNIFIED_ID_EID = {
+  source: 'adserver.org',
+  inserter: 'adserver.org',
+  matcher: 'adserver.org',
+  mm: 4,
+  uids: [{ id: 'fictional-tdid', atype: 1, ext: { rtiPartner: 'TDID' } }],
+};
+// The only safe form of a trustedServer TCF exception (spec 3.7).
+const FULL_BASIC_ADS_RULE = {
+  purpose: 'basicAds',
+  enforcePurpose: true,
+  enforceVendor: true,
+  softVendorExceptions: ['trustedServer'],
+};
+
+let outputDirectory;
+let bundleCode;
+let shimCode;
+
+beforeAll(async () => {
+  outputDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'trusted-server-prebid-eids-'));
+  await main([
+    '--modules-json',
+    JSON.stringify({
+      bidder: ['appnexusBidAdapter'],
+      userId: ['sharedIdSystem', 'unifiedIdSystem', 'identityLinkIdSystem'],
+    }),
+    '--out',
+    outputDirectory,
+  ]);
+  const manifest = JSON.parse(fs.readFileSync(path.join(outputDirectory, 'manifest.json'), 'utf8'));
+  bundleCode = fs.readFileSync(path.join(outputDirectory, manifest.filename), 'utf8');
+
+  const { build } = await import('vite');
+  await build(
+    moduleBuildOptions({
+      name: 'prebid',
+      entryPath: path.join(libDir, 'src', 'integrations', 'prebid', 'index.ts'),
+      outDir: outputDirectory,
+    })
+  );
+  shimCode = fs.readFileSync(path.join(outputDirectory, 'tsjs-prebid.js'), 'utf8');
+}, 240_000);
+
+afterAll(() => {
+  fs.rmSync(outputDirectory, { recursive: true, force: true });
+});
+
+function tcfData(vendorConsents, purposeOneConsent) {
+  return {
+    gdprApplies: true,
+    tcString: 'CPexampleTCStringForTests',
+    eventStatus: 'tcloaded',
+    cmpStatus: 'loaded',
+    apiVersion: '2',
+    purpose: {
+      consents: { 1: purposeOneConsent, 2: true, 3: true, 4: true },
+      legitimateInterests: {},
+    },
+    vendor: { consents: vendorConsents, legitimateInterests: {} },
+    publisher: { restrictions: {} },
+    specialFeatureOptins: {},
+  };
+}
+
+/**
+ * A CMP that answers at once: Purposes 2 to 4 consented, Purpose 1 as given,
+ * the given vendors only.
+ */
+function tcfApi(vendorConsents, purposeOneConsent) {
+  let nextListenerId = 1;
+  return (command, _version, callback) => {
+    if (command === 'addEventListener') {
+      callback(
+        { ...tcfData(vendorConsents, purposeOneConsent), listenerId: nextListenerId++ },
+        true
+      );
+    } else if (command === 'getTCData') {
+      callback(tcfData(vendorConsents, purposeOneConsent), true);
+    } else if (command === 'removeEventListener') {
+      callback(true, true);
+    }
+  };
+}
+
+/**
+ * A publisher page whose window.load is held by a stylesheet until
+ * releaseLoad(). Every fetch goes to a spy, installed before the bundle is
+ * evaluated, that records /auction bodies and answers the unifiedId endpoint
+ * after UNIFIED_ID_DELAY_MS.
+ */
+function createPage({ cookies = [], vendorConsents, purposeOneConsent = true } = {}) {
+  let releaseHeldLoad;
+  const loadHeld = new Promise((resolve) => {
+    releaseHeldLoad = resolve;
+  });
+  const dom = new JSDOM(
+    `<!doctype html><html><head><link rel="stylesheet" href="${PAGE_ORIGIN}${HOLD_LOAD_PATH}"></head><body></body></html>`,
+    {
+      url: `${PAGE_ORIGIN}/article`,
+      runScripts: 'outside-only',
+      pretendToBeVisual: true,
+      resources: {
+        interceptors: [
+          requestInterceptor(async (request) => {
+            if (new URL(request.url).pathname === HOLD_LOAD_PATH) {
+              await loadHeld;
+              return new Response('', {
+                status: 200,
+                headers: { 'Content-Type': 'text/css' },
+              });
+            }
+            return new Response('', { status: 204 });
+          }),
+        ],
+      },
+    }
+  );
+  const pageWindow = dom.window;
+
+  // jsdom drops Secure cookies on non-HTTPS origins (spec 7.1 rule 5).
+  pageWindow.document.cookie = 'ts-eids-probe=1; Path=/; Secure; SameSite=Lax';
+  expect(pageWindow.document.cookie, 'Secure cookies should work on the page origin').toContain(
+    'ts-eids-probe=1'
+  );
+  pageWindow.document.cookie = 'ts-eids-probe=; Path=/; Max-Age=0';
+  for (const cookie of cookies) {
+    pageWindow.document.cookie = cookie;
+  }
+
+  const auctionBodies = [];
+  pageWindow.fetch = vi.fn(async (resource, init) => {
+    const url = new URL(typeof resource === 'string' ? resource : resource.url, PAGE_ORIGIN);
+    if (url.pathname === '/auction') {
+      const body =
+        init?.body ?? (typeof resource === 'object' ? await resource.clone().text() : undefined);
+      auctionBodies.push(JSON.parse(body));
+    }
+    if (url.pathname === UNIFIED_ID_PATH) {
+      await new Promise((resolve) => setTimeout(resolve, UNIFIED_ID_DELAY_MS));
+      return new Response(JSON.stringify({ TDID: 'fictional-tdid' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      });
+    }
+    return new Response('{}', {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  });
+  pageWindow.Request = class PageRequest extends Request {
+    constructor(resource, init) {
+      super(typeof resource === 'string' ? new URL(resource, PAGE_ORIGIN).href : resource, init);
+    }
+  };
+  pageWindow.Headers = Headers;
+  pageWindow.Response = Response;
+  pageWindow.AbortController = AbortController;
+  if (!('isSecureContext' in pageWindow)) {
+    pageWindow.isSecureContext = true;
+  }
+  if (vendorConsents) {
+    pageWindow.__tcfapi = tcfApi(vendorConsents, purposeOneConsent);
+  }
+
+  // Mirror the server's head-injected state.
+  pageWindow.eval('window.pbjs = { que: [], cmd: [] };');
+  pageWindow.__tsjs_prebid = {
+    clientSideBidders: [],
+    serverSideBidders: [],
+    registeredSources: REGISTERED_SOURCES,
+  };
+
+  return {
+    pageWindow,
+    auctionBodies,
+    install() {
+      pageWindow.eval(bundleCode);
+      pageWindow.eval(shimCode);
+    },
+    async releaseLoad() {
+      releaseHeldLoad();
+      await vi.waitFor(() => expect(pageWindow.document.readyState).toBe('complete'));
+    },
+    async close() {
+      releaseHeldLoad();
+      // Let in-flight User ID work settle before jsdom tears down.
+      await new Promise((resolve) => setTimeout(resolve, UNIFIED_ID_DELAY_MS + 100));
+      pageWindow.close();
+    },
+  };
+}
+
+function readTsEidsCookie(pageWindow) {
+  const value = pageWindow.document.cookie.match(/(?:^|; )ts-eids=([^;]*)/)?.[1];
+  if (!value) {
+    return undefined;
+  }
+  return JSON.parse(
+    new TextDecoder().decode(Uint8Array.from(atob(value), (char) => char.charCodeAt(0)))
+  );
+}
+
+function presetTsEidsCookie() {
+  return `ts-eids=${btoa(JSON.stringify(PRESET_COOKIE_EIDS))}; Path=/; Secure; SameSite=Lax`;
+}
+
+function requestBids(pageWindow, adUnits) {
+  return new Promise((resolve) => {
+    pageWindow.pbjs.requestBids({
+      adUnits,
+      timeout: 1000,
+      bidsBackHandler: () => resolve(),
+    });
+  });
+}
+
+/** An ad unit with no publisher bidders: the shim adds only trustedServer. */
+function trustedServerAdUnits() {
+  return [
+    {
+      code: 'ad-slot-1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      bids: [],
+    },
+  ];
+}
+
+/** An ad unit with a client-side bidder that has a GVL ID (appnexus, 32). */
+function clientBidderAdUnits() {
+  return [
+    {
+      code: 'ad-slot-1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      bids: [{ bidder: 'appnexus', params: { placementId: 1 } }],
+    },
+  ];
+}
+
+function tcfEnforcementResults(pageWindow) {
+  return pageWindow.pbjs
+    .getEvents()
+    .filter((event) => event.eventType === 'tcf2Enforcement')
+    .map((event) => event.args);
+}
+
+describe('trustedServer EIDs with real Prebid.js', () => {
+  it('D1: never forwards an ID restricted to another bidder', async () => {
+    const page = createPage({
+      cookies: ['_sharedid=fictional-shared-id; Path=/'],
+    });
+    try {
+      page.install();
+      expect(page.pageWindow.document.readyState, 'install runs before load').toBe('loading');
+      page.pageWindow.pbjs.setConfig({
+        userSync: {
+          auctionDelay: 300,
+          userIds: [
+            {
+              name: 'sharedId',
+              bidders: ['appnexus'],
+              storage: { type: 'cookie', name: '_sharedid', expires: 30 },
+            },
+          ],
+        },
+        ortb2: { user: { ext: { eids: [CONTROL_EID] } } },
+      });
+
+      await requestBids(page.pageWindow, trustedServerAdUnits());
+      expect(page.pageWindow.document.readyState, 'the auction runs before load').toBe('loading');
+
+      expect(
+        page.pageWindow.pbjs.getUserIdsAsEids().map((eid) => eid.source),
+        'precondition: the restricted module produced its ID'
+      ).toContain('pubcid.org');
+      expect(
+        page.auctionBodies.map((body) => body.eids),
+        'the /auction body should carry the control and not the restricted ID'
+      ).toEqual([[CONTROL_EID]]);
+      expect(readTsEidsCookie(page.pageWindow), 'ts-eids should copy the body set').toEqual([
+        CONTROL_EID,
+      ]);
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+
+  it('D3: forwards same-source entries separately with their own EID-level fields', async () => {
+    const first = {
+      source: 'ids.example.com',
+      inserter: 'inserter-a.example.com',
+      mm: 2,
+      ext: { segments: ['s1'] },
+      uids: [{ id: 'ids-uid', atype: 1 }],
+    };
+    const second = {
+      source: 'ids.example.com',
+      inserter: 'inserter-b.example.com',
+      matcher: 'matcher-b.example.com',
+      mm: 3,
+      uids: [{ id: 'ids-uid', atype: 1 }],
+    };
+    const page = createPage();
+    try {
+      page.install();
+      expect(page.pageWindow.document.readyState, 'install runs before load').toBe('loading');
+      page.pageWindow.pbjs.setConfig({
+        ortb2: { user: { ext: { eids: [first, second] } } },
+      });
+
+      await requestBids(page.pageWindow, trustedServerAdUnits());
+      expect(page.pageWindow.document.readyState, 'the auction runs before load').toBe('loading');
+
+      expect(page.auctionBodies.map((body) => body.eids)).toEqual([[first, second]]);
+      const { ext: _eidExt, ...firstWithoutExt } = first;
+      expect(
+        readTsEidsCookie(page.pageWindow),
+        'ts-eids should hold both entries without EID-level ext'
+      ).toEqual([firstWithoutExt, second]);
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+
+  it('D4: the first auction after window.load waits for a pending User ID module', async () => {
+    const page = createPage();
+    try {
+      page.install();
+      expect(page.pageWindow.document.readyState, 'step 1 starts before load').toBe('loading');
+      await page.releaseLoad();
+
+      page.pageWindow.pbjs.setConfig({
+        userSync: {
+          userIds: [
+            {
+              name: 'unifiedId',
+              params: { url: `${PAGE_ORIGIN}${UNIFIED_ID_PATH}` },
+            },
+          ],
+        },
+      });
+      expect(page.pageWindow.document.readyState, 'step 2 runs after load').toBe('complete');
+      expect(
+        page.pageWindow.pbjs.getConfig('userSync').auctionDelay,
+        "Prebid's default auctionDelay should apply"
+      ).toBe(500);
+
+      await requestBids(page.pageWindow, trustedServerAdUnits());
+
+      expect(
+        page.auctionBodies.map((body) => body.eids),
+        'the first /auction should carry the delayed unifiedId'
+      ).toEqual([[UNIFIED_ID_EID]]);
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+
+  it('D4 control: the first auction before window.load waits, on every build', async () => {
+    const page = createPage();
+    try {
+      page.install();
+      page.pageWindow.pbjs.setConfig({
+        userSync: {
+          userIds: [
+            {
+              name: 'unifiedId',
+              params: { url: `${PAGE_ORIGIN}${UNIFIED_ID_PATH}` },
+            },
+          ],
+        },
+      });
+      expect(page.pageWindow.document.readyState, 'the auction runs before load').toBe('loading');
+
+      await requestBids(page.pageWindow, trustedServerAdUnits());
+
+      // A projection, not the full entry: main drops EID-level fields, and
+      // this control must pass on main and on the branch alike.
+      expect(
+        page.auctionBodies.map((body) =>
+          (body.eids ?? []).map((eid) => [eid.source, eid.uids.map((uid) => uid.id)])
+        ),
+        'the spy and the module should deliver unifiedId to the first auction'
+      ).toEqual([[['adserver.org', ['fictional-tdid']]]]);
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+
+  async function runTcfPage({ withRule, purposeOneConsent = true }) {
+    const page = createPage({
+      cookies: ['idl_env=fictional-idl-envelope; Path=/', presetTsEidsCookie()],
+      vendorConsents: { [IDENTITY_LINK_GVL_ID]: true },
+      purposeOneConsent,
+    });
+    page.install();
+    expect(page.pageWindow.document.readyState, 'install runs before load').toBe('loading');
+    expect(readTsEidsCookie(page.pageWindow), 'precondition: ts-eids is preset').toEqual(
+      PRESET_COOKIE_EIDS
+    );
+    page.pageWindow.pbjs.setConfig({
+      consentManagement: {
+        gdpr: {
+          cmpApi: 'iab',
+          timeout: 500,
+          ...(withRule ? { rules: [FULL_BASIC_ADS_RULE] } : {}),
+        },
+      },
+      userSync: {
+        auctionDelay: 300,
+        userIds: [
+          {
+            name: 'identityLink',
+            params: { pid: '999', notUse3P: true },
+            storage: { type: 'cookie', name: 'idl_env', expires: 15 },
+          },
+        ],
+      },
+      ortb2: { user: { ext: { eids: [CONTROL_EID] } } },
+    });
+    await requestBids(page.pageWindow, clientBidderAdUnits());
+    expect(page.pageWindow.document.readyState, 'the auction runs before load').toBe('loading');
+    return page;
+  }
+
+  it('TCF: without an exception no client EIDs reach TS and ts-eids is cleared', async () => {
+    const page = await runTcfPage({ withRule: false });
+    try {
+      expect(
+        tcfEnforcementResults(page.pageWindow).some((result) =>
+          result.biddersBlocked.includes('trustedServer')
+        ),
+        'positive control: Prebid blocked trustedServer'
+      ).toBe(true);
+      expect(page.auctionBodies, 'no /auction request should be sent').toEqual([]);
+      expect(readTsEidsCookie(page.pageWindow), 'ts-eids should be cleared').toBeUndefined();
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+
+  it('TCF: with the full basicAds rule TS gets its EIDs and other bidders stay blocked', async () => {
+    const page = await runTcfPage({ withRule: true });
+    try {
+      // Prebid appends module EIDs after ortb2 entries (spec 3.2 step 3).
+      expect(page.auctionBodies.map((body) => body.eids)).toEqual([[CONTROL_EID, LIVERAMP_EID]]);
+      const results = tcfEnforcementResults(page.pageWindow);
+      expect(
+        results.some((result) => result.biddersBlocked.includes('appnexus')),
+        'the rule must not switch off enforcement for other bidders'
+      ).toBe(true);
+      expect(
+        results.some((result) => result.biddersBlocked.includes('trustedServer')),
+        'trustedServer should not be blocked with the rule'
+      ).toBe(false);
+      // LiveRamp stays in the request body but is not a registered cookie
+      // source. The registered preset source survives this request's merge.
+      expect(readTsEidsCookie(page.pageWindow), 'ts-eids should merge registered sources').toEqual([
+        CONTROL_EID,
+        ...PRESET_COOKIE_EIDS,
+      ]);
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+
+  it('TCF: with the full basicAds rule and Purpose 1 denied, TS gets its ortb2 EIDs and ts-eids is cleared', async () => {
+    const page = await runTcfPage({ withRule: true, purposeOneConsent: false });
+    try {
+      // Purpose 1 gates the User ID module (enrichEids), not ortb2 EIDs
+      // (transmitEids), so only the control reaches TS.
+      expect(
+        page.auctionBodies.map((body) => body.eids),
+        'Prebid should still let trustedServer forward the ortb2 EID'
+      ).toEqual([[CONTROL_EID]]);
+      expect(
+        tcfEnforcementResults(page.pageWindow).some((result) =>
+          result.biddersBlocked.includes('trustedServer')
+        ),
+        'trustedServer should not be blocked with the rule'
+      ).toBe(false);
+      expect(
+        readTsEidsCookie(page.pageWindow),
+        'ts-eids should be cleared without Purpose 1'
+      ).toBeUndefined();
+    } finally {
+      await page.close();
+    }
+  }, 60_000);
+});
diff --git a/crates/trusted-server-js/lib/test/shared/sdk_url.test.ts b/crates/trusted-server-js/lib/test/shared/sdk_url.test.ts
new file mode 100644
index 0000000000..add341dc0b
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/shared/sdk_url.test.ts
@@ -0,0 +1,71 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import {
+  installLockrGuard,
+  resetGuardState as resetLockrGuard,
+} from '../../src/integrations/lockr/script_guard';
+import {
+  installPermutiveGuard,
+  resetGuardState as resetPermutiveGuard,
+} from '../../src/integrations/permutive/script_guard';
+import { parseSdkNetworkUrl } from '../../src/shared/sdk_url';
+
+describe.each(['http:', 'https:'])('SDK shorthand with an %s document base', (baseScheme) => {
+  let base: HTMLBaseElement;
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    base = document.createElement('base');
+    base.href = `${baseScheme}//publisher.example.com/page`;
+    document.head.appendChild(base);
+    container = document.createElement('div');
+    document.body.appendChild(container);
+    installLockrGuard();
+    installPermutiveGuard();
+  });
+
+  afterEach(() => {
+    resetLockrGuard();
+    resetPermutiveGuard();
+    container.remove();
+    base.remove();
+  });
+
+  it.each([
+    '\0https://aim.loc.kr/identity-lockr.js',
+    'https://aim.loc.kr/identity-lockr.js\0',
+    '\0https://cdn.permutive.com/app-web.js',
+    'https://cdn.permutive.com/app-web.js\0',
+  ])('leaves NUL-containing static markup unowned: %s', (raw) => {
+    expect(parseSdkNetworkUrl(raw)).toBeNull();
+    const template = document.createElement('template');
+    template.innerHTML = `<script src="${raw}"></script>`;
+    const script = template.content.querySelector('script')!;
+    const attribute = raw.split('\0').join('\ufffd');
+    expect(script.getAttribute('src')).toBe(attribute);
+
+    container.appendChild(script);
+    expect(script.getAttribute('src')).toBe(attribute);
+  });
+
+  it.each([
+    ['http:', 'aim.loc.kr/identity-lockr.js', 'lockr'],
+    ['https:', 'aim.loc.kr/identity-lockr.js', 'lockr'],
+    ['http:', 'cdn.permutive.com/app-web.js', 'permutive'],
+    ['https:', 'cdn.permutive.com/app-web.js', 'permutive'],
+  ])('resolves %s%s before the %s guard claims it', (scheme, path, owner) => {
+    const raw = `${scheme}${path}`;
+    expect(parseSdkNetworkUrl(raw)).toBeNull();
+
+    const script = document.createElement('script');
+    script.setAttribute('src', raw);
+    expect(script.src).toBe(
+      scheme === baseScheme ? `${baseScheme}//publisher.example.com/${path}` : `${scheme}//${path}`
+    );
+    container.appendChild(script);
+
+    expect(script.getAttribute('src')).toBe(
+      scheme === baseScheme ? raw : `${window.location.origin}/integrations/${owner}/sdk`
+    );
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/trace-assets.test.mjs b/crates/trusted-server-js/lib/test/trace-assets.test.mjs
index 3e2c68a17e..3627ba68ff 100644
--- a/crates/trusted-server-js/lib/test/trace-assets.test.mjs
+++ b/crates/trusted-server-js/lib/test/trace-assets.test.mjs
@@ -6,6 +6,8 @@ import { fileURLToPath } from 'node:url';
 
 import { describe, expect, it } from 'vitest';
 
+import { traceSourceDigest } from '../trace-asset-sources.mjs';
+
 const library = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const traceBuild = path.join(library, '..', 'dist', 'trace');
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
@@ -17,6 +19,9 @@ describe('versioned trace assets', () => {
     const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
     expect(manifest.schema_version).toBe(1);
     expect(manifest.source_sha256).toMatch(/^[a-f\d]{64}$/);
+    expect(manifest.source_sha256, 'should match the current trace sources and toolchain').toBe(
+      traceSourceDigest(library)
+    );
     expect(manifest.assets.map((asset) => asset.path)).toEqual([
       '/_ts/trace/assets/v1.js',
       '/_ts/trace/assets/v1.css',
diff --git a/crates/trusted-server-js/lib/test/trace/projection.test.ts b/crates/trusted-server-js/lib/test/trace/projection.test.ts
index 0cde5b2e1f..5ebe958073 100644
--- a/crates/trusted-server-js/lib/test/trace/projection.test.ts
+++ b/crates/trusted-server-js/lib/test/trace/projection.test.ts
@@ -77,6 +77,38 @@ describe('explicit GPT public projection', () => {
       ).toBe(false);
     }
   );
+  it('projects combined server and Prebid evidence without widening the mobile report schema', () => {
+    const store = new GptDiagnosticsStore({ now: () => 1 });
+    const slot = { getSlotElementId: () => 'example' };
+    store.recordTrustedServerOpportunity(slot, 'example', 'no_candidate', undefined, undefined, {
+      auctionType: 'ssat',
+      winner: { bidder: 'private-server-bidder', priceBucket: '1.00' },
+      serverTimings: { auctionResolvedMs: 84 },
+    });
+    store.recordPrebidAuction(slot, 'private-prebid-auction', {
+      bidder: 'private-prebid-bidder',
+      priceBucket: '2.00',
+    });
+    store.recordSlotRequested(slot);
+    const source = observedGptSource(store);
+    expect(source.slots[0]!.requests[0]).toMatchObject({
+      auctionType: 'competing',
+      serverAuctionTimingOrigin: 'navigation',
+    });
+    const projected = projectTraceGptDiagnostics(source, TRACE_ORIGIN);
+    expect(projected.ok).toBe(true);
+    if (!projected.ok) throw new Error('should project combined diagnostics');
+    const cycle = projected.value.slots[0]!.requests[0]!;
+    for (const key of [
+      'auctionType',
+      'auctionWinner',
+      'prebidAuction',
+      'serverAuctionTimings',
+      'serverAuctionTimingOrigin',
+    ])
+      expect(cycle).not.toHaveProperty(key);
+    expect(JSON.stringify(projected.value)).not.toContain('private-');
+  });
   it('classifies inspection failures without reading caller-controlled errors', () => {
     let reads = 0;
     const failure = Object.defineProperty(new Error('private-message'), 'message', {
diff --git a/crates/trusted-server-js/lib/test/trace/types.test.ts b/crates/trusted-server-js/lib/test/trace/types.test.ts
index 97a9c2ccc0..9eca4e9c2c 100644
--- a/crates/trusted-server-js/lib/test/trace/types.test.ts
+++ b/crates/trusted-server-js/lib/test/trace/types.test.ts
@@ -57,6 +57,11 @@ const cycle = {
   requestPath: 'copy',
   requestIntentId: 'copy',
   trustedServerAuctionId: 'copy',
+  auctionType: 'exclude',
+  auctionWinner: 'exclude',
+  prebidAuction: 'exclude',
+  serverAuctionTimings: 'exclude',
+  serverAuctionTimingOrigin: 'exclude',
   opportunityToRequestMs: 'copy',
   replacedRequestNumber: 'copy',
   previousRenderToRequestMs: 'copy',
diff --git a/crates/trusted-server-js/lib/trace-assets-manifest.json b/crates/trusted-server-js/lib/trace-assets-manifest.json
index 8450d65363..deda347cce 100644
--- a/crates/trusted-server-js/lib/trace-assets-manifest.json
+++ b/crates/trusted-server-js/lib/trace-assets-manifest.json
@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "source_sha256": "e188da9359876286f6488882a1093f8b9ed6d0471df112f817623612ec18ae1c",
+  "source_sha256": "3d174896817ca880ca4994487e66b793ccbccf017f7b6c92e81951b8e367229a",
   "assets": [
     {
       "path": "/_ts/trace/assets/v1.js",
diff --git a/docs/.vitepress/config.mts b/docs/.vitepress/config.mts
index 13c3c3c984..d52f6afc84 100644
--- a/docs/.vitepress/config.mts
+++ b/docs/.vitepress/config.mts
@@ -111,6 +111,10 @@ export default withMermaid(
           items: [
             { text: 'Edge Cookies', link: '/guide/edge-cookies' },
             { text: 'EC Setup', link: '/guide/ec-setup-guide' },
+            {
+              text: 'Identity Providers',
+              link: '/guide/identity-providers',
+            },
             { text: 'GDPR Compliance', link: '/guide/gdpr-compliance' },
             { text: 'Ad Serving', link: '/guide/ad-serving' },
             {
@@ -169,6 +173,10 @@ export default withMermaid(
               text: 'GPT Runtime Diagnostics',
               link: '/guide/integrations/gpt-diagnostics',
             },
+            {
+              text: 'GPT Diagnostics Label Dictionary',
+              link: '/guide/integrations/gpt-diagnostics-dictionary',
+            },
             { text: 'Lockr', link: '/guide/integrations/lockr' },
             { text: 'Next.js', link: '/guide/integrations/nextjs' },
             { text: 'Osano', link: '/guide/integrations/osano' },
diff --git a/docs/guide/api-reference.md b/docs/guide/api-reference.md
index 99059adba0..873c599317 100644
--- a/docs/guide/api-reference.md
+++ b/docs/guide/api-reference.md
@@ -213,6 +213,66 @@ curl -X POST https://edge.example.com/auction \
   -d '{"adUnits":[{"code":"banner","mediaTypes":{"banner":{"sizes":[[300,250]]}}}]}'
 ```
 
+#### `ts_eids_s` mirror payload
+
+The endpoint never writes KV. When `[ec.identity] mirror_enabled` is on
+(it is off by default), the response may carry `ext.ts_eids_s`, the payload
+for the client-only `__Host-ts-eids-s` mirror cookie that the shim writes
+for page scripts. It has one of three forms:
+
+- `{ "value": "<base64url>", "max_age": 86400 }` when the request read a live,
+  consenting row and the servable server IDs are not empty. `value` is the
+  unpadded base64url encoding of compact JSON `{"v":1,"eids":[...]}`, at most
+  2,048 bytes. `max_age` is at most 86,400 seconds and never past the earliest
+  expiry of an ID in the set.
+- `{ "clear": true }` when consent denies EID persistence, when the row is a
+  tombstone or missing, or when the servable set is empty. The shim expires
+  the cookie.
+- Absent when the request read no KV. The shim leaves the cookie as it is.
+
+#### Browser EIDs (`eids`)
+
+The optional `eids` array carries OpenRTB 2.6 EID objects from the browser:
+
+```json
+{
+  "eids": [
+    {
+      "source": "ids.example.com",
+      "inserter": "inserter.example.com",
+      "matcher": "ids.example.com",
+      "mm": 4,
+      "ext": { "segments": ["s1"] },
+      "uids": [
+        { "id": "fictional-uid", "atype": 1, "ext": { "partner": "example" } }
+      ]
+    }
+  ]
+}
+```
+
+Each entry is validated on its own. A malformed entry or field is dropped and
+the request proceeds; only a malformed body outside `eids` rejects the request.
+
+| Field                 | Rule                                                     |
+| --------------------- | -------------------------------------------------------- |
+| entry                 | JSON object that parses on its own                       |
+| `source`              | string, not blank, at most 255 UTF-8 bytes               |
+| `uids`                | at least one valid UID; the first 32 valid UIDs are kept |
+| `uids[].id`           | string, not blank, at most 512 bytes                     |
+| `uids[].atype`, `mm`  | integer from 0 to 2,147,483,647                          |
+| `uids[].ext`, `ext`   | JSON object, at most 2,048 bytes as compact JSON         |
+| `inserter`, `matcher` | string, not blank, at most 255 bytes                     |
+| array                 | duplicates dropped, then the first 64 entries kept       |
+
+Entries keep their order and a source may repeat. When the body has no valid
+entry, the `ts-eids` cookie is used with the same rules. Browser EIDs are used
+only for a request with an allowed EC.
+
+The response's `x-ts-eids` header carries the consent-gated EIDs sent to
+providers, base64-encoded JSON including EID-level fields, capped at 4,096
+bytes. `x-ts-eids-truncated: true` marks a truncated value.
+
 #### PBS stored-request intent
 
 The reserved `trustedServer` bid accepts `storedRequest` inside `params`, beside
@@ -290,6 +350,16 @@ any `OPTIONS` returns `403`; missing `[creative_opportunities]` returns `404`.
 The `200`, `400`, and `403` terminal responses are `private, no-store`. The
 endpoint has no built-in authentication, CORS grant, or rate limiter.
 
+**Identity:** the endpoint never writes KV. When `[ec.identity]
+mirror_enabled` is on, its JSON body may carry a `ts_eids_s` member, the payload for the client-only `__Host-ts-eids-s` mirror
+cookie (see [`ext.ts_eids_s`](#ts-eids-s-mirror-payload) under `POST /auction`
+for its shape):
+
+- `{ "value": "...", "max_age": 86400 }`: write the cookie with this value and
+  `Max-Age`.
+- `{ "clear": true }`: expire the cookie.
+- Absent: the request read no KV, so leave the cookie as it is.
+
 **Configuration:** `[creative_opportunities]`, `[auction]`, slot page patterns,
 provider profiles, and consent settings. Bot and prefetch requests retain slot
 shape but skip live provider calls.
@@ -327,6 +397,10 @@ below `[publisher].domain` receive reflected credentialed CORS for
 The endpoint is Fastly-only and requires the EC store and a statically
 configured `[[ec.partners]]` token.
 
+**No writes:** the endpoint never writes KV, and it omits an ID that has expired. The response shape is unchanged: one UID per source, even for a record that holds several.
+
+**Provider-written IDs need a browser call.** The EC ID is a bearer value: partners and the origin hold it, and any server can send it in a `ts-ec` cookie. So an ID a server-side identity provider wrote is returned only when the request carries an allowed `Origin` and `Sec-Fetch-Site: same-origin` or `same-site`, as a browser's fetch from the publisher's site does. Otherwise the response omits `uid` and `eid`, as if no ID were synced. IDs from browser ingest, batch sync and pull sync are returned as before.
+
 **Request:**
 
 - Uses `ts-ec` cookie and consent signals
@@ -903,7 +977,7 @@ curl -u 'admin:<resolved-admin-password>' \
 
 ### GET /\_ts/admin/eids
 
-Parses the request's `ts-eids` and `sharedId` cookies and previews which configured partner IDs cookie ingestion would match or drop. It performs request inspection only: it does not read or write KV and is available on every adapter. The preview lists candidate matches from the cookies alone; it does not apply the TCF Purpose 1 + 4 consent gate on identity-graph writes, does not see `/auction` request-body EIDs, and does not account for partner UIDs already stored in KV.
+Parses the request's `ts-eids` and `sharedId` cookies and previews which configured partner IDs cookie ingestion would match or drop. It performs request inspection only: it does not read or write KV and is available on every adapter. The preview lists candidate matches from the cookies alone; it does not apply the TCF Purpose 1 + 4 consent gate on identity-graph writes, does not see `/auction` request-body EIDs, and does not account for partner UIDs already stored in KV. Cookie entries are validated one by one with the `/auction` body rules, so a mistyped field drops only that field, and the returned `eids` include `inserter`, `matcher` and `mm` when present. The `ingest.unmatched` diagnostics still read the raw cookie, before validation.
 
 After successful authentication this endpoint always returns `200 OK`; missing or malformed cookies are represented by `cookie_present`, `sharedid_present`, and `parse_error`. The `ingest.matched` and `ingest.unmatched` arrays show the ingestion preview. Each unmatched entry contains its `source` and either a `no_partner` reason when no configured partner recognizes it or `no_valid_uid` when the partner exists but every supplied UID is empty or exceeds the storage limit.
 
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 8413e77d09..e24ba57d72 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -61,6 +61,7 @@ publisher, trusted-client-IP, EC, handler, Tinybird, DataDome, and S3 fields:
 - `ec.partners[*].ts_pull_token`, when pull sync is enabled
 - `handlers[*].password`
 - `tinybird.auction_token_secret`, when Tinybird auction telemetry is enabled
+- `tinybird.access_token_secret`, when Tinybird access telemetry is enabled
 - `integrations.datadome.server_side_key_secret_name`, when protection is enabled
 - `integrations.datadome.protection_test_bypass.credential_secret_name`, when the bypass is enabled
 - `proxy.asset_routes[*].auth.access_key_id`, `secret_access_key`, and optional `session_token`
@@ -70,11 +71,8 @@ resolved only while an instance builds runtime settings. An adapter can map the
 logical ID to a different physical name. For example, Fastly commonly maps
 `trusted_server_secrets` to physical store `ts_secrets`.
 
-One accepted secret-shaped field is deliberately different:
-
-- `tinybird.access_token_secret` is deprecated input. It is accepted for
-  migration, then discarded and omitted from serialized config; use
-  `tinybird.auction_token_secret` as the store key name instead.
+Both Tinybird token fields are active secret-store key references when their
+respective sinks are enabled.
 
 The four deprecated `secret_store` selectors under Tinybird, DataDome, its
 protection-test bypass, and S3 route authentication are also accepted and
@@ -90,26 +88,26 @@ diff; it does not move inline values to a secret store.
 The following table records the independent lifecycle, key-identity,
 serialization, runtime, and secret axes for every exceptional field:
 
-| Path                                                         | Lifecycle  | Key identity                        | Serialization | Runtime              | Secret handling          |
-| ------------------------------------------------------------ | ---------- | ----------------------------------- | ------------- | -------------------- | ------------------------ |
-| `AssetOriginAuth.s3_sig_v4`                                  | deprecated | alias of `AssetOriginAuth.s3_sigv4` | skipped       | deserialization only | none                     |
-| `DataDomeConfig.server_side_key_secret_name`                 | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `DataDomeConfig.server_side_key_secret_store`                | deprecated | canonical                           | skipped       | normalized away      | none                     |
-| `DataDomeProtectionTestBypassConfig.credential_secret_name`  | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `DataDomeProtectionTestBypassConfig.credential_secret_store` | deprecated | canonical                           | skipped       | normalized away      | none                     |
-| `Ec.passphrase`                                              | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `EcPartner.api_token`                                        | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `EcPartner.ts_pull_token`                                    | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `Handler.password`                                           | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `Publisher.proxy_secret`                                     | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `S3SigV4AuthConfig.access_key_id`                            | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `S3SigV4AuthConfig.secret_access_key`                        | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `S3SigV4AuthConfig.secret_store`                             | deprecated | canonical                           | skipped       | normalized away      | none                     |
-| `S3SigV4AuthConfig.session_token`                            | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `TinybirdSettings.access_token_secret`                       | deprecated | canonical                           | skipped       | normalized away      | accepted, then discarded |
-| `TinybirdSettings.auction_token_secret`                      | canonical  | canonical                           | serialized    | active               | store resolved           |
-| `TinybirdSettings.secret_store`                              | deprecated | canonical                           | skipped       | normalized away      | none                     |
-| `TrustedClientIpConfig.shared_secret`                        | canonical  | canonical                           | serialized    | active               | store resolved           |
+| Path                                                         | Lifecycle  | Key identity                        | Serialization           | Runtime              | Secret handling |
+| ------------------------------------------------------------ | ---------- | ----------------------------------- | ----------------------- | -------------------- | --------------- |
+| `AssetOriginAuth.s3_sig_v4`                                  | deprecated | alias of `AssetOriginAuth.s3_sigv4` | skipped                 | deserialization only | none            |
+| `DataDomeConfig.server_side_key_secret_name`                 | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `DataDomeConfig.server_side_key_secret_store`                | deprecated | canonical                           | skipped                 | normalized away      | none            |
+| `DataDomeProtectionTestBypassConfig.credential_secret_name`  | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `DataDomeProtectionTestBypassConfig.credential_secret_store` | deprecated | canonical                           | skipped                 | normalized away      | none            |
+| `Ec.passphrase`                                              | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `EcPartner.api_token`                                        | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `EcPartner.ts_pull_token`                                    | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `Handler.password`                                           | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `Publisher.proxy_secret`                                     | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `S3SigV4AuthConfig.access_key_id`                            | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `S3SigV4AuthConfig.secret_access_key`                        | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `S3SigV4AuthConfig.secret_store`                             | deprecated | canonical                           | skipped                 | normalized away      | none            |
+| `S3SigV4AuthConfig.session_token`                            | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `TinybirdSettings.access_token_secret`                       | canonical  | canonical                           | serialized when present | active sink only     | store resolved  |
+| `TinybirdSettings.auction_token_secret`                      | canonical  | canonical                           | serialized              | active               | store resolved  |
+| `TinybirdSettings.secret_store`                              | deprecated | canonical                           | skipped                 | normalized away      | none            |
+| `TrustedClientIpConfig.shared_secret`                        | canonical  | canonical                           | serialized              | active               | store resolved  |
 
 Prepare an initial reference-based deployment in this order:
 
@@ -163,6 +161,7 @@ auction_token_secret = "tinybird_auction_append_token"
 Store the APPEND token value under `tinybird_auction_append_token` in the
 physical store mapped from `trusted_server_secrets`. The token is resolved once
 at startup. Disabled Tinybird telemetry does not require or resolve the token.
+`access_token_secret` follows the same path when `access_enabled` is on.
 The legacy `tinybird.secret_store` field is accepted for one migration release,
 but it is ignored and omitted from newly pushed config.
 
@@ -202,13 +201,14 @@ fail and the service will return its startup-error response.
 | `[[handlers]]`             | Ordered HTTP Basic-auth rules                                           |
 | `[image_optimizer]`        | Reusable Fastly Image Optimizer profiles                                |
 | `[integrations.*]`         | Typed partner and browser integration settings                          |
+| `[observability]`          | Server-Timing header emission and bounded publisher route sections      |
 | `[proxy]`                  | Proxy allowlist, TLS policy, and asset routes                           |
 | `[publisher]`              | Publisher domain, origin, and proxy signing key                         |
 | `[request_signing]`        | Outbound Ed25519 request signing and management-store IDs               |
 | `[response_headers]`       | Headers added to Trusted Server responses                               |
 | `[rewrite]`                | First-party URL rewrite exclusions                                      |
 | `[tester_cookie]`          | Optional tester-cookie endpoints                                        |
-| `[tinybird]`               | Direct Tinybird auction telemetry                                       |
+| `[tinybird]`               | Direct Tinybird auction and access telemetry                            |
 | `[trusted_forwarder]`      | Authenticated browser-facing host and scheme forwarding                 |
 | `[trusted_client_ip]`      | Authenticated front-door client-IP forwarding                           |
 
@@ -743,24 +743,125 @@ The legacy `[consent].consent_store` setting has been removed. Trusted Server us
 
 Legacy consent-store records are not read or migrated into `ec.ec_store`. Their payload schema is not authoritative EC lifecycle state, so do not copy those records into the identity store. You may retain the old store unchanged for a defined rollback window, then unlink its platform resource binding and delete it. No browser-cookie or EC identity-store migration is required.
 
+### Identity Providers (`[ec.identity]`)
+
+Policy for server-side identity providers. The table is optional; every key has a default.
+
+| Key                       | Type    | Default | Meaning                                                                                                                                                                                                         |
+| ------------------------- | ------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `max_concurrency`         | Integer | `4`     | Most providers dispatched at once (at least 1). Replaces `ec.pull_sync_concurrency`.                                                                                                                            |
+| `hold_budget_ms`          | Integer | `100`   | Total wall-clock time a navigation may wait for all hold-mode providers (at most 1000)                                                                                                                          |
+| `hold_retry_sec`          | Integer | `300`   | Seconds to wait before calling a provider again after the hold budget cut its call off                                                                                                                          |
+| `max_response_bytes`      | Integer | `65536` | Largest provider response body accepted, before and after decoding                                                                                                                                              |
+| `max_backend_requests`    | Integer | `32`    | Most backend requests one Fastly execution may start, counting the origin, the auction and provider calls. A provider call past it is skipped, not counted as a failure. Set `10` on Fastly trial accounts      |
+| `mirror_enabled`          | Boolean | `false` | Return the `__Host-ts-eids-s` mirror payload from `/auction` and `/_ts/page-bids`                                                                                                                               |
+| `spa_writer_interval_sec` | Integer | `300`   | Seconds a same-origin `/_ts/page-bids` call from a real browser waits after the row's last write before it writes browser ingest and after-send provider results itself, for single-page apps. `0` turns it off |
+
+#### Per-provider keys
+
+Each provider can have an `[ec.identity.providers.<id>]` table. A provider with no table uses the defaults. The table name is the provider ID: the integration ID of a vendor provider, or the generated `pull-` ID of a pull partner.
+
+| Key                           | Type    | Default                            | Meaning                                                                                                                                                                                                   |
+| ----------------------------- | ------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `mode`                        | String  | `after_send`                       | `hold` runs before the navigation's auction; `after_send` runs after the response is sent. Providers run on a returning visitor's page load; a `hold` provider also on a new visitor's first one (below). |
+| `timeout_ms`                  | Integer | `hold_budget_ms`                   | Hold-mode call timeout, at most `hold_budget_ms`                                                                                                                                                          |
+| `after_send_timeout_ms`       | Integer | `1000`                             | Timeout for any call made after send, `1` to `10000`                                                                                                                                                      |
+| `sources`                     | Array   | every source the provider declares | Narrows the source domains the provider may write. Required for a capture-only provider.                                                                                                                  |
+| `refresh_after_sec`           | Integer | `86400`                            | Seconds before a stored ID is refreshed, and the wait after a skipped call (greater than 0)                                                                                                               |
+| `max_calls_per_minute`        | Integer | `1`                                | Per-visitor burst cap, enforced in 60-second windows                                                                                                                                                      |
+| `max_calls_per_ip_per_minute` | Integer | `10`                               | Ceiling per client address across every visitor behind it, in 60-second windows. `0` turns it off                                                                                                         |
+| `breaker_failures_per_minute` | Integer | `50`                               | Transport failures, timeouts, 429s and 5xx responses in one 60-second window after which the provider is skipped for every visitor                                                                        |
+| `cookie_priority`             | Integer | `0`                                | Lower values are left out of the `__Host-ts-eids-s` mirror first when it exceeds its size cap                                                                                                             |
+| `revoke_scope`                | String  | `provider` (capture only)          | `provider` or `global`. Applies only to a provider that captures IDs; setting it on any other provider is a validation error. See below.                                                                  |
+
+**`mode`, `timeout_ms` and `after_send_timeout_ms`.** A provider runs on a returning visitor's full page navigation. A `hold` provider that does not read the EC ID also runs on a new visitor's first navigation when it runs an auction: the visitor's KV row is created after the call, with its answer, so the first page still makes one KV write. In `hold` mode the call runs before the navigation's auction, within the shared `hold_budget_ms`, and its answer joins that auction. A call the budget cuts off is not a failure: the provider waits `hold_retry_sec` before the next call. When the navigation runs no auction, a hold-mode provider runs after send instead and waits `after_send_timeout_ms`. In `after_send` mode (the default) the provider always runs after the response is sent.
+
+**`sources`.** Narrows the source domains the provider may write, before ownership is checked. It must name only sources the provider declares and keep at least one. A capture-only provider has no usable default and must list its `sources`: its opt-out removes browser-ingested records of every source it lists, so list only the sources it is the delivery path for.
+
+**`refresh_after_sec`, `max_calls_per_minute`, `breaker_failures_per_minute`.** `refresh_after_sec` is how long a stored ID lives before it is refreshed when the provider gives no hint, and how long to wait after a skipped call. `max_calls_per_minute` caps bursts per visitor in 60-second windows, and `max_calls_per_ip_per_minute` caps calls from one client address across visitors, so minting a fresh EC per request cannot multiply calls. `breaker_failures_per_minute` counts transport failures, timeouts, 429s and 5xx responses across all visitors at one edge location. Past it the provider is skipped for everyone until the window clears. Input-caused 4xx responses and unparseable replies back off only that visitor and never open the breaker.
+
+**`cookie_priority`.** When the `__Host-ts-eids-s` mirror exceeds its size cap, whole sources are left out, lowest `cookie_priority` first.
+
+**`revoke_scope`.** For a provider that captures IDs from proxied responses. With `provider`, a captured opt-out removes that provider's records and, for a capture-only provider, the records of its listed sources that no provider wrote. With `global`, a captured opt-out runs the consent-withdrawal tombstone: the row is tombstoned, the `ts-ec` cookie is cleared, and everything is removed, provider opt-outs included. It also sets an `HttpOnly` `ts-ec-revoked` cookie holding a fingerprint of the visitor's consent, and no new EC is minted while that consent is unchanged, so a CMP that still grants does not undo the revoke on the next page. Either way it applies whatever the client, as a consent withdrawal does; only clearing an opt-out needs a real browser.
+
+#### Source ownership (`[[ec.partners]].owner`)
+
+`owner` is an optional key on an `[[ec.partners]]` entry. It names the identity provider that owns that source. An owner refreshes the source and wins over browser and other writers: its result replaces the source's whole entry set, and batch sync writes to it only when the row holds no value for the source. An expired owned record still counts as a value, so batch sync never fills or replaces it. A source with no `owner` is unowned, and a provider can only fill it when absent or expired.
+
+```toml
+[[ec.partners]]
+name = "Example ID"
+source_domain = "exampleid.example.com"
+openrtb_atype = 1
+bidstream_enabled = true
+owner = "exampleid"
+
+[ec.identity.providers.exampleid]
+mode = "hold"
+timeout_ms = 80
+```
+
+**Validation.** Each of these stops startup and fails `ts config validate` and `ts config push`.
+
+| Mistake                                                    | Error                                                                                                                                                      |
+| ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `owner` names a provider that is not enabled               | ``ec.partners source `exampleid.example.com` names owner `exampleid`, which is not an enabled identity provider``                                          |
+| `owner` names a capture-only provider                      | ``... names owner `examplecapture`, which is capture-only; a capture-only provider stores no positive ID and cannot own a source``                         |
+| `owner` names a provider that does not claim the source    | ``... names owner `exampleid`, which does not claim that source``                                                                                          |
+| Two providers claim an owned source                        | ``identity provider `other` claims source `exampleid.example.com`, which `exampleid` owns; use ec.identity.providers.other.sources to narrow one of them`` |
+| A provider claims a source with no `[[ec.partners]]` entry | ``identity provider `exampleid` claims source `exampleid.example.com`, which has no [[ec.partners]] entry``                                                |
+| A capture-only provider has no `sources`                   | ``provider `examplecapture` is capture-only, so ec.identity.providers.examplecapture.sources must list the sources it is the delivery path for``           |
+| `sources` names a source the provider does not declare     | ``ec.identity.providers.exampleid.sources names `other.example.com`, which provider `exampleid` does not declare``                                         |
+| A provider table names no enabled provider                 | `ec.identity.providers.missing names no enabled identity provider; configured providers: exampleid`                                                        |
+| `revoke_scope` on a provider that declares no captures     | ``ec.identity.providers.exampleid.revoke_scope is set, but provider `exampleid` declares no captures``                                                     |
+| `timeout_ms` above the hold budget in hold mode            | `ec.identity.providers.exampleid.timeout_ms must not exceed hold_budget_ms (100)`                                                                          |
+| `after_send_timeout_ms` outside 1 to 10000                 | `ec.identity.providers.exampleid.after_send_timeout_ms must be between 1 and 10000, got 0`                                                                 |
+| `refresh_after_sec = 0`                                    | `ec.identity.providers.exampleid.refresh_after_sec must be greater than 0`                                                                                 |
+| `hold_budget_ms` above 1000, `max_concurrency = 0`         | `ec.identity.hold_budget_ms must be at most 1000, got 1001` and `ec.identity.max_concurrency must be at least 1`                                           |
+
+Also an error: a duplicate provider ID, more than 32 enabled providers (generic pull partners included), a `mode` other than `hold` or `after_send`, and a `revoke_scope` other than `provider` or `global`. Before enabling a capture provider on a live service, work through the [capture provider checklist](/guide/edge-cookies#capture-provider-checklist).
+
+**Pull partner provider IDs.** Each `[[ec.partners]]` entry with `pull_sync_enabled = true` registers a provider whose ID is `pull-` plus the source domain with dots replaced by `-`. For example, `ssp.example.com` is `pull-ssp-example-com`. A domain that contains `-`, or an ID that would be longer than 63 characters, also gets `-` and the first 8 hex digits of the SHA-256 of the full domain, so `a-b.example.com` and `a.b.example.com` get different IDs. Configure the partner's pacing in `[ec.identity.providers.pull-ssp-example-com]`.
+
+**Removed keys.** Validation rejects each of these with an error that names its replacement:
+
+| Removed key                                | Replacement                                                                  |
+| ------------------------------------------ | ---------------------------------------------------------------------------- |
+| `ec.pull_sync_concurrency`                 | `[ec.identity].max_concurrency`                                              |
+| `[[ec.partners]].pull_sync_ttl_sec`        | `refresh_after_sec` in `[ec.identity.providers.<pull-id>]`                   |
+| `[[ec.partners]].pull_sync_rate_limit = N` | `max_calls_per_minute = ceil(N / 60)` in `[ec.identity.providers.<pull-id>]` |
+
+The old rate limit counted calls per hour; the new one counts them per minute and defaults to 1, so a partner that kept the old default of 10 per hour is now paced at an effective 60 per hour.
+
+#### Rolling back
+
+This release moves the KV identity row to schema version 2. A release before it cannot read a version 2 row, so rolling back past this release is unsupported once it has written one; going back needs a KV migration to version 1, which is not provided.
+
+To roll back from a release that adds vendor providers to the identity framework without vendors, follow the steps in [Rolling back from vendor providers](/guide/edge-cookies#rolling-back-from-vendor-providers): remove every `owner` and vendor `[ec.identity.providers.*]` table first, because the earlier release rejects both.
+
 ### `[ec]`
 
 `passphrase` is a key name in `trusted_server_secrets`; the resolved value must
 be at least 32 bytes. Keep it stable to preserve EC identifier continuity.
 
-| Field                     | Type           | Required | Description                                                             |
-| ------------------------- | -------------- | -------- | ----------------------------------------------------------------------- |
-| `passphrase`              | String         | Yes      | Publisher passphrase used as HMAC key                                   |
-| `ec_store`                | String or null | No       | Fastly KV store name for EC identity graph and withdrawal state         |
-| `pull_sync_concurrency`   | Integer        | No       | Maximum concurrent pull-sync requests per organic response              |
-| `cluster_trust_threshold` | Integer        | No       | Cluster size threshold for identity trust decisions                     |
-| `cluster_recheck_secs`    | Integer        | No       | Legacy compatibility setting; cluster rechecks no longer use timestamps |
-| `partners`                | Array          | No       | Static partner registry entries                                         |
+| Field                           | Type           | Required | Description                                                                                                             |
+| ------------------------------- | -------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `passphrase`                    | String         | Yes      | Publisher passphrase used as HMAC key                                                                                   |
+| `ec_store`                      | String or null | No       | Fastly KV store name for EC identity graph and withdrawal state                                                         |
+| `cluster_trust_threshold`       | Integer        | No       | Cluster size threshold for identity trust decisions                                                                     |
+| `cluster_recheck_secs`          | Integer        | No       | Legacy compatibility setting; cluster rechecks no longer use timestamps                                                 |
+| `strip_eids_cookie_from_origin` | Boolean        | No       | Also strip `ts-eids` from publisher-origin requests (default `false`; the `__Host-ts-eids-s` mirror is always stripped) |
+| `partners`                      | Array          | No       | Static partner registry entries                                                                                         |
 
 ::: tip Partner keying
 `source_domain` is the canonical partner key. It matches incoming OpenRTB EID `source` values and is also used as the EC KV `ids` map key.
 :::
 
+`openrtb_atype` sets the `atype` of EIDs that Trusted Server builds from KV.
+It applies only where KV supplies a source the browser did not send; for a
+source in the browser's EIDs, the browser's own entry and `atype` are
+forwarded instead.
+
 `api_token` is optional. Set it to a key in `trusted_server_secrets` only when
 the partner calls the inbound identify or batch-sync APIs. A partner without
 `api_token` remains available for source-domain lookup, bidstream EIDs, and
@@ -1541,26 +1642,30 @@ See [Asset Routes](/guide/asset-routes) for request flow, S3 auth details, and I
 
 ## Tinybird Configuration
 
-`[tinybird]` sends auction events directly to the Tinybird Events API. The
-emitter is active only when `enabled = true`; access-log emission is not wired.
+`[tinybird]` sends auction events and sampled access rows directly to the
+Tinybird Events API. Fastly wires both emitters; each sink requires
+`enabled = true` and its own enable flag. Other adapters do not emit Tinybird
+rows. See [Telemetry](/guide/telemetry) for sampling, privacy, and retention.
 
 ### `[tinybird]`
 
-| Field                  | Type           | Default                | Contract                                                           |
-| ---------------------- | -------------- | ---------------------- | ------------------------------------------------------------------ |
-| `enabled`              | Boolean        | `false`                | Enable auction telemetry                                           |
-| `api_host`             | String         | `""`                   | Required when enabled; regional host without scheme, port, or path |
-| `auction_dataset`      | String         | `"auction_events_raw"` | 1–128 ASCII letters, digits, or `_`                                |
-| `auction_token_secret` | String or null | `null`                 | Store key required when enabled; resolved value must be nonempty   |
-| `access_enabled`       | Boolean        | `false`                | Reserved; `true` fails startup because no emitter is wired         |
-| `access_dataset`       | String         | `"access_logs_raw"`    | Reserved access-log dataset name                                   |
-| `access_sample_rate`   | Number         | `0.0`                  | `0.0..=1.0`; reserved while access emission is disabled            |
-| `max_body_bytes`       | Integer        | `1048576`              | At least `1024` bytes                                              |
-
-`secret_store` and `access_token_secret` are deprecated compatibility inputs.
-Both are removed during normalization; neither reaches runtime or serialized
-output. New configurations use only `auction_token_secret`, whose value is
-resolved through `trusted_server_secrets`.
+| Field                  | Type           | Default                | Contract                                                                          |
+| ---------------------- | -------------- | ---------------------- | --------------------------------------------------------------------------------- |
+| `enabled`              | Boolean        | `false`                | Master switch for Tinybird telemetry                                              |
+| `auction_enabled`      | Boolean        | `true`                 | Enable auction telemetry when the master switch is on                             |
+| `api_host`             | String         | `""`                   | Required when enabled; regional host without scheme, port, or path                |
+| `auction_dataset`      | String         | `"auction_events_raw"` | 1–128 ASCII letters, digits, or `_`                                               |
+| `auction_token_secret` | String or null | `null`                 | Required for an active auction sink; resolves through the default secret store    |
+| `access_enabled`       | Boolean        | `false`                | Enable sampled post-delivery access telemetry                                     |
+| `access_dataset`       | String         | `"access_logs_v2"`     | Versioned access datasource; `access_logs_raw` is rejected when access is enabled |
+| `access_token_secret`  | String or null | `null`                 | Required for an active access sink; resolves through the default secret store     |
+| `access_sample_rate`   | Number         | `0.0`                  | `0.0..=1.0`; must be positive when access telemetry is enabled                    |
+| `max_body_bytes`       | Integer        | `1048576`              | At least `1024` bytes                                                             |
+
+`secret_store` is a deprecated compatibility input. It is ignored and omitted
+from newly pushed config. Both sink tokens resolve through
+`trusted_server_secrets`. Disabled sinks neither require nor resolve their token
+references, even when stale keys remain in a stored config.
 
 The complete enabled example appears in
 [Tinybird auction telemetry](#tinybird-auction-telemetry).
@@ -3149,6 +3254,183 @@ Rollback to the legacy entry point is no longer controlled by runtime config
 keys. Use the normal deployment rollback path to restore a pre-cleanup service
 version if that is required.
 
+## Observability and Access Telemetry Configuration
+
+Settings for the `Server-Timing` response header and the sampled
+access-telemetry sink. Both are off by default and are independent switches:
+enabling one does not enable the other.
+
+### `[observability]`
+
+| Field                   | Type     | Required | Default | Description                                                                                               |
+| ----------------------- | -------- | -------- | ------- | --------------------------------------------------------------------------------------------------------- |
+| `server_timing_enabled` | Boolean  | No       | `false` | Append request-phase timings to the `Server-Timing` response header                                       |
+| `route_sections`        | String[] | No       | `[]`    | Section names kept as publisher route templates (`/{section}/*`) in access telemetry; empty collapses all |
+
+Route sections are matched ASCII-case-insensitively against the first path segment,
+with at least one further segment required. Leading and trailing non-control
+whitespace is trimmed; tabs, newlines, and other control characters are rejected,
+not trimmed. Names are limited to 32 entries of at most 128 UTF-8 bytes each and
+must be nonempty with no slash or control characters. For example,
+`route_sections = [" news "]` normalizes to `["news"]`, preserving `/news/*` but not
+`/news`. Matching uses the raw path without percent-decoding, so literal non-ASCII
+section names do not match their percent-encoded URLs. Use ASCII section names.
+The name `other`, in any case, shares the fallback `/other/*` bucket rather than
+creating a distinct section. Configure this array in TOML, for example
+`route_sections = ["news"]`; the environment overlay cannot set arrays.
+
+**Purpose**: Surfaces per-phase request timing (`ts-total` plus recorded
+phases such as `ts-appbuild`, `ts-filter`, `ts-geo`, `ts-kv`, `ts-origin`, and
+`ts-template-cache`) as a standard `Server-Timing` header, in milliseconds
+with one decimal place. An unrecorded phase is omitted from the header
+rather than rendered as zero. When origin dispatch overlaps auction dispatch or
+EC preload, `ts-origin` measures the remaining origin wait after overlap, not full
+origin latency. Fastly `ts-appbuild` measures per-request setup and includes application
+construction only on cold requests; a non-null warm value is not a cold-start signal.
+Axum builds state at startup and has no per-request app-build phase.
+
+**Emission is conservative**: the header is appended only on responses that
+are conclusively private, meaning `Cache-Control` contains a bare `private` or
+`no-store` directive and no recognized CDN/surrogate cache-control header is present.
+A field-qualified directive such as `private="Set-Cookie"` does not qualify.
+An edge-cache header suppresses timing even alongside private/no-store, since
+shared-cache overrides can replay request-specific timings. A response that is
+heuristically cacheable, carries a bare
+`max-age`, or has no cache header at all never receives the header, because a
+shared-cache object would otherwise replay one request's timings for its
+entire stored lifetime. The long-lived, shared-cacheable `tsjs` asset route is
+the concrete case this excludes. The header is appended, never inserted, so
+an origin-supplied `Server-Timing` value and any entries the fronting
+delivery layer adds are preserved alongside the TS entries.
+
+The Axum adapter applies the same private-response rule at its own terminal
+point before serializing the response, and emits the header only; it does not
+send access-telemetry rows. Cloudflare and Spin collect timing for GPT diagnostics
+only; neither emits `Server-Timing` or access rows, so these emission flags have
+no effect there.
+
+**Example**:
+
+```toml
+[observability]
+server_timing_enabled = true
+```
+
+::: tip The Axum dev server reads this flag once at startup
+The Axum dev server bakes `server_timing_enabled` into its service when it starts.
+Flipping the flag there requires a restart to take effect.
+:::
+
+::: warning Client-visible latency disclosure
+The `Server-Timing` header is sent to every client on eligible responses,
+not only to operators: browsers expose the values to same-origin JavaScript
+via `PerformanceResourceTiming.serverTiming`, and any caller can read the
+raw header. Enabling it publishes measured per-phase server latency,
+including KV read timing on the public identity endpoints (`ts-kv`) and
+origin/cache behaviour on publisher pages (`ts-origin`,
+`ts-template-cache`). This is standard `Server-Timing` practice and the
+values are durations only, but treat the flag as a diagnostic aid to enable
+deliberately, not a general always-on toggle, unless disclosing those
+timings to all clients is acceptable for the deployment.
+:::
+
+**Environment Override**:
+
+```bash
+TRUSTED_SERVER__OBSERVABILITY__SERVER_TIMING_ENABLED=true
+```
+
+::: tip Present-but-false by default
+`server_timing_enabled` ships as `false` in the base operator config rather
+than being left out, even though `false` is also its default. The
+environment-variable overlay can only override a leaf that already exists in
+the parsed TOML; it cannot create a missing one. Keeping the leaf present lets
+`TRUSTED_SERVER__OBSERVABILITY__SERVER_TIMING_ENABLED` take effect without an
+extra edit to add the table first.
+:::
+
+### `[tinybird]` access telemetry keys
+
+The authoritative field reference is [Tinybird Configuration](#tinybird).
+The examples below cover access-sink enablement and rollout.
+
+**Purpose**: `access_enabled` and `auction_enabled` gate the two Tinybird
+sinks separately so that turning on one does not silently turn on (or leave
+off) the other; a settings test locks this decoupling in both directions.
+Setting `access_enabled = true` with `access_sample_rate = 0.0` is rejected at
+config load as an armed-but-silent configuration; use `access_enabled` itself
+to turn the sink off, not the sample rate. Enabling `access_enabled` also
+requires the shared transport fields (`enabled`, non-empty `api_host`,
+`access_dataset`, a resolvable `access_token_secret`, and a
+`max_body_bytes` of at least 1024) to already be set.
+
+**Example**:
+
+```toml
+[tinybird]
+enabled = true
+api_host = "api.tinybird.example.com"
+auction_enabled = false
+
+# Access-only telemetry: no auction APPEND token is required.
+access_enabled = true
+access_dataset = "access_logs_v2"
+access_token_secret = "tinybird_access_append_token"
+access_sample_rate = 0.05
+max_body_bytes = 1048576
+```
+
+**Environment Override**:
+
+```bash
+TRUSTED_SERVER__TINYBIRD__ACCESS_ENABLED=true
+TRUSTED_SERVER__TINYBIRD__ACCESS_SAMPLE_RATE=0.05
+TRUSTED_SERVER__TINYBIRD__AUCTION_ENABLED=false
+```
+
+These overrides require the corresponding leaves to exist in the parsed TOML.
+The example's Tinybird block is commented out; uncomment and configure it first.
+Keep `access_sample_rate` as a TOML float, such as `0.05` or `0.0`, since overlay
+coercion uses the existing leaf's type.
+
+A sampled request dispatches one access-telemetry row to `access_dataset` after
+client delivery. Fastly starts the host-owned request and drops its pending handle,
+without awaiting the ingest reply or retrying. Local serialization/setup/start
+failures are logged; later transport errors, non-2xx responses and ingestion
+acceptance are not observed. The row records the configured sample rate and has a
+30-day TTL. See [Telemetry](/guide/telemetry#access-data-path) for limits, the
+collection-time and delivery-result contracts, and privacy.
+
+### Deploy and rollback ordering
+
+::: warning Push a compatibility config before rolling back
+The compatibility boundary is uneven. The top-level `Settings` schema uses
+`deny_unknown_fields`, so an older binary rejects a config carrying the
+`[observability]` table. The nested `[tinybird]` table does not: an older
+binary accepts unknown keys there, rejects `access_enabled = true` through
+validation, ignores `auction_enabled` entirely, and reads `enabled = true`
+as "auction telemetry on".
+
+**Deploying**: create the versioned `access_logs_v2` datasource and its scoped
+`ts_access_v2_ingest` APPEND token before deploying the emitting binary. Preserve
+`access_logs_raw`; it is the legacy reserved schema, not the target for these
+rows. Upgrade every serving binary before pushing a config containing the new
+fields. An existing explicit `access_dataset = "access_logs_raw"` must be changed
+to `access_logs_v2`, with the matching token key. When access is enabled,
+validation rejects exactly the normalized legacy name `access_logs_raw`; custom
+dataset names remain allowed and disabled legacy configurations remain accepted.
+Follow the workspace cutover in
+[`tinybird/README.md`](https://github.com/IABTechLab/trusted-server/blob/main/tinybird/README.md).
+
+**Rolling back**: push a compatibility config first, then roll the binary
+back. The compatibility config removes the `[observability]` table, sets
+`access_enabled = false`, and, for a deployment that only used the access
+sink, sets `enabled = false` as well. Otherwise the older binary tries to enable
+auction telemetry, or fails startup if no auction token is present. Keep both
+Tinybird datasources during rollback. Do not redeploy an older Tinybird project
+that omits `access_logs_v2`; inspect the deployment dry-run for proposed removals.
+:::
+
 ## Validation
 
 ### Automatic Validation
diff --git a/docs/guide/ec-setup-guide.md b/docs/guide/ec-setup-guide.md
index cccb04daee..11ec21b1d1 100644
--- a/docs/guide/ec-setup-guide.md
+++ b/docs/guide/ec-setup-guide.md
@@ -82,6 +82,15 @@ api_token = "partner_api_token"
 bidstream_enabled = true
 ```
 
+Pull partners (`pull_sync_enabled = true`) run from a visitor's second page
+load, because they run after send on a returning visitor's page navigation. A
+partner that returns an error backs off instead of being called on every
+request, and its pace comes from its `[ec.identity.providers.<pull-id>]`
+table, for example `pull-ssp-example-com` for `ssp.example.com`: set
+`refresh_after_sec` and `max_calls_per_minute` there. The old
+`pull_sync_ttl_sec` and `pull_sync_rate_limit` keys are rejected; see the
+[Configuration Reference](/guide/configuration#identity-providers-ec-identity).
+
 Provision the bearer token value under `partner_api_token`, then deploy or
 restart after changing partner configuration. The token is required for this
 demo because it exercises the inbound partner APIs.
@@ -189,6 +198,13 @@ Expected decoded payload contains:
 - `source = ssp.example.com`
 - `uids[0].id = <partner-uid>`
 
+When the request also carries browser EIDs, the decoded header lists them
+first, exactly as the `trustedServer` adapter sent them (including `inserter`,
+`matcher` and `mm`), followed by KV-only partner sources. The browser copies
+the same EIDs, without EID-level `ext`, into the `ts-eids` cookie, which
+navigations and `GET /_ts/page-bids` ingest. `/auction` ingests its own body
+EIDs instead of the cookie.
+
 ## 8) Fastly KV Operational Checks
 
 List stores:
diff --git a/docs/guide/edge-cookies.md b/docs/guide/edge-cookies.md
index 113066cdaf..f36728b2eb 100644
--- a/docs/guide/edge-cookies.md
+++ b/docs/guide/edge-cookies.md
@@ -61,11 +61,11 @@ sequenceDiagram
         TS-->>B: Response + Set-Cookie: ts-ec=...
     else Return Visit (EC cookie present)
         Note over TS: Phase 2: Routing<br/>EC exists — skip generation
-        Note over TS: Phase 3: Finalize<br/>Ingest Prebid EID cookies
+        Note over TS: Phase 3: Finalize<br/>Stage Prebid EID cookies<br/>(written once in phase 4)
         TS-->>B: Response<br/>(no cookie refresh)
     end
 
-    Note over TS,KV: Phase 4: Post-send (background)<br/>Dispatch pull-sync to partners
+    Note over TS,KV: Phase 4: Post-send (background)<br/>Writer request only: call due pull partners,<br/>then one KV write
 ```
 
 ### Response Finalization
@@ -83,7 +83,7 @@ flowchart TD
     ExplicitWithdrawal -- "No" --> HeaderOnly
 
     ConsentCheck -- "Yes" --> WasPresent{EC was present<br/>in request?}
-    WasPresent -- "Yes, not generated" --> Returning["Ingest Prebid EID cookies<br/>No cookie or KV TTL refresh"]
+    WasPresent -- "Yes, not generated" --> Returning["Stage Prebid EID cookies for the writer's one flush<br/>No cookie or KV TTL refresh"]
     WasPresent -- "No, just generated" --> NewEc["Ingest Prebid EID cookies<br/>Set ts-ec cookie"]
 ```
 
@@ -148,13 +148,24 @@ flowchart LR
 
 ### Prebid EID Flow
 
-Browser-resolved Prebid EIDs reach the identity graph when Trusted Server finalizes a response. It collects matched partner UIDs from three request-local sources, applied in this order so that, when two sources carry the same partner, the later source's UID is the candidate offered to KV:
-
-1. the `ts-eids` cookie,
-2. the `eids` array in the `/auction` request body,
-3. the `sharedId` cookie.
-
-The `/auction` body carries the full EID set Prebid.js resolved, so `/auction` ingestion is not limited by the size cap TSJS applies to the `ts-eids` cookie. The cookie still bridges Prebid user ID modules with the identity graph on requests that carry no EID body, such as `GET /_ts/page-bids` and page navigations.
+Browser EIDs reach the identity graph when Trusted Server finalizes a
+response. Which browser input it reads depends on the route:
+
+- `POST /auction` reads only the client EIDs the auction itself used: its
+  request body, or the `ts-eids` cookie when the body has none. An earlier
+  page's cookie is never ingested next to a body.
+- Publisher navigations, admitted `GET /_ts/page-bids` requests and newly
+  generated ECs read the `ts-eids` cookie.
+- Every route then applies the `sharedId` cookie last.
+
+The TSJS Prebid adapter writes `ts-eids` in `buildRequests`, before each
+`trustedServer` request is sent: the request's EIDs without EID-level `ext`,
+trimmed to 3,072 bytes, as base64 of UTF-8 JSON. It clears the cookie when that
+set is empty or when Prebid's TCF rules block `trustedServer`. Where GDPR
+applies, it writes the cookie only with TCF Purpose 1 (store/access device) and
+Purpose 4 (personalized ads) consent, the rule below; without it, the adapter
+clears the cookie and still sends the EIDs in the `/auction` body. Auctions that
+do not include `trustedServer` leave it unchanged.
 
 These Prebid EID writes follow the same consent rule as bidstream EID forwarding: when a TCF signal is present, Purpose 1 (store/access device) and Purpose 4 (personalized ads) must both be consented, and when GDPR applies without a TCF signal the writes are withheld. A user who consents to Purpose 1 but not Purpose 4 keeps their EC, but no EIDs from the request are persisted.
 
@@ -166,12 +177,9 @@ sequenceDiagram
     participant TS as Trusted Server
     participant KV as KV Store
 
-    Prebid->>Prebid: Auction completes
-    Prebid->>TSJS: bidsBackHandler fires
-    TSJS->>Prebid: getUserIdsAsEids()
-    Prebid-->>TSJS: [{source, uids: [{id, atype}]}]
-    TSJS->>TSJS: Base64 encode full OpenRTB-style EID array<br/>[{source, uids:[{id, atype, ext?}]}]
-    TSJS->>B: document.cookie = "ts-eids=..."
+    Prebid->>TSJS: buildRequests(bidRequests, bidderRequest)
+    TSJS->>TSJS: Copy bidderRequest.ortb2 EIDs<br/>drop EID-level ext, fit 3,072 bytes
+    TSJS->>B: document.cookie = "ts-eids=..." (before the request is sent)
 
     Note over B,TS: Next eligible EID-sync request
     B->>TS: Document navigation, POST /auction,<br/>or admitted GET /_ts/page-bids
@@ -179,7 +187,7 @@ sequenceDiagram
     TS->>KV: Add missing partner IDs in one conditional write<br/>skip when UIDs already match<br/>(requires TCF Purpose 1 + 4 under GDPR)
 ```
 
-Current TSJS writers preserve the full OpenRTB-style `{source, uids:[...]}` shape in `ts-eids`. The server remains backward-compatible with earlier flattened `{source, id, atype}` cookies during rollout, but new cookies use the structured `uids[]` form.
+`ts-eids` holds OpenRTB-style `{source, uids:[...]}` entries, with `inserter`, `matcher` and `mm` when Prebid set them. The server validates each entry with the same rules as the `/auction` body and drops only what is malformed. Earlier flattened `{source, id, atype}` cookies are still accepted.
 
 The `sharedId` cookie follows a similar path but is written directly by Prebid's SharedID module rather than by TSJS. The server reads it separately and maps it via the `sharedid.org` source domain.
 
@@ -208,24 +216,24 @@ sequenceDiagram
         TS->>KV: Upsert ids[source_domain] = UID
     else Prebid sync seeds browser EIDs
         B->>B: Prebid User ID modules resolve IDs
-        B->>TSJS: getUserIdsAsEids()
+        B->>TSJS: buildRequests(bidRequests, bidderRequest)
         TSJS->>B: Write ts-eids cookie<br/>Base64 OpenRTB-style EIDs (size-capped)
         B->>TS: Next eligible request with ts-eids
         TS->>KV: Add missing matched partner UIDs<br/>defer different stored values
     end
 
     Note over B,TS: Prebid-routed auction
-    B->>B: getUserIdsAsEids() for current auction
+    B->>B: Prebid builds the trustedServer bidder request
     B->>TS: POST /auction<br/>adUnits + eids[] + ts-ec cookie
     TS->>KV: Resolve EC-backed source-domain IDs
     KV-->>TS: Stored partner UIDs
-    TS->>TS: Convert stored UIDs to EIDs<br/>Merge + dedupe with request eids[]<br/>Apply consent gating
+    TS->>TS: Request eids[] as sent<br/>+ KV EIDs for sources not sent<br/>Apply consent gating
     TS->>PS: OpenRTB request<br/>user.ext.eids = merged EID set
     PS->>DSP: OpenRTB bid request<br/>user.ext.eids preserved for bidders
     DSP-->>PS: OpenRTB bid response
     PS-->>TS: OpenRTB seatbid response
     TS-->>B: Auction response + x-ts-eids header when available
-    TS->>KV: Add missing partner UIDs from request eids[]<br/>+ ts-eids/sharedId cookies (TCF Purpose 1 + 4 under GDPR)
+    TS->>KV: Add missing partner UIDs from request eids[]<br/>+ sharedId cookie (TCF Purpose 1 + 4 under GDPR)
 ```
 
 The relevant OpenRTB structure forwarded to Prebid Server and downstream partners is:
@@ -263,17 +271,95 @@ The relevant OpenRTB structure forwarded to Prebid Server and downstream partner
 }
 ```
 
-Server-resolved EIDs and current-request Prebid EIDs are deduplicated by `source + uid.id`. Browser-supplied EIDs, from the `/auction` request body, the `ts-eids` cookie, or the `sharedId` cookie, only fill partner UIDs that are missing from KV; a different stored UID is kept, as described in [Prebid EID Flow](#prebid-eid-flow).
+Browser EIDs are forwarded as sent; KV adds EIDs only for registered sources the browser did not send. Browser-supplied EIDs, from the `/auction` request body, the `ts-eids` cookie, or the `sharedId` cookie, only fill partner UIDs that are missing from KV; a different stored UID is kept, as described in [Prebid EID Flow](#prebid-eid-flow).
+
+### One KV Write per EC-Bearing Request
+
+At most one request per page view writes browser-driven identity changes to KV: a full page navigation from a returning visitor (a request that already carries a valid `ts-ec`). Every other route reads KV and stages its changes but never writes them:
+
+- `/auction` and `/_ts/api/v1/identify` no longer write KV. `/_ts/page-bids` writes only as the single-page-app writer: a same-origin call from a real browser, at most once per `spa_writer_interval_sec` (300 seconds by default) since the row's last write, with browser EIDs and after-send providers only.
+- The writer request collects every change from the page load: browser EIDs from the `ts-eids` and `sharedId` cookies, pull partner results and the cluster size. It sends the response first, then writes everything once, after send, with a generation check. A failed write is not retried as a whole.
+- A new visitor's first request still creates the row before routing, as before.
+- Two kinds of write are exempt because a withdrawal or removal must not be lost: the consent-withdrawal tombstone (with one more attempt after send when it fails before send), and a retry that writes only the removals of a failed flush.
+
+Pull partners run in the same after-send step, from a visitor's second page load, because they need a returning visitor's row. A partner that fails backs off instead of being called on every request, and its pace is set by its `[ec.identity.providers.<pull-id>]` table (see the [Configuration Reference](/guide/configuration#identity-providers-ec-identity)).
+
+The `ts-ec-pull-complete` completeness cookie no longer exists. Trusted Server neither sets nor reads it. A copy that a browser still holds is ignored and expires on its own within its one-hour `Max-Age`.
+
+Each request also logs one `identity request measurement: ...` line after the response is sent. It carries the inbound `Cookie` header size in bytes, KV reads and writes labelled by route kind (`writer`, `stager` or `new_ec`), the flush outcome, the number of removals deferred to the pending key and of lost removals, and whether a withdrawal tombstone needed its after-send run and failed. It holds no EC ID, UID or cookie value. It replaces the `EID sync measurement: ...` line for returning visitors; that line is now logged only for a new EC.
+
+### The `ts-eids-s` Mirror Cookie
+
+`__Host-ts-eids-s` is a client-only mirror of the server-side IDs for page scripts. It is off by default; `[ec.identity] mirror_enabled = true` turns it on. The shim writes it from the `ext.ts_eids_s` member of `/auction` responses and the `ts_eids_s` member of `/_ts/page-bids` responses (see the [API Reference](/guide/api-reference)). The server never sets, reads or trusts it, and it strips it from requests to the origin and to Prebid Server.
+
+- Attributes: `Path=/; Secure; SameSite=Lax`, no `Domain`, and not `HttpOnly`, because the shim writes it with `document.cookie`.
+- Lifetime: a `Max-Age` of at most one day, and never past the earliest expiry of an ID it holds.
+- Size: at most 2,048 bytes. When the IDs do not fit, whole sources are left out, lowest `cookie_priority` first, never part of a source.
+- The shim now writes only registered (`[[ec.partners]]`) sources into `ts-eids`, and merges each auction's entries into the cookie per source instead of replacing it. A source an auction lacks stays in the cookie until it expires; a TCF block still clears it.
+
+## Server-Side Identity Providers
+
+Identity providers fetch or capture IDs on the server. Engineers who write one should read [Writing an Identity Provider](/guide/identity-providers). The sections below are for operators. Per-key reference is in the [Configuration Reference](/guide/configuration#identity-providers-ec-identity).
+
+### Capture Provider Checklist
+
+A capture provider reads responses that Trusted Server proxies for a vendor. A captured revocation, opt-out or clear is written to KV at once. A captured positive ID is counted in `capture_unpersisted`; when it comes from a browser whose consent allows the provider and differs from what KV holds, it is stored by the next writer navigation, through the `pending:<ec_id>` KV key. A removal whose KV writes all fail waits in the same key (`removal_deferred` on the measurement line) and is counted in `removal_lost` only when that key cannot take it either. Work through these steps before enabling one on a live service:
+
+1. **Register every captured source.** Each source the provider declares has an `[[ec.partners]]` entry with `bidstream_enabled = true` and the right `openrtb_atype`.
+2. **Move a source off pull sync first.** A source that is going to have an `owner` must not also have `pull_sync_enabled = true`. A pull-sync entry registers a generic pull provider that claims the source, and two providers cannot claim an owned source.
+3. **Keep `sources` minimal.** The provider's `sources` list in `[ec.identity.providers.<id>]` holds only the sources it is the delivery path for. Its opt-out removes browser-ingested records of every source on the list, whoever produced them.
+4. **Run the live acceptance check.** After a revocation is captured on a live page, look up the visitor's row with `GET /_ts/admin/ec` and confirm it shows the provider's `ps.o` and no record for the provider's sources. After the vendor issues again, confirm the row shows `ps.oc`, and that the next returning-visitor navigation ingests the source again. Use `GET /_ts/admin/eids` with the visitor's `ts-eids` cookie to preview what the browser would ingest. Read the `identity request measurement: ...` log line of the revocation request: `removal_lost` must stay at `0`, and `capture_unpersisted` shows the positive IDs a durable path would add.
 
-### Pull-Sync Completeness Marker
+### Revoke Scope
 
-When the identity graph contains a UID for every pull-enabled partner, Trusted Server sets a signed, host-only `ts-ec-pull-complete` cookie. The cookie contains no partner UID or EC ID. It authenticates a one-hour expiration and a fingerprint of the current pull-partner source-domain set, bound to the active EC ID with key material derived from `ec.passphrase`.
+`revoke_scope` in `[ec.identity.providers.<id>]` decides how far a captured opt-out reaches. The default, `provider`, removes only that provider's records and, for a capture-only provider, the records of its listed sources that no provider wrote.
 
-A valid marker avoids a KV lookup only when pull-sync completeness is the sole reason to inspect the row. Auctions that need stored EIDs, browser EID-cookie ingestion, explicit withdrawal, and generation continue to use KV. The marker acts as recent proof that the row existed, so deletion of a previously complete row is not detected until the marker expires, at most one hour after issuance. Partner-set changes, passphrase rotation, malformed values, and expiration invalidate the marker and restore the normal lookup and orphan-recovery path.
+With `revoke_scope = "global"`, a captured opt-out runs the consent-withdrawal tombstone: the row is tombstoned, the `ts-ec` cookie is cleared, and everything is removed, provider opt-outs included. It also sets an `HttpOnly` `ts-ec-revoked` cookie holding a fingerprint of the visitor's consent (TCF purposes, US opt-outs and GPC). No new EC is minted while the visitor's consent matches it, so a CMP that still grants does not undo the revoke on the next page. Once the consent changes, the visitor starts again with a new EC and the marker is expired. Like a consent withdrawal, a captured removal or opt-out applies whatever the client, including one that fails the bot check. Only clearing an opt-out needs a real browser, because a clear re-enables IDs.
 
-Pull sync runs after response delivery, so a partner response that fills the last missing UID cannot set the marker on that already-sent response. A later eligible request verifies the completed row and issues the marker. Explicit withdrawal expires both `ts-ec` and any present `ts-ec-pull-complete` marker even when KV is unavailable.
+### Complete Provider EIDs
 
-Issuing or expiring the marker adds `Set-Cookie` to the outgoing response. Cache-privacy handling makes an otherwise shareable response private when that happens. A valid marker is not refreshed on each request, so this cost is limited to responses that establish or clear marker state in exchange for avoiding later KV reads.
+A provider can return more than one EID entry for a source, several UIDs per entry, and EID-level `inserter`, `matcher`, `mm` and `ext`. KV stores the whole set in the source's `eids` array, and the admin lookup (`GET /_ts/admin/ec`) shows it in the row's `ids` map, as stored (other row fields omitted):
+
+```json
+{
+  "entry": {
+    "ids": {
+      "exampleid.example.com": {
+        "w": "exampleid",
+        "rv": "0123456789abcdef",
+        "at": 1790000000,
+        "eids": [
+          {
+            "uids": [
+              { "id": "uid-a", "atype": 1, "ext": { "kind": "a" } },
+              { "id": "uid-b" }
+            ],
+            "inserter": "exampleid.example.com",
+            "matcher": "exampleid.example.com",
+            "mm": 2
+          },
+          { "uids": [{ "id": "uid-c" }], "ext": { "segment": "x" } }
+        ]
+      }
+    }
+  }
+}
+```
+
+Bidders receive the entries in that order, after the browser's entries. An entry that sets none of `inserter`, `matcher` and `mm` gets the provider's configured defaults at output. The `ext` data is stored only in KV and reaches bidders, `x-ts-eids` and the `__Host-ts-eids-s` mirror under the same consent gates as the UIDs. The mirror can be read by every script on the page.
+
+`GET /_ts/api/v1/identify` is unchanged: it still returns one UID per source, the first UID of the first entry, with the partner's `openrtb_atype`.
+
+### Rolling Back from Vendor Providers
+
+To go back to the identity release without vendor providers:
+
+1. Remove every `owner` key from `[[ec.partners]]` and every vendor `[ec.identity.providers.*]` table first, then push the config. The earlier release's validation rejects both. Pull-partner tables (`pull-...`) stay.
+2. Deploy the earlier release.
+
+After the rollback, multi-entry records stay readable but are not served while the provider that wrote them is not configured, and browser ingest may replace them. Each provider's `ps.o`, `ps.oc` and `ps.ov` (the opt-out, its clear and the removed-ID hashes) are kept, so opt-outs survive; the rest of its `ps` is pruned. Invalidated values can therefore be seeded once more, and stateful providers start over when rolled forward again.
+
+Rolling back past the identity release is unsupported, because a release before it cannot read KV schema version 2.
 
 ## Configuration
 
@@ -299,6 +385,17 @@ sets `Path=/`, `Secure`, `HttpOnly`, `SameSite=Lax`, and a `Max-Age`.
 `Domain` is computed as `.{publisher.domain}`. The separate
 `cookie_domain` setting applies only to non-EC cookies.
 
+## Cookies Forwarded to the Origin
+
+`ts-ec` and `ts-eids` still reach the publisher origin. The
+`__Host-ts-eids-s` mirror cookie does not: Trusted Server strips it from
+the request before it forwards it, so the origin's `Cookie` header stays
+the size it was before the mirror existed. An operator whose origin
+rejects large `Cookie` headers can strip `ts-eids` as well with
+`[ec] strip_eids_cookie_from_origin = true`. Prebid Server never receives
+any Trusted Server identity cookie (`ts-ec`, `ts-eids`, or
+`__Host-ts-eids-s`).
+
 ## Operational Notes
 
 - Rotate the secret periodically. Rotation produces a new 64-hex base
@@ -313,12 +410,13 @@ sets `Path=/`, `Secure`, `HttpOnly`, `SameSite=Lax`, and a `Max-Age`.
 - When consent is blocked but not explicitly withdrawn, Trusted Server strips EC response headers for that request but leaves any existing `ts-ec` cookie intact; cookie expiry and tombstones happen only on explicit withdrawal.
 - `/_ts/api/v1/identify` is read-oriented and returns identity enrichment for the authenticated partner. It computes `cluster_size` only when the EC entry does not already store one.
 - `/_ts/api/v1/batch-sync` validates every input, groups valid mappings by normalized EC ID, and applies the last valid UID for each group once. Group outcomes still account for every original input; infrastructure failures reject the failing and remaining groups. Mapping timestamps remain required for API compatibility but do not order writes. See the [API Reference](/guide/api-reference) for the complete contract.
-- Pull sync fills missing partner UIDs only. Existing partner UIDs are not periodically refreshed because EC entries no longer store per-partner sync timestamps.
+- Pull sync fills missing partner UIDs only, from a returning visitor's second page load. Existing partner UIDs are not periodically refreshed because EC entries no longer store per-partner sync timestamps.
 
 ## Next Steps
 
 - Follow the [EC Setup Guide](/guide/ec-setup-guide)
 - [Configuration Reference](/guide/configuration)
+- [Writing an Identity Provider](/guide/identity-providers)
 - [GDPR Compliance](/guide/gdpr-compliance) for consent signal handling
 - Configure [Ad Serving](/guide/ad-serving)
 - [Collective Sync](/guide/collective-sync) for cross-publisher data sharing details and diagrams
diff --git a/docs/guide/identity-providers.md b/docs/guide/identity-providers.md
new file mode 100644
index 0000000000..e93deefe8e
--- /dev/null
+++ b/docs/guide/identity-providers.md
@@ -0,0 +1,315 @@
+# Writing an Identity Provider
+
+This guide is for engineers who add a vendor to Trusted Server's server-side identity framework. Operators configuring a provider that already exists want the [Configuration Reference](/guide/configuration#identity-providers-ec-identity) and the [Edge Cookies](/guide/edge-cookies) guide instead.
+
+Every example uses a fictional provider, `exampleid`, that calls `api.exampleid.example.com`. No vendor ships with the framework. Vendors arrive in their own specs.
+
+For the protocol, the storage layout and the reasoning behind each rule, see the [design spec](https://github.com/IABTechLab/trusted-server/blob/main/docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md). Section numbers below point into it.
+
+## What a provider is
+
+A provider turns request signals into OpenRTB EIDs. It does that in one or both of two ways:
+
+- **Active resolution.** It builds an HTTPS request to the vendor from the visitor's signals, then parses the vendor's reply into IDs.
+- **Passive capture.** It reads a response that Trusted Server already proxies for the vendor, with no outbound call. Capture is revoke-only (see [Capture](#capture)).
+
+A provider does no I/O. It builds requests and parses bytes that are already buffered. The coordinator does the rest:
+
+| The coordinator handles                                                   | You write                                 |
+| ------------------------------------------------------------------------- | ----------------------------------------- |
+| Consent checks against your policy before any byte leaves                 | A `ConsentPolicy` in the descriptor       |
+| Real-browser gate, eligibility, refresh timing, per-visitor burst cap     | Nothing                                   |
+| HTTPS, host allow-list, no `Cookie` header, redirects, timeouts, body cap | Declared hosts                            |
+| Backoff on failure and the circuit breaker                                | Nothing                                   |
+| The single KV write, ownership, expiry and opt-outs                       | A `Resolution` that says what you learned |
+| Hold mode versus after-send dispatch                                      | Nothing (the operator picks the mode)     |
+
+## The pieces
+
+Implement `IdentityProvider`. Only `descriptor` is required. You add a capability by declaring it in the descriptor and overriding the matching method (`request` and `response` for resolving, `capture` for capturing). Every default body returns a `not_implemented` marker, so a capability that is declared but not implemented fails in the harness.
+
+Implement `IdentityProviderConfig` on your integration's config type. Its `build_descriptor` builds the descriptor from config alone, with no secrets, so `ts config validate` and the running provider see the same descriptor. Your constructor calls it and stores the result.
+
+## The descriptor
+
+```rust
+ProviderDescriptor::builder("exampleid".parse()?)
+    .with_source("exampleid.example.com".parse()?)
+    .with_resolves(
+        Resolves::new()
+            .with_endpoint("https://api.exampleid.example.com/v1/fetch")
+            .with_needs([Input::ClientIp, Input::UserAgent])
+            .with_wants([Input::PageUrl])
+            .with_private_state(),
+    )
+    .with_consent_policy(
+        ConsentPolicy::strict()
+            .with_tcf_purposes([4])
+            .with_tcf_vendor(9999),
+    )
+    .build()?
+```
+
+- `with_source` declares each source domain you may write. A source also needs an `[[ec.partners]]` entry.
+- `Resolves::with_endpoint` must be an `https` URL. Its host becomes the only host you may call. `with_host` adds more.
+- `with_needs` inputs are required: without them the provider is skipped. `with_wants` inputs are passed when available.
+- `with_private_state` lets you keep a small JSON blob between calls (see [Private state](#private-state)).
+- `with_expiring_ids` or `with_expiring_source` marks IDs as expiring. A set for an expiring source must then carry an expiry.
+- `Resolves::with_refresh_grace` is for an owner without private state whose refresh accepts an expired ID. An expired record it wrote stays a refresh anchor until its expiry plus the grace, so a backoff or a quiet spell does not turn the next call into an `Initial`. It needs the `Refresh` kind and a grace above zero.
+- `ConsentPolicy::strict()` is the default. It blocks when any consent signal cannot be decoded, requires TCF Purpose 1 where TCF applies, and blocks on every US opt-out, `Sec-GPC: 1` and `DNT: 1`. A provider that resolves must declare the purposes its GVL entry lists with `with_tcf_purposes` (Purpose 1 is always required) and its GVL ID with `with_tcf_vendor`. A vendor with no GVL ID calls `without_tcf_vendor` instead, so purpose consent alone lets it run. That and relaxations such as `allowing_dnt` need a documented legal basis in the vendor spec.
+- `build()` fails with `Config` for a descriptor with no source or no capability, a missing or non-`https` endpoint, invalid provenance, or a resolving policy that declares no purposes or names no vendor without `without_tcf_vendor`.
+
+The descriptor must never read a secret field. Deploy validation runs before secrets resolve and would see key names. `check_descriptor_ignores_secrets` enforces this in tests.
+
+### Provenance defaults
+
+`with_provenance(source, EidProvenance)` sets default `inserter`, `matcher` and `mm` for a source. The default is applied at output only, and only to a stored entry that sets none of the three. An entry that sets any of them is the vendor's complete statement, and no default mixes in. Defaults are not stored, so a config change applies at once. A blank `inserter` or `matcher`, one over 255 bytes, or an `mm` below 0 fails `build()`.
+
+## Reading inputs
+
+You get only what the descriptor declared. Read a required input with `?` and a wanted one with `.ok()`:
+
+```rust
+let ip = input.client_ip()?;
+let page = input.page_url().ok();
+```
+
+An accessor fails in one of two ways:
+
+- `UndeclaredInput`: you read something the descriptor never declared. This is a provider bug. Even if you hide the error with `.ok()`, the read is recorded, the coordinator logs it as `Config`, and the harness fails your test.
+- `InputUnavailable`: the input was declared but is missing this time. This is a normal skip, handled like returning `None` from `request`.
+
+Always available: `consent()`, `publisher_domain()`, `now()`, `random_bytes()`, `stored(source)` and the declared `endpoint()`. When the sources in one request have different kinds, use `input.is_initial(&source)` or `input.is_refresh(&source)` rather than matching on the kind.
+
+## Building a request
+
+`request` returns `Ok(Some(request))`, or `Ok(None)` to skip this time. A skip is not a failure: the coordinator waits `refresh_after_sec` before asking again.
+
+```rust
+fn request(
+    &self,
+    input: &ResolveInput<'_>,
+) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+    let consent = input.consent();
+    let body = FetchBody {
+        partner: self.partner_id,
+        ip: input.client_ip()?.to_string(),
+        ua: input.user_agent()?,
+        page: input.page_url().ok().map(Url::as_str),
+        gdpr: consent.gdpr_applies(),
+        consent: consent.raw_tc_string(),
+        signature: input.state::<ExampleIdState>()?.map(|state| state.signature),
+    };
+    ProviderRequest::post_json(input.endpoint()?, &body).map(Some)
+}
+```
+
+The coordinator refuses to send a request that is not `https`, that targets an undeclared host, that carries a `Cookie` header, or whose headers are invalid. Use `try_with_call_context` to pass data from `request` to `response`, such as a nonce. It stays in memory, is never sent, and is limited to 1,024 bytes of JSON.
+
+## Parsing a response
+
+`response` receives the buffered, already decoded body and returns a `Resolution`:
+
+```rust
+fn response(
+    &self,
+    response: &ProviderResponse,
+    input: &ResolveInput<'_>,
+) -> Result<Resolution, Report<IdentityProviderError>> {
+    let reply: FetchReply = response.success_json()?;
+    let Some(uid) = reply.uid else {
+        return Ok(Resolution::no_match());
+    };
+
+    let mut uid = ResolvedUid::new(uid).with_atype(1);
+    if let Some(link_type) = reply.link_type {
+        uid = uid.with_ext(json!({ "linkType": link_type }));
+    }
+    let mut eid = ResolvedEid::new(input.primary_source(), uid);
+    if let Some(max_age) = reply.max_age_sec {
+        eid = eid.with_refresh_in(Duration::from_secs(max_age));
+    }
+    let resolution = Resolution::found([eid]);
+    Ok(match reply.signature {
+        Some(signature) => resolution.replacing_state(&ExampleIdState { signature }),
+        None => resolution,
+    })
+}
+```
+
+Return `Rejected` (through `success_json` or `IdentityProviderError::rejected`) for a refusal and `Malformed` for a body you cannot parse. Both back the visitor off. Do not return an error for "this visitor is unknown": that is `Resolution::no_match()`.
+
+| Constructor                         | Meaning                                                                                                                                                                                                  |
+| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Resolution::found(entries)`        | One or more `ResolvedEid` entries                                                                                                                                                                        |
+| `Resolution::no_match()`            | Nobody recognized. `with_retry_in` sets the wait (default 24 hours)                                                                                                                                      |
+| `Resolution::invalidate(source)`    | The stored ID for `source` is no longer valid                                                                                                                                                            |
+| `found(..).also_invalidate(source)` | Return some sources and drop others in one response                                                                                                                                                      |
+| `Resolution::opted_out()`           | The visitor opted out with the vendor. Sticky until a re-grant: consent that was denied when the opt-out was recorded is granted again, the vendor issues again (capture-only), or an operator clears it |
+
+## Complete provider EIDs
+
+A `ResolvedEid` is one OpenRTB EID entry: a source, one or more `ResolvedUid`s, and EID-level fields. A result may hold several entries for one source, in the order bidders should see them, and several UIDs per entry.
+
+```rust
+let first = ResolvedEid::new(&source, ResolvedUid::new("uid-a").with_atype(1).with_ext(json!({ "kind": "a" })))
+    .with_uid(ResolvedUid::new("uid-b"))
+    .with_inserter("exampleid.example.com")
+    .with_matcher("exampleid.example.com")
+    .with_mm(2);
+let second = ResolvedEid::new(&source, ResolvedUid::new("uid-c")).with_ext(json!({ "segment": "x" }));
+let resolution = Resolution::found([first, second]);
+```
+
+- UID-level fields: `atype` and `ext`.
+- EID-level fields: `inserter`, `matcher`, `mm` and `ext`.
+- Timing (`with_expires_in`, `with_expires_at`, `with_refresh_in`, `with_refresh_at`) applies to the source's whole set. When several entries of a source set it, the earliest time wins.
+- `with_refresh_until` is for a provider with private state. It marks when an ID stops being refreshable, so an expired record stays as a refresh anchor until then.
+
+### Limits
+
+The coordinator groups a result's entries by source and checks each group with the browser parser's field rules, plus per-source caps the browser parser does not have. It applies them before the result joins the write.
+
+- An entry for a source you do not claim, or that the operator narrowed away, is discarded.
+- A UID that is empty, blank or over 512 bytes is dropped. An entry left with no UID is discarded.
+- A blank or over-255-byte `inserter` or `matcher`, an `ext` that is not an object or exceeds 2,048 bytes as compact JSON, and an `mm` or `atype` below 0 are dropped as fields. The entry is kept.
+- An entry equal to an earlier kept entry of the same source is dropped.
+- A source keeps at most **8 entries** and **32 UIDs** across them. The rest are dropped.
+- A source's entry set over **4,096 bytes** (`MAX_ENTRY_SET_BYTES`, measured as stored, without provenance defaults) is discarded whole, never trimmed.
+
+Each `ext` may hold 2,048 bytes and each `inserter` or `matcher` 255 bytes, but those field caps do not guarantee the set cap. A set whose legal fields add up to more than 4,096 bytes is discarded whole.
+
+A discarded set leaves the stored set as it is, as if the result had not named the source. A result all of whose sets are discarded counts as `Malformed`: the visitor backs off, and the result's removals still apply. The harness fails a fixture that hits any limit, so keep your test responses at realistic sizes.
+
+### Replace or fill
+
+What a result does depends on who owns the source:
+
+- For a source the provider **owns** (the `owner` key of its `[[ec.partners]]` entry), a result replaces the source's whole entry set. An entry the next result omits is removed.
+- For an **unowned** source, a result only fills an absent or expired record. It is never replaced by its writer, and browser values and other writers win.
+
+A source your result does not name keeps its record either way.
+
+### Vendor `ext` data and privacy
+
+Vendor `ext` data is stored only in KV, never in the `ts-eids` cookie. It reaches bidders, the `x-ts-eids` response header and the `__Host-ts-eids-s` mirror under the same consent gates as the UIDs. The mirror is not `HttpOnly`, so every script on the page can read it. If you store segments or match metadata in `ext`, say exactly what they hold in your vendor spec. If a vendor's IDs must not reach page scripts, the operator sets the source's `bidstream_enabled = false` or keeps the provider off.
+
+Never log UIDs, provider state, consent strings or URLs with a query string. Log errors with `current_context()` only.
+
+## Private state
+
+A provider declared `with_private_state()` can keep up to 1,024 bytes of JSON in the visitor's row, for things like a refresh token or a signature. Read it with `input.state::<T>()` and replace it with `Resolution::replacing_state(&value)` or `clearing_state()`.
+
+- State lives in KV only. It is never sent to bidders, put in a cookie, or returned by the admin lookup (which shows `[redacted]`).
+- A state that does not decode as `T` returns `InvalidState`, and the coordinator clears it so the next call starts fresh. Use a strict type: a `#[serde(default)]` type that decodes anything fails the harness.
+- An oversized or unserializable replacement rejects the result's positive part whole (no ID, no state), while its removals still apply.
+- A stateful result applies whole. If another writer stored a newer ID while your call was in flight, your ID, state and scheduling are all dropped together.
+
+## Capture
+
+A capture-only provider declares `with_captures(Captures::new().with_path(Method::POST, "/integrations/examplecapture/api/token"))` and no `resolves`, so it is never dispatched. Every capture path must lie under the registering integration's own proxy routes, or startup fails. It overrides one method:
+
+```rust
+fn capture(
+    &self,
+    input: &CaptureInput<'_>,
+) -> Result<Resolution, Report<IdentityProviderError>> {
+    let Ok(reply) = input.response().json::<TokenReply>() else {
+        return Ok(Resolution::no_match());
+    };
+    Ok(Resolution::found(reply.tokens.into_iter().filter_map(|token| {
+        let source = input.source_named(&token.source)?;
+        Some(ResolvedEid::new(source, ResolvedUid::new(token.value)))
+    })))
+}
+```
+
+Capture is **revoke-only**. A capture result can do three things, and no more:
+
+- Its removals (`invalidate`, `also_invalidate`) and an opt-out (`opted_out`) are written to KV.
+- A positive result clears the provider's opt-out (the vendor issuing again after the visitor re-consented), provided consent allows it.
+- Its positive IDs are only counted in the `capture_unpersisted` counter, by provider and source and never by value. They are not stored. The browser's own path carries them through ordinary browser ingest.
+
+More rules:
+
+- Capture never changes private state, and never touches backoff or the circuit breaker. A proxied call that held nothing is not a failure. A state change in a capture result is ignored with a warning, and the harness fails it.
+- Return `Ok(Resolution::no_match())` for any body you do not recognize.
+- `CaptureInput` never exposes request bodies or request headers.
+- **Real-browser gate.** Removals, opt-outs and global revokes apply from any client, as consent withdrawals do. Only a clear needs a real browser: a positive result from a client that fails the real-browser check never clears an opt-out. A script replaying a copied `ts-ec` cookie through the proxy can therefore revoke for that visitor, as it could already withdraw consent, but cannot lift a revocation.
+- **A capture-only provider must list its `sources`** in `[ec.identity.providers.<id>]`, and it **cannot own a source**. Its opt-out removes browser-ingested records of every listed source, so the operator names only the sources it is the delivery path for.
+- `revoke_scope` controls how far a captured opt-out reaches (see [Configuration Reference](/guide/configuration#per-provider-keys)). With `"provider"` (the default) it removes only that provider's records and, for a capture-only provider, the records of its listed sources that no provider wrote. With `"global"`, a captured opt-out runs the consent-withdrawal tombstone, from any client.
+
+## Registering a provider
+
+An integration's `register` function registers a provider through the existing builder. `try_with_identity_provider` wraps a fallible constructor and turns a failure into `TrustedServerError::Integration`:
+
+```rust
+Ok(Some(
+    IntegrationRegistration::builder(EXAMPLEID_INTEGRATION_ID)
+        .try_with_identity_provider(ExampleIdProvider::new(&config))?
+        .build(),
+))
+```
+
+`with_identity_provider(Arc<dyn IdentityProvider>)` takes an already built provider. An integration can register more than one. Add a `validate_identity_integration` line for your config type next to the existing per-type list in the deploy validator, so `ts config validate` builds your descriptor.
+
+Provider IDs match `^[a-z][a-z0-9_-]{0,62}$`, and two providers cannot share an ID. At most 32 providers can be enabled, generic pull partners included.
+
+## Testing with the harness
+
+`ProviderHarness` drives a provider the way the coordinator does, so vendor tests stay short. It lives in `trusted_server_core::ec::identity::test_support`, behind `cfg(any(test, feature = "test-utils"))`. A provider in its own crate enables `test-utils` as a dev-dependency feature of `trusted-server-core`. `ExampleIdProvider` is a crate-private fixture in the core crate, so the snippets in this guide are illustrative: substitute your own provider type and config.
+
+```rust
+let provider = ExampleIdProvider::new(&example_config()).expect("should build the provider");
+let mut harness = ProviderHarness::new(&provider)
+    .with_client_ip("192.0.2.10")
+    .with_user_agent("ExampleBrowser/1.0");
+
+let request = harness
+    .request()
+    .expect("should build a request")
+    .expect("should not skip the request");
+assert_eq!(
+    request.url().host_str(),
+    Some("api.exampleid.example.com"),
+    "should call the declared host"
+);
+
+let resolution = harness
+    .respond(StatusCode::OK, &json!({ "uid": "example-uid", "signature": "example-signature" }))
+    .expect("should parse the response");
+assert_eq!(
+    resolution.eids()[0].uids()[0].id(),
+    "example-uid",
+    "should return the uid"
+);
+```
+
+- `respond_raw(status, headers, bytes)` covers empty and non-JSON bodies. `request_json::<T>()` decodes the built body. `capture(&CaptureFixture)` runs a capture (build the fixture with `CaptureFixture::new(Method::POST, path).with_response(status, &json)`). `state_of::<T>(&resolution)` decodes the replacement state.
+- `with_stored(StoredId::for_test(&source, "example-uid"))` makes a source a refresh. `HashedEmail::for_test` takes a `[u8; 32]` digest. Both are available under `test-utils`. `StoredId::with_eids` gives a refreshing provider a stored full set.
+- The `Resolution` getters show what the provider set. Provenance defaults are applied only by `output_eids(&resolution)`, which returns the EIDs bidders would see after the section 4.5 rules and your descriptor's defaults.
+- `check_conformance(&cases)` runs the checks every provider must pass; `check_conformance_with_state::<S>` also round-trips your state type. Both panic with a message naming the failure. `try_check_conformance` and `try_check_conformance_with_state::<S>` return `Result<(), Report<ConformanceFailure>>` instead (`ConformanceFailure` is `#[non_exhaustive]`). Use them to assert that a deliberately broken provider fails, because a panic aborts the whole `wasm32-wasip1` test run.
+- `check_descriptor_ignores_secrets(&placeholder_config, &resolved_config)` fails if your descriptor depends on a secret.
+
+`check_conformance` verifies that inputs hold only what the descriptor declares, that a resolver returns a request for at least one listed setup, that requests go only to declared hosts over HTTPS with valid headers and no `Cookie`, that entries are for declared sources and no fixture hits a limit, that expiries are reported and present for expiring sources, that nothing returns state without `with_private_state()`, that `capture` never changes state, and that a bare-JSON-string stored state is never accepted.
+
+```rust
+#[test]
+fn example_provider_conforms() {
+    let provider = ExampleIdProvider::new(&example_config()).expect("should build the provider");
+    ProviderHarness::new(&provider).check_conformance_with_state::<ExampleIdState>(
+        &ConformanceCases::default().with_resolve_case(
+            HarnessSetup::default().with_client_ip("192.0.2.10").with_user_agent("ExampleBrowser/1.0"),
+            StatusCode::OK,
+            &json!({ "uid": "example-uid", "signature": "s" }),
+        ),
+    );
+}
+```
+
+Add a fixture response for each outcome the vendor can return, and assert it through the `Resolution` getters.
+
+## Next steps
+
+- [Edge Cookies](/guide/edge-cookies) for the operator checklist and rollback steps
+- [Configuration Reference](/guide/configuration#identity-providers-ec-identity) for every operator key
diff --git a/docs/guide/integrations/gpt-diagnostics-dictionary.md b/docs/guide/integrations/gpt-diagnostics-dictionary.md
new file mode 100644
index 0000000000..9458b07924
--- /dev/null
+++ b/docs/guide/integrations/gpt-diagnostics-dictionary.md
@@ -0,0 +1,171 @@
+# GPT Diagnostics Label Dictionary
+
+This dictionary defines the exact fixed labels and dynamic label prefixes in the GPT Runtime Diagnostics panel and badges. Text after a prefix such as `Server auction winner:` is the bounded observed value. The console reports observations; it does not identify the creative ultimately served unless a listed evidence source explicitly establishes that fact. Browser times use `performance.now()` and server times use the server request's `RequestTimings` clock. The clocks are never subtracted.
+
+See [GPT Runtime Diagnostics](./gpt-diagnostics.md) for activation and operational details.
+
+## Identity and controls
+
+| Label                         | Badge        | Source                      | Meaning and limits                                                                                                                     |
+| ----------------------------- | ------------ | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `Ad #N`                       | `Ad #N`      | `runtimeSlotNumber`         | Stable number assigned to a GPT slot object in this page. It is not a creative ID.                                                     |
+| `Request #M`                  | `Request #M` | `requestNumber`             | Monotonic request cycle for that slot, including refreshes. It does not imply fill.                                                    |
+| `Filter`                      | —            | panel state                 | Limits displayed rows. Activating a badge resets a hiding filter to `All`.                                                             |
+| `Export JSON`                 | —            | `gptDiagnostics.export()`   | Downloads the allowlisted V1 snapshot. It issues no ad request.                                                                        |
+| `Label dictionary`            | —            | documentation link          | Opens this keyboard-accessible help page.                                                                                              |
+| `How to read this evidence`   | —            | inline help                 | Expands a concise explanation that winner, candidate, render, and timing observations have separate meanings and clocks.               |
+| `Locate on page`              | —            | exact unique DOM binding    | Scrolls only on activation and briefly draws a diagnostics-layer highlight. It never changes publisher attributes, classes, or styles. |
+| `Collapse`, `Expand`, `Close` | —            | panel state                 | Presentation controls only. `show()` can reopen a closed panel.                                                                        |
+| `Request history`             | —            | retained cycles             | Earlier retained requests. At most ten cycles are retained per slot. An evicted selection is reported as no longer retained.           |
+| `Technical details`           | —            | allowlisted snapshot fields | Expands correlation IDs, coverage, failures, and other non-summary evidence.                                                           |
+
+Badge evidence passes pointer input through. A small keyboard-accessible `Ad #N`
+button opens the panel from outside the observed bound creative rectangles. If no
+outside position fits inside the viewport, only the button is hidden. Selecting
+the latest request focuses its current details; an earlier request opens history.
+
+The per-request panel groups are `Summary`, `Auction evidence`, `Delivery evidence`, `Timing`, and `Size and visibility`. Summary prefixes are `GPT result:` and `Observed auction path:`. Technical prefixes include `Ad unit`, `Request intent:`, `Trusted Server auction:`, and `Prebid auction:`. A fact appears in one detailed group; Technical details does not repeat those grouped facts.
+
+Panel status is `GPT observed` or `Waiting for GPT`. Filter values are `All`, `Visible`, `Filled`, `Empty`, `Pending/Incomplete`, and `Unbound/Ambiguous`. Empty results are `No GPT slots observed yet.` or `No slots match.` The retained-cycle labels are `Initial request` and `Refresh N`; an evicted selection is announced as `Ad #N, Request #M is no longer retained.` The overview counts use the prefixes `slots`, `callback issues`, and `attribution issues`. Callback coverage uses the suffixes `observed`, `matched`, `unmatched`, and `ambiguous`.
+
+## GPT lifecycle and delivery
+
+| Label                                                                | Badge                     | Raw value / source                          | Meaning and what it does not prove                                                                                                                                                        |
+| -------------------------------------------------------------------- | ------------------------- | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Waiting for request`                                                | —                         | no request cycle                            | GPT has not emitted `slotRequested` for the slot.                                                                                                                                         |
+| `Requesting`                                                         | `Pending`                 | `slotRequested`                             | A GPT request callback was observed. Elapsed time alone does not mean failure.                                                                                                            |
+| `Response received`                                                  | —                         | `slotResponseReceived`                      | GPT emitted its response callback. It does not prove fill.                                                                                                                                |
+| `GPT result: Filled` / `Filled`                                      | `Filled`                  | `slotRenderEnded.isEmpty === false`         | GPT reported non-empty. It does not prove which bidder or pixels were served.                                                                                                             |
+| `GPT result: Empty` / `Empty`                                        | `Empty`                   | `slotRenderEnded.isEmpty === true`          | GPT explicitly reported empty.                                                                                                                                                            |
+| `GPT result: Rendered (fill unknown)` / `Rendered (fill unknown)`    | `Rendered (fill unknown)` | `slotRenderEnded` without `isEmpty`         | Render callback observed; fill remains unavailable.                                                                                                                                       |
+| `Creative markup sent; execution not confirmed`                      | `TS response sent`        | `delivery=trusted_server_response_sent`     | The bridge posted markup to PUC. It does not prove execution, visibility, or final served source.                                                                                         |
+| `Server bid selected by the creative bridge; response not confirmed` | `TS selected`             | `delivery=trusted_server_selected`          | A matched PUC request selected the server bid; no successful response post was observed.                                                                                                  |
+| `Server bid available; selection not confirmed`                      | `TS unconfirmed`          | `delivery=candidate_unconfirmed`            | A server candidate existed but no matched selection appeared in the observation window.                                                                                                   |
+| `Waiting for Trusted Server creative evidence`                       | `TS candidate (pending)`  | `delivery=pending`                          | The five-second positive-evidence window is open.                                                                                                                                         |
+| `No direct Trusted Server candidate`                                 | `No TS candidate`         | `delivery=no_candidate`                     | `adInit` explicitly found no direct candidate for this request.                                                                                                                           |
+| `Delivery status unknown — required evidence was not observed`       | `Delivery unknown`        | `delivery=unknown`                          | Evidence exists but cannot establish a more specific delivery state.                                                                                                                      |
+| `Delivery evidence: Not applicable`                                  | —                         | `delivery=not_applicable`                   | No positive bridge evidence exists and a delivery conclusion does not apply before render or for an explicitly empty result.                                                              |
+| `Delivery evidence: Not observed`                                    | —                         | missing delivery state                      | No delivery state was captured.                                                                                                                                                           |
+| `Served bidder not confirmed`                                        | —                         | a non-empty GPT render without served proof | Server winner, targeting candidate, `bidWon`, and GPT render facts remain separate; none alone confirms the final served creative. This label is not shown for pending or empty requests. |
+| `GPT slot onload observed`                                           | —                         | `slotOnload`                                | GPT emitted onload. It is not pixel-level or demand-source proof.                                                                                                                         |
+| `GPT impressionViewable observed`                                    | —                         | `impressionViewable`                        | GPT emitted its viewability callback.                                                                                                                                                     |
+| `Incomplete sequence`                                                | `Incomplete sequence`     | `incompleteSequence`                        | An observed callback proves a missing or invalid predecessor. Time alone never sets it.                                                                                                   |
+
+## Auction evidence
+
+| Label                               | Badge            | Raw value / source                                                                | Meaning and limits                                                                                                                                                               |
+| ----------------------------------- | ---------------- | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SSAT: initial-page server auction` | `SSAT`           | `auctionType=ssat`                                                                | Explicit completed server-auction evidence from the initial page request.                                                                                                        |
+| `TS auction: SPA server auction`    | `TS auction`     | `auctionType=trusted_server`                                                      | Explicit completed `/_ts/page-bids` server-auction evidence.                                                                                                                     |
+| `Client-side Prebid auction`        | `Prebid auction` | `auctionType=client_side`, exact Prebid callback correlation                      | A completed Prebid attempt was correlated to this slot and next GPT request. A refresh wrapper call alone does not establish it.                                                 |
+| `Multiple auction paths observed`   | `Multiple paths` | `auctionType=competing`                                                           | Completed server and Prebid auction evidence both exist for the request. This does not prove a race, overwrite, or winner.                                                       |
+| `Auction not observed`              | no auction badge | missing or malformed explicit facts                                               | Diagnostics has no qualifying completed-auction evidence. It never defaults to SSAT.                                                                                             |
+| `Server auction winner`             | —                | compatibility `auctionWinner`, server `hb_bidder`                                 | Winner selected by the server auction. It is not the final served bidder.                                                                                                        |
+| `Server bid price bucket:`          | —                | server `hb_pb`                                                                    | Already-bucketed price; raw CPM is never exported. A supplied currency follows the bucket value; an absent currency adds no suffix.                                              |
+| `Prebid targeting candidate:`       | —                | `prebidAuction.targetingCandidate` after exact `setTargetingForGPTAsync` boundary | Candidate targeting observed on the exact GPT slot for the exact Prebid callback auction ID. It is not a final win.                                                              |
+| `Prebid candidate price bucket:`    | —                | candidate `hb_pb`                                                                 | Bucketed targeting value for the candidate; it is not a winning-price claim. Diagnostics do not infer or read a Prebid currency targeting key.                                   |
+| `Prebid bidWon observation:`        | —                | `prebidAuction.win`, documented `bidWon` payload                                  | A bounded event joined by exact auction ID, ad-unit code, slot object, navigation generation, and retention window. It remains distinct from GPT render and served-source proof. |
+| `Prebid win price bucket:`          | —                | `bidWon.adserverTargeting.hb_pb`                                                  | Bucketed value observed on the correlated `bidWon` event; it is not proof of the creative GAM served. Diagnostics do not infer a currency.                                       |
+
+Bidder names are limited to 128 UTF-8 bytes, numeric bucket strings to 64 bytes, currencies to three ASCII letters, and auction IDs to 256 UTF-8 bytes. Prebid supplies its own auction ID through `bidsBackHandler`; diagnostics does not override Prebid auction identity. Duplicate, ambiguous, expired, late, prior-navigation, and malformed observations are rejected. Only an active diagnostics recorder installs the `bidWon` listener or retains candidate/win state, which is bounded to 128 pending attempts and 30 seconds. No raw CPM, creative markup, targeting dump, or losing bids are retained.
+
+First-party GPT and Prebid integrations never populate `currency`. The optional field
+accepts currency supplied through the internal `gptDiagnosticsRecorder` channel; that
+channel is not a supported operator API. Diagnostics does not infer a currency or read
+`hb_cur`, and missing currency adds no suffix to the price bucket.
+
+`Auction not observed` also covers the Prebid watchdog fallback: targeting can be
+applied even when Prebid never invokes `bidsBackHandler`, so no completed-auction ID
+is available to correlate with the GPT request. Targeting alone is not proof of a
+completed auction.
+
+## Request paths and opportunities
+
+| Label                                              | Raw value                 | Meaning                                                                                                                                    |
+| -------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `Request path: Trusted Server direct`              | `trusted_server_direct`   | The direct `adInit` route preceded the request. Route evidence alone is not auction evidence.                                              |
+| `Request path: Prebid refresh`                     | `prebid_refresh`          | The installed wrapper delegated the GPT refresh. Timeout and throw fallbacks retain this route label but do not claim a completed auction. |
+| `Request path: Publisher refresh`                  | `publisher_refresh`       | Publisher refresh boundary observed.                                                                                                       |
+| `Request path: Multiple paths observed`            | `competing`               | More than one route marker preceded the request; competition is possible but unproven.                                                     |
+| `Request path: Not observed`                       | `unattributed`            | No eligible route marker was consumed.                                                                                                     |
+| `Server bid available; creative source present`    | `renderable_candidate`    | Bid targeting plus ad ID and inline markup or complete cache coordinates were present.                                                     |
+| `Server bid available; creative source incomplete` | `unrenderable_candidate`  | Bid targeting existed but the bridge lacked a complete render source.                                                                      |
+| `Direct opportunity: No candidate`                 | `no_candidate`            | `adInit` explicitly observed no direct bid targeting.                                                                                      |
+| `Direct opportunity: Not observed`                 | missing opportunity       | No bounded direct-opportunity evidence was captured. It is not negative demand-source evidence.                                            |
+| `Request intent:`                                  | `requestIntentId`         | Opaque local correlation sequence, not an auction or user ID.                                                                              |
+| `Trusted Server auction:`                          | `trustedServerAuctionId`  | Opaque per-auction correlation token, not a GAM key or visitor identifier.                                                                 |
+| `Prebid auction:`                                  | `prebidAuction.auctionId` | Opaque Prebid-supplied auction correlation token. Diagnostics does not create or replace it.                                               |
+
+Path markers live for five seconds, are consumed once, and are keyed by GPT slot object identity.
+
+## Timing
+
+All values are milliseconds. Missing timing that should apply is `Unavailable`, never zero. Server timing is `Not applicable` when no completed server auction was observed. A displayed zero is a valid immediate observation. The three server rows below are rendered with their T0 anchor substituted: `Initial document request T0` for a navigation-origin auction and `SPA page-bids request T0` for an SPA-origin one. When no server timing origin was observed, the rows use the neutral `Server request T0` prefix with `Not applicable` values; this does not imply that a server clock or auction was observed.
+
+| Label                              | Origin and boundaries                                                            | Raw field                                  |
+| ---------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------ |
+| `<T0 anchor> → auction dispatched` | Server request `RequestTimings` T0 to successful `dispatch_auction` outcome      | `serverAuctionTimings.auctionDispatchedMs` |
+| `<T0 anchor> → auction collected`  | Same T0 to completion of `collect_dispatched_auction`                            | `auctionResolvedMs`                        |
+| `<T0 anchor> → bids ready`         | Same T0 to winning-bid map commit                                                | `auctionCommittedMs`                       |
+| `Auction collection wait`          | Actual duration blocked in collect; placement is `pre-header` or `in stream`     | `auctionWaitMs`, `auctionWaitPlacement`    |
+| `Opportunity → request`            | Browser `performance.now()`: recorder observation to matched GPT `slotRequested` | `opportunityToRequestMs`                   |
+| `GAM request → response`           | Browser `slotRequested` to `slotResponseReceived`                                | `durations.requestToResponseMs`            |
+| `GAM response → render`            | Browser `slotResponseReceived` to `slotRenderEnded`                              | `responseToRenderMs`                       |
+| `GAM request → render`             | Browser `slotRequested` to `slotRenderEnded`                                     | `requestToRenderMs`                        |
+| `Render → load`                    | Browser `slotRenderEnded` to `slotOnload`                                        | `renderToLoadMs`                           |
+| `Render → viewable`                | Browser `slotRenderEnded` to `impressionViewable`                                | `renderToViewableMs`                       |
+| `Replaced rendered request`        | Earlier browser render callback to later request callback                        | `previousRenderToRequestMs`                |
+
+Server offsets are not browser timestamps. `auctionResolvedMs` means collection completed (including timeout handling), not that a network byte arrived at that exact instant.
+
+## Size, visibility, binding, and GAM fields
+
+| Label                                                                          | Raw field / source                    | Meaning and limits                                                                                                                          |
+| ------------------------------------------------------------------------------ | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Requested sizes`                                                              | `requestedSlotSizes`                  | Configured sizes supplied to GPT; ordinary sizes such as 300×250 remain visible. Missing data is shown as `Requested sizes: Not observed`.  |
+| `GPT-reported size`                                                            | `size`                                | Exact `slotRenderEnded.size`. A 1×1 placeholder is shown as `GPT-reported size: placeholder hidden` and retained unchanged in V1 JSON.      |
+| `Size filled` / `Measured outer slot size`                                     | `observedSlotSize`                    | CSS outer box of the exact uniquely bound slot after fill. Missing data is shown as `Size filled: Not observed · Measured outer slot size`. |
+| `GPT visibility`                                                               | current/maximum visibility percentage | Values from GPT visibility callbacks; absence is `GPT visibility: Not observed`.                                                            |
+| `Binding: Bound` / `Bound`                                                     | `binding.status=bound`                | Exactly one connected publisher element matched.                                                                                            |
+| `Binding: unbound` / `Unbound`                                                 | `binding.status=unbound`              | No safe element binding; reason is shown.                                                                                                   |
+| `Binding: ambiguous` / `Ambiguous binding`                                     | `binding.status=ambiguous`            | Duplicate ID or GPT-slot evidence prevented a safe choice. No badge or locate action is invented.                                           |
+| `Outside viewport`                                                             | binding geometry                      | The exact element does not intersect the viewport; it remains in the panel.                                                                 |
+| `Ad Manager response class: empty/backfill/reservation/unclassified non-empty` | `responseClass`                       | Source-neutral classification derived from GPT render facts.                                                                                |
+| `Ad Manager reported …`                                                        | `adManager` identifiers               | GAM-reported line item, order, advertiser, creative, yield-group, and company IDs. They do not identify the demand source.                  |
+| `Ad Manager fields: Not observed`                                              | missing `adManager`                   | No allowlisted GAM identifier was captured.                                                                                                 |
+| `Ad Manager response class: Not observed`                                      | missing `responseClass`               | GPT did not provide enough render evidence to classify the response.                                                                        |
+| `Backfill yes/no`                                                              | `isBackfill`                          | GPT's callback value.                                                                                                                       |
+| `Slot content changed yes/no`                                                  | `slotContentChanged`                  | GPT's callback value; not proof pixels changed.                                                                                             |
+| `Creative changed/unchanged`                                                   | retained GAM creative IDs             | Comparison only when both cycles supplied an ID.                                                                                            |
+
+The unprefixed `Bound`, `Unbound`, and `Ambiguous binding` variants appear in Technical details only when a slot has no request cycle. Once request groups exist, binding appears only under Size and visibility.
+
+Binding reasons are `missing_slot_element_id`, `missing_element`, `duplicate_dom_id`, `dom_uniqueness_unverifiable`, and `duplicate_gpt_slot_id`. Other exact technical fact prefixes are `Replaced rendered request`, `Creative changed`, `Creative unchanged`, `Trusted Server creative request observed at`, and `Trusted Server markup response sent at`.
+
+## Failures, attribution, coverage, and retention
+
+Creative bridge labels are `Creative bridge failure: missing render source`, `Creative bridge failure: cache fetch failed`, `Creative bridge failure: invalid cache payload`, and `Creative bridge failure: response post failed`. They map directly to `missing_render_source`, `cache_fetch_failed`, `invalid_cache_payload`, and `response_post_failed`; they describe only the observed bridge step and contain no URL, markup, payload, or stack trace.
+
+Attribution issue labels map to `creative_request_without_slot`, `creative_request_without_cycle`, `creative_request_ambiguous_cycle`, `creative_request_on_empty_cycle`, `creative_attempt_capacity`, `creative_attempt_unknown`, `creative_attempt_expired`, and `creative_attempt_evicted`. Callback coverage separately counts `observed`, `matched`, `unmatched`, and `ambiguous` for `slotRequested`, `slotResponseReceived`, `slotRenderEnded`, `slotOnload`, `impressionViewable`, and `slotVisibilityChanged`.
+
+The V1 export remains additive and compatible: optional Prebid evidence and optional currency fields are new; existing fields keep their meanings. Bounds are 64 slots, ten request cycles per slot, 128 callback issues, 128 attribution issues, 64 direct associations, 16 requested sizes, and 128 creative attempts. Metadata reports dropped callbacks/issues and evicted slots/cycles.
+
+## Missing-value vocabulary
+
+- **Not observed**: the relevant callback or explicit evidence was not captured.
+- **Unavailable**: the value cannot be calculated or safely retained.
+- **Not applicable**: the fact does not apply, for example delivery conclusions before render or for an explicitly empty result.
+- **Unknown**: evidence exists but is insufficient to select a more specific state.
+
+## Acronyms
+
+- **TS**: Trusted Server.
+- **SSAT**: server-side ad targeting on the initial page request.
+- **SPA**: single-page application.
+- **GPT**: Google Publisher Tag.
+- **GAM**: Google Ad Manager.
+- **Prebid**: the client-side header bidding library observed here.
+- **PBS**: Prebid Server.
+- **PUC**: Prebid Universal Creative.
+- **CPM**: cost per thousand impressions; diagnostics retains only a bucketed targeting value, never raw CPM.
+- **T0**: the start of one server request's `RequestTimings` clock.
diff --git a/docs/guide/integrations/gpt-diagnostics.md b/docs/guide/integrations/gpt-diagnostics.md
index 445eda7873..2cb77e23c7 100644
--- a/docs/guide/integrations/gpt-diagnostics.md
+++ b/docs/guide/integrations/gpt-diagnostics.md
@@ -9,9 +9,8 @@
 
 GPT Runtime Diagnostics is an opt-in browser console for documented Google
 Publisher Tag (GPT) lifecycle callbacks and Trusted Server integration evidence.
-It groups observations into per-slot request cycles, shows timings and source-neutral
-GAM facts, binds slots to exact DOM elements, and downloads the same allowlisted data
-as versioned JSON.
+It groups observations into per-slot request cycles, shows auction and GPT timings,
+links each accessible page badge to the same stable `Ad #N` and `Request #M` in the side panel, binds slots to exact DOM elements, and downloads the same allowlisted data as versioned JSON. See the complete [label dictionary](./gpt-diagnostics-dictionary.md) for every operator-facing term.
 
 The console reports positive observations, not inferred ownership. A filled result
 means only that GPT emitted `slotRenderEnded` with `isEmpty === false`. A Trusted
@@ -322,8 +321,12 @@ Visible, Filled, Empty, Pending/Incomplete, and Unbound/Ambiguous slots.
 
 Each request cycle can show:
 
+- The same stable `Ad #N` and `Request #M` used by the request's page badge.
 - The observed request path, request-intent ID, and direct Trusted Server opportunity.
+- Explicit auction classification: initial-page server, SPA server, completed client-side Prebid, multiple observed paths, or not observed.
 - Opaque Trusted Server auction-ID correlation and opportunity-to-request latency when available.
+- Source-scoped server-auction winner, Prebid targeting candidate, and documented Prebid win observations. None is presented as the final served creative.
+- Server-measured auction dispatch, resolution, commit, and wait timing when available.
 - Observed replacement of an earlier retained filled render, including GPT creative-ID transitions.
 - Requesting, Response received, Filled, Empty, or Rendered (fill unknown) GPT
   lifecycle state.
@@ -331,9 +334,11 @@ Each request cycle can show:
 - Safe, deduplicated creative-bridge failure categories.
 - Source-neutral GAM response class and identifiers reported by GPT.
 - GPT slot-onload, impression-viewable, and visibility observations.
-- Non-negative request-to-response, response-to-render, render-to-load, and
+- Non-negative GAM request-to-response, GAM response-to-render, render-to-load, and
   render-to-viewable durations.
-- GPT-reported rendered size, a separately labelled observed outer slot box when safely bound, backfill, and slot-content-change facts.
+- GPT-reported rendered size, a separately labelled `Size filled` outer-slot measurement
+  when safely bound, backfill, and slot-content-change facts. GPT's ubiquitous `1×1`
+  placeholder stays in the JSON evidence but is hidden from the panel and badge.
 - Current DOM binding status and viewport intersection.
 
 Elapsed time alone never changes a pending GPT request to Incomplete. Incomplete
@@ -342,6 +347,68 @@ step. When `slotRenderEnded` omits `isEmpty`, the result stays Rendered (fill un
 and `responseClass` remains absent. `unclassified_non_empty` requires an explicit
 `isEmpty === false` observation.
 
+## Auction Classification and Timing
+
+Auction labels describe the path observed for that GPT request cycle:
+
+| Label                             | Meaning                                                                                              |
+| --------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| SSAT: initial-page server auction | Explicit completed initial-document server-auction evidence populated the direct request.            |
+| TS auction: SPA server auction    | Explicit completed `/_ts/page-bids` server-auction evidence populated the direct request.            |
+| Client-side Prebid auction        | A completed Prebid attempt was joined by exact auction ID, ad-unit code, GPT slot, and next request. |
+| Multiple auction paths observed   | Server and completed client-side evidence were both observed. This does not prove a race or winner.  |
+| Auction not observed              | Explicit completed-auction evidence was absent or malformed. It never defaults to SSAT.              |
+
+Publisher refresh evidence does not by itself establish another auction. It remains
+visible in the request-path classification but does not turn an SSAT, TS auction, or
+client-side auction label into `Multiple auction paths observed`. Publisher-only refreshes and
+unattributed requests have no auction label because the available evidence does not
+establish an auction implementation.
+
+For synthetic refresh auctions, diagnostics correlates the auction ID supplied by
+Prebid's own `bidsBackHandler`; it does not provide or override Prebid auction IDs. The
+`bidWon` listener, targeting reads, and bounded correlation state are installed only
+when an active diagnostics recorder exists, so an inactive console does not change
+Prebid-visible behavior.
+
+Server auction timing and browser GPT timing use separate clocks and are never
+subtracted from each other. Both initial SSAT and SPA TS auction offsets use the
+adapter's server-request clock. Initial offsets belong to the document request, while
+SPA offsets belong to the later `/_ts/page-bids` request. Diagnostics retain that
+request origin separately from the aggregate auction classification, so a request marked
+`competing` still labels SPA offsets from the SPA page-bids request T0. Neither server
+clock is the browser's navigation clock. The server facts are:
+
+- `auctionDispatchedMs`: bid dispatch offset from that timing origin.
+- `auctionResolvedMs`: offset when auction collection completed, including timeout handling.
+- `auctionCommittedMs`: offset when winning bids were available to page state.
+- `auctionWaitMs`: actual time blocked in auction collection.
+- `auctionWaitPlacement`: whether that wait occurred before response headers or while
+  the document response was streaming.
+
+The SPA page-bids response includes these server timings only for an activated
+console session and a successfully dispatched auction. Failures before any provider
+dispatch do not emit timing evidence. The activation cookie is still removed before
+auction and publisher processing; the server retains only the request-scoped activation
+decision needed to gate this diagnostics field.
+
+Browser timings have different boundaries. **GAM request → response** starts at GPT's
+`slotRequested` callback and ends at `slotResponseReceived`. **GAM response → render**
+starts at `slotResponseReceived` and ends at `slotRenderEnded`. “Render” therefore
+means that GPT emitted its render-ended callback; it does not prove inner-iframe pixels
+executed or became visible.
+
+```mermaid
+flowchart TB
+    A[Server timing origin] --> B[Auction dispatched]
+    B --> C[Auction collected]
+    A -->|Mediator-only collection| C
+    C --> D[Bids committed to page state]
+    E[GPT slotRequested] --> F[GPT slotResponseReceived]
+    F --> G[GPT slotRenderEnded]
+    G --> H[GPT slotOnload / impressionViewable]
+```
+
 ## Request Paths
 
 Request-path labels describe integration paths observed immediately before one GPT
@@ -374,9 +441,19 @@ synchronous diagnostics context while delegating their own refresh, so a nested
 context even when the delegated refresh throws, and the Prebid wrapper restores the
 exact prior value. Diagnostics never suppresses or changes a GPT request.
 
+The always-served Prebid shim calls one optional completed-auction recorder hook
+with the exact Prebid instance and targeted slots. Targeting reads, `bidWon`
+subscription and bounded correlation state live in the separate diagnostics bundle.
+Without that runtime, the shim does not install diagnostics listeners or read
+candidate targeting. Runtime destruction removes its own listener when `offEvent`
+is available; otherwise its listener becomes inert and releases retained recorder
+state.
+
 For a direct observation, the optional opaque auction ID is retained only after
-trimming to a non-empty value no longer than 256 UTF-8 bytes. No auction payload,
-targeting map, bid price, markup, network body, or stack trace is exported. The
+trimming to a non-empty value no longer than 256 UTF-8 bytes. Winning bidder names are
+limited to 128 UTF-8 bytes, and numeric price-bucket strings to 64 bytes. The console
+exports only those winning-bid fields and the bounded timing object—not a raw auction
+payload, targeting map, exact unbucketed CPM, markup, network body, or stack trace. The
 reported opportunity-to-request duration is browser-observed only and is omitted for
 invalid or negative timing.
 
@@ -394,8 +471,8 @@ For the direct path, `adInit` records one opportunity:
 | `unrenderable_candidate` | Bid targeting was applied, but the current bridge lacked the complete ID/render-source combination needed to serve markup. |
 | `no_candidate`           | `adInit` explicitly observed no direct Trusted Server bid targeting for that configured slot.                              |
 
-An absent opportunity is displayed as unknown. It must not be converted into a
-negative demand-source conclusion.
+An absent opportunity is displayed as `Not observed`. It must not be converted into
+a negative demand-source conclusion.
 
 ## Trusted Server Evidence Ladder
 
@@ -415,15 +492,15 @@ that acknowledgement is outside the zero-publisher-change design.
 
 The derived `delivery` value uses these evidence-safe meanings:
 
-| Delivery state                 | Panel wording                                                                                                                                               |
-| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `trusted_server_response_sent` | Trusted Server selected; markup response sent to PUC                                                                                                        |
-| `trusted_server_selected`      | Trusted Server selected; no markup response confirmed                                                                                                       |
-| `candidate_unconfirmed`        | Trusted Server candidate unconfirmed — another GAM result or a creative/bridge failure is possible                                                          |
-| `no_candidate`                 | adInit observed no direct Trusted Server candidate for this request                                                                                         |
-| `unknown`                      | Delivery status unknown — required GPT or direct-candidate evidence was not observed                                                                        |
-| `pending`                      | Waiting for Trusted Server creative evidence                                                                                                                |
-| `not_applicable`               | No delivery conclusion is displayed before render or for an explicitly empty result, provided no Trusted Server creative evidence was stamped on the cycle. |
+| Delivery state                 | Panel wording                                                      |
+| ------------------------------ | ------------------------------------------------------------------ |
+| `trusted_server_response_sent` | Creative markup sent; execution not confirmed                      |
+| `trusted_server_selected`      | Server bid selected by the creative bridge; response not confirmed |
+| `candidate_unconfirmed`        | Server bid available; selection not confirmed                      |
+| `no_candidate`                 | No direct Trusted Server candidate                                 |
+| `unknown`                      | Delivery status unknown — required evidence was not observed       |
+| `pending`                      | Waiting for Trusted Server creative evidence                       |
+| `not_applicable`               | Delivery evidence: Not applicable                                  |
 
 For an explicit non-empty candidate, diagnostics wait five seconds from
 `slotRenderEnded` for positive creative evidence. If no matched PUC request arrives,
@@ -548,11 +625,13 @@ A concise viewport badge appears only when a slot:
 - Has a unique, connected exact binding.
 - Has a non-zero rectangle intersecting the viewport.
 
-A badge summarizes the slot's most recent request cycle: the GPT result (Filled, Empty,
-Rendered (fill unknown), or Pending), a short delivery label, a `Competing paths`
-marker when the request path is `competing`, the rendered size, and the request-to-
-response, response-to-render, and render-to-viewable durations that are available. It
-adds `Incomplete sequence` when a callback proved a missing or invalid earlier step.
+A badge starts with the slot's stable `Ad #N`, matching the side-panel heading. It then
+summarizes the most recent request cycle: the GPT result (Filled, Empty, Rendered (fill
+unknown), or Pending), auction type, a short delivery label, a `Competing paths` marker
+when the request path is `competing` and the auction type is not already `Multiple paths`,
+sizes, and the GAM request-to-response, GAM
+response-to-render, and render-to-viewable durations that are available. It adds
+`Incomplete sequence` when a callback proved a missing or invalid earlier step.
 
 Badge delivery labels are the same derived states the panel and export report, shortened
 to fit:
@@ -593,10 +672,11 @@ becomes unbound or ambiguous, the last successful sample remains as request-cycl
 evidence while the binding status reports the current DOM state. It is displayed
 separately from `size`, which remains the exact GPT-reported `slotRenderEnded.size`
 fill-size fact. The panel labels the three separate facts as requested slot sizes,
-GPT-reported fill size, and observed outer slot box; the badge abbreviates them as
-`Req`, `Fill`, and `Box`. The observed box may differ from GPT's reported size (for
-example, a flexible APS creative can report `1×1` while its allocated outer slot box
-is larger). The measurement describes publisher-page layout, not universal internal
+GPT-reported fill size, and `Size filled`; the badge abbreviates the first two as `Req`
+and `Fill` and uses `Size filled` for the observed outer box. The observed box may
+differ from GPT's reported size. A flexible APS creative, for example, can report GPT's
+uninformative `1×1` placeholder while its allocated outer slot box is larger; the UI
+suppresses that `1×1` text but the export retains the original `size: [1, 1]` evidence. The measurement describes publisher-page layout, not universal internal
 creative-pixel dimensions. A collapsed or hidden bound element can report `0×0`, which records the
 page layout state rather than an invalid measurement. Empty, unbound, missing, or
 ambiguous slots do not report an observed box; delayed measurements from an older cycle
@@ -607,14 +687,19 @@ content or altering the APS sandbox, so this field cannot prove the inner creati
 pixels.
 
 Badges and the panel live in a closed Shadow DOM. Diagnostics do not add attributes,
-classes, or inline styles to publisher slot elements.
+classes, or inline styles to publisher slot elements. Badge evidence is noninteractive
+and passes pointer input through. Only the small native `Ad #N` button is clickable.
+It is positioned outside the bound creative rectangles observed by diagnostics and
+inside the viewport. If no such position fits, the button is hidden while the panel
+remains available. The button supports normal keyboard focus and activation.
 
 ## Presentation Lifecycle
 
 - **Collapse** reduces the panel while preserving capture.
 - **Close** dismisses the presentation for the current document.
 - External removal by hydration or DOM reconciliation triggers a debounced remount.
-- Live re-renders preserve open request-history disclosures and panel scroll position.
+- Live re-renders preserve open request-history, help, and technical disclosures plus panel scroll position.
+- Selecting the latest request focuses its current details without opening history. Selecting an earlier retained request opens its history once. A later user collapse remains closed across live updates.
 - Explicit Close or `hide()` prevents remount until `show()` is called.
 - Capture continues while the panel is hidden.
 
@@ -658,8 +743,17 @@ The existing GPT-only `snapshot()` and `export()` model contains:
 - Retained slots, binding facts, visibility, and request cycles.
 - `requestedSlotSizes` when Trusted Server supplied configured formats for that exact
   request, plus GPT-reported fill `size` and an optional observed outer `observedSlotSize`.
-- Request path, request intent ID, opportunity, creative-progress timestamps, and
-  safe failure enums.
+- Request path, auction type, request intent ID, opportunity, creative-progress
+  timestamps, and safe failure enums.
+- The bounded winning bidder and bucketed price plus server auction timing fields and
+  their `navigation` or `spa_auction` origin when direct auction evidence was observed.
+- Completed client-side Prebid evidence (`prebidAuction`): Prebid's opaque `auctionId`,
+  plus bounded bidder and bucketed price fields in `targetingCandidate` and `win`,
+  when a completed attempt and any documented `bidWon` observation were correlated
+  to that exact request. Neither candidate nor win evidence proves the final served bidder.
+- Optional `currency` on server winner, Prebid candidate, and Prebid win evidence,
+  when supplied through the internal recorder. Values are normalized to three uppercase
+  ASCII letters; first-party integrations do not populate this field.
 - The per-auction diagnostics token (`trustedServerAuctionId`) and the
   opportunity-to-request duration, when a direct opportunity was observed.
 - Replacement facts for a re-rendered slot: `replacedRequestNumber`,
@@ -670,9 +764,11 @@ The existing GPT-only `snapshot()` and `export()` model contains:
 - Separate callback issues, attribution issues, coverage counters, and retention
   counters.
 
-It does not contain raw targeting, bid IDs, bid prices, bidder identity, creative
-markup, cache URLs, cache payloads, cache or bridge error details, cookies, user
-identifiers, query strings, or URL fragments. The exported `trustedServerAuctionId`
+It does not contain raw targeting, bid IDs, exact unbucketed bid prices, losing bid
+lists, creative markup, cache URLs, cache payloads, cache or bridge error details,
+cookies, user identifiers, query strings, or URL fragments. It does contain the server
+winner and the Prebid candidate and win bidder names with their bucketed `hb_pb` values
+as described above, even when the final served bidder is unconfirmed. The exported `trustedServerAuctionId`
 is the `hb_auction_id` value described in
 [Auction correlation token](#auction-correlation-token): minted fresh for each
 server-side auction, not derived from the Edge Cookie ID or any other visitor
@@ -680,6 +776,12 @@ identifier, and never repeated across auctions, so it cannot be joined back to a
 visitor. Diagnostics retain it only after trimming to a non-empty value of at most
 256 UTF-8 bytes.
 
+The exported `prebidAuction.auctionId` is supplied by Prebid for auction correlation,
+not visitor identity. Diagnostics does not generate or replace it and retains only
+non-empty values of at most 256 UTF-8 bytes. Bidder names are limited to 128 UTF-8
+bytes and numeric price bucket strings to 64 bytes. These bounds limit retained data;
+they do not establish how a publisher's Prebid configuration generated its auction ID.
+
 The GPT-only observation store remains memory-only. Its capture and `export()` do not add an upload, diagnostics
 network request, `localStorage`, `sessionStorage`, IndexedDB, or other persistence.
 `export()` creates only the user-requested local JSON download; it sends nothing to a
@@ -689,6 +791,8 @@ inaccessible to JavaScript.
 The explicit mobile handoff separately writes the bounded combined trace report
 to `sessionStorage`. Its stricter GPT projection excludes the exact pathname,
 GAM identifiers and `previousCreativeId`, as described under [Mobile Trace Page](#mobile-trace-page).
+It also excludes the GPT-only auction classification, winner, Prebid candidate and win,
+and server timing fields. Server auction trace evidence retains its separate v1 schema.
 
 ## Timing and Retention Bounds
 
@@ -706,8 +810,9 @@ GAM identifiers and `previousCreativeId`, as described under [Mobile Trace Page]
 - Retained attribution issues: 128.
 
 The least-recently-active slot is evicted when the slot bound is exceeded. An evicted
-GPT slot can re-enter retention only after a future `slotRequested`; request numbers
-remain monotonic. The oldest request cycle or issue is removed at its own bound.
+GPT slot can re-enter retention only after a future `slotRequested`; its `Ad #N` identity
+and request numbers remain stable and monotonic for the console lifetime. The oldest
+request cycle or issue is removed at its own bound.
 Export metadata reports `evictedSlots`, `evictedRequestCycles`, `droppedCallbacks`,
 and `droppedAttributionIssues`.
 
diff --git a/docs/guide/integrations/lockr.md b/docs/guide/integrations/lockr.md
index f6831545f3..dac9641289 100644
--- a/docs/guide/integrations/lockr.md
+++ b/docs/guide/integrations/lockr.md
@@ -47,6 +47,16 @@ For example, `/integrations/lockr/api/example?mode=test` forwards to `https://id
 
 ### SDK URL rewriting
 
+Server-side attribute rewriting and the browser script guard recognize only
+`aim.loc.kr` and `identity.loc.kr` URLs whose pathname contains
+`identity-lockr` and ends in `.js`, case-insensitively. Absolute HTTP(S) and
+protocol-relative URLs are supported. Other scripts on those hosts, lookalike
+hosts, and vendor names embedded in another URL's path or query are not claimed.
+
+Query strings and fragments do not prevent SDK recognition. Matching URLs use
+`/integrations/lockr/sdk`, which serves the configured `sdk_url`; the original
+query and fragment are not forwarded to upstream.
+
 With `rewrite_sdk = true`, the server rewrites matching Lockr SDK URLs in HTML to an absolute first-party URL ending in `/integrations/lockr/sdk`, using the request scheme and request host. An external `<base href>` does not redirect the rewritten SDK load to another origin.
 
 The Lockr browser module also intercepts matching dynamically inserted SDK scripts and preload or prefetch links. It rewrites them to `window.location.origin` plus `/integrations/lockr/sdk`. This interception remains active when `rewrite_sdk = false`; that setting controls server-side HTML attribute rewriting only.
@@ -59,6 +69,40 @@ The default `identity-lockr-trust-server.js` SDK uses the relative API prefix `/
 
 The guard does not intercept `fetch` or `sendBeacon`. It does not reroute arbitrary absolute third-party API URLs. It neither changes private SDK host fields nor polls for SDK initialization.
 
+## EID forwarding
+
+The Lockr SDK writes its ID5 EID into Prebid's first-party data with
+`pbjs.setConfig({ ortb2: { user: { ext: { eids } } } })`. Prebid includes it in
+the `trustedServer` bidder request, and the adapter forwards it to `/auction`
+with its EID-level fields, for example:
+
+```json
+{
+  "source": "id5-sync.com",
+  "inserter": "inserter.example.com",
+  "mm": 2,
+  "uids": [{ "id": "fictional-id5-id", "atype": 1 }]
+}
+```
+
+The SDK writes the EID after its own network call, so the first auction on a
+page may run before it is available. Later auctions include it, and requests
+without an EID body get it from the `ts-eids` cookie and KV.
+
+To store the ID in the EC identity graph, register the source:
+
+```toml
+[[ec.partners]]
+name = "ID5 via Lockr"
+source_domain = "id5-sync.com"
+bidstream_enabled = true
+```
+
+Where GDPR applies and Prebid's TCF enforcement is active, Prebid sends the
+`trustedServer` adapter no EIDs unless the publisher grants the exception
+described in
+[TCF and the `trustedServer` adapter](./prebid.md#tcf-and-the-trustedserver-adapter).
+
 ## Migration from the SDK-host shim
 
 The old SDK-host shim is no longer available. `rewrite_sdk_host` remains accepted for configuration compatibility, but has no effect.
@@ -76,3 +120,11 @@ In browser developer tools, check that the SDK loads from the page origin at `/i
 If API calls still go directly to a third-party host, inspect the actual SDK loaded. Check `sdk_url`, unreplaced static tags, and custom SDK routing rather than enabling `rewrite_sdk_host`.
 
 See the [configuration reference](/guide/configuration) for the full integration settings.
+
+### Missing EIDs in bid requests
+
+- Confirm `pbjs.getEvents()` shows a `bidRequested` event for `trustedServer`
+  whose `ortb2.user.ext.eids` contains the `id5-sync.com` entry.
+- Under GDPR, confirm the publisher's Prebid config grants `trustedServer` the
+  full TCF exception.
+- Decode the `/auction` response's `x-ts-eids` header to see what was forwarded.
diff --git a/docs/guide/integrations/permutive.md b/docs/guide/integrations/permutive.md
index e3c9258421..5ef3f947bf 100644
--- a/docs/guide/integrations/permutive.md
+++ b/docs/guide/integrations/permutive.md
@@ -35,6 +35,18 @@ rewrite_sdk = true
 - `GET/POST /integrations/permutive/sync/*` - ID synchronization
 - `GET /integrations/permutive/cdn/*` - CDN proxy
 
+## SDK URL rewriting
+
+Server-side attribute rewriting and the browser script guard recognize URLs on
+`cdn.permutive.com` or a subdomain of `edge.permutive.app` whose pathname ends in
+`-web.js`, case-insensitively. Absolute HTTP(S) and protocol-relative URLs are
+supported. The bare `edge.permutive.app` host, unrelated scripts, lookalike hosts,
+and vendor names embedded in another URL's path or query are not claimed.
+
+Query strings and fragments do not prevent SDK recognition. Matching URLs use
+`/integrations/permutive/sdk`, which serves the SDK selected by `organization_id`
+and `workspace_id`; the original query and fragment are not forwarded to upstream.
+
 ## Features
 
 - **Real-time segmentation**: Build audience cohorts in real-time
diff --git a/docs/guide/integrations/prebid.md b/docs/guide/integrations/prebid.md
index b7a05ac7be..3dfda271bd 100644
--- a/docs/guide/integrations/prebid.md
+++ b/docs/guide/integrations/prebid.md
@@ -355,8 +355,8 @@ A settled result that denies consent still seeds the managed entry; `tcfControl`
 then blocks the vendor call and the storage write, which is the enforcement path
 this integration relies on. A CMP that recovers later — the user completes its
 UI, or a delayed first response arrives — activates the managed entries at that
-point, with `userSync.autoRefresh` briefly enabled so Prebid initializes modules
-added after its first pass.
+point, with `userSync.autoRefresh` enabled so Prebid initializes modules
+added after its first pass. Because Prebid accumulates `userSync` settings, `autoRefresh` then stays enabled for the rest of the page.
 
 This scope is deliberately narrow. It applies only to the automatic TCF
 collector that Trusted Server configures for its own managed modules. A
@@ -675,9 +675,26 @@ paths.
 
 ## User ID Modules
 
-Prebid.js can expose publisher-configured User ID Module output via
-`pbjs.getUserIdsAsEids()`. The TSJS Prebid shim reads those current-request
-EIDs after auctions and forwards them to Trusted Server when they are available.
+Prebid.js places the EIDs each bidder may receive in that bidder's
+`bidderRequest.ortb2`: User ID module output, `setConfig({ortb2})` and
+`setBidderConfig` data, and RTD output, with IDs restricted to other bidders
+left out and Prebid's activity controls applied. The `trustedServer` adapter
+forwards exactly the `user.ext.eids` and `user.eids` entries in its own bidder
+request, with their `inserter`, `matcher`, `mm` and `ext`. It never reads
+`pbjs.getUserIdsAsEids()`, which also returns IDs restricted to other bidders.
+
+### Timing and `userSync`
+
+Trusted Server writes no Prebid `userSync` settings other than the managed
+`userIds` entries below (and `autoRefresh` when a late CMP answer seeds them).
+The publisher's `auctionDelay`, `syncDelay`, `syncsPerBidder` and
+`filterSettings`, or Prebid's defaults, apply from the first auction. Prebid's
+default `auctionDelay` is 500 ms: an auction waits up to that long while User
+ID modules are still resolving, and not at all once they have settled. Set
+`auctionDelay` and `filterSettings` in your own Prebid configuration if the
+defaults do not suit you. Prebid's default allows image user syncs only.
+Vendors that write `ortb2` after their own network call, such as the Lockr
+SDK, are not awaited; their IDs reach later requests.
 
 User ID submodule inclusion comes from `bundle.modules.user_id`. The available
 modules and default preset are checked in at
@@ -861,16 +878,26 @@ IdentityLink resolves asynchronously. A new browser's first auction can run
 before RampID is available; later auctions can include it without blocking the
 page or auction. When available, the opaque value follows the standard path:
 
-1. `pbjs.getUserIdsAsEids()` exposes an entry whose source is `liveramp.com`.
-2. The current `/auction` request includes that entry.
-3. Trusted Server merges and consent-gates it, then forwards it to Prebid
-   Server as `user.ext.eids`.
+1. Prebid places the `liveramp.com` entry in the `trustedServer` bidder
+   request's `ortb2.user.ext.eids`.
+2. The adapter forwards that entry in the `/auction` body and, before sending
+   the request, merges the body's EIDs from registered partners (without
+   EID-level `ext`) into the bounded `ts-eids` cookie.
+3. Trusted Server consent-gates it and forwards it to Prebid Server as
+   `user.ext.eids`.
 4. After the response, the same `/auction` request ingests the body entry into
    an EC/KV partner configured with `source_domain = "liveramp.com"`, when that
    partner UID is not already stored.
-5. The browser also persists the opaque value in the bounded `ts-eids` cookie,
-   which lets requests without an EID body, such as `GET /_ts/page-bids` and
-   page navigations, ingest it.
+5. Requests without an EID body, such as `GET /_ts/page-bids` and page
+   navigations, read and ingest the `ts-eids` cookie.
+
+Where GDPR applies and Prebid's TCF enforcement is active, Prebid sends the
+`trustedServer` adapter no bid requests unless the publisher grants it an
+exception (see [TCF and the `trustedServer` adapter](#tcf-and-the-trustedserver-adapter)),
+and the adapter clears `ts-eids`, so no browser EIDs reach Trusted Server.
+With such an exception but without TCF Purpose 1 (store/access device) and
+Purpose 4 (personalized ads) consent, the adapter still forwards the EIDs in the
+`/auction` body but clears `ts-eids` instead of writing it.
 
 Trusted Server treats the RampID envelope as an opaque string. Do not log,
 decode, publish, or dimension metrics by the value. Source names, counts,
@@ -952,17 +979,31 @@ not passed by this implementation.
 
 ## Identity Forwarding
 
-Trusted Server uses a **hybrid EID forwarding model** for Prebid-routed auctions:
-
-1. **Current-request EIDs from Prebid.js** are read from `pbjs.getUserIdsAsEids()` in the browser and sent in the `/auction` request body.
-2. **Server-side EIDs from the EC/KV identity graph** are resolved on the edge from the current EC ID.
-3. Trusted Server **merges and deduplicates** both sets before calling Prebid Server.
-4. The merged result is forwarded downstream as `user.ext.eids` in the OpenRTB request.
-5. After the response, Trusted Server adds matched partner UIDs that are missing from the EC identity graph, reading the `ts-eids` cookie, then the `/auction` request-body EIDs, then the `sharedId` cookie. Because the body carries the untrimmed EID set, `/auction` ingestion is not limited by the size-capped `ts-eids` cookie.
-
-The `ts-eids` cookie still matters for requests without an EID body, such as `GET /_ts/page-bids` and page navigations, where it is the source for both EID fallback and identity-graph ingestion. Identity-graph EID writes follow the same consent rule as bidstream forwarding: under GDPR, TCF Purpose 1 and Purpose 4 must both be consented.
-
-This means Prebid auctions get same-request transparency for browser-resolved IDs without giving up the durability of the server-managed EC identity graph.
+Trusted Server combines browser EIDs with the EC/KV identity graph:
+
+1. **Browser EIDs** are the entries Prebid placed in the `trustedServer`
+   bidder request. The adapter sends them in the `/auction` body as plain data.
+   Before the request is sent, it merges the entries of sources configured in
+   `[[ec.partners]]`, without EID-level `ext`, into the `ts-eids` cookie. A
+   request's entries replace the cookie's entries for the same source, and the
+   cookie keeps sources the request lacks. Unregistered sources never reach
+   the cookie.
+2. **Server-side EIDs** are resolved from the EC/KV identity graph for
+   partners with `bidstream_enabled = true`.
+3. Browser entries are forwarded first, exactly as sent. KV adds entries only
+   for registered sources the browser did not send.
+4. Consent gating applies to the merged set, which goes out as `user.ext.eids`
+   and is echoed in the `x-ts-eids` response header.
+5. After the response, `/auction` adds matched partner UIDs that KV does not
+   yet hold from its own client set (the body, or the cookie when the body has
+   none), then from the `sharedId` cookie. Other routes read the `ts-eids`
+   cookie instead.
+
+The server validates every browser entry on its own, whether it came in the
+body or the cookie. A malformed entry or field is dropped and the rest of the
+request proceeds. Identity-graph writes follow the same consent rule as
+bidstream forwarding: under GDPR, TCF Purpose 1 and Purpose 4 must both be
+consented.
 
 ### Identity flow
 
@@ -973,38 +1014,87 @@ sequenceDiagram
     participant K as EC + KV identity graph
     participant P as Prebid Server
 
-    B->>B: User ID modules resolve EIDs
-    B->>T: POST /auction\n(adUnits + current-request eids)
+    B->>B: Prebid builds the trustedServer bidder request (ortb2 EIDs)
+    B->>B: Copy its EIDs into ts-eids (no EID-level ext)
+    B->>T: POST /auction\n(adUnits + the bidder request's eids)
+    T->>T: Validate each entry
     T->>K: Resolve EC-backed source-domain IDs
     K-->>T: KV-derived EIDs
-    T->>T: Merge + dedupe client + KV EIDs
+    T->>T: Browser entries as sent, then KV-only sources
     T->>T: Apply consent gating
     T->>P: OpenRTB request\nuser.ext.eids = merged set
     P-->>T: OpenRTB bid response
-    T-->>B: Auction response
-    T->>K: Ingest body eids + ts-eids/sharedId cookies\n(TCF Purpose 1 + 4 under GDPR)
+    T-->>B: Auction response + x-ts-eids
+    T->>K: Ingest this request's client EIDs + sharedId cookie\n(TCF Purpose 1 + 4 under GDPR)
 ```
 
-### Merge and deduplication rules
+### Merge rules
 
-- Client-request EIDs and KV-resolved EIDs are merged by `source`
-- UIDs are deduplicated by `source + id`
-- If the same UID appears in both places, it is sent only once downstream
-- Distinct UIDs under the same source are preserved
-- Consent gating is applied to the **merged** set before forwarding
+- Browser entries are forwarded in the order Prebid sent them and are never
+  altered or combined. A source can appear in more than one entry, for example
+  `adserver.org` from two modules with different `matcher` values.
+- KV adds one entry for each registered source no browser entry carries.
+  Sources are compared case-insensitively, ignoring a trailing dot.
+- For a source the browser sends, KV's stored UID and its configured
+  `openrtb_atype` are not used.
+- Consent gating is applied to the merged set before forwarding.
 
 ### What reaches Prebid Server
 
 The downstream Prebid Server request includes:
 
 - `user.id` when EC forwarding is allowed
-- `user.ext.eids` containing the merged, deduplicated EID set
+- `user.ext.eids` with the browser entries and their `inserter`, `matcher`,
+  `mm` and `ext`, followed by KV-only sources
 - only allowlisted consent cookies in `both` and `cookies_only`; no Cookie header in `openrtb_only`
 
-In practice, this gives operators both:
+Before rolling this out, send one request with a repeated source and all four
+EID-level fields to each configured provider in staging and confirm it is
+accepted.
+
+### TCF and the `trustedServer` adapter
+
+The `trustedServer` adapter has no GVL ID. Where GDPR applies and Prebid's TCF
+enforcement is active (the publisher configures `consentManagement.gdpr`, or
+Trusted Server enables it for managed User IDs), Prebid's default rules remove
+`trustedServer` from the auction and withhold its EIDs. Trusted Server then
+receives no browser EIDs from the adapter, and the adapter clears `ts-eids`
+when Prebid reports the block.
+
+Granting `trustedServer` an exception is the publisher's decision. Use only
+the full rule:
+
+```js
+pbjs.setConfig({
+  consentManagement: {
+    gdpr: {
+      // ...the publisher's existing CMP settings...
+      rules: [
+        {
+          purpose: 'basicAds',
+          enforcePurpose: true,
+          enforceVendor: true,
+          softVendorExceptions: ['trustedServer'],
+        },
+      ],
+    },
+  },
+})
+```
+
+::: warning
+A publisher rule replaces Prebid's default rule for that purpose. A rule
+written as `{ purpose: 'basicAds', softVendorExceptions: ['trustedServer'] }`,
+without `enforcePurpose: true` and `enforceVendor: true`, switches off both
+checks for **every** bidder. Do not use `vendorExceptions`, which also skips
+the purpose check.
+:::
 
-- **same-request identity transparency** for Prebid User ID Module output, and
-- **future-request continuity** through cookie ingestion and KV-backed partner resolution.
+With the full rule, `trustedServer` still needs Purpose 2 consent and skips
+only the vendor check. A publisher that sets `eidsRequireP4Consent` must also
+add the same full rule for `personalizedAds`; without it `trustedServer` gets
+bid requests with no EIDs. The adapter then leaves `ts-eids` as it is, so it
+can hold the last IDs for up to a day.
 
 ## Endpoints
 
@@ -1069,7 +1159,7 @@ The shared OpenRTB driver builds Prebid Server requests:
 - Sets `tagid` from the slot ID
 - Adds site metadata with publisher domain, a validated publisher-owned page URL with query and fragment removed, `site.publisher` from the domain, and the browser `Referer` as `site.ref`. Removing query and fragment data from `site.page` can reduce contextual targeting or per-page reporting for sites whose page identity depends on query parameters
 - Injects EC ID in the user object
-- Merges current-request browser EIDs with KV-resolved EIDs and forwards the deduplicated result as `user.ext.eids`
+- Forwards the browser EIDs as sent, followed by KV-resolved EIDs for registered sources the browser did not send, as `user.ext.eids`
 - Forwards user consent string and sets the GDPR flag based on geo and consent presence
 - Translates the `Sec-GPC` header to a US Privacy string (`us_privacy`)
 - Extracts `DNT` and `Accept-Language` headers into device fields
diff --git a/docs/guide/telemetry.md b/docs/guide/telemetry.md
index a4ad08b93a..d7ae4aa344 100644
--- a/docs/guide/telemetry.md
+++ b/docs/guide/telemetry.md
@@ -1,10 +1,13 @@
-# Auction Telemetry
+# Auction and access telemetry
 
-Trusted Server can emit bounded auction observations directly to Tinybird.
-Emission is currently wired only by the Fastly adapter. Other adapters use the
-core no-op sink even if they can parse the shared settings.
+Trusted Server can emit bounded auction observations and sampled request-timing
+rows directly to Tinybird. Both sinks are opt-in and currently wired only by the
+Fastly adapter. Axum can emit the `Server-Timing` response header, but not Tinybird
+rows. Cloudflare and Spin collect timings for GPT diagnostics only; their
+`server_timing_enabled` and `tinybird.access_enabled` settings have no effect on
+header or access-row emission.
 
-## Data path
+## Auction data path
 
 The request entry point derives coarse `DeviceSignals`. Auction execution
 combines those signals with request and navigation facts in an
@@ -19,7 +22,7 @@ after dispatch; it does not wait for Tinybird's response. Each batch is limited
 to 512 rows and `tinybird.max_body_bytes` bytes. The Fastly backend uses
 two-second first-byte and between-byte timeouts.
 
-## Privacy boundary
+## Auction privacy boundary
 
 Telemetry records operational auction facts, not the EC identifier. The event
 model includes coarse device classification, auction source and outcome,
@@ -33,19 +36,133 @@ clients produce no value. Edge, Opera, and iOS-specific tokens are matched
 before generic Chrome or Safari tokens so embedded UA tokens do not
 misclassify them.
 
-## Configuration
+## Access data path
 
-Set `tinybird.enabled = true`, provide the regional API host, select the
-auction datasource, and set `auction_token_secret` to the key holding that
-datasource's APPEND token in the default app-config secret store. The default
-datasource is `auction_events_raw`; the default body limit is 1 MiB and the
-minimum accepted limit is 1 KiB.
+Fastly attaches one request clock, records phases, and stamps the headers-ready
+boundary after applying terminal response effects. Access sampling is uniform per
+response: one random draw is made before constructing the snapshot, using the
+configured `access_sample_rate`. Each selected response emits one row after its
+buffered response has been handed to the client transport or its stream has been
+finished. The row stores the same sample rate; joins to auction rows therefore
+represent only the sampled access population.
 
-`tinybird.access_enabled = true` is rejected because no access-log emitter is
-wired. `access_dataset` and `access_sample_rate` are reserved.
-`access_token_secret` is deprecated input and is normalized away; it cannot
-enable access telemetry.
+```mermaid
+flowchart TB
+    A[Request clock and recorded phases] --> B[Terminal response effects]
+    B --> C[Headers-ready boundary and sampling]
+    C --> D[Capture selected response dimensions]
+    D --> E[Send or finish client response]
+    E --> F[Dispatch one access row]
+    F --> G[Fastly host continues ingest after callback return]
+```
+
+Auction-wait duration measures the actual collection interval after a provider or
+mediator request started. `/auction` and `/_ts/page-bids` record this interval with
+`pre_header` placement. Publisher HTML records `pre_header` or `in_stream` according
+to where collection runs. A measured wait under one millisecond is `0`, with its
+placement retained. Empty plans, routing-only or immediate outcomes with no network
+work, and failures before collection leave wait timing null with `none` placement.
+
+`auction_dispatched_ms` records provider dispatch only. Mediator-only collection
+can therefore have a wait, `auction_collected_ms` and commit offset while provider
+dispatch is null. A configured mediator alone is not launch evidence; a pending
+request or explicit started-request error is required. Instrumentation does not
+start new mediator requests on paths that otherwise return without dispatch.
+Page-bids browser diagnostics use the same measured wait, not R minus D. Browser
+wire fields retain the name `auctionResolvedMs`; the persisted access column is
+`auction_collected_ms` to describe the collection-return point accurately.
+
+Emission is best effort. Serialization, body-size, backend-registration and request
+start failures are logged without changing the delivered response. Like the auction
+sink, access telemetry starts `send_async` and drops the pending handle. Fastly's
+host continues transmission after the callback returns, so a reusable sandbox does
+not wait for the ingest reply. Dispatch preparation still costs work. Ingest is not
+included in `request_elapsed_ms`.
+
+Successful dispatch is not confirmed ingestion. Later transport/TLS failures,
+non-2xx responses and quarantined rows are unobserved by the emitter; there is no
+retry or durability guarantee. Check workspace ingestion and quarantine during
+rollout. The SDK lifetime contract was exercised with delayed local Viceroy backends,
+including sandbox reuse, not a production Tinybird deployment.
+
+## Access privacy boundary
+
+The new `access_logs_v2` datasource has a configured 30-day TTL. Its 31 columns
+contain:
+
+- Event timestamp, normalized HTTP method, response status, and sampling rate.
+- Fastly service ID, publisher domain, deployment environment, POP, country, and
+  `ts_version`, which matches the Trusted Server build identifier in `x-ts-version`.
+  It uses the build-pipeline override, exact Git tag, branch name, then six-character
+  commit SHA, in that order; absent metadata is `unknown`. It is not the numeric
+  Fastly activation version from `x-ts-fastly-version`. A branch name is not an
+  immutable source fingerprint.
+- Coarse route class and bounded route template, body mode, and template-cache
+  state. Publisher paths collapse to `/`, `/other/*`, or an operator-allowlisted
+  section such as `/news/*`; named routes retain parameter placeholders. Asset
+  routes report `<configured prefix>/*`; responses without route metadata report
+  `unknown`.
+- App-build, filter, geo, KV, origin, template-cache, auction-wait, and stream
+  durations, plus headers-ready and request-completion offsets and response bytes
+  accepted by the transport. When origin dispatch overlaps other work, `origin_ms`
+  measures only the remaining origin wait after overlap, not full origin latency.
+  A template-cache hit skips the origin span. Unrecorded timings are null.
+- `delivery_result` is `complete`, `partial`, or `error`. It describes local body
+  handoff to the transport, not confirmed client receipt. `partial` means bytes
+  were accepted before a drive error, or transport finish failed; `error` means a
+  drive failed before any body byte was accepted. A status of 200 can accompany
+  either failure result.
+- Auction wait placement, dispatch/collection/commit offsets, and a random auction
+  UUID. The UUID joins to `auction_events_raw.auction_id`, where coarse device
+  class and browser family can also be present. Disabled auctions have no access
+  UUID; active consent-denied observations retain their join key without launch
+  milestones.
+
+`appbuild_ms` measures Fastly per-request setup, including config-store opening and,
+on cold requests, application construction. A warm sample can be non-null; this is
+not a cold-start flag. Axum builds its state at startup and records no per-request
+app-build phase. Adapter entry points start their clocks at different boundaries,
+so compare timings within one adapter rather than treating their T0 values as equal.
+
+Access rows contain no raw path, query string, IP address, User-Agent, cookie,
+EC ID, or creative content. Configuring a route section preserves that operator
+value, so allowlist only content categories, not usernames or other identifiers.
+The legacy `access_logs_raw` dataset is preserved separately, without backfilling
+its raw paths into the new privacy-bounded dataset.
+
+## Configuration and rollout
+
+Both sinks require `tinybird.enabled = true` and the regional API host.
+`auction_enabled` defaults to true for existing configurations. Set it to false
+for access-only telemetry. The auction sink defaults to `auction_events_raw` and
+requires that datasource's APPEND token key in `auction_token_secret`.
+
+To enable access telemetry, deploy `access_logs_v2` first, create its
+`ts_access_v2_ingest` APPEND token, and store the token value in the platform's
+default app-config secret store. Set `access_enabled = true`,
+`access_dataset = "access_logs_v2"`, `access_token_secret` to the stored key name,
+and a positive `access_sample_rate`, such as `0.05`. Token values are resolved
+when runtime settings load; only key names belong in config. Existing configs
+that explicitly name `access_logs_raw` must change their dataset and token before
+enabling this sink. Validation rejects exactly the normalized `access_logs_raw`
+name when access is enabled. Custom dataset names remain allowed, and disabled
+legacy configurations remain accepted. The default body limit is 1 MiB and the
+minimum accepted limit is 1 KiB; an individual row exceeding the configured limit
+is dropped.
+
+Deploy the datasource before the emitting binary, then push the opt-in config
+only after every serving binary understands it. Check ingestion freshness and
+workspace quarantine before switching dashboards to the new datasource. Remote
+deployment checks are required; source/schema alignment alone does not validate
+a workspace cutover.
+
+Before rolling back to a pre-observability binary, disable access telemetry,
+remove the non-default `[observability]` table, and re-push compatible config. An
+access-only deployment must also disable the Tinybird master switch. Keep both
+datasources during rollback; do not drop or recreate the legacy dataset or redeploy
+an older Tinybird project that omits `access_logs_v2`.
 
 The exact settings and secret-handling dispositions are in
-[Configuration](/guide/configuration#tinybird). The tracked Tinybird project is
-described in [`tinybird/README.md`](https://github.com/IABTechLab/trusted-server/blob/main/tinybird/README.md).
+[Configuration](/guide/configuration#tinybird). Token provisioning and the
+versioned cutover are described in
+[`tinybird/README.md`](https://github.com/IABTechLab/trusted-server/blob/main/tinybird/README.md).
diff --git a/docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md b/docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
new file mode 100644
index 0000000000..ce7294a855
--- /dev/null
+++ b/docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
@@ -0,0 +1,235 @@
+# Prebid EID Fidelity Implementation Notes
+
+Red log for the tests this work adds or changes (spec 7.1 rule 1, A12). Each
+entry names the test, the command, and the failure seen before the change, or,
+for a regression net, the line temporarily reverted and the failure it caused.
+
+## Environment
+
+- Date: 2026-10-19
+- Branch: `feat/1246-prebid-eid-fidelity`
+- Rust: rustc 1.95.0 (59807616e 2026-04-14)
+- Node: v24.12.0
+
+## Task 1: `Eid` carries OpenRTB 2.6 EID-level fields
+
+Command:
+
+```bash
+cargo test-fastly --no-run 2>&1 | grep -E "^error" | sort | uniq -c
+```
+
+Failures (the new tests and helpers do not compile against the unchanged `Eid`):
+
+- `eid_serializes_openrtb_provenance_fields_when_present`, `eid_deserializes_provenance_fields_and_keeps_rejecting_unknown_keys`, `eid_header_carries_provenance_fields_and_repeated_sources`, `to_openrtb_forwards_eid_provenance_fields_and_repeated_sources`, `aps_request_forwards_eid_provenance_fields_and_repeated_sources`, `standard_profile_forwards_eid_provenance_fields_and_repeated_sources`: `error[E0560]: struct 'openrtb::Eid' has no field named 'inserter'` (also `matcher`, `mm`, `ext`; 4 each)
+- `eid_without_provenance_fields_serializes_as_before`: `error[E0599]: no function or associated item named 'new' found for struct 'openrtb::Eid'`
+- `eid_deserializes_provenance_fields_and_keeps_rejecting_unknown_keys`: `error[E0369]: binary operation '==' cannot be applied to type 'openrtb::Eid'`
+
+## Task 2: One parser for browser EIDs
+
+Command (each test run alone, because a failed assertion aborts the wasm test binary):
+
+```bash
+cargo test-fastly -- ec::client_eids::tests::<name> --exact
+```
+
+Failures (the stub `parse_client_eids` returns no entries, so each assertion on the parsed output fails and the Viceroy run aborts on the panic):
+
+- `keeps_a_valid_entry_with_every_field`, `drops_only_the_entry_that_does_not_parse`, `drops_entries_that_are_not_objects`, `validates_source`, `drops_an_entry_without_a_valid_uid`, `validates_uid_ids`, `keeps_the_first_32_valid_uids`, `reads_atype_and_mm_as_integers_in_range`, `validates_ext_objects_and_their_size`, `validates_inserter_and_matcher`, `drops_duplicates_before_the_entry_cap`, `keeps_the_first_64_entries`, `keeps_order_and_repeated_sources_and_ignores_unknown_keys`, `logs_dropped_entries_and_fields_by_name_and_source_without_values`: `assert_eq!` or `assert!` on the empty stub output panics (wasm abort)
+- `yields_nothing_for_a_payload_that_is_not_an_array`: passes against the stub, as expected (regression net)
+
+## Task 3: Body and cookie go through the shared parser
+
+Command (each test run alone, because a failed assertion aborts the wasm test binary):
+
+```bash
+cargo test-fastly -- <module path>::<name> --exact
+```
+
+Failures (against the unchanged body and cookie readers):
+
+- `tsjs_auction_body_fixture_drops_only_the_unparsable_entry` (body rejected, provider saw `None`), `tsjs_cookie_fixture_drops_only_the_unparsable_entry` (cookie rejected, provider saw `Some(Null)`), `auction_body_eid_level_fields_reach_the_auction_request` (EID-level fields dropped): wasm abort on assertion. Moved to Task 4: they also depend on the merge rewrite; the old merge drops EID-level fields.
+- `structured_cookie_keeps_eid_level_fields`, `structured_cookie_drops_a_mistyped_field_instead_of_the_whole_cookie`, `structured_cookie_isolates_an_unparsable_entry`, `structured_cookie_applies_the_entry_cap`: assertion panic (wasm abort)
+- `structured_cookie_diagnostics_report_raw_uid_strings`: also FAILS on unchanged code (the strict cookie parser keeps the 513-byte UID), so it is a red-first test, not a regression net; no revert proof needed
+- `auction_uses_the_cookie_when_no_body_entry_is_valid`: passes against unchanged code (regression net)
+- Revert proof: with `.filter(|eids| !eids.is_empty())` removed from `resolve_client_auction_eids`, `auction_uses_the_cookie_when_no_body_entry_is_valid` FAILS (`left: Some(Null)`); line restored
+
+## Task 4: Forward browser entries as sent; KV fills absent sources
+
+Command (each test run alone, because a failed assertion aborts the wasm test binary):
+
+```bash
+cargo test-fastly -- <module path>::<name> --exact
+```
+
+Failures (against the old merge):
+
+- `merge_case_1_forwards_a_browser_entry_with_its_fields`, `merge_case_2_keeps_the_browser_atype_for_a_shared_uid`, `merge_case_3_drops_the_stale_kv_uid_for_a_browser_source`, `merge_case_4_appends_kv_sources_the_browser_did_not_send`, `merge_case_5_keeps_same_source_entries_with_different_fields_apart`, `merge_case_6_matches_sources_as_the_registry_normalizes_them`, `merge_auction_eids_does_not_union_kv_uids_into_a_browser_source`, `merge_auction_eids_keeps_browser_metadata_on_conflict`, `publisher::tests::body_less_auction_eids_put_cookie_entries_first_and_kv_only_sources_after`: assertion panic (wasm abort); the old merge drops EID-level fields, puts KV first, unions UIDs and lets KV's atype and ext win
+- `tsjs_auction_body_fixture_drops_only_the_unparsable_entry`, `tsjs_cookie_fixture_drops_only_the_unparsable_entry`, `auction_body_eid_level_fields_reach_the_auction_request` (deferred from Task 3): assertion panic (wasm abort); the old merge rebuilds entries without EID-level fields
+- `merge_case_7_forwards_kv_entries_when_the_browser_sent_none`, `merge_drops_entries_without_uids`, `merge_auction_eids_deduplicates_client_and_resolved_ids`: pass against the old merge (regression nets)
+- Revert proof: with `merged.push(eid);` replaced by `let _ = eid;`, `merge_case_7_forwards_kv_entries_when_the_browser_sent_none` FAILS (wasm abort); line restored
+- Revert proof: with `.filter(|eid| !eid.uids.is_empty())` removed from the browser branch, `merge_drops_entries_without_uids` FAILS (wasm abort); line restored
+
+## Task 5: KV ingestion on /auction reads only the auction's own client set
+
+Command (each test run alone, because a failed assertion aborts the wasm test binary):
+
+```bash
+cargo test-fastly -- <module path>::<name> --exact
+```
+
+Failures (against the old ingestion, which always read the cookie first):
+
+- `auction::endpoints::tests::auction_ingests_its_body_eids_and_not_a_cookie_only_source`: KV held `body.example.com` and also `cookie-only.example.com`
+- `auction::endpoints::tests::disabled_auction_ingests_nothing_from_the_cookie_but_keeps_shared_id`: KV held `cookie-only.example.com` next to `sharedid.org`
+- `navigation_ingests_the_cookie_only_source`, `finalize_generated_ec_without_sync_source_ingests_the_ts_eids_cookie`, the edited `finalize_recovers_orphaned_ec_when_purpose_four_denial_empties_updates` and `auction_route_carries_the_raw_ts_eids_cookie_to_finalization` pass against the old code (regression nets)
+- Revert proof: with `browser_eid_input`'s fallback arm changed to `_ => (None, ec_context.client_eids()),`, `navigation_ingests_the_cookie_only_source`, `finalize_generated_ec_without_sync_source_ingests_the_ts_eids_cookie` and `finalize_recovers_orphaned_ec_when_purpose_four_denial_empties_updates` each FAIL (wasm abort); arm restored
+- Revert proof: with the Fastly adapter's `let eids_cookie = crate::extract_cookie_value(req, COOKIE_TS_EIDS);` replaced by `let eids_cookie: Option<String> = None;`, `auction_route_carries_the_raw_ts_eids_cookie_to_finalization` FAILS (wasm abort); line restored
+
+## Task 6: Pure EID collector and cookie value builder
+
+Command (against a stub `eids.ts` whose functions return `undefined` and an empty cookie):
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/integrations/prebid/eids.test.ts
+```
+
+Result: 22 failed, 9 passed (31 tests). The 9 passes are the four `returns undefined for …` cases, the four `… not an object` cases and `does not modify the entries it is given`, which the stub passes trivially.
+
+Failures:
+
+- `collectBidderEids` tests (`reads ortb2.user.ext.eids`, `reads ortb2.user.eids, …`, `reads user.ext.eids before user.eids`, `returns plain-data copies without undefined fields`, `drops an entry whose serialization throws …`, `keeps a set that fits the UTF-8 budget exactly`, `drops the entry that crosses the budget …`, `measures the budget in UTF-8 bytes …`, `keeps order and repeated sources`, `forwards a lone surrogate unchanged …`, `passes the Prebid module shapes from spec 3.5 …`): `expected undefined to deeply equal [...]`
+- `fitEidCookie` tests (`removes EID-level ext and drops the duplicates …`, `trims UIDs from the last source …`, `reports a source trimmed and then dropped only as dropped`, both `removes a last entry that is … whole` cases, `removes a null last entry whole …`, `encodes non-Latin-1 text as UTF-8 base64 …`): `should produce a cookie value: expected undefined to be defined`
+- `fitEidCookie > drops whole tail sources until the cookie fits`: `TypeError: Cannot read properties of undefined (reading 'length')`
+- `fitEidCookie > returns no value when nothing fits`: `droppedSources` is `[]` instead of `['huge.example.com']`
+- `fitEidCookie > matches btoa output for ASCII payloads`, `fitEidCookie > produces exactly the ts-eids-cookie fixture for the fixture input`: `expected undefined to be '<base64>'`
+
+## Task 7: Adapter forwards the bidder request's EIDs and owns ts-eids
+
+Command (canary, helpers and new tests installed; adapter unchanged):
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/integrations/prebid/index.test.ts test/core/request.test.ts
+```
+
+Result: 175 failed, 132 passed. Besides the new tests, about 160 existing tests that build a `trustedServer` request or run `bidsBackHandler` fail in the shared `afterEach`, because the old collector forwards the `canary.example.com` EID from `getUserIdsAsEids()` (`the getUserIdsAsEids canary leaked into an /auction body`) or writes it to `ts-eids`.
+
+Failures:
+
+- `forwards an opaque LiveRamp envelope from the bidder request unchanged`: `expected [ { …(2) } ] to deeply equal [ { source: 'liveramp.com', …(1) } ]` (the canary arrives instead)
+- `forwards bidderRequest.ortb2 EIDs with EID-level fields, user.ext.eids first`: `should forward both paths as sent: expected [ { …(2) } ] to deeply equal [ …(2) ]`
+- `sends exactly the auction-body fixture for the fixture input`: `TSJS should produce the Rust fixture byte for byte`
+- `writes exactly the ts-eids fixture for the fixture input`: `expected undefined to be 'W3sic291cmNl…'`
+- `writes ts-eids from the body set without EID-level ext`: `the body keeps EID-level ext: expected [ { …(2) } ] to deeply equal [ { …(3) }, { …(2) } ]`
+- `clears ts-eids before the request when the bidder request holds no EIDs`: `the body should carry no eids: expected [ { …(2) } ] to be undefined`
+- `sends no eids and leaves ts-eids alone without a bidder request object`: `expected [ { …(2) } ] to be undefined`
+- `lets the later of two overlapping requests own ts-eids`: `expected undefined to deeply equal [ { …(2) } ]`
+- `forwards ortb2 EIDs and writes ts-eids without the User ID module`: `expected undefined to deeply equal [ { source: 'id5-sync.com', …(3) } ]`
+- `logs EID counts and the cookie decision at debug level, never values`: `expected "debug" to be called with arguments: [ …(2) ]`
+- `keeps the trim log when the cookie had to drop sources`: `the body keeps every entry: expected [ { …(2) } ] to deeply equal [ …(7) ]`
+- `clears ts-eids when tcf2Enforcement lists trustedServer in biddersBlocked` and `… in eidsBlocked`, and `leaves ts-eids alone when tcf2Enforcement lists only other bidders`: `the shim should listen for tcf2Enforcement: expected undefined to be defined`
+- `leaves ts-eids alone when an auction builds no trustedServer request`: `only buildRequests may write or clear the cookie: expected 'W3sic291cmNl…' to be 'preset-value'`
+- `exposes the getUserIdsAsEids canary on the pbjs the shim uses` and `sends no eids in the /auction body`: PASS (positive control and net)
+- Net proof: with `src/core/request.ts:45` changed to pass `{ eids: [{ source: 'net.example.com', … }] }` to `buildAdRequest`, `sends no eids in the /auction body` FAILS (`requestAds should leave EIDs to the ts-eids cookie: expected { adUnits: […], …(2) } to not have property "eids"`); line restored
+
+## Task 8: Stop writing Prebid userSync settings
+
+Command (new self-init tests added; `installUserIdModules` still present):
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/integrations/prebid/index.test.ts -t "writes no userSync|preserves publisher userSync"
+```
+
+Result: 2 failed, 2 passed. The file-level `afterAll` canary also reports `the canary should have inspected at least one /auction body: expected 0 to be greater than 0`. This comes from the `-t` filter selecting no `/auction` test, not from this change, and a full run satisfies it.
+
+Failures:
+
+- `prebid self-init writes no Prebid userSync settings > writes no userSync when the bundle loads after window load`: `TS should leave userSync to the publisher and Prebid: expected [ [ { userSync: { …(6) } } ], …(1) ] to deeply equal []` (the `auctionDelay: 0`, `syncDelay: 3000`, `filterSettings.all` write)
+- `prebid self-init writes no Prebid userSync settings > writes no userSync when window load fires after install`: same assertion, same write after the `load` event
+- `preserves publisher userSync and autoRefresh=%s when seeding late IDs` (both `false` and `true`): PASS with the extended `syncDelay` and `filterSettings` fields. This is the seeding net; its proof follows in Task 8's green run.
+
+Net proof (seeding path): with `src/integrations/prebid/index.ts` line 2181 changed from `...(isRecord(effectiveUserSync) ? effectiveUserSync : {}),` to `...{},`, `-t "preserves publisher userSync"` FAILS on both cases: `preserves publisher userSync and autoRefresh=false when seeding late IDs` and `… autoRefresh=true …`, with `expected { userIds: [ { …(3) } ], …(1) } to deeply equal { userIds: [ { …(3) } ], …(5) }`. Line restored; the full file then passes 294 of 294.
+
+## Task 9: Real Prebid.js arms for D1, D3, D4 and TCF
+
+Command (the shim built from `main`'s sources: `src/integrations/prebid/index.ts` and `src/core/auction.ts` checked out from the merge base `a9037770a` for one run, then restored with `git checkout --`; `git status --short crates/trusted-server-js/lib/src` was clean afterwards):
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/prebid-eid-fidelity.test.mjs
+```
+
+Result: 5 failed, 1 passed (6 tests). Each failure is the one spec 7.5 predicts.
+
+Failures:
+
+- `D1: never forwards an ID restricted to another bidder`: `the /auction body should carry the control and not the restricted ID: expected [ [ { source: 'pubcid.org', …(1) } ] ] to deeply equal [ [ { …(2) } ] ]` (the precondition passed: sharedId produced `pubcid.org` from the preset `_sharedid` cookie)
+- `D3: forwards same-source entries separately with their own EID-level fields`: `expected [ undefined ] to deeply equal [ [ { …(5) }, { …(5) } ] ]` (`main` never reads `ortb2`)
+- `D4: the first auction after window.load waits for a pending User ID module`: `Prebid's default auctionDelay should apply: expected +0 to be 500`
+- `TCF: without an exception no client EIDs reach TS and ts-eids is cleared`: `ts-eids should be cleared: expected [ { source: 'liveramp.com', …(1) } ] to be undefined` (the positive control and the no-`/auction` check passed; `main`'s `bidsBackHandler` rewrote the cookie)
+- `TCF: with the full basicAds rule TS gets its EIDs and other bidders stay blocked`: `expected [ Array(1) ] to deeply equal [ [ { …(2) }, { …(2) } ] ]` (the body carried `liveramp.com` only)
+- `D4 control: the first auction before window.load waits, on every build`: PASS, as intended
+
+D4 mechanism probe: a temporary copy of the suite without the `auctionDelay` assertion, run with `-t "D4"` against the same `main` sources, still fails the D4 arm at the body: `the first /auction should carry the delayed unifiedId: expected [ undefined ] to deeply equal [ Array(1) ]`. So on `main` the first auction after `window.load` goes out without `adserver.org`, not merely with a different setting. The copy was deleted and the sources restored.
+
+## Task 10: Delete the dead EID-to-module resolver
+
+Command:
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/integrations/prebid/user_id_modules.test.ts -t "no EID source metadata"
+```
+
+Failures:
+
+- `carries no EID source metadata`: `no entry should keep eidSources: expected [ 'connectIdSystem', …(10) ] to deeply equal []` (11 modules still carry `eidSources`)
+
+Green: after deleting `eidSources` and the resolver, `carries no EID source metadata` passes. The three targeted suites (`user_id_modules.test.ts`, `prebid-user-id-registry.test.mjs`, `build-prebid-external.test.mjs`) pass 81 of 81. `./scripts/test-cli.sh` exits 0. The full Vitest run under Node 24.12.0 passes 1249 of 1249 across 52 files.
+
+## Final review fixes
+
+### Fix 1: nothing fits clears the cookie (regression net)
+
+Revert proof: temporarily deleted the `clearPrebidEidsCookie();` call inside the `fitted.value === undefined` branch of `writePrebidEidsCookie`, then restored it.
+
+Command:
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/integrations/prebid/index.test.ts -t "no EID fits"
+```
+
+Failures:
+
+- `clears ts-eids when no EID fits the cookie budget but still sends the body`: `the cookie should be cleared: expected 'preset-value' to be undefined`
+
+Green: with the call restored, the test passes.
+
+### Fix 2: cookie writes must not throw out of buildRequests
+
+Command (against the unguarded `clearPrebidEidsCookie`):
+
+```bash
+cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run test/integrations/prebid/index.test.ts -t "document.cookie writes throw"
+```
+
+Failures:
+
+- `still builds the request with the entry when the cookie write fails`: `Error: cookies blocked` thrown from `clearPrebidEidsCookie` through `buildRequests`
+- `still builds the request without eids when the cookie clear fails`: `Error: cookies blocked` thrown from `clearPrebidEidsCookie` through `buildRequests`
+
+Green: with the `try`/`catch` guard both pass; full Vitest passes 1252 of 1252.
+
+### Fix 3: non-array cookie JSON is a parse error
+
+Command (against the unchanged decoder):
+
+```bash
+cargo test-fastly -- parse_prebid_eids_cookie_rejects_non_array_json
+cargo test-fastly -- eids_lookup_reports_non_array
+```
+
+Failures:
+
+- `parse_prebid_eids_cookie_rejects_non_array_json`: test trapped, the `{"a":1}` cookie parsed as `Ok`
+- `eids_lookup_reports_non_array_cookie_as_parse_error`: test trapped, no `parse_error` reported
+
+Green: with the array check both pass.
diff --git a/docs/superpowers/plans/2026-08-24-request-phase-timing.md b/docs/superpowers/plans/2026-08-24-request-phase-timing.md
new file mode 100644
index 0000000000..2537801457
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-24-request-phase-timing.md
@@ -0,0 +1,1044 @@
+# Request Phase Timing Implementation Plan
+
+> PR #1261 contract update: access v2 has 31 columns, including `delivery_result`
+> and `auction_collected_ms`. `ts_version` is the compiled TS build identifier.
+> Access ingestion is best-effort dispatch/drop, not a confirmed-ingest wait.
+> The guide/spec and current tests define these contracts; historical unchecked
+> steps do not prove deployment or committed-pin validation.
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Every application response attributes its own server time by phase via a
+Server-Timing header and a sampled Tinybird access-telemetry row.
+
+**Architecture:** A core `RequestTimings` handle (Arc-shared, infallible recording)
+collects phase spans always-on; the Fastly adapter freezes and emits at
+`send_edgezero_response` immediately before `into_parts()`; a post-send emitter ships
+one NDJSON row to the Tinybird Events API with a bounded, 2xx-validated await.
+
+**Tech Stack:** Rust 2024, `edgezero` HTTP types, Fastly Compute (wasm32-wasip1,
+Viceroy tests), Axum (native tests), Tinybird Events API.
+
+**Spec:** `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md`: the
+plan argues from the spec; executors read both. Spec section numbers are cited per
+task.
+
+## Global Constraints
+
+- Errors use `error-stack` (`Report<TrustedServerError>`); errors defined with
+  `derive_more::Display`; never thiserror, never anyhow (except the Spin entry point).
+- No `unwrap()` in production code; `expect("should ...")` only. Assertion messages
+  `"should ..."`. Tests use Arrange-Act-Assert.
+- No inline comments; comments on their own line above the code.
+- Functions never exceed 7 arguments; use a struct instead (this bit
+  `ec_finalize_response` in review; the timings handle travels inside existing state).
+- No local imports inside functions; `use super::*` only in `#[cfg(test)]`.
+- Only example/fictional data in tests and docs (`example.com` domains).
+- Recording is infallible: saturating math, lock failure drops the sample, no panics
+  (spec 5, 13).
+- Vendor identity never appears in emitted surfaces: the filter span is `ts-filter`
+  (spec 3).
+- Test commands: `cargo test-axum` (native, fast inner loop), `cargo test-fastly`
+  (Viceroy) for adapter tasks. Before PR handoff: the full CI gate list in
+  `CLAUDE.md`.
+- Commit style: sentence case, imperative, no prefixes, no trailers.
+
+## File Structure
+
+| File                                                              | Responsibility                                                                                     |
+| ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
+| `crates/trusted-server-core/src/request_timing.rs` (new)          | `Phase`, `AuctionWaitPlacement`, `RequestTimings`, `PhaseSpan`, `TimingSnapshot`, header rendering |
+| `crates/trusted-server-core/src/access_telemetry.rs` (new)        | `RouteClass`, `publisher_route_template`, `AccessTelemetrySnapshot`, `AccessEventRow` NDJSON       |
+| `crates/trusted-server-core/src/geo.rs` (modify)                  | `GeoLookupState` response-extension type                                                           |
+| `crates/trusted-server-core/src/settings.rs` (modify)             | `ObservabilitySettings`, tinybird flag decoupling, access validation                               |
+| `crates/trusted-server-core/src/publisher.rs` (modify)            | `ts-origin`, `ts-template-cache`, auction-wait spans                                               |
+| `crates/trusted-server-core/src/ec/kv.rs` (modify)                | `ts-kv` at the graph abstraction                                                                   |
+| `crates/trusted-server-adapter-fastly/src/main.rs` (modify)       | T0, appbuild span, freeze point, `DeliveryOutcome`, post-send emission ordering                    |
+| `crates/trusted-server-adapter-fastly/src/app.rs` (modify)        | filter span, geo span + `GeoLookupState` attach, route class assignment                            |
+| `crates/trusted-server-adapter-fastly/src/middleware.rs` (modify) | finalize consumes `GeoLookupState`                                                                 |
+| `crates/trusted-server-adapter-fastly/src/tinybird.rs` (modify)   | best-effort post-send access dispatch                                                              |
+| `crates/trusted-server-adapter-axum/src/` (modify)                | terminal freeze layer, header emission                                                             |
+| `tinybird/datasources/access_logs_v2.datasource` (create)         | versioned phase-column schema; preserve the legacy reserved datasource                             |
+| `trusted-server.example.toml` (modify)                            | `[observability]`, tinybird keys                                                                   |
+
+Out of scope for this plan: the Grafana dashboard JSON (separate telemetry repo,
+spec 11) and Cloudflare/Spin emission wiring (spec non-goal).
+
+---
+
+### Task 1: Core `RequestTimings`
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/request_timing.rs`
+- Modify: `crates/trusted-server-core/src/lib.rs` (add `pub mod request_timing;`)
+- Test: same file, `#[cfg(test)]`
+
+**Interfaces:**
+
+- Consumes: nothing (leaf module; `std::time`, `std::sync`).
+- Produces (later tasks rely on these exact names):
+  - `pub enum Phase { AppBuild, Filter, Geo, EcKv, Origin, TemplateCacheLookup, AuctionWait, Stream }`
+  - `pub enum AuctionWaitPlacement { PreHeader, InStream }`
+  - `#[derive(Clone)] pub struct RequestTimings` with:
+    - `pub fn new() -> Self`
+    - `pub fn record(&self, phase: Phase, dur: Duration)` (saturating accumulate)
+    - `pub fn record_auction_wait(&self, placement: AuctionWaitPlacement, dur: Duration)`
+    - `pub fn span(&self, phase: Phase) -> PhaseSpan` (records on drop)
+    - `pub fn mark_headers_ready(&self)` (first call wins)
+    - `pub fn mark_request_elapsed(&self)` (first call wins)
+    - `pub fn set_resp_bytes(&self, bytes: u64)`
+    - `pub fn server_timing_value(&self) -> Option<String>`
+    - `pub fn snapshot(&self) -> TimingSnapshot`
+  - `pub struct TimingSnapshot { pub time_elapsed_ms: Option<u32>, pub request_elapsed_ms: Option<u32>, pub appbuild_ms: Option<u32>, pub filter_ms: Option<u32>, pub geo_ms: Option<u32>, pub kv_ms: Option<u32>, pub origin_ms: Option<u32>, pub template_cache_ms: Option<u32>, pub auction_wait_ms: Option<u32>, pub stream_ms: Option<u32>, pub auction_wait_placement: Option<AuctionWaitPlacement>, pub resp_bytes: Option<u64> }`
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn render_omits_unrecorded_phases_and_orders_total_first() {
+        let timings = RequestTimings::new();
+        timings.record(Phase::Filter, Duration::from_micros(9_100));
+        timings.mark_headers_ready();
+        let value = timings
+            .server_timing_value()
+            .expect("should render after mark_headers_ready");
+        assert!(
+            value.starts_with("ts-total;dur="),
+            "should lead with ts-total: {value}"
+        );
+        assert!(value.contains("ts-filter;dur=9.1"), "should render one decimal: {value}");
+        assert!(!value.contains("ts-geo"), "should omit unrecorded phases: {value}");
+    }
+
+    #[test]
+    fn render_returns_none_before_headers_ready() {
+        let timings = RequestTimings::new();
+        timings.record(Phase::Geo, Duration::from_millis(1));
+        assert!(timings.server_timing_value().is_none(), "should require the snapshot");
+    }
+
+    #[test]
+    fn repeated_phases_accumulate_saturating() {
+        let timings = RequestTimings::new();
+        timings.record(Phase::Geo, Duration::from_millis(2));
+        timings.record(Phase::Geo, Duration::from_millis(3));
+        timings.mark_headers_ready();
+        let snapshot = timings.snapshot();
+        assert_eq!(snapshot.geo_ms, Some(5), "should accumulate repeats");
+    }
+
+    #[test]
+    fn mark_headers_ready_is_first_call_wins() {
+        let timings = RequestTimings::new();
+        timings.mark_headers_ready();
+        let first = timings.snapshot().time_elapsed_ms;
+        std::thread::sleep(Duration::from_millis(5));
+        timings.mark_headers_ready();
+        assert_eq!(timings.snapshot().time_elapsed_ms, first, "should not restamp");
+    }
+
+    #[test]
+    fn span_guard_records_on_drop() {
+        let timings = RequestTimings::new();
+        {
+            let _span = timings.span(Phase::Origin);
+            std::thread::sleep(Duration::from_millis(2));
+        }
+        timings.mark_headers_ready();
+        assert!(
+            timings.snapshot().origin_ms.expect("should record on drop") >= 1,
+            "should measure elapsed span time"
+        );
+    }
+
+    #[test]
+    fn auction_wait_records_placement() {
+        let timings = RequestTimings::new();
+        timings.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::from_millis(40));
+        let snapshot = timings.snapshot();
+        assert_eq!(snapshot.auction_wait_ms, Some(40), "should record wait");
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::PreHeader),
+            "should record placement"
+        );
+    }
+
+    #[test]
+    fn rendered_names_never_include_vendor_terms() {
+        let timings = RequestTimings::new();
+        for phase in [Phase::AppBuild, Phase::Filter, Phase::Geo, Phase::EcKv, Phase::Origin, Phase::TemplateCacheLookup] {
+            timings.record(phase, Duration::from_millis(1));
+        }
+        timings.mark_headers_ready();
+        let value = timings.server_timing_value().expect("should render");
+        assert!(!value.to_ascii_lowercase().contains("datadome"), "should mask vendors");
+    }
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-axum -p trusted-server-core request_timing`
+Expected: compile FAIL, module does not exist.
+
+- [ ] **Step 3: Implement**
+
+```rust
+//! Per-request phase timing collection and Server-Timing rendering.
+//!
+//! Collection is always-on and infallible: saturating math, lock failure
+//! drops the sample, no panics. See the design spec
+//! `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md`.
+
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+const PHASE_COUNT: usize = 8;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Phase {
+    AppBuild,
+    Filter,
+    Geo,
+    EcKv,
+    Origin,
+    TemplateCacheLookup,
+    AuctionWait,
+    Stream,
+}
+
+impl Phase {
+    fn index(self) -> usize { /* match self -> 0..=7 */ }
+
+    /// Header entry name; row-only phases return None.
+    fn header_name(self) -> Option<&'static str> {
+        match self {
+            Self::AppBuild => Some("ts-appbuild"),
+            Self::Filter => Some("ts-filter"),
+            Self::Geo => Some("ts-geo"),
+            Self::EcKv => Some("ts-kv"),
+            Self::Origin => Some("ts-origin"),
+            Self::TemplateCacheLookup => Some("ts-template-cache"),
+            Self::AuctionWait | Self::Stream => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuctionWaitPlacement {
+    PreHeader,
+    InStream,
+}
+
+struct Inner {
+    t0: Instant,
+    phases: [Option<Duration>; PHASE_COUNT],
+    headers_ready_total: Option<Duration>,
+    request_elapsed: Option<Duration>,
+    auction_wait_placement: Option<AuctionWaitPlacement>,
+    resp_bytes: Option<u64>,
+}
+
+#[derive(Clone)]
+pub struct RequestTimings(Arc<Mutex<Inner>>);
+```
+
+Implementation notes (all bodies in this task, none deferred):
+
+- Every method takes `if let Ok(mut inner) = self.0.try_lock()` and silently
+  returns otherwise: contention and poison both drop the sample instead of waiting,
+  per the infallibility constraint.
+- `record` accumulates with `saturating_add` semantics
+  (`Some(existing.saturating_add(dur))`).
+- `mark_headers_ready` and `mark_request_elapsed` write `t0.elapsed()` only when the
+  slot is `None`.
+- `server_timing_value` returns `None` unless `headers_ready_total` is set; renders
+  `ts-total` first from the stored snapshot, then the six header phases in enum order
+  with `{:.1}` millisecond formatting (`dur.as_secs_f64() * 1000.0`).
+- `PhaseSpan { timings: RequestTimings, phase: Phase, started: Instant }`; `Drop`
+  calls `record(self.phase, self.started.elapsed())`.
+- `TimingSnapshot` converts each `Duration` with
+  `u32::try_from(dur.as_millis()).unwrap_or(u32::MAX)`.
+- `impl Default for RequestTimings` delegates to `new()`.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-axum -p trusted-server-core request_timing`
+Expected: all 7 tests PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/request_timing.rs crates/trusted-server-core/src/lib.rs
+git commit -m "Add RequestTimings phase collection and Server-Timing rendering"
+```
+
+---
+
+### Task 2: Settings: `[observability]`, tinybird decoupling, access validation
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs`
+- Modify: `trusted-server.example.toml`
+
+**Interfaces:**
+
+- Produces:
+  - `pub struct ObservabilitySettings { pub server_timing_enabled: bool }` as
+    `settings.observability`, `#[serde(default)]` on the field and
+    `#[serde(skip_serializing_if = "ObservabilitySettings::is_default")]`.
+  - `TinybirdSettings.auction_enabled: bool` (`#[serde(default = "default_true")]`).
+  - `prepare_runtime` validation: `access_enabled` requires `enabled`, non-empty
+    `api_host`, `secret_store`, `access_dataset`, `access_token_secret`,
+    `max_body_bytes >= 1024`, and `access_sample_rate > 0.0`.
+
+- [ ] **Step 1: Write the failing tests** (in `settings.rs` tests module)
+
+```rust
+#[test]
+fn observability_defaults_off_and_serializes_away() {
+    let settings = create_test_settings();
+    assert!(!settings.observability.server_timing_enabled, "should default off");
+    let toml = toml::to_string(&settings).expect("should serialize settings");
+    assert!(
+        !toml.contains("[observability]"),
+        "should omit the default table so a prior binary can parse the config"
+    );
+}
+
+#[test]
+fn access_enabled_requires_positive_sample_rate() {
+    // access_enabled = true with access_sample_rate = 0 is armed-but-silent: an error.
+    let err = settings_from_toml_with(
+        "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\naccess_enabled = true\naccess_sample_rate = 0.0\n",
+    )
+    .expect_err("should reject armed-but-silent access telemetry");
+    assert!(format!("{err:?}").contains("access_sample_rate"), "should name the field");
+}
+
+#[test]
+fn access_and_auction_emission_are_independent() {
+    let settings = settings_from_toml_with(
+        "[tinybird]\nenabled = true\napi_host = \"api.example.com\"\nauction_enabled = false\naccess_enabled = true\naccess_sample_rate = 1.0\n",
+    )
+    .expect("should accept access without auction");
+    assert!(!settings.tinybird.auction_enabled, "should disable auction emission");
+    assert!(settings.tinybird.access_enabled, "should enable access emission");
+}
+
+#[test]
+fn auction_enabled_defaults_true_for_existing_configs() {
+    let settings = settings_from_toml_with("[tinybird]\nenabled = true\napi_host = \"api.example.com\"\n")
+        .expect("should parse a pre-decoupling config");
+    assert!(settings.tinybird.auction_enabled, "should preserve current behavior");
+}
+```
+
+Also REPLACE the existing rejection test
+(`tinybird_access_enabled_is_rejected_until_emitter_is_wired`, `settings.rs:4123`)
+with a wiring test asserting a fully-specified access config is accepted.
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-axum -p trusted-server-core observability access_enabled auction_enabled`
+Expected: compile FAIL (`observability` field missing).
+
+- [ ] **Step 3: Implement**
+
+- Add `ObservabilitySettings` (derive `Debug, Clone, Default, PartialEq, Deserialize,
+Serialize`, `#[serde(deny_unknown_fields)]`), with
+  `fn is_default(&self) -> bool { *self == Self::default() }`.
+- Add the `observability` field to `Settings` with the serde attributes above.
+- Add `auction_enabled` to `TinybirdSettings` with `default_true()`; update
+  `Default for TinybirdSettings`.
+- Extend `TinybirdSettings::prepare_runtime` with the access validation matrix; error
+  messages name the failing field (`"tinybird.access_sample_rate must be > 0 when
+access_enabled"` and so on).
+- `trusted-server.example.toml`: add a commented `[observability]` block with
+  `server_timing_enabled = false` present-but-false and the env-override note (the
+  overlay cannot create a missing leaf), plus `auction_enabled`/access keys in the
+  tinybird section comments.
+- Gate the auction sink: in `crates/trusted-server-adapter-fastly/src/app.rs`,
+  `auction_sink_from_settings` condition becomes
+  `settings.tinybird.enabled && settings.tinybird.auction_enabled`.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-axum -p trusted-server-core` then `cargo test-fastly` (the sink gate
+touches the Fastly adapter).
+Expected: PASS, including the replaced wiring test.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/settings.rs trusted-server.example.toml crates/trusted-server-adapter-fastly/src/tinybird.rs crates/trusted-server-adapter-fastly/src/app.rs
+git commit -m "Add observability settings and decouple tinybird access and auction emission"
+```
+
+---
+
+### Task 3: Fastly freeze point, header emission, `DeliveryOutcome`
+
+**Files:**
+
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (entry T0, appbuild span,
+  `send_edgezero_response`)
+- Test: `crates/trusted-server-adapter-fastly/src/app.rs` tests module (route-level
+  tests run under Viceroy)
+
+**Interfaces:**
+
+- Consumes: `RequestTimings`, `Phase` (Task 1);
+  `trusted_server_core::cache_policy::cache_control_headers_are_private_or_no_store`.
+- Produces:
+  - `RequestTimings` inserted into request extensions at dispatch
+    (`core_req.extensions_mut().insert(timings.clone())`), alongside the existing
+    `config_store`/`device_signals`/`client_info` inserts.
+  - `send_edgezero_response(response, effects, timings) -> DeliveryOutcome` where
+    `pub(crate) struct DeliveryOutcome { pub bytes: u64, pub result: DeliveryResult }`
+    and `pub(crate) enum DeliveryResult { Complete, Error }` (streaming partial
+    detection lands in Task 6).
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[test]
+fn server_timing_emitted_on_private_response_when_enabled() {
+    // Arrange: settings with observability.server_timing_enabled = true; publisher
+    // route fixture whose response is Cache-Control: private, no-store.
+    // Act: dispatch through the full adapter path.
+    // Assert:
+    let header = response_header(&response, "server-timing").expect("should emit header");
+    assert!(header.contains("ts-total;dur="), "should carry the stored total");
+    assert_eq!(
+        header.matches("ts-total").count(), 1,
+        "should emit exactly one TS-owned metric set"
+    );
+}
+
+#[test]
+fn server_timing_absent_when_flag_off() { /* same fixture, flag false: no ts-total */ }
+
+#[test]
+fn server_timing_absent_on_cacheable_responses() {
+    // tsjs route (public, max-age=31536000, immutable) and a bare max-age=60 response:
+    // both must carry no ts-total even with the flag on.
+}
+
+#[test]
+fn preexisting_server_timing_values_survive() {
+    // Fixture response already carrying Server-Timing: upstream;dur=1 stays present
+    // alongside the appended TS set.
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-fastly server_timing`
+Expected: FAIL, no header emitted.
+
+- [ ] **Step 3: Implement**
+
+In `edgezero_main` (`main.rs`):
+
+```rust
+let timings = RequestTimings::new();
+{
+    let _appbuild = timings.span(Phase::AppBuild);
+    // existing: open_trusted_server_config_store() + build_app_with_state()
+}
+```
+
+Move the config-store open inside the span scope. Insert `timings.clone()` into
+request extensions before dispatch. Thread the handle into both send sites and the
+error paths by value (it is a cheap clone).
+
+In `send_edgezero_response`, immediately before `response.into_parts()`:
+
+```rust
+timings.mark_headers_ready();
+let conclusively_private =
+    cache_control_headers_are_private_or_no_store(response.headers());
+if settings_enabled_server_timing && conclusively_private {
+    if let Some(value) = timings.server_timing_value() {
+        match HeaderValue::from_str(&value) {
+            Ok(header_value) => {
+                response.headers_mut().append(header::SERVER_TIMING, header_value);
+            }
+            Err(error) => log::warn!("skipping server-timing header: {error}"),
+        }
+    }
+}
+```
+
+`settings_enabled_server_timing` arrives inside a small
+`SendContext { timings: RequestTimings, server_timing_enabled: bool }` so the
+function stays at or under seven parameters. Return `DeliveryOutcome` with per-mode
+semantics: buffered bodies capture the byte count from the body length before
+`send_to_client()` (which returns no delivery result) and report complete-on-return;
+the streaming branch gains a counting writer in Task 6. Existing callers ignore the
+outcome in this task (Task 8 consumes it).
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-fastly` and `cargo clippy-fastly`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-adapter-fastly/src/main.rs crates/trusted-server-adapter-fastly/src/app.rs
+git commit -m "Emit Server-Timing at the send freeze point on conclusively private responses"
+```
+
+---
+
+### Task 4: Filter span and geo span with `GeoLookupState` dedupe
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/geo.rs` (add `GeoLookupState`)
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs`
+  (`run_pre_route_filters` wrapper, `build_ec_request_state` geo span + state attach)
+- Modify: `crates/trusted-server-adapter-fastly/src/middleware.rs` and `main.rs`
+  (`resolve_geo_for_response` consumes carried state)
+
+**Interfaces:**
+
+- Consumes: `RequestTimings` from request extensions (Task 3).
+- Produces:
+  - `pub enum GeoLookupState { NotAttempted, Attempted, Resolved(GeoInfo) }` in
+    `trusted_server_core::geo`, attached as a response extension on every exit path
+    that attempted a lookup (including the asset fallback).
+  - `resolve_geo_for_response` gains the carried state as input: live lookup only on
+    `NotAttempted`; `Attempted` is never retried; fallback lookups are wrapped in
+    `timings.span(Phase::Geo)`.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[test]
+fn finalize_reuses_request_phase_geo_without_second_lookup() {
+    // Counting geo stub: dispatch a publisher route; assert lookup count == 1 and
+    // x-geo-country still set on the response.
+}
+
+#[test]
+fn failed_lookup_is_not_retried() {
+    // Stub returns None once; assert GeoLookupState::Attempted carried and the
+    // finalize path performs zero further lookups.
+}
+
+#[test]
+fn asset_fallback_carries_geo_state_without_ec_finalize_state() {
+    // Asset route: response extension holds GeoLookupState, EcFinalizeState absent.
+}
+
+#[test]
+fn filter_span_recorded_when_request_filter_runs() {
+    // Registry fixture with a test request filter; assert snapshot().filter_ms is Some.
+}
+
+#[test]
+fn geo_lookup_skipped_for_unauthorized_responses() {
+    // Existing 401 rule preserved: no lookup, state NotAttempted.
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-fastly geo_ filter_span`
+Expected: FAIL (lookup count 2; no `GeoLookupState`).
+
+- [ ] **Step 3: Implement**
+
+- `GeoLookupState` derives `Debug, Clone`; store in response extensions from the
+  dispatch layer right after `build_ec_request_state` resolves (or fails) its lookup.
+- Wrap the `build_ec_request_state` lookup and any finalize fallback lookup in
+  `timings.span(Phase::Geo)` (accumulating slot handles the repeat case).
+- Wrap `run_pre_route_filters` (`app.rs:751`) in `timings.span(Phase::Filter)`,
+  recording only when at least one filter is registered (skip the span when the
+  registry has no request filters, so the header omits `ts-filter` on unconfigured
+  deployments).
+- `resolve_geo_for_response(response, carried: &GeoLookupState, client_ip, lookup)`
+  keeps the 401 short-circuit first, then matches the carried state.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-fastly` and `cargo test-axum`
+Expected: PASS including untouched existing geo header tests.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/geo.rs crates/trusted-server-adapter-fastly/src/app.rs crates/trusted-server-adapter-fastly/src/middleware.rs crates/trusted-server-adapter-fastly/src/main.rs
+git commit -m "Record filter and geo spans and dedupe the per-request geo lookup"
+```
+
+---
+
+### Task 5: Core spans: origin, template cache, KV abstraction
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs` (origin send ~4496, template
+  cache lookup ~4391 on current main)
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (graph-level `ts-kv`)
+- Test: `publisher.rs` and `ec/kv.rs` test modules
+
+**Interfaces:**
+
+- Consumes: `RequestTimings` read from request extensions inside
+  `handle_publisher_request`; `KvIdentityGraph` gains
+  `pub fn with_timings(self, timings: RequestTimings) -> Self` (builder-style,
+  optional field), set where the graph is constructed in `main.rs`.
+- Produces: `origin_ms`, `template_cache_ms`, `kv_ms` populated in snapshots.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[test]
+fn origin_span_covers_the_publisher_fetch() {
+    // Stubbed origin with a small injected delay; assert snapshot().origin_ms is Some.
+}
+
+#[test]
+fn template_cache_span_recorded_only_when_lookup_runs() {
+    // Inline mode fixture: template_cache_ms None. Shared-mode eligible fixture:
+    // template_cache_ms Some.
+}
+
+#[test]
+fn kv_span_accumulates_across_graph_operations() {
+    // Stub KV recording two operations through a TimedKvStore-wrapped graph; assert
+    // kv_ms Some and covers both (accumulated, not last-write).
+}
+
+#[test]
+fn consent_store_reads_are_timed_and_pull_sync_is_not() {
+    // Consent read through the decorated RuntimeServices store: kv_ms Some.
+    // Pull-sync graph built from the untimed store: records nothing.
+}
+
+#[test]
+fn ec_finalize_kv_lands_before_freeze() {
+    // Adapter-level (test-fastly): EC-enabled fixture with eids cookies; assert the
+    // emitted header contains ts-kv, proving the freeze point sits after finalize.
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-axum -p trusted-server-core origin_span template_cache_span kv_span`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement**
+
+- `handle_publisher_request` reads the handle:
+  `let timings = req.extensions().get::<RequestTimings>().cloned().unwrap_or_default();`
+  (a defaulted handle records into nothing that ever renders, keeping non-adapter
+  tests unchanged).
+- Origin: `let origin_span = timings.span(Phase::Origin);` immediately before
+  `services.http_client().send(platform_request).await`; `drop(origin_span)` when the
+  response headers are available (directly after the `match` arm binds the response).
+- Template cache: same guard pattern around
+  `services.template_cache().lookup_or_reserve(key).await`.
+- KV: add `TimedKvStore` (new type in `crates/trusted-server-core/src/platform/`),
+  a decorator implementing `PlatformKvStore` that wraps `Arc<dyn PlatformKvStore>`
+  plus a `RequestTimings` handle and records `Phase::EcKv` around every trait
+  method. Every request-path `KvIdentityGraph` construction site (request setup,
+  identify, admin lookup, batch sync, finalization) receives the timed store;
+  consent-store access through `RuntimeServices` uses the same decorator; pull-sync
+  constructs its graph from the untimed store explicitly (add a test asserting the
+  pull-sync store records nothing). `ec_finalize_response` keeps seven arguments:
+  the handle rides inside the store the graph already receives.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-axum` then `cargo test-fastly`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/publisher.rs crates/trusted-server-core/src/ec/kv.rs crates/trusted-server-adapter-fastly/src/main.rs
+git commit -m "Record origin, template cache, and KV phase spans in core"
+```
+
+---
+
+### Task 6: Body-phase capture: stream, auction wait placement, bytes
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs` (seam wait + buffered wait)
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (stream drive timing,
+  `DeliveryOutcome.bytes`)
+- Test: `publisher.rs` tests + adapter tests
+
+**Interfaces:**
+
+- Consumes: `record_auction_wait` (Task 1), `DeliveryOutcome` (Task 3).
+- Produces: `stream_ms`, `auction_wait_ms` + placement, `resp_bytes`,
+  `mark_request_elapsed()` called by the adapter immediately after the stream drive
+  returns.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[test]
+fn streaming_seam_wait_records_in_stream_placement() {
+    // Streaming fixture with a delayed auction: placement InStream, and
+    // stream_ms >= auction_wait_ms.
+}
+
+#[test]
+fn buffered_template_miss_records_pre_header_placement() {
+    // Shared-template authorized miss (buffered finalizer): placement PreHeader; the
+    // wait is recorded even though headers had not committed.
+}
+
+#[test]
+fn delivery_outcome_reports_bytes_and_request_elapsed_set() {
+    // Adapter: after send, snapshot has resp_bytes Some(body_len) and
+    // request_elapsed_ms Some; request_elapsed excludes post-send emitter time by
+    // construction (asserted by ordering test in Task 8).
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-fastly seam_wait buffered_template delivery_outcome`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement**
+
+- Streaming path: around the `collect_stream_auction(...)` await inside the body
+  stream, measure with `Instant::now()` and call
+  `timings.record_auction_wait(AuctionWaitPlacement::InStream, waited)`. The handle
+  reaches the stream closure through `OwnedProcessResponseParams`/assembly params (it
+  is `Clone`; add a field).
+- Buffered path (`buffer_publisher_response_async` and the shared-template miss
+  finalizer): same measurement with `AuctionWaitPlacement::PreHeader`.
+- Adapter stream drive: wrap the `block_on(stream_asset_body(...))` region with a
+  counting writer that tallies bytes and observes truncation/error, record
+  `Phase::Stream` with the elapsed drive time, populate `DeliveryOutcome` with
+  bytes and Complete/Partial/Error, call `timings.set_resp_bytes(bytes)` and
+  `timings.mark_request_elapsed()` immediately after the drive returns, before
+  anything else post-send. Buffered responses keep the Task 3 complete-on-return
+  semantics; `body_mode` distinguishes the regimes in the row.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-fastly` and `cargo test-axum`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/publisher.rs crates/trusted-server-adapter-fastly/src/main.rs
+git commit -m "Capture stream duration, auction wait placement, and response bytes"
+```
+
+---
+
+### Task 7: `AccessTelemetrySnapshot`, route class, route template
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/access_telemetry.rs`
+- Modify: `crates/trusted-server-core/src/lib.rs`
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` (RouteMetadata attach at
+  handler wrappers), `main.rs` (snapshot build at freeze point),
+  `crates/trusted-server-core/src/publisher.rs` (typed template-cache state
+  extension)
+
+**Interfaces:**
+
+- Consumes: `TimingSnapshot` (Task 1), `GeoLookupState` (Task 4).
+- Produces:
+  - `pub enum RouteClass { PublisherHtml, Tsjs, IntegrationProxy, Ec, AuctionApi, Other }`
+    with `pub fn as_str(&self) -> &'static str` (snake_case values from the spec).
+  - `pub fn publisher_route_template(path: &str) -> String`: `/` plus first segment
+    filtered to `[a-z0-9_-]`, truncated to 32 chars, plus `/*` when deeper; empty or
+    disallowed first segments render `/other/*`.
+  - `pub struct AccessTelemetrySnapshot { pub method: String, pub status: u16, pub route_class: RouteClass, pub route_template: String, pub publisher_domain: String, pub env: String, pub service_id: String, pub pop: String, pub country: String, pub template_cache_state: String, pub body_mode: &'static str, pub sample_rate: f64 }`
+  - `pub fn access_event_row(snapshot: &AccessTelemetrySnapshot, timings: &TimingSnapshot, delivery_result: DeliveryResult, event_ts_epoch_ms: u64) -> String` (one NDJSON line).
+
+- [ ] **Step 1: Write the failing tests** (adversarial, per spec 9)
+
+```rust
+#[test]
+fn admin_ec_route_template_never_contains_the_identifier() {
+    // Named-route template comes from the route table: "/_ts/admin/ec/{id}".
+    // Assert a row built for that route never contains a 64-hex EC id fixture.
+}
+
+#[test]
+fn publisher_paths_normalize_to_coarse_templates() {
+    assert_eq!(publisher_route_template("/news/some-article-slug"), "/news/*");
+    assert_eq!(publisher_route_template("/"), "/");
+    assert_eq!(
+        publisher_route_template("/user@example.com/profile"),
+        "/other/*",
+        "should reject non-allowlisted characters"
+    );
+    assert_eq!(
+        publisher_route_template(&format!("/{}", "a".repeat(500))),
+        format!("/{}", "a".repeat(32)),
+        "should bound segment length"
+    );
+    assert_eq!(publisher_route_template("/search terms here"), "/other/*");
+}
+
+#[test]
+fn row_serializes_nulls_for_missing_phases() {
+    // Sparse TimingSnapshot: absent phases serialize as JSON null, dimension fields
+    // never null (unknown sentinel).
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-axum -p trusted-server-core access_telemetry route_template`
+Expected: compile FAIL.
+
+- [ ] **Step 3: Implement**
+
+Row serialization via `serde_json::json!` mapping spec section 9 column names exactly
+(`time_elapsed_ms`, `appbuild_ms`, ..., `auction_wait_placement` as
+`pre_header|in_stream|none`). `pop`/`service_id` read from Fastly env
+(`FASTLY_SERVICE_ID`, `FASTLY_POP`), defaulting `"unknown"`; `env` derived by the
+adapter from `FASTLY_IS_STAGING` (the `x-ts-env` input), never from `Settings`.
+Route identity travels as a typed `RouteMetadata` response extension
+(`pub struct RouteMetadata { pub route_class: RouteClass, pub route_template: String }`
+in `access_telemetry.rs`): each named-route handler wrapper attaches its matched
+route-table pattern verbatim, and the fallback and tsjs handlers attach their class
+plus the coarse template; the freeze point consumes the extension (no `RouteClass`
+column in `NAMED_ROUTES`, no reconstruction from a handler enum). Also in this task:
+make `TemplateCacheResponseState` a typed response extension in `publisher.rs`, set
+at every point that writes `x-ts-template-cache` so header and extension cannot
+drift; the row reads the extension. The snapshot is built (when access
+telemetry is enabled) in
+`send_edgezero_response` right after `mark_headers_ready()` and returned inside
+`DeliveryOutcome` (add field `pub snapshot: AccessTelemetrySnapshot`).
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-axum` and `cargo test-fastly`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/access_telemetry.rs crates/trusted-server-core/src/lib.rs crates/trusted-server-adapter-fastly/src/app.rs crates/trusted-server-adapter-fastly/src/main.rs
+git commit -m "Add access telemetry snapshot, route classes, and coarse route templates"
+```
+
+---
+
+### Task 8: Best-effort access dispatch and post-send ordering
+
+**Files:**
+
+- Modify: `crates/trusted-server-adapter-fastly/src/tinybird.rs` (access sink)
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (post-send ordering)
+
+**Interfaces:**
+
+- Consumes: `AccessTelemetrySnapshot` + `access_event_row` (Task 7), settings flags
+  (Task 2), `DeliveryOutcome` (Tasks 3/6).
+- Produces: `pub(crate) async fn emit_access_event(client: &FastlyPlatformHttpClient, target: &TinybirdEventsTarget, row: String) -> Result<(), Report<TrustedServerError>>`,
+  starting the host-owned request with `send_async` after client delivery,
+  then dropping its pending handle. Serialization/setup/start errors are returned;
+  later transport, HTTP status and ingestion acceptance are unobserved. The transport context is adapter-owned and route-independent (target
+  derived from settings once at entry), so asset, admin, and error responses emit
+  without `RuntimeServices` or `EcFinalizeState`.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[test]
+fn access_emitter_dispatches_ndjson_and_drops_without_waiting() {
+    // Assert exact URI/body/auth, one async start, no synchronous send or wait,
+    // and destruction of the returned pending handle.
+}
+
+#[test]
+fn access_emitter_reports_start_failure_without_retry() {
+    // An async-start failure returns Err; no retry or wait is attempted.
+}
+
+#[test]
+fn sampled_out_requests_emit_nothing() {
+    // access_sample_rate stub decision false: RecordingHttpClient sees zero requests.
+}
+
+#[test]
+fn post_send_order_is_elapsed_then_pull_sync_then_telemetry() {
+    // Instrumented stubs record call order; assert request_elapsed snapshot precedes
+    // pull-sync dispatch which precedes the telemetry send.
+}
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-fastly access_emitter post_send_order`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement**
+
+- Reuse `TinybirdEventsTarget` with a second constructor
+  `from_access_config(config: &TinybirdSettings)` using `access_dataset` and
+  `access_token_secret`.
+- Sampling decision: `fn sampled_in(rate: f64, roll: f64) -> bool` compares the
+  configured rate to one uniform random draw before snapshot construction.
+- `main.rs` post-send, in order: `timings.mark_request_elapsed()` (already placed in
+  Task 6), existing pull-sync dispatch unchanged, then when
+  `settings.tinybird.enabled && settings.tinybird.access_enabled` and sampled in:
+  build the row from `outcome.snapshot` + `timings.snapshot()`, call
+  `emit_access_event`, log one warning on `Err`.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-fastly` and `cargo clippy-fastly`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-adapter-fastly/src/tinybird.rs crates/trusted-server-adapter-fastly/src/main.rs
+git commit -m "Dispatch access telemetry after pull-sync post-send"
+```
+
+---
+
+### Task 9: Tinybird datasource schema
+
+**Files:**
+
+- Create: `tinybird/datasources/access_logs_v2.datasource`
+- Preserve: `tinybird/datasources/access_logs_raw.datasource`
+
+**Interfaces:**
+
+- Consumes: column names exactly as serialized by `access_event_row` (Task 7).
+- Produces: the deployed schema contract for the dashboard (separate repo).
+
+- [ ] **Step 1: Create the versioned schema** per spec section 9, with the
+      31 producer fields and JSONPaths, non-nullable dimension columns, nullable
+      phase/milestone columns, and a 30-day TTL. Use
+      `ENGINE_SORTING_KEY "toDate(event_ts), service_id, publisher_domain, env, route_class, pop, status"`.
+      Keep the legacy nine-column datasource unchanged. No `FORWARD_QUERY` or
+      historical raw-path backfill is part of this cutover.
+
+- [ ] **Step 2: Validate** with the tinybird toolchain if available locally
+      (`tb check` / project tests under `tinybird/tests`); otherwise assert the file
+      parses by review and rely on rollout step 4's remote verification. Add a fixture row
+      in `tinybird/fixtures` matching `access_event_row` output.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add tinybird/datasources/access_logs_v2.datasource tinybird/fixtures
+git commit -m "Add the versioned access timing datasource"
+```
+
+---
+
+### Task 10: Axum adapter emission
+
+**Files:**
+
+- Modify: `crates/trusted-server-adapter-axum/src/` (terminal layer at the response
+  serialization boundary; locate the equivalent of the Fastly send path)
+- Test: axum adapter tests (`cargo test-axum`)
+
+**Interfaces:**
+
+- Consumes: `RequestTimings`, header emission helper. Extract the emission block from
+  Task 3 into a shared core helper so both adapters call one function:
+  `pub fn append_server_timing_if_private(response: &mut Response, timings: &RequestTimings, enabled: bool)`
+  in `request_timing.rs` (move the Fastly inline logic here and re-point Task 3's call
+  site).
+- Produces: Axum responses carry the header under the same conservative predicate;
+  `ts-appbuild` absent by construction (state built at startup); router-generated
+  404/405 covered by the terminal layer; `/health` excluded by route match.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[test]
+fn axum_emits_header_on_private_response() { /* flag on, private response: ts-total present, ts-appbuild absent */ }
+
+#[test]
+fn axum_404_carries_header_when_private() { /* router-generated 404 passes through the terminal layer */ }
+
+#[test]
+fn axum_health_is_excluded() { /* /health: no ts-total */ }
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `cargo test-axum axum_emits axum_404 axum_health`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement** an outer service wrapper around the `RouterService`
+      inside `AxumDevServer` (not router middleware, which router-generated 404/405
+      responses bypass and which returns before body serialization): create
+      `RequestTimings::new()` per request in the wrapper, insert into request
+      extensions, and on the wrapper's response side call `mark_headers_ready()` +
+      `append_server_timing_if_private(...)`, skipping the `/health` path by match.
+
+- [ ] **Step 4: Run to verify pass**
+
+Run: `cargo test-axum`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-adapter-axum/src crates/trusted-server-core/src/request_timing.rs crates/trusted-server-adapter-fastly/src/main.rs
+git commit -m "Emit Server-Timing from the Axum terminal layer with adapter-specific semantics"
+```
+
+---
+
+### Task 11: Full gate, docs, and PR
+
+- [ ] **Step 1: Docs.** Add a short operator section to `docs/guide/configuration.md`:
+      the `[observability]` flag, the tinybird access keys, the deploy/rollback ordering
+      from spec section 12 (binary first, config second; config first on rollback), and
+      the conservative emission rule. Run `cd docs && npm run format`.
+
+- [ ] **Step 2: Full CI gate list** from `CLAUDE.md`:
+      `cargo fmt --all -- --check`; all six clippy aliases; `test-fastly`, `test-axum`,
+      `test-cloudflare`, `test-spin`; the integration-tests parity suite; JS build/test
+      and formats. Cloudflare/Spin compile the new core modules (collection only), which
+      is exactly what the non-goal requires.
+
+- [ ] **Step 3: Commit docs, push the branch, open the implementation PR** referencing
+      the spec PR #1069 and issue #1068, with the rollout section of the spec quoted as
+      the deployment checklist (staging pass-through + MISS/HIT replay before production
+      flag-on).
+
+---
+
+## Self-Review
+
+- Spec coverage: sections 5 (Task 1), 12 (Task 2), 7 (Tasks 3, 10), 8/8a (Tasks 4,
+  10), 6 (Tasks 4-6), 9 (Tasks 7, 9), 10 (Task 8), 13 (Tasks 1, 3, 8), 14 (test
+  steps throughout), 15 steps 1-4 (Task 11 + deployment checklist). Section 11
+  (dashboard) is explicitly out of scope for this repo's plan.
+- Type consistency: `RequestTimings`/`TimingSnapshot`/`RouteClass`/
+  `AccessTelemetrySnapshot`/`DeliveryOutcome` names and signatures match across
+  Tasks 1, 3, 6, 7, 8, 10.
+- Known intentional deferral: `DeliveryResult::Partial` detection is named in Task 3
+  and wired when the stream drive reports bytes in Task 6; no other deferrals.
diff --git a/docs/superpowers/plans/2026-08-26-auction-timeline-offsets.md b/docs/superpowers/plans/2026-08-26-auction-timeline-offsets.md
new file mode 100644
index 0000000000..4b5b518c48
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-26-auction-timeline-offsets.md
@@ -0,0 +1,89 @@
+# Auction Timeline Offsets Implementation Plan
+
+> PR #1261 contract update: the persisted collection field is `auction_collected_ms`.
+> Internal Rust and browser `resolved` names remain unchanged. Collection wait uses
+> actual provider or mediator launch evidence, while provider dispatch stays null
+> for mediator-only work. Historical checkboxes below are not evidence that the
+> current committed Fastly dependency or a live deployment has been validated.
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Record three T0-anchored auction milestones (dispatched, resolved, committed) plus the auction id on `RequestTimings`, and emit them as four auction columns on the versioned `access_logs_v2` row.
+
+**Architecture:** Follows spec section 18. All state lives in the existing `RequestTimings` inner (same `try_lock`/first-call-wins/saturating model as `mark_headers_ready`); the row builder reads the values from `TimingSnapshot`, so no new emission path and no adapter changes.
+
+**Tech Stack:** Rust (core crate only), Tinybird datasource and fixture files.
+
+**Spec:** `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md` section 18.
+
+## Global Constraints
+
+- Marks are first-call-wins; `try_lock` only; a contended lock drops the sample, a poisoned lock is recovered (matching every other write on the collector).
+- A null offset means "this milestone was not reached", not "no auction ran". `auction_id` is what separates the two: null id means no auction was attempted; a non-null id with a null dispatch offset means no provider launch, but mediator-only collection may still have occurred; a non-null dispatch offset with a null resolve offset means dispatched and never collected.
+- The id is stamped where an active-auction observation is built, not on dispatch, so active skipped and dispatch-failed auctions stay joinable. Disabled auctions have null access UUIDs on all three routes.
+- Column names: `auction_dispatched_ms`, `auction_collected_ms`, `auction_committed_ms`, `auction_id`; JSONPaths `json:$.<name>`. The new versioned datasource has no `FORWARD_QUERY`; the legacy dataset is preserved.
+- `auction_id` is `Nullable(UUID)`, matching `auction_events_raw.auction_id` so the join needs no cast and no sentinel.
+- All three `AuctionSource` variants are instrumented: `InitialNavigation`, `SpaNavigation` (`/_ts/page-bids`), and `AuctionApi` (`POST /auction`).
+- No header emission and no config surface. Changes are confined to `trusted-server-core`, `tinybird/`, and the spec and plan documents.
+
+---
+
+### Task 1: RequestTimings marks and snapshot fields
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/request_timing.rs`
+
+**Interfaces:**
+
+- Produces: `set_auction_id(&self, auction_id: Uuid)`, `mark_auction_dispatched(&self)`, `mark_auction_resolved(&self)`, `mark_auction_committed(&self)`; `TimingSnapshot { auction_dispatched_ms, auction_resolved_ms, auction_committed_ms: Option<u32>, auction_id: Option<Uuid>, .. }`
+
+- [x] Add `auction_dispatched`, `auction_resolved`, `auction_committed: Option<Duration>` and `auction_id: Option<Uuid>` to `Inner`; initialize `None`.
+- [x] Add `set_auction_id` plus the three no-arg mark methods, first-call-wins on their own field, storing `inner.t0.elapsed()`.
+- [x] Recover a poisoned lock in all four, matching the other lock-taking methods on the collector.
+- [x] Map all four into `TimingSnapshot` via `duration_ms`; `Uuid` is `Copy`, so the id needs no clone.
+- [x] Tests: first-call-wins per mark, proved by sleeping between the two calls and asserting the value is unchanged; the id survives a request with no dispatch mark; unmarked snapshot yields all `None`.
+- [x] `cargo test-fastly request_timing`, commit.
+
+### Task 2: Auction call sites
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs`
+
+**Interfaces:**
+
+- Consumes: Task 1 methods; `observation.auction_id` (`AuctionObservationContext`), in scope wherever an observation is built.
+
+- [x] Navigation path: `set_auction_id` at observation construction; `mark_auction_dispatched()` in the `DispatchAuctionOutcome::Dispatched` arm; `mark_auction_resolved()` after both `record_auction_wait` calls; `mark_auction_committed()` after both `write_bids_to_state` calls.
+- [x] `/_ts/page-bids`: preserve the adapter collector, stamp the enabled observation UUID, use the orchestrator-owned dispatch/collect mapping and measured pre-header wait, then commit after the bid map is built. No-work outcomes keep timing null.
+- [x] `POST /auction`: preserve the adapter collector and use the same observed orchestration path; commit once the OpenRTB response is converted. Mediator work does not synthesize provider dispatch.
+- [x] Tests: extend the two existing collect-site tests to assert the resolve and commit offsets alongside `auction_wait_ms`.
+- [x] `cargo test-fastly`, commit.
+
+### Task 3: Row columns, datasource, fixture
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/access_telemetry.rs`
+- Create: `tinybird/datasources/access_logs_v2.datasource`
+- Create: `tinybird/fixtures/access_logs_v2.ndjson`
+
+- [x] `access_event_row`: add the three offset keys and `auction_id`, all nullable, after the existing phase keys.
+- [x] Extend `row_serializes_nulls_for_missing_phases` (including `auction_id` in the nullable-column loop) and `row_serializes_recorded_phases_as_numbers` for the new keys.
+- [x] Datasource: four schema columns with JSONPaths (`Nullable(UInt32)` ×3, `Nullable(UUID)`) on the new `access_logs_v2` datasource. Preserve the legacy nine-column datasource without a forward query or backfill.
+- [x] Fixture: extend the existing row with a full timeline reusing the `auction_events_raw` fixture's UUID so the pair demonstrates the join, and add a second row covering the no-auction case.
+- [x] Full gates: fmt, clippy (all six), test-fastly/axum/cloudflare/spin, parity. Commit.
+
+### Task 4: Spec amendment
+
+**Files:**
+
+- Modify: `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md`
+
+- [x] Section 18: mark table including `set_auction_id`, the per-source instrumentation table, the null-semantics table, and the `Nullable(UUID)` rationale.
+- [x] Section 18: correct the interpretation ladder so `time_elapsed_ms` is not shown last, since on a streamed body the headers commit before the seam collect.
+- [x] Section 18: state the `R - D` versus `total_time_ms` reconciliation caveat and give the join query.
+- [x] Section 9: add the four columns so the canonical column list the row builder's doc comment points at stays complete.
+- [x] Docs format (`cd docs && npm run format`).
diff --git a/docs/superpowers/plans/2026-10-18-prebid-eid-capture-fidelity.md b/docs/superpowers/plans/2026-10-18-prebid-eid-capture-fidelity.md
new file mode 100644
index 0000000000..6a2d86f2bb
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-18-prebid-eid-capture-fidelity.md
@@ -0,0 +1,5477 @@
+# Prebid EID Fidelity Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make the `trustedServer` Prebid adapter forward to `/auction`, and copy into `ts-eids`, exactly the EIDs Prebid.js gives that bidder, with their OpenRTB 2.6 EID-level fields. Validate them once on the server, forward browser entries as sent, and ingest into KV only the set the auction used.
+
+**Architecture:** A new pure TSJS module (`integrations/prebid/eids.ts`) copies `bidderRequest.ortb2.user.ext.eids` and `user.eids` as plain data within a 64 KiB UTF-8 budget. It also builds the `ts-eids` cookie value from that set without EID-level `ext`. The adapter writes or clears the cookie in `buildRequests`, and a `tcf2Enforcement` listener clears it when Prebid's TCF rules block `trustedServer`. On the server, a new `ec/client_eids.rs` parser validates each body or cookie entry on its own. `merge_auction_eids` forwards browser entries unchanged and adds KV entries only for registered sources the browser did not send. Finalization ingests only the auction's own client set on `/auction`. TS stops writing Prebid `userSync` settings, which fixes the forced `auctionDelay: 0`.
+
+**Tech Stack:** Rust 1.95 (`trusted-server-core`, `trusted-server-adapter-fastly`), serde_json 1.0.150 with `raw_value`, TypeScript + Vitest 4.0.18, jsdom 28.1.0, Prebid.js 10.26.0 (bundled npm dependency).
+
+**Spec:** `docs/superpowers/specs/2026-10-18-prebid-eid-fidelity-design.md` (branch `spec/1246-prebid-eid-fidelity`). Read it before starting. Section numbers in this plan (for example "spec 4.4") refer to it. Where this plan and the spec disagree, the spec wins. Stop and report the disagreement instead of picking one.
+
+## Global Constraints
+
+Copied from the spec. Every task implicitly includes these.
+
+- Follow `AGENTS.md` at the repo root for commands, style, error handling and CI gates. Bare `cargo test` / `cargo build` fail at the workspace root by design; use the aliases.
+- Prebid.js is pinned to **10.26.0** by `crates/trusted-server-js/lib/package-lock.json`. Read Prebid behavior from `crates/trusted-server-js/lib/node_modules/prebid.js/`, not from a newer checkout.
+- **`ts-eids` stays.** It remains a browser-written first-party cookie that TS reads before KV (product requirement, spec O1). **`x-ts-eids` stays** (spec G7). Never remove either.
+- **No new configuration** (spec 4.10). `MAX_AUCTION_EIDS_BYTES` and the server limits are constants.
+- TSJS budget: `MAX_AUCTION_EIDS_BYTES = 65,536`, measured in UTF-8 bytes with `TextEncoder`, never with JavaScript string length.
+- Cookie: at most **3,072** encoded bytes; attributes exactly `Path=/; Secure; SameSite=Lax; Max-Age=86400`; standard padded base64 of the UTF-8 bytes of the JSON array; never EID-level `ext`.
+- Server rules (spec 4.4): `source`, `inserter`, `matcher` are strings, not blank by `str::trim`, at most **255** UTF-8 bytes. `uids[].id` is a string, not blank, at most **512** bytes. `atype` and `mm` are integers from **0 to 2,147,483,647** (`4`, `4.0` and `4e0` are equal). UID-level and EID-level `ext` are JSON objects of at most **2,048** bytes as compact JSON. Keep the first **32** valid UIDs per entry and the first **64** entries after dropping duplicates.
+- TSJS does no EID validation beyond serialization. The server validates body and cookie with one parser.
+- Never log UID values, in TSJS or Rust. Logs carry source names, field names and counts only.
+- Never read `bidderRequest.auctionId`. Prebid hides it from adapters by default.
+- Use only example or fictional data in code, tests, comments and docs (`example.com` domains). The real Prebid source names the spec lists (`adserver.org`, `liveramp.com`, `pubcid.org`, `id5-sync.com`, `51d.es`) are public protocol identifiers and may appear in tests that model those modules.
+- Test discipline (spec 7.1), checked in every task:
+  1. **Red first.** Run each new test against unchanged code and see it fail for the expected reason. For a regression net that already passes, temporarily revert the line it guards, see it fail, then restore. Record every red result in the red log (see "Before you start").
+  2. **Pair absence with presence.** Every "X is missing" assertion sits next to a "control Y is present" assertion on the same request, cookie or output.
+  3. **Compare EID payloads whole:** `toEqual` in Vitest, full `serde_json::Value` equality in Rust. No `objectContaining`, `toMatchObject`, `.contains()` or length-only checks on EID payloads.
+  4. **Check the cookie environment.** Preset a cookie and read it back before asserting "cleared" or "unchanged".
+  5. **Use raw JSON text** in Rust parser tests where spelling matters (`4.0`, `4e0`, `-0`, large numbers, lone surrogates, exact byte lengths). This is an intended exception to the `json!` preference in `AGENTS.md`.
+  6. **Write Rust test literals that assert EID-level fields with every `Eid` field spelled out.** Never use `..Default::default()` there.
+- Commits: sentence case, imperative, no `fix:`/`feat:` prefixes, no bracketed tags, `git commit --signoff -S`, multiple `-m` flags for paragraphs, no heredoc, no AI attribution lines. Commit only on the implementation branch.
+
+---
+
+## Background
+
+Read spec sections 1 (defects D1 to D9), 3.2 (how Prebid builds a bidder's EIDs), 3.4 (current data flow), 3.7 (TCF and the `trustedServer` adapter) and 4 (architecture). In short:
+
+- The shim's `collectAuctionEids()` (`crates/trusted-server-js/lib/src/integrations/prebid/index.ts:1891-1914`) reads `pbjs.getUserIdsAsEids()`. That returns IDs restricted to other bidders and IDs Prebid redacted for `trustedServer` (D1). It also misses everything set through `ortb2` (D2), and drops `inserter`, `matcher`, `mm` and EID-level `ext` (D3).
+- `buildRequests` (`index.ts:2357`) ignores its second argument, `bidderRequest`. Its `ortb2` is exactly what Prebid lets `trustedServer` see, already scoped and redacted.
+- `syncPrebidEidsCookie()` (`index.ts:2982-3009`) rebuilds the cookie in `bidsBackHandler` from a different call (D5).
+- `installUserIdModules()` (`index.ts:2881-2898`) forces `auctionDelay: 0` and other `userSync` values on `window.load` (D4).
+- Rust: `Eid` (`crates/trusted-server-core/src/openrtb.rs:66-75`) has only `source` and `uids`. The body parser (`auction/endpoints.rs:491-562`) and cookie parser (`ec/prebid_eids.rs:33-47`, `:282-322`) validate differently, and one bad string fails the whole body (D8). `merge_auction_eids` (`auction/endpoints.rs:564-622`) folds by source with KV first (D9). Finalization ingests the cookie next to the body on `/auction` (`ec/finalize.rs:80-90`).
+
+The staged `fix/1246` work mentioned in older notes is superseded (spec O4). Do not commit it or build on it. Branch `fix/1246-collect-ortb2-eids` has no commits beyond `main`.
+
+## File map
+
+| File                                                                                                                                 | Responsibility                                       | Tasks      |
+| ------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- | ---------- |
+| `Cargo.toml` (workspace, line 105)                                                                                                   | serde_json `raw_value` feature                       | 2          |
+| `crates/trusted-server-core/src/openrtb.rs`                                                                                          | `Eid` fields, `PartialEq`, `Eid::new`                | 1          |
+| `crates/trusted-server-core/src/ec/client_eids.rs` (new)                                                                             | The one parser for body and cookie entries           | 2          |
+| `crates/trusted-server-core/src/ec/mod.rs`                                                                                           | `pub(crate) mod client_eids;`                        | 2          |
+| `crates/trusted-server-core/src/migration_guards.rs`                                                                                 | Fastly-SDK guard list entry                          | 2          |
+| `crates/trusted-server-core/src/auction/formats.rs`                                                                                  | `AdRequest.eids` as raw JSON; `x-ts-eids` test       | 1, 3       |
+| `crates/trusted-server-core/src/auction/endpoints.rs`                                                                                | Body/cookie resolution, merge, endpoint tests        | 1, 3, 4, 5 |
+| `crates/trusted-server-core/src/ec/prebid_eids.rs`                                                                                   | Cookie decode through the shared parser; diagnostics | 1, 3, 5    |
+| `crates/trusted-server-core/src/ec/finalize.rs`                                                                                      | KV ingestion input selection                         | 1, 5       |
+| `crates/trusted-server-core/src/publisher.rs`                                                                                        | Navigation/page-bids merge test                      | 4          |
+| `crates/trusted-server-core/src/{ec/eids.rs, ec/identify.rs, auction/test_support.rs, integrations/prebid.rs}`                       | `Eid::new` call sites                                | 1          |
+| `crates/trusted-server-core/src/integrations/{prebid.rs, aps.rs}`, `src/auction/openrtb/tests.rs`                                    | Outbound serialization tests                         | 1          |
+| `crates/trusted-server-adapter-fastly/src/app.rs`                                                                                    | Adapter-layer cookie extraction test                 | 5          |
+| `crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt`, `ts-eids-cookie.txt` (new)                                       | Cross-language fixtures                              | 3, 6, 7    |
+| `crates/trusted-server-js/lib/src/integrations/prebid/eids.ts` (new)                                                                 | Collector, cookie value fitting and encoding         | 6          |
+| `crates/trusted-server-js/lib/test/integrations/prebid/eids.test.ts` (new)                                                           | Unit tests for `eids.ts`                             | 6          |
+| `crates/trusted-server-js/lib/src/core/auction.ts`                                                                                   | `AuctionEid` becomes `unknown`                       | 7          |
+| `crates/trusted-server-js/lib/src/integrations/prebid/index.ts`                                                                      | Adapter glue, TCF listener, deletions                | 7, 8       |
+| `crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts`                                                                | Canary, adapter tests, self-init tests               | 7, 8       |
+| `crates/trusted-server-js/lib/test/core/request.test.ts`                                                                             | `requestAds` sends no `eids`                         | 7          |
+| `crates/trusted-server-js/lib/test/prebid-eid-fidelity.test.mjs` (new)                                                               | Real-Prebid JSDOM arms (spec 7.5)                    | 9          |
+| `crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.{ts,json}`, `test/integrations/prebid/user_id_modules.test.ts` | Delete resolver and `eidSources` (O6)                | 10         |
+| `docs/guide/integrations/prebid.md`, `lockr.md`, `edge-cookies.md`, `ec-setup-guide.md`, `api-reference.md`, `configuration.md`      | Docs (spec 8.6)                                      | 11         |
+| `docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md` (new)                                                      | Red log (spec 7.1 rule 1, A12)                       | all        |
+
+Commit order follows spec 8.1: Rust (Tasks 1 to 5), TSJS (6 to 8), the real-Prebid suite (9), registry (10), docs (11). All of it ships as one pull request.
+
+## Before you start
+
+- [ ] **Step 1: Create the implementation branch from the spec branch.**
+
+The spec and this plan live on `spec/1246-prebid-eid-fidelity`. They must be committed there before you branch. If `git status --short` in that branch's checkout still lists them as untracked, stop and ask the user to commit the spec PR first.
+
+Use superpowers:using-git-worktrees to create a worktree for a new branch `feat/1246-prebid-eid-fidelity` cut from `spec/1246-prebid-eid-fidelity`. All commands below run from that worktree's root unless a step says otherwise.
+
+- [ ] **Step 2: Confirm the baseline is green.**
+
+Run:
+
+```bash
+cargo test-fastly
+(cd crates/trusted-server-js/lib && npm ci && npx vitest run)
+```
+
+Expected: both PASS. If either fails, stop and report. Do not build on a red baseline.
+
+- [ ] **Step 3: Create the red log.**
+
+Create `docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md`:
+
+```markdown
+# Prebid EID Fidelity Implementation Notes
+
+Red log for the tests this work adds or changes (spec 7.1 rule 1, A12). Each
+entry names the test, the command, and the failure seen before the change, or,
+for a regression net, the line temporarily reverted and the failure it caused.
+
+## Environment
+
+- Date: <YYYY-MM-DD>
+- Branch: `feat/1246-prebid-eid-fidelity`
+- Rust: <output of `rustc --version`>
+- Node: <output of `node --version`>
+```
+
+Fill in the three values. Every "Run it and see it fail" step below appends a `## Task N` section with this shape:
+
+````markdown
+## Task N: <task name>
+
+Command:
+
+```bash
+<the exact command>
+```
+
+Failures:
+
+- `<test name>`: <the assertion or compiler message, one line>
+````
+
+Keep only the identifying line of each failure, not whole stack traces, and never paste UID values from real pages.
+
+---
+
+## Rust test commands
+
+Core and Fastly adapter tests run on `wasm32-wasip1` under Viceroy through `cargo test-fastly`. **`cargo test-axum` does not run core tests.** To filter, put the name after `--`, for example `cargo test-fastly -- client_eids`. The filter applies to every test binary in the alias.
+
+---
+
+### Task 1: `Eid` carries OpenRTB 2.6 EID-level fields
+
+Spec: 4.4 (last paragraph), 4.7, 7.4 ("Serialization", "`auction/formats.rs`"), A5, A11.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/openrtb.rs:66-88` (`Eid`, `Uid`) and its tests module (`:193`)
+- Modify: `crates/trusted-server-core/src/auction/test_support.rs` (shared EID fixture helpers)
+- Modify: every `Eid { … }` struct literal (26 literals in 9 files, listed in Step 5)
+- Test: `crates/trusted-server-core/src/openrtb.rs`, `src/auction/formats.rs`, `src/integrations/prebid.rs`, `src/integrations/aps.rs`, `src/auction/openrtb/tests.rs`
+
+**Interfaces:**
+
+- Produces:
+
+  ```rust
+  #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+  #[serde(deny_unknown_fields)]
+  pub struct Eid {
+      pub source: String,
+      pub uids: Vec<Uid>,
+      pub inserter: Option<String>,
+      pub matcher: Option<String>,
+      pub mm: Option<i32>,
+      pub ext: Option<serde_json::Value>,
+  }
+  impl Eid { pub fn new(source: String, uids: Vec<Uid>) -> Self }
+  // Uid gains PartialEq; its fields are unchanged.
+  ```
+
+  Test helpers in `crate::auction::test_support`: `repeated_source_provenance_eids() -> Vec<Eid>` and `repeated_source_provenance_eids_json() -> serde_json::Value`.
+
+- [ ] **Step 1: Add the shared test helpers.**
+
+Append to `crates/trusted-server-core/src/auction/test_support.rs`. Add `use serde_json::json;` to its imports if it is not there. `Eid` and `Uid` are already imported, since line 95 builds an `Eid`.
+
+```rust
+/// Two entries for one source with different EID-level fields, the way
+/// Prebid sends them (spec 3.2), for outbound serialization tests.
+pub(crate) fn repeated_source_provenance_eids() -> Vec<Eid> {
+    vec![
+        Eid {
+            source: "ids.example.com".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
+            }],
+            inserter: Some("inserter-a.example.com".to_string()),
+            matcher: Some("ids.example.com".to_string()),
+            mm: Some(4),
+            ext: None,
+        },
+        Eid {
+            source: "ids.example.com".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
+            }],
+            inserter: Some("inserter-b.example.com".to_string()),
+            matcher: Some("matcher-b.example.com".to_string()),
+            mm: Some(2),
+            ext: Some(json!({ "segments": ["s1"] })),
+        },
+    ]
+}
+
+/// [`repeated_source_provenance_eids`] as the JSON every outbound path must
+/// emit in `user.ext.eids`.
+pub(crate) fn repeated_source_provenance_eids_json() -> serde_json::Value {
+    json!([
+        {
+            "source": "ids.example.com",
+            "uids": [{ "id": "fictional-uid", "atype": 1 }],
+            "inserter": "inserter-a.example.com",
+            "matcher": "ids.example.com",
+            "mm": 4
+        },
+        {
+            "source": "ids.example.com",
+            "uids": [{ "id": "fictional-uid", "atype": 1 }],
+            "inserter": "inserter-b.example.com",
+            "matcher": "matcher-b.example.com",
+            "mm": 2,
+            "ext": { "segments": ["s1"] }
+        }
+    ])
+}
+```
+
+- [ ] **Step 2: Write the failing tests.**
+
+In the `tests` module of `src/openrtb.rs` (add `use serde_json::json;` if missing):
+
+```rust
+    #[test]
+    fn eid_serializes_openrtb_provenance_fields_when_present() {
+        let eid = Eid {
+            source: "ids.example.com".to_owned(),
+            uids: vec![Uid {
+                id: "uid-1".to_owned(),
+                atype: Some(1),
+                ext: Some(json!({ "rtiPartner": "TDID" })),
+            }],
+            inserter: Some("inserter.example.com".to_owned()),
+            matcher: Some("matcher.example.com".to_owned()),
+            mm: Some(4),
+            ext: Some(json!({ "segments": ["s1"] })),
+        };
+
+        let serialized = serde_json::to_value(&eid).expect("should serialize EID");
+
+        assert_eq!(
+            serialized,
+            json!({
+                "source": "ids.example.com",
+                "uids": [{ "id": "uid-1", "atype": 1, "ext": { "rtiPartner": "TDID" } }],
+                "inserter": "inserter.example.com",
+                "matcher": "matcher.example.com",
+                "mm": 4,
+                "ext": { "segments": ["s1"] }
+            }),
+            "should serialize every EID-level field"
+        );
+    }
+
+    #[test]
+    fn eid_without_provenance_fields_serializes_as_before() {
+        let eid = Eid::new(
+            "ids.example.com".to_owned(),
+            vec![Uid {
+                id: "uid-1".to_owned(),
+                atype: Some(1),
+                ext: None,
+            }],
+        );
+
+        let serialized = serde_json::to_string(&eid).expect("should serialize EID");
+
+        assert_eq!(
+            serialized, r#"{"source":"ids.example.com","uids":[{"id":"uid-1","atype":1}]}"#,
+            "an EID without EID-level fields should serialize byte-identically to before"
+        );
+    }
+
+    #[test]
+    fn eid_deserializes_provenance_fields_and_keeps_rejecting_unknown_keys() {
+        let parsed: Eid = serde_json::from_str(
+            r#"{"source":"ids.example.com","uids":[{"id":"uid-1"}],"inserter":"inserter.example.com","matcher":"matcher.example.com","mm":3,"ext":{"k":"v"}}"#,
+        )
+        .expect("should deserialize EID-level fields");
+
+        assert_eq!(
+            parsed,
+            Eid {
+                source: "ids.example.com".to_owned(),
+                uids: vec![Uid {
+                    id: "uid-1".to_owned(),
+                    atype: None,
+                    ext: None,
+                }],
+                inserter: Some("inserter.example.com".to_owned()),
+                matcher: Some("matcher.example.com".to_owned()),
+                mm: Some(3),
+                ext: Some(json!({ "k": "v" })),
+            },
+            "should read every EID-level field"
+        );
+        assert!(
+            serde_json::from_str::<Eid>(r#"{"source":"ids.example.com","uids":[],"unknown":1}"#)
+                .is_err(),
+            "should keep deny_unknown_fields"
+        );
+    }
+```
+
+In the `tests` module of `src/auction/formats.rs` (it already imports `Eid`, `Uid` and `json`; add `use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};` and `use crate::auction::test_support::{repeated_source_provenance_eids, repeated_source_provenance_eids_json};` if missing). Put it next to `response_includes_eid_headers_when_eids_present` (`:813`):
+
+```rust
+    #[test]
+    fn eid_header_carries_provenance_fields_and_repeated_sources() {
+        let mut request = make_auction_request();
+        request.user.eids = Some(repeated_source_provenance_eids());
+
+        let response =
+            convert_to_openrtb_response(&make_empty_result(), &make_settings(), &request, true)
+                .expect("should build response");
+
+        let header = response
+            .headers()
+            .get(&HEADER_X_TS_EIDS)
+            .and_then(|value| value.to_str().ok())
+            .expect("should include x-ts-eids");
+        let decoded: serde_json::Value = serde_json::from_slice(
+            &BASE64.decode(header).expect("should decode x-ts-eids base64"),
+        )
+        .expect("should parse x-ts-eids JSON");
+        assert_eq!(
+            decoded,
+            repeated_source_provenance_eids_json(),
+            "x-ts-eids should show both entries with their own EID-level fields"
+        );
+    }
+```
+
+In `src/integrations/prebid.rs` tests, next to `to_openrtb_includes_eids_from_auction_request` (`:6862`), importing the two helpers from `crate::auction::test_support`:
+
+```rust
+    #[test]
+    fn to_openrtb_forwards_eid_provenance_fields_and_repeated_sources() {
+        let provider = PrebidAuctionProvider::new(base_config());
+        let mut auction_request = create_test_auction_request();
+        auction_request.user.eids = Some(repeated_source_provenance_eids());
+        let settings = make_settings();
+        let request = build_test_request();
+        let context = create_test_auction_context(&settings, &request);
+
+        let openrtb = provider.to_openrtb(
+            &auction_request,
+            &context,
+            None,
+            make_request_info(&context),
+        );
+
+        let serialized = serde_json::to_value(&openrtb).expect("should serialize OpenRTB request");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"],
+            repeated_source_provenance_eids_json(),
+            "Prebid Server should receive both entries with their own EID-level fields"
+        );
+    }
+```
+
+In `src/integrations/aps.rs` tests, next to `builds_aps_openrtb_request_with_explicit_privacy_policy` (`:2309`):
+
+```rust
+    #[test]
+    fn aps_request_forwards_eid_provenance_fields_and_repeated_sources() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut auction_request = canonical_parity_auction_request();
+        auction_request.user.eids = Some(repeated_source_provenance_eids());
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            transport_timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let openrtb = provider.build_openrtb_request(&auction_request, &context);
+
+        let serialized = serde_json::to_value(&openrtb).expect("should serialize request");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"],
+            repeated_source_provenance_eids_json(),
+            "APS should receive both entries with their own EID-level fields"
+        );
+    }
+```
+
+In `src/auction/openrtb/tests.rs` (the config-first path, `auction/openrtb.rs:372`):
+
+```rust
+#[test]
+fn standard_profile_forwards_eid_provenance_fields_and_repeated_sources() {
+    let mut request = canonical_parity_auction_request();
+    request.user.eids = Some(crate::auction::test_support::repeated_source_provenance_eids());
+
+    let built = build_with_request("standard", json!({}), request, None);
+
+    let serialized = serde_json::to_value(&built).expect("should serialize request");
+    assert_eq!(
+        serialized["user"]["ext"]["eids"],
+        crate::auction::test_support::repeated_source_provenance_eids_json(),
+        "config-first providers should receive both entries with their own EID-level fields"
+    );
+}
+```
+
+- [ ] **Step 3: Run them and see them fail.**
+
+Run: `cargo test-fastly --no-run 2>&1 | grep -E "^error" | sort | uniq -c`
+Expected: compile errors `struct 'Eid' has no field named 'inserter'` (also `matcher`, `mm`, `ext`), `no function or associated item named 'new'`, and `binary operation '==' cannot be applied to type 'Eid'`. Record them in the red log under `## Task 1`.
+
+- [ ] **Step 4: Extend `Eid` and `Uid`.**
+
+Replace `Eid` and the derive line of `Uid` in `src/openrtb.rs`:
+
+````rust
+/// An Extended User ID entry from an identity provider.
+///
+/// Mirrors `OpenRTB` 2.6 §3.2.27. Browser entries keep the EID-level fields
+/// Prebid set; KV-resolved entries leave them empty.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Eid {
+    /// Identity provider domain (e.g. `"id5-sync.com"`).
+    pub source: String,
+    /// One or more user IDs from this provider.
+    pub uids: Vec<Uid>,
+    /// Entity that inserted the IDs into the request (`eid.inserter`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub inserter: Option<String>,
+    /// Entity that matched the IDs (`eid.matcher`). Absent means `source`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub matcher: Option<String>,
+    /// Match method (`eid.mm`). Vendor values from 500 up are passed through.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mm: Option<i32>,
+    /// Provider-specific extension data, e.g. `LiveIntent` `segments`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ext: Option<Value>,
+}
+
+impl Eid {
+    /// Builds an [`Eid`] without EID-level fields.
+    ///
+    /// Use this for EIDs that never carry provenance, such as KV-resolved
+    /// partner IDs.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use trusted_server_core::openrtb::{Eid, Uid};
+    ///
+    /// let eid = Eid::new(
+    ///     "ids.example.com".to_owned(),
+    ///     vec![Uid { id: "uid-1".to_owned(), atype: Some(1), ext: None }],
+    /// );
+    /// assert_eq!(eid.inserter, None);
+    /// ```
+    #[must_use]
+    pub fn new(source: String, uids: Vec<Uid>) -> Self {
+        Self {
+            source,
+            uids,
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
+    }
+}
+````
+
+and change `Uid`'s derive to `#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]`.
+
+- [ ] **Step 5: Replace every struct literal with `Eid::new`.**
+
+Run: `cargo test-fastly --no-run 2>&1 | grep -E "missing fields .*inserter" -A3`
+
+Convert each flagged `Eid { source: S, uids: U }` to `Eid::new(S, U)`. Do not add values. The compiler should flag these 26 literals (`git grep -n "Eid {" crates/trusted-server-core/src` lists them):
+
+| File                      | Lines                                    | Kind                                          |
+| ------------------------- | ---------------------------------------- | --------------------------------------------- |
+| `auction/endpoints.rs`    | 533, 585                                 | production (rewritten again in Tasks 3 and 4) |
+| `auction/endpoints.rs`    | 1657, 1666, 1674, 1695, 1703, 1722, 1730 | tests (rewritten in Task 4)                   |
+| `auction/formats.rs`      | 816                                      | test                                          |
+| `auction/test_support.rs` | 95                                       | test helper                                   |
+| `ec/eids.rs`              | 67                                       | production (`to_eids`)                        |
+| `ec/identify.rs`          | 127                                      | production                                    |
+| `ec/finalize.rs`          | 1118, 1520, 1528, 1598                   | tests                                         |
+| `ec/prebid_eids.rs`       | 297, 328                                 | production (297 is deleted in Task 3)         |
+| `ec/prebid_eids.rs`       | 639, 647                                 | tests                                         |
+| `integrations/prebid.rs`  | 6866, 6874, 6882                         | tests                                         |
+| `openrtb.rs`              | 396, 420                                 | tests                                         |
+
+For example, `ec/eids.rs:67` becomes:
+
+```rust
+        .map(|item| {
+            Eid::new(
+                item.source_domain.clone(),
+                vec![Uid {
+                    id: item.uid.clone(),
+                    atype: Some(item.openrtb_atype),
+                    ext: None,
+                }],
+            )
+        })
+```
+
+and `auction/endpoints.rs:585` becomes `merged.push(Eid::new(eid.source.clone(), Vec::new()));`. `trusted-server-openrtb/src/generated.rs` has its own, unrelated `Eid`. Leave it alone.
+
+Run `cargo check-axum && cargo check-cloudflare` as well, since target-gated code may hold more literals.
+
+- [ ] **Step 6: Run the tests.**
+
+Run: `cargo test-fastly -- eid`
+Expected: PASS, including the five new tests.
+
+Then run the golden serialization tests unchanged (A5): `cargo test-fastly -- golden wire_fixture builds_aps_openrtb_request`
+Expected: PASS with no edits to `integrations/prebid.rs:9994`, `:10033`, `integrations/aps.rs:2400` or the fixtures in `auction/openrtb/tests.rs`. If any golden string needs editing, stop: serialization is no longer byte-identical.
+
+- [ ] **Step 7: Gates and commit.**
+
+Run: `cargo fmt --all -- --check && cargo clippy-fastly && cargo clippy-axum && cargo test-fastly`
+Expected: clean.
+
+```bash
+git add crates/trusted-server-core/src docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Carry OpenRTB EID-level fields on Eid" -m "Eid gains inserter, matcher, mm and ext, each skipped when absent, so serialization without them is byte-identical. Eid::new replaces the struct literals that never carry these fields."
+```
+
+---
+
+### Task 2: One parser for browser EIDs
+
+Spec: 4.4 (the rules table and notes), 7.1 rules 7 and 10, 7.4 (`ec/client_eids.rs`, `migration_guards.rs`).
+
+**Files:**
+
+- Modify: `Cargo.toml:105` (workspace)
+- Create: `crates/trusted-server-core/src/ec/client_eids.rs`
+- Modify: `crates/trusted-server-core/src/ec/mod.rs:32-51` (module list)
+- Modify: `crates/trusted-server-core/src/migration_guards.rs:76-92` (guard list)
+
+**Interfaces:**
+
+- Consumes: `Eid`, `Uid` (Task 1); `crate::ec::kv_types::MAX_UID_LENGTH` (512).
+- Produces, in `crate::ec::client_eids`:
+
+  ```rust
+  pub(crate) const MAX_CLIENT_EID_ENTRIES: usize = 64;
+  pub(crate) const MAX_CLIENT_UIDS_PER_ENTRY: usize = 32;
+  pub(crate) const MAX_CLIENT_EID_LABEL_BYTES: usize = 255;
+  pub(crate) const MAX_CLIENT_EID_EXT_BYTES: usize = 2048;
+  pub(crate) fn parse_client_eids(raw: &serde_json::value::RawValue) -> Vec<Eid>;
+  ```
+
+  Task 3 calls `parse_client_eids` for the body and the cookie. Per spec 8.4, if PR #1382 lands first, this becomes `pub`.
+
+- [ ] **Step 1: Enable `raw_value` and add the module with a stub.**
+
+In the workspace `Cargo.toml`, change line 105 from `serde_json = "1.0.149"` to:
+
+```toml
+serde_json = { version = "1.0.149", features = ["raw_value"] }
+```
+
+In `src/ec/mod.rs`, add `pub(crate) mod client_eids;` in alphabetical order, after `pub mod batch_sync;`.
+
+In `src/migration_guards.rs`, add after the `"ec/batch_sync.rs"` entry:
+
+```rust
+        ("ec/client_eids.rs", include_str!("ec/client_eids.rs")),
+```
+
+Create `src/ec/client_eids.rs` with the module doc, the constants and a stub, so the tests in Step 2 compile and fail on their assertions:
+
+```rust
+//! Parsing and validation of browser-supplied EIDs.
+//!
+//! The `/auction` request body and the `ts-eids` cookie carry the same
+//! OpenRTB-style EID array, which TSJS copies from the EIDs Prebid placed in
+//! the `trustedServer` bidder request. Both go through [`parse_client_eids`],
+//! so a malformed entry or field costs only itself, whichever transport or
+//! client sent it.
+//!
+//! Rules, per entry:
+//!
+//! - The entry parses on its own and is a JSON object, or it is dropped.
+//! - `source` is a string, not blank, at most [`MAX_CLIENT_EID_LABEL_BYTES`]
+//!   UTF-8 bytes, or the entry is dropped.
+//! - `uids` holds at least one valid UID, or the entry is dropped. The first
+//!   [`MAX_CLIENT_UIDS_PER_ENTRY`] valid UIDs are kept.
+//! - `uids[].id` is a string, not blank, at most `MAX_UID_LENGTH` bytes, or
+//!   the UID is dropped. `uids[].atype` is an integer from 0 to `i32::MAX`;
+//!   `uids[].ext` is an object of at most [`MAX_CLIENT_EID_EXT_BYTES`] as
+//!   compact JSON. An invalid `atype` or `ext` drops only that field.
+//! - `inserter` and `matcher` follow the `source` rule, `mm` the `atype` rule
+//!   and `ext` the UID `ext` rule. An invalid value drops only that field.
+//! - Unknown keys are ignored. Order is preserved and a source may repeat.
+//!
+//! An entry equal to an earlier kept entry is dropped, and then the first
+//! [`MAX_CLIENT_EID_ENTRIES`] entries are kept. "Blank" means empty or only
+//! whitespace by `str::trim`. "Integer" means a JSON number with no fractional
+//! part, so `4`, `4.0` and `4e0` are the same value.
+
+use serde_json::Value as JsonValue;
+use serde_json::value::RawValue;
+
+use crate::openrtb::{Eid, Uid};
+
+use super::kv_types::MAX_UID_LENGTH;
+
+/// Maximum number of entries kept from one browser EID array.
+pub(crate) const MAX_CLIENT_EID_ENTRIES: usize = 64;
+
+/// Maximum number of valid UIDs kept per entry.
+pub(crate) const MAX_CLIENT_UIDS_PER_ENTRY: usize = 32;
+
+/// Maximum UTF-8 length of `source`, `inserter` and `matcher`.
+pub(crate) const MAX_CLIENT_EID_LABEL_BYTES: usize = 255;
+
+/// Maximum compact-JSON length of an EID-level or UID-level `ext` object.
+pub(crate) const MAX_CLIENT_EID_EXT_BYTES: usize = 2048;
+
+/// Parses and validates browser-supplied EID entries from an `/auction` body
+/// or a `ts-eids` cookie.
+///
+/// See the module documentation for the rules.
+#[must_use]
+pub(crate) fn parse_client_eids(raw: &RawValue) -> Vec<Eid> {
+    let _ = (raw, MAX_UID_LENGTH);
+    Vec::new()
+}
+```
+
+The stub's `let _ = …` keeps the imports used. Step 4 replaces it.
+
+- [ ] **Step 2: Write the failing tests.**
+
+Append to `src/ec/client_eids.rs`. Inputs whose JSON spelling matters are raw text (spec 7.1 rule 7). Expected outputs are full `serde_json::Value`s.
+
+```rust
+#[cfg(test)]
+mod tests {
+    use std::sync::{Mutex, Once};
+
+    use serde_json::json;
+
+    use super::*;
+
+    fn parse(text: &str) -> Vec<Eid> {
+        let raw = RawValue::from_string(text.to_owned()).expect("should capture raw JSON");
+        parse_client_eids(&raw)
+    }
+
+    fn parsed_json(text: &str) -> JsonValue {
+        serde_json::to_value(parse(text)).expect("should serialize parsed EIDs")
+    }
+
+    fn good(source: &str) -> String {
+        format!(r#"{{"source":"{source}","uids":[{{"id":"uid-{source}"}}]}}"#)
+    }
+
+    fn good_json(source: &str) -> JsonValue {
+        json!({ "source": source, "uids": [{ "id": format!("uid-{source}") }] })
+    }
+
+    /// An `ext` object whose compact JSON is exactly `bytes` long.
+    fn ext_of_len(bytes: usize) -> String {
+        // `{"k":""}` is 8 bytes.
+        format!(r#"{{"k":"{}"}}"#, "x".repeat(bytes - 8))
+    }
+
+    static CAPTURED_LOGS: Mutex<Vec<String>> = Mutex::new(Vec::new());
+    static INSTALL_LOGGER: Once = Once::new();
+
+    struct CapturingLogger;
+
+    impl log::Log for CapturingLogger {
+        fn enabled(&self, metadata: &log::Metadata<'_>) -> bool {
+            metadata.level() <= log::Level::Debug
+        }
+
+        fn log(&self, record: &log::Record<'_>) {
+            if self.enabled(record.metadata()) {
+                CAPTURED_LOGS
+                    .lock()
+                    .expect("should lock captured logs")
+                    .push(record.args().to_string());
+            }
+        }
+
+        fn flush(&self) {}
+    }
+
+    fn install_capturing_logger() {
+        INSTALL_LOGGER.call_once(|| {
+            log::set_logger(&CapturingLogger).expect("should install the capturing test logger");
+            log::set_max_level(log::LevelFilter::Debug);
+        });
+    }
+
+    fn captured_logs() -> Vec<String> {
+        CAPTURED_LOGS
+            .lock()
+            .expect("should lock captured logs")
+            .clone()
+    }
+
+    #[test]
+    fn keeps_a_valid_entry_with_every_field() {
+        let parsed = parsed_json(
+            r#"[{"source":"ids.example.com","inserter":"inserter.example.com","matcher":"matcher.example.com","mm":4,"ext":{"segments":["s1"]},"uids":[{"id":"uid-1","atype":1,"ext":{"rtiPartner":"TDID"}}]}]"#,
+        );
+
+        assert_eq!(
+            parsed,
+            json!([{
+                "source": "ids.example.com",
+                "inserter": "inserter.example.com",
+                "matcher": "matcher.example.com",
+                "mm": 4,
+                "ext": { "segments": ["s1"] },
+                "uids": [{ "id": "uid-1", "atype": 1, "ext": { "rtiPartner": "TDID" } }]
+            }]),
+            "should keep every valid field"
+        );
+    }
+
+    #[test]
+    fn yields_nothing_for_a_payload_that_is_not_an_array() {
+        for text in [r#"{"source":"ids.example.com"}"#, r#""text""#, "null", "1", "true"] {
+            assert_eq!(parsed_json(text), json!([]), "should ignore non-array payload {text}");
+        }
+    }
+
+    #[test]
+    fn drops_only_the_entry_that_does_not_parse() {
+        // `\ud800` is a lone surrogate escape: serde_json rejects it when the
+        // element is parsed on its own.
+        let bad_entries = [
+            r#"{"source":"bad-\ud800.example.com","uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","uids":[{"id":"u-\ud800"}]}"#,
+            r#"{"source":"bad.example.com","inserter":"i-\ud800","uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","matcher":"m-\ud800","uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","ext":{"k-\ud800":1},"uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","ext":{"k":"v-\ud800"},"uids":[{"id":"u"}]}"#,
+            r#"{"source":"bad.example.com","uids":[{"id":"u","ext":{"k-\ud800":1}}]}"#,
+            r#"{"source":"bad.example.com","uids":[{"id":"u","ext":{"k":"v-\ud800"}}]}"#,
+        ];
+        for bad in bad_entries {
+            let text = format!("[{},{bad},{}]", good("a.example.com"), good("b.example.com"));
+
+            assert_eq!(
+                parsed_json(&text),
+                json!([good_json("a.example.com"), good_json("b.example.com")]),
+                "should drop only the unparsable entry {bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn drops_entries_that_are_not_objects() {
+        let text = format!(r#"[1,"text",null,[],true,{}]"#, good("a.example.com"));
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([good_json("a.example.com")]),
+            "should keep only the object entry"
+        );
+    }
+
+    #[test]
+    fn validates_source() {
+        let source_255 = format!("a{}", "é".repeat(127));
+        let source_256 = "é".repeat(128);
+        let text = format!(
+            r#"[{{"uids":[{{"id":"u"}}]}},{{"source":7,"uids":[{{"id":"u"}}]}},{{"source":"   ","uids":[{{"id":"u"}}]}},{{"source":"{source_256}","uids":[{{"id":"u"}}]}},{{"source":"{source_255}","uids":[{{"id":"u"}}]}}]"#
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([{ "source": source_255, "uids": [{ "id": "u" }] }]),
+            "should keep only a non-blank string source of at most 255 UTF-8 bytes"
+        );
+    }
+
+    #[test]
+    fn drops_an_entry_without_a_valid_uid() {
+        let text = format!(
+            r#"[{{"source":"no-uids.example.com"}},{{"source":"string-uids.example.com","uids":"u"}},{{"source":"empty-uids.example.com","uids":[]}},{{"source":"bad-uids.example.com","uids":[{{"id":""}},7]}},{}]"#,
+            good("a.example.com")
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([good_json("a.example.com")]),
+            "should drop entries whose uids hold no valid UID"
+        );
+    }
+
+    #[test]
+    fn validates_uid_ids() {
+        let id_512 = "x".repeat(512);
+        let id_513 = "x".repeat(513);
+        let text = format!(
+            r#"[{{"source":"ids.example.com","uids":[{{"id":7}},{{"id":"  "}},{{"id":"{id_513}"}},{{"atype":1}},{{"id":"{id_512}"}}]}}]"#
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([{ "source": "ids.example.com", "uids": [{ "id": id_512 }] }]),
+            "should keep only a non-blank string id of at most 512 bytes"
+        );
+    }
+
+    #[test]
+    fn keeps_the_first_32_valid_uids() {
+        let uids: Vec<String> = [r#"{"id":""}"#.to_owned(), r#"{"id":7}"#.to_owned()]
+            .into_iter()
+            .chain((0..33).map(|index| format!(r#"{{"id":"u{index}"}}"#)))
+            .collect();
+        let text = format!(r#"[{{"source":"ids.example.com","uids":[{}]}}]"#, uids.join(","));
+
+        let expected_uids: Vec<JsonValue> = (0..32).map(|index| json!({ "id": format!("u{index}") })).collect();
+        assert_eq!(
+            parsed_json(&text),
+            json!([{ "source": "ids.example.com", "uids": expected_uids }]),
+            "should keep the first 32 valid UIDs, not counting invalid ones"
+        );
+    }
+
+    #[test]
+    fn reads_atype_and_mm_as_integers_in_range() {
+        let accepted = [
+            ("4", 4),
+            ("4.0", 4),
+            ("4e0", 4),
+            ("-0", 0),
+            ("0", 0),
+            ("2147483647", 2_147_483_647),
+            ("2147483647.0", 2_147_483_647),
+            ("571187", 571_187),
+        ];
+        for (spelling, value) in accepted {
+            let text = format!(
+                r#"[{{"source":"ids.example.com","mm":{spelling},"uids":[{{"id":"u","atype":{spelling}}}]}}]"#
+            );
+
+            assert_eq!(
+                parsed_json(&text),
+                json!([{ "source": "ids.example.com", "mm": value, "uids": [{ "id": "u", "atype": value }] }]),
+                "should accept {spelling} as {value}"
+            );
+        }
+
+        let rejected = [
+            "2147483648",
+            "9007199254740993",
+            "18446744073709551616",
+            "1.5",
+            "-1",
+            "1e300",
+            r#""1""#,
+            "null",
+            "true",
+        ];
+        for spelling in rejected {
+            let text = format!(
+                r#"[{{"source":"ids.example.com","mm":{spelling},"uids":[{{"id":"u","atype":{spelling}}}]}}]"#
+            );
+
+            assert_eq!(
+                parsed_json(&text),
+                json!([{ "source": "ids.example.com", "uids": [{ "id": "u" }] }]),
+                "should drop only the fields for {spelling}"
+            );
+        }
+    }
+
+    #[test]
+    fn validates_ext_objects_and_their_size() {
+        let ext_2048 = ext_of_len(2048);
+        let ext_2049 = ext_of_len(2049);
+        let text = format!(
+            r#"[{{"source":"keep.example.com","ext":{ext_2048},"uids":[{{"id":"u","ext":{ext_2048}}}]}},{{"source":"big.example.com","ext":{ext_2049},"uids":[{{"id":"u","ext":{ext_2049}}}]}},{{"source":"shape.example.com","ext":[1],"uids":[{{"id":"u","ext":"text"}}]}}]"#
+        );
+        let kept_ext: JsonValue = serde_json::from_str(&ext_2048).expect("should parse ext");
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([
+                { "source": "keep.example.com", "ext": kept_ext, "uids": [{ "id": "u", "ext": kept_ext }] },
+                { "source": "big.example.com", "uids": [{ "id": "u" }] },
+                { "source": "shape.example.com", "uids": [{ "id": "u" }] }
+            ]),
+            "should keep objects of at most 2048 compact bytes and drop only the bad fields"
+        );
+    }
+
+    #[test]
+    fn validates_inserter_and_matcher() {
+        let label_255 = format!("a{}", "é".repeat(127));
+        let label_256 = "é".repeat(128);
+        let text = format!(
+            r#"[{{"source":"keep.example.com","inserter":"{label_255}","matcher":"{label_255}","uids":[{{"id":"u"}}]}},{{"source":"drop.example.com","inserter":"{label_256}","matcher":"  ","uids":[{{"id":"u"}}]}},{{"source":"type.example.com","inserter":7,"matcher":null,"uids":[{{"id":"u"}}]}}]"#
+        );
+
+        assert_eq!(
+            parsed_json(&text),
+            json!([
+                { "source": "keep.example.com", "inserter": label_255, "matcher": label_255, "uids": [{ "id": "u" }] },
+                { "source": "drop.example.com", "uids": [{ "id": "u" }] },
+                { "source": "type.example.com", "uids": [{ "id": "u" }] }
+            ]),
+            "should keep non-blank strings of at most 255 bytes and drop only the bad fields"
+        );
+    }
+
+    #[test]
+    fn drops_duplicates_before_the_entry_cap() {
+        let mut entries: Vec<String> = (0..64)
+            .map(|index| good(&format!("s{index}.example.com")))
+            .collect();
+        // Equal to entry 0 once validated: unknown keys are ignored.
+        entries.insert(
+            1,
+            r#"{"source":"s0.example.com","uids":[{"id":"uid-s0.example.com"}],"unknown":true}"#
+                .to_owned(),
+        );
+        let text = format!("[{}]", entries.join(","));
+
+        let expected: Vec<JsonValue> = (0..64)
+            .map(|index| good_json(&format!("s{index}.example.com")))
+            .collect();
+        assert_eq!(
+            parsed_json(&text),
+            JsonValue::Array(expected),
+            "a duplicate should not take one of the 64 places"
+        );
+    }
+
+    #[test]
+    fn keeps_the_first_64_entries() {
+        let entries: Vec<String> = (0..70)
+            .map(|index| good(&format!("s{index}.example.com")))
+            .collect();
+        let text = format!("[{}]", entries.join(","));
+
+        let expected: Vec<JsonValue> = (0..64)
+            .map(|index| good_json(&format!("s{index}.example.com")))
+            .collect();
+        assert_eq!(parsed_json(&text), JsonValue::Array(expected), "should keep the first 64 entries");
+    }
+
+    #[test]
+    fn keeps_order_and_repeated_sources_and_ignores_unknown_keys() {
+        let parsed = parsed_json(
+            r#"[{"source":"b.example.com","uids":[{"id":"u","unknown":1}],"unknown":2},{"source":"a.example.com","mm":1,"uids":[{"id":"u"}]},{"source":"a.example.com","mm":2,"uids":[{"id":"u"}]}]"#,
+        );
+
+        assert_eq!(
+            parsed,
+            json!([
+                { "source": "b.example.com", "uids": [{ "id": "u" }] },
+                { "source": "a.example.com", "mm": 1, "uids": [{ "id": "u" }] },
+                { "source": "a.example.com", "mm": 2, "uids": [{ "id": "u" }] }
+            ]),
+            "should keep wire order and both same-source entries"
+        );
+    }
+
+    #[test]
+    fn logs_dropped_entries_and_fields_by_name_and_source_without_values() {
+        install_capturing_logger();
+
+        let parsed = parsed_json(
+            r#"[{"source":"log-a.example.com","mm":-1,"uids":[{"id":"secret-uid-a","atype":"1"}]},{"source":"log-b.example.com","uids":[{"id":""}]}]"#,
+        );
+
+        assert_eq!(
+            parsed,
+            json!([{ "source": "log-a.example.com", "uids": [{ "id": "secret-uid-a" }] }]),
+            "should keep the entry and drop only its invalid fields"
+        );
+        let logs = captured_logs();
+        for (field, source) in [
+            ("`mm`", "log-a.example.com"),
+            ("`atype`", "log-a.example.com"),
+            ("without a valid UID", "log-b.example.com"),
+        ] {
+            assert!(
+                logs.iter().any(|line| line.contains(field) && line.contains(source)),
+                "should log {field} for {source}; captured: {logs:?}"
+            );
+        }
+        assert!(
+            !logs.iter().any(|line| line.contains("secret-uid-a")),
+            "should never log a UID value"
+        );
+    }
+}
+```
+
+The logger is process-global. Only this module installs one, and each assertion matches on a source name unique to its test, so parallel tests do not interfere.
+
+- [ ] **Step 3: Run them and see them fail.**
+
+Run: `cargo test-fastly -- client_eids`
+Expected: every test except `yields_nothing_for_a_payload_that_is_not_an_array` FAILS, because the stub returns no entries. Record the failures. That one passing test is a regression net: Step 4 must keep it passing.
+
+- [ ] **Step 4: Implement the parser.**
+
+Replace the stub `parse_client_eids` with:
+
+```rust
+/// Parses and validates browser-supplied EID entries from an `/auction` body
+/// or a `ts-eids` cookie.
+///
+/// See the module documentation for the rules. Anything other than a JSON
+/// array yields no entries.
+///
+/// # Performance
+///
+/// Parses each element into a [`JsonValue`] once. Duplicate detection is
+/// quadratic in the kept entries, which are capped at
+/// [`MAX_CLIENT_EID_ENTRIES`].
+#[must_use]
+pub(crate) fn parse_client_eids(raw: &RawValue) -> Vec<Eid> {
+    // Capturing elements as raw JSON does not validate string escapes, so an
+    // element holding a lone surrogate fails only its own parse below.
+    let Ok(elements) = serde_json::from_str::<Vec<Box<RawValue>>>(raw.get()) else {
+        log::debug!("Client EIDs: payload is not a JSON array; ignoring it");
+        return Vec::new();
+    };
+
+    let mut eids: Vec<Eid> = Vec::new();
+    for element in &elements {
+        if eids.len() >= MAX_CLIENT_EID_ENTRIES {
+            log::debug!(
+                "Client EIDs: keeping the first {MAX_CLIENT_EID_ENTRIES} entries; dropping the rest"
+            );
+            break;
+        }
+        let Some(eid) = parse_client_eid(element) else {
+            continue;
+        };
+        if eids.contains(&eid) {
+            log::debug!(
+                "Client EIDs: dropping a duplicate entry for source '{}'",
+                eid.source
+            );
+            continue;
+        }
+        eids.push(eid);
+    }
+    eids
+}
+
+fn parse_client_eid(element: &RawValue) -> Option<Eid> {
+    let entry = match serde_json::from_str::<JsonValue>(element.get()) {
+        Ok(JsonValue::Object(entry)) => entry,
+        Ok(_) => {
+            log::debug!("Client EIDs: dropping an entry that is not a JSON object");
+            return None;
+        }
+        Err(_) => {
+            log::debug!("Client EIDs: dropping an entry that does not parse");
+            return None;
+        }
+    };
+
+    let Some(source) = entry.get("source").and_then(parse_client_eid_label) else {
+        log::debug!("Client EIDs: dropping an entry without a valid `source`");
+        return None;
+    };
+
+    let uids: Vec<Uid> = match entry.get("uids") {
+        Some(JsonValue::Array(raw_uids)) => raw_uids
+            .iter()
+            .filter_map(|raw_uid| parse_client_uid(raw_uid, &source))
+            .take(MAX_CLIENT_UIDS_PER_ENTRY)
+            .collect(),
+        _ => Vec::new(),
+    };
+    if uids.is_empty() {
+        log::debug!("Client EIDs: dropping source '{source}' without a valid UID");
+        return None;
+    }
+
+    let inserter = parse_optional_field(&entry, "EID", "inserter", &source, parse_client_eid_label);
+    let matcher = parse_optional_field(&entry, "EID", "matcher", &source, parse_client_eid_label);
+    let mm = parse_optional_field(&entry, "EID", "mm", &source, parse_client_eid_integer);
+    let ext = parse_optional_field(&entry, "EID", "ext", &source, parse_client_eid_ext);
+
+    Some(Eid {
+        source,
+        uids,
+        inserter,
+        matcher,
+        mm,
+        ext,
+    })
+}
+
+fn parse_client_uid(raw: &JsonValue, source: &str) -> Option<Uid> {
+    let JsonValue::Object(uid) = raw else {
+        log::debug!("Client EIDs: dropping a UID that is not an object for source '{source}'");
+        return None;
+    };
+
+    let Some(id) = uid
+        .get("id")
+        .and_then(JsonValue::as_str)
+        .filter(|id| !id.trim().is_empty())
+        .filter(|id| id.len() <= MAX_UID_LENGTH)
+    else {
+        log::debug!("Client EIDs: dropping a UID without a valid `id` for source '{source}'");
+        return None;
+    };
+
+    Some(Uid {
+        id: id.to_owned(),
+        atype: parse_optional_field(uid, "UID", "atype", source, parse_client_eid_integer),
+        ext: parse_optional_field(uid, "UID", "ext", source, parse_client_eid_ext),
+    })
+}
+
+/// Applies `parse` to `key` when it is present, logging the field name and
+/// source, never the value, when the value is invalid.
+fn parse_optional_field<T>(
+    object: &serde_json::Map<String, JsonValue>,
+    scope: &str,
+    key: &str,
+    source: &str,
+    parse: impl Fn(&JsonValue) -> Option<T>,
+) -> Option<T> {
+    let value = object.get(key)?;
+    let parsed = parse(value);
+    if parsed.is_none() {
+        log::debug!("Client EIDs: dropping invalid {scope} `{key}` for source '{source}'");
+    }
+    parsed
+}
+
+/// Reads `source`, `inserter` or `matcher`: a string that is not blank and at
+/// most [`MAX_CLIENT_EID_LABEL_BYTES`] long, kept as supplied.
+fn parse_client_eid_label(value: &JsonValue) -> Option<String> {
+    value
+        .as_str()
+        .filter(|label| !label.trim().is_empty())
+        .filter(|label| label.len() <= MAX_CLIENT_EID_LABEL_BYTES)
+        .map(str::to_owned)
+}
+
+/// Reads `atype` or `mm`: a JSON number with no fractional part, from 0 to
+/// `i32::MAX`.
+fn parse_client_eid_integer(value: &JsonValue) -> Option<i32> {
+    let number = value.as_number()?;
+    if let Some(integer) = number.as_i64() {
+        return i32::try_from(integer).ok().filter(|integer| *integer >= 0);
+    }
+    if number.is_u64() {
+        // Above `i64::MAX`, so above the accepted range.
+        return None;
+    }
+    // serde_json reads `4.0`, `4e0` and `-0` as floats.
+    let float = number.as_f64()?;
+    if float.fract() != 0.0 || !(0.0..=f64::from(i32::MAX)).contains(&float) {
+        return None;
+    }
+    // Integral and within `0..=i32::MAX`, so the conversion is exact.
+    Some(float as i32)
+}
+
+/// Reads an `ext`: a JSON object of at most [`MAX_CLIENT_EID_EXT_BYTES`] as
+/// compact JSON.
+fn parse_client_eid_ext(value: &JsonValue) -> Option<JsonValue> {
+    if !value.is_object() {
+        return None;
+    }
+    let compact_len = serde_json::to_vec(value).ok()?.len();
+    (compact_len <= MAX_CLIENT_EID_EXT_BYTES).then(|| value.clone())
+}
+```
+
+- [ ] **Step 5: Run the tests.**
+
+Run: `cargo test-fastly -- client_eids migration_guards`
+Expected: PASS. If `drops_only_the_entry_that_does_not_parse` fails because serde_json accepted a lone surrogate, check that `Cargo.lock` still pins serde_json 1.0.150, then stop and report. The design depends on per-element rejection (spec D8).
+
+- [ ] **Step 6: Gates and commit.**
+
+Run: `cargo fmt --all -- --check && cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-spin-native && cargo test-fastly`
+Expected: clean. `raw_value` is workspace-wide (spec 4.4 notes the one side effect), so lint every adapter.
+
+```bash
+git add Cargo.toml crates/trusted-server-core/src/ec docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add one parser for browser-supplied EIDs" -m "ec::client_eids parses each array element on its own, so one malformed entry or field costs only itself. It validates sources, UIDs, atype, EID-level provenance fields and ext sizes, drops duplicates before the 64-entry cap, and logs field names and sources but never values."
+```
+
+---
+
+### Task 3: Body and cookie go through the shared parser
+
+Spec: 4.4 ("Callers"), 7.1 rule 8, 7.4 (`ec/prebid_eids.rs`, `auction/endpoints.rs`), A4.
+
+**Files:**
+
+- Create: `crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt`, `crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt`
+- Modify: `crates/trusted-server-core/src/auction/formats.rs:43-47` (`AdRequest.eids`)
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs` (imports `:8-23`, constants `:38-40`, `handle_auction` `:293-300`, `resolve_client_auction_eids` and the old parser `:472-562`, tests)
+- Modify: `crates/trusted-server-core/src/ec/prebid_eids.rs` (module doc `:1-9`, structs `:32-52`, `decode_prebid_eids_cookie` `:78-97`, `DecodedCookieEids` `:99-127`, `structured_cookie_*` `:282-322`, tests)
+
+**Interfaces:**
+
+- Consumes: `crate::ec::client_eids::parse_client_eids(&RawValue) -> Vec<Eid>` (Task 2).
+- Produces:
+  - `AdRequest { pub eids: Option<Box<serde_json::value::RawValue>>, .. }`
+  - `pub(crate) fn resolve_client_auction_eids(raw: Option<&RawValue>, cookie_value: Option<&str>) -> Option<Vec<Eid>>`. An empty parse result counts as absent, so the cookie is used. Callers: `handle_auction` and `publisher.rs:5541`, which passes `None`.
+  - Fixture files that Tasks 6 and 7 assert TSJS reproduces exactly.
+
+- [ ] **Step 1: Create the cross-language fixtures.**
+
+The input behind both files is defined in Task 6 (`FIXTURE_EIDS`): three entries, with a lone surrogate in the middle entry's UID `id`, non-Latin-1 text in the first entry's `inserter` and UID `ext`, and an EID-level `ext` on the last entry. The `.txt` extension keeps Prettier from rewriting them (`crates/trusted-server-js/lib/package.json:15`).
+
+Create `crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt` with exactly this one line (471 bytes as UTF-8, no trailing newline). The `\ud800` is six literal ASCII characters:
+
+```text
+{"adUnits":[{"code":"div-gpt-1","mediaTypes":{"banner":{"sizes":[[300,250]]}},"bids":[{"bidder":"trustedServer","params":{}}]}],"eids":[{"source":"first.example.com","inserter":"inserter-€.example.com","matcher":"first.example.com","mm":3,"uids":[{"id":"first-uid","atype":1,"ext":{"label":"日本"}}]},{"source":"bad.example.com","uids":[{"id":"bad-\ud800-uid","atype":1}]},{"source":"last.example.com","ext":{"segments":["s1"]},"uids":[{"id":"last-uid","atype":3}]}]}
+```
+
+Create `crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt` with exactly this one line (412 bytes, no trailing newline):
+
+```text
+W3sic291cmNlIjoiZmlyc3QuZXhhbXBsZS5jb20iLCJpbnNlcnRlciI6Imluc2VydGVyLeKCrC5leGFtcGxlLmNvbSIsIm1hdGNoZXIiOiJmaXJzdC5leGFtcGxlLmNvbSIsIm1tIjozLCJ1aWRzIjpbeyJpZCI6ImZpcnN0LXVpZCIsImF0eXBlIjoxLCJleHQiOnsibGFiZWwiOiLml6XmnKwifX1dfSx7InNvdXJjZSI6ImJhZC5leGFtcGxlLmNvbSIsInVpZHMiOlt7ImlkIjoiYmFkLVx1ZDgwMC11aWQiLCJhdHlwZSI6MX1dfSx7InNvdXJjZSI6Imxhc3QuZXhhbXBsZS5jb20iLCJ1aWRzIjpbeyJpZCI6Imxhc3QtdWlkIiwiYXR5cGUiOjN9XX1d
+```
+
+Verify the bytes:
+
+```bash
+sha256sum crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt
+```
+
+Expected (if an editor added a trailing newline, remove it and re-run):
+
+```text
+9266631df92f77c462b39c33e37e699a62fd8822afeb9cf1b3a2850c4eea785c  crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt
+e63a610fa5c7006065f8016e853069ed9e5fc34f50025c9670d1972ed7173079  crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt
+```
+
+The cookie decodes to the body's `eids` array with the last entry's EID-level `ext` removed. It keeps the `\ud800` escape as ASCII, so the server drops the middle entry from the cookie as well.
+
+- [ ] **Step 2: Write the failing endpoint tests.**
+
+In the `tests` module of `src/auction/endpoints.rs`, add next to `EidCapturingProvider` (`:1259`):
+
+```rust
+    const AUCTION_BODY_FIXTURE: &str =
+        include_str!("../../../trusted-server-js/lib/test/fixtures/auction-body-eids.txt");
+    const TS_EIDS_COOKIE_FIXTURE: &str =
+        include_str!("../../../trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt");
+
+    /// Provider that records the full EID set its auction request carried,
+    /// then fails its launch so no real transport handle is needed.
+    struct EidRecordingProvider {
+        eids: Arc<Mutex<Option<JsonValue>>>,
+    }
+
+    #[async_trait::async_trait(?Send)]
+    impl AuctionProvider for EidRecordingProvider {
+        fn provider_name(&self) -> &str {
+            "eid_recording_provider"
+        }
+
+        async fn request_bids(
+            &self,
+            request: &AuctionRequest,
+            _context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            *self.eids.lock().expect("should lock recorded eids") = Some(
+                serde_json::to_value(&request.user.eids).expect("should serialize recorded eids"),
+            );
+            Err(Report::new(TrustedServerError::Auction {
+                message: "record only".to_string(),
+            }))
+        }
+
+        async fn parse_response(
+            &self,
+            _response: PlatformResponse,
+            _response_time_ms: u64,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            panic!("parse_response must not run when the launch fails");
+        }
+
+        fn timeout_ms(&self) -> u32 {
+            100
+        }
+
+        fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
+            Some("record-backend".to_string())
+        }
+    }
+
+    /// Runs `/auction` with an allowed EC and returns the EIDs the provider
+    /// received: `None` when no provider was called (the request was
+    /// rejected), `Some(Value::Null)` when it carried no EIDs.
+    async fn recorded_auction_eids(body: Vec<u8>, ts_eids_cookie: Option<&str>) -> Option<JsonValue> {
+        let settings = create_test_settings();
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_recording_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        let recorded = Arc::new(Mutex::new(None));
+        orchestrator.register_provider(Arc::new(EidRecordingProvider {
+            eids: Arc::clone(&recorded),
+        }));
+        let ec_id = format!("{}.fixtur", "a".repeat(64));
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let mut builder = Request::builder()
+            .method("POST")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/auction"); // allow-domain: test-publisher.com
+        if let Some(cookie) = ts_eids_cookie {
+            builder = builder.header(header::COOKIE, format!("{COOKIE_TS_EIDS}={cookie}"));
+        }
+        let req = builder
+            .body(EdgeBody::from(body))
+            .expect("should build auction request");
+
+        // The recording provider fails its launch; the assertion is on what
+        // it received, not on the auction result.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            None,
+            None,
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        recorded.lock().expect("should lock recorded eids").clone()
+    }
+
+    fn ad_units_only_body() -> Vec<u8> {
+        serde_json::to_vec(&json!({
+            "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }]
+        }))
+        .expect("should serialize body")
+    }
+
+    /// The two parsable entries of the fixture input, as providers receive
+    /// them. The cookie copy has no EID-level `ext` on the last entry.
+    fn fixture_good_entries(with_eid_ext: bool) -> JsonValue {
+        let mut last = json!({
+            "source": "last.example.com",
+            "uids": [{ "id": "last-uid", "atype": 3 }]
+        });
+        if with_eid_ext {
+            last["ext"] = json!({ "segments": ["s1"] });
+        }
+        json!([
+            {
+                "source": "first.example.com",
+                "inserter": "inserter-€.example.com",
+                "matcher": "first.example.com",
+                "mm": 3,
+                "uids": [{ "id": "first-uid", "atype": 1, "ext": { "label": "日本" } }]
+            },
+            last
+        ])
+    }
+
+    #[tokio::test]
+    async fn tsjs_auction_body_fixture_drops_only_the_unparsable_entry() {
+        let recorded = recorded_auction_eids(
+            AUCTION_BODY_FIXTURE.trim_end().as_bytes().to_vec(),
+            None,
+        )
+        .await;
+
+        assert_eq!(
+            recorded,
+            Some(fixture_good_entries(true)),
+            "the request should be accepted and carry the two good entries unchanged"
+        );
+    }
+
+    #[tokio::test]
+    async fn tsjs_cookie_fixture_drops_only_the_unparsable_entry() {
+        let recorded =
+            recorded_auction_eids(ad_units_only_body(), Some(TS_EIDS_COOKIE_FIXTURE.trim_end())).await;
+
+        assert_eq!(
+            recorded,
+            Some(fixture_good_entries(false)),
+            "the cookie's good entries should reach the provider without the bad one"
+        );
+    }
+
+    #[tokio::test]
+    async fn auction_body_eid_level_fields_reach_the_auction_request() {
+        let eids = json!([{
+            "source": "adserver.org",
+            "inserter": "adserver.org",
+            "matcher": "adserver.org",
+            "mm": 4,
+            "uids": [{ "id": "fictional-tdid", "atype": 1, "ext": { "rtiPartner": "TDID" } }]
+        }]);
+        let body = serde_json::to_vec(&json!({
+            "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+            "eids": eids
+        }))
+        .expect("should serialize body");
+
+        assert_eq!(
+            recorded_auction_eids(body, None).await,
+            Some(eids),
+            "EID-level fields from the body should reach the provider unchanged"
+        );
+    }
+
+    #[tokio::test]
+    async fn auction_uses_the_cookie_when_no_body_entry_is_valid() {
+        let cookie_entries = json!([{ "source": "cookie.example.com", "uids": [{ "id": "cookie-uid" }] }]);
+        let cookie = BASE64.encode(serde_json::to_vec(&cookie_entries).expect("should serialize cookie"));
+        let body = serde_json::to_vec(&json!({
+            "adUnits": [{ "code": "div-gpt-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+            "eids": [{ "source": "", "uids": [{ "id": "body-uid" }] }]
+        }))
+        .expect("should serialize body");
+
+        assert_eq!(
+            recorded_auction_eids(body, Some(&cookie)).await,
+            Some(cookie_entries),
+            "a body whose entries are all invalid should count as absent"
+        );
+    }
+```
+
+In `src/ec/prebid_eids.rs` tests, add:
+
+```rust
+    #[test]
+    fn structured_cookie_keeps_eid_level_fields() {
+        let entries = json!([{
+            "source": "adserver.org",
+            "inserter": "adserver.org",
+            "matcher": "adserver.org",
+            "mm": 4,
+            "uids": [{ "id": "fictional-tdid", "atype": 1 }]
+        }]);
+
+        let decoded = parse_prebid_eids_cookie(&encode_json(&entries)).expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            entries,
+            "should keep EID-level fields from the cookie"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_drops_a_mistyped_field_instead_of_the_whole_cookie() {
+        let encoded = encode_json(&json!([
+            { "source": "a.example.com", "uids": [{ "id": "a-uid", "atype": "1" }] },
+            { "source": "b.example.com", "uids": [{ "id": "b-uid", "atype": 3 }] }
+        ]));
+
+        let decoded = parse_prebid_eids_cookie(&encoded).expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            json!([
+                { "source": "a.example.com", "uids": [{ "id": "a-uid" }] },
+                { "source": "b.example.com", "uids": [{ "id": "b-uid", "atype": 3 }] }
+            ]),
+            "a mistyped atype should drop only that field"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_isolates_an_unparsable_entry() {
+        let raw = r#"[{"source":"a.example.com","uids":[{"id":"a-uid"}]},{"source":"bad.example.com","uids":[{"id":"bad-\ud800"}]}]"#;
+
+        let decoded = parse_prebid_eids_cookie(&BASE64.encode(raw)).expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            json!([{ "source": "a.example.com", "uids": [{ "id": "a-uid" }] }]),
+            "a lone surrogate should cost only its own entry"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_applies_the_entry_cap() {
+        let entries: Vec<serde_json::Value> = (0..65)
+            .map(|index| json!({ "source": format!("s{index}.example.com"), "uids": [{ "id": "u" }] }))
+            .collect();
+
+        let decoded = parse_prebid_eids_cookie(&encode_json(&serde_json::Value::Array(entries.clone())))
+            .expect("should decode cookie");
+
+        assert_eq!(
+            serde_json::to_value(&decoded).expect("should serialize decoded EIDs"),
+            serde_json::Value::Array(entries[..64].to_vec()),
+            "the body's 64-entry cap should apply to the cookie"
+        );
+    }
+
+    #[test]
+    fn structured_cookie_diagnostics_report_raw_uid_strings() {
+        let registry = make_registry(vec![("example", "example.com")]);
+        let oversized = "x".repeat(MAX_UID_LENGTH + 1);
+        let encoded = encode_json(&json!([{ "source": "example.com", "uids": [{ "id": oversized }] }]));
+
+        let analysis = analyze_prebid_eids_cookie(&encoded, &registry).expect("should decode cookie");
+
+        assert!(analysis.eids.is_empty(), "an oversized UID should not survive validation");
+        assert_eq!(
+            analysis
+                .diagnostic_sources
+                .iter()
+                .map(|source| (source.source.clone(), source.uids.clone()))
+                .collect::<Vec<_>>(),
+            vec![("example.com".to_owned(), vec![oversized])],
+            "diagnostics should still report the raw source and UID so admin can say no valid UID"
+        );
+    }
+```
+
+- [ ] **Step 3: Run them and see them fail.**
+
+Run: `cargo test-fastly -- tsjs_ auction_body_eid_level auction_uses_the_cookie structured_cookie`
+Expected before the change:
+
+- `tsjs_auction_body_fixture_drops_only_the_unparsable_entry` FAILS with `None`: the whole body is rejected.
+- `tsjs_cookie_fixture_drops_only_the_unparsable_entry` FAILS with `Some(Null)`: the whole cookie is rejected.
+- `auction_body_eid_level_fields_reach_the_auction_request` FAILS: the fields are dropped.
+- `auction_uses_the_cookie_when_no_body_entry_is_valid` PASSES today. It is a regression net. Prove it in Step 7.
+- The `structured_cookie_*` tests FAIL: the cookie is rejected or the fields are dropped, except `structured_cookie_diagnostics_report_raw_uid_strings`, a regression net.
+
+Record all of this.
+
+- [ ] **Step 4: Capture `eids` as raw JSON.**
+
+In `src/auction/formats.rs`, add `use serde_json::value::RawValue;` and change the field:
+
+```rust
+    /// Browser EIDs, captured as raw JSON so a malformed entry (for example a
+    /// lone surrogate escape) cannot fail the whole body. Each entry is
+    /// validated on its own by the shared client EID parser.
+    pub eids: Option<Box<RawValue>>,
+```
+
+`AdRequest` has no `flatten` or untagged enum. Do not add one: either breaks raw capture. The `eids: None` initializers in `formats.rs` (`:275`, `:628` and the tests) compile unchanged.
+
+- [ ] **Step 5: Route body and cookie through `parse_client_eids`.**
+
+In `src/auction/endpoints.rs`:
+
+1. Delete the three constants at `:38-40`, `parse_client_auction_eids` (`:491-537`) and `parse_client_auction_uid` (`:539-562`).
+2. Change the imports: add `use serde_json::value::RawValue;` and `use crate::ec::client_eids::parse_client_eids;`, and change `use crate::openrtb::{Eid, Uid};` to `use crate::openrtb::Eid;`. Remove `use serde_json::Value as JsonValue;` if the compiler reports it unused.
+3. Replace `resolve_client_auction_eids`:
+
+```rust
+/// Resolves the request's browser EIDs: the `/auction` body when it has a
+/// valid entry, else the `ts-eids` cookie.
+///
+/// Both go through the shared client EID parser, so the same rules and caps
+/// apply to each, and a malformed entry costs only itself.
+pub(crate) fn resolve_client_auction_eids(
+    raw: Option<&RawValue>,
+    cookie_value: Option<&str>,
+) -> Option<Vec<Eid>> {
+    raw.map(parse_client_eids)
+        .filter(|eids| !eids.is_empty())
+        .or_else(|| parse_cookie_auction_eids(cookie_value))
+}
+```
+
+4. In `handle_auction` (`:294-297`), pass `body.eids.as_deref()` instead of `body.eids.as_ref()`.
+5. The existing test `resolve_client_auction_eids_prefers_request_body_over_cookie` (`:1484`) no longer compiles, because it passes a `JsonValue`. Replace its `let raw = json!([...]);` with:
+
+```rust
+        let raw = serde_json::value::to_raw_value(&json!([
+            {
+                "source": "id5-sync.com",
+                "uids": [{ "id": "body_uid", "atype": 1 }]
+            }
+        ]))
+        .expect("should capture raw EIDs");
+```
+
+Call it as `resolve_client_auction_eids(Some(raw.as_ref()), Some(&encoded))`, and replace its field-by-field assertions with whole-value equality:
+
+```rust
+        assert_eq!(
+            serde_json::to_value(&resolved).expect("should serialize resolved EIDs"),
+            json!([{ "source": "id5-sync.com", "uids": [{ "id": "body_uid", "atype": 1 }] }]),
+            "should use the request body when it has valid entries"
+        );
+```
+
+In `src/ec/prebid_eids.rs`:
+
+1. Replace the module doc (`:1-9`):
+
+```rust
+//! Prebid EID cookie ingestion.
+//!
+//! Parses the `ts-eids` cookie written by the TSJS Prebid integration and
+//! syncs matched partner UIDs to the KV identity graph.
+//!
+//! The current cookie holds a base64-encoded JSON array of OpenRTB-style EID
+//! objects, validated entry by entry with the same parser as the `/auction`
+//! body (`ec::client_eids`). The earlier flattened payload shape
+//! (`{source, id, atype}` per entry) is still accepted.
+```
+
+2. Delete `StructuredCookieEid` and `StructuredCookieUid` (`:32-47`), `structured_cookie_eids_to_openrtb` and `structured_cookie_uid_to_openrtb` (`:282-322`). Add `use serde_json::value::RawValue;` and `use super::client_eids::parse_client_eids;`.
+3. Change the enum variant to `Structured(Box<RawValue>)`.
+4. In `decode_prebid_eids_cookie`, replace the structured parse:
+
+```rust
+    let structured = serde_json::from_slice::<Box<RawValue>>(&bytes)
+        .map_err(|e| format!("JSON parse failed: {e}"))?;
+    Ok(DecodedCookieEids::Structured(structured))
+```
+
+5. In `impl DecodedCookieEids`, change the `Structured` arms:
+
+```rust
+            Self::Structured(raw) => raw_diagnostic_sources(raw),
+```
+
+```rust
+            Self::Structured(raw) => parse_client_eids(&raw),
+```
+
+and add below the impl:
+
+```rust
+/// Reports every source and raw UID string in a structured cookie, before
+/// validation, so admin diagnostics can tell "no partner" from "no valid UID".
+fn raw_diagnostic_sources(raw: &RawValue) -> Vec<DiagnosticEidSource> {
+    let Ok(elements) = serde_json::from_str::<Vec<Box<RawValue>>>(raw.get()) else {
+        return Vec::new();
+    };
+
+    elements
+        .iter()
+        .filter_map(|element| {
+            let JsonValue::Object(entry) = serde_json::from_str::<JsonValue>(element.get()).ok()?
+            else {
+                return None;
+            };
+            let source = entry
+                .get("source")
+                .and_then(JsonValue::as_str)
+                .filter(|source| !source.is_empty())?
+                .to_owned();
+            let uids = entry
+                .get("uids")
+                .and_then(JsonValue::as_array)
+                .map(|uids| {
+                    uids.iter()
+                        .filter_map(|uid| uid.get("id").and_then(JsonValue::as_str))
+                        .map(str::to_owned)
+                        .collect()
+                })
+                .unwrap_or_default();
+            Some(DiagnosticEidSource { source, uids })
+        })
+        .collect()
+}
+```
+
+- [ ] **Step 6: Remove the tests of the deleted body parser.**
+
+Delete these tests from `src/auction/endpoints.rs`. Task 2's `client_eids` tests cover the same rules for both transports. Keep `resolve_client_auction_eids_falls_back_to_ts_eids_cookie`.
+
+- `parse_client_auction_eids_ignores_malformed_entries` (`:1509`)
+- `parse_client_auction_eids_caps_sources_and_uids` (`:1535`)
+- `parse_client_auction_eids_drops_whitespace_and_oversized_uids` (`:1565`)
+- `parse_client_auction_eids_preserves_pair_atype` (`:1585`)
+- `parse_client_auction_eids_preserves_uid_ext_and_sanitizes_invalid_atype` (`:1603`)
+
+- [ ] **Step 7: Run the tests and prove the regression nets.**
+
+Run: `cargo test-fastly -- tsjs_ auction_body_eid_level auction_uses_the_cookie structured_cookie resolve_client_auction_eids admin prebid_eids`
+Expected: PASS.
+
+Then prove the two nets that passed before the change:
+
+- Temporarily delete `.filter(|eids| !eids.is_empty())` from `resolve_client_auction_eids` and run `cargo test-fastly -- auction_uses_the_cookie`. It must FAIL (`Some(Null)`). Restore the line.
+- Temporarily make `raw_diagnostic_sources` return `Vec::new()` and run `cargo test-fastly -- structured_cookie_diagnostics`. It must FAIL. Restore it.
+
+Record both in the red log.
+
+- [ ] **Step 8: Gates and commit.**
+
+Run: `cargo fmt --all -- --check && cargo clippy-fastly && cargo clippy-axum && cargo test-fastly && cargo test-axum`
+Expected: clean.
+
+```bash
+git add crates/trusted-server-core/src crates/trusted-server-js/lib/test/fixtures/auction-body-eids.txt crates/trusted-server-js/lib/test/fixtures/ts-eids-cookie.txt docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Validate body and cookie EIDs with the shared parser" -m "AdRequest captures eids as raw JSON so a lone surrogate in one entry no longer rejects the whole /auction body. The ts-eids structured branch uses the same parser, so a mistyped field or bad entry costs only itself and the body's caps apply to the cookie. Admin diagnostics still report raw sources and UIDs."
+```
+
+---
+
+### Task 4: Forward browser entries as sent; KV fills absent sources
+
+Spec: 4.5 (rules and the seven cases), D9, 7.4 ("Merge", "`publisher.rs`"), A3.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs:564-622` (`merge_auction_eids`) and its tests (`:1655-1753`)
+- Test: `crates/trusted-server-core/src/publisher.rs` (tests module)
+
+**Interfaces:**
+
+- Consumes: `crate::ec::partner::normalize_partner_source_domain(&str) -> Result<String, String>`.
+- Produces: `merge_auction_eids(client_eids: Option<Vec<Eid>>, resolved_eids: Option<Vec<Eid>>) -> Option<Vec<Eid>>`. The signature is unchanged, the behavior is new. `publisher.rs:5549` calls it unchanged.
+
+- [ ] **Step 1: Write the failing merge tests.**
+
+In `src/auction/endpoints.rs` tests, replace the three existing `merge_auction_eids_*` tests (`:1655-1753`) with:
+
+```rust
+    const SOURCE_S: &str = "ids.example.com";
+    const SOURCE_T: &str = "other.example.com";
+
+    fn kv_eid(source: &str, id: &str, atype: i32) -> Eid {
+        Eid::new(
+            source.to_owned(),
+            vec![Uid {
+                id: id.to_owned(),
+                atype: Some(atype),
+                ext: None,
+            }],
+        )
+    }
+
+    /// A browser entry, every field spelled out (spec 7.1 rule 9).
+    fn browser_eid(
+        source: &str,
+        id: &str,
+        atype: Option<i32>,
+        inserter: Option<&str>,
+        mm: Option<i32>,
+    ) -> Eid {
+        Eid {
+            source: source.to_owned(),
+            uids: vec![Uid {
+                id: id.to_owned(),
+                atype,
+                ext: None,
+            }],
+            inserter: inserter.map(str::to_owned),
+            matcher: None,
+            mm,
+            ext: None,
+        }
+    }
+
+    fn merged_json(client: Option<Vec<Eid>>, kv: Option<Vec<Eid>>) -> JsonValue {
+        serde_json::to_value(merge_auction_eids(client, kv)).expect("should serialize merged EIDs")
+    }
+
+    #[test]
+    fn merge_case_1_forwards_a_browser_entry_with_its_fields() {
+        let merged = merged_json(
+            Some(vec![browser_eid(SOURCE_S, "u1", None, Some("inserter-1.example.com"), Some(1))]),
+            None,
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1" }] }]),
+            "a browser entry should go out with its EID-level fields"
+        );
+    }
+
+    #[test]
+    fn merge_case_2_keeps_the_browser_atype_for_a_shared_uid() {
+        let merged = merged_json(
+            Some(vec![browser_eid(SOURCE_S, "u1", Some(1), Some("inserter-1.example.com"), Some(1))]),
+            Some(vec![kv_eid(SOURCE_S, "u1", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1", "atype": 1 }] }]),
+            "KV's operator-configured atype should not override the browser's"
+        );
+    }
+
+    #[test]
+    fn merge_case_3_drops_the_stale_kv_uid_for_a_browser_source() {
+        let merged = merged_json(
+            Some(vec![browser_eid(SOURCE_S, "u1", None, Some("inserter-1.example.com"), Some(1))]),
+            Some(vec![kv_eid(SOURCE_S, "u0", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1" }] }]),
+            "KV's value for a source the browser sends should not be forwarded"
+        );
+    }
+
+    #[test]
+    fn merge_case_4_appends_kv_sources_the_browser_did_not_send() {
+        let merged = merged_json(
+            Some(vec![browser_eid(SOURCE_S, "u1", None, None, None)]),
+            Some(vec![kv_eid(SOURCE_T, "t1", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": SOURCE_S, "uids": [{ "id": "u1" }] },
+                { "source": SOURCE_T, "uids": [{ "id": "t1", "atype": 3 }] }
+            ]),
+            "browser entries should come first and KV-only sources after"
+        );
+    }
+
+    #[test]
+    fn merge_case_5_keeps_same_source_entries_with_different_fields_apart() {
+        let merged = merged_json(
+            Some(vec![
+                browser_eid(SOURCE_S, "u1", None, Some("inserter-1.example.com"), Some(1)),
+                browser_eid(SOURCE_S, "u1", None, Some("inserter-2.example.com"), Some(2)),
+            ]),
+            None,
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": SOURCE_S, "inserter": "inserter-1.example.com", "mm": 1, "uids": [{ "id": "u1" }] },
+                { "source": SOURCE_S, "inserter": "inserter-2.example.com", "mm": 2, "uids": [{ "id": "u1" }] }
+            ]),
+            "two browser entries for one source should stay two entries"
+        );
+    }
+
+    #[test]
+    fn merge_case_6_matches_sources_as_the_registry_normalizes_them() {
+        let merged = merged_json(
+            Some(vec![browser_eid("IDS.Example.com.", "u1", None, None, None)]),
+            Some(vec![kv_eid(SOURCE_S, "u0", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": "IDS.Example.com.", "uids": [{ "id": "u1" }] }]),
+            "a browser source differing only in case or a trailing dot should suppress KV's"
+        );
+    }
+
+    #[test]
+    fn merge_case_7_forwards_kv_entries_when_the_browser_sent_none() {
+        let merged = merged_json(None, Some(vec![kv_eid(SOURCE_S, "u0", 3), kv_eid(SOURCE_T, "t1", 3)]));
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": SOURCE_S, "uids": [{ "id": "u0", "atype": 3 }] },
+                { "source": SOURCE_T, "uids": [{ "id": "t1", "atype": 3 }] }
+            ]),
+            "KV entries should be forwarded unchanged without browser EIDs"
+        );
+    }
+
+    #[test]
+    fn merge_drops_entries_without_uids() {
+        let empty_browser = Eid::new(SOURCE_S.to_owned(), Vec::new());
+        let empty_kv = Eid::new(SOURCE_T.to_owned(), Vec::new());
+
+        assert_eq!(
+            merged_json(Some(vec![empty_browser]), Some(vec![empty_kv])),
+            JsonValue::Null,
+            "entries without UIDs should be dropped, leaving no EIDs"
+        );
+    }
+
+    #[test]
+    fn merge_auction_eids_deduplicates_client_and_resolved_ids() {
+        let merged = merged_json(
+            Some(vec![kv_eid("id5-sync.com", "ID5_abc", 1)]),
+            Some(vec![kv_eid("id5-sync.com", "ID5_abc", 1), kv_eid("liveramp.com", "LR_xyz", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([
+                { "source": "id5-sync.com", "uids": [{ "id": "ID5_abc", "atype": 1 }] },
+                { "source": "liveramp.com", "uids": [{ "id": "LR_xyz", "atype": 3 }] }
+            ]),
+            "the browser's id5 entry should go out once, followed by KV's liveramp"
+        );
+    }
+
+    #[test]
+    fn merge_auction_eids_does_not_union_kv_uids_into_a_browser_source() {
+        let merged = merged_json(
+            Some(vec![browser_eid("sharedid.org", "shared_client", None, None, None)]),
+            Some(vec![kv_eid("sharedid.org", "shared_server", 3)]),
+        );
+
+        assert_eq!(
+            merged,
+            json!([{ "source": "sharedid.org", "uids": [{ "id": "shared_client" }] }]),
+            "KV's UID for a source the browser sends should not be added to it"
+        );
+    }
+
+    #[test]
+    fn merge_auction_eids_keeps_browser_metadata_on_conflict() {
+        let client = Eid::new(
+            "adserver.org".to_owned(),
+            vec![Uid {
+                id: "shared_uid".to_owned(),
+                atype: Some(1),
+                ext: Some(json!({ "provider": "client" })),
+            }],
+        );
+        let resolved = Eid::new(
+            "adserver.org".to_owned(),
+            vec![Uid {
+                id: "shared_uid".to_owned(),
+                atype: Some(3),
+                ext: Some(json!({ "provider": "server" })),
+            }],
+        );
+
+        assert_eq!(
+            merged_json(Some(vec![client]), Some(vec![resolved])),
+            json!([{
+                "source": "adserver.org",
+                "uids": [{ "id": "shared_uid", "atype": 1, "ext": { "provider": "client" } }]
+            }]),
+            "the browser's atype and ext should win over KV's"
+        );
+    }
+```
+
+- [ ] **Step 2: Write the failing publisher test.**
+
+Add to the `tests` module of `src/publisher.rs`. Add any of these imports the module does not already have: `crate::auction::test_support::canonical_parity_auction_request`, `crate::consent::ConsentContext`, `crate::consent::jurisdiction::Jurisdiction`, `crate::cookies::parse_cookies_to_jar`, `crate::ec::EcKvSnapshot`, `crate::ec::kv_types::{KvEntry, KvPartnerId}`, `crate::platform::test_support::noop_services`, `crate::redacted::Redacted`, `crate::settings::EcPartner`, `base64::{Engine as _, engine::general_purpose::STANDARD as BASE64}`.
+
+```rust
+    fn eid_merge_partner(source_domain: &str) -> EcPartner {
+        EcPartner {
+            name: format!("Partner {source_domain}"),
+            source_domain: source_domain.to_owned(),
+            openrtb_atype: EcPartner::default_openrtb_atype(),
+            bidstream_enabled: true,
+            api_token: Some(Redacted::new(format!(
+                "token-{source_domain}-32-bytes-minimum-value"
+            ))),
+            batch_rate_limit: EcPartner::default_batch_rate_limit(),
+            pull_sync_enabled: false,
+            pull_sync_url: None,
+            pull_sync_allowed_domains: vec![],
+            pull_sync_ttl_sec: EcPartner::default_pull_sync_ttl_sec(),
+            pull_sync_rate_limit: EcPartner::default_pull_sync_rate_limit(),
+            ts_pull_token: None,
+        }
+    }
+
+    #[test]
+    fn body_less_auction_eids_put_cookie_entries_first_and_kv_only_sources_after() {
+        let ec_id = format!("{}.navmrg", "a".repeat(64));
+        let registry = PartnerRegistry::from_config(&[
+            eid_merge_partner("ids.example.com"),
+            eid_merge_partner("other.example.com"),
+        ])
+        .expect("should build partner registry");
+        let mut entry = KvEntry::tombstone(1000);
+        entry.consent.ok = true;
+        entry.ids.insert(
+            "ids.example.com".to_owned(),
+            KvPartnerId { uid: "kv-stale".to_owned() },
+        );
+        entry.ids.insert(
+            "other.example.com".to_owned(),
+            KvPartnerId { uid: "kv-other".to_owned() },
+        );
+        let snapshot = EcKvSnapshot::Present {
+            ec_id: ec_id.clone(),
+            entry: Box::new(entry),
+            generation: None,
+        };
+        let ec_context = EcContext::new_for_test(
+            Some(ec_id.clone()),
+            ConsentContext {
+                jurisdiction: Jurisdiction::NonRegulated,
+                ..ConsentContext::default()
+            },
+        );
+        let cookie_entries = json!([{
+            "source": "ids.example.com",
+            "inserter": "inserter-1.example.com",
+            "mm": 1,
+            "uids": [{ "id": "browser-fresh", "atype": 1 }]
+        }]);
+        let cookie = BASE64.encode(serde_json::to_vec(&cookie_entries).expect("should serialize cookie"));
+        let jar = parse_cookies_to_jar(&format!("{COOKIE_TS_EIDS}={cookie}"));
+        let services = noop_services();
+        let mut auction_request = canonical_parity_auction_request();
+        // No TCF signal and no GDPR, so the consent gate passes the merged set.
+        auction_request.user.consent = None;
+        auction_request.user.eids = None;
+
+        apply_auction_eids_and_device(
+            &mut auction_request,
+            &AuctionEidTargeting {
+                cookie_jar: Some(&jar),
+                ec_id: Some(ec_id.as_str()),
+                kv_snapshot: &snapshot,
+                partner_registry: Some(&registry),
+                ec_context: &ec_context,
+                services: &services,
+                geo: None,
+                path_label: "Test",
+            },
+        );
+
+        assert_eq!(
+            serde_json::to_value(&auction_request.user.eids).expect("should serialize EIDs"),
+            json!([
+                {
+                    "source": "ids.example.com",
+                    "inserter": "inserter-1.example.com",
+                    "mm": 1,
+                    "uids": [{ "id": "browser-fresh", "atype": 1 }]
+                },
+                {
+                    "source": "other.example.com",
+                    "uids": [{ "id": "kv-other", "atype": EcPartner::default_openrtb_atype() }]
+                }
+            ]),
+            "navigation and page-bids auctions should forward the cookie entry as sent, then KV-only sources"
+        );
+    }
+```
+
+If `publisher.rs` tests already import `serde_json::json` under another name, or already define a partner helper, reuse it instead of adding a duplicate.
+
+- [ ] **Step 3: Run them and see them fail.**
+
+Run: `cargo test-fastly -- merge_ body_less_auction_eids`
+Expected FAIL against the old merge: cases 1 to 6 and the three rewritten tests (fields dropped, KV first, UIDs unioned, KV atype wins), and the publisher test. `merge_case_7_forwards_kv_entries_when_the_browser_sent_none` and `merge_drops_entries_without_uids` pass today. They are regression nets for Step 5. Record everything.
+
+- [ ] **Step 4: Rewrite the merge.**
+
+Replace `merge_auction_eids` in `src/auction/endpoints.rs`. Add `use crate::ec::partner::normalize_partner_source_domain;`, change `use std::collections::HashMap;` to `use std::collections::{HashMap, HashSet};`, and remove `use crate::ec::kv_types::MAX_UID_LENGTH;` once it is unused:
+
+```rust
+/// Merges the request's browser EIDs with KV-resolved partner EIDs.
+///
+/// Browser entries are forwarded as parsed, in wire order, never altered or
+/// combined: they are what Prebid sent the `trustedServer` adapter, and a
+/// source may repeat with different EID-level fields. KV entries are appended
+/// after them, only for registered sources no browser entry carries. Sources
+/// are compared as the partner registry normalizes them (lowercase, trailing
+/// dot removed). For a source the browser sends, KV's UIDs, `atype` and `ext`
+/// are not used: KV keeps the first value it stored, so it is the staler copy.
+/// Entries without UIDs are dropped.
+pub(crate) fn merge_auction_eids(
+    client_eids: Option<Vec<Eid>>,
+    resolved_eids: Option<Vec<Eid>>,
+) -> Option<Vec<Eid>> {
+    let mut merged: Vec<Eid> = client_eids
+        .into_iter()
+        .flatten()
+        .filter(|eid| !eid.uids.is_empty())
+        .collect();
+    let browser_sources: HashSet<String> = merged
+        .iter()
+        .filter_map(|eid| normalize_partner_source_domain(&eid.source).ok())
+        .collect();
+
+    for eid in resolved_eids.into_iter().flatten() {
+        if eid.uids.is_empty() {
+            continue;
+        }
+        let carried_by_browser = normalize_partner_source_domain(&eid.source)
+            .is_ok_and(|source| browser_sources.contains(&source));
+        if !carried_by_browser {
+            merged.push(eid);
+        }
+    }
+
+    if merged.is_empty() {
+        None
+    } else {
+        Some(merged)
+    }
+}
+```
+
+Update the comment above the call in `handle_auction` (`:345-346`) to: "Forward the browser entries as sent, append KV entries for registered sources the browser did not send, then apply consent gating."
+
+- [ ] **Step 5: Run the tests and prove the nets.**
+
+Run: `cargo test-fastly -- merge_ body_less_auction_eids`
+Expected: PASS.
+
+Prove the two nets:
+
+- Temporarily replace `merged.push(eid);` with `let _ = eid;` and run `cargo test-fastly -- merge_case_7`. It must FAIL. Restore.
+- Temporarily remove `.filter(|eid| !eid.uids.is_empty())` and run `cargo test-fastly -- merge_drops_entries_without_uids`. It must FAIL. Restore.
+
+Record both.
+
+- [ ] **Step 6: Gates and commit.**
+
+Run: `cargo fmt --all -- --check && cargo clippy-fastly && cargo clippy-axum && cargo test-fastly`
+Expected: clean.
+
+```bash
+git add crates/trusted-server-core/src docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Forward browser EIDs as sent and fill only absent sources from KV" -m "Browser entries reach providers unchanged, in wire order, with repeated sources kept apart. KV adds entries only for registered sources the browser did not send, so its stale UID and operator atype no longer override the browser's."
+```
+
+---
+
+### Task 5: KV ingestion on `/auction` reads only the auction's own client set
+
+Spec: 4.6, 7.1 rule 11, 7.4 ("Fastly adapter and `ec/finalize.rs`"), A2 (KV part), A8.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/finalize.rs:79-150` (both ingestion branches) and tests
+- Modify: `crates/trusted-server-core/src/ec/prebid_eids.rs:129-161` (`collect_eid_updates` doc comment only)
+- Test: `crates/trusted-server-core/src/auction/endpoints.rs`, `crates/trusted-server-core/src/ec/finalize.rs`, `crates/trusted-server-adapter-fastly/src/app.rs`
+
+**Interfaces:**
+
+- Consumes: `EcContext::eid_sync_source() -> Option<EidSyncSource>` and `EcContext::client_eids() -> Option<&[Eid]>`, both existing.
+- Produces: a private `browser_eid_input(&EcContext, Option<&str>) -> (Option<&str>, Option<&[Eid]>)` in `ec/finalize.rs`. `collect_eid_updates` keeps its signature.
+
+- [ ] **Step 1: Write the failing core-layer tests.**
+
+In `src/auction/endpoints.rs` tests, next to `auction_body_eids_reach_kv_even_when_the_ts_eids_cookie_is_absent` (`:807`):
+
+```rust
+    const COOKIE_ONLY_SOURCE: &str = "cookie-only.example.com";
+
+    fn ingestion_registry(extra_source: &str) -> PartnerRegistry {
+        PartnerRegistry::from_config(&[
+            counting_test_partner(COOKIE_ONLY_SOURCE),
+            counting_test_partner(extra_source),
+        ])
+        .expect("should build partner registry")
+    }
+
+    fn cookie_only_ts_eids() -> String {
+        BASE64.encode(
+            serde_json::to_vec(&json!([
+                { "source": COOKIE_ONLY_SOURCE, "uids": [{ "id": "cookie-uid" }] }
+            ]))
+            .expect("should serialize cookie"),
+        )
+    }
+
+    fn seeded_graph(ec_id: &str) -> KvIdentityGraph {
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let mut live = crate::ec::kv_types::KvEntry::tombstone(1000);
+        live.consent.ok = true;
+        graph.create(ec_id, &live).expect("should seed live row");
+        graph
+    }
+
+    fn stored_ids(graph: &KvIdentityGraph, ec_id: &str) -> Vec<(String, String)> {
+        let (stored, _) = graph
+            .get(ec_id)
+            .expect("should read store")
+            .expect("row should exist");
+        stored
+            .ids
+            .iter()
+            .map(|(source, id)| (source.clone(), id.uid.clone()))
+            .collect()
+    }
+
+    #[tokio::test]
+    async fn auction_ingests_its_body_eids_and_not_a_cookie_only_source() {
+        let settings = create_test_settings();
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::new(std::sync::Mutex::new(None)),
+        }));
+        let registry = ingestion_registry("body.example.com");
+        let ec_id = format!("{}.ingbdy", "a".repeat(64));
+        let graph = seeded_graph(&ec_id);
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Auction);
+        let cookie = cookie_only_ts_eids();
+        let req = Request::builder()
+            .method("POST")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+            .header(header::COOKIE, format!("{COOKIE_TS_EIDS}={cookie}"))
+            .body(EdgeBody::from(
+                serde_json::to_vec(&json!({
+                    "adUnits": [{ "code": "div-gpt-ad-1", "mediaTypes": { "banner": { "sizes": [[300, 250]] } } }],
+                    "eids": [{ "source": "body.example.com", "uids": [{ "id": "body-uid" }] }]
+                }))
+                .expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+        let mut response = http::Response::new(EdgeBody::empty());
+        crate::ec::finalize::ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            Some(&cookie),
+            None,
+            &mut response,
+        );
+
+        assert_eq!(
+            stored_ids(&graph, &ec_id),
+            vec![("body.example.com".to_owned(), "body-uid".to_owned())],
+            "KV should learn the body's source and not the cookie-only source"
+        );
+    }
+
+    #[tokio::test]
+    async fn disabled_auction_ingests_nothing_from_the_cookie_but_keeps_shared_id() {
+        let settings = create_test_settings();
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: false,
+            ..Default::default()
+        });
+        let registry = ingestion_registry("sharedid.org");
+        let ec_id = format!("{}.ingdis", "a".repeat(64));
+        let graph = seeded_graph(&ec_id);
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Auction);
+        let cookie = cookie_only_ts_eids();
+        let req = Request::builder()
+            .method("POST")
+            // Keep the host aligned with the shared settings fixture.
+            .uri("https://test-publisher.com/auction") // allow-domain: test-publisher.com
+            .header(header::COOKIE, format!("{COOKIE_TS_EIDS}={cookie}"))
+            .body(EdgeBody::from(ad_units_only_body()))
+            .expect("should build auction request");
+
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+        let mut response = http::Response::new(EdgeBody::empty());
+        crate::ec::finalize::ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            Some(&cookie),
+            Some("shared-cookie-id"),
+            &mut response,
+        );
+
+        assert_eq!(
+            stored_ids(&graph, &ec_id),
+            vec![("sharedid.org".to_owned(), "shared-cookie-id".to_owned())],
+            "an /auction that resolved no client set should ingest only the sharedId cookie"
+        );
+    }
+
+    #[test]
+    fn navigation_ingests_the_cookie_only_source() {
+        // Control for the two tests above: the registry does match the
+        // cookie-only source when the route reads the cookie.
+        let settings = create_test_settings();
+        let registry = ingestion_registry("body.example.com");
+        let ec_id = format!("{}.ingnav", "a".repeat(64));
+        let graph = seeded_graph(&ec_id);
+        let mut ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        ec_context.set_eid_sync_source(crate::ec::EidSyncSource::Navigation);
+        let cookie = cookie_only_ts_eids();
+        let mut response = http::Response::new(EdgeBody::empty());
+
+        crate::ec::finalize::ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            Some(&cookie),
+            None,
+            &mut response,
+        );
+
+        assert_eq!(
+            stored_ids(&graph, &ec_id),
+            vec![(COOKIE_ONLY_SOURCE.to_owned(), "cookie-uid".to_owned())],
+            "a navigation should ingest the cookie's registered source"
+        );
+    }
+```
+
+`ad_units_only_body` comes from Task 3. If `AuctionConfig` has no `Default` for `enabled: false`, copy the field list from the enabled config above with `enabled: false` and `providers: AuctionConfig::legacy_provider_map(&[])`.
+
+In `src/ec/finalize.rs` tests, next to `finalize_generated_ec_persists_eid_updates` (`:1297`):
+
+```rust
+    #[test]
+    fn finalize_generated_ec_without_sync_source_ingests_the_ts_eids_cookie() {
+        let settings = create_test_settings();
+        let ec_id = sample_ec_id("genck1");
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let live = KvEntry::new(
+            &granting_consent(),
+            None,
+            current_timestamp(),
+            &settings.publisher.domain,
+        );
+        graph
+            .create(&ec_id, &live)
+            .expect("should seed generated row");
+        let mut ec_context =
+            make_context(Some(&ec_id), None, false, true, Jurisdiction::NonRegulated);
+        ec_context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+        let registry = PartnerRegistry::from_config(&[make_partner("ids.example.com")])
+            .expect("should build registry");
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::to_vec(&serde_json::json!([
+                { "source": "ids.example.com", "uids": [{ "id": "cookie-uid" }] }
+            ]))
+            .expect("should serialize test cookie payload"),
+        );
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            Some(&eids_cookie),
+            None,
+            &mut response,
+        );
+
+        let (stored, _) = graph
+            .get(&ec_id)
+            .expect("should read store")
+            .expect("row should remain");
+        assert_eq!(
+            stored
+                .ids
+                .iter()
+                .map(|(source, id)| (source.as_str(), id.uid.as_str()))
+                .collect::<Vec<_>>(),
+            vec![("ids.example.com", "cookie-uid")],
+            "a new EC with no sync source should ingest the cookie"
+        );
+    }
+```
+
+Change `finalize_recovers_orphaned_ec_when_purpose_four_denial_empties_updates` (`:1096`). Under the new rule a navigation ingests the cookie, not the client set, so its EID must arrive through the cookie. Delete the `ec_context.set_client_eids(vec![…]);` statement (`:1118-1125`), add before the `ec_finalize_response` call:
+
+```rust
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::to_vec(&serde_json::json!([
+                { "source": "id5-sync.com", "uids": [{ "id": "ID5_should_not_persist", "atype": 1 }] }
+            ]))
+            .expect("should serialize test cookie payload"),
+        );
+```
+
+and pass `Some(&eids_cookie)` as the fifth argument of that call (it is `None` today, `:1136`).
+
+- [ ] **Step 2: Write the adapter-layer test.**
+
+In `crates/trusted-server-adapter-fastly/src/app.rs` tests, next to `dispatch_limits_returning_user_eid_sync_to_eligible_routes` (`:2300`):
+
+```rust
+    #[test]
+    fn auction_route_carries_the_raw_ts_eids_cookie_to_finalization() {
+        let router = test_router();
+        let eids_cookie = base64::engine::general_purpose::STANDARD.encode(
+            serde_json::json!([{ "source": "ids.example.com", "uids": [{ "id": "example-uid" }] }])
+                .to_string(),
+        );
+        let mut request = browser_request(Method::POST, "/auction", "empty");
+        request.headers_mut().insert(
+            header::COOKIE,
+            HeaderValue::from_str(&format!("ts-eids={eids_cookie}"))
+                .expect("should build cookie header"),
+        );
+
+        let response = route(&router, request);
+
+        let state = response
+            .extensions()
+            .get::<super::EcFinalizeState>()
+            .expect("auction responses should carry EC finalization state");
+        assert_eq!(
+            state.eids_cookie.as_deref(),
+            Some(eids_cookie.as_str()),
+            "the adapter should hand finalization the raw ts-eids cookie"
+        );
+        assert_eq!(
+            state.ec_context.eid_sync_source(),
+            Some(EidSyncSource::Auction),
+            "finalization should know this was an /auction request"
+        );
+    }
+```
+
+This test does not assert the client set. Setting one needs an allowed EC, which no adapter test arranges (spec 7.1 rule 11).
+
+- [ ] **Step 3: Run them and see them fail.**
+
+Run: `cargo test-fastly -- ingests_ cookie_only_source finalize_generated_ec_without_sync_source finalize_recovers_orphaned_ec auction_route_carries_the_raw`
+Expected before the change:
+
+- `auction_ingests_its_body_eids_and_not_a_cookie_only_source` FAILS: KV also holds `cookie-only.example.com`.
+- `disabled_auction_ingests_nothing_from_the_cookie_but_keeps_shared_id` FAILS for the same reason.
+- `navigation_ingests_the_cookie_only_source`, `finalize_generated_ec_without_sync_source_ingests_the_ts_eids_cookie`, the edited orphan test and `auction_route_carries_the_raw_ts_eids_cookie_to_finalization` PASS. They are regression nets, proved in Step 6.
+
+Record this.
+
+- [ ] **Step 4: Select the ingestion input by sync source.**
+
+In `src/ec/finalize.rs`, add `use crate::openrtb::Eid;` and, below `ec_finalize_response`:
+
+```rust
+/// Chooses the browser EID input KV ingestion reads for this request.
+///
+/// `/auction` ingests only the client set the auction itself used (its body,
+/// else its `ts-eids` cookie, as `handle_auction` resolved it). A cookie from
+/// an earlier page is then never ingested next to a scoped body, and an
+/// `/auction` that resolved no client set ingests nothing from the cookie.
+/// Every other route, and requests with no sync source, read the cookie.
+fn browser_eid_input<'a>(
+    ec_context: &'a EcContext,
+    eids_cookie: Option<&'a str>,
+) -> (Option<&'a str>, Option<&'a [Eid]>) {
+    match ec_context.eid_sync_source() {
+        Some(EidSyncSource::Auction) => (None, ec_context.client_eids()),
+        _ => (eids_cookie, None),
+    }
+}
+```
+
+In the returning-user branch (`:82-92`), replace the `collect_eid_updates(…)` call inside `.map(|_| …)` with:
+
+```rust
+                .map(|_| {
+                    let (cookie_input, client_input) = browser_eid_input(ec_context, eids_cookie);
+                    collect_eid_updates(cookie_input, sharedid_cookie, client_input, registry)
+                })
+```
+
+In the generated-EC branch (`:141-149`):
+
+```rust
+        let (cookie_input, client_input) = browser_eid_input(ec_context, eids_cookie);
+        let updates = gate_eid_updates_by_consent(
+            collect_eid_updates(cookie_input, sharedid_cookie, client_input, registry),
+            ec_context.consent(),
+        );
+```
+
+Update the doc comment of `ec_finalize_response` where it describes `eids_cookie`: "`eids_cookie` should be the raw value of the `ts-eids` cookie extracted from the request before routing consumes it. `/auction` responses ignore it in favor of the request's own client set."
+
+In `src/ec/prebid_eids.rs`, replace the doc comment of `collect_eid_updates` (`:129-137`):
+
+```rust
+/// Collects validated request-local partner updates without performing KV I/O.
+///
+/// Finalization passes either the `ts-eids` cookie or the request's own client
+/// EIDs, never both: `/auction` passes the client set it used, every other
+/// route the cookie. The `sharedId` cookie is applied last, so it wins over a
+/// Prebid EID for the same partner. With repeated sources, the later entry's
+/// first valid UID is the candidate for that partner.
+```
+
+- [ ] **Step 5: Run the tests.**
+
+Run: `cargo test-fastly -- ingests_ cookie_only_source finalize_ auction_route_carries_the_raw prebid_eids`
+Expected: PASS, including every existing `finalize_*` test.
+
+- [ ] **Step 6: Prove the regression nets.**
+
+- Temporarily change `browser_eid_input`'s fallback arm to `_ => (None, ec_context.client_eids()),` and run `cargo test-fastly -- cookie_only_source finalize_generated_ec_without_sync_source finalize_recovers_orphaned_ec`. All three must FAIL. Restore.
+- Temporarily change `crates/trusted-server-adapter-fastly/src/app.rs:420` to `let eids_cookie: Option<String> = None;` and run `cargo test-fastly -- auction_route_carries_the_raw`. It must FAIL. Restore.
+
+Record both.
+
+- [ ] **Step 7: Gates and commit.**
+
+Run: `cargo fmt --all -- --check && cargo clippy-fastly && cargo clippy-axum && cargo test-fastly && cargo test-fastly-reuse`
+Expected: clean.
+
+```bash
+git add crates/trusted-server-core/src crates/trusted-server-adapter-fastly/src/app.rs docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Ingest only the auction's own client EIDs on /auction" -m "Finalization chooses its browser input by sync source. /auction reads the client set the auction used, so a cookie from an earlier page is not ingested next to a scoped body. Other routes keep reading ts-eids, and the sharedId cookie is still applied last."
+```
+
+---
+
+## TSJS test commands
+
+From `crates/trusted-server-js/lib`: `npx vitest run <file> -t "<name pattern>"` for one test, `npx vitest run` for everything, `npm run format` for the Prettier check (`npm run format:write` fixes). The JSDOM suites (`test/*.test.mjs`) build real artifacts and take minutes.
+
+---
+
+### Task 6: Pure EID collector and cookie value builder
+
+Spec: 4.2 (collection steps 1 to 4), 4.3 (content, size, encoding, failure), 7.1 rules 4, 6 and 8, 7.2, A9.
+
+**Files:**
+
+- Create: `crates/trusted-server-js/lib/src/integrations/prebid/eids.ts`
+- Create: `crates/trusted-server-js/lib/test/fixtures/eid-fixture-input.ts`
+- Create: `crates/trusted-server-js/lib/test/integrations/prebid/eids.test.ts`
+
+**Interfaces:**
+
+- Consumes: `test/fixtures/ts-eids-cookie.txt` (Task 3).
+- Produces, in `src/integrations/prebid/eids.ts`:
+
+  ```ts
+  export const MAX_AUCTION_EIDS_BYTES = 65_536
+  export const MAX_EID_COOKIE_BYTES = 3072
+  export interface EidCollectionStats {
+    forwarded: number
+    unserializable: number
+    overBudget: number
+  }
+  export interface FittedEidCookie {
+    value: string | undefined
+    droppedSources: string[]
+    trimmedSources: string[]
+  }
+  export function collectBidderEids(
+    bidderRequest: unknown,
+    stats?: EidCollectionStats
+  ): unknown[] | undefined
+  export function fitEidCookie(eids: readonly unknown[]): FittedEidCookie
+  ```
+
+  `collectBidderEids` keeps the spec 4.2 signature, plus an optional `stats` out-parameter for the debug log in spec 4.12. Task 7 calls both functions from `buildRequests`.
+
+- Produces, in `test/fixtures/eid-fixture-input.ts`: `export const FIXTURE_EIDS` (used by Task 7).
+
+- [ ] **Step 1: Add the fixture input and a stub module.**
+
+`test/fixtures/eid-fixture-input.ts`:
+
+```ts
+/**
+ * The fixed input behind `auction-body-eids.txt` and `ts-eids-cookie.txt`
+ * (spec 7.1 rule 8). The middle entry's UID `id` holds a lone UTF-16
+ * surrogate, which `JSON.stringify` writes as the escape `\ud800` and the
+ * server drops for that entry only. The first entry has non-Latin-1 text in
+ * `inserter` and in a UID `ext`. The last has an EID-level `ext`, which the
+ * cookie omits. Key order matters: the fixtures are exact bytes.
+ */
+export const FIXTURE_EIDS = [
+  {
+    source: 'first.example.com',
+    inserter: 'inserter-€.example.com',
+    matcher: 'first.example.com',
+    mm: 3,
+    uids: [{ id: 'first-uid', atype: 1, ext: { label: '日本' } }],
+  },
+  { source: 'bad.example.com', uids: [{ id: 'bad-\ud800-uid', atype: 1 }] },
+  {
+    source: 'last.example.com',
+    ext: { segments: ['s1'] },
+    uids: [{ id: 'last-uid', atype: 3 }],
+  },
+]
+```
+
+`src/integrations/prebid/eids.ts`, a stub so the tests fail on assertions rather than on a missing import:
+
+```ts
+/** UTF-8 byte budget for the EIDs forwarded in one `/auction` body. */
+export const MAX_AUCTION_EIDS_BYTES = 65_536
+
+/** Maximum length of the base64 `ts-eids` cookie value. */
+export const MAX_EID_COOKIE_BYTES = 3072
+
+/** Counts reported by {@link collectBidderEids} for debug logging. */
+export interface EidCollectionStats {
+  /** Entries copied into the result. */
+  forwarded: number
+  /** Entries dropped because they could not be serialized. */
+  unserializable: number
+  /** Entries dropped because the byte budget was exhausted. */
+  overBudget: number
+}
+
+/** A fitted `ts-eids` cookie value and the sources trimming touched. */
+export interface FittedEidCookie {
+  /** Base64 cookie value, or `undefined` when nothing fits. */
+  value: string | undefined
+  /** Sources removed whole. */
+  droppedSources: string[]
+  /** Sources that lost UIDs but stayed in the cookie. */
+  trimmedSources: string[]
+}
+
+export function collectBidderEids(
+  _bidderRequest: unknown,
+  _stats?: EidCollectionStats
+): unknown[] | undefined {
+  return undefined
+}
+
+export function fitEidCookie(_eids: readonly unknown[]): FittedEidCookie {
+  return { value: undefined, droppedSources: [], trimmedSources: [] }
+}
+```
+
+- [ ] **Step 2: Write the failing tests.**
+
+`test/integrations/prebid/eids.test.ts`:
+
+```ts
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  collectBidderEids,
+  fitEidCookie,
+  MAX_AUCTION_EIDS_BYTES,
+  MAX_EID_COOKIE_BYTES,
+  type EidCollectionStats,
+} from '../../../src/integrations/prebid/eids'
+import { FIXTURE_EIDS } from '../../fixtures/eid-fixture-input'
+
+function deepFreeze<T>(value: T, seen = new WeakSet<object>()): T {
+  if (value !== null && typeof value === 'object' && !seen.has(value)) {
+    seen.add(value)
+    for (const child of Object.values(value)) {
+      deepFreeze(child, seen)
+    }
+    Object.freeze(value)
+  }
+  return value
+}
+
+/** A bidder request shaped as Prebid passes it: frozen `ortb2`, `auctionId` hidden. */
+function bidderRequest(user: unknown): unknown {
+  return deepFreeze({
+    bidderCode: 'trustedServer',
+    auctionId: null,
+    ortb2: { user },
+  })
+}
+
+function freshStats(): EidCollectionStats {
+  return { forwarded: 0, unserializable: 0, overBudget: 0 }
+}
+
+function utf8Length(text: string): number {
+  return new TextEncoder().encode(text).length
+}
+
+/** An entry whose `JSON.stringify` is exactly `bytes` UTF-8 bytes long. */
+function entryOfBytes(source: string, bytes: number, filler = 'x'): unknown {
+  const base = JSON.stringify({ source, uids: [{ id: '' }] })
+  const fillerBytes = utf8Length(filler)
+  return {
+    source,
+    uids: [{ id: filler.repeat((bytes - utf8Length(base)) / fillerBytes) }],
+  }
+}
+
+function decodeCookie(value: string | undefined): unknown {
+  expect(value, 'should produce a cookie value').toBeDefined()
+  return JSON.parse(
+    new TextDecoder().decode(
+      Uint8Array.from(atob(value!), (char) => char.charCodeAt(0))
+    )
+  )
+}
+
+function readFixture(name: string): string {
+  return fs
+    .readFileSync(
+      path.resolve(
+        path.dirname(fileURLToPath(import.meta.url)),
+        '../../fixtures',
+        name
+      ),
+      'utf8'
+    )
+    .trimEnd()
+}
+
+const EXT_EID = {
+  source: 'ext.example.com',
+  uids: [{ id: 'ext-uid', atype: 1 }],
+}
+const USER_EID = {
+  source: 'user.example.com',
+  uids: [{ id: 'user-uid', atype: 1 }],
+}
+
+describe('collectBidderEids', () => {
+  it('reads ortb2.user.ext.eids', () => {
+    expect(
+      collectBidderEids(bidderRequest({ ext: { eids: [EXT_EID] } }))
+    ).toEqual([EXT_EID])
+  })
+
+  it('reads ortb2.user.eids, where RTD modules can write after normalization', () => {
+    expect(collectBidderEids(bidderRequest({ eids: [USER_EID] }))).toEqual([
+      USER_EID,
+    ])
+  })
+
+  it('reads user.ext.eids before user.eids', () => {
+    const request = bidderRequest({
+      ext: { eids: [EXT_EID] },
+      eids: [USER_EID],
+    })
+    expect(
+      Object.isFrozen((request as { ortb2: { user: object } }).ortb2.user),
+      'the input should be frozen as Prebid passes it'
+    ).toBe(true)
+
+    expect(collectBidderEids(request)).toEqual([EXT_EID, USER_EID])
+  })
+
+  it.each([
+    ['no user', bidderRequest(undefined)],
+    ['an empty user', bidderRequest({})],
+    [
+      'non-array paths',
+      bidderRequest({ ext: { eids: 'x' }, eids: { source: 'x' } }),
+    ],
+    ['no ortb2', deepFreeze({ bidderCode: 'trustedServer' })],
+  ])('returns undefined for %s', (_label, request) => {
+    expect(collectBidderEids(request)).toBeUndefined()
+  })
+
+  it.each([undefined, null, 'request', 7])(
+    'returns undefined for a bidder request that is not an object: %s',
+    (request) => {
+      expect(collectBidderEids(request)).toBeUndefined()
+    }
+  )
+
+  it('returns plain-data copies without undefined fields', () => {
+    const openPair = {
+      source: 'openpair.example.com',
+      inserter: undefined,
+      matcher: undefined,
+      mm: 3,
+      uids: [{ id: 'pair-uid', atype: 571187 }],
+    }
+
+    const result = collectBidderEids(
+      bidderRequest({ ext: { eids: [openPair] } })
+    )
+
+    expect(
+      result,
+      'undefined provenance fields should disappear'
+    ).toStrictEqual([
+      {
+        source: 'openpair.example.com',
+        mm: 3,
+        uids: [{ id: 'pair-uid', atype: 571187 }],
+      },
+    ])
+    expect(
+      result![0],
+      'the result should be a copy, not Prebid’s object'
+    ).not.toBe(openPair)
+  })
+
+  it('drops an entry whose serialization throws and keeps the others', () => {
+    const circular: Record<string, unknown> = {}
+    circular.self = circular
+    const stats = freshStats()
+
+    const result = collectBidderEids(
+      bidderRequest({
+        ext: {
+          eids: [
+            EXT_EID,
+            {
+              source: 'circular.example.com',
+              ext: circular,
+              uids: [{ id: 'c' }],
+            },
+            {
+              source: 'bigint.example.com',
+              uids: [{ id: 'b', atype: BigInt(10) }],
+            },
+            USER_EID,
+          ],
+        },
+      }),
+      stats
+    )
+
+    expect(result).toEqual([EXT_EID, USER_EID])
+    expect(stats).toEqual({ forwarded: 2, unserializable: 2, overBudget: 0 })
+  })
+
+  it('keeps a set that fits the UTF-8 budget exactly', () => {
+    const first = entryOfBytes(
+      'first.example.com',
+      MAX_AUCTION_EIDS_BYTES - 100
+    )
+    const second = entryOfBytes('second.example.com', 100)
+    const stats = freshStats()
+
+    expect(
+      collectBidderEids(
+        bidderRequest({ ext: { eids: [first, second] } }),
+        stats
+      )
+    ).toEqual([first, second])
+    expect(stats).toEqual({ forwarded: 2, unserializable: 0, overBudget: 0 })
+  })
+
+  it('drops the entry that crosses the budget and every entry after it', () => {
+    const first = entryOfBytes(
+      'first.example.com',
+      MAX_AUCTION_EIDS_BYTES - 100
+    )
+    const second = entryOfBytes('second.example.com', 101)
+    const third = entryOfBytes('third.example.com', 60)
+    const stats = freshStats()
+
+    expect(
+      collectBidderEids(
+        bidderRequest({ ext: { eids: [first, second, third] } }),
+        stats
+      )
+    ).toEqual([first])
+    expect(stats).toEqual({ forwarded: 1, unserializable: 0, overBudget: 2 })
+  })
+
+  it('measures the budget in UTF-8 bytes, not JavaScript string length', () => {
+    const ascii = entryOfBytes('ascii.example.com', 40_000)
+    // `€` is one UTF-16 code unit and three UTF-8 bytes: 53 bytes of JSON
+    // around 10,000 of them.
+    const multibyte = entryOfBytes('multibyte.example.com', 30_053, '€')
+    expect(
+      JSON.stringify(ascii).length + JSON.stringify(multibyte).length,
+      'precondition: the set fits by JavaScript length'
+    ).toBeLessThan(MAX_AUCTION_EIDS_BYTES)
+
+    expect(
+      collectBidderEids(bidderRequest({ ext: { eids: [ascii, multibyte] } }))
+    ).toEqual([ascii])
+  })
+
+  it('keeps order and repeated sources', () => {
+    const a1 = { source: 'a.example.com', mm: 1, uids: [{ id: 'u' }] }
+    const b = { source: 'b.example.com', uids: [{ id: 'u' }] }
+    const a2 = { source: 'a.example.com', mm: 2, uids: [{ id: 'u' }] }
+
+    expect(
+      collectBidderEids(bidderRequest({ ext: { eids: [a1, b, a2] } }))
+    ).toEqual([a1, b, a2])
+  })
+
+  it('forwards a lone surrogate unchanged for the server to drop', () => {
+    const result = collectBidderEids(
+      bidderRequest({ ext: { eids: FIXTURE_EIDS } })
+    )
+
+    expect(result).toEqual(FIXTURE_EIDS)
+    expect(
+      JSON.stringify(result),
+      'JSON.stringify should write the escape'
+    ).toContain('"bad-\\ud800-uid"')
+  })
+
+  it('passes the Prebid module shapes from spec 3.5 through as plain data', () => {
+    const fiftyOneDegrees = [
+      { source: '51d.es', mm: 1, uids: [{ id: 'device-1', atype: 1 }] },
+      { source: '51d.es', mm: 2, uids: [{ id: 'device-2', atype: 1 }] },
+    ]
+    const openPair = {
+      source: 'openpair.example.com',
+      inserter: undefined,
+      matcher: undefined,
+      uids: [{ id: 'p' }],
+    }
+    const liveIntent = {
+      source: 'liveintent.com',
+      ext: { segments: ['s1', 's2'] },
+      uids: [{ id: 'li', atype: 3 }],
+    }
+    const oneKey = {
+      source: 'paf.example.com',
+      ext: { preferences: { use_browsing_for_personalization: true } },
+      uids: [{ id: 'ok', atype: 1 }],
+    }
+    const pair = {
+      source: 'google.com',
+      uids: [{ id: 'pair-id', atype: 571187 }],
+    }
+
+    const result = collectBidderEids(
+      bidderRequest({
+        ext: { eids: [openPair, liveIntent, oneKey, pair] },
+        eids: fiftyOneDegrees,
+      })
+    )
+
+    expect(result).toStrictEqual([
+      { source: 'openpair.example.com', uids: [{ id: 'p' }] },
+      liveIntent,
+      oneKey,
+      pair,
+      ...fiftyOneDegrees,
+    ])
+  })
+})
+
+describe('fitEidCookie', () => {
+  it('removes EID-level ext and drops the duplicates that creates, comparing with sorted keys', () => {
+    const withExt = {
+      source: 'a.example.com',
+      ext: { segments: ['s1'] },
+      uids: [{ id: 'a' }],
+    }
+    const reordered = { uids: [{ id: 'a' }], source: 'a.example.com' }
+    const other = {
+      source: 'b.example.com',
+      uids: [{ id: 'b', ext: { kept: true } }],
+    }
+
+    const fitted = fitEidCookie([withExt, reordered, other])
+
+    expect(decodeCookie(fitted.value)).toEqual([
+      { source: 'a.example.com', uids: [{ id: 'a' }] },
+      other,
+    ])
+    expect(fitted.droppedSources).toEqual([])
+    expect(fitted.trimmedSources).toEqual([])
+  })
+
+  it('does not modify the entries it is given', () => {
+    const entry = {
+      source: 'a.example.com',
+      ext: { segments: ['s1'] },
+      uids: [{ id: 'a' }, { id: 'b' }],
+    }
+    const snapshot = structuredClone(entry)
+
+    fitEidCookie([entry])
+
+    expect(entry).toEqual(snapshot)
+  })
+
+  it('drops whole tail sources until the cookie fits', () => {
+    const long = 'x'.repeat(400)
+    const entries = [0, 1, 2, 3, 4, 5, 6].map((index) => ({
+      source: `s${index}.example.com`,
+      uids: [{ id: long, atype: 1 }],
+    }))
+
+    const fitted = fitEidCookie(entries)
+
+    expect(fitted.value!.length).toBeLessThanOrEqual(MAX_EID_COOKIE_BYTES)
+    expect(decodeCookie(fitted.value)).toEqual(entries.slice(0, 5))
+    expect(fitted.droppedSources).toEqual(['s6.example.com', 's5.example.com'])
+    expect(fitted.trimmedSources).toEqual([])
+  })
+
+  it('trims UIDs from the last source before dropping it', () => {
+    const long = 'x'.repeat(400)
+    const uids = Array.from({ length: 10 }, (_, index) => ({
+      id: `${long}${index}`,
+      atype: 1,
+    }))
+
+    const fitted = fitEidCookie([{ source: 'ids.example.com', uids }])
+
+    expect(decodeCookie(fitted.value)).toEqual([
+      { source: 'ids.example.com', uids: uids.slice(0, 5) },
+    ])
+    expect(fitted.droppedSources).toEqual([])
+    expect(fitted.trimmedSources).toEqual(['ids.example.com'])
+  })
+
+  it('reports a source trimmed and then dropped only as dropped', () => {
+    const huge = 'y'.repeat(2500)
+    const kept = {
+      source: 'kept.example.com',
+      uids: [{ id: 'kept', atype: 1 }],
+    }
+
+    const fitted = fitEidCookie([
+      kept,
+      {
+        source: 'dropped.example.com',
+        uids: Array.from({ length: 3 }, (_, index) => ({
+          id: `${huge}${index}`,
+          atype: 1,
+        })),
+      },
+    ])
+
+    expect(decodeCookie(fitted.value)).toEqual([kept])
+    expect(fitted.droppedSources).toEqual(['dropped.example.com'])
+    expect(fitted.trimmedSources).toEqual([])
+  })
+
+  it.each([
+    ['a string', 'x'.repeat(4000), '(malformed entry)'],
+    [
+      'an object without a uids array',
+      { source: 'no-uids.example.com', blob: 'x'.repeat(4000) },
+      'no-uids.example.com',
+    ],
+  ])('removes a last entry that is %s whole', (_label, last, droppedLabel) => {
+    const small = { source: 'small.example.com', uids: [{ id: 's' }] }
+
+    const fitted = fitEidCookie([small, last])
+
+    expect(decodeCookie(fitted.value)).toEqual([small])
+    expect(fitted.droppedSources).toEqual([droppedLabel])
+  })
+
+  it('removes a null last entry whole before trimming the entry before it', () => {
+    const big = {
+      source: 'big.example.com',
+      uids: [{ id: 'y'.repeat(1500) }, { id: 'z'.repeat(1500) }],
+    }
+
+    const fitted = fitEidCookie([big, null])
+
+    expect(decodeCookie(fitted.value)).toEqual([
+      { source: 'big.example.com', uids: [big.uids[0]] },
+    ])
+    expect(fitted.droppedSources).toEqual(['(malformed entry)'])
+    expect(fitted.trimmedSources).toEqual(['big.example.com'])
+  })
+
+  it('returns no value when nothing fits', () => {
+    const fitted = fitEidCookie([
+      { source: 'huge.example.com', uids: [{ id: 'h'.repeat(5000) }] },
+    ])
+
+    expect(fitted).toEqual({
+      value: undefined,
+      droppedSources: ['huge.example.com'],
+      trimmedSources: [],
+    })
+  })
+
+  it('encodes non-Latin-1 text as UTF-8 base64 that round-trips', () => {
+    const entries = [
+      {
+        source: 'ids.example.com',
+        inserter: 'inserter-€',
+        uids: [{ id: '日本' }],
+      },
+    ]
+    expect(
+      () => btoa(JSON.stringify(entries)),
+      'precondition: btoa alone throws here'
+    ).toThrow()
+
+    expect(decodeCookie(fitEidCookie(entries).value)).toEqual(entries)
+  })
+
+  it('matches btoa output for ASCII payloads', () => {
+    const entries = [
+      { source: 'ids.example.com', uids: [{ id: 'ascii-uid', atype: 1 }] },
+    ]
+
+    expect(fitEidCookie(entries).value).toBe(btoa(JSON.stringify(entries)))
+  })
+
+  it('produces exactly the ts-eids-cookie fixture for the fixture input', () => {
+    const collected = collectBidderEids(
+      bidderRequest({ ext: { eids: FIXTURE_EIDS } })
+    )
+
+    expect(fitEidCookie(collected!).value).toBe(
+      readFixture('ts-eids-cookie.txt')
+    )
+  })
+})
+```
+
+- [ ] **Step 3: Run them and see them fail.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/eids.test.ts`
+Expected: every test FAILS except the four `returns undefined …` and `… not an object` cases and `does not modify the entries it is given`, which the stub passes trivially. Record the failures. Step 4 must keep those passing; with the real implementation they test real behavior.
+
+- [ ] **Step 4: Implement `eids.ts`.**
+
+Replace the stub's two functions and add the helpers. Keep the constants and interfaces. Put the file header comment at the top:
+
+```ts
+// Plain-data copies of the EIDs Prebid placed in the `trustedServer` bidder
+// request, and the `ts-eids` cookie value built from them.
+//
+// Pure functions: nothing here reads `pbjs`, the DOM or the clock. The server
+// validates every entry of the body and the cookie alike (spec 4.4), so this
+// module checks nothing beyond what serialization needs.
+
+const utf8Encoder = new TextEncoder()
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/**
+ * Returns the arrays Prebid may hold EIDs in, in reading order:
+ * `ortb2.user.ext.eids`, then `ortb2.user.eids`. RTD modules write after
+ * Prebid normalizes first-party data, so `user.eids` can hold entries too.
+ * Prebid redacts both paths for the bidder, so reading both does not widen
+ * what `trustedServer` receives.
+ */
+function bidderEidArrays(bidderRequest: unknown): unknown[][] {
+  if (!isRecord(bidderRequest) || !isRecord(bidderRequest.ortb2)) {
+    return []
+  }
+  const user = bidderRequest.ortb2.user
+  if (!isRecord(user)) {
+    return []
+  }
+  const arrays: unknown[][] = []
+  if (isRecord(user.ext) && Array.isArray(user.ext.eids)) {
+    arrays.push(user.ext.eids)
+  }
+  if (Array.isArray(user.eids)) {
+    arrays.push(user.eids)
+  }
+  return arrays
+}
+
+function serializeEntry(entry: unknown): string | undefined {
+  try {
+    // `undefined` and functions serialize to `undefined`; treat them as
+    // unserializable like a circular object or a BigInt.
+    return JSON.stringify(entry)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Copies the EIDs Prebid placed in a `trustedServer` bidder request.
+ *
+ * Reads `ortb2.user.ext.eids` then `ortb2.user.eids`, copies each entry
+ * through a JSON round trip so the result is plain data (`undefined` fields
+ * disappear), drops entries that cannot be serialized, and keeps entries in
+ * order while their serializations total at most
+ * {@link MAX_AUCTION_EIDS_BYTES} UTF-8 bytes, dropping the rest. Entries are
+ * not merged and not validated.
+ *
+ * @param bidderRequest the second `buildRequests` argument
+ * @param stats filled with counts for debug logging, when given
+ * @returns the copied entries, or `undefined` when none remain
+ */
+export function collectBidderEids(
+  bidderRequest: unknown,
+  stats?: EidCollectionStats
+): unknown[] | undefined {
+  const collected: unknown[] = []
+  let usedBytes = 0
+  let budgetExhausted = false
+  let unserializable = 0
+  let overBudget = 0
+
+  for (const entries of bidderEidArrays(bidderRequest)) {
+    for (const entry of entries) {
+      const serialized = serializeEntry(entry)
+      if (serialized === undefined) {
+        unserializable += 1
+        continue
+      }
+      const bytes = utf8Encoder.encode(serialized).length
+      if (budgetExhausted || usedBytes + bytes > MAX_AUCTION_EIDS_BYTES) {
+        budgetExhausted = true
+        overBudget += 1
+        continue
+      }
+      usedBytes += bytes
+      collected.push(JSON.parse(serialized))
+    }
+  }
+
+  if (stats) {
+    stats.forwarded = collected.length
+    stats.unserializable = unserializable
+    stats.overBudget = overBudget
+  }
+  return collected.length > 0 ? collected : undefined
+}
+
+function withoutEidExt(entry: unknown): unknown {
+  if (!isRecord(entry) || !('ext' in entry)) {
+    return entry
+  }
+  const copy: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(entry)) {
+    if (key !== 'ext') {
+      copy[key] = value
+    }
+  }
+  return copy
+}
+
+/** JSON with object keys sorted at every level, for equality checks. */
+function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(',')}]`
+  }
+  if (isRecord(value)) {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+      .join(',')}}`
+  }
+  return JSON.stringify(value) ?? 'null'
+}
+
+function cookieLabel(entry: unknown): string {
+  return isRecord(entry) && typeof entry.source === 'string'
+    ? entry.source
+    : '(malformed entry)'
+}
+
+function encodeUtf8Base64(text: string): string {
+  let binary = ''
+  for (const byte of utf8Encoder.encode(text)) {
+    binary += String.fromCharCode(byte)
+  }
+  return btoa(binary)
+}
+
+/**
+ * Builds the `ts-eids` cookie value from a request's collected EIDs.
+ *
+ * Removes each entry's EID-level `ext`, drops entries that become identical
+ * (compared with sorted keys), then trims from the tail until the standard
+ * padded base64 of the JSON array's UTF-8 bytes is at most
+ * {@link MAX_EID_COOKIE_BYTES} long: drop UIDs from the last entry, then the
+ * entry itself, and repeat. A last entry that is not an object with a `uids`
+ * array is removed whole. The input is not modified.
+ *
+ * @param eids the entries forwarded in the `/auction` body
+ * @returns the cookie value, or `undefined` when nothing fits, and the
+ *   sources trimming touched
+ */
+export function fitEidCookie(eids: readonly unknown[]): FittedEidCookie {
+  const seen = new Set<string>()
+  const payload: unknown[] = []
+  for (const entry of eids) {
+    const stripped = withoutEidExt(entry)
+    const key = canonicalJson(stripped)
+    if (seen.has(key)) {
+      continue
+    }
+    seen.add(key)
+    payload.push(
+      isRecord(stripped) && Array.isArray(stripped.uids)
+        ? { ...stripped, uids: [...stripped.uids] }
+        : stripped
+    )
+  }
+
+  const dropped = new Set<string>()
+  const trimmed = new Set<string>()
+  while (payload.length > 0) {
+    const value = encodeUtf8Base64(JSON.stringify(payload))
+    if (value.length <= MAX_EID_COOKIE_BYTES) {
+      return {
+        value,
+        droppedSources: [...dropped],
+        trimmedSources: [...trimmed],
+      }
+    }
+
+    const last = payload[payload.length - 1]
+    if (isRecord(last) && Array.isArray(last.uids) && last.uids.length > 1) {
+      last.uids = last.uids.slice(0, -1)
+      trimmed.add(cookieLabel(last))
+      continue
+    }
+
+    payload.pop()
+    const label = cookieLabel(last)
+    dropped.add(label)
+    // A source trimmed and then dropped is reported once, as dropped.
+    trimmed.delete(label)
+  }
+
+  return {
+    value: undefined,
+    droppedSources: [...dropped],
+    trimmedSources: [...trimmed],
+  }
+}
+```
+
+The spread copies made for entries with a `uids` array are fresh objects, so `last.uids = …` never touches the caller's entries.
+
+- [ ] **Step 5: Run the tests.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/eids.test.ts`
+Expected: PASS. If the fixture test fails, compare `fitEidCookie(...).value` with the file character by character. The fixture is fixed by Task 3 and the Rust tests. Fix the code, not the file.
+
+- [ ] **Step 6: Format and commit.**
+
+Run: `cd crates/trusted-server-js/lib && npm run format:write && npm run format && npx vitest run test/integrations/prebid/eids.test.ts`
+Expected: format clean, tests PASS.
+
+```bash
+git add crates/trusted-server-js/lib/src/integrations/prebid/eids.ts crates/trusted-server-js/lib/test/integrations/prebid/eids.test.ts crates/trusted-server-js/lib/test/fixtures/eid-fixture-input.ts docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Add a pure collector for the trustedServer bidder request's EIDs" -m "collectBidderEids copies ortb2.user.ext.eids and user.eids as plain data within a 64 KiB UTF-8 budget. fitEidCookie builds the ts-eids value without EID-level ext, trimmed to 3,072 bytes and encoded as UTF-8 base64."
+```
+
+---
+
+### Task 7: The adapter forwards the bidder request's EIDs and owns `ts-eids` in `buildRequests`
+
+Spec: 4.2 (`buildRequests` steps 1 to 5, deletions), 4.3 (when, overlapping auctions, TCF block), 4.11, 4.12, 7.1 rules 2 to 6 and 10, 7.3, A1, A7.
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/core/auction.ts:23-41` (`AuctionUid`, `AuctionEid`)
+- Modify: `crates/trusted-server-js/lib/src/integrations/prebid/index.ts`: imports (`:26-35`), `PbjsGlobal` (`:37-45`), `MAX_OPENRTB_ATYPE` (`:151-153`), `PrebidUserIdEid` (`:1012-1015`), `sanitizeAuctionUid` (`:1076-1101`), `collectAuctionEids` (`:1891-1914`), adapter registration and `buildRequests` (`:2347-2376`), the chained `bidsBackHandler` (`:2537-2541`), and the cookie section (`:2900-3009`)
+- Test: `crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts`, `crates/trusted-server-js/lib/test/core/request.test.ts`
+
+**Interfaces:**
+
+- Consumes: `collectBidderEids`, `fitEidCookie`, `EidCollectionStats` (Task 6); `FIXTURE_EIDS` and both fixture files.
+- Produces: `buildRequests(validBidRequests, bidderRequest?: unknown)`; a `pbjs.onEvent('tcf2Enforcement', …)` listener registered once per page in `installPrebidNpm`; `export type AuctionEid = unknown`. `AuctionUid` is deleted.
+
+- [ ] **Step 1: Install the D1 canary and the cookie environment check.**
+
+In `test/integrations/prebid/index.test.ts`:
+
+1. In the `vi.hoisted` block (`:240-341`), add before `mockGetUserIdsAsEids`:
+
+```ts
+// D1 canary (spec 7.1 rule 3): an ID only pbjs.getUserIdsAsEids() knows. It
+// must never reach an /auction body or ts-eids.
+const CANARY_EID = {
+  source: 'canary.example.com',
+  uids: [{ id: 'canary-uid', atype: 1 }],
+}
+// Every /auction body the trustedServer adapter builds, recorded at the
+// adapter so no test can bypass the canary check.
+const auctionBodyLog = { bodies: [] as string[], total: 0 }
+```
+
+Change `mockGetUserIdsAsEids` to return the canary:
+
+```ts
+const mockGetUserIdsAsEids = vi.fn(
+  () =>
+    [CANARY_EID] as Array<{
+      source: string
+      uids?: Array<{ id: string; atype?: number }>
+    }>
+)
+```
+
+and `mockRegisterBidAdapter` to record built bodies:
+
+```ts
+const mockRegisterBidAdapter = vi.fn(
+  (
+    _bidder: unknown,
+    code: string,
+    spec: { buildRequests?: (...args: unknown[]) => { data?: unknown } }
+  ) => {
+    if (code !== 'trustedServer' || typeof spec?.buildRequests !== 'function')
+      return
+    const buildRequests = spec.buildRequests
+    spec.buildRequests = function (this: unknown, ...args: unknown[]) {
+      const request = buildRequests.apply(this, args)
+      auctionBodyLog.bodies.push(String(request?.data))
+      auctionBodyLog.total += 1
+      return request
+    }
+  }
+)
+```
+
+Add `CANARY_EID` and `auctionBodyLog` to the object `vi.hoisted` returns and to the destructuring at `:198`.
+
+2. In the four describe-level `beforeEach` blocks that reset the mock (`:580-581`, `:3363-3364`, `:4465-4466`, `:7552-7553`), change `mockGetUserIdsAsEids.mockReturnValue([]);` to `mockGetUserIdsAsEids.mockReturnValue([CANARY_EID]);`.
+
+3. Add `afterAll` and `beforeAll` to the `vitest` import. After the file-level `beforeEach` (`:370-376`) add the shared helpers and hooks:
+
+```ts
+function readTsEidsCookie(): string | undefined {
+  return document.cookie.match(/(?:^|; )ts-eids=([^;]*)/)?.[1] || undefined
+}
+
+function decodeBase64Utf8(value: string): string {
+  return new TextDecoder().decode(
+    Uint8Array.from(atob(value), (char) => char.charCodeAt(0))
+  )
+}
+
+function decodedTsEidsCookie(): unknown {
+  const value = readTsEidsCookie()
+  return value === undefined ? undefined : JSON.parse(decodeBase64Utf8(value))
+}
+
+function presetTsEidsCookie(value: string): void {
+  document.cookie = `ts-eids=${value}; Path=/; Secure; SameSite=Lax; Max-Age=60`
+  expect(readTsEidsCookie(), 'the preset ts-eids cookie should read back').toBe(
+    value
+  )
+}
+
+beforeAll(() => {
+  // jsdom silently drops a Secure cookie on a non-HTTPS URL other than
+  // localhost (spec 7.1 rule 5). Prove the shim's attributes survive here.
+  document.cookie = 'ts-eids-probe=1; Path=/; Secure; SameSite=Lax; Max-Age=60'
+  expect(
+    document.cookie,
+    'shim cookie attributes should be readable here'
+  ).toContain('ts-eids-probe=1')
+  document.cookie = 'ts-eids-probe=; Path=/; Max-Age=0'
+})
+
+afterEach(() => {
+  expect(
+    mockGetUserIdsAsEids(),
+    'a test switched the getUserIdsAsEids canary off'
+  ).toEqual([CANARY_EID])
+  for (const body of auctionBodyLog.bodies) {
+    expect(
+      body,
+      'the getUserIdsAsEids canary leaked into an /auction body'
+    ).not.toContain(CANARY_EID.source)
+  }
+  auctionBodyLog.bodies.length = 0
+  const cookie = readTsEidsCookie()
+  if (cookie !== undefined) {
+    let readable = cookie
+    try {
+      readable = decodeBase64Utf8(cookie)
+    } catch {
+      // A preset non-base64 test value; check it as written.
+    }
+    expect(
+      readable,
+      'the getUserIdsAsEids canary leaked into ts-eids'
+    ).not.toContain(CANARY_EID.source)
+  }
+})
+
+afterAll(() => {
+  expect(
+    auctionBodyLog.total,
+    'the canary should have inspected at least one /auction body'
+  ).toBeGreaterThan(0)
+})
+```
+
+4. Add the shared test inputs next to `TestAdapterSpec` (`:215`). Add these imports at the top: `fs` from `node:fs`, `path` from `node:path`, `fileURLToPath` from `node:url`, and `FIXTURE_EIDS` from `../../fixtures/eid-fixture-input`.
+
+```ts
+function deepFreeze<T>(value: T, seen = new WeakSet<object>()): T {
+  if (value !== null && typeof value === 'object' && !seen.has(value)) {
+    seen.add(value)
+    for (const child of Object.values(value)) {
+      deepFreeze(child, seen)
+    }
+    Object.freeze(value)
+  }
+  return value
+}
+
+/**
+ * A bidder request shaped as Prebid passes it to buildRequests: a frozen
+ * `ortb2` and `auctionId: null`, as Prebid's proxy hides it by default.
+ */
+function prebidBidderRequest(
+  user: Record<string, unknown>
+): Record<string, unknown> {
+  return deepFreeze({
+    bidderCode: 'trustedServer',
+    auctionId: null,
+    ortb2: { user },
+  })
+}
+
+function trustedServerBidRequests(): Array<Record<string, unknown>> {
+  return [
+    {
+      adUnitCode: 'div-gpt-1',
+      bidder: 'trustedServer',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      params: {},
+    },
+  ]
+}
+
+function readFixture(name: string): string {
+  return fs
+    .readFileSync(
+      path.resolve(
+        path.dirname(fileURLToPath(import.meta.url)),
+        '../../fixtures',
+        name
+      ),
+      'utf8'
+    )
+    .trimEnd()
+}
+```
+
+- [ ] **Step 2: Delete or rewrite the tests that encode the old collector.**
+
+In `describe('adapter spec')` (`:2385`):
+
+- `buildRequests includes current Prebid EIDs in the /auction payload` (`:2419`): delete. Step 3 covers it.
+- `forwards the opaque LiveRamp envelope as a liveramp.com EID` (`:2462`): rewrite so the envelope arrives in the bidder request:
+
+```ts
+it('forwards an opaque LiveRamp envelope from the bidder request unchanged', () => {
+  const spec = getAdapterSpec()
+  const liveramp = {
+    source: 'liveramp.com',
+    uids: [{ id: 'opaque-test-envelope', atype: 3 }],
+  }
+
+  const request = spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: [liveramp] } })
+  )
+
+  expect(JSON.parse(String(request.data)).eids).toEqual([liveramp])
+})
+```
+
+- `drops empty and malformed LiveRamp envelope values` (`:2489`): delete. TSJS no longer validates (spec O2). Task 2's tests cover the server.
+- `never writes an opaque LiveRamp envelope to logs` (`:2516`): delete. Step 3's logging test replaces it.
+- `buildRequests clears stale ts-eids cookie when current Prebid EIDs are absent` (`:2546`): delete. Step 3 replaces it.
+- `buildRequests preserves uid ext and sanitizes invalid atype values` (`:2563`): delete. Server-side rules are covered in Task 2.
+
+In `describe('requestBids shim')`, delete the cookie-sync tests that depend on `bidsBackHandler`: `syncs a structured ts-eids cookie after bidsBackHandler` (`:3160`), `preserves an opaque LiveRamp envelope in the ts-eids cookie` (`:3192`), `trims an oversized ts-eids cookie …` (`:3218`), `logs a source whose UIDs were partially trimmed but retained` (`:3265`), `reports a source trimmed and then dropped only as dropped` (`:3305`) and `clears ts-eids cookie after bidsBackHandler when no current EIDs remain` (`:3341`). Task 6 covers the trim rules. Step 3 covers the adapter's cookie and trim log.
+
+Then search the file for `mockGetUserIdsAsEids.mockReturnValue(`. The only matches left should be the four `beforeEach` lines from Step 1.
+
+- [ ] **Step 3: Write the failing adapter tests.**
+
+Inside `describe('adapter spec')`:
+
+```ts
+it('forwards bidderRequest.ortb2 EIDs with EID-level fields, user.ext.eids first', () => {
+  const spec = getAdapterSpec()
+  const extEid = {
+    source: 'adserver.org',
+    inserter: 'adserver.org',
+    matcher: 'adserver.org',
+    mm: 4,
+    uids: [{ id: 'fictional-tdid', atype: 1, ext: { rtiPartner: 'TDID' } }],
+  }
+  const userEid = {
+    source: '51d.es',
+    mm: 1,
+    uids: [{ id: 'fictional-device', atype: 1 }],
+  }
+
+  const result = spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: [extEid] }, eids: [userEid] })
+  )
+
+  expect(
+    JSON.parse(String(result.data)).eids,
+    'should forward both paths as sent'
+  ).toEqual([extEid, userEid])
+  expect(
+    mockGetUserIdsAsEids,
+    'should never read getUserIdsAsEids'
+  ).not.toHaveBeenCalled()
+  expect(
+    mockGetConfig.mock.calls.some(([key]) => key === 'ortb2'),
+    'should never read the global ortb2 config'
+  ).toBe(false)
+})
+
+it('sends exactly the auction-body fixture for the fixture input', () => {
+  const spec = getAdapterSpec()
+
+  const result = spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: FIXTURE_EIDS } })
+  )
+
+  expect(
+    String(result.data),
+    'TSJS should produce the Rust fixture byte for byte'
+  ).toBe(readFixture('auction-body-eids.txt'))
+})
+
+it('writes exactly the ts-eids fixture for the fixture input', () => {
+  const spec = getAdapterSpec()
+
+  spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: FIXTURE_EIDS } })
+  )
+
+  expect(readTsEidsCookie()).toBe(readFixture('ts-eids-cookie.txt'))
+})
+
+it('writes ts-eids from the body set without EID-level ext', () => {
+  const spec = getAdapterSpec()
+  const withExt = {
+    source: 'liveintent.example.com',
+    ext: { segments: ['s1'] },
+    uids: [{ id: 'li-uid', atype: 3 }],
+  }
+  const plain = {
+    source: 'ids.example.com',
+    uids: [{ id: 'ids-uid', atype: 1 }],
+  }
+
+  const result = spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: [withExt, plain] } })
+  )
+
+  expect(
+    JSON.parse(String(result.data)).eids,
+    'the body keeps EID-level ext'
+  ).toEqual([withExt, plain])
+  expect(
+    decodedTsEidsCookie(),
+    'the cookie copies the body set without EID-level ext'
+  ).toEqual([
+    { source: 'liveintent.example.com', uids: [{ id: 'li-uid', atype: 3 }] },
+    plain,
+  ])
+})
+
+it('clears ts-eids before the request when the bidder request holds no EIDs', () => {
+  const spec = getAdapterSpec()
+  presetTsEidsCookie('preset-value')
+
+  const result = spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({})
+  )
+
+  const payload = JSON.parse(String(result.data))
+  expect(payload.adUnits[0].code, 'the request should still be built').toBe(
+    'div-gpt-1'
+  )
+  expect(payload.eids, 'the body should carry no eids').toBeUndefined()
+  expect(readTsEidsCookie(), 'the cookie should be cleared').toBeUndefined()
+})
+
+it('sends no eids and leaves ts-eids alone without a bidder request object', () => {
+  const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {})
+  const spec = getAdapterSpec()
+  presetTsEidsCookie('preset-value')
+
+  const result = spec.buildRequests(trustedServerBidRequests())
+
+  expect(JSON.parse(String(result.data)).adUnits[0].code).toBe('div-gpt-1')
+  expect(JSON.parse(String(result.data)).eids).toBeUndefined()
+  expect(readTsEidsCookie(), 'the cookie should be unchanged').toBe(
+    'preset-value'
+  )
+  expect(
+    debugSpy.mock.calls.some(
+      ([message]) =>
+        typeof message === 'string' && message.includes('no bidder request')
+    ),
+    'should explain at debug level'
+  ).toBe(true)
+})
+
+it('lets the later of two overlapping requests own ts-eids', () => {
+  const spec = getAdapterSpec()
+  const first = { source: 'first.example.com', uids: [{ id: 'first-uid' }] }
+  const second = { source: 'second.example.com', uids: [{ id: 'second-uid' }] }
+
+  spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: [first] } })
+  )
+  spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: [second] } })
+  )
+
+  expect(decodedTsEidsCookie()).toEqual([second])
+})
+
+it('forwards ortb2 EIDs and writes ts-eids without the User ID module', () => {
+  const spec = getAdapterSpec()
+  const original = mockPbjs.getUserIdsAsEids
+  mockPbjs.getUserIdsAsEids =
+    undefined as unknown as typeof mockGetUserIdsAsEids
+  try {
+    const lockrId5 = {
+      source: 'id5-sync.com',
+      inserter: 'inserter.example.com',
+      mm: 2,
+      uids: [{ id: 'fictional-id5', atype: 1 }],
+    }
+
+    const result = spec.buildRequests(
+      trustedServerBidRequests(),
+      prebidBidderRequest({ ext: { eids: [lockrId5] } })
+    )
+
+    expect(JSON.parse(String(result.data)).eids).toEqual([lockrId5])
+    expect(decodedTsEidsCookie()).toEqual([lockrId5])
+  } finally {
+    mockPbjs.getUserIdsAsEids = original
+  }
+})
+
+it('logs EID counts and the cookie decision at debug level, never values', () => {
+  log.setLevel('debug')
+  const spies = [
+    vi.spyOn(log, 'debug').mockImplementation(() => {}),
+    vi.spyOn(log, 'info').mockImplementation(() => {}),
+    vi.spyOn(log, 'warn').mockImplementation(() => {}),
+    vi.spyOn(log, 'error').mockImplementation(() => {}),
+  ]
+  try {
+    const spec = getAdapterSpec()
+
+    spec.buildRequests(
+      trustedServerBidRequests(),
+      prebidBidderRequest({
+        ext: {
+          eids: [
+            { source: 'ids.example.com', uids: [{ id: 'secret-uid-value' }] },
+          ],
+        },
+      })
+    )
+
+    expect(spies[0]).toHaveBeenCalledWith(
+      '[tsjs-prebid] forwarding bidder EIDs',
+      {
+        forwarded: 1,
+        unserializable: 0,
+        overBudget: 0,
+        cookie: 'written',
+      }
+    )
+    const logged = spies.flatMap((spy) => spy.mock.calls).flat()
+    expect(
+      logged.some((value) =>
+        String(JSON.stringify(value)).includes('secret-uid-value')
+      ),
+      'no log argument may contain a UID value'
+    ).toBe(false)
+  } finally {
+    log.setLevel('warn')
+  }
+})
+
+it('keeps the trim log when the cookie had to drop sources', () => {
+  const debugSpy = vi.spyOn(log, 'debug').mockImplementation(() => {})
+  const spec = getAdapterSpec()
+  const long = 'x'.repeat(400)
+  const entries = [0, 1, 2, 3, 4, 5, 6].map((index) => ({
+    source: `s${index}.example.com`,
+    uids: [{ id: long, atype: 1 }],
+  }))
+
+  const result = spec.buildRequests(
+    trustedServerBidRequests(),
+    prebidBidderRequest({ ext: { eids: entries } })
+  )
+
+  expect(
+    JSON.parse(String(result.data)).eids,
+    'the body keeps every entry'
+  ).toEqual(entries)
+  expect(decodedTsEidsCookie(), 'the cookie keeps what fits').toEqual(
+    entries.slice(0, 5)
+  )
+  expect(debugSpy).toHaveBeenCalledWith(
+    '[tsjs-prebid] ts-eids cookie exceeded 3072 bytes; dropped sources: s6.example.com, s5.example.com'
+  )
+  expect(debugSpy).toHaveBeenCalledWith(
+    '[tsjs-prebid] forwarding bidder EIDs',
+    { forwarded: 7, unserializable: 0, overBudget: 0, cookie: 'trimmed' }
+  )
+})
+```
+
+Inside `describe('prebid/installPrebidNpm')`, outside `adapter spec`:
+
+```ts
+it('exposes the getUserIdsAsEids canary on the pbjs the shim uses', () => {
+  const pbjs = installPrebidNpm() as unknown as {
+    getUserIdsAsEids?: () => unknown
+  }
+
+  expect(pbjs.getUserIdsAsEids).toBe(mockGetUserIdsAsEids)
+  expect(pbjs.getUserIdsAsEids?.()).toEqual([CANARY_EID])
+})
+
+function tcfEnforcementHandler(): (event: unknown) => void {
+  installPrebidNpm()
+  const registration = mockOnEvent.mock.calls.find(
+    ([event]) => event === 'tcf2Enforcement'
+  )
+  expect(
+    registration,
+    'the shim should listen for tcf2Enforcement'
+  ).toBeDefined()
+  return registration![1] as (event: unknown) => void
+}
+
+it.each([
+  ['biddersBlocked', { biddersBlocked: ['trustedServer'], eidsBlocked: [] }],
+  ['eidsBlocked', { biddersBlocked: [], eidsBlocked: ['trustedServer'] }],
+])(
+  'clears ts-eids when tcf2Enforcement lists trustedServer in %s',
+  (_list, blocked) => {
+    const handler = tcfEnforcementHandler()
+    presetTsEidsCookie('preset-value')
+
+    handler({
+      storageBlocked: [],
+      analyticsBlocked: [],
+      ufpdBlocked: [],
+      geoBlocked: [],
+      ...blocked,
+    })
+
+    expect(readTsEidsCookie()).toBeUndefined()
+  }
+)
+
+it('leaves ts-eids alone when tcf2Enforcement lists only other bidders', () => {
+  const handler = tcfEnforcementHandler()
+  presetTsEidsCookie('preset-value')
+
+  handler({ biddersBlocked: ['appnexus'], eidsBlocked: ['appnexus'] })
+
+  expect(readTsEidsCookie()).toBe('preset-value')
+})
+
+it('leaves ts-eids alone when an auction builds no trustedServer request', () => {
+  mockRequestBids.mockImplementation(
+    (opts?: { bidsBackHandler?: () => void }) => {
+      opts?.bidsBackHandler?.()
+    }
+  )
+  presetTsEidsCookie('preset-value')
+  const pbjs = installPrebidNpm()
+
+  pbjs.requestBids({
+    adUnits: [{ bids: [{ bidder: 'appnexus', params: {} }] }],
+  } as unknown as RequestBidsArg)
+
+  expect(mockRequestBids, 'the auction should have run').toHaveBeenCalled()
+  expect(
+    readTsEidsCookie(),
+    'only buildRequests may write or clear the cookie'
+  ).toBe('preset-value')
+})
+```
+
+In `test/core/request.test.ts`, inside `describe('request.requestAds')`:
+
+```ts
+it('sends no eids in the /auction body', async () => {
+  globalThis.fetch = vi.fn().mockResolvedValue({
+    ok: true,
+    status: 200,
+    headers: { get: () => 'application/json' },
+    json: async () => ({ seatbid: [] }),
+  })
+  const { addAdUnits } = await import('../../src/core/registry')
+  const { requestAds } = await import('../../src/core/request')
+  document.body.innerHTML = '<div id="slot1"></div>'
+  addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } })
+
+  requestAds()
+  await flushRequestAds()
+
+  const [, init] = (globalThis.fetch as ReturnType<typeof vi.fn>).mock
+    .calls[0] as [string, RequestInit]
+  const body = JSON.parse(String(init.body)) as Record<string, unknown>
+  expect(body.adUnits, 'the body should carry the ad unit').toEqual([
+    {
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      bids: [],
+    },
+  ])
+  expect(
+    body,
+    'requestAds should leave EIDs to the ts-eids cookie'
+  ).not.toHaveProperty('eids')
+})
+```
+
+- [ ] **Step 4: Run them and see them fail.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/index.test.ts test/core/request.test.ts`
+Expected before the change:
+
+- Every new `adapter spec` test FAILS. The old collector ignores the bidder request and forwards the canary, so the shared `afterEach` also reports `the getUserIdsAsEids canary leaked into an /auction body` for every test that builds a request.
+- The two `clears ts-eids when tcf2Enforcement …` cases FAIL: no listener is registered.
+- `leaves ts-eids alone when an auction builds no trustedServer request` FAILS: `main`'s `bidsBackHandler` writes the canary into the cookie.
+- `leaves ts-eids alone when tcf2Enforcement lists only other bidders` FAILS at `tcfEnforcementHandler`: no registration.
+- `exposes the getUserIdsAsEids canary …` and `sends no eids in the /auction body` PASS. They are positive controls and nets. Prove the second in Step 7.
+
+Record a representative failure for each test.
+
+- [ ] **Step 5: Make `AuctionEid` opaque.**
+
+In `src/core/auction.ts`, delete `AuctionUid` (`:23-28`) and replace `AuctionEid` (`:30-34`):
+
+```ts
+/**
+ * An auction-level EID entry forwarded to the server.
+ *
+ * TSJS forwards the entries Prebid placed in the `trustedServer` bidder
+ * request as plain data and the server validates each one, so the server
+ * defines the contract.
+ */
+export type AuctionEid = unknown
+```
+
+- [ ] **Step 6: Rewire the adapter.**
+
+In `src/integrations/prebid/index.ts`:
+
+1. Imports: change `import type { AuctionBid, AuctionEid } from '../../core/auction';` to `import type { AuctionBid } from '../../core/auction';`, and add:
+
+```ts
+import {
+  collectBidderEids,
+  fitEidCookie,
+  MAX_EID_COOKIE_BYTES,
+  type EidCollectionStats,
+} from './eids'
+```
+
+2. `PbjsGlobal` (`:37-45`) no longer needs the `getUserIdsAsEids` extension:
+
+```ts
+/** Prebid.js public API surface (type-only; erased at build time). */
+type PbjsGlobal = typeof _pbjsDefault
+```
+
+3. Delete `MAX_OPENRTB_ATYPE` and its two comment lines (`:151-153`), `PrebidUserIdEid` (`:1012-1015`), `sanitizeAuctionUid` (`:1076-1101`) and `collectAuctionEids` (`:1891-1914`). Keep `isDefined`, which other code uses.
+
+4. In the adapter registration, replace `buildRequests` (`:2357-2376`):
+
+```ts
+    buildRequests(
+      validBidRequests: TrustedServerBidRequest[],
+      bidderRequest?: unknown
+    ): TrustedServerRequest {
+      log.debug('[tsjs-prebid] buildRequests', { count: validBidRequests.length });
+      const requestScopedBidRequests = [...validBidRequests];
+      const auctionEids = forwardBidderEids(bidderRequest);
+      const payload = buildAdRequest(validBidRequests, { eids: auctionEids });
+      return {
+        method: 'POST',
+        url: auctionEndpoint,
+        data: JSON.stringify(payload),
+        options: { contentType: 'application/json' },
+        // Keep bid requests on the request object so interpretResponse can
+        // map bids without relying on shared mutable adapter state.
+        bidRequests: requestScopedBidRequests,
+        tsjsBidRequests: requestScopedBidRequests,
+      };
+    },
+```
+
+5. Right after the `registerBidAdapter(…)` call closes (`:2389`), register the TCF listener:
+
+```ts
+// Prebid never calls buildRequests for a bidder its TCF rules block, so
+// without this a ts-eids cookie written before consent changed would live
+// for its full day. Prebid emits the event at AUCTION_END, before
+// bidsBackHandler.
+const prebidEvents = pbjs as unknown as {
+  onEvent?: (event: string, handler: (payload: unknown) => void) => void
+}
+if (typeof prebidEvents.onEvent === 'function') {
+  prebidEvents.onEvent('tcf2Enforcement', (payload) => {
+    if (tcfBlocksTrustedServer(payload)) {
+      clearPrebidEidsCookie()
+      log.debug(
+        '[tsjs-prebid] cleared ts-eids: Prebid TCF rules blocked trustedServer'
+      )
+    }
+  })
+}
+```
+
+6. In the `requestBids` wrapper (`:2537-2541`), remove `syncPrebidEidsCookie();`. Replace the comment above the chained handler with `// Chain a bidsBackHandler to register this auction's publisher bids before the publisher's handler runs.`
+
+7. Replace the cookie section from the `Prebid EID cookie sync` banner (`:2900`) through `syncPrebidEidsCookie` (`:3009`) with:
+
+```ts
+// ---------------------------------------------------------------------------
+// Prebid EID forwarding and the ts-eids cookie
+// ---------------------------------------------------------------------------
+
+/** Cookie name for persisted Prebid EIDs. */
+const EID_COOKIE_NAME = 'ts-eids'
+
+/** Cookie max-age in seconds (1 day). */
+const EID_COOKIE_MAX_AGE = 86400
+
+/** What `buildRequests` did with `ts-eids`, for debug logs. */
+type EidCookieDecision = 'written' | 'trimmed' | 'cleared'
+
+/** Clears any previously persisted Prebid EIDs cookie. */
+function clearPrebidEidsCookie(): void {
+  document.cookie = `${EID_COOKIE_NAME}=; Path=/; Secure; SameSite=Lax; Max-Age=0`
+}
+
+/**
+ * Logs which EID sources the cookie had to drop or trim UIDs from, if any.
+ * Debug level: `/auction` sends the untrimmed set in the request body, so a
+ * trimmed cookie is expected steady state rather than a warning.
+ */
+function logTrimmedEidSources(
+  droppedSources: string[],
+  trimmedSources: string[]
+): void {
+  if (droppedSources.length === 0 && trimmedSources.length === 0) {
+    return
+  }
+  const parts: string[] = []
+  if (droppedSources.length > 0) {
+    parts.push(`dropped sources: ${droppedSources.join(', ')}`)
+  }
+  if (trimmedSources.length > 0) {
+    parts.push(`trimmed uids from sources: ${trimmedSources.join(', ')}`)
+  }
+  log.debug(
+    `[tsjs-prebid] ts-eids cookie exceeded ${MAX_EID_COOKIE_BYTES} bytes; ${parts.join('; ')}`
+  )
+}
+
+/**
+ * Writes `ts-eids` from the EIDs of the `trustedServer` request being built:
+ * the same entries without EID-level `ext`, fitted to the cookie size cap.
+ * Clears the cookie when nothing fits or encoding fails, so it never holds a
+ * set that no longer matches the latest request.
+ */
+function writePrebidEidsCookie(eids: unknown[]): EidCookieDecision {
+  try {
+    const fitted = fitEidCookie(eids)
+    logTrimmedEidSources(fitted.droppedSources, fitted.trimmedSources)
+    if (fitted.value === undefined) {
+      clearPrebidEidsCookie()
+      return 'cleared'
+    }
+    document.cookie = `${EID_COOKIE_NAME}=${fitted.value}; Path=/; Secure; SameSite=Lax; Max-Age=${EID_COOKIE_MAX_AGE}`
+    return fitted.droppedSources.length > 0 || fitted.trimmedSources.length > 0
+      ? 'trimmed'
+      : 'written'
+  } catch {
+    log.warn('[tsjs-prebid] failed to write the ts-eids cookie; clearing it')
+    clearPrebidEidsCookie()
+    return 'cleared'
+  }
+}
+
+/**
+ * Collects the EIDs Prebid placed in this `trustedServer` bidder request and
+ * mirrors them into `ts-eids` synchronously, before Prebid sends the request,
+ * so the server never falls back to a stale cookie for it.
+ *
+ * `bidderRequest.ortb2` is what Prebid lets `trustedServer` see: global
+ * first-party data merged with its own bidder fragment, IDs restricted to
+ * other bidders excluded, activity controls applied. Nothing else is read:
+ * not `getUserIdsAsEids()`, not the `ortb2` config, not `auctionId`.
+ */
+function forwardBidderEids(bidderRequest: unknown): unknown[] | undefined {
+  if (bidderRequest === null || typeof bidderRequest !== 'object') {
+    log.debug(
+      '[tsjs-prebid] buildRequests got no bidder request; sending no EIDs and leaving ts-eids unchanged'
+    )
+    return undefined
+  }
+
+  const stats: EidCollectionStats = {
+    forwarded: 0,
+    unserializable: 0,
+    overBudget: 0,
+  }
+  const eids = collectBidderEids(bidderRequest, stats)
+  let cookie: EidCookieDecision
+  if (eids) {
+    cookie = writePrebidEidsCookie(eids)
+  } else {
+    clearPrebidEidsCookie()
+    cookie = 'cleared'
+  }
+  log.debug('[tsjs-prebid] forwarding bidder EIDs', { ...stats, cookie })
+  return eids
+}
+
+/** Whether a `tcf2Enforcement` payload says Prebid blocked `trustedServer` or its EIDs. */
+function tcfBlocksTrustedServer(payload: unknown): boolean {
+  if (payload === null || typeof payload !== 'object') {
+    return false
+  }
+  const { biddersBlocked, eidsBlocked } = payload as {
+    biddersBlocked?: unknown
+    eidsBlocked?: unknown
+  }
+  return [biddersBlocked, eidsBlocked].some(
+    (blocked) => Array.isArray(blocked) && blocked.includes(ADAPTER_CODE)
+  )
+}
+```
+
+Function declarations are hoisted, so `installPrebidNpm` may call these even though they appear later in the file, as it already does with `clearPrebidEidsCookie`.
+
+- [ ] **Step 7: Run the tests and prove the net.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/index.test.ts test/integrations/prebid/eids.test.ts test/core/request.test.ts test/core/auction.test.ts`
+Expected: PASS, including the canary `afterEach` and `afterAll`.
+
+Prove the `requestAds` net: temporarily change `src/core/request.ts:45` to `const payload = { ...buildAdRequest(adUnits, { eids: [{ source: 'net.example.com', uids: [{ id: 'net' }] }] }), config };` and run `npx vitest run test/core/request.test.ts -t "sends no eids"`. It must FAIL. Restore it, and record the result.
+
+- [ ] **Step 8: Full JS suite, including the artifact size bound.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run && npm run format`
+Expected: PASS. `test/prebid-artifact-integration.test.mjs` asserts the served shim stays under 41,000 characters (`:313`). This task removes about as much code as it adds. If that assertion fails, report the new size instead of raising the bound. The bound exists to catch a value-import of Prebid.
+
+- [ ] **Step 9: Commit.**
+
+```bash
+git add crates/trusted-server-js/lib/src crates/trusted-server-js/lib/test docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Forward the trustedServer bidder request's EIDs and write ts-eids in buildRequests" -m "buildRequests reads bidderRequest.ortb2 instead of getUserIdsAsEids(), so IDs restricted to other bidders or redacted for trustedServer are no longer forwarded, and ortb2 EIDs such as Lockr's ID5 now arrive with their EID-level fields. The cookie copies each request's set before it is sent and is cleared when Prebid's TCF rules block trustedServer. bidsBackHandler no longer touches it."
+```
+
+---
+
+### Task 8: Stop writing Prebid `userSync` settings
+
+Spec: D4, 4.9 ("Change" and "Effects"), 7.3 (last two bullets), A6.
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/integrations/prebid/index.ts` (`installUserIdModules` `:2874-2898`, self-init `:3011-3035`)
+- Test: `crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts` (`describe('prebid self-init user ID module timing')` `:8049-8091`, and the `preserves publisher userSync …` test `:1318`)
+
+**Interfaces:**
+
+- Produces: `installUserIdModules` is removed from the module's exports. Before deleting it, run `git grep -n installUserIdModules crates docs` and confirm that only `index.ts`, its test and docs reference it.
+
+- [ ] **Step 1: Write the failing tests.**
+
+Replace `describe('prebid self-init user ID module timing', …)` (`:8049-8091`) with:
+
+```ts
+describe('prebid self-init writes no Prebid userSync settings', () => {
+  const userSyncCalls = () =>
+    mockSetConfig.mock.calls.filter(
+      ([arg]) => arg !== null && typeof arg === 'object' && 'userSync' in arg
+    )
+
+  const setReadyState = (value: DocumentReadyState) => {
+    Object.defineProperty(document, 'readyState', { value, configurable: true })
+  }
+
+  beforeEach(() => {
+    vi.resetModules()
+    mockSetConfig.mockClear()
+  })
+
+  afterEach(() => {
+    setReadyState('complete')
+  })
+
+  it('writes no userSync when the bundle loads after window load', async () => {
+    setReadyState('complete')
+
+    await import('../../../src/integrations/prebid/index')
+
+    expect(
+      mockSetConfig,
+      'the shim should still apply its own config'
+    ).toHaveBeenCalledWith({
+      debug: false,
+    })
+    expect(
+      userSyncCalls(),
+      'TS should leave userSync to the publisher and Prebid'
+    ).toEqual([])
+  })
+
+  it('writes no userSync when window load fires after install', async () => {
+    setReadyState('loading')
+
+    await import('../../../src/integrations/prebid/index')
+    window.dispatchEvent(new Event('load'))
+
+    expect(
+      mockSetConfig,
+      'the shim should still apply its own config'
+    ).toHaveBeenCalledWith({
+      debug: false,
+    })
+    expect(
+      userSyncCalls(),
+      'TS should leave userSync to the publisher and Prebid'
+    ).toEqual([])
+  })
+})
+```
+
+In `preserves publisher userSync and autoRefresh=%s when seeding late IDs` (`:1318`), extend the effective config so the existing exact assertions also cover `syncDelay` and `filterSettings` (spec 7.3):
+
+```ts
+const userSync = {
+  userIds: [],
+  auctionDelay: 300,
+  syncDelay: 50,
+  filterSettings: { image: { bidders: '*', filter: 'include' } },
+  syncEnabled: false,
+  autoRefresh,
+}
+```
+
+- [ ] **Step 2: Run them and see them fail.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/index.test.ts -t "writes no userSync|preserves publisher userSync"`
+Expected: both `writes no userSync …` tests FAIL with one `userSync` call (`auctionDelay: 0`, `syncDelay: 3000`, `filterSettings.all`). The extended `preserves publisher userSync …` PASSES. It is a net for the seeding path, proved in Step 4. Record this.
+
+- [ ] **Step 3: Delete `installUserIdModules` and its load hook.**
+
+In `src/integrations/prebid/index.ts`, delete `installUserIdModules` and its doc comment (`:2874-2898`). Replace the self-init block (`:3011-3035`) with:
+
+```ts
+// Self-initialize when loaded in a browser (same pattern as other integrations).
+if (typeof window !== 'undefined') {
+  installPrebidNpm()
+  // When the external bundle failed to load, installPrebidNpm bailed out and
+  // pbjs.requestBids is undefined. Installing the refresh handler anyway
+  // would clear TS-applied GPT targeting on every publisher refresh and then
+  // fail to run the replacement auction — leave GPT untouched instead.
+  if (hasPrebidJsApi()) {
+    installRefreshHandler()
+  }
+  // TS writes no userSync values beyond managed userIds (and autoRefresh on a
+  // late seed), so the publisher's or Prebid's auctionDelay applies from the
+  // first auction.
+}
+```
+
+Leave the managed seeding's `autoRefresh: true` write (`:2248-2256`) unchanged (spec 4.9).
+
+- [ ] **Step 4: Run the tests and prove the net.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/index.test.ts`
+Expected: PASS.
+
+Prove the seeding net: temporarily change `...(isRecord(effectiveUserSync) ? effectiveUserSync : {}),` (`:2242`) to `...{},` and run `npx vitest run test/integrations/prebid/index.test.ts -t "preserves publisher userSync"`. It must FAIL. Restore it, and record the result.
+
+- [ ] **Step 5: Full JS suite, format, commit.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run && npm run format`
+Expected: PASS.
+
+```bash
+git add crates/trusted-server-js/lib/src/integrations/prebid/index.ts crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Stop overriding the publisher's Prebid userSync settings" -m "installUserIdModules forced auctionDelay 0, syncDelay 3000, syncsPerBidder 5 and iframe syncs for every bidder on window.load. Prebid accumulates userSync settings, so every later auction ran without waiting for pending IDs. TS now writes only managed userIds and, on a late seed, autoRefresh."
+```
+
+---
+
+### Task 9: Prove D1, D3, D4 and the TCF behavior with real Prebid.js
+
+Spec: 7.5 (harness work and the four arms), 7.1 rules 1, 2, 5 and 12, O8, A1, A6, A7, A10.
+
+Unit tests can only check what a mocked `pbjs` receives. These arms evaluate the real generated bundle and the real shim in a JSDOM page, the way `test/prebid-artifact-integration.test.mjs` and `test/prebid-consent-enforcement.test.mjs` do, and capture `/auction` bodies. CI runs them with the rest of Vitest.
+
+They go in one new suite file. Spec 7.5 allows "extending one suite or sharing helpers", and a separate file leaves the two existing suites' tests untouched. The new file combines the consent suite's `__tcfapi` stub with the artifact suite's body capture.
+
+**Files:**
+
+- Create: `crates/trusted-server-js/lib/test/prebid-eid-fidelity.test.mjs`
+
+**Interfaces:**
+
+- Consumes: `main` from `build-prebid-external.mjs` and `moduleBuildOptions` from `build-module-options.mjs`, used as the artifact suite does at `test/prebid-artifact-integration.test.mjs:16-66`.
+
+The arms must fail against `main` (spec 7.1 rule 1). The shim is built from `src/` in `beforeAll`, so Step 3 proves red by building it from `main`'s sources.
+
+Harness facts checked while writing this plan (jsdom 28.1.0, Prebid 10.26.0):
+
+- A `<link rel="stylesheet">` whose interceptor response is held keeps `document.readyState` at `loading` and delays `window.load` until it resolves.
+- jsdom 28.1.0 exposes `TextEncoder` and `TextDecoder` on the page window, so the harness need not copy them.
+- Prebid's `ajax` binds `window.fetch` when the bundle is evaluated (`src/ajax.ts:8-9`), so the fetch spy must exist before `eval(bundleCode)`.
+- `tcf2Enforcement` carries `biddersBlocked` and `eidsBlocked` arrays (`modules/tcfControl.ts:319-336`). `pbjs.getEvents()` returns `{ eventType, args }` records.
+- unifiedId accepts `params.url`. It reads `{ "TDID": … }` and emits `adserver.org` with `inserter`/`matcher` `adserver.org`, `mm: 4`, `atype: 1` and UID `ext.rtiPartner: "TDID"` (`modules/unifiedIdSystem.js:36-90`, `libraries/uid1Eids/uid1Eids.js`).
+- sharedId emits `pubcid.org` with `atype: 1`. identityLink emits `liveramp.com` with `atype: 3` and has GVL ID 97.
+
+- [ ] **Step 1: Write the suite.**
+
+`test/prebid-eid-fidelity.test.mjs`:
+
+```js
+// @vitest-environment node
+
+// Real Prebid.js arms for the trustedServer EID contract (spec 7.5). Unit
+// tests mock window.pbjs; this suite evaluates the generated external bundle
+// and the served shim together in a JSDOM page and captures /auction bodies.
+// Every arm except the D4 control fails against a shim built from main.
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { JSDOM, requestInterceptor } from 'jsdom'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+import { moduleBuildOptions } from '../build-module-options.mjs'
+import { main } from '../build-prebid-external.mjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const libDir = path.resolve(__dirname, '..')
+
+const PAGE_ORIGIN = 'https://pub.example.com'
+const HOLD_LOAD_PATH = '/hold-window-load.css'
+const UNIFIED_ID_PATH = '/unified-id'
+const UNIFIED_ID_DELAY_MS = 200
+const IDENTITY_LINK_GVL_ID = 97
+
+const CONTROL_EID = {
+  source: 'control.example.com',
+  uids: [{ id: 'control-uid', atype: 1 }],
+}
+const PRESET_COOKIE_EIDS = [
+  { source: 'preset.example.com', uids: [{ id: 'preset-uid' }] },
+]
+const LIVERAMP_EID = {
+  source: 'liveramp.com',
+  uids: [{ id: 'fictional-idl-envelope', atype: 3 }],
+}
+const UNIFIED_ID_EID = {
+  source: 'adserver.org',
+  inserter: 'adserver.org',
+  matcher: 'adserver.org',
+  mm: 4,
+  uids: [{ id: 'fictional-tdid', atype: 1, ext: { rtiPartner: 'TDID' } }],
+}
+// The only safe form of a trustedServer TCF exception (spec 3.7).
+const FULL_BASIC_ADS_RULE = {
+  purpose: 'basicAds',
+  enforcePurpose: true,
+  enforceVendor: true,
+  softVendorExceptions: ['trustedServer'],
+}
+
+let outputDirectory
+let bundleCode
+let shimCode
+
+beforeAll(async () => {
+  outputDirectory = fs.mkdtempSync(
+    path.join(os.tmpdir(), 'trusted-server-prebid-eids-')
+  )
+  await main([
+    '--modules-json',
+    JSON.stringify({
+      bidder: ['appnexusBidAdapter'],
+      userId: ['sharedIdSystem', 'unifiedIdSystem', 'identityLinkIdSystem'],
+    }),
+    '--out',
+    outputDirectory,
+  ])
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(outputDirectory, 'manifest.json'), 'utf8')
+  )
+  bundleCode = fs.readFileSync(
+    path.join(outputDirectory, manifest.filename),
+    'utf8'
+  )
+
+  const { build } = await import('vite')
+  await build(
+    moduleBuildOptions({
+      name: 'prebid',
+      entryPath: path.join(libDir, 'src', 'integrations', 'prebid', 'index.ts'),
+      outDir: outputDirectory,
+    })
+  )
+  shimCode = fs.readFileSync(
+    path.join(outputDirectory, 'tsjs-prebid.js'),
+    'utf8'
+  )
+}, 240_000)
+
+afterAll(() => {
+  fs.rmSync(outputDirectory, { recursive: true, force: true })
+})
+
+function tcfData(vendorConsents) {
+  return {
+    gdprApplies: true,
+    tcString: 'CPexampleTCStringForTests',
+    eventStatus: 'tcloaded',
+    cmpStatus: 'loaded',
+    apiVersion: '2',
+    purpose: {
+      consents: { 1: true, 2: true, 3: true, 4: true },
+      legitimateInterests: {},
+    },
+    vendor: { consents: vendorConsents, legitimateInterests: {} },
+    publisher: { restrictions: {} },
+    specialFeatureOptins: {},
+  }
+}
+
+/** A CMP that answers at once: Purposes 1 to 4 consented, the given vendors only. */
+function tcfApi(vendorConsents) {
+  let nextListenerId = 1
+  return (command, _version, callback) => {
+    if (command === 'addEventListener') {
+      callback(
+        { ...tcfData(vendorConsents), listenerId: nextListenerId++ },
+        true
+      )
+    } else if (command === 'getTCData') {
+      callback(tcfData(vendorConsents), true)
+    } else if (command === 'removeEventListener') {
+      callback(true, true)
+    }
+  }
+}
+
+/**
+ * A publisher page whose window.load is held by a stylesheet until
+ * releaseLoad(). Every fetch goes to a spy, installed before the bundle is
+ * evaluated, that records /auction bodies and answers the unifiedId endpoint
+ * after UNIFIED_ID_DELAY_MS.
+ */
+function createPage({ cookies = [], vendorConsents } = {}) {
+  let releaseHeldLoad
+  const loadHeld = new Promise((resolve) => {
+    releaseHeldLoad = resolve
+  })
+  const dom = new JSDOM(
+    `<!doctype html><html><head><link rel="stylesheet" href="${PAGE_ORIGIN}${HOLD_LOAD_PATH}"></head><body></body></html>`,
+    {
+      url: `${PAGE_ORIGIN}/article`,
+      runScripts: 'outside-only',
+      pretendToBeVisual: true,
+      resources: {
+        interceptors: [
+          requestInterceptor(async (request) => {
+            if (new URL(request.url).pathname === HOLD_LOAD_PATH) {
+              await loadHeld
+              return new Response('', {
+                status: 200,
+                headers: { 'Content-Type': 'text/css' },
+              })
+            }
+            return new Response('', { status: 204 })
+          }),
+        ],
+      },
+    }
+  )
+  const pageWindow = dom.window
+
+  // jsdom drops Secure cookies on non-HTTPS origins (spec 7.1 rule 5).
+  pageWindow.document.cookie = 'ts-eids-probe=1; Path=/; Secure; SameSite=Lax'
+  expect(
+    pageWindow.document.cookie,
+    'Secure cookies should work on the page origin'
+  ).toContain('ts-eids-probe=1')
+  pageWindow.document.cookie = 'ts-eids-probe=; Path=/; Max-Age=0'
+  for (const cookie of cookies) {
+    pageWindow.document.cookie = cookie
+  }
+
+  const auctionBodies = []
+  pageWindow.fetch = vi.fn(async (resource, init) => {
+    const url = new URL(
+      typeof resource === 'string' ? resource : resource.url,
+      PAGE_ORIGIN
+    )
+    if (url.pathname === '/auction') {
+      const body =
+        init?.body ??
+        (typeof resource === 'object'
+          ? await resource.clone().text()
+          : undefined)
+      auctionBodies.push(JSON.parse(body))
+    }
+    if (url.pathname === UNIFIED_ID_PATH) {
+      await new Promise((resolve) => setTimeout(resolve, UNIFIED_ID_DELAY_MS))
+      return new Response(JSON.stringify({ TDID: 'fictional-tdid' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+    return new Response('{}', {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  })
+  pageWindow.Request = class PageRequest extends Request {
+    constructor(resource, init) {
+      super(
+        typeof resource === 'string'
+          ? new URL(resource, PAGE_ORIGIN).href
+          : resource,
+        init
+      )
+    }
+  }
+  pageWindow.Headers = Headers
+  pageWindow.Response = Response
+  pageWindow.AbortController = AbortController
+  if (!('isSecureContext' in pageWindow)) {
+    pageWindow.isSecureContext = true
+  }
+  if (vendorConsents) {
+    pageWindow.__tcfapi = tcfApi(vendorConsents)
+  }
+
+  // Mirror the server's head-injected state.
+  pageWindow.eval('window.pbjs = { que: [], cmd: [] };')
+  pageWindow.__tsjs_prebid = { clientSideBidders: [], serverSideBidders: [] }
+
+  return {
+    pageWindow,
+    auctionBodies,
+    install() {
+      pageWindow.eval(bundleCode)
+      pageWindow.eval(shimCode)
+    },
+    async releaseLoad() {
+      releaseHeldLoad()
+      await vi.waitFor(() =>
+        expect(pageWindow.document.readyState).toBe('complete')
+      )
+    },
+    async close() {
+      releaseHeldLoad()
+      // Let in-flight User ID work settle before jsdom tears down.
+      await new Promise((resolve) =>
+        setTimeout(resolve, UNIFIED_ID_DELAY_MS + 100)
+      )
+      pageWindow.close()
+    },
+  }
+}
+
+function readTsEidsCookie(pageWindow) {
+  const value = pageWindow.document.cookie.match(/(?:^|; )ts-eids=([^;]*)/)?.[1]
+  if (!value) {
+    return undefined
+  }
+  return JSON.parse(
+    new TextDecoder().decode(
+      Uint8Array.from(atob(value), (char) => char.charCodeAt(0))
+    )
+  )
+}
+
+function presetTsEidsCookie() {
+  return `ts-eids=${btoa(JSON.stringify(PRESET_COOKIE_EIDS))}; Path=/; Secure; SameSite=Lax`
+}
+
+function requestBids(pageWindow, adUnits) {
+  return new Promise((resolve) => {
+    pageWindow.pbjs.requestBids({
+      adUnits,
+      timeout: 1000,
+      bidsBackHandler: () => resolve(),
+    })
+  })
+}
+
+/** An ad unit with no publisher bidders: the shim adds only trustedServer. */
+function trustedServerAdUnits() {
+  return [
+    {
+      code: 'ad-slot-1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      bids: [],
+    },
+  ]
+}
+
+/** An ad unit with a client-side bidder that has a GVL ID (appnexus, 32). */
+function clientBidderAdUnits() {
+  return [
+    {
+      code: 'ad-slot-1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+      bids: [{ bidder: 'appnexus', params: { placementId: 1 } }],
+    },
+  ]
+}
+
+function tcfEnforcementResults(pageWindow) {
+  return pageWindow.pbjs
+    .getEvents()
+    .filter((event) => event.eventType === 'tcf2Enforcement')
+    .map((event) => event.args)
+}
+
+describe('trustedServer EIDs with real Prebid.js', () => {
+  it('D1: never forwards an ID restricted to another bidder', async () => {
+    const page = createPage({
+      cookies: ['_sharedid=fictional-shared-id; Path=/'],
+    })
+    try {
+      page.install()
+      page.pageWindow.pbjs.setConfig({
+        userSync: {
+          auctionDelay: 300,
+          userIds: [
+            {
+              name: 'sharedId',
+              bidders: ['appnexus'],
+              storage: { type: 'cookie', name: '_sharedid', expires: 30 },
+            },
+          ],
+        },
+        ortb2: { user: { ext: { eids: [CONTROL_EID] } } },
+      })
+
+      await requestBids(page.pageWindow, trustedServerAdUnits())
+
+      expect(
+        page.pageWindow.pbjs.getUserIdsAsEids().map((eid) => eid.source),
+        'precondition: the restricted module produced its ID'
+      ).toContain('pubcid.org')
+      expect(
+        page.auctionBodies.map((body) => body.eids),
+        'the /auction body should carry the control and not the restricted ID'
+      ).toEqual([[CONTROL_EID]])
+      expect(
+        readTsEidsCookie(page.pageWindow),
+        'ts-eids should copy the body set'
+      ).toEqual([CONTROL_EID])
+    } finally {
+      await page.close()
+    }
+  }, 60_000)
+
+  it('D3: forwards same-source entries separately with their own EID-level fields', async () => {
+    const first = {
+      source: 'ids.example.com',
+      inserter: 'inserter-a.example.com',
+      mm: 2,
+      ext: { segments: ['s1'] },
+      uids: [{ id: 'ids-uid', atype: 1 }],
+    }
+    const second = {
+      source: 'ids.example.com',
+      inserter: 'inserter-b.example.com',
+      matcher: 'matcher-b.example.com',
+      mm: 3,
+      uids: [{ id: 'ids-uid', atype: 1 }],
+    }
+    const page = createPage()
+    try {
+      page.install()
+      page.pageWindow.pbjs.setConfig({
+        ortb2: { user: { ext: { eids: [first, second] } } },
+      })
+
+      await requestBids(page.pageWindow, trustedServerAdUnits())
+
+      expect(page.auctionBodies.map((body) => body.eids)).toEqual([
+        [first, second],
+      ])
+      const { ext: _eidExt, ...firstWithoutExt } = first
+      expect(
+        readTsEidsCookie(page.pageWindow),
+        'ts-eids should hold both entries without EID-level ext'
+      ).toEqual([firstWithoutExt, second])
+    } finally {
+      await page.close()
+    }
+  }, 60_000)
+
+  it('D4: the first auction after window.load waits for a pending User ID module', async () => {
+    const page = createPage()
+    try {
+      page.install()
+      expect(
+        page.pageWindow.document.readyState,
+        'step 1 starts before load'
+      ).toBe('loading')
+      await page.releaseLoad()
+
+      page.pageWindow.pbjs.setConfig({
+        userSync: {
+          userIds: [
+            {
+              name: 'unifiedId',
+              params: { url: `${PAGE_ORIGIN}${UNIFIED_ID_PATH}` },
+            },
+          ],
+        },
+      })
+      expect(
+        page.pageWindow.document.readyState,
+        'step 2 runs after load'
+      ).toBe('complete')
+      expect(
+        page.pageWindow.pbjs.getConfig('userSync').auctionDelay,
+        "Prebid's default auctionDelay should apply"
+      ).toBe(500)
+
+      await requestBids(page.pageWindow, trustedServerAdUnits())
+
+      expect(
+        page.auctionBodies.map((body) => body.eids),
+        'the first /auction should carry the delayed unifiedId'
+      ).toEqual([[UNIFIED_ID_EID]])
+    } finally {
+      await page.close()
+    }
+  }, 60_000)
+
+  it('D4 control: the first auction before window.load waits, on every build', async () => {
+    const page = createPage()
+    try {
+      page.install()
+      page.pageWindow.pbjs.setConfig({
+        userSync: {
+          userIds: [
+            {
+              name: 'unifiedId',
+              params: { url: `${PAGE_ORIGIN}${UNIFIED_ID_PATH}` },
+            },
+          ],
+        },
+      })
+      expect(
+        page.pageWindow.document.readyState,
+        'the auction runs before load'
+      ).toBe('loading')
+
+      await requestBids(page.pageWindow, trustedServerAdUnits())
+
+      // A projection, not the full entry: main drops EID-level fields, and
+      // this control must pass on main and on the branch alike.
+      expect(
+        page.auctionBodies.map((body) =>
+          (body.eids ?? []).map((eid) => [
+            eid.source,
+            eid.uids.map((uid) => uid.id),
+          ])
+        ),
+        'the spy and the module should deliver unifiedId to the first auction'
+      ).toEqual([[['adserver.org', ['fictional-tdid']]]])
+    } finally {
+      await page.close()
+    }
+  }, 60_000)
+
+  async function runTcfPage({ withRule }) {
+    const page = createPage({
+      cookies: ['idl_env=fictional-idl-envelope; Path=/', presetTsEidsCookie()],
+      vendorConsents: { [IDENTITY_LINK_GVL_ID]: true },
+    })
+    page.install()
+    expect(
+      readTsEidsCookie(page.pageWindow),
+      'precondition: ts-eids is preset'
+    ).toEqual(PRESET_COOKIE_EIDS)
+    page.pageWindow.pbjs.setConfig({
+      consentManagement: {
+        gdpr: {
+          cmpApi: 'iab',
+          timeout: 500,
+          ...(withRule ? { rules: [FULL_BASIC_ADS_RULE] } : {}),
+        },
+      },
+      userSync: {
+        auctionDelay: 300,
+        userIds: [
+          {
+            name: 'identityLink',
+            params: { pid: '999', notUse3P: true },
+            storage: { type: 'cookie', name: 'idl_env', expires: 15 },
+          },
+        ],
+      },
+      ortb2: { user: { ext: { eids: [CONTROL_EID] } } },
+    })
+    await requestBids(page.pageWindow, clientBidderAdUnits())
+    return page
+  }
+
+  it('TCF: without an exception no client EIDs reach TS and ts-eids is cleared', async () => {
+    const page = await runTcfPage({ withRule: false })
+    try {
+      expect(
+        tcfEnforcementResults(page.pageWindow).some((result) =>
+          result.biddersBlocked.includes('trustedServer')
+        ),
+        'positive control: Prebid blocked trustedServer'
+      ).toBe(true)
+      expect(page.auctionBodies, 'no /auction request should be sent').toEqual(
+        []
+      )
+      expect(
+        readTsEidsCookie(page.pageWindow),
+        'ts-eids should be cleared'
+      ).toBeUndefined()
+    } finally {
+      await page.close()
+    }
+  }, 60_000)
+
+  it('TCF: with the full basicAds rule TS gets its EIDs and other bidders stay blocked', async () => {
+    const page = await runTcfPage({ withRule: true })
+    try {
+      // Prebid appends module EIDs after ortb2 entries (spec 3.2 step 3).
+      expect(page.auctionBodies.map((body) => body.eids)).toEqual([
+        [CONTROL_EID, LIVERAMP_EID],
+      ])
+      const results = tcfEnforcementResults(page.pageWindow)
+      expect(
+        results.some((result) => result.biddersBlocked.includes('appnexus')),
+        'the rule must not switch off enforcement for other bidders'
+      ).toBe(true)
+      expect(
+        results.some((result) =>
+          result.biddersBlocked.includes('trustedServer')
+        ),
+        'trustedServer should not be blocked with the rule'
+      ).toBe(false)
+    } finally {
+      await page.close()
+    }
+  }, 60_000)
+})
+```
+
+- [ ] **Step 2: Run it on the branch.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/prebid-eid-fidelity.test.mjs`
+Expected: PASS.
+
+If an arm fails, find out why in `node_modules/prebid.js` before changing anything. Do not relax an assertion to make it pass. Some failures need reporting rather than fixing, for example a different EID order from Prebid, sharedId not producing an ID from the preset cookie, or identityLink needing more storage config to read `idl_env`. Report those in the red log and to the user with the Prebid source line, and change the test only if the spec's expectation still holds.
+
+- [ ] **Step 3: Prove every arm fails against `main`, except the D4 control.**
+
+Build the shim from `main`'s sources for one run, then restore:
+
+```bash
+BASE=$(git merge-base HEAD main)
+git show "$BASE":crates/trusted-server-js/lib/src/integrations/prebid/index.ts > crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+git show "$BASE":crates/trusted-server-js/lib/src/core/auction.ts > crates/trusted-server-js/lib/src/core/auction.ts
+(cd crates/trusted-server-js/lib && npx vitest run test/prebid-eid-fidelity.test.mjs)
+git checkout -- crates/trusted-server-js/lib/src/integrations/prebid/index.ts crates/trusted-server-js/lib/src/core/auction.ts
+git status --short crates/trusted-server-js/lib/src
+```
+
+Expected against `main`:
+
+- D1 FAILS: the body carries `pubcid.org` from `getUserIdsAsEids()`, not the control.
+- D3 FAILS: no `eids`, because `main` never reads `ortb2`.
+- D4 FAILS at the `auctionDelay` assertion: `0`, not `500`.
+- The D4 control PASSES.
+- TCF without an exception FAILS: `main`'s `bidsBackHandler` rewrites `ts-eids` with `liveramp.com`.
+- TCF with the rule FAILS: the body carries `liveramp.com` only.
+
+The final `git status` must show `src/` clean. Record each result. If an arm passes against `main`, it does not discriminate. Stop and report instead of committing it (spec 7.1 rule 1).
+
+- [ ] **Step 4: Commit.**
+
+```bash
+git add crates/trusted-server-js/lib/test/prebid-eid-fidelity.test.mjs docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Prove the trustedServer EID contract with real Prebid.js" -m "A JSDOM suite evaluates the generated bundle and the served shim and captures /auction bodies. It covers a bidder-restricted ID, same-source entries with their own fields, the first auction after window.load, and TCF with and without the full trustedServer exception. Every arm except the timing control fails against main."
+```
+
+---
+
+### Task 10: Delete the dead EID-to-module resolver
+
+Spec: D6, O6, 7.7 (CLI tests).
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json` (drop every `eidSources` key)
+- Modify: `crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts` (`:1-60`, `:104-145`)
+- Test: `crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts`
+
+**Interfaces:**
+
+- Removes: `resolvePrebidUserIdModulesFromEids`, `PrebidUserIdEidLike`, `PrebidUserIdModuleResolution`, and `PrebidUserIdModuleRegistryEntry.eidSources`. Run `git grep -n -E "resolvePrebidUserIdModulesFromEids|eidSources|PrebidUserIdEidLike" crates` first. Only these three files may match. The CLI's `PrebidUserIdModuleRegistryEntry` (`crates/trusted-server-cli/src/prebid_bundle.rs:211-215`) reads only `moduleName` and `configNames`, without `deny_unknown_fields`, so the JSON change does not affect it.
+
+- [ ] **Step 1: Write the failing test.**
+
+In `user_id_modules.test.ts`, add:
+
+```ts
+it('carries no EID source metadata', () => {
+  expect(
+    registry.modules.length,
+    'the registry should still list modules'
+  ).toBeGreaterThan(0)
+  expect(
+    registry.modules
+      .filter((entry) => 'eidSources' in entry)
+      .map((entry) => entry.moduleName),
+    'no entry should keep eidSources'
+  ).toEqual([])
+})
+```
+
+- [ ] **Step 2: Run it and see it fail.**
+
+Run: `cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/user_id_modules.test.ts -t "no EID source metadata"`
+Expected: FAIL, listing every module. Record it.
+
+- [ ] **Step 3: Delete the resolver and the data.**
+
+1. In `user_id_modules.json`, delete the `"eidSources": […]` line from every module entry. Keep `moduleName`, `configNames`, any `notes`, and `defaultPreset`.
+2. In `user_id_modules.ts`, delete `eidSources` from `PrebidUserIdModuleRegistryEntry`. Also delete `PrebidUserIdEidLike`, `PrebidUserIdModuleResolution`, `DEFAULT_PREBID_USER_ID_MODULES`, `MODULE_SORT_ORDER`, `stableModuleSort`, `normalizeSource`, `hasLiveIntentProvider` and `resolvePrebidUserIdModulesFromEids`. Keep `PREBID_USER_ID_MODULE_REGISTRY`, `knownUserIdConfigNames`, `findUserIdModuleEntry`, `userIdConfigNameAliases` and `userIdSubmoduleKey`. Delete a helper only after `git grep` shows no other use.
+3. In `user_id_modules.test.ts`, delete the `resolvePrebidUserIdModulesFromEids` import, the `sampleEids` fixture and the five resolver tests: `resolves the target-site EID sample …`, `maps the Google PAIR EID source …`, `maps LiveRamp EIDs …`, `maps unknown LiveIntent provider-backed sources …` and `reports unknown non-LiveIntent sources`. Keep the rest.
+
+- [ ] **Step 4: Run the JS and CLI tests.**
+
+Run:
+
+```bash
+(cd crates/trusted-server-js/lib && npx vitest run test/integrations/prebid/user_id_modules.test.ts test/prebid-user-id-registry.test.mjs test/build-prebid-external.test.mjs && npm run format)
+./scripts/test-cli.sh
+```
+
+Expected: PASS.
+
+- [ ] **Step 5: Commit.**
+
+```bash
+git add crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Delete the unused EID-to-module resolver" -m "Only tests read resolvePrebidUserIdModulesFromEids and the registry's eidSources. The data could not be made correct, since several modules share sources. The CLI and bundle builder read only module and config names."
+```
+
+---
+
+### Task 11: Documentation
+
+Spec: 8.6, 3.7 (the full rule and its warning), 8.2.
+
+**Files:**
+
+- Modify: `docs/guide/integrations/prebid.md`, `docs/guide/integrations/lockr.md`, `docs/guide/edge-cookies.md`, `docs/guide/ec-setup-guide.md`, `docs/guide/api-reference.md`, `docs/guide/configuration.md`
+
+Use only example domains. Replace each passage named below with the text given.
+
+- [ ] **Step 1: `docs/guide/integrations/prebid.md`.**
+
+(a) Under `## User ID Modules`, replace the first paragraph (`:662-664`, "Prebid.js can expose … when they are available.") with:
+
+```markdown
+Prebid.js places the EIDs each bidder may receive in that bidder's
+`bidderRequest.ortb2`: User ID module output, `setConfig({ortb2})` and
+`setBidderConfig` data, and RTD output, with IDs restricted to other bidders
+left out and Prebid's activity controls applied. The `trustedServer` adapter
+forwards exactly the `user.ext.eids` and `user.eids` entries in its own bidder
+request, with their `inserter`, `matcher`, `mm` and `ext`. It never reads
+`pbjs.getUserIdsAsEids()`, which also returns IDs restricted to other bidders.
+
+### Timing and `userSync`
+
+Trusted Server writes no Prebid `userSync` settings other than the managed
+`userIds` entries below (and `autoRefresh` when a late CMP answer seeds them).
+The publisher's `auctionDelay`, `syncDelay`, `syncsPerBidder` and
+`filterSettings`, or Prebid's defaults, apply from the first auction. Prebid's
+default `auctionDelay` is 500 ms: an auction waits up to that long while User
+ID modules are still resolving, and not at all once they have settled. Set
+`auctionDelay` and `filterSettings` in your own Prebid configuration if the
+defaults do not suit you. Prebid's default allows image user syncs only.
+Vendors that write `ortb2` after their own network call, such as the Lockr
+SDK, are not awaited; their IDs reach later requests.
+```
+
+(b) In `### A settled CMP result, not a callable API`, replace "with `userSync.autoRefresh` briefly enabled so Prebid initializes modules added after its first pass." (`:342-343`) with "with `userSync.autoRefresh` enabled so Prebid initializes modules added after its first pass. Because Prebid accumulates `userSync` settings, `autoRefresh` then stays enabled for the rest of the page."
+
+(c) In `### Resolution timing and data flow` (`:842-861`), replace steps 1 to 5 with:
+
+```markdown
+1. Prebid places the `liveramp.com` entry in the `trustedServer` bidder
+   request's `ortb2.user.ext.eids`.
+2. The adapter forwards that entry in the `/auction` body and, before sending
+   the request, copies the body's EIDs (without EID-level `ext`) into the
+   bounded `ts-eids` cookie.
+3. Trusted Server consent-gates it and forwards it to Prebid Server as
+   `user.ext.eids`.
+4. After the response, the same `/auction` request ingests the body entry into
+   an EC/KV partner configured with `source_domain = "liveramp.com"`, when that
+   partner UID is not already stored.
+5. Requests without an EID body, such as `GET /_ts/page-bids` and page
+   navigations, read and ingest the `ts-eids` cookie.
+
+Where GDPR applies and Prebid's TCF enforcement is active, Prebid sends the
+`trustedServer` adapter no bid requests unless the publisher grants it an
+exception (see [TCF and the `trustedServer` adapter](#tcf-and-the-trustedserver-adapter)),
+and the adapter clears `ts-eids`, so no browser EIDs reach Trusted Server.
+```
+
+(d) Replace the `## Identity Forwarding` section from its first line (`:937`) through the end of `### What reaches Prebid Server` (`:991`) with:
+
+````markdown
+## Identity Forwarding
+
+Trusted Server combines browser EIDs with the EC/KV identity graph:
+
+1. **Browser EIDs** are the entries Prebid placed in the `trustedServer`
+   bidder request. The adapter sends them in the `/auction` body as plain data
+   and copies them, without EID-level `ext`, into the `ts-eids` cookie before
+   the request is sent.
+2. **Server-side EIDs** are resolved from the EC/KV identity graph for
+   partners with `bidstream_enabled = true`.
+3. Browser entries are forwarded first, exactly as sent. KV adds entries only
+   for registered sources the browser did not send.
+4. Consent gating applies to the merged set, which goes out as `user.ext.eids`
+   and is echoed in the `x-ts-eids` response header.
+5. After the response, `/auction` adds matched partner UIDs that KV does not
+   yet hold from its own client set (the body, or the cookie when the body has
+   none), then from the `sharedId` cookie. Other routes read the `ts-eids`
+   cookie instead.
+
+The server validates every browser entry on its own, whether it came in the
+body or the cookie. A malformed entry or field is dropped and the rest of the
+request proceeds. Identity-graph writes follow the same consent rule as
+bidstream forwarding: under GDPR, TCF Purpose 1 and Purpose 4 must both be
+consented.
+
+### Identity flow
+
+```mermaid
+sequenceDiagram
+    participant B as Browser / Prebid.js
+    participant T as Trusted Server /auction
+    participant K as EC + KV identity graph
+    participant P as Prebid Server
+
+    B->>B: Prebid builds the trustedServer bidder request (ortb2 EIDs)
+    B->>B: Copy its EIDs into ts-eids (no EID-level ext)
+    B->>T: POST /auction\n(adUnits + the bidder request's eids)
+    T->>T: Validate each entry
+    T->>K: Resolve EC-backed source-domain IDs
+    K-->>T: KV-derived EIDs
+    T->>T: Browser entries as sent, then KV-only sources
+    T->>T: Apply consent gating
+    T->>P: OpenRTB request\nuser.ext.eids = merged set
+    P-->>T: OpenRTB bid response
+    T-->>B: Auction response + x-ts-eids
+    T->>K: Ingest this request's client EIDs + sharedId cookie\n(TCF Purpose 1 + 4 under GDPR)
+```
+
+### Merge rules
+
+- Browser entries are forwarded in the order Prebid sent them and are never
+  altered or combined. A source can appear in more than one entry, for example
+  `adserver.org` from two modules with different `matcher` values.
+- KV adds one entry for each registered source no browser entry carries.
+  Sources are compared case-insensitively, ignoring a trailing dot.
+- For a source the browser sends, KV's stored UID and its configured
+  `openrtb_atype` are not used.
+- Consent gating is applied to the merged set before forwarding.
+
+### What reaches Prebid Server
+
+The downstream Prebid Server request includes:
+
+- `user.id` when EC forwarding is allowed
+- `user.ext.eids` with the browser entries and their `inserter`, `matcher`,
+  `mm` and `ext`, followed by KV-only sources
+- forwarded browser cookies (subject to consent-forwarding mode)
+
+Before rolling this out, send one request with a repeated source and all four
+EID-level fields to each configured provider in staging and confirm it is
+accepted.
+
+### TCF and the `trustedServer` adapter
+
+The `trustedServer` adapter has no GVL ID. Where GDPR applies and Prebid's TCF
+enforcement is active (the publisher configures `consentManagement.gdpr`, or
+Trusted Server enables it for managed User IDs), Prebid's default rules remove
+`trustedServer` from the auction and withhold its EIDs. Trusted Server then
+receives no browser EIDs from the adapter, and the adapter clears `ts-eids`
+when Prebid reports the block.
+
+Granting `trustedServer` an exception is the publisher's decision. Use only
+the full rule:
+
+```js
+pbjs.setConfig({
+  consentManagement: {
+    gdpr: {
+      // ...the publisher's existing CMP settings...
+      rules: [
+        {
+          purpose: 'basicAds',
+          enforcePurpose: true,
+          enforceVendor: true,
+          softVendorExceptions: ['trustedServer'],
+        },
+      ],
+    },
+  },
+})
+```
+
+::: warning
+A publisher rule replaces Prebid's default rule for that purpose. A rule
+written as `{ purpose: 'basicAds', softVendorExceptions: ['trustedServer'] }`,
+without `enforcePurpose: true` and `enforceVendor: true`, switches off both
+checks for **every** bidder. Do not use `vendorExceptions`, which also skips
+the purpose check.
+:::
+
+With the full rule, `trustedServer` still needs Purpose 2 consent and skips
+only the vendor check. A publisher that sets `eidsRequireP4Consent` must also
+add the same full rule for `personalizedAds`; without it `trustedServer` gets
+bid requests with no EIDs and `ts-eids` is cleared after every auction.
+````
+
+(e) Under `### OpenRTB request construction`, replace the bullet "Merges current-request browser EIDs with KV-resolved EIDs and forwards the deduplicated result as `user.ext.eids`" (`:1056`) with "Forwards the browser EIDs as sent, followed by KV-resolved EIDs for registered sources the browser did not send, as `user.ext.eids`".
+
+- [ ] **Step 2: `docs/guide/integrations/lockr.md`.**
+
+Replace the `### Extended ID (EID) Support` section (`:89-111`) with:
+
+````markdown
+### Extended ID (EID) Support
+
+The Lockr SDK writes its ID5 EID into Prebid's first-party data with
+`pbjs.setConfig({ ortb2: { user: { ext: { eids } } } })`. Prebid includes it in
+the `trustedServer` bidder request, and the adapter forwards it to `/auction`
+with its EID-level fields, for example:
+
+```json
+{
+  "source": "id5-sync.com",
+  "inserter": "inserter.example.com",
+  "mm": 2,
+  "uids": [{ "id": "fictional-id5-id", "atype": 1 }]
+}
+```
+
+The SDK writes the EID after its own network call, so the first auction on a
+page may run before it is available. Later auctions include it, and requests
+without an EID body get it from the `ts-eids` cookie and KV.
+
+To store the ID in the EC identity graph, register the source:
+
+```toml
+[[ec.partners]]
+name = "ID5 via Lockr"
+source_domain = "id5-sync.com"
+bidstream_enabled = true
+```
+
+Where GDPR applies and Prebid's TCF enforcement is active, Prebid sends the
+`trustedServer` adapter no EIDs unless the publisher grants the exception
+described in
+[TCF and the `trustedServer` adapter](./prebid.md#tcf-and-the-trustedserver-adapter).
+````
+
+Replace the three solution bullets under `### Missing EID in Bid Requests` (`:227-229`) with:
+
+```markdown
+- Confirm `pbjs.getEvents()` shows a `bidRequested` event for `trustedServer`
+  whose `ortb2.user.ext.eids` contains the `id5-sync.com` entry
+- Under GDPR, confirm the publisher's Prebid config grants `trustedServer` the
+  full TCF exception
+- Decode the `/auction` response's `x-ts-eids` header to see what was forwarded
+```
+
+- [ ] **Step 3: `docs/guide/edge-cookies.md`.**
+
+(a) In `### Prebid EID Flow`, replace the first paragraph and numbered list (`:151-157`, from "Browser-resolved Prebid EIDs reach the identity graph…" through the paragraph ending "…such as `GET /_ts/page-bids` and page navigations.") with:
+
+```markdown
+Browser EIDs reach the identity graph when Trusted Server finalizes a
+response. Which browser input it reads depends on the route:
+
+- `POST /auction` reads only the client EIDs the auction itself used: its
+  request body, or the `ts-eids` cookie when the body has none. An earlier
+  page's cookie is never ingested next to a body.
+- Publisher navigations, admitted `GET /_ts/page-bids` requests and newly
+  generated ECs read the `ts-eids` cookie.
+- Every route then applies the `sharedId` cookie last.
+
+The TSJS Prebid adapter writes `ts-eids` in `buildRequests`, before each
+`trustedServer` request is sent: the request's EIDs without EID-level `ext`,
+trimmed to 3,072 bytes, as base64 of UTF-8 JSON. It clears the cookie when that
+set is empty or when Prebid's TCF rules block `trustedServer`. Auctions that do
+not include `trustedServer` leave it unchanged.
+```
+
+(b) In the sequence diagram that follows (`:160-180`), replace the four lines from `Prebid->>Prebid: Auction completes` through `TSJS->>B: document.cookie = "ts-eids=..."` with:
+
+```text
+    Prebid->>TSJS: buildRequests(bidRequests, bidderRequest)
+    TSJS->>TSJS: Copy bidderRequest.ortb2 EIDs<br/>drop EID-level ext, fit 3,072 bytes
+    TSJS->>B: document.cookie = "ts-eids=..." (before the request is sent)
+```
+
+(c) Replace the paragraph "Current TSJS writers preserve the full OpenRTB-style …" (`:182`) with: "`ts-eids` holds OpenRTB-style `{source, uids:[...]}` entries, with `inserter`, `matcher` and `mm` when Prebid set them. The server validates each entry with the same rules as the `/auction` body and drops only what is malformed. Earlier flattened `{source, id, atype}` cookies are still accepted."
+
+(d) In the `### EID Seeding and Prebid Bidstream Forwarding` diagram (`:205-228`), replace `B->>TSJS: getUserIdsAsEids()` with `B->>TSJS: buildRequests(bidRequests, bidderRequest)`, `B->>B: getUserIdsAsEids() for current auction` with `B->>B: Prebid builds the trustedServer bidder request`, `TS->>TS: Convert stored UIDs to EIDs<br/>Merge + dedupe with request eids[]<br/>Apply consent gating` with `TS->>TS: Request eids[] as sent<br/>+ KV EIDs for sources not sent<br/>Apply consent gating`, and `TS->>KV: Add missing partner UIDs from request eids[]<br/>+ ts-eids/sharedId cookies (TCF Purpose 1 + 4 under GDPR)` with `TS->>KV: Add missing partner UIDs from request eids[]<br/>+ sharedId cookie (TCF Purpose 1 + 4 under GDPR)`.
+
+(e) Replace the sentence "Server-resolved EIDs and current-request Prebid EIDs are deduplicated by `source + uid.id`." (`:266`) with "Browser EIDs are forwarded as sent; KV adds EIDs only for registered sources the browser did not send."
+
+- [ ] **Step 4: `docs/guide/ec-setup-guide.md`.**
+
+After the "Expected decoded payload contains:" list in the `x-ts-eids` verification step (`:186-189`), add:
+
+```markdown
+When the request also carries browser EIDs, the decoded header lists them
+first, exactly as the `trustedServer` adapter sent them (including `inserter`,
+`matcher` and `mm`), followed by KV-only partner sources. The browser copies
+the same EIDs, without EID-level `ext`, into the `ts-eids` cookie, which
+navigations and `GET /_ts/page-bids` ingest. `/auction` ingests its own body
+EIDs instead of the cookie.
+```
+
+- [ ] **Step 5: `docs/guide/api-reference.md`.**
+
+(a) In `### POST /auction`, insert before `#### PBS stored-request intent`:
+
+````markdown
+#### Browser EIDs (`eids`)
+
+The optional `eids` array carries OpenRTB 2.6 EID objects from the browser:
+
+```json
+{
+  "eids": [
+    {
+      "source": "ids.example.com",
+      "inserter": "inserter.example.com",
+      "matcher": "ids.example.com",
+      "mm": 4,
+      "ext": { "segments": ["s1"] },
+      "uids": [
+        { "id": "fictional-uid", "atype": 1, "ext": { "partner": "example" } }
+      ]
+    }
+  ]
+}
+```
+
+Each entry is validated on its own. A malformed entry or field is dropped and
+the request proceeds; only a malformed body outside `eids` rejects the request.
+
+| Field                 | Rule                                                     |
+| --------------------- | -------------------------------------------------------- |
+| entry                 | JSON object that parses on its own                       |
+| `source`              | string, not blank, at most 255 UTF-8 bytes               |
+| `uids`                | at least one valid UID; the first 32 valid UIDs are kept |
+| `uids[].id`           | string, not blank, at most 512 bytes                     |
+| `uids[].atype`, `mm`  | integer from 0 to 2,147,483,647                          |
+| `uids[].ext`, `ext`   | JSON object, at most 2,048 bytes as compact JSON         |
+| `inserter`, `matcher` | string, not blank, at most 255 bytes                     |
+| array                 | duplicates dropped, then the first 64 entries kept       |
+
+Entries keep their order and a source may repeat. When the body has no valid
+entry, the `ts-eids` cookie is used with the same rules. Browser EIDs are used
+only for a request with an allowed EC.
+
+The response's `x-ts-eids` header carries the consent-gated EIDs sent to
+providers, base64-encoded JSON including EID-level fields, capped at 4,096
+bytes. `x-ts-eids-truncated: true` marks a truncated value.
+````
+
+(b) In `### GET /\_ts/admin/eids` (`:904`), append to the first paragraph: "Cookie entries are validated one by one with the `/auction` body rules, so a mistyped field drops only that field, and the returned `eids` include `inserter`, `matcher` and `mm` when present. The `ingest.unmatched` diagnostics still read the raw cookie, before validation."
+
+- [ ] **Step 6: `docs/guide/configuration.md`.**
+
+After the `::: tip Partner keying` block (`:651-653`), add:
+
+```markdown
+`openrtb_atype` sets the `atype` of EIDs that Trusted Server builds from KV.
+It applies only where KV supplies a source the browser did not send; for a
+source in the browser's EIDs, the browser's own entry and `atype` are
+forwarded instead.
+```
+
+- [ ] **Step 7: Format and check links.**
+
+Run:
+
+```bash
+(cd docs && npm run format)
+docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "tinybird/**/*.md"
+git grep -n -E "getUserIdsAsEids|contribute_eids|deduplicat" docs/guide
+```
+
+Expected: format clean (fix with `npm run format:write` and the same Prettier command with `--write` in place of `--check`). The `git grep` should list only historical or Prebid-API mentions that are still correct. Rewrite any line that describes TS reading `getUserIdsAsEids()` or deduplicating by source. If `docs/` uses VitePress dead-link checking (`cd docs && npm run build`), run it to confirm the new `#tcf-and-the-trustedserver-adapter` anchor resolves.
+
+- [ ] **Step 8: Commit.**
+
+```bash
+git add docs/guide
+git commit --signoff -S -m "Document Prebid EID forwarding, the ts-eids writer and the TCF exception" -m "Guides now describe forwarding the trustedServer bidder request's EIDs, the browser-first merge, per-entry validation, KV ingestion inputs by route, TS no longer setting userSync, and the full trustedServer TCF rule with its warning."
+```
+
+---
+
+### Task 12: Final verification and hand-off
+
+Spec: 7.6, 7.7, 8.2, 8.3, A12, A13.
+
+- [ ] **Step 1: Run every CI gate (spec 7.7, `AGENTS.md` "CI Gates").**
+
+```bash
+cargo fmt --all -- --check
+cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm && cargo clippy-cli && cargo clippy-codegen
+cargo test-fastly && cargo test-fastly-reuse && cargo test-axum && cargo test-cloudflare && cargo test-spin
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+(cd crates/trusted-server-js/lib && npx vitest run && npm run format)
+(cd docs && npm ci && npm run format)
+docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "tinybird/**/*.md"
+cargo test -p trusted-server-core --test template_build_digest && cargo clippy -p trusted-server-core --test template_build_digest -- -D warnings
+scripts/lint-wasm-clock.sh
+./scripts/test-cli.sh
+```
+
+Expected: all PASS. Report any failure with its output. Do not call the work done while a gate fails.
+
+- [ ] **Step 2: Check the red log is complete (A12).**
+
+`docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md` must have a `## Task N` entry for Tasks 1 to 10. Every test added or changed must appear either with its failure before the change, or as a regression net with the reverted line and its failure. Run `(cd docs && npm run format)` again if you edited it, and commit it if it changed:
+
+```bash
+git add docs/superpowers/implementation-notes/2026-10-18-prebid-eid-fidelity.md
+git commit --signoff -S -m "Complete the Prebid EID fidelity red log"
+```
+
+- [ ] **Step 3: Hand the live check to the user (spec 7.6).**
+
+The user runs these steps through `ts dev proxy` on a page with Lockr and the default User ID preset. Give them the list and report only what they observe:
+
+1. On a `main` build, record `pbjs.getConfig('userSync').auctionDelay` before the first `requestBids` and after `window.load`, note when the CMP answered, and record the sources of the first `/auction` body.
+2. On the branch, record the same. Expect the publisher's or Prebid's delay throughout, and asynchronous User ID sources (criteo, LiveIntent) in the first body when they resolve within that delay. Lockr's ID5 may still be missing from the first auction.
+3. Decode an `/auction` response's `x-ts-eids` and the cookie with `JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(value), (c) => c.charCodeAt(0))))`. The header's browser entries should equal the request body's, with their own `inserter`, `matcher` and `mm`, followed by KV-only sources. The cookie should equal the body without EID-level `ext`, subject to the trim.
+4. `/_ts/admin/eids` (authenticated) lists the cookie's `adserver.org` entries with their own fields.
+5. Compare `pbjs.getEvents()` `bidRequested` events for `trustedServer` with the `/auction` bodies. The entries should match.
+
+If step 1 shows `main`'s first auction already ran with a delay above 0, say that D4 on that page had another cause. Do not claim a fix (spec 4.9).
+
+- [ ] **Step 4: Prepare the pull request text. Do not open the PR or push unless the user asks.**
+
+The implementation PR is based on `spec/1246-prebid-eid-fidelity`. It links the spec and issue #1246 and lists, from spec 8.2:
+
+- Bidders: browser entries first, KV-only sources after. KV's value and `atype` are no longer sent for a browser source, and repeated sources are no longer folded.
+- Publishers: TS stops overwriting `syncEnabled`, `filterSettings`, `syncsPerBidder`, `syncDelay` and `auctionDelay`, and no longer force-enables iframe syncs. Auctions wait up to `auctionDelay` (500 ms by default) while IDs are pending. A late managed seed still leaves `autoRefresh: true`.
+- Server-side bidders folded into `trustedServer`: IDs restricted to them are no longer forwarded.
+- GDPR traffic without a `trustedServer` exception: the cookie is cleared instead of written from `getUserIdsAsEids()`. Body-less routes and KV ingestion lose browser EIDs for that traffic, including the IdentityLink flow.
+- Cookie contents: `ortb2` EIDs and provenance fields, never EID-level `ext`, written at request time without a Purpose 1 check of its own.
+- KV ingestion on `/auction` no longer reads the cookie next to the body.
+- Operator actions (spec 8.3): the staging check of repeated sources and the four fields per provider before production, regenerating bundles with a baked-in shim, telling publishers about `userSync`, and the full TCF rule (plus `personalizedAds` with `eidsRequireP4Consent`).
+- Follow-ups (spec 8.5), filed or listed: the Prebid.js identityLink fix (D7), `sharedId` ingestion ignoring restrictions, TS's TCF identity, per-bidder EID forwarding through PBS `eidpermissions`, KV refresh rules, restoring `autoRefresh`, gating the cookie write on Purpose 1, a server-written cookie, and a lenient parse of the rest of the `/auction` body.
+
+---
+
+## Spec coverage
+
+| Spec item                                        | Task                                                                                                                       |
+| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
+| D1, G1 (scoped EIDs only)                        | 7, 9 (D1 arm)                                                                                                              |
+| D2 (`ortb2` EIDs, #1246)                         | 6, 7, 9 (D3 and TCF-rule arms)                                                                                             |
+| D3 (EID-level fields)                            | 1, 2, 3, 6, 7, 9                                                                                                           |
+| D4, G6 (`auctionDelay`)                          | 8, 9 (D4 arm and control)                                                                                                  |
+| D5, G2 (cookie copies the body set)              | 6, 7                                                                                                                       |
+| D6, O6 (dead registry)                           | 10                                                                                                                         |
+| D7 (identityLink upstream)                       | Out of scope; follow-up in the PR text (Task 12)                                                                           |
+| D8, G5 (isolation, budget, one parser)           | 2, 3, 6                                                                                                                    |
+| D9, G4, O3 (browser-first merge)                 | 4                                                                                                                          |
+| G3, O7 (KV input selection)                      | 5                                                                                                                          |
+| G7 (`x-ts-eids` with fields)                     | 1                                                                                                                          |
+| 3.7, O9 (TCF listener, full rule)                | 7, 9, 11                                                                                                                   |
+| 4.4 (`raw_value`, guard list, admin diagnostics) | 2, 3                                                                                                                       |
+| 4.7 (golden bytes unchanged)                     | 1 (Step 6)                                                                                                                 |
+| 4.12 (observability)                             | 2, 7                                                                                                                       |
+| 7.1 rules 1 to 12                                | Global Constraints; each task's red step; 3 (rule 8 Rust); 6 and 7 (rule 8 TSJS); 5 (rule 11); 7 (rule 3); 9 (rule 12)     |
+| 7.6 live check                                   | 12                                                                                                                         |
+| 7.7 CI gates                                     | 12                                                                                                                         |
+| 8.6 docs                                         | 11                                                                                                                         |
+| A1 to A13                                        | A1: 7, 9. A2: 3, 5, 7. A3: 4. A4: 2, 3. A5: 1. A6: 8, 9. A7: 7, 9. A8: 5. A9: 6. A10: 9. A11: 1. A12: red log, 12. A13: 12 |
diff --git a/docs/superpowers/plans/2026-10-22-server-side-identity-providers.md b/docs/superpowers/plans/2026-10-22-server-side-identity-providers.md
new file mode 100644
index 0000000000..20e6ca92ba
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-22-server-side-identity-providers.md
@@ -0,0 +1,10005 @@
+# Server-side Identity Providers Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let Trusted Server call identity providers (ID5, LiveRamp ATS, Lockr, UID2 and generic pull partners) from the edge through one `IdentityProvider` trait and one coordinator. Every page load makes at most one KV write, apart from the removal writes, and removals reach KV on the request that carries them. A provider can return complete EIDs, with several entries and UIDs per source and their EID-level fields, and TS stores and sends them whole. Every path that predates this work keeps its one-UID behaviour (G13).
+
+**Architecture:** New code lives in `crates/trusted-server-core/src/ec/identity/`. Providers are pure. They describe themselves with a `ProviderDescriptor`, build `ProviderRequest`s and parse buffered `ProviderResponse`s into `Resolution`s. The `IdentityCoordinator` owns eligibility, consent, transport limits, backoff and turning results into changes. Each request is either the **writer** (a real-browser top-level document navigation) or a **stager**. Resolving providers run only on the writer of a returning EC. The writer adds every KV change to one request-scoped `IdentityMutation` and applies it with one conditional write after the response is sent. Stagers persist no positive ID: they read KV and serve from it. The two removal writes are the exceptions: a failed flush retries its removals alone, and a capture's revocation is written on the proxied request through the shared CAS loop in `removal.rs`. The server sets no identity cookie of its own beyond `ts-ec`. `/auction` and `/_ts/page-bids` return a `ts-eids-s` mirror payload that the shim writes, and the server never reads that cookie. KV schema version 2 stores every record as an entry set (`eids`), and reads version 1 rows as one-entry records. Today's pull sync becomes `GenericPullProvider`.
+
+**Tech Stack:** Rust 1.95 (edition 2024), `trusted-server-core`, `trusted-server-adapter-fastly`, `error-stack`, `derive_more`, `serde`/`serde_json`, `hmac`/`sha2`, `base64`, `rand`, `flate2`/`brotli` (all already dependencies). The shim is TypeScript in `crates/trusted-server-js/lib`. Fastly Compute (Viceroy for tests).
+
+**Spec:** `docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md` (revision 15 with the round 15 amendments, branch `spec/1246-server-side-identity-providers`). Read it before starting. "Spec 5.4" means section 5.4 of that file. Where this plan and the spec disagree, the spec wins. Stop and report the disagreement instead of choosing one. The spec cites `file:line` at commit `c84a73da7`. Line numbers have drifted slightly since then, so find code by the function names given here, not by line number.
+
+## How this plan is split
+
+The spec's rollout (spec 14) has three steps, and each step can ship on its own. This plan has one **Part** per step, and each Part is one pull request. Part 0 is based on `main`, because it must ship in a release before Part 1; Parts 1 and 2 are stacked:
+
+| Part | Spec step                | Branch                            | Base                                       | Tasks         |
+| ---- | ------------------------ | --------------------------------- | ------------------------------------------ | ------------- |
+| 0    | 0. Reader first          | `feat/1246-kv-v2-reader`          | `main`                                     | R1 to R3      |
+| 1    | 1. One write, no vendors | `feat/1246-identity-single-write` | `spec/1246-server-side-identity-providers` | 1 to 31       |
+| 2    | 2. Providers             | `feat/1246-identity-providers`    | `feat/1246-identity-single-write`          | 32 to 41, 39b |
+
+A task with a letter suffix, such as Task 39b, was added by a later spec revision. It runs right after the task with the same number. Task numbers 4b, 16 and 31b are retired: revision 15 removed the cookie keyring, the sealed cookies and the first-auction race metric. Task 27 is reused: it held the removal overflow write, which revision 15 removed, and now holds the withdrawal tombstone's after-send attempt. Part 1 starts with the outbound cookie strips (Tasks 1 to 4), which spec 14 folds into rollout step 1.
+
+Do not start Part 2 until Part 1's one-write invariant tests (Task 30) pass.
+
+**Ship Part 0 in a release before deploying Part 1** (spec 14, added after the round 14 review). Part 1 writes KV schema version 2, and today's reader rejects every version but 1. Part 0 is the rollback floor: it reads version 2 rows and never rewrites them except to tombstone, so Part 1 can roll back to it and deploy alongside it. Rolling back below Part 0 is unsupported; Part 1's PR description and changelog say so.
+
+# Part 0: Reader first (spec 14, step 0)
+
+Based on `main`. Each task is test-first and ends green; the whole Part changes no response and writes only schema version 1.
+
+### Task R1: Read a version 2 row into today's shape
+
+**Files:** `crates/trusted-server-core/src/ec/kv_types.rs`, `crates/trusted-server-core/src/ec/kv.rs` (`get`, `load_snapshot`).
+
+- Add a deserialize-only `KvEntryV2Read` holding exactly the version 2 fields Part 0 reads (spec 6.1): the shared row fields, and per source the first UID of the first entry with `w`, `exp` and `at`, and `ps` reduced to whether any provider holds `o` without a later `oc`. Unknown fields are ignored.
+- `KvEntry::validate` keeps rejecting every version but 1 for writes. A new read path parses `v: 2` into `KvEntry` plus a `v2: Option<V2Facts>` marker (`has_open_opt_out`), so callers can tell a row came from version 2.
+- Tests: a version 2 fixture (copied from Part 1's `kv_types` tests, with `example.com` sources) loads as `EcKvSnapshot::Present`; a version 3 row still fails; a version 1 row is unchanged.
+
+### Task R2: Serve version 2 records conservatively
+
+**Files:** `crates/trusted-server-core/src/ec/eids.rs` (`resolve_partner_ids`), `crates/trusted-server-core/src/ec/identify.rs`.
+
+- A record from a version 2 row is served only when `exp` has not passed. A row with `has_open_opt_out` serves no stored ID, from either path.
+- Tests: an expired version 2 record is not served; a version 2 row with an open opt-out serves nothing; one with a cleared opt-out serves as usual.
+
+### Task R3: Never rewrite a version 2 row, except to tombstone
+
+**Files:** `crates/trusted-server-core/src/ec/kv.rs` (`sync_eid_cookie_updates_from_snapshot`, `upsert_partner_ids_from_snapshot`, `upsert_partner_id`, `upsert_partner_id_if_exists`, `create_or_revive`), `crates/trusted-server-core/src/ec/pull_sync.rs`.
+
+- Each positive write path returns early when the live row is version 2, logs at debug, and increments `v2_row_write_skipped`. `write_withdrawal_tombstone` and `tombstone_existing_from_snapshot` tombstone a version 2 row as they do a version 1 row.
+- Tests with the write-counting store: browser ingest, `/auction` ingest and pull sync write nothing to a version 2 row; a withdrawal tombstones it; a version 1 row is written as today.
+- Changelog: "Reads KV schema version 2 rows written by a later release, serving them read-only, so that release can roll back to this one."
+
+## Global Constraints
+
+Copied from the spec and `AGENTS.md`. Every task implicitly includes these.
+
+- Follow `AGENTS.md` for commands, style, error handling and CI gates. Bare `cargo test`, `cargo build` and `cargo check` fail at the workspace root by design. Use the aliases (`cargo test-fastly`, `cargo clippy-fastly`, and the others).
+- Errors use `error-stack` `Report<E>` with `derive_more::Display` enums and `impl core::error::Error`. No `anyhow` and no `thiserror`. Use `expect("should ...")`, never `unwrap()`, in production and in tests.
+- No local imports inside functions. No wildcard imports except `use super::*` in test modules. Comments go on their own line, above the code.
+- Every public item has a doc comment, and every fallible public function has `# Errors`. Every builder method and getter is `#[must_use]`. Spec 4.2, "Conventions for the listings", gives the derive list for each type. Copy it exactly.
+- Never log UIDs, envelopes, HEMs, provider state, consent strings, cookie values, or provider URLs with a query string. EC IDs go through `log_id`. Log provider errors with `current_context()` only, never `{:?}` of the report (spec 9.3).
+- Use only example or fictional data in code, tests, comments and docs (`example.com` hosts). Public protocol source domains (`id5-sync.com`, `liveramp.com`, `uidapi.com`, `sharedid.org`) may appear where the spec uses them.
+- **Fixed values from the spec. Do not change them:**
+  - `ts-eids-s` (`__Host-ts-eids-s`) is client-only: the shim writes it with `Path=/; Secure; SameSite=Lax`, no `Domain` and no `HttpOnly`, with the `Max-Age` the payload gives. The server never sets, opens, parses or trusts it. The mirror payload is `ext.ts_eids_s` on `/auction` and a `ts_eids_s` member of the `/_ts/page-bids` body: `{value, max_age}`, `{clear: true}`, or absent. `value` is base64url without padding of compact JSON `{"v":1,"eids":[...]}`, at most **2,048** bytes. `max_age` is at most **86,400** and never past the earliest `exp` in the mirrored set (spec 6.2).
+  - `TS_IDENTITY_COOKIE_NAMES` = `ts-ec`, `ts-eids`, `__Host-ts-eids-s`, stripped from Prebid Server requests. `TS_ORIGIN_STRIPPED_COOKIE_NAMES` = `__Host-ts-eids-s`, stripped from origin requests by default; `TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS` = `ts-eids`, `__Host-ts-eids-s`, stripped instead when `[ec] strip_eids_cookie_from_origin = true`. Exact names only: there are no cookie prefixes.
+  - Hashes: `ps.iv` and `ps.ov` hold the first **16** hex digits of the unkeyed SHA-256 of each UID. The consent fingerprint `fp` is a plain bitmask written as hex. The only keyed value is the rate-limit visitor key, an HMAC of the full EC ID with a key derived from `ec.passphrase` (spec 9.3). Nothing stored in the row is keyed.
+  - KV: `SCHEMA_VERSION` is **2**. Every record is `{w?, rv?, at?, exp?, ra?, ru?, eids: [{uids: [{id, atype?, ext?}], inserter?, matcher?, mm?, ext?}]}`, and `eids` is never empty. A version 1 record (`{uid, ...}`) reads as one entry holding that UID, and the row's next write stores version 2. Every UID-level and EID-level `ext` is a JSON object of at most **2,048** bytes as compact JSON. `inserter` and `matcher` are not blank and at most **255** bytes. A source holds at most **8** entries and **32** UIDs, and its entry set is at most **4,096** bytes as compact JSON (`MAX_ENTRY_SET_BYTES`). `ps.st` is at most **1,024** bytes of embedded JSON, a row has at most **32** `ps` entries, and `ps.iv` and `ps.ov` are each an ordered list of at most **128** hashes (`MAX_INVALIDATED_UIDS`), oldest first, truncated from the front before validation. One function, `entry_set_bytes`, measures `MAX_ENTRY_SET_BYTES` on the stored `eids` array, for both the coordinator and `KvEntry::validate`. Expired means `now >= exp`. `rv` is **16** hex digits (64 random bits). On read, a record that breaks a limit is dropped from the row and logged with its source only; only `serialize_entry` rejects.
+  - `ProviderRequest` call context: at most **1,024** bytes of JSON. `IdentityProviderId`: `^[a-z][a-z0-9_-]{0,62}$`.
+  - `[ec.identity]` defaults: `max_concurrency = 4`, `hold_budget_ms = 100`, `hold_retry_sec = 300`, `max_response_bytes = 65536`. Per-provider defaults: `mode = "after_send"`, `timeout_ms` = `hold_budget_ms`, `after_send_timeout_ms = 1000`, `refresh_after_sec = 86400`, `max_calls_per_minute = 1`, `breaker_failures_per_minute = 50`, `cookie_priority = 0`, `sources` = every source the descriptor declares (required for a capture-only provider). For a provider that declares `captures`: `revoke_scope = "provider"`.
+  - Removed config keys, each rejected with an error that names its replacement (spec 10.2): `ec.pull_sync_concurrency` (`[ec.identity].max_concurrency`), and `pull_sync_ttl_sec` and `pull_sync_rate_limit` on `[[ec.partners]]` (`refresh_after_sec` and `max_calls_per_minute = ceil(N / 60)` in `[ec.identity.providers.<pull-id>]`).
+  - Backoff (spec 8): a `found` sets `f = 0`. A `no_match` waits `n = now + retry_in`, default 24 h and at most 7 d. `with_retry_in` on any other resolution makes `n` at least `now + retry_in`, after the row's own rule (so an `invalidate` gets `n = max(now, now + retry_in)`). An input-caused failure waits `min(1 h × 2^(f-1), 24 h)`. A transport, 429 or 5xx failure waits `min(5 min × 2^(f-1), 1 h)`. A cut-off hold call waits `hold_retry_sec`. A skip waits `refresh_after_sec`. A due provider the burst cap stops gets `ps.n = max(ps.n, now + 60 s)`. A provider the breaker or a limiter error stops is not dispatched and its `ps` is unchanged.
+- **G4 is strict.** A page load makes at most one KV write, never retried as a whole. The only exceptions (spec 5.1):
+  - the consent-withdrawal tombstone path (a CAS with up to five attempts, then its completion marker, per withdrawn EC ID), which also runs for a `revoke_scope = "global"` capture from any client, and gets one more attempt after send when it fails before send (Task 27)
+  - the removal-only retry of a failed flush (spec 5.2, phase 4, step 5; Task 29)
+  - the capture removal write (spec 5.3; Task 38)
+
+  The last two share one CAS loop, `ec/identity/removal.rs` (Task 18): up to five attempts, retrying only a generation mismatch, and `removal_lost` when every attempt fails.
+
+- **Removals win.** No filter (consent re-gate, staleness, ownership, the provider no longer being enabled, size cap) may drop a removal, an opt-out or a clear. No client gate applies to a removal or an opt-out; only a capture's clear needs a real browser (spec 4.7, 5.6).
+- **Keep `ts-eids` and `x-ts-eids`.** Do not remove either (product requirement).
+- **Behaviour that predates the spec does not change (G13).** G13 itself changes none of the paths that predate the spec. Browser ingest, `ts-eids`, batch sync, generic pull, `/auction` body forwarding and the `/identify` response keep the behaviour the rest of the spec gives them, and every record they write is one entry with one UID: one UID per registered source, picked by today's rule (`collect_eid_updates`, `ec/prebid_eids.rs:146-151`: for a repeated source, the first valid UID of its last entry, with the sharedId cookie applied last), and nothing for an unregistered source. Only a provider result writes more, and no Part 1 code writes more. A version 1 row goes out to bidders exactly as it does on `main`. Golden tests, named `golden_*` so `cargo test-fastly -- golden` runs them all, pin these paths (Tasks 6, 7, 28 and 30).
+- **Feature gate for test support.** Gate test-only code on `#[cfg(any(test, feature = "test-utils"))]`, the feature `trusted-server-core` already has (`crates/trusted-server-core/Cargo.toml`) and spec 13 names. `ec::identity::test_support` is a `pub mod` under that gate, and every item in it is `pub`, from the task that creates it, as existing `test-utils` items are (`IntegrationRegistry::from_request_filters`). A `pub(crate)` item behind the feature is dead code in the non-test library build that `cargo clippy-fastly` lints with `--all-features`, so `-D warnings` fails it. The Fastly adapter's dev-dependencies already enable the feature (`crates/trusted-server-adapter-fastly/Cargo.toml`).
+- **Adapter-facing API.** The Fastly adapter is a separate crate. It reaches identity state only through `pub struct IdentityRuntime` (Task 23) and `pub` opaque wrappers such as `BrowserSeed` (Task 25). Core types stay `pub(crate)`, and no `pub` item exposes a `pub(crate)` type: `private_interfaces` is an error under `-D warnings`.
+- **Lints that bite plan code.** Backtick `OpenRTB`, CamelCase vendor names such as `LiveRamp` and `SharedID`, and other code-like words in doc comments (`clippy::doc_markdown`). `clippy::panic` is denied in production code; `clippy.toml` allows `panic!` in tests. On `wasm32-wasip1` a panic aborts the whole test binary under Viceroy and `#[should_panic]` tests are ignored, so a check that a test must see fail returns a `Result` instead of panicking.
+- Test discipline:
+  1. **Red first.** Run each new test against unchanged code and watch it fail for the expected reason before you implement.
+  2. **Pair absence with presence.** Each "X is gone" assertion sits next to a "control Y is still there" assertion on the same value.
+  3. Compare structured outputs whole (full `KvEntry`, full `serde_json::Value`). Do not use `..Default::default()` in exhaustiveness tests. List every field.
+  4. Use `json!` for JSON fixtures, except where exact byte lengths matter.
+- Commits: sentence case, imperative mood, no `fix:`/`feat:` prefixes, no bracketed tags, `git commit --signoff -S`, one `-m` flag per paragraph, no heredoc, no AI attribution lines.
+
+## Test commands
+
+| What                                  | Command                                                                                                                 |
+| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| Core and Fastly adapter (Viceroy)     | `cargo test-fastly`                                                                                                     |
+| One core test by name                 | `cargo test-fastly -- <test_name_substring>`                                                                            |
+| Fastly adapter with reusable sandbox  | `cargo test-fastly-reuse`                                                                                               |
+| Other adapters (strips, Task 31)      | `cargo test-axum && cargo test-cloudflare && cargo test-spin`                                                           |
+| Lint, Fastly target                   | `cargo clippy-fastly`                                                                                                   |
+| Docs                                  | `cargo doc --no-deps --all-features -p trusted-server-core`                                                             |
+| Parity crate                          | `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity`                           |
+| CLI (config validation, Tasks 19, 33) | `./scripts/test-cli.sh`                                                                                                 |
+| JS shim (Tasks 26, 30, 31)            | `cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run && mise exec node@24.12.0 -- npm run lint` |
+| Full gate before each PR              | `/check-ci`                                                                                                             |
+
+`cargo test-fastly -- <filter>` runs only the tests whose path contains `<filter>`. Every "Run" step below gives the exact filter.
+
+## File map
+
+| File                                                                                                                                                    | Responsibility                                                                                                                                                                                              | Tasks                                   |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
+| `crates/trusted-server-core/src/constants.rs`, `src/cookies.rs`                                                                                         | Cookie names, identity cookie lists, name strip                                                                                                                                                             | 1                                       |
+| `crates/trusted-server-core/src/auction/routing.rs`, `src/integrations/prebid.rs`                                                                       | Strip identity cookies from Prebid Server requests                                                                                                                                                          | 2                                       |
+| `crates/trusted-server-core/src/publisher.rs`                                                                                                           | Origin strip; servability callers; `is_prefetch_request` move; finalize callers; page-bids stops ingest and returns the mirror; navigation merge and denials; preload decision; owned precedence; hold mode | 3, 14, 23, 25, 26, 28, 29, 36, 37       |
+| `crates/trusted-server-core/src/cookies/template_cache_policy.rs`                                                                                       | `ts-eids-s` refused as a cache key                                                                                                                                                                          | 4                                       |
+| `crates/trusted-server-core/src/settings.rs`, `src/config.rs`                                                                                           | `[ec.identity]`: `IdentitySettings`, `ProviderSettings`, `RevokeScope`; removed keys; deploy and runtime validation; `ADMIN_ENDPOINTS`                                                                      | 19, 22, 33, 36                          |
+| `crates/trusted-server-core/src/ec/identity/mod.rs`, `ids.rs`, `resolution.rs` (new)                                                                    | Module, ID newtypes, `UnixTime`, error type, results (`ResolvedEid`, `ResolvedUid`, `entry_sets`)                                                                                                           | 5, 10                                   |
+| `crates/trusted-server-core/src/ec/kv_types.rs`                                                                                                         | Schema version 2: `KvPartnerId` with `eids`, `KvEid`, `KvUid`, `entry_set_bytes`, `KvProviderState` with `iv` and `ov`, `KvEntry.ps`, validation, upgrade on read                                           | 6                                       |
+| `crates/trusted-server-core/src/ec/kv.rs`                                                                                                               | Constructors; upgrade on read; `PartnerIdUpdate.acquired_at`; `create_if_absent` seed; `compute_cluster_size`; withdrawal retry after send; counting store                                                  | 6, 7, 22, 24, 25, 27                    |
+| `crates/trusted-server-core/src/ec/prebid_eids.rs`                                                                                                      | Browser ingest records `at` and stays one UID                                                                                                                                                               | 7                                       |
+| `crates/trusted-server-core/src/ec/admin.rs`                                                                                                            | Redact `ps.st`; upgrade on read; servability; operator opt-out clear                                                                                                                                        | 6, 14, 36                               |
+| `crates/trusted-server-core/src/ec/identity/descriptor.rs` (new)                                                                                        | Descriptor, builder, `Resolves`, `Captures`, `ConsentPolicy`, `EidProvenance`, `Input`, `Access`, `ResolveKind`, `UsOptOut`                                                                                 | 5, 8                                    |
+| `crates/trusted-server-core/src/ec/identity/input.rs` (new)                                                                                             | `ResolveInput`, `CaptureInput`, `StoredId`, `Region`, `HashedEmail`, `ProviderConsent`, randomness                                                                                                          | 9, 10                                   |
+| `crates/trusted-server-core/src/ec/identity/exchange.rs` (new)                                                                                          | `ProviderRequest`, `ProviderResponse`                                                                                                                                                                       | 10                                      |
+| `crates/trusted-server-core/src/ec/identity/provider.rs` (new)                                                                                          | `IdentityProvider`, `IdentityProviderConfig`                                                                                                                                                                | 11                                      |
+| `crates/trusted-server-core/src/ec/identity/policy.rs` (new), `src/consent/*`                                                                           | Policy evaluation, GPP opt-outs, the plain consent fingerprint, redacting `Debug`                                                                                                                           | 12, 20, 34                              |
+| `crates/trusted-server-core/src/ec/identity/revision.rs` (new)                                                                                          | `Revision`, `RecordRevision`, `StateRevision`, the unkeyed UID hash, the visitor key                                                                                                                        | 13                                      |
+| `crates/trusted-server-core/src/ec/identity/catalog.rs`, `servable.rs` (new)                                                                            | Provider catalog, narrowed sources, ownership, `validate_identity_catalog`; the servability check                                                                                                           | 14, 22, 32, 33                          |
+| `crates/trusted-server-core/src/ec/eids.rs`, `ec/identify.rs`, `src/openrtb.rs`                                                                         | Servability for KV IDs; one EID per stored entry; provenance defaults; `/identify` stops writing                                                                                                            | 14, 24, 28                              |
+| `crates/trusted-server-core/src/ec/identity/mutation.rs` (new)                                                                                          | `IdentityMutation` and its apply algorithm, including the removals-only apply                                                                                                                               | 15                                      |
+| `crates/trusted-server-core/src/ec/identity/mirror.rs` (new)                                                                                            | The `ts-eids-s` mirror payload and its size cap                                                                                                                                                             | 17                                      |
+| `crates/trusted-server-core/src/ec/identity/removal.rs` (new)                                                                                           | The shared removal write: CAS loop, after-send attempt, `removal_lost`                                                                                                                                      | 18, 29, 38                              |
+| `crates/trusted-server-core/src/ec/identity/coordinator.rs` (new)                                                                                       | Eligibility, outcomes, dispatch, breaker, hold, capture, re-grants                                                                                                                                          | 20, 21, 35, 36, 37, 38                  |
+| `crates/trusted-server-core/src/ec/identity/generic_pull.rs` (new), `ec/pull_sync.rs`, `ec/pull_sync_marker.rs`                                         | `GenericPullProvider`; dispatch order; pull sync dispatcher and the pull-complete marker removed                                                                                                            | 21, 22, 29                              |
+| `crates/trusted-server-core/src/ec/identity/test_support.rs` (new, `pub` under `test-utils`)                                                            | Shared fixtures, counting store, fake HTTP client and limiter, `ProviderHarness`, `MultiEntryTestProvider`                                                                                                  | 14, 15, 18, 20, 21, 22, 25, 35, 39, 39b |
+| `crates/trusted-server-core/src/ec/identity/runtime.rs` (new)                                                                                           | `pub struct IdentityRuntime`: catalog and visitor key for the adapter                                                                                                                                       | 23, 29                                  |
+| `crates/trusted-server-core/src/ec/identity/request.rs` (new), `src/ec/mod.rs`, `src/http_util.rs`                                                      | Writer decision, phase-1 captures, request identity state, removal counters                                                                                                                                 | 5, 23, 25, 29, 38                       |
+| `crates/trusted-server-core/src/ec/finalize.rs`                                                                                                         | Mutation instead of writes; `browser_seed`; global revoke; withdrawal retry; metrics                                                                                                                        | 7, 25, 27, 29, 31, 38                   |
+| `crates/trusted-server-core/src/auction/endpoints.rs`, `src/openrtb.rs`                                                                                 | Servability callers; finalize test callers; mirror payload in `ext`; server set and denials in the merge; owned precedence; hold mode                                                                       | 14, 25, 26, 28, 36, 37                  |
+| `crates/trusted-server-core/src/ec/identity/flush.rs` (new)                                                                                             | Phase 4 `run_after_send`                                                                                                                                                                                    | 29                                      |
+| `crates/trusted-server-adapter-fastly/src/app.rs`, `src/main.rs`, `src/rate_limiter.rs`                                                                 | `IdentityRuntime` in `AppState`; writer decision; status capture; testable post-route function and phase 4; `record`/`count`; request-level tests (`drive_request_for_test`); admin route                   | 23, 25, 27, 29, 30, 35, 36, 39b         |
+| `crates/trusted-server-adapter-axum/src/app.rs`, `crates/trusted-server-adapter-cloudflare/src/app.rs`, `crates/trusted-server-adapter-spin/src/app.rs` | Admin opt-out route parity                                                                                                                                                                                  | 36                                      |
+| `crates/trusted-server-core/src/integrations/registry.rs`                                                                                               | `BrowserSeed` and `is_real_browser` on `ProxyDispatchInput`; provider registration; capture-path check; capture plumbing                                                                                    | 23, 25, 32, 38                          |
+| `crates/trusted-server-core/src/integrations/gpt_diagnostics.rs`                                                                                        | `is_prefetch_request` caller                                                                                                                                                                                | 23                                      |
+| `crates/trusted-server-core/src/integrations/lockr.rs`                                                                                                  | Upstream log without the query string                                                                                                                                                                       | 38                                      |
+| `crates/trusted-server-js/lib/src/core/*.ts`, `src/integrations/prebid/*`, `test/**`                                                                    | The mirror writer; registered-only, per-source `ts-eids` merge; `ortb2` G10 test                                                                                                                            | 26, 30, 31                              |
+| `crates/trusted-server-core/src/ec/rate_limiter.rs`                                                                                                     | `record` and `count`                                                                                                                                                                                        | 35                                      |
+| `crates/trusted-server-core/src/ec/batch_sync.rs` (and its adapter call site)                                                                           | Owned sources fill only when absent                                                                                                                                                                         | 40                                      |
+| `crates/trusted-server-core/src/ec/identity/examples.rs` (new, tests only)                                                                              | Spec 4.6 reference providers                                                                                                                                                                                | 32, 33, 39, 39b                         |
+| `crates/trusted-server-core/src/migration_guards.rs`                                                                                                    | Every new `ec/identity/*.rs` file                                                                                                                                                                           | 5 onward                                |
+| `docs/guide/*.md`, `CHANGELOG.md`, `trusted-server.example.toml`                                                                                        | Docs, removed keys and the rollback note                                                                                                                                                                    | 4, 19, 31, 41                           |
+
+This layout is the one spec 4.1's file table lists, with one difference: `[ec.identity]` settings live in `settings.rs` with the rest of the settings, and their validation in `config.rs`, rather than in a new `ec/identity/config.rs`. `UnixTime` lives in `ids.rs`.
+
+---
+
+# Part 1: One write, no new vendors (spec 14, step 1)
+
+Part 1 starts by removing TS's identity cookies from outbound requests (Tasks 1 to 4), then builds the provider framework without registering any vendor, moves KV to schema version 2, and makes a page load write KV once. Generic pull partners are its only providers. It reads, preserves, validates and serves complete entry sets, but nothing in it writes a set with more than one entry or UID, so a rollback from Part 2 to Part 1 keeps every set a provider wrote. No vendor provider is registered yet, and no provider runs in hold mode or captures. Those come in Part 2.
+
+Tasks 1 to 4 strip the identity cookies from outbound requests. Tasks 5 to 22 build unit-tested modules. Most have no request wiring: Task 6 moves KV to schema version 2, Task 7 changes what finalize's browser ingest stores, and Task 14 moves the `/auction`, admin and `/identify` readers onto the servability check. Tasks 23 to 29 wire the rest into requests. Task 26 adds the `ts-eids-s` mirror payload and the shim code that writes it. Task 30 proves the one-write invariant, and Task 31 ships the metrics and the docs.
+
+Before you start: create a worktree from the spec branch, `git worktree add -b feat/1246-identity-single-write .claude/worktrees/1246-identity-providers spec/1246-server-side-identity-providers`. The implementation stacks on its spec branch, which already carries the Prebid EID-fidelity work this spec depends on. Build with the toolchain that branch pins in `rust-toolchain.toml`.
+
+### Task 1: Identity cookie names and a cookie strip helper
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/constants.rs` (next to `COOKIE_TS_EIDS`, line 8)
+- Modify: `crates/trusted-server-core/src/cookies.rs` (after `CONSENT_COOKIE_NAMES`, and after `strip_cookies`)
+- Test: `crates/trusted-server-core/src/cookies.rs` (`mod tests`)
+
+**Interfaces:**
+
+- Produces:
+  - `pub const COOKIE_TS_EIDS_S: &str = "__Host-ts-eids-s";`
+  - `pub const TS_IDENTITY_COOKIE_NAMES: &[&str]` = `ts-ec`, `ts-eids`, `__Host-ts-eids-s` (spec 6.2)
+  - `pub const TS_ORIGIN_STRIPPED_COOKIE_NAMES: &[&str]` = `ts-eids`, `__Host-ts-eids-s`
+  - `pub fn strip_cookie_pairs(cookie_header: &str, names: &[&str]) -> String`
+  - `pub fn strip_cookie_headers(headers: &mut http::HeaderMap, names: &[&str])`
+
+The lists match exact names only: no TS identity cookie is a family with a name prefix (spec 6.2). `ts-ec-pull-complete` is not on either list. Task 29 stops setting it, and a browser's copy expires within its one-hour `Max-Age`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `mod tests` in `cookies.rs`:
+
+```rust
+    #[test]
+    fn strip_cookie_pairs_removes_exact_names_only() {
+        let header = "ts-ec=abc; ts-eids=W10; __Host-ts-eids-s=eyJ2IjoxfQ; other=1; ts-eids-extra=keep";
+
+        let stripped = strip_cookie_pairs(header, TS_ORIGIN_STRIPPED_COOKIE_NAMES);
+
+        assert_eq!(
+            stripped, "ts-ec=abc; other=1; ts-eids-extra=keep",
+            "should drop the ID cookies and keep ts-ec and a cookie that only shares a prefix"
+        );
+    }
+
+    #[test]
+    fn strip_cookie_headers_joins_every_cookie_field_and_drops_non_utf8() {
+        let mut headers = http::HeaderMap::new();
+        headers.append(header::COOKIE, http::HeaderValue::from_static("ts-ec=abc; ts-eids=W10"));
+        headers.append(
+            header::COOKIE,
+            http::HeaderValue::from_bytes(b"bad=\xff").expect("should build an opaque header"),
+        );
+        headers.append(header::COOKIE, http::HeaderValue::from_static("other=1"));
+
+        strip_cookie_headers(&mut headers, TS_IDENTITY_COOKIE_NAMES);
+
+        let values: Vec<_> = headers.get_all(header::COOKIE).iter().collect();
+        assert_eq!(values.len(), 1, "should collapse into one Cookie header");
+        assert_eq!(values[0], "other=1", "should keep only the unrelated cookie");
+    }
+
+    #[test]
+    fn strip_cookie_headers_removes_header_when_nothing_is_left() {
+        let mut headers = http::HeaderMap::new();
+        headers.insert(
+            header::COOKIE,
+            http::HeaderValue::from_static("ts-ec=abc; __Host-ts-eids-s=eyJ2IjoxfQ"),
+        );
+        headers.insert(header::USER_AGENT, http::HeaderValue::from_static("ExampleBrowser/1.0"));
+
+        strip_cookie_headers(&mut headers, TS_IDENTITY_COOKIE_NAMES);
+
+        assert!(headers.get(header::COOKIE).is_none(), "should remove the empty Cookie header");
+        assert!(headers.get(header::USER_AGENT).is_some(), "should leave other headers alone");
+    }
+```
+
+- [ ] **Step 2: Run the tests and see them fail**
+
+Run: `cargo test-fastly -- cookies::tests::strip_cookie`
+Expected: compile errors, because `strip_cookie_pairs`, `strip_cookie_headers` and the constants do not exist.
+
+- [ ] **Step 3: Implement**
+
+In `constants.rs`, under `COOKIE_TS_EIDS`:
+
+```rust
+/// Client-only mirror of the servable server-side EIDs, written by the shim
+/// and never read by the server (spec 6.2).
+pub const COOKIE_TS_EIDS_S: &str = "__Host-ts-eids-s";
+```
+
+In `cookies.rs`, extend the `crate::constants` import with `COOKIE_TS_EC`, `COOKIE_TS_EIDS` and `COOKIE_TS_EIDS_S`. Then add, after `CONSENT_COOKIE_NAMES`:
+
+```rust
+/// Trusted Server identity cookies that never reach a third party.
+///
+/// Stripped from Prebid Server requests and never added to proxy or provider
+/// requests.
+pub const TS_IDENTITY_COOKIE_NAMES: &[&str] = &[COOKIE_TS_EC, COOKIE_TS_EIDS, COOKIE_TS_EIDS_S];
+
+/// Identity cookies removed from publisher-origin requests.
+///
+/// `ts-ec` still reaches the origin. The ID cookies
+/// are removed so that they cannot push the origin's `Cookie` header past
+/// common 8 KB header limits.
+pub const TS_ORIGIN_STRIPPED_COOKIE_NAMES: &[&str] = &[COOKIE_TS_EIDS, COOKIE_TS_EIDS_S];
+```
+
+After `strip_cookies`:
+
+```rust
+/// Strips cookies whose name is exactly one of `names` from a `Cookie` header
+/// value.
+///
+/// Returns an empty string when nothing is left.
+#[must_use]
+pub fn strip_cookie_pairs(cookie_header: &str, names: &[&str]) -> String {
+    cookie_header
+        .split(';')
+        .map(str::trim)
+        .filter(|pair| !pair.is_empty())
+        .filter(|pair| {
+            let name = pair.split('=').next().unwrap_or_default().trim();
+            !names.contains(&name)
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+/// Strips matching cookies from every `Cookie` field in `headers`.
+///
+/// All `Cookie` fields are read, matching pairs are removed, and the rest is
+/// written back as one field. A field that is not valid UTF-8 is dropped
+/// rather than forwarded, because it cannot be checked. The header is removed
+/// when nothing is left.
+pub fn strip_cookie_headers(headers: &mut http::HeaderMap, names: &[&str]) {
+    let retained = headers
+        .get_all(header::COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .map(|value| strip_cookie_pairs(value, names))
+        .filter(|value| !value.is_empty())
+        .collect::<Vec<_>>()
+        .join("; ");
+
+    headers.remove(header::COOKIE);
+    if retained.is_empty() {
+        return;
+    }
+    match http::HeaderValue::from_str(&retained) {
+        Ok(value) => {
+            headers.insert(header::COOKIE, value);
+        }
+        Err(_) => log::debug!("Dropping Cookie header that is invalid after stripping"),
+    }
+}
+```
+
+`unwrap_or_default()` on an `Option<&str>` is not `unwrap()`, and `split` always yields at least one item, so it is safe here.
+
+- [ ] **Step 4: Run the tests and see them pass**
+
+Run: `cargo test-fastly -- cookies::tests`
+Expected: PASS, including the existing `strip_cookies` tests.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/constants.rs crates/trusted-server-core/src/cookies.rs
+git commit --signoff -S -m "Add identity cookie lists and a cookie strip by name"
+```
+
+### Task 2: Strip identity cookies from Prebid Server requests in every mode
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/routing.rs` (`PrebidTransportHeaders`, around line 205)
+- Modify: `crates/trusted-server-core/src/integrations/prebid.rs` (`apply_prebid_header_values` and both callers, around lines 2025-2108)
+- Test: `crates/trusted-server-core/src/integrations/prebid.rs` (`mod tests`)
+
+**Interfaces:**
+
+- Consumes: `strip_cookie_pairs`, `TS_IDENTITY_COOKIE_NAMES`, `CONSENT_COOKIE_NAMES` (Task 1)
+- Produces: `PrebidTransportHeaders::cookies(&self) -> &[HeaderValue]`, which replaces `cookie()`. `apply_prebid_header_values` takes `cookies: &[HeaderValue]` as its first argument.
+
+Today `apply_prebid_header_values` forwards the raw `Cookie` header unchanged whenever `consent_forwarding.strips_consent_cookies()` is false, and both callers pass only the first `Cookie` field. After this task, identity cookies are stripped in every mode, every field is read, and a non-UTF-8 field is dropped (spec 6.2, "Prebid Server").
+
+- [ ] **Step 1: Write the failing tests**
+
+Find the existing tests of `apply_prebid_header_values` with `grep -n "apply_prebid_header_values\|strips_consent_cookies" crates/trusted-server-core/src/integrations/prebid.rs`, and add next to them. Build the target request the way those tests do. The `ConsentForwardingMode` variants are listed in `consent_config.rs:137-150`. Use the one that does **not** strip consent cookies for the first test and the one that does for the second.
+
+```rust
+    fn cookie_values(request: &http::Request<EdgeBody>) -> Vec<String> {
+        request
+            .headers()
+            .get_all(header::COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should be ASCII").to_owned())
+            .collect()
+    }
+
+    #[test]
+    fn prebid_headers_strip_identity_cookies_when_consent_cookies_are_forwarded() {
+        let cookies = [
+            HeaderValue::from_static("ts-ec=abc; euconsent-v2=tcf; other=1"),
+            HeaderValue::from_static("__Host-ts-eids-s=eyJ2IjoxfQ; partner=p"),
+            HeaderValue::from_static("ts-eids=W10; second=2"),
+        ];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &cookies,
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::Both,
+            None,
+        );
+
+        assert_eq!(
+            cookie_values(&to),
+            vec!["euconsent-v2=tcf; other=1; partner=p; second=2".to_owned()],
+            "should drop identity cookies, keep consent and unrelated cookies, and read every field"
+        );
+    }
+
+    #[test]
+    fn prebid_headers_strip_identity_and_consent_cookies_in_openrtb_only_mode() {
+        let cookies = [HeaderValue::from_static("ts-ec=abc; euconsent-v2=tcf; other=1")];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &cookies,
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::OpenrtbOnly,
+            None,
+        );
+
+        assert_eq!(cookie_values(&to), vec!["other=1".to_owned()], "should keep only other=1");
+    }
+
+    #[test]
+    fn prebid_headers_drop_non_utf8_cookie_fields_and_empty_results() {
+        let cookies = [
+            HeaderValue::from_bytes(b"x=\xff").expect("should build an opaque header"),
+            HeaderValue::from_static("ts-ec=abc"),
+        ];
+        let mut to = http::Request::new(EdgeBody::empty());
+
+        apply_prebid_header_values(
+            &cookies,
+            None,
+            None,
+            None,
+            &mut to,
+            ConsentForwardingMode::Both,
+            None,
+        );
+
+        assert!(to.headers().get(header::COOKIE).is_none(), "should send no Cookie header");
+    }
+```
+
+If the mode variants are named differently, use the real names and keep the meaning: one mode that forwards consent cookies and `OpenrtbOnly`.
+
+- [ ] **Step 2: Run the tests and see them fail**
+
+Run: `cargo test-fastly -- integrations::prebid::tests::prebid_headers_`
+Expected: compile error, because the first argument is still `Option<&HeaderValue>`.
+
+- [ ] **Step 3: Implement**
+
+In `auction/routing.rs`, change the field and its accessor:
+
+```rust
+pub(crate) struct PrebidTransportHeaders {
+    cookies: Vec<HeaderValue>,
+    user_agent: Option<HeaderValue>,
+    referer: Option<HeaderValue>,
+    accept_language: Option<HeaderValue>,
+}
+
+impl PrebidTransportHeaders {
+    /// Every inbound `Cookie` field, in order.
+    pub(crate) fn cookies(&self) -> &[HeaderValue] {
+        &self.cookies
+    }
+    // user_agent, referer and accept_language unchanged
+```
+
+and in `snapshot`:
+
+```rust
+            cookies: request.headers().get_all(header::COOKIE).iter().cloned().collect(),
+```
+
+Fix every other use of `cookie:` or `.cookie()` in `routing.rs` that the compiler reports, including the tests at about lines 1300-1315 that append two `Cookie` fields. Those tests should now see both fields.
+
+In `integrations/prebid.rs`, change the import to `use crate::cookies::{CONSENT_COOKIE_NAMES, TS_IDENTITY_COOKIE_NAMES, strip_cookie_pairs};`. Then replace the cookie half of `apply_prebid_header_values`:
+
+```rust
+fn apply_prebid_header_values(
+    cookies: &[HeaderValue],
+    user_agent: Option<&HeaderValue>,
+    referer: Option<&HeaderValue>,
+    accept_language: Option<&HeaderValue>,
+    to: &mut http::Request<EdgeBody>,
+    consent_forwarding: ConsentForwardingMode,
+    client_ip: Option<std::net::IpAddr>,
+) {
+    // ... unchanged header loop and x-forwarded-for ...
+
+    // Identity cookies are stripped in every mode, before the consent mode is
+    // checked, so no mode forwards the raw header (spec 6.2).
+    let consent_names: &[&str] = if consent_forwarding.strips_consent_cookies() {
+        CONSENT_COOKIE_NAMES
+    } else {
+        &[]
+    };
+    let retained = cookies
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .map(|value| strip_cookie_pairs(value, TS_IDENTITY_COOKIE_NAMES))
+        .map(|value| strip_cookie_pairs(&value, consent_names))
+        .filter(|value| !value.is_empty())
+        .collect::<Vec<_>>()
+        .join("; ");
+    if !retained.is_empty()
+        && let Ok(cookie_header) = HeaderValue::from_str(&retained)
+    {
+        to.headers_mut().insert(header::COOKIE, cookie_header);
+    }
+}
+```
+
+Update both callers. `copy_request_headers`-style callers pass a local `let cookies: Vec<HeaderValue> = from.headers().get_all(header::COOKIE).iter().cloned().collect();` and then `&cookies`. `apply_prebid_transport_headers` passes `from.cookies()`. Remove `strip_cookies` from the import if nothing else uses it.
+
+- [ ] **Step 4: Run the tests and see them pass**
+
+Run: `cargo test-fastly -- integrations::prebid` and then `cargo test-fastly -- auction::routing`
+Expected: PASS. If an existing test asserted that the raw header is forwarded unchanged, update its expectation to the stripped value and say why in the commit body.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/auction/routing.rs crates/trusted-server-core/src/integrations/prebid.rs
+git commit --signoff -S -m "Strip identity cookies from Prebid Server requests in every mode" -m "Every Cookie field is now read and checked, and a field that is not valid UTF-8 is dropped instead of forwarded."
+```
+
+### Task 3: Strip the ID cookies from publisher-origin requests
+
+> Revised after the round 14 review: by default only `__Host-ts-eids-s` is stripped, and `ts-eids` keeps reaching the origin as today. `rewrite_origin_request` takes a `strip_eids: bool` from `settings.ec.strip_eids_cookie_from_origin` (`Ec` field, `#[serde(default)]`), which strips `ts-eids` too. Tests: `rewrite_origin_request_strips_only_the_mirror_by_default` and `rewrite_origin_request_strips_ts_eids_when_the_operator_asks`. The steps below are the original task; read their `ts-eids` strip as the opt-in case.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs` (`rewrite_origin_request`, around line 3124)
+- Test: `crates/trusted-server-core/src/publisher.rs` (`mod tests`)
+
+**Interfaces:**
+
+- Consumes: `strip_cookie_headers`, `TS_ORIGIN_STRIPPED_COOKIE_NAMES` (Task 1)
+
+- [ ] **Step 1: Write the failing test**
+
+Add to `publisher.rs` tests, next to any existing `rewrite_origin_request` test (`grep -n "fn .*rewrite_origin_request" crates/trusted-server-core/src/publisher.rs`):
+
+```rust
+    #[test]
+    fn rewrite_origin_request_strips_id_cookies_and_keeps_ts_ec() {
+        let mut req = Request::builder()
+            .uri("https://www.example.com/article")
+            .header(header::COOKIE, "ts-ec=abc; ts-eids=W10; session=1")
+            .header(
+                header::COOKIE,
+                "__Host-ts-eids-s=eyJ2IjoxfQ; ts-ec-pull-complete=v1",
+            )
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        rewrite_origin_request(
+            &mut req,
+            "https://origin.example.com/article".parse().expect("should parse uri"),
+            "origin.example.com",
+        )
+        .expect("should rewrite request");
+
+        let cookies: Vec<_> = req.headers().get_all(header::COOKIE).iter().collect();
+        assert_eq!(cookies.len(), 1, "should send one Cookie header");
+        assert_eq!(
+            cookies[0], "ts-ec=abc; session=1; ts-ec-pull-complete=v1",
+            "should keep ts-ec, the pull marker and unrelated cookies, and drop the ID cookies"
+        );
+    }
+
+    #[test]
+    fn rewrite_origin_request_drops_cookie_header_when_only_id_cookies() {
+        let mut req = Request::builder()
+            .uri("https://www.example.com/")
+            .header(header::COOKIE, "ts-eids=W10; __Host-ts-eids-s=eyJ2IjoxfQ")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        rewrite_origin_request(
+            &mut req,
+            "https://origin.example.com/".parse().expect("should parse uri"),
+            "origin.example.com",
+        )
+        .expect("should rewrite request");
+
+        assert!(req.headers().get(header::COOKIE).is_none(), "should drop the empty Cookie header");
+        assert_eq!(req.headers()[header::HOST], "origin.example.com", "should still set Host");
+    }
+```
+
+- [ ] **Step 2: Run and see it fail**
+
+Run: `cargo test-fastly -- publisher::tests::rewrite_origin_request_`
+Expected: FAIL. The first assertion sees two `Cookie` fields that still hold `ts-eids`.
+
+- [ ] **Step 3: Implement**
+
+In `rewrite_origin_request`, after `req.headers_mut().remove("fastly-ssl");`:
+
+```rust
+    // The publisher origin keeps `ts-ec` but never receives the ID cookies,
+    // which can push its `Cookie` header past common 8 KB limits (spec 6.2).
+    strip_cookie_headers(req.headers_mut(), TS_ORIGIN_STRIPPED_COOKIE_NAMES);
+```
+
+Add `use crate::cookies::{TS_ORIGIN_STRIPPED_COOKIE_NAMES, strip_cookie_headers};` to the imports at the top of `publisher.rs`.
+
+- [ ] **Step 4: Run and see it pass, then run the other adapters**
+
+Run: `cargo test-fastly -- publisher::tests` then `cargo test-axum && cargo test-cloudflare && cargo test-spin`
+Expected: PASS. The strip lives in core, so every adapter gets it (spec 11). If an adapter test asserted that `ts-eids` reaches the origin, update it and note the behaviour change in the commit body.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/publisher.rs
+git commit --signoff -S -m "Strip the mirror cookie from publisher origin requests" -m "The origin keeps ts-ec, ts-eids and every unrelated cookie, and never receives __Host-ts-eids-s. [ec] strip_eids_cookie_from_origin strips ts-eids too, for origins that reject large Cookie headers."
+```
+
+### Task 4: Refuse the mirror cookie as a template-cache key, and document the strips
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/cookies/template_cache_policy.rs` (around line 35)
+- Modify: `docs/guide/edge-cookies.md`, `CHANGELOG.md`
+- Test: `crates/trusted-server-core/src/cookies/template_cache_policy.rs` (`mod tests`, line 172)
+
+- [ ] **Step 1: Write the failing tests**
+
+Find the test that rejects `ts-eids` as a key (`grep -n "identity cookie" crates/trusted-server-core/src/cookies/template_cache_policy.rs`). It shows how the validating function is called. Add two cases next to it with the same call shape:
+
+```rust
+    #[test]
+    fn template_cache_key_rejects_the_mirror_cookie() {
+        let error = validate_names_for_test(&["__Host-ts-eids-s".to_owned()], &[])
+            .expect_err("should reject the mirror cookie as a cache key");
+        assert!(
+            error.contains("must not key on Trusted Server identity cookie"),
+            "should explain the rejection, got {error}"
+        );
+        validate_names_for_test(&["session".to_owned()], &[])
+            .expect("should still accept an unrelated cookie");
+    }
+```
+
+`validate_names_for_test` stands for the call the existing identity-cookie test makes. Use that exact call, not a new helper.
+
+- [ ] **Step 2: Run and see it fail**
+
+Run: `cargo test-fastly -- template_cache_policy::tests::template_cache_key_rejects_the_mirror`
+Expected: FAIL, because the name is accepted today.
+
+- [ ] **Step 3: Implement**
+
+Replace the condition at line 35:
+
+```rust
+            if field == "template_cache_key_cookies"
+                && [COOKIE_TS_EC, COOKIE_TS_EIDS, COOKIE_TS_EIDS_S, COOKIE_SHAREDID].contains(&name.as_str())
+            {
+```
+
+and extend the `crate::constants` import with `COOKIE_TS_EIDS_S`.
+
+- [ ] **Step 4: Run and see it pass**
+
+Run: `cargo test-fastly -- template_cache_policy`
+Expected: PASS.
+
+- [ ] **Step 5: Docs**
+
+In `docs/guide/edge-cookies.md`, in the section that lists TS cookies, add a short "Cookies forwarded to the origin" paragraph. Say that `ts-ec` and `ts-eids` still reach the publisher origin, that `__Host-ts-eids-s` does not, and that `[ec] strip_eids_cookie_from_origin = true` strips `ts-eids` too. Also say that Prebid Server never receives any TS identity cookie.
+
+In `CHANGELOG.md` under `## [Unreleased]` / `### Changed`, add:
+
+```markdown
+- **Breaking:** Prebid Server no longer receives any Trusted Server identity cookie (`ts-ec`, `ts-eids`, and the `__Host-ts-eids-s` mirror that this release's shim writes); today it receives `ts-ec` and `ts-eids`. The publisher origin still receives `ts-ec` and `ts-eids` but never the mirror. `[ec] strip_eids_cookie_from_origin = true` strips `ts-eids` from origin requests too.
+```
+
+Run: `cd docs && npm run format && cd ..` and `docs/node_modules/.bin/prettier --config docs/.prettierrc --write CHANGELOG.md`
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add crates/trusted-server-core/src/cookies/template_cache_policy.rs docs/guide/edge-cookies.md CHANGELOG.md
+git commit --signoff -S -m "Refuse the identity mirror cookie as a template cache key"
+```
+
+### Task 5: The `ec::identity` module, its ID newtypes and its error type
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/mod.rs`
+- Create: `crates/trusted-server-core/src/ec/identity/ids.rs`
+- Create: `crates/trusted-server-core/src/ec/identity/resolution.rs` (error type only in this task, extended in Task 10)
+- Modify: `crates/trusted-server-core/src/ec/mod.rs` (module list, around line 32)
+- Modify: `crates/trusted-server-core/src/migration_guards.rs` (`checked_sources`)
+
+**Interfaces:**
+
+- Produces:
+  - `IdentityProviderId`: `FromStr<Err = Report<IdentityProviderError>>`, `as_str(&self) -> &str`, serde as a string. Derives `Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display`.
+  - `SourceDomain`: `FromStr` through `normalize_partner_source_domain`, `as_str`, `matches(&self, name: &str) -> bool`, serde as a string. Same derives.
+  - `UnixTime`: `from_secs(u64)`, `from_millis(u64)`, `as_secs(self) -> u64`, `Add<Duration>`. Derives `Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord`.
+  - `IdentityProviderError` (all seven variants from spec 4.5) with `config`, `rejected`, `malformed` and `not_implemented` constructors. `Access` and `Input` are referenced by two variants, so this task adds a minimal `descriptor.rs` with just those two enums. Task 8 fills in the rest of the file.
+
+- [ ] **Step 1: Write the failing tests**
+
+Create `ec/identity/ids.rs` with only this test module for now:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn provider_id_accepts_the_documented_grammar() {
+        for id in ["id5", "pull-ssp-example-com", "lockr_aim", "a"] {
+            assert!(id.parse::<IdentityProviderId>().is_ok(), "should accept `{id}`");
+        }
+        let longest = format!("a{}", "b".repeat(62));
+        longest.parse::<IdentityProviderId>().expect("should accept 63 characters");
+    }
+
+    #[test]
+    fn provider_id_rejects_everything_else() {
+        let too_long = format!("a{}", "b".repeat(63));
+        for id in ["", "1id", "Id5", "id 5", "id.5", too_long.as_str()] {
+            let error = id.parse::<IdentityProviderId>().expect_err("should reject the id");
+            assert!(
+                matches!(error.current_context(), IdentityProviderError::Config { .. }),
+                "should be a Config error for `{id}`"
+            );
+        }
+    }
+
+    #[test]
+    fn source_domain_normalizes_and_matches() {
+        let source: SourceDomain = "ID5-Sync.com.".parse().expect("should parse");
+        assert_eq!(source.as_str(), "id5-sync.com", "should lower-case and drop the trailing dot");
+        assert!(source.matches("id5-sync.COM"), "should match another spelling");
+        assert!(!source.matches("example.com"), "should not match another domain");
+        // The domain parser must reject URL syntax.
+        assert!(!source.matches("https://id5-sync.com"), "should not match a URL"); // allow-domain: id5-sync.com
+    }
+
+    #[test]
+    fn source_domain_round_trips_through_serde() {
+        let source: SourceDomain = "example.com".parse().expect("should parse");
+        let json = serde_json::to_string(&source).expect("should serialize");
+        assert_eq!(json, "\"example.com\"", "should serialize as a bare string");
+        let back: SourceDomain = serde_json::from_str(&json).expect("should deserialize");
+        assert_eq!(back, source, "should round-trip");
+        serde_json::from_str::<SourceDomain>("\"not a domain\"")
+            .expect_err("should reject an invalid domain on deserialize");
+    }
+
+    #[test]
+    fn unix_time_converts_millis_and_adds_durations() {
+        assert_eq!(UnixTime::from_millis(1_760_000_000_999).as_secs(), 1_760_000_000, "should floor millis");
+        let later = UnixTime::from_secs(100) + Duration::from_secs(50);
+        assert_eq!(later, UnixTime::from_secs(150), "should add seconds");
+        let saturated = UnixTime::from_secs(u64::MAX) + Duration::from_secs(1);
+        assert_eq!(saturated, UnixTime::from_secs(u64::MAX), "should saturate");
+    }
+}
+```
+
+Create `ec/identity/mod.rs`:
+
+```rust
+//! Server-side identity providers.
+//!
+//! An [`IdentityProvider`](provider::IdentityProvider) turns request signals
+//! into `OpenRTB` EIDs. Providers only build requests and parse buffered
+//! responses. The coordinator owns eligibility, consent, transport limits and
+//! KV write-back, so every page load makes at most one browser-driven KV
+//! write. See `docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md`.
+
+pub mod descriptor;
+pub mod ids;
+pub mod resolution;
+
+pub use descriptor::{Access, Input};
+pub use ids::{IdentityProviderId, SourceDomain, UnixTime};
+pub use resolution::IdentityProviderError;
+```
+
+Add `pub mod identity;` to the module list in `ec/mod.rs`, in alphabetical order after `pub mod identify;`.
+
+- [ ] **Step 2: Run and see the tests fail**
+
+Run: `cargo test-fastly -- ec::identity::ids`
+Expected: compile errors, because the types do not exist.
+
+- [ ] **Step 3: Implement `resolution.rs` (error only) and the minimal `descriptor.rs`**
+
+`ec/identity/descriptor.rs` for now:
+
+```rust
+//! What a provider is, may write, needs and must respect.
+
+/// An input a provider can ask for.
+///
+/// Consent strings, the provider's stored IDs, the publisher domain, the
+/// time and the declared endpoint are always available. Private state is
+/// available to providers declared `with_private_state()`.
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display,
+)]
+#[non_exhaustive]
+pub enum Input {
+    /// The platform's client address.
+    #[display("client_ip")]
+    ClientIp,
+    /// The request's `User-Agent`.
+    #[display("user_agent")]
+    UserAgent,
+    /// The top-level page URL without query string or fragment.
+    #[display("page_url")]
+    PageUrl,
+    /// Country and subdivision only.
+    #[display("region")]
+    Region,
+    /// A SHA-256 of a normalized email address. Never available in v1.
+    #[display("hashed_email")]
+    HashedEmail,
+}
+
+/// Something a provider read without declaring it.
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display,
+)]
+#[non_exhaustive]
+pub enum Access {
+    /// An undeclared [`Input`].
+    #[display("{_0}")]
+    Input(Input),
+    /// The endpoint, when the descriptor declares no `resolves`.
+    #[display("endpoint")]
+    Endpoint,
+    /// Private state, without `with_private_state()`.
+    #[display("private_state")]
+    PrivateState,
+}
+```
+
+`ec/identity/resolution.rs` for now:
+
+```rust
+//! Provider results and errors.
+
+use error_stack::Report;
+use http::StatusCode;
+
+use super::descriptor::{Access, Input};
+
+/// Marker message of [`IdentityProviderError::not_implemented`]. The harness
+/// matches on it to tell a missing override from a real failure.
+pub(crate) const NOT_IMPLEMENTED_MARKER: &str = "capability declared but not implemented: ";
+
+/// A provider failure. Built through the constructors below.
+#[derive(Debug, derive_more::Display)]
+#[non_exhaustive]
+pub enum IdentityProviderError {
+    /// Configuration or provider code makes the call impossible.
+    #[display("identity provider configuration error: {message}")]
+    Config {
+        /// What is wrong. Never contains a secret, UID or URL query.
+        message: String,
+    },
+    /// The provider read something its descriptor did not declare.
+    #[display("`{access}` was read but not declared")]
+    UndeclaredInput {
+        /// What was read.
+        access: Access,
+    },
+    /// A declared input is not available for this request.
+    #[display("input `{input}` is unavailable for this request")]
+    InputUnavailable {
+        /// The missing input.
+        input: Input,
+    },
+    /// The provider refused the request.
+    #[display("provider rejected the request with status {status}")]
+    Rejected {
+        /// The response status.
+        status: StatusCode,
+    },
+    /// The provider's response could not be parsed.
+    #[display("provider response could not be parsed")]
+    Malformed,
+    /// The stored private state does not decode as the provider's type.
+    #[display("stored provider state could not be decoded")]
+    InvalidState,
+    /// Set by the coordinator only. Providers never see transport failures.
+    #[display("provider request failed in transport")]
+    Transport,
+}
+
+impl core::error::Error for IdentityProviderError {}
+
+impl IdentityProviderError {
+    /// A [`Self::Config`] error.
+    #[must_use]
+    pub fn config(message: impl Into<String>) -> Report<Self> {
+        Report::new(Self::Config { message: message.into() })
+    }
+
+    /// A [`Self::Rejected`] error.
+    #[must_use]
+    pub fn rejected(status: StatusCode) -> Report<Self> {
+        Report::new(Self::Rejected { status })
+    }
+
+    /// A [`Self::Malformed`] error.
+    #[must_use]
+    pub fn malformed() -> Report<Self> {
+        Report::new(Self::Malformed)
+    }
+
+    /// The default body of a capability method: a `Config` error with a
+    /// fixed marker message, so the harness can tell a missing override from
+    /// a real failure.
+    #[must_use]
+    pub fn not_implemented(method: &'static str) -> Report<Self> {
+        Self::config(format!("{NOT_IMPLEMENTED_MARKER}{method}"))
+    }
+
+    /// Whether this is the [`Self::not_implemented`] marker.
+    #[must_use]
+    pub(crate) fn is_not_implemented(&self) -> bool {
+        matches!(self, Self::Config { message } if message.starts_with(NOT_IMPLEMENTED_MARKER))
+    }
+}
+```
+
+- [ ] **Step 4: Implement `ids.rs`**
+
+Put this above the test module:
+
+```rust
+//! Identifiers shared by the identity provider API.
+
+use core::ops::Add;
+use core::str::FromStr;
+use std::time::Duration;
+
+use error_stack::Report;
+use serde::{Deserialize, Serialize};
+
+use super::resolution::IdentityProviderError;
+use crate::ec::partner::normalize_partner_source_domain;
+
+/// An identity provider's ID, such as `id5` or `pull-ssp-example-com`.
+///
+/// Matches `^[a-z][a-z0-9_-]{0,62}$`, so it can be a bare TOML key and can
+/// equal an integration ID that uses `_`. Separate from
+/// [`crate::auction::ProviderId`].
+#[derive(
+    Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display, Serialize, Deserialize,
+)]
+#[serde(try_from = "String", into = "String")]
+pub struct IdentityProviderId(String);
+
+impl IdentityProviderId {
+    /// The ID as written in config.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl FromStr for IdentityProviderId {
+    type Err = Report<IdentityProviderError>;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let mut bytes = value.bytes();
+        let valid_first = bytes.next().is_some_and(|byte| byte.is_ascii_lowercase());
+        let valid_rest = bytes.all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'_' || byte == b'-'
+        });
+        if valid_first && valid_rest && value.len() <= 63 {
+            Ok(Self(value.to_owned()))
+        } else {
+            Err(IdentityProviderError::config(format!(
+                "identity provider id `{value}` must match ^[a-z][a-z0-9_-]{{0,62}}$"
+            )))
+        }
+    }
+}
+
+impl TryFrom<String> for IdentityProviderId {
+    type Error = Report<IdentityProviderError>;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+
+impl From<IdentityProviderId> for String {
+    fn from(id: IdentityProviderId) -> Self {
+        id.0
+    }
+}
+
+/// An EID `source` domain, normalized. Also the key of the KV `ids` map.
+#[derive(
+    Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display, Serialize, Deserialize,
+)]
+#[serde(try_from = "String", into = "String")]
+pub struct SourceDomain(String);
+
+impl SourceDomain {
+    /// The normalized domain.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    /// Whether a vendor's spelling of a source names this one, after
+    /// normalization.
+    #[must_use]
+    pub fn matches(&self, name: &str) -> bool {
+        normalize_partner_source_domain(name).is_ok_and(|normalized| normalized == self.0)
+    }
+}
+
+impl FromStr for SourceDomain {
+    type Err = Report<IdentityProviderError>;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        normalize_partner_source_domain(value)
+            .map(Self)
+            .map_err(IdentityProviderError::config)
+    }
+}
+
+impl TryFrom<String> for SourceDomain {
+    type Error = Report<IdentityProviderError>;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+
+impl From<SourceDomain> for String {
+    fn from(source: SourceDomain) -> Self {
+        source.0
+    }
+}
+
+/// Unix seconds.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub struct UnixTime(u64);
+
+impl UnixTime {
+    /// From Unix seconds.
+    #[must_use]
+    pub fn from_secs(secs: u64) -> Self {
+        Self(secs)
+    }
+
+    /// From Unix milliseconds, for vendors such as Lockr and `UID2`. Floors to
+    /// whole seconds.
+    #[must_use]
+    pub fn from_millis(millis: u64) -> Self {
+        Self(millis / 1000)
+    }
+
+    /// As Unix seconds.
+    #[must_use]
+    pub fn as_secs(self) -> u64 {
+        self.0
+    }
+}
+
+impl Add<Duration> for UnixTime {
+    type Output = UnixTime;
+
+    fn add(self, rhs: Duration) -> UnixTime {
+        UnixTime(self.0.saturating_add(rhs.as_secs()))
+    }
+}
+```
+
+serde's `try_from` needs the error to implement `Display`, and `Report<C>` does. Check that `normalize_partner_source_domain` rejects `"not a domain"` (spaces fail the label check). If it does not, use `"not/a/domain"` in the test.
+
+Add both new files to `checked_sources()` in `migration_guards.rs`, in alphabetical order, following the `ec/client_eids.rs` entry:
+
+```rust
+        ("ec/identity/descriptor.rs", include_str!("ec/identity/descriptor.rs")),
+        ("ec/identity/ids.rs", include_str!("ec/identity/ids.rs")),
+        ("ec/identity/mod.rs", include_str!("ec/identity/mod.rs")),
+        ("ec/identity/resolution.rs", include_str!("ec/identity/resolution.rs")),
+```
+
+Every later task that creates a file under `ec/identity/` adds it to this list the same way.
+
+- [ ] **Step 5: Run and see the tests pass**
+
+Run: `cargo test-fastly -- ec::identity` and `cargo test-fastly -- migration_guards`
+Expected: PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/mod.rs crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add the identity module with provider and source ID newtypes"
+```
+
+### Task 6: KV schema version 2: one record shape, provider state, `Default` and constructors
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/kv_types.rs` (`SCHEMA_VERSION`, `KvEntry`, `KvConsent`, `KvGeo`, `KvPartnerId`, `validate`, `upgrade_for_read`, constructors, the size estimate in the `KvEntry` doc comment)
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (`deserialize_entry`, every production `.uid` reader, and the tests at about lines 1736 and 1758)
+- Modify: every file with a `KvPartnerId {` literal or a `.uid` read of a `KvPartnerId` (find them with `grep -rn "KvPartnerId {" crates/` and the compiler)
+- Modify: `crates/trusted-server-core/src/ec/admin.rs` (`build_lookup_response`, around `admin.rs:375-415`, and the `.uid` readers at about lines 490 and 616)
+- Modify: `crates/trusted-server-core/src/ec/eids.rs` (the `.uid` readers at about lines 40, 53 and 71; Task 14 rewrites this file's output path)
+- Test: `crates/trusted-server-core/src/ec/kv_types.rs`, `crates/trusted-server-core/src/ec/kv.rs`, `crates/trusted-server-core/src/ec/admin.rs`
+
+**Interfaces:**
+
+- Produces:
+  - `pub const SCHEMA_VERSION: u8 = 2;`. `KvMetadata.v` mirrors it on every write.
+  - `KvPartnerId { w: Option<String>, rv: Option<String>, at: Option<u64>, exp: Option<u64>, ra: Option<u64>, ru: Option<u64>, eids: Vec<KvEid> }`, deriving `Debug, Clone, Default, PartialEq, Serialize, Deserialize`, with `#[serde(from = "KvPartnerIdWire")]`. It has no `uid`, `atype` or `ext` field. `eids` is always serialized and never empty in a valid record. Each optional field is skipped when `None`.
+  - `KvPartnerId::new(uid: impl Into<String>) -> Self` (one entry with one UID and no metadata), `KvPartnerId::browser(uid: impl Into<String>, acquired_at: Option<u64>) -> Self`, and `KvPartnerId::first_uid(&self) -> Option<&str>` (the first UID of the first entry)
+  - `KvEid { uids: Vec<KvUid>, inserter: Option<String>, matcher: Option<String>, mm: Option<i32>, ext: Option<serde_json::Value> }` (no `source`: the `ids` key holds it) and `KvUid { id: String, atype: Option<i32>, ext: Option<serde_json::Value> }`, both deriving `Debug, Clone, Default, PartialEq, Serialize, Deserialize`, with every optional field skipped when `None`, and neither denying unknown fields
+  - `KvProviderState { n: Option<u64>, f: u32, o: Option<KvOptOut>, oc: Option<u64>, iv: Vec<String>, ov: Vec<String>, st: Option<serde_json::Value> }`, deriving `Default`
+  - `KvOptOut { at: u64, fp: String }`. `fp` is the consent bitmask of spec 8 as lowercase hex, at most 16 digits (Task 20 defines the bits).
+  - `KvEntry.ps: BTreeMap<String, KvProviderState>`, and `KvEntry` derives `Default`
+  - Constants `MAX_PARTNER_EXT_BYTES = 2048` (UID-level and EID-level `ext`), `MAX_EID_FIELD_BYTES = 255` (`inserter`, `matcher`), `MAX_ENTRIES_PER_SOURCE = 8`, `MAX_UIDS_PER_SOURCE = 32`, `MAX_ENTRY_SET_BYTES = 4096` (compact JSON of the stored set), `MAX_PROVIDER_STATE_BYTES = 1024`, `MAX_PROVIDER_STATES = 32`, `MAX_INVALIDATED_UIDS = 128` (the cap of `ps.iv` and of `ps.ov`, each an ordered list, oldest first), `RECORD_REVISION_HEX_LEN = 16`
+  - `pub(crate) fn entry_set_bytes(set: &[KvEid]) -> usize`: the length of `serde_json::to_vec(set)`, the stored array without `source`, after the field rules and without provenance defaults. `KvEntry::validate` and the coordinator (Tasks 10 and 20) both measure `MAX_ENTRY_SET_BYTES` with it, so they never disagree.
+  - `pub(crate) fn KvEntry::upgrade_for_read(&mut self) -> Result<Vec<String>, String>`: accepts `v` of 1 or 2 and sets it to 2, rejecting any other version as today's check does. It then drops each record that breaks a rule of `validate_record`, and returns one message per dropped record, naming the source and the rule, never a UID (spec 6.1). `deserialize_entry` calls it before `validate` and logs each message at warn. Only `serialize_entry` rejects a bad record.
+
+Spec 6.1: every record stores its source's entry set in `eids`. A record that browser ingest, generic pull or batch sync writes is one entry with one UID and no EID-level fields. Only a provider result writes more, and nothing in Part 1 does. This task makes larger sets read, preserved and validated, so a rollback from Part 2 to Part 1 keeps every set a provider wrote readable. Such a set is not served while its writer is not configured (spec 14).
+
+Every row on `main` is version 1, whose records hold one `uid`. The reader accepts both versions: a version 1 record reads as one entry holding that `uid`, with no `w`, no `rv` and no timing beyond `at`, and the row's next write stores version 2. Today's reader rejects every version but its own (`ec/kv_types.rs:376-381`), so a build without this task cannot read a row this task has written. Rolling back past Part 1 is unsupported (spec 14), and Task 31's changelog says so.
+
+`validate` runs on every read (`ec/kv.rs:366`, `deserialize_entry`) as well as on every write. One bad record must not make its whole row unreadable, because nothing could then write the row again. So the read path first drops such a record, and only the write path rejects it.
+
+- [ ] **Step 1: Write the failing tests**
+
+Add to `kv_types.rs` tests. The test module has `use super::*;` only, so also add `use serde_json::json;`:
+
+```rust
+    fn kv_uid(id: &str, atype: Option<i32>) -> KvUid {
+        KvUid {
+            id: id.to_owned(),
+            atype,
+            ext: None,
+        }
+    }
+
+    fn kv_eid(uids: Vec<KvUid>) -> KvEid {
+        KvEid {
+            uids,
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+        }
+    }
+
+    /// The set of spec 6.1's `example-ids.example.com` record.
+    fn example_full_set() -> Vec<KvEid> {
+        vec![
+            KvEid {
+                uids: vec![
+                    kv_uid("example-a", Some(1)),
+                    KvUid {
+                        id: "example-b".to_owned(),
+                        atype: Some(3),
+                        ext: Some(json!({ "stype": "ppuid" })),
+                    },
+                ],
+                inserter: Some("example.com".to_owned()),
+                matcher: None,
+                mm: Some(3),
+                ext: None,
+            },
+            KvEid {
+                uids: vec![kv_uid("example-c", Some(1))],
+                inserter: None,
+                matcher: Some("partner.example.com".to_owned()),
+                mm: None,
+                ext: None,
+            },
+        ]
+    }
+
+    fn with_set(set: Vec<KvEid>) -> KvEntry {
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+        entry.ids.get_mut("example.com").expect("should exist").eids = set;
+        entry
+    }
+
+    #[test]
+    fn golden_version_1_row_reads_as_one_entry_records_and_writes_version_2() {
+        let main_row = json!({
+            "v": 1,
+            "created": 1_760_000_000,
+            "consent": { "ok": true, "updated": 1_760_000_000 },
+            "geo": { "country": "US" },
+            "ids": {
+                "id5-sync.com": { "uid": "ID5*example" },
+                "sharedid.org": { "uid": "example-shared-id" }
+            }
+        });
+
+        let mut entry: KvEntry = serde_json::from_value(main_row).expect("should read a row from main");
+        let messages = entry.upgrade_for_read().expect("should accept version 1");
+        entry.validate().expect("should be valid once upgraded");
+
+        assert!(messages.is_empty(), "should drop nothing from a valid version 1 row");
+        assert_eq!(entry.ids["id5-sync.com"], KvPartnerId::new("ID5*example"), "should read uid as one entry");
+        assert_eq!(
+            serde_json::to_value(&entry).expect("should write"),
+            json!({
+                "v": 2,
+                "created": 1_760_000_000,
+                "consent": { "ok": true, "updated": 1_760_000_000 },
+                "geo": { "country": "US" },
+                "ids": {
+                    "id5-sync.com": { "eids": [{ "uids": [{ "id": "ID5*example" }] }] },
+                    "sharedid.org": { "eids": [{ "uids": [{ "id": "example-shared-id" }] }] }
+                }
+            }),
+            "should write version 2, with no uid key and no ps"
+        );
+    }
+
+    #[test]
+    fn version_2_row_and_provider_state_round_trip() {
+        let stored = json!({
+            "v": 2,
+            "created": 1_760_000_000,
+            "consent": { "ok": true, "updated": 1_760_000_000 },
+            "geo": { "country": "US" },
+            "ids": {
+                "id5-sync.com": {
+                    "w": "id5",
+                    "rv": "9c1d04b7e6a83f2a",
+                    "at": 1_760_000_000,
+                    "exp": 1_767_776_000,
+                    "ra": 1_760_086_400,
+                    "ru": 1_770_000_000,
+                    "eids": [{ "uids": [{ "id": "ID5*example", "atype": 1, "ext": { "linkType": 2 } }] }]
+                },
+                "example-ids.example.com": {
+                    "w": "exampleid",
+                    "rv": "4be71f0c2d9a6e35",
+                    "at": 1_760_000_000,
+                    "eids": [
+                        {
+                            "uids": [
+                                { "id": "example-a", "atype": 1 },
+                                { "id": "example-b", "atype": 3, "ext": { "stype": "ppuid" } }
+                            ],
+                            "inserter": "example.com",
+                            "mm": 3
+                        },
+                        {
+                            "uids": [{ "id": "example-c", "atype": 1 }],
+                            "matcher": "partner.example.com"
+                        }
+                    ]
+                }
+            },
+            "ps": {
+                "id5": {
+                    "n": 1_760_003_600,
+                    "f": 1,
+                    "o": { "at": 1_759_000_000, "fp": "1a" },
+                    "oc": 1_759_500_000,
+                    "iv": ["aaaaaaaaaaaaaaaa"],
+                    "ov": ["bbbbbbbbbbbbbbbb"],
+                    "st": { "signature": "example-opaque-state" }
+                }
+            }
+        });
+
+        let entry: KvEntry = serde_json::from_value(stored.clone()).expect("should read");
+        entry.validate().expect("should be valid");
+        assert_eq!(serde_json::to_value(&entry).expect("should write"), stored, "should round-trip exactly");
+        assert_eq!(
+            entry.ids["example-ids.example.com"].eids,
+            example_full_set(),
+            "should read the set whole and in order"
+        );
+    }
+
+    #[test]
+    fn a_record_reads_its_eids_and_its_version_1_uid_only_without_them() {
+        let both: KvPartnerId = serde_json::from_value(json!({
+            "uid": "stale-copy",
+            "eids": [{ "uids": [{ "id": "example-a" }] }]
+        }))
+        .expect("should read a record with both keys");
+        assert_eq!(both.first_uid(), Some("example-a"), "should take eids over a uid copy");
+
+        let neither: KvPartnerId = serde_json::from_value(json!({ "w": "exampleid" })).expect("should read");
+        assert!(neither.eids.is_empty(), "should read no entry from a record with neither key");
+        assert_eq!(neither.first_uid(), None, "should have no first UID");
+        with_set(Vec::new()).validate().expect_err("should reject a record with an empty eids on write");
+    }
+
+    #[test]
+    fn upgrade_for_read_drops_bad_records_and_names_the_source_only() {
+        let mut set = example_full_set();
+        set[1].matcher = Some("  ".to_owned());
+        let mut entry = with_set(set);
+        entry.ids.insert("sharedid.org".to_owned(), KvPartnerId::new("example-shared-id"));
+        entry.v = 1;
+
+        let messages = entry.upgrade_for_read().expect("should accept the row");
+
+        assert_eq!(entry.v, SCHEMA_VERSION, "should upgrade the version");
+        assert_eq!(messages.len(), 1, "should report one dropped record");
+        assert!(messages[0].contains("example.com"), "should name the source");
+        assert!(!messages[0].contains("example-a"), "should never name a UID");
+        assert!(!entry.ids.contains_key("example.com"), "should drop the bad record");
+        assert_eq!(
+            entry.ids["sharedid.org"],
+            KvPartnerId::new("example-shared-id"),
+            "should leave a valid record alone"
+        );
+        entry.validate().expect("should validate once upgraded");
+
+        let mut future = KvEntry::minimal("example.com", "example-uid", 1);
+        future.v = SCHEMA_VERSION + 1;
+        future.upgrade_for_read().expect_err("should reject a version it does not know");
+    }
+
+    #[test]
+    fn entry_set_bytes_measures_the_stored_array() {
+        let set = example_full_set();
+        let bytes = serde_json::to_vec(&set).expect("should serialize the set");
+
+        assert_eq!(entry_set_bytes(&set), bytes.len(), "should measure the stored array");
+        assert!(
+            !String::from_utf8(bytes).expect("should be UTF-8").contains("\"source\""),
+            "should measure entries without source"
+        );
+    }
+
+    #[test]
+    fn validate_rejects_entry_set_limits() {
+        let rejects = |entry: &KvEntry, field: &str| {
+            let error = entry.validate().expect_err(&format!("should reject {field}"));
+            assert!(error.contains(field), "should name {field}, got {error}");
+        };
+
+        rejects(&with_set(Vec::new()), "eids");
+
+        let mut set = example_full_set();
+        set[0].ext = Some(json!({ "pad": "x".repeat(MAX_PARTNER_EXT_BYTES) }));
+        rejects(&with_set(set), "ext");
+
+        let mut set = example_full_set();
+        set[0].uids[0].ext = Some(json!("not an object"));
+        rejects(&with_set(set), "ext");
+
+        let mut set = example_full_set();
+        set[0].inserter = Some("  ".to_owned());
+        rejects(&with_set(set), "inserter");
+
+        let mut set = example_full_set();
+        set[1].matcher = Some("m".repeat(MAX_EID_FIELD_BYTES + 1));
+        rejects(&with_set(set), "matcher");
+
+        let mut set = example_full_set();
+        set[0].mm = Some(-1);
+        rejects(&with_set(set), "mm");
+
+        let mut set = example_full_set();
+        set[0].uids[1].atype = Some(-1);
+        rejects(&with_set(set), "atype");
+
+        let mut set = example_full_set();
+        set[1].uids[0].id = " ".to_owned();
+        rejects(&with_set(set), "uid");
+
+        let mut set = example_full_set();
+        set[1].uids.clear();
+        rejects(&with_set(set), "uid");
+
+        let nine_entries = (0..=MAX_ENTRIES_PER_SOURCE)
+            .map(|index| kv_eid(vec![kv_uid(&format!("example-{index}"), None)]))
+            .collect();
+        rejects(&with_set(nine_entries), "entries");
+
+        let thirty_three_uids = (0..=MAX_UIDS_PER_SOURCE)
+            .map(|index| kv_uid(&format!("example-{index}"), None))
+            .collect();
+        rejects(&with_set(vec![kv_eid(thirty_three_uids)]), "uids");
+
+        let oversized = (0..4)
+            .map(|index| KvEid {
+                ext: Some(json!({ "pad": "x".repeat(1_100) })),
+                ..kv_eid(vec![kv_uid(&format!("example-{index}"), None)])
+            })
+            .collect();
+        rejects(&with_set(oversized), "entry set");
+
+        let mut old = with_set(example_full_set());
+        old.v = 1;
+        rejects(&old, "version");
+
+        with_set(example_full_set()).validate().expect("should accept the control set");
+    }
+
+    #[test]
+    fn validate_rejects_oversized_state_and_too_many_providers() {
+        let with_state = |state: KvProviderState| {
+            let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+            entry.ps.insert("id5".to_owned(), state);
+            entry
+        };
+        let hashes = |count: usize| vec!["a".repeat(16); count];
+
+        let error = with_state(KvProviderState { st: Some(json!("x".repeat(MAX_PROVIDER_STATE_BYTES))), ..KvProviderState::default() })
+            .validate()
+            .expect_err("should reject st");
+        assert!(error.contains("st"), "should name st");
+
+        for (name, state) in [
+            ("iv", KvProviderState { iv: hashes(MAX_INVALIDATED_UIDS + 1), ..KvProviderState::default() }),
+            ("ov", KvProviderState { ov: hashes(MAX_INVALIDATED_UIDS + 1), ..KvProviderState::default() }),
+            ("fp", KvProviderState { o: Some(KvOptOut { at: 1, fp: "XYZ".to_owned() }), ..KvProviderState::default() }),
+        ] {
+            let error = with_state(state).validate().expect_err(&format!("should reject {name}"));
+            assert!(error.contains(name), "should name {name}, got {error}");
+        }
+        with_state(KvProviderState {
+            iv: hashes(MAX_INVALIDATED_UIDS),
+            ov: hashes(MAX_INVALIDATED_UIDS),
+            o: Some(KvOptOut { at: 1, fp: "1a".to_owned() }),
+            ..KvProviderState::default()
+        })
+        .validate()
+        .expect("should accept 128 hashes in each list and a hex fingerprint");
+
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+        for index in 0..=MAX_PROVIDER_STATES {
+            entry.ps.insert(format!("p{index}"), KvProviderState::default());
+        }
+        assert!(entry.validate().expect_err("should reject ps size").contains("ps"), "should name ps");
+
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1);
+        entry.ids.get_mut("example.com").expect("should exist").rv = Some("not-hex".to_owned());
+        assert!(entry.validate().expect_err("should reject rv").contains("rv"), "should name rv");
+
+        KvEntry::minimal("example.com", "example-uid", 1).validate().expect("should accept the control entry");
+    }
+```
+
+The validation tests build `KvProviderState` with `..KvProviderState::default()` and `KvEid` with struct update syntax because they test one field at a time. They are not exhaustiveness tests. The oversized-set case keeps every `ext` under 2,048 bytes and every other limit intact, so only the 4,096-byte set limit applies.
+
+In `kv.rs` tests, rewrite the two tests that pin today's version and UID checks:
+
+- `deserialize_entry_rejects_invalid_legacy_values` (about line 1736) becomes `deserialize_entry_drops_an_invalid_record`: a body whose record for one source has a UID over `MAX_UID_LENGTH` deserializes, the row reads without that source, and a second, valid source is kept. A row-level fault, such as a malformed `consent`, still fails the read as a whole, as today.
+- The test that sets `SCHEMA_VERSION + 1` (about line 1758) keeps its expectation: the read fails. Add a sibling, `deserialize_entry_reads_a_version_1_body`, whose body is a row from `main`.
+
+Add to `admin.rs` tests, next to the existing raw-lookup test (`grep -n "lookup_raw\|fn .*lookup" crates/trusted-server-core/src/ec/admin.rs`). Use the same setup that test uses to put an entry in the in-memory graph and call the handler:
+
+```rust
+    #[test]
+    fn admin_lookup_redacts_provider_state() {
+        let mut entry = KvEntry::minimal("example.com", "example-uid", 1_760_000_000);
+        entry.ps.insert(
+            "id5".to_owned(),
+            KvProviderState { n: Some(5), st: Some(json!({ "signature": "secret-state" })), ..KvProviderState::default() },
+        );
+        let body = admin_lookup_body_for_test(&entry);
+
+        assert_eq!(body["entry"]["ps"]["id5"]["st"], json!("[redacted]"), "should redact the state");
+        assert_eq!(body["entry"]["ps"]["id5"]["n"], json!(5), "should keep the rest of ps");
+        assert_eq!(
+            body["entry"]["ids"]["example.com"]["eids"][0]["uids"][0]["id"],
+            json!("example-uid"),
+            "should keep the ids"
+        );
+    }
+```
+
+`admin_lookup_body_for_test` stands for whatever the existing lookup tests do to get the JSON body: insert the row, call the handler and parse the body. Write it as a small helper in the test module that reuses that setup. The stored row sits under `"entry"` in the response, as the existing assertions such as `json["entry"]["ids"]["bidstream.example"]["uid"]` (`admin.rs:998`) show. Those existing assertions read `uid`; move each to `eids[0].uids[0].id`.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::kv_types::tests`, `cargo test-fastly -- ec::kv::tests::deserialize_entry` and `cargo test-fastly -- ec::admin::tests::admin_lookup_redacts`
+Expected: compile errors (`ps`, `KvProviderState`, `KvEid`, `KvUid`, `KvPartnerId::new`, `first_uid`, `entry_set_bytes` and `upgrade_for_read` do not exist).
+
+- [ ] **Step 3: Implement the schema**
+
+In `kv_types.rs`, set `SCHEMA_VERSION` to 2 and add the constants after `MAX_UID_LENGTH`:
+
+```rust
+/// Maximum serialized bytes of a stored UID-level or EID-level `ext`.
+pub const MAX_PARTNER_EXT_BYTES: usize = 2048;
+/// Maximum bytes of a stored `inserter` or `matcher`.
+pub const MAX_EID_FIELD_BYTES: usize = 255;
+/// Maximum number of EID entries stored for one source.
+pub const MAX_ENTRIES_PER_SOURCE: usize = 8;
+/// Maximum number of UIDs stored for one source, across its entries.
+pub const MAX_UIDS_PER_SOURCE: usize = 32;
+/// Maximum bytes of one source's stored entry set, as measured by
+/// [`entry_set_bytes`].
+pub const MAX_ENTRY_SET_BYTES: usize = 4096;
+/// Maximum serialized bytes of one provider's private state (`ps.st`).
+pub const MAX_PROVIDER_STATE_BYTES: usize = 1024;
+/// Maximum number of providers with a `ps` entry in one row.
+pub const MAX_PROVIDER_STATES: usize = 32;
+/// Maximum number of UID hashes kept in each of a provider's `ps.iv` and
+/// `ps.ov` lists, enough for four whole 32-UID sets.
+pub const MAX_INVALIDATED_UIDS: usize = 128;
+/// Length of a record revision (`rv`) in lowercase hex digits.
+pub const RECORD_REVISION_HEX_LEN: usize = 16;
+```
+
+Change the size estimate in the `KvEntry` doc comment from `(max ~5KB)` to the typical and at-every-cap figures spec 6.1 gives, citing spec 6.1.
+
+Add `Default` to the derives of `KvEntry`, `KvConsent` and `KvGeo`. Add the `ps` field at the end of `KvEntry`:
+
+```rust
+    /// Per-provider scheduling, opt-out, removal and private state, keyed by
+    /// identity provider ID. Never sent to bidders.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub ps: BTreeMap<String, KvProviderState>,
+```
+
+Replace `KvPartnerId`:
+
+```rust
+/// A source's record within a KV entry (spec 6.1).
+///
+/// Every record stores its source's entry set in `eids`. A version 1 record,
+/// which holds one `uid`, reads as one entry holding that UID.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+#[serde(from = "KvPartnerIdWire")]
+pub struct KvPartnerId {
+    /// Writer: an identity provider ID. Absent for browser ingest and
+    /// version 1 records.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub w: Option<String>,
+    /// Record revision: 16 lowercase hex digits, random on every write.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rv: Option<String>,
+    /// Unix seconds when the ID was acquired or last refreshed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub at: Option<u64>,
+    /// Unix seconds at or after which the ID must not be sent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub exp: Option<u64>,
+    /// Unix seconds after which the ID is due for refresh.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ra: Option<u64>,
+    /// Unix seconds after which the ID can no longer be refreshed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ru: Option<u64>,
+    /// The source's entry set, in order. Never empty in a valid record.
+    pub eids: Vec<KvEid>,
+}
+
+/// The stored shape of [`KvPartnerId`], which also reads version 1's `uid`.
+#[derive(Deserialize)]
+struct KvPartnerIdWire {
+    #[serde(default)]
+    uid: Option<String>,
+    #[serde(default)]
+    w: Option<String>,
+    #[serde(default)]
+    rv: Option<String>,
+    #[serde(default)]
+    at: Option<u64>,
+    #[serde(default)]
+    exp: Option<u64>,
+    #[serde(default)]
+    ra: Option<u64>,
+    #[serde(default)]
+    ru: Option<u64>,
+    #[serde(default)]
+    eids: Vec<KvEid>,
+}
+
+impl From<KvPartnerIdWire> for KvPartnerId {
+    fn from(wire: KvPartnerIdWire) -> Self {
+        let eids = match (wire.eids.is_empty(), wire.uid) {
+            (true, Some(uid)) => vec![KvEid::one_uid(uid)],
+            (_, _) => wire.eids,
+        };
+        Self { w: wire.w, rv: wire.rv, at: wire.at, exp: wire.exp, ra: wire.ra, ru: wire.ru, eids }
+    }
+}
+
+impl KvPartnerId {
+    /// A record holding one entry with one UID, and no metadata.
+    #[must_use]
+    pub fn new(uid: impl Into<String>) -> Self {
+        Self { eids: vec![KvEid::one_uid(uid.into())], ..Self::default() }
+    }
+
+    /// A browser-ingested record: no writer, with its acquisition time.
+    #[must_use]
+    pub fn browser(uid: impl Into<String>, acquired_at: Option<u64>) -> Self {
+        Self { at: acquired_at, ..Self::new(uid) }
+    }
+
+    /// The first UID of the first entry, which `/identify` returns and
+    /// today's one-UID readers use.
+    #[must_use]
+    pub fn first_uid(&self) -> Option<&str> {
+        self.eids.first().and_then(|entry| entry.uids.first()).map(|uid| uid.id.as_str())
+    }
+}
+
+/// One EID entry of a record (spec 6.1).
+///
+/// The `OpenRTB` EID object without `source`, which the `ids` key holds.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct KvEid {
+    /// The entry's UIDs, in order. Never empty in a valid record.
+    pub uids: Vec<KvUid>,
+    /// `eid.inserter`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub inserter: Option<String>,
+    /// `eid.matcher`. Absent means `source`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub matcher: Option<String>,
+    /// `eid.mm`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mm: Option<i32>,
+    /// EID-level `ext`, at most [`MAX_PARTNER_EXT_BYTES`] serialized bytes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ext: Option<serde_json::Value>,
+}
+
+impl KvEid {
+    /// One entry holding one UID and nothing else: the shape browser
+    /// ingest, generic pull and batch sync write.
+    fn one_uid(id: String) -> Self {
+        Self { uids: vec![KvUid { id, atype: None, ext: None }], ..Self::default() }
+    }
+}
+
+/// One UID of a stored entry.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct KvUid {
+    /// The user identifier.
+    pub id: String,
+    /// `uid.atype`. Absent: use the partner's `openrtb_atype`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub atype: Option<i32>,
+    /// UID-level `ext`, at most [`MAX_PARTNER_EXT_BYTES`] serialized bytes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ext: Option<serde_json::Value>,
+}
+
+/// A provider's sticky opt-out (spec 8).
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct KvOptOut {
+    /// Unix seconds when the opt-out was reported.
+    pub at: u64,
+    /// The consent bits the provider's policy read then, as a lowercase hex
+    /// bitmask of at most 16 digits. Plain, not keyed (spec 8).
+    pub fp: String,
+}
+
+/// Per-provider state in a KV row (`ps.<provider>`).
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct KvProviderState {
+    /// Unix seconds before which the provider must not be called.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub n: Option<u64>,
+    /// Consecutive failures, for backoff.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub f: u32,
+    /// Sticky opt-out.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub o: Option<KvOptOut>,
+    /// When the provider's opt-out was last cleared.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub oc: Option<u64>,
+    /// Unkeyed hashes of UIDs the owner invalidated, oldest first, at most
+    /// [`MAX_INVALIDATED_UIDS`]. Never emptied (spec 5.4).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub iv: Vec<String>,
+    /// Unkeyed hashes of UIDs the provider's opt-out removed, oldest first,
+    /// at most [`MAX_INVALIDATED_UIDS`]. Emptied when the opt-out clears.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub ov: Vec<String>,
+    /// The provider's private state as embedded JSON. KV only.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub st: Option<serde_json::Value>,
+}
+
+fn is_zero(value: &u32) -> bool {
+    *value == 0
+}
+
+/// Bytes of a stored entry set as compact JSON: the array of entries without
+/// `source`, as `eids` stores it. Both `validate` and the coordinator measure
+/// [`MAX_ENTRY_SET_BYTES`] with this function.
+pub(crate) fn entry_set_bytes(set: &[KvEid]) -> usize {
+    serde_json::to_vec(set).map_or(usize::MAX, |bytes| bytes.len())
+}
+```
+
+`KvPartnerId`, `KvEid` and `KvUid` do not deny unknown fields, so a field a later build adds never makes this build fail to read the row (spec 6.1).
+
+The listed constructors (`KvEntry::new`, `minimal`, `tombstone`) gain `ps: BTreeMap::new()` and write `v: SCHEMA_VERSION`, which is now 2. `minimal` uses `KvPartnerId::new(uid)`. `KvMetadata.v` takes the entry's `v`, so metadata written from now on says 2. Find every reader of the metadata version (`grep -rn "\.v\b\|SCHEMA_VERSION" crates/trusted-server-core/src/ec/`) and make each accept 1 and 2 where it reads, and write 2.
+
+Extend `validate()`. It still rejects `v != SCHEMA_VERSION`, now 2, with a message containing `version`. Inside the existing `for (partner_id, partner_uid) in &self.ids` loop, replace the UID length check with `validate_record(partner_id, partner_uid)?;`. After the loop:
+
+```rust
+        if self.ps.len() > MAX_PROVIDER_STATES {
+            return Err(format!("ps exceeds MAX_PROVIDER_STATES ({})", self.ps.len()));
+        }
+        for (provider, state) in &self.ps {
+            for (name, hashes) in [("iv", &state.iv), ("ov", &state.ov)] {
+                if hashes.len() > MAX_INVALIDATED_UIDS {
+                    return Err(format!("ps '{provider}' {name} exceeds {MAX_INVALIDATED_UIDS} hashes"));
+                }
+            }
+            if let Some(opt_out) = &state.o
+                && (opt_out.fp.is_empty()
+                    || opt_out.fp.len() > 16
+                    || !opt_out.fp.bytes().all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)))
+            {
+                return Err(format!("ps '{provider}' o.fp is not a hex bitmask"));
+            }
+            if let Some(st) = &state.st
+                && serde_json::to_vec(st).map_or(true, |bytes| bytes.len() > MAX_PROVIDER_STATE_BYTES)
+            {
+                return Err(format!("ps '{provider}' st exceeds {MAX_PROVIDER_STATE_BYTES} bytes"));
+            }
+        }
+```
+
+Add the helpers after `impl KvEntry`:
+
+```rust
+/// Checks one record against the limits of spec 4.5 and 6.1.
+fn validate_record(partner_id: &str, record: &KvPartnerId) -> Result<(), String> {
+    if record.eids.is_empty() {
+        return Err(format!("partner ID '{partner_id}' has an empty eids"));
+    }
+    if let Some(rv) = &record.rv
+        && (rv.len() != RECORD_REVISION_HEX_LEN
+            || !rv.bytes().all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)))
+    {
+        return Err(format!("partner ID '{partner_id}' rv is not {RECORD_REVISION_HEX_LEN} hex digits"));
+    }
+    if record.eids.len() > MAX_ENTRIES_PER_SOURCE {
+        return Err(format!("partner ID '{partner_id}' has more than {MAX_ENTRIES_PER_SOURCE} entries"));
+    }
+    let mut uid_count = 0;
+    for entry in &record.eids {
+        if entry.uids.is_empty() {
+            return Err(format!("partner ID '{partner_id}' has an entry without a uid"));
+        }
+        for (name, value) in [("inserter", &entry.inserter), ("matcher", &entry.matcher)] {
+            if let Some(value) = value
+                && (value.trim().is_empty() || value.len() > MAX_EID_FIELD_BYTES)
+            {
+                return Err(format!("partner ID '{partner_id}' {name} is blank or over {MAX_EID_FIELD_BYTES} bytes"));
+            }
+        }
+        if entry.mm.is_some_and(|mm| mm < 0) {
+            return Err(format!("partner ID '{partner_id}' mm is negative"));
+        }
+        validate_ext(partner_id, entry.ext.as_ref())?;
+        for uid in &entry.uids {
+            if uid.id.trim().is_empty() || uid.id.len() > MAX_UID_LENGTH {
+                return Err(format!("partner ID '{partner_id}' has a blank or oversized uid"));
+            }
+            if uid.atype.is_some_and(|atype| atype < 0) {
+                return Err(format!("partner ID '{partner_id}' atype is negative"));
+            }
+            validate_ext(partner_id, uid.ext.as_ref())?;
+        }
+        uid_count += entry.uids.len();
+    }
+    if uid_count > MAX_UIDS_PER_SOURCE {
+        return Err(format!("partner ID '{partner_id}' has more than {MAX_UIDS_PER_SOURCE} uids"));
+    }
+    if entry_set_bytes(&record.eids) > MAX_ENTRY_SET_BYTES {
+        return Err(format!("partner ID '{partner_id}' entry set exceeds {MAX_ENTRY_SET_BYTES} bytes"));
+    }
+    Ok(())
+}
+
+/// Checks a UID-level or EID-level `ext`: a JSON object of at most
+/// [`MAX_PARTNER_EXT_BYTES`] bytes as compact JSON.
+fn validate_ext(partner_id: &str, ext: Option<&serde_json::Value>) -> Result<(), String> {
+    let Some(ext) = ext else {
+        return Ok(());
+    };
+    let oversized = serde_json::to_vec(ext).map_or(true, |bytes| bytes.len() > MAX_PARTNER_EXT_BYTES);
+    if !ext.is_object() || oversized {
+        return Err(format!("partner ID '{partner_id}' ext is not an object of at most {MAX_PARTNER_EXT_BYTES} bytes"));
+    }
+    Ok(())
+}
+```
+
+Today's UID check (`kv_types.rs:375`) decides whether a version 1 `uid` is valid. Read it before writing `validate_record`, and keep accepting every `uid` it accepts, so no row that reads on `main` loses a record here. If it accepts a blank `uid`, accept it too and say so in the commit body; the spec's non-blank rule then applies only to UIDs a provider writes (Task 10).
+
+Add `upgrade_for_read` to `impl KvEntry`:
+
+```rust
+    /// Brings a row read from KV to the current schema (spec 6.1).
+    ///
+    /// Accepts schema versions 1 and 2 and sets the version to 2. Drops each
+    /// record that breaks a rule of spec 4.5 or 6.1, and returns one message
+    /// per dropped record, naming the source and the rule, never a UID.
+    /// Called on read only, before [`Self::validate`], so one bad record
+    /// never makes the row unreadable.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error naming the version when the row's version is
+    /// neither 1 nor 2.
+    pub(crate) fn upgrade_for_read(&mut self) -> Result<Vec<String>, String> {
+        if !(1..=SCHEMA_VERSION).contains(&self.v) {
+            return Err(format!("unsupported schema version {}", self.v));
+        }
+        self.v = SCHEMA_VERSION;
+        let mut messages = Vec::new();
+        self.ids.retain(|partner_id, record| match validate_record(partner_id, record) {
+            Ok(()) => true,
+            Err(message) => {
+                messages.push(message);
+                false
+            }
+        });
+        Ok(messages)
+    }
+```
+
+Every `validate_record` message names the partner ID and the rule and never a UID, so it is safe to log. In `ec/kv.rs` `deserialize_entry` (`kv.rs:355`), make `entry` mutable and call `entry.upgrade_for_read()` right before `entry.validate()`. Map its `Err` to the same error today's version check gives, and log each message with `log::warn!("Dropping an invalid record on read for key '{}': {message}", log_id(ec_id))`. `serialize_entry` keeps calling only `validate`, so a bad record is never written. In `ec/admin.rs` `build_lookup_response`, call `upgrade_for_read` on the parsed `KvEntry` before its `validate()` too, so the auction view matches what the read path serves, and when it returns messages set `payload.entry_error` to `dropped on read: ` followed by the messages joined with `; `.
+
+- [ ] **Step 4: Move every literal and `.uid` reader**
+
+Run `grep -rn "KvPartnerId {" crates/` and change each `KvPartnerId { uid: X }` to `KvPartnerId::new(X)`. That covers about 30 sites in 8 files, including `ec/kv.rs` (`apply_cookie_partner_id_updates`, `apply_partner_id_updates` and others), the batch sync and pull sync writers, the admin tests and `kv_types.rs`. None of them copies an existing record, so none loses metadata or entries. If one does, clone the record instead of rebuilding it. Run `grep -rn "KvEntry {" crates/` too, and add `ps: BTreeMap::new()` to any full literal the compiler flags.
+
+Then let the compiler list every read of the removed `uid` field. Each production reader moves to `first_uid()`, keeping today's meaning, because every record a Part 1 path reads that way is one entry with one UID:
+
+- `ec/kv.rs`, about lines 147, 186, 201 and 916, and the "is it the same UID" check at about line 988, which becomes `existing.first_uid() == Some(uid)`
+- `ec/admin.rs`, about lines 490 and 616
+- `ec/eids.rs`, about lines 40, 53 and 71 (Task 14 replaces these with the stored set)
+
+Test readers in `ec/kv.rs`, `auction/endpoints.rs`, `ec/finalize.rs` and `ec/pull_sync.rs` move to `first_uid()` too, or compare whole records against `KvPartnerId::new(..)`. Do not change what they assert.
+
+- [ ] **Step 5: Redact `ps.st` in the admin lookup**
+
+`build_lookup_response` (`ec/admin.rs:375`) already parses the body into a `JsonValue`, adds the `*_iso` companions and returns it as `payload.entry`. Redact that value in place, right after the parse and before `add_iso_timestamp_companions`:
+
+```rust
+/// Replaces every `ps.<provider>.st` with a marker. Provider state is never
+/// returned by the admin lookup (spec 6.1, 9.3).
+fn redact_provider_state(entry: &mut JsonValue) {
+    let Some(states) = entry.get_mut("ps").and_then(JsonValue::as_object_mut) else {
+        return;
+    };
+    for state in states.values_mut() {
+        if let Some(st) = state.get_mut("st") {
+            *st = JsonValue::String("[redacted]".to_owned());
+        }
+    }
+}
+```
+
+A body that is not JSON goes into `raw_body` unchanged, as today, because the lookup exists to inspect corrupt rows. Check that `raw_body` is only set for a body that does not parse, so it can never carry `ps.st`. The stored JSON is returned as stored, so a version 1 row shows `uid` until its next write.
+
+- [ ] **Step 6: Run and see the tests pass**
+
+Run: `cargo test-fastly -- ec::` and then `cargo clippy-fastly`
+Expected: PASS. Every existing KV, batch sync and pull sync test passes once its readers moved in Step 4, with its assertions unchanged.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Move the KV schema to version 2 with one record shape" -m "Every record stores its source's entry set in eids, with optional writer, revision and timing fields, and the row gains per-provider state. Version 1 rows read as one-entry records and are written as version 2. A build without this change cannot read a version 2 row, so rolling back past it is unsupported." -m "A record that breaks a limit is dropped on read and logged with its source only, so one bad record never makes a row unreadable; only the write path rejects it." -m "KvPartnerId and KvEntry derive Default, and literals move to constructors. The admin lookup redacts provider state."
+```
+
+### Task 7: Browser ingest records when it acquired an ID, and stores one UID
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (`PartnerIdUpdate`, `apply_cookie_partner_id_updates`, `apply_partner_id_updates`)
+- Modify: `crates/trusted-server-core/src/ec/prebid_eids.rs` (`collect_eid_updates`, `dedupe_partner_updates`)
+- Modify: `crates/trusted-server-core/src/ec/finalize.rs` (both `collect_eid_updates` callers), and every other `PartnerIdUpdate::new` or `collect_eid_updates` caller the compiler reports
+- Test: `crates/trusted-server-core/src/ec/kv.rs`, `crates/trusted-server-core/src/ec/prebid_eids.rs`
+
+**Interfaces:**
+
+- Produces: `PartnerIdUpdate { partner_id, uid, acquired_at: Option<u64> }`, `PartnerIdUpdate::new(partner_id, uid)` (`acquired_at = None`), `PartnerIdUpdate::with_acquired_at(self, at: u64) -> Self`. `collect_eid_updates` gains a last parameter `now: Option<u64>`. A record that browser ingest inserts now carries `at`.
+
+What browser ingest stores does not change (G13): one UID per registered source, as one entry with one UID and no `atype`, `ext` or EID-level field, picked by today's rule, and nothing for an unregistered source, whatever extra UIDs or EID-level fields the browser sent. Today's rule is in the `collect_eid_updates` doc comment (`ec/prebid_eids.rs:146-151`): for a repeated source, the first valid UID of its last entry wins, and the sharedId cookie is applied last, so it wins over a Prebid EID for the same partner. The golden test pins that for `ts-eids` and the sharedId cookie, the only input browser ingest keeps once Task 26 stops `/auction` and `/_ts/page-bids` from ingesting their bodies (spec G10). Until then the body input still goes through `collect_eid_updates` unchanged.
+
+- [ ] **Step 1: Write the failing tests**
+
+In `kv.rs` tests:
+
+```rust
+    #[test]
+    fn browser_ingest_records_acquisition_time() {
+        let mut entry = KvEntry::minimal("sharedid.org", "existing", 1);
+        let updates = [PartnerIdUpdate::new("example.com", "new-uid").with_acquired_at(1_760_000_000)];
+
+        let changed = apply_partner_id_updates(&mut entry, &updates);
+
+        assert!(changed, "should report a change");
+        assert_eq!(
+            entry.ids["example.com"],
+            KvPartnerId::browser("new-uid", Some(1_760_000_000)),
+            "should store the UID with at and no writer"
+        );
+        assert_eq!(entry.ids["sharedid.org"], KvPartnerId::new("existing"), "should leave other sources alone");
+    }
+```
+
+In `prebid_eids.rs` tests, next to `collect_eid_updates_merges_prebid_and_sharedid_without_kv` (`make_registry` and `encode_json` already exist there). Add `use crate::ec::kv::apply_partner_id_updates;` and `use crate::ec::kv_types::KvEntry;` to the test module's imports if they are not there:
+
+```rust
+    #[test]
+    fn golden_browser_ingest_stores_one_uid_per_registered_source() {
+        let registry = make_registry(vec![("id5", "id5-sync.com"), ("sharedid", "sharedid.org")]);
+        let eids_cookie = encode_json(&json!([
+            { "source": "id5-sync.com", "uids": [{ "id": "ID5_earlier_entry", "atype": 1 }] },
+            {
+                "source": "id5-sync.com",
+                "uids": [
+                    { "id": " ", "atype": 1 },
+                    { "id": "ID5_first", "atype": 1, "ext": { "linkType": 2 } },
+                    { "id": "ID5_second", "atype": 1 }
+                ],
+                "inserter": "example.com",
+                "matcher": "partner.example.com",
+                "mm": 3,
+                "ext": { "segments": ["example-segment"] }
+            },
+            { "source": "sharedid.org", "uids": [{ "id": "prebid-shared-id", "atype": 1 }] },
+            { "source": "unregistered.example.com", "uids": [{ "id": "other", "atype": 1 }] }
+        ]));
+        let updates =
+            collect_eid_updates(Some(&eids_cookie), Some(" cookie-shared-id "), None, &registry, Some(1_760_000_000));
+        let mut entry = KvEntry::minimal("example.com", "existing", 1);
+        apply_partner_id_updates(&mut entry, &updates);
+        let stored = serde_json::to_value(&entry.ids).expect("should serialize ids");
+
+        assert_eq!(
+            stored,
+            json!({
+                "example.com": { "eids": [{ "uids": [{ "id": "existing" }] }] },
+                "id5-sync.com": { "at": 1_760_000_000, "eids": [{ "uids": [{ "id": "ID5_first" }] }] },
+                "sharedid.org": { "at": 1_760_000_000, "eids": [{ "uids": [{ "id": "cookie-shared-id" }] }] }
+            }),
+            "should store one UID per registered source by today's rule, with no EID-level field, atype or ext"
+        );
+    }
+```
+
+The expected values are today's rule, not a new one. Before Step 3, check them against the code as Task 6 leaves it: call the four-argument `collect_eid_updates`, drop every `"at"` from the expectation, and the assertion must pass. If it does not, the expectation is wrong, not the code: fix the expectation to what `main` stores and record the difference in the PR description.
+
+Update the existing `collect_eid_updates(...)` calls in `prebid_eids.rs` tests to pass `None` as the new last argument. Their expectations do not change.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::kv::tests::browser_ingest_records_acquisition_time` and `cargo test-fastly -- ec::prebid_eids::tests::golden_browser_ingest`
+Expected: compile errors, because `with_acquired_at` and the `now` parameter do not exist.
+
+- [ ] **Step 3: Implement**
+
+Add the field and builder:
+
+```rust
+pub(crate) struct PartnerIdUpdate {
+    pub(crate) partner_id: String,
+    pub(crate) uid: String,
+    /// Unix seconds this request saw the ID. Stored as the record's `at`.
+    pub(crate) acquired_at: Option<u64>,
+}
+
+impl PartnerIdUpdate {
+    pub(crate) fn new(partner_id: impl Into<String>, uid: impl Into<String>) -> Self {
+        Self { partner_id: partner_id.into(), uid: uid.into(), acquired_at: None }
+    }
+
+    /// Records when this request saw the ID.
+    #[must_use]
+    pub(crate) fn with_acquired_at(mut self, at: u64) -> Self {
+        self.acquired_at = Some(at);
+        self
+    }
+}
+```
+
+In both `apply_*` functions, the de-duplicating map now keeps the whole update: `BTreeMap<&str, &PartnerIdUpdate>`. Insert `KvPartnerId::browser(update.uid.clone(), update.acquired_at)`. Equality checks still compare only `uid`, so an unchanged UID is not rewritten just to bump `at`.
+
+In `prebid_eids.rs`, add the `now: Option<u64>` parameter last in `collect_eid_updates`. When it is `Some`, call `.with_acquired_at(now)` on each update before `dedupe_partner_updates`. `dedupe_partner_updates` rebuilds every update from its `partner_id` and `uid` today, which would drop `acquired_at`, so make it keep the whole update:
+
+```rust
+pub(crate) fn dedupe_partner_updates(updates: Vec<PartnerIdUpdate>) -> Vec<PartnerIdUpdate> {
+    let mut latest = std::collections::BTreeMap::new();
+    for update in updates {
+        latest.insert(update.partner_id.clone(), update);
+    }
+
+    latest.into_values().collect()
+}
+```
+
+The later update for a partner still wins, and the output is still ordered by partner ID. Pass `checked_current_timestamp()` as `now` from both callers in `finalize.rs`. Leave batch sync and pull sync without `acquired_at`. They get it through the mutation in Tasks 15 and 22.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::`
+Expected: PASS, including every existing `prebid_eids` and `finalize` test unchanged apart from the extra `None` argument.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src/ec
+git commit --signoff -S -m "Record when browser ingest acquired each ID" -m "Ingest still stores one UID per registered source, by today's rule: the first valid UID of a repeated source's last entry, with the sharedId cookie applied last. A golden test pins that extra UIDs and EID-level fields from the browser are not stored."
+```
+
+### Task 8: The provider descriptor
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/identity/descriptor.rs` (Task 5 created it with `Input` and `Access`)
+- Modify: `crates/trusted-server-core/src/ec/identity/mod.rs` (re-exports)
+- Test: `crates/trusted-server-core/src/ec/identity/descriptor.rs`
+
+**Interfaces:**
+
+- Consumes: `IdentityProviderId`, `SourceDomain`, `IdentityProviderError` (Task 5)
+- Produces, exactly as spec 4.3 lists them:
+  - `ProviderDescriptor` and its getters: `builder`, `id`, `sources`, `primary_source`, `source_named`, `resolves`, `endpoint`, `captures`, `consent_policy`, `provenance`, `is_expiring`
+  - `ProviderDescriptorBuilder`: `with_source`, `with_resolves`, `with_captures`, `with_consent_policy`, `with_expiring_ids`, `with_expiring_source`, `with_provenance`, `build`
+  - `Resolves`: `new`, `with_endpoint(&str)`, `with_host(&str)`, `with_needs`, `with_needs_for`, `with_wants`, `with_kinds`, `with_private_state`, plus `pub(in crate::ec::identity) fn with_ec_id(self)` and crate-visible getters `hosts()`, `needs(kind)`, `wants()`, `kinds()`, `has_private_state()`, `gets_ec_id()`
+  - `Captures`: `new`, `with_path(Method, &str)`, `with_path_prefix(&str)`, plus crate-visible `matches(&Method, &str) -> bool`, `paths()`, `prefixes()`. There is no body-consent rule: capture is gated by the request's own consent, from its cookies and headers (spec 4.7).
+  - `EidProvenance`: `new`, `with_inserter`, `with_matcher`, `with_mm`, `inserter`, `matcher`, `mm`
+  - `ConsentPolicy`: `strict`, `with_tcf_purposes`, `with_tcf_vendor`, `allowing_dnt`, `allowing_gpc`, `allowing_us_opt_out`, plus `pub(in crate::ec::identity) fn eid_persistence_only()` for generic pull and crate-visible getters
+  - `UsOptOut { Sale, Sharing, TargetedAdvertising }`
+  - `ResolveKind { Initial, Refresh }` lives here rather than in `input.rs` because `Resolves` keys on it. `input.rs` re-exports it.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use http::Method;
+
+    use super::*;
+
+    fn source(name: &str) -> SourceDomain {
+        name.parse().expect("should parse source")
+    }
+
+    fn id(name: &str) -> IdentityProviderId {
+        name.parse().expect("should parse id")
+    }
+
+    #[test]
+    fn builds_the_documented_example() {
+        let descriptor = ProviderDescriptor::builder(id("exampleid"))
+            .with_source(source("exampleid.example.com"))
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint("https://api.exampleid.example.com/v1/fetch")
+                    .with_needs([Input::ClientIp, Input::UserAgent])
+                    .with_wants([Input::PageUrl]),
+            )
+            .with_consent_policy(ConsentPolicy::strict().with_tcf_vendor(9999))
+            .build()
+            .expect("should build");
+
+        assert_eq!(descriptor.id().as_str(), "exampleid", "should keep the id");
+        assert_eq!(descriptor.primary_source(), &source("exampleid.example.com"), "should keep the source");
+        assert_eq!(
+            descriptor.endpoint().map(Url::as_str),
+            Some("https://api.exampleid.example.com/v1/fetch"),
+            "should parse the endpoint"
+        );
+        let resolves = descriptor.resolves().expect("should resolve");
+        assert_eq!(
+            resolves.hosts(),
+            &["api.exampleid.example.com".to_owned()],
+            "should allow the endpoint host"
+        );
+        assert_eq!(
+            resolves.kinds(),
+            &[ResolveKind::Initial, ResolveKind::Refresh],
+            "should default to Initial and Refresh"
+        );
+        assert!(descriptor.captures().is_none(), "should not capture");
+        assert!(!descriptor.is_expiring(&source("exampleid.example.com")), "should not expire by default");
+        assert_eq!(descriptor.consent_policy().tcf_vendor(), Some(9999), "should keep the vendor");
+        assert_eq!(
+            descriptor.consent_policy().tcf_purposes().iter().copied().collect::<Vec<_>>(),
+            vec![1, 4],
+            "should require Purposes 1 and 4 under strict"
+        );
+    }
+
+    #[test]
+    fn build_rejects_invalid_descriptors() {
+        let cases: Vec<(&str, ProviderDescriptorBuilder)> = vec![
+            ("no source", ProviderDescriptor::builder(id("p")).with_resolves(Resolves::new().with_endpoint("https://a.example.com"))),
+            ("no capability", ProviderDescriptor::builder(id("p")).with_source(source("example.com"))),
+            ("no endpoint or host", ProviderDescriptor::builder(id("p")).with_source(source("example.com")).with_resolves(Resolves::new())),
+            ("http endpoint", ProviderDescriptor::builder(id("p")).with_source(source("example.com")).with_resolves(Resolves::new().with_endpoint("http://a.example.com"))),
+            ("bad host", ProviderDescriptor::builder(id("p")).with_source(source("example.com")).with_resolves(Resolves::new().with_host("a.example.com/path"))),
+            (
+                "provenance for undeclared source",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(&source("other.example.com"), EidProvenance::new().with_mm(2)),
+            ),
+            (
+                "expiring undeclared source",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_expiring_source(&source("other.example.com")),
+            ),
+            (
+                "blank provenance inserter",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(&source("example.com"), EidProvenance::new().with_inserter("  ")),
+            ),
+            (
+                "blank provenance matcher",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(&source("example.com"), EidProvenance::new().with_matcher("")),
+            ),
+            (
+                "oversized provenance matcher",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(
+                        &source("example.com"),
+                        EidProvenance::new().with_matcher(&"m".repeat(MAX_EID_FIELD_BYTES + 1)),
+                    ),
+            ),
+            (
+                "negative provenance mm",
+                ProviderDescriptor::builder(id("p"))
+                    .with_source(source("example.com"))
+                    .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                    .with_provenance(&source("example.com"), EidProvenance::new().with_mm(-1)),
+            ),
+        ];
+        for (name, builder) in cases {
+            let error = builder
+                .build()
+                .expect_err(&format!("should reject a descriptor with {name}"));
+            assert!(
+                matches!(error.current_context(), IdentityProviderError::Config { .. }),
+                "should be a Config error: {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn expiring_and_provenance_are_per_source() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let descriptor = ProviderDescriptor::builder(id("p"))
+            .with_source(a.clone())
+            .with_source(b.clone())
+            .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+            .with_expiring_source(&b)
+            .with_provenance(&a, EidProvenance::new().with_inserter("example-inserter").with_mm(2))
+            .build()
+            .expect("should build");
+
+        assert!(!descriptor.is_expiring(&a), "should not mark a as expiring");
+        assert!(descriptor.is_expiring(&b), "should mark b as expiring");
+        let provenance = descriptor.provenance(&a).expect("should have provenance for a");
+        assert_eq!(provenance.inserter(), Some("example-inserter"), "should keep the inserter");
+        assert_eq!(provenance.matcher(), None, "should leave the matcher unset");
+        assert_eq!(provenance.mm(), Some(2), "should keep mm");
+        assert!(descriptor.provenance(&b).is_none(), "should have no provenance for b");
+        assert_eq!(descriptor.source_named("A.EXAMPLE.COM"), Some(&a), "should find a by any spelling");
+    }
+
+    #[test]
+    fn expiring_ids_marks_every_source() {
+        let descriptor = ProviderDescriptor::builder(id("p"))
+            .with_source(source("a.example.com"))
+            .with_source(source("b.example.com"))
+            .with_expiring_ids()
+            .with_captures(Captures::new().with_path_prefix("/integrations/p/"))
+            .build()
+            .expect("should build");
+        assert!(descriptor.sources().iter().all(|s| descriptor.is_expiring(s)), "should mark every source");
+    }
+
+    #[test]
+    fn captures_match_exact_paths_and_prefixes() {
+        let captures = Captures::new()
+            .with_path(Method::POST, "/integrations/p/api/token")
+            .with_path_prefix("/integrations/p/stream/");
+        assert!(captures.matches(&Method::POST, "/integrations/p/api/token"), "should match the exact path");
+        assert!(!captures.matches(&Method::GET, "/integrations/p/api/token"), "should require the method");
+        assert!(
+            !captures.matches(&Method::POST, "/integrations/p/api/token/x"),
+            "should not treat an exact path as a prefix"
+        );
+        assert!(captures.matches(&Method::GET, "/integrations/p/stream/1"), "should match a prefix for any method");
+        assert!(!captures.matches(&Method::GET, "/integrations/p/settings"), "should not match others");
+    }
+
+    #[test]
+    fn needs_differ_by_kind() {
+        let resolves = Resolves::new()
+            .with_endpoint("https://a.example.com")
+            .with_needs([Input::ClientIp])
+            .with_needs_for(ResolveKind::Initial, [Input::HashedEmail]);
+        assert_eq!(
+            resolves.needs(ResolveKind::Initial),
+            [Input::ClientIp, Input::HashedEmail].into_iter().collect(),
+            "should need both inputs for Initial"
+        );
+        assert_eq!(
+            resolves.needs(ResolveKind::Refresh),
+            [Input::ClientIp].into_iter().collect(),
+            "should need only the IP for Refresh"
+        );
+    }
+
+    #[test]
+    fn valid_provenance_builds() {
+        let descriptor = ProviderDescriptor::builder(id("p"))
+            .with_source(source("example.com"))
+            .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+            .with_provenance(
+                &source("example.com"),
+                EidProvenance::new().with_inserter("example-inserter").with_matcher("example-matcher").with_mm(0),
+            )
+            .build()
+            .expect("should accept non-blank provenance and mm 0");
+        assert!(
+            descriptor.provenance(&source("example.com")).is_some(),
+            "should keep the provenance"
+        );
+    }
+}
+```
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::descriptor`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Add above the existing enums in `descriptor.rs`:
+
+```rust
+use std::collections::{BTreeMap, BTreeSet};
+
+use error_stack::Report;
+use http::Method;
+use url::Url;
+
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::resolution::IdentityProviderError;
+use crate::ec::kv_types::MAX_EID_FIELD_BYTES;
+use crate::ec::partner::normalize_partner_source_domain;
+
+/// What a provider is, may write, needs and must respect.
+///
+/// Built from config with no secrets, so `ts config validate` and the running
+/// coordinator read the same value.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderDescriptor {
+    id: IdentityProviderId,
+    sources: Vec<SourceDomain>,
+    resolves: Option<Resolves>,
+    endpoint: Option<Url>,
+    captures: Option<Captures>,
+    consent_policy: ConsentPolicy,
+    provenance: BTreeMap<SourceDomain, EidProvenance>,
+    expiring: BTreeSet<SourceDomain>,
+}
+
+impl ProviderDescriptor {
+    /// Starts a descriptor for `id`.
+    #[must_use]
+    pub fn builder(id: IdentityProviderId) -> ProviderDescriptorBuilder {
+        ProviderDescriptorBuilder {
+            id,
+            sources: Vec::new(),
+            resolves: None,
+            captures: None,
+            consent_policy: ConsentPolicy::strict(),
+            provenance: BTreeMap::new(),
+            expiring_all: false,
+            expiring: BTreeSet::new(),
+        }
+    }
+
+    /// The provider's ID.
+    #[must_use]
+    pub fn id(&self) -> &IdentityProviderId {
+        &self.id
+    }
+
+    /// The sources this provider may write, in declaration order.
+    #[must_use]
+    pub fn sources(&self) -> &[SourceDomain] {
+        &self.sources
+    }
+
+    /// The first source added. Every built descriptor has one.
+    #[must_use]
+    pub fn primary_source(&self) -> &SourceDomain {
+        &self.sources[0]
+    }
+
+    /// Finds a declared source by a vendor's spelling of it, normalized.
+    #[must_use]
+    pub fn source_named(&self, name: &str) -> Option<&SourceDomain> {
+        self.sources.iter().find(|source| source.matches(name))
+    }
+
+    /// Active resolution, when declared.
+    #[must_use]
+    pub fn resolves(&self) -> Option<&Resolves> {
+        self.resolves.as_ref()
+    }
+
+    /// The endpoint declared with [`Resolves::with_endpoint`], if any.
+    #[must_use]
+    pub fn endpoint(&self) -> Option<&Url> {
+        self.endpoint.as_ref()
+    }
+
+    /// Passive capture, when declared.
+    #[must_use]
+    pub fn captures(&self) -> Option<&Captures> {
+        self.captures.as_ref()
+    }
+
+    /// The consent this provider requires.
+    #[must_use]
+    pub fn consent_policy(&self) -> &ConsentPolicy {
+        &self.consent_policy
+    }
+
+    /// Default EID-level fields for `source`, if declared.
+    #[must_use]
+    pub fn provenance(&self, source: &SourceDomain) -> Option<&EidProvenance> {
+        self.provenance.get(source)
+    }
+
+    /// Whether IDs of `source` are declared as expiring.
+    #[must_use]
+    pub fn is_expiring(&self, source: &SourceDomain) -> bool {
+        self.expiring.contains(source)
+    }
+}
+
+/// Builds a [`ProviderDescriptor`].
+#[derive(Debug, Clone)]
+pub struct ProviderDescriptorBuilder {
+    id: IdentityProviderId,
+    sources: Vec<SourceDomain>,
+    resolves: Option<Resolves>,
+    captures: Option<Captures>,
+    consent_policy: ConsentPolicy,
+    provenance: BTreeMap<SourceDomain, EidProvenance>,
+    expiring_all: bool,
+    expiring: BTreeSet<SourceDomain>,
+}
+
+impl ProviderDescriptorBuilder {
+    /// Adds a source this provider may write. Repeatable. A repeat is ignored.
+    #[must_use]
+    pub fn with_source(mut self, source: SourceDomain) -> Self {
+        if !self.sources.contains(&source) {
+            self.sources.push(source);
+        }
+        self
+    }
+
+    /// Declares active resolution.
+    #[must_use]
+    pub fn with_resolves(mut self, resolves: Resolves) -> Self {
+        self.resolves = Some(resolves);
+        self
+    }
+
+    /// Declares passive capture.
+    #[must_use]
+    pub fn with_captures(mut self, captures: Captures) -> Self {
+        self.captures = Some(captures);
+        self
+    }
+
+    /// Replaces the default policy, [`ConsentPolicy::strict`].
+    #[must_use]
+    pub fn with_consent_policy(mut self, policy: ConsentPolicy) -> Self {
+        self.consent_policy = policy;
+        self
+    }
+
+    /// Marks the IDs of every declared source as expiring (spec 6.1).
+    #[must_use]
+    pub fn with_expiring_ids(mut self) -> Self {
+        self.expiring_all = true;
+        self
+    }
+
+    /// Marks the IDs of one declared source as expiring.
+    #[must_use]
+    pub fn with_expiring_source(mut self, source: &SourceDomain) -> Self {
+        self.expiring.insert(source.clone());
+        self
+    }
+
+    /// Default EID-level fields for a declared source. At output, the
+    /// coordinator applies them to a stored entry of that source, written by
+    /// this provider, only when the entry sets none of `inserter`, `matcher`
+    /// and `mm`. An entry that sets any of them is the vendor's complete
+    /// statement, so vendor and config provenance never mix in one entry.
+    /// The defaults are not stored, so a config change applies at once.
+    #[must_use]
+    pub fn with_provenance(mut self, source: &SourceDomain, provenance: EidProvenance) -> Self {
+        self.provenance.insert(source.clone(), provenance);
+        self
+    }
+
+    /// Validates and builds the descriptor.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Config` when the descriptor has no source, no capability, a
+    /// resolver with no endpoint or host, an endpoint that is not an `https`
+    /// URL, a host that is not a bare hostname, provenance or an expiring
+    /// mark for a source it does not declare, a provenance `inserter` or
+    /// `matcher` that is blank or over 255 bytes, or a provenance `mm` below 0.
+    pub fn build(self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        let id = self.id;
+        let fail = |what: &str| IdentityProviderError::config(format!("provider `{id}`: {what}"));
+
+        if self.sources.is_empty() {
+            return Err(fail("declares no source"));
+        }
+        if self.resolves.is_none() && self.captures.is_none() {
+            return Err(fail("declares neither resolves nor captures"));
+        }
+        for source in self.provenance.keys().chain(self.expiring.iter()) {
+            if !self.sources.contains(source) {
+                return Err(fail(&format!("names undeclared source `{source}`")));
+            }
+        }
+        for (source, provenance) in &self.provenance {
+            let fields = [("inserter", provenance.inserter()), ("matcher", provenance.matcher())];
+            for (name, value) in fields {
+                if let Some(value) = value
+                    && (value.trim().is_empty() || value.len() > MAX_EID_FIELD_BYTES)
+                {
+                    return Err(fail(&format!(
+                        "provenance `{name}` for `{source}` is blank or over {MAX_EID_FIELD_BYTES} bytes"
+                    )));
+                }
+            }
+            if provenance.mm().is_some_and(|mm| mm < 0) {
+                return Err(fail(&format!("provenance `mm` for `{source}` is below 0")));
+            }
+        }
+
+        let mut endpoint = None;
+        let mut resolves = self.resolves;
+        if let Some(resolves) = resolves.as_mut() {
+            if let Some(raw) = resolves.raw_endpoint.as_deref() {
+                let url = Url::parse(raw).map_err(|_| fail("endpoint is not a URL"))?;
+                if url.scheme() != "https" {
+                    return Err(fail("endpoint must use https"));
+                }
+                let host = url.host_str().ok_or_else(|| fail("endpoint has no host"))?.to_owned();
+                if !resolves.hosts.contains(&host) {
+                    resolves.hosts.insert(0, host);
+                }
+                endpoint = Some(url);
+            }
+            if resolves.hosts.is_empty() {
+                return Err(fail("resolves declares no endpoint or host"));
+            }
+            for host in &resolves.hosts {
+                if normalize_partner_source_domain(host).ok().as_deref() != Some(host.as_str()) {
+                    return Err(fail(&format!("host `{host}` is not a bare lowercase hostname")));
+                }
+            }
+        }
+
+        let expiring = if self.expiring_all {
+            self.sources.iter().cloned().collect()
+        } else {
+            self.expiring
+        };
+
+        Ok(ProviderDescriptor {
+            id,
+            sources: self.sources,
+            resolves,
+            endpoint,
+            captures: self.captures,
+            consent_policy: self.consent_policy,
+            provenance: self.provenance,
+            expiring,
+        })
+    }
+}
+
+/// The kind of resolution one source needs.
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display,
+)]
+#[non_exhaustive]
+pub enum ResolveKind {
+    /// No stored record for the source.
+    #[display("initial")]
+    Initial,
+    /// A stored record exists, valid or expired, and is due.
+    #[display("refresh")]
+    Refresh,
+}
+
+/// Active resolution: the provider calls an endpoint.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Resolves {
+    raw_endpoint: Option<String>,
+    hosts: Vec<String>,
+    needs: BTreeSet<Input>,
+    needs_for: BTreeMap<ResolveKind, BTreeSet<Input>>,
+    wants: BTreeSet<Input>,
+    kinds: Vec<ResolveKind>,
+    private_state: bool,
+    ec_id: bool,
+}
+
+impl Default for Resolves {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Resolves {
+    /// A resolver with no inputs, handling `Initial` and `Refresh`.
+    #[must_use]
+    pub fn new() -> Self {
+        Self {
+            raw_endpoint: None,
+            hosts: Vec::new(),
+            needs: BTreeSet::new(),
+            needs_for: BTreeMap::new(),
+            wants: BTreeSet::new(),
+            kinds: vec![ResolveKind::Initial, ResolveKind::Refresh],
+            private_state: false,
+            ec_id: false,
+        }
+    }
+
+    /// The endpoint the provider calls, as config spells it. `build()` parses
+    /// it and requires `https`. Its host becomes an allowed host.
+    #[must_use]
+    pub fn with_endpoint(mut self, endpoint: &str) -> Self {
+        self.raw_endpoint = Some(endpoint.to_owned());
+        self
+    }
+
+    /// Adds another host the provider may call. Repeatable.
+    #[must_use]
+    pub fn with_host(mut self, host: &str) -> Self {
+        if !self.hosts.iter().any(|known| known == host) {
+            self.hosts.push(host.to_owned());
+        }
+        self
+    }
+
+    /// Inputs required for every kind.
+    #[must_use]
+    pub fn with_needs(mut self, inputs: impl IntoIterator<Item = Input>) -> Self {
+        self.needs.extend(inputs);
+        self
+    }
+
+    /// Inputs required for one kind only.
+    #[must_use]
+    pub fn with_needs_for(mut self, kind: ResolveKind, inputs: impl IntoIterator<Item = Input>) -> Self {
+        self.needs_for.entry(kind).or_default().extend(inputs);
+        self
+    }
+
+    /// Inputs passed when available, never required.
+    #[must_use]
+    pub fn with_wants(mut self, inputs: impl IntoIterator<Item = Input>) -> Self {
+        self.wants.extend(inputs);
+        self
+    }
+
+    /// The kinds this provider handles. Default: `Initial` and `Refresh`.
+    #[must_use]
+    pub fn with_kinds(mut self, kinds: impl IntoIterator<Item = ResolveKind>) -> Self {
+        self.kinds = kinds.into_iter().collect();
+        self
+    }
+
+    /// This provider keeps private state in KV (`ps.st`, spec 6.1). It can
+    /// then read the stored state and return a state change.
+    #[must_use]
+    pub fn with_private_state(mut self) -> Self {
+        self.private_state = true;
+        self
+    }
+
+    /// Gives the provider the full EC ID. Only generic pull may use this.
+    #[must_use]
+    pub(in crate::ec::identity) fn with_ec_id(mut self) -> Self {
+        self.ec_id = true;
+        self
+    }
+
+    /// Hosts the provider may call.
+    #[must_use]
+    pub(crate) fn hosts(&self) -> &[String] {
+        &self.hosts
+    }
+
+    /// Inputs required for `kind`: the common needs plus that kind's.
+    #[must_use]
+    pub(crate) fn needs(&self, kind: ResolveKind) -> BTreeSet<Input> {
+        let mut needs = self.needs.clone();
+        if let Some(extra) = self.needs_for.get(&kind) {
+            needs.extend(extra.iter().copied());
+        }
+        needs
+    }
+
+    /// Every input declared for any kind, needed or wanted.
+    #[must_use]
+    pub(crate) fn declared_inputs(&self) -> BTreeSet<Input> {
+        let mut all = self.needs.clone();
+        all.extend(self.wants.iter().copied());
+        for extra in self.needs_for.values() {
+            all.extend(extra.iter().copied());
+        }
+        all
+    }
+
+    /// Inputs passed when available.
+    #[must_use]
+    pub(crate) fn wants(&self) -> &BTreeSet<Input> {
+        &self.wants
+    }
+
+    /// The kinds this provider handles.
+    #[must_use]
+    pub(crate) fn kinds(&self) -> &[ResolveKind] {
+        &self.kinds
+    }
+
+    /// Whether the provider keeps private state.
+    #[must_use]
+    pub(crate) fn has_private_state(&self) -> bool {
+        self.private_state
+    }
+
+    /// Whether the provider receives the full EC ID.
+    #[must_use]
+    pub(crate) fn gets_ec_id(&self) -> bool {
+        self.ec_id
+    }
+}
+
+/// Revoke-only capture from responses TS proxies for this provider: it
+/// can remove IDs, opt out or clear an opt-out, and never stores a positive
+/// ID (spec 4.7).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Captures {
+    paths: Vec<(Method, String)>,
+    prefixes: Vec<String>,
+}
+
+impl Captures {
+    /// No capture rules yet.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Offers proxied responses to exactly this method and path. Repeatable.
+    #[must_use]
+    pub fn with_path(mut self, method: Method, path: &str) -> Self {
+        self.paths.push((method, path.to_owned()));
+        self
+    }
+
+    /// Offers proxied responses whose path starts with `prefix`, for any
+    /// method. Repeatable.
+    #[must_use]
+    pub fn with_path_prefix(mut self, prefix: &str) -> Self {
+        self.prefixes.push(prefix.to_owned());
+        self
+    }
+
+    /// Whether a proxied request matches a rule.
+    #[must_use]
+    pub(crate) fn matches(&self, method: &Method, path: &str) -> bool {
+        self.paths.iter().any(|(rule_method, rule_path)| rule_method == method && rule_path == path)
+            || self.prefixes.iter().any(|prefix| path.starts_with(prefix.as_str()))
+    }
+
+    /// Exact path rules.
+    #[must_use]
+    pub(crate) fn paths(&self) -> &[(Method, String)] {
+        &self.paths
+    }
+
+    /// Prefix rules.
+    #[must_use]
+    pub(crate) fn prefixes(&self) -> &[String] {
+        &self.prefixes
+    }
+}
+
+/// Default EID-level fields (`OpenRTB` 2.6 §3.2.27) that bidders read, such
+/// as who inserted an ID and how it was matched. They apply only to an entry
+/// that sets none of the three. A provider whose vendor returns these per
+/// response sets them on each `ResolvedEid` instead (spec 4.5).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct EidProvenance {
+    inserter: Option<String>,
+    matcher: Option<String>,
+    mm: Option<i32>,
+}
+
+impl EidProvenance {
+    /// No fields set.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Sets `inserter`.
+    #[must_use]
+    pub fn with_inserter(mut self, inserter: &str) -> Self {
+        self.inserter = Some(inserter.to_owned());
+        self
+    }
+
+    /// Sets `matcher`.
+    #[must_use]
+    pub fn with_matcher(mut self, matcher: &str) -> Self {
+        self.matcher = Some(matcher.to_owned());
+        self
+    }
+
+    /// Sets `mm`.
+    #[must_use]
+    pub fn with_mm(mut self, mm: i32) -> Self {
+        self.mm = Some(mm);
+        self
+    }
+
+    /// `inserter`, if set.
+    #[must_use]
+    pub fn inserter(&self) -> Option<&str> {
+        self.inserter.as_deref()
+    }
+
+    /// `matcher`, if set.
+    #[must_use]
+    pub fn matcher(&self) -> Option<&str> {
+        self.matcher.as_deref()
+    }
+
+    /// `mm`, if set.
+    #[must_use]
+    pub fn mm(&self) -> Option<i32> {
+        self.mm
+    }
+}
+
+/// A US opt-out a policy can relax.
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, derive_more::Display,
+)]
+#[non_exhaustive]
+pub enum UsOptOut {
+    /// Sale of personal information.
+    #[display("sale")]
+    Sale,
+    /// Sharing for cross-context behavioural advertising.
+    #[display("sharing")]
+    Sharing,
+    /// Targeted advertising.
+    #[display("targeted_advertising")]
+    TargetedAdvertising,
+}
+
+/// The consent a provider requires. Evaluated by the coordinator (Task 12).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ConsentPolicy {
+    tcf_purposes: BTreeSet<u8>,
+    tcf_vendor: Option<u16>,
+    allow_dnt: bool,
+    allow_gpc: bool,
+    allowed_us_opt_outs: BTreeSet<UsOptOut>,
+    eid_persistence_only: bool,
+}
+
+impl ConsentPolicy {
+    /// The default. Blocked when any consent signal present cannot be
+    /// decoded. Where TCF applies, requires Purposes 1 and 4. Blocked by
+    /// every US opt-out TS decodes, by `Sec-GPC: 1` and by `DNT: 1`.
+    #[must_use]
+    pub fn strict() -> Self {
+        Self {
+            tcf_purposes: [1, 4].into_iter().collect(),
+            tcf_vendor: None,
+            allow_dnt: false,
+            allow_gpc: false,
+            allowed_us_opt_outs: BTreeSet::new(),
+            eid_persistence_only: false,
+        }
+    }
+
+    /// Also requires these TCF purposes, where TCF applies.
+    #[must_use]
+    pub fn with_tcf_purposes(mut self, purposes: impl IntoIterator<Item = u8>) -> Self {
+        self.tcf_purposes.extend(purposes);
+        self
+    }
+
+    /// Requires vendor consent for this IAB Global Vendor List ID.
+    #[must_use]
+    pub fn with_tcf_vendor(mut self, vendor_id: u16) -> Self {
+        self.tcf_vendor = Some(vendor_id);
+        self
+    }
+
+    /// Does not block on `DNT: 1`. Needs a documented legal basis.
+    #[must_use]
+    pub fn allowing_dnt(mut self) -> Self {
+        self.allow_dnt = true;
+        self
+    }
+
+    /// Does not block on GPC. Needs a documented legal basis.
+    #[must_use]
+    pub fn allowing_gpc(mut self) -> Self {
+        self.allow_gpc = true;
+        self
+    }
+
+    /// Does not block on one US opt-out. Needs a documented legal basis.
+    #[must_use]
+    pub fn allowing_us_opt_out(mut self, opt_out: UsOptOut) -> Self {
+        self.allowed_us_opt_outs.insert(opt_out);
+        self
+    }
+
+    /// Blocks exactly what pull sync blocks today: only the global EC and
+    /// EID-persistence gates. For generic pull's parity (spec 10.4).
+    #[must_use]
+    pub(in crate::ec::identity) fn eid_persistence_only() -> Self {
+        Self { eid_persistence_only: true, ..Self::strict() }
+    }
+
+    /// Required TCF purposes.
+    #[must_use]
+    pub fn tcf_purposes(&self) -> &BTreeSet<u8> {
+        &self.tcf_purposes
+    }
+
+    /// Required GVL vendor, if any.
+    #[must_use]
+    pub fn tcf_vendor(&self) -> Option<u16> {
+        self.tcf_vendor
+    }
+
+    /// Whether `DNT: 1` is allowed.
+    #[must_use]
+    pub fn allows_dnt(&self) -> bool {
+        self.allow_dnt
+    }
+
+    /// Whether GPC is allowed.
+    #[must_use]
+    pub fn allows_gpc(&self) -> bool {
+        self.allow_gpc
+    }
+
+    /// Whether a US opt-out is allowed.
+    #[must_use]
+    pub fn allows_us_opt_out(&self, opt_out: UsOptOut) -> bool {
+        self.allowed_us_opt_outs.contains(&opt_out)
+    }
+
+    /// Whether this is generic pull's parity policy.
+    #[must_use]
+    pub(crate) fn is_eid_persistence_only(&self) -> bool {
+        self.eid_persistence_only
+    }
+}
+```
+
+`normalize_partner_source_domain` doubles as a hostname check: it accepts exactly a bare, lowercase-normalized hostname. Comparing its output to the input also rejects uppercase.
+
+The descriptor only holds the provenance defaults. Task 28 applies them at output to entries the provider wrote, and only to an entry that sets none of `inserter`, `matcher` and `mm` (all or nothing, spec 4.3). Nothing writes them to KV. `build()` reuses Task 6's `MAX_EID_FIELD_BYTES` (255), the same cap the coordinator applies to a `ResolvedEid`'s fields. Update `mod.rs`:
+
+```rust
+pub use descriptor::{
+    Access, Captures, ConsentPolicy, EidProvenance, Input, ProviderDescriptor,
+    ProviderDescriptorBuilder, ResolveKind, Resolves, UsOptOut,
+};
+```
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::descriptor`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity
+git commit --signoff -S -m "Add the identity provider descriptor and its builder"
+```
+
+### Task 9: Provider inputs
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/input.rs`
+- Modify: `crates/trusted-server-core/src/ec/identity/descriptor.rs` (`Access::EcId`), `mod.rs`, `migration_guards.rs`
+- Test: `crates/trusted-server-core/src/ec/identity/input.rs`
+
+**Interfaces:**
+
+- Consumes: `ProviderDescriptor`, `Resolves`, `Input`, `Access`, `ResolveKind` (Task 8), `KvPartnerId`, `KvEid` and `KvUid` (Task 6), `crate::openrtb::{Eid, Uid}`, and `ConsentContext` (`consent/types.rs`)
+- Produces:
+  - `ProviderConsent` with `gdpr_applies`, `raw_tc_string`, `raw_gpp_string`, `gpp_section_ids`, `raw_us_privacy`, and `pub(crate) fn from_context(&ConsentContext) -> Self`
+  - `Region` with `country`, `subdivision`, `is`, and `pub(crate) fn from_geo(country: &str, region: Option<&str>) -> Option<Self>`, which normalizes to upper case and strips an `XX-` prefix
+  - `HashedEmail` (32 bytes) with `as_bytes`, `to_hex`, `to_base64`, a redacting `Debug`, and `pub fn from_bytes([u8; 32]) -> Self` behind `#[cfg(any(test, feature = "test-utils"))]`. It is the only constructor in v1, and Task 39's harness reuses it instead of adding a second one
+  - `StoredId` with `eids`, `uid`, `atype`, `ext`, `writer`, `acquired_at`, `expires_at`, `refresh_at`, `is_expired`, and `pub(crate) fn from_record(source: &SourceDomain, record: &KvPartnerId) -> Option<Self>`, `None` for a record with an empty `eids`. `eids()` is the record's whole entry set (spec 4.4), one `Eid` per stored entry with `source` filled in; a record that browser ingest, generic pull or batch sync wrote is one entry with one UID. `uid`, `atype` and `ext` describe the first UID of the first entry, so a single-UID provider such as LiveRamp reads what it reads today
+  - `ResolveSignals<'a>`: a crate-private struct holding every signal the coordinator has (IP, UA, page URL, region, HEM, consent, publisher domain, now, random seed source, EC ID, stored IDs, raw state JSON). There is no dry-run flag: phase 4 calls `request` once (spec 5.2).
+  - `ResolveInput<'a>` with the spec 4.4 accessors, `pub(crate) fn new(descriptor: &'a ProviderDescriptor, kinds: BTreeMap<SourceDomain, ResolveKind>, signals: &'a ResolveSignals<'a>) -> Self`, `pub(crate) fn recorded_errors(&self) -> Vec<Access>`, `pub(crate) fn state_decode_failed(&self) -> bool`, and `pub(in crate::ec::identity) fn ec_id(&self) -> Result<&str, Report<IdentityProviderError>>`. Only the inputs of the kinds in `kinds` are available (spec 4.4): an input the descriptor declares only for a kind this call does not hold reads as `InputUnavailable`, not as an undeclared read
+  - `Access::EcId`, a new variant in `descriptor.rs` (`Access` is `#[non_exhaustive]`): an EC ID read by a resolver not declared `with_ec_id()`
+  - `RandomSource`: a crate-private trait `fn fill(&self, bytes: &mut [u8])`, with `ThreadRandom` for production and `pub struct SeededRandom` (an xorshift generator from a `u64` seed, `pub fn new(seed: u64)`) behind `#[cfg(any(test, feature = "test-utils"))]`. Test-support items are `pub` under that gate, as the crate's existing `test-utils` items are, so the non-test library build with `--all-features` has no dead code. Task 14's `test_support` module re-exports `SeededRandom`
+  - `CaptureInput` moves to Task 10, which creates the `ProviderResponse` it holds
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+    use std::net::IpAddr;
+
+    use super::*;
+    use crate::ec::identity::descriptor::{ProviderDescriptor, Resolves};
+    use crate::ec::kv_types::{KvEid, KvPartnerId, KvUid};
+
+    fn descriptor(resolves: Resolves) -> ProviderDescriptor {
+        ProviderDescriptor::builder("p".parse().expect("should parse the provider id"))
+            .with_source("example.com".parse().expect("should parse the source"))
+            .with_resolves(resolves)
+            .build()
+            .expect("should build")
+    }
+
+    fn signals() -> ResolveSignals<'static> {
+        ResolveSignals {
+            client_ip: Some("192.0.2.10".parse().expect("should parse ip")),
+            user_agent: Some("ExampleBrowser/1.0"),
+            page_url: None,
+            region: Region::from_geo("us", Some("us-ca")),
+            hashed_email: None,
+            consent: ProviderConsent::default(),
+            publisher_domain: "www.example.com",
+            now: UnixTime::from_secs(1_760_000_000),
+            random: &ThreadRandom,
+            ec_id: Some("a".repeat(64) + ".ABC123"),
+            stored: BTreeMap::new(),
+            state_json: None,
+        }
+    }
+
+    #[test]
+    fn declared_inputs_are_available_and_wanted_missing_ones_are_unavailable() {
+        let descriptor = descriptor(
+            Resolves::new()
+                .with_endpoint("https://a.example.com")
+                .with_needs([Input::ClientIp, Input::Region])
+                .with_wants([Input::PageUrl]),
+        );
+        let signals = signals();
+        let input = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Initial), &signals);
+
+        assert_eq!(
+            input.client_ip().expect("should read the ip"),
+            "192.0.2.10".parse::<IpAddr>().expect("should parse the ip"),
+            "should return the client ip"
+        );
+        let region = input.region().expect("should read region");
+        assert_eq!((region.country(), region.subdivision()), ("US", Some("CA")), "should normalize the region");
+        assert!(region.is("US", "CA"), "should test country and subdivision");
+        let error = input.page_url().expect_err("should be unavailable");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::InputUnavailable { input: Input::PageUrl }),
+            "should report a declared but missing input as InputUnavailable"
+        );
+        assert!(input.recorded_errors().is_empty(), "should record nothing for declared reads");
+    }
+
+    #[test]
+    fn input_declared_only_for_an_absent_kind_is_unavailable() {
+        let descriptor = descriptor(
+            Resolves::new()
+                .with_endpoint("https://a.example.com")
+                .with_needs([Input::ClientIp])
+                .with_needs_for(ResolveKind::Refresh, [Input::UserAgent]),
+        );
+        let signals = signals();
+
+        let initial = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Initial), &signals);
+        let refresh = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Refresh), &signals);
+
+        let error = initial.user_agent().expect_err("should hide a Refresh-only input on an Initial call");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::InputUnavailable { input: Input::UserAgent }),
+            "should report InputUnavailable, not an undeclared read"
+        );
+        assert!(initial.recorded_errors().is_empty(), "should record no undeclared read");
+        assert_eq!(
+            refresh.user_agent().expect("should read the user agent on a Refresh call"),
+            "ExampleBrowser/1.0",
+            "should return the user agent for the kind that declares it"
+        );
+    }
+
+    #[test]
+    fn undeclared_reads_are_recorded_even_when_ignored() {
+        let descriptor = descriptor(Resolves::new().with_endpoint("https://a.example.com"));
+        let signals = signals();
+        let input = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Initial), &signals);
+
+        let ignored = input.user_agent().ok();
+        let state = input.state::<serde_json::Value>();
+
+        assert!(ignored.is_none(), "should not return an undeclared input");
+        assert!(state.is_err(), "should need with_private_state for state");
+        assert_eq!(
+            input.recorded_errors(),
+            vec![Access::Input(Input::UserAgent), Access::PrivateState],
+            "should record both undeclared reads"
+        );
+        input.endpoint().expect("should always return the declared endpoint");
+    }
+
+    #[test]
+    fn state_decodes_and_a_bad_state_is_recorded() {
+        let descriptor = descriptor(Resolves::new().with_endpoint("https://a.example.com").with_private_state());
+        let mut good = signals();
+        good.state_json = Some(r#"{"signature":"s"}"#.to_owned());
+        let input = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Refresh), &good);
+        let state: serde_json::Value = input
+            .state()
+            .expect("should decode the state")
+            .expect("should have a state");
+        assert_eq!(state["signature"], "s", "should decode the state");
+        assert!(!input.state_decode_failed(), "should not record a good state as a failure");
+
+        let mut bad = signals();
+        bad.state_json = Some(r#""a bare string""#.to_owned());
+        let input = ResolveInput::new(&descriptor, kinds(&descriptor, ResolveKind::Refresh), &bad);
+        let error = input.state::<TypedState>().expect_err("should not decode a bare string");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::InvalidState),
+            "should report InvalidState"
+        );
+        assert!(input.state_decode_failed(), "should record the failure");
+    }
+
+    #[test]
+    fn ec_id_is_only_for_providers_declared_with_ec_id() {
+        let generic = descriptor(Resolves::new().with_host("a.example.com").with_ec_id());
+        let other = descriptor(Resolves::new().with_host("a.example.com"));
+        let signals = signals();
+        ResolveInput::new(&generic, kinds(&generic, ResolveKind::Initial), &signals)
+            .ec_id()
+            .expect("should let generic pull read the EC ID");
+        let input = ResolveInput::new(&other, kinds(&other, ResolveKind::Initial), &signals);
+        input.ec_id().expect_err("should refuse the EC ID to other providers");
+        assert_eq!(input.recorded_errors(), vec![Access::EcId], "should record an EC ID read");
+
+        let mut no_ec = signals();
+        no_ec.ec_id = None;
+        let error = ResolveInput::new(&generic, kinds(&generic, ResolveKind::Initial), &no_ec)
+            .ec_id()
+            .expect_err("should fail without an EC ID");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::Config { .. }),
+            "should report a missing EC ID as Config, not as a missing input"
+        );
+    }
+
+    #[test]
+    fn stored_ids_and_expiry() {
+        let record = KvPartnerId {
+            w: Some("p".to_owned()),
+            rv: Some("0123456789abcdef".to_owned()),
+            at: Some(10),
+            exp: Some(20),
+            ra: Some(15),
+            ru: None,
+            eids: vec![KvEid {
+                uids: vec![KvUid { id: "u".to_owned(), atype: Some(3), ext: None }],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            }],
+        };
+        let source: SourceDomain = "example.com".parse().expect("should parse the source");
+        let stored = StoredId::from_record(&source, &record).expect("should read a record with an entry");
+        assert_eq!(stored.writer().map(IdentityProviderId::as_str), Some("p"), "should parse the writer");
+        assert!(!stored.is_expired(UnixTime::from_secs(19)), "should not be expired before exp");
+        assert!(stored.is_expired(UnixTime::from_secs(20)), "should be expired at exp");
+        assert_eq!(stored.refresh_at(), Some(UnixTime::from_secs(15)), "should read ra");
+        assert_eq!(stored.eids().len(), 1, "should expose a one-UID record as one entry");
+        let eid = &stored.eids()[0];
+        assert_eq!(eid.source, "example.com", "should fill in the source");
+        assert_eq!(eid.uids.len(), 1, "should expose its one UID");
+        assert_eq!(eid.uids[0].id, "u", "should keep the UID");
+        assert_eq!(eid.uids[0].atype, Some(3), "should keep the atype");
+        assert_eq!(
+            (eid.inserter.as_deref(), eid.matcher.as_deref(), eid.mm, eid.ext.as_ref()),
+            (None, None, None, None),
+            "should expose no EID-level fields when none are stored"
+        );
+        assert_eq!((stored.uid(), stored.atype()), ("u", Some(3)), "should describe the first UID");
+
+        let empty = KvPartnerId { eids: Vec::new(), ..record };
+        assert!(StoredId::from_record(&source, &empty).is_none(), "should not read a record with no entry");
+    }
+
+    #[test]
+    fn a_full_record_exposes_every_entry_and_its_first_uid() {
+        let record = KvPartnerId {
+            w: Some("p".to_owned()),
+            rv: Some("0123456789abcdef".to_owned()),
+            at: Some(10),
+            exp: None,
+            ra: None,
+            ru: None,
+            eids: vec![
+                KvEid {
+                    uids: vec![
+                        KvUid { id: "first".to_owned(), atype: Some(1), ext: Some(serde_json::json!({ "rtiPartner": "TDID" })) },
+                        KvUid { id: "second".to_owned(), atype: Some(3), ext: None },
+                    ],
+                    inserter: Some("inserter.example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(2),
+                    ext: Some(serde_json::json!({ "segments": ["a"] })),
+                },
+                KvEid {
+                    uids: vec![KvUid { id: "third".to_owned(), atype: None, ext: None }],
+                    inserter: None,
+                    matcher: Some("matcher.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ],
+        };
+        let source: SourceDomain = "example.com".parse().expect("should parse the source");
+
+        let stored = StoredId::from_record(&source, &record).expect("should read the record");
+
+        let ids: Vec<Vec<&str>> = stored
+            .eids()
+            .iter()
+            .map(|eid| eid.uids.iter().map(|uid| uid.id.as_str()).collect())
+            .collect();
+        assert_eq!(ids, vec![vec!["first", "second"], vec!["third"]], "should keep every entry in stored order");
+        assert!(stored.eids().iter().all(|eid| eid.source == "example.com"), "should fill in the source");
+        assert_eq!(stored.eids()[0].inserter.as_deref(), Some("inserter.example.com"), "should keep the inserter");
+        assert_eq!(stored.eids()[0].mm, Some(2), "should keep mm");
+        assert_eq!(
+            stored.eids()[0].ext,
+            Some(serde_json::json!({ "segments": ["a"] })),
+            "should keep the EID-level ext"
+        );
+        assert_eq!(stored.eids()[1].matcher.as_deref(), Some("matcher.example.com"), "should keep the matcher");
+        assert_eq!(stored.uid(), "first", "should return the first UID of the first entry");
+        assert_eq!(stored.atype(), Some(1), "should return that UID's atype");
+        assert_eq!(
+            stored.ext(),
+            Some(&serde_json::json!({ "rtiPartner": "TDID" })),
+            "should return that UID's ext"
+        );
+        assert!(!format!("{stored:?}").contains("second"), "should redact every UID in Debug");
+    }
+
+    #[test]
+    fn hashed_email_debug_is_redacted() {
+        let email = HashedEmail::from_bytes([0xab; 32]);
+        assert_eq!(email.to_hex(), "ab".repeat(32), "should encode lowercase hex");
+        assert_eq!(format!("{email:?}"), "HashedEmail([redacted])", "should redact Debug");
+    }
+
+    fn kinds(descriptor: &ProviderDescriptor, kind: ResolveKind) -> BTreeMap<SourceDomain, ResolveKind> {
+        descriptor.sources().iter().map(|source| (source.clone(), kind)).collect()
+    }
+
+    #[derive(serde::Deserialize)]
+    struct TypedState {
+        #[allow(dead_code)]
+        signature: String,
+    }
+}
+```
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::input`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement `input.rs`**
+
+```rust
+//! What a provider may read for one call.
+
+use core::cell::RefCell;
+use core::fmt;
+use std::collections::{BTreeMap, BTreeSet};
+use std::net::IpAddr;
+
+use base64::Engine as _;
+use base64::engine::general_purpose::STANDARD;
+use error_stack::Report;
+use rand::RngCore as _;
+use serde::de::DeserializeOwned;
+use url::Url;
+
+use super::descriptor::{Access, Input, ProviderDescriptor, ResolveKind};
+use super::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use super::resolution::IdentityProviderError;
+use crate::consent::ConsentContext;
+use crate::ec::kv_types::KvPartnerId;
+use crate::openrtb::{Eid, Uid};
+
+/// The raw consent strings a provider forwards, and `gdpr_applies`.
+///
+/// Providers never decide consent. The coordinator has already applied the
+/// descriptor's policy.
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct ProviderConsent {
+    gdpr_applies: bool,
+    tc_string: Option<String>,
+    gpp_string: Option<String>,
+    gpp_section_ids: Option<Vec<u16>>,
+    us_privacy: Option<String>,
+}
+
+impl fmt::Debug for ProviderConsent {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderConsent")
+            .field("gdpr_applies", &self.gdpr_applies)
+            .field("tc_string", &self.tc_string.as_ref().map(|_| "[redacted]"))
+            .field("gpp_string", &self.gpp_string.as_ref().map(|_| "[redacted]"))
+            .field("gpp_section_ids", &self.gpp_section_ids)
+            .field("us_privacy", &self.us_privacy.as_ref().map(|_| "[redacted]"))
+            .finish()
+    }
+}
+
+impl ProviderConsent {
+    /// The view of a request's consent context.
+    #[must_use]
+    pub(crate) fn from_context(context: &ConsentContext) -> Self {
+        Self {
+            gdpr_applies: context.gdpr_applies,
+            tc_string: context.raw_tc_string.clone(),
+            gpp_string: context.raw_gpp_string.clone(),
+            gpp_section_ids: context.gpp_section_ids.clone(),
+            us_privacy: context.raw_us_privacy.clone(),
+        }
+    }
+
+    /// Whether GDPR applies to this request.
+    #[must_use]
+    pub fn gdpr_applies(&self) -> bool {
+        self.gdpr_applies
+    }
+
+    /// The raw TCF string.
+    #[must_use]
+    pub fn raw_tc_string(&self) -> Option<&str> {
+        self.tc_string.as_deref()
+    }
+
+    /// The raw GPP string.
+    #[must_use]
+    pub fn raw_gpp_string(&self) -> Option<&str> {
+        self.gpp_string.as_deref()
+    }
+
+    /// The applicable GPP section IDs.
+    #[must_use]
+    pub fn gpp_section_ids(&self) -> Option<&[u16]> {
+        self.gpp_section_ids.as_deref()
+    }
+
+    /// The raw US Privacy string.
+    #[must_use]
+    pub fn raw_us_privacy(&self) -> Option<&str> {
+        self.us_privacy.as_deref()
+    }
+}
+```
+
+Check the real field names on `ConsentContext` (`consent/types.rs:109-148`): `grep -n "pub " crates/trusted-server-core/src/consent/types.rs | sed -n 1,60p`. Use them in `from_context`. If the section IDs are stored as another type, convert here. The rest of the file:
+
+```rust
+/// Country and subdivision, upper case.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Region {
+    country: String,
+    subdivision: Option<String>,
+}
+
+impl Region {
+    /// Normalizes platform geo: upper case, and an ISO 3166-2 `US-CA` style
+    /// region loses its country prefix. `None` without a two-letter country.
+    #[must_use]
+    pub(crate) fn from_geo(country: &str, region: Option<&str>) -> Option<Self> {
+        let country = country.trim().to_ascii_uppercase();
+        if country.len() != 2 || !country.bytes().all(|byte| byte.is_ascii_alphabetic()) {
+            return None;
+        }
+        let subdivision = region
+            .map(|value| value.trim().to_ascii_uppercase())
+            .map(|value| match value.split_once('-') {
+                Some((prefix, rest)) if prefix == country => rest.to_owned(),
+                _ => value,
+            })
+            .filter(|value| !value.is_empty() && value.bytes().all(|byte| byte.is_ascii_alphanumeric()));
+        Some(Self { country, subdivision })
+    }
+
+    /// ISO 3166-1 alpha-2, upper case, for example `"US"`.
+    #[must_use]
+    pub fn country(&self) -> &str {
+        &self.country
+    }
+
+    /// The ISO 3166-2 subdivision without the country prefix, for example
+    /// `"CA"`. `None` when the platform does not know it.
+    #[must_use]
+    pub fn subdivision(&self) -> Option<&str> {
+        self.subdivision.as_deref()
+    }
+
+    /// Whether this is `country` and `subdivision`.
+    #[must_use]
+    pub fn is(&self, country: &str, subdivision: &str) -> bool {
+        self.country == country && self.subdivision.as_deref() == Some(subdivision)
+    }
+}
+
+/// The 32 raw bytes of a SHA-256 of a normalized email. Personal data.
+#[derive(Clone, PartialEq, Eq)]
+pub struct HashedEmail([u8; 32]);
+
+impl fmt::Debug for HashedEmail {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("HashedEmail([redacted])")
+    }
+}
+
+impl HashedEmail {
+    /// From digest bytes. Test support only: v1 has no source of hashed
+    /// emails, so nothing else builds one.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn from_bytes(bytes: [u8; 32]) -> Self {
+        Self(bytes)
+    }
+
+    /// The digest.
+    #[must_use]
+    pub fn as_bytes(&self) -> &[u8; 32] {
+        &self.0
+    }
+
+    /// Lowercase hex, as `LiveRamp` takes it.
+    #[must_use]
+    pub fn to_hex(&self) -> String {
+        hex::encode(self.0)
+    }
+
+    /// Standard base64, as `UID2` takes it.
+    #[must_use]
+    pub fn to_base64(&self) -> String {
+        STANDARD.encode(self.0)
+    }
+}
+
+/// A stored record for one of this provider's sources, valid or expired.
+///
+/// It holds the source's whole entry set, which is never empty.
+#[derive(Clone, PartialEq)]
+pub struct StoredId {
+    eids: Vec<Eid>,
+    uid: String,
+    writer: Option<IdentityProviderId>,
+    acquired_at: Option<UnixTime>,
+    expires_at: Option<UnixTime>,
+    refresh_at: Option<UnixTime>,
+}
+
+impl fmt::Debug for StoredId {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("StoredId")
+            .field("entries", &self.eids.len())
+            .field("uid", &"[redacted]")
+            .field("writer", &self.writer)
+            .field("acquired_at", &self.acquired_at)
+            .field("expires_at", &self.expires_at)
+            .field("refresh_at", &self.refresh_at)
+            .finish_non_exhaustive()
+    }
+}
+
+impl StoredId {
+    /// From the KV record of `source`. A writer that does not parse is
+    /// treated as none. `None` for a record with no entry, which
+    /// `KvEntry::validate` never lets through.
+    #[must_use]
+    pub(crate) fn from_record(source: &SourceDomain, record: &KvPartnerId) -> Option<Self> {
+        let uid = record.first_uid()?.to_owned();
+        let eids = record
+            .eids
+            .iter()
+            .map(|entry| Eid {
+                source: source.as_str().to_owned(),
+                uids: entry
+                    .uids
+                    .iter()
+                    .map(|uid| Uid { id: uid.id.clone(), atype: uid.atype, ext: uid.ext.clone() })
+                    .collect(),
+                inserter: entry.inserter.clone(),
+                matcher: entry.matcher.clone(),
+                mm: entry.mm,
+                ext: entry.ext.clone(),
+            })
+            .collect();
+        Some(Self {
+            eids,
+            uid,
+            writer: record.w.as_deref().and_then(|writer| writer.parse().ok()),
+            acquired_at: record.at.map(UnixTime::from_secs),
+            expires_at: record.exp.map(UnixTime::from_secs),
+            refresh_at: record.ra.map(UnixTime::from_secs),
+        })
+    }
+
+    fn first_uid(&self) -> Option<&Uid> {
+        self.eids.first().and_then(|eid| eid.uids.first())
+    }
+
+    /// Every stored entry for the source, in stored order, with its UIDs and
+    /// EID-level fields. A record that browser ingest, generic pull, batch
+    /// sync or a version 1 row wrote is one entry with one UID.
+    #[must_use]
+    pub fn eids(&self) -> &[Eid] {
+        &self.eids
+    }
+
+    /// The first UID of the first entry. What a single-UID refresh, such as
+    /// `LiveRamp`'s, sends back.
+    #[must_use]
+    pub fn uid(&self) -> &str {
+        &self.uid
+    }
+
+    /// The `atype` of that first UID.
+    #[must_use]
+    pub fn atype(&self) -> Option<i32> {
+        self.first_uid().and_then(|uid| uid.atype)
+    }
+
+    /// The UID-level ext of that first UID, as bidders read it in
+    /// `uids[].ext`.
+    #[must_use]
+    pub fn ext(&self) -> Option<&serde_json::Value> {
+        self.first_uid().and_then(|uid| uid.ext.as_ref())
+    }
+
+    /// The provider that wrote it. `None` for browser ingest and legacy rows.
+    #[must_use]
+    pub fn writer(&self) -> Option<&IdentityProviderId> {
+        self.writer.as_ref()
+    }
+
+    /// When it was acquired or last refreshed.
+    #[must_use]
+    pub fn acquired_at(&self) -> Option<UnixTime> {
+        self.acquired_at
+    }
+
+    /// When it must stop being sent.
+    #[must_use]
+    pub fn expires_at(&self) -> Option<UnixTime> {
+        self.expires_at
+    }
+
+    /// When it is due for refresh.
+    #[must_use]
+    pub fn refresh_at(&self) -> Option<UnixTime> {
+        self.refresh_at
+    }
+
+    /// Whether `now` is at or past its expiry.
+    #[must_use]
+    pub fn is_expired(&self, now: UnixTime) -> bool {
+        self.expires_at.is_some_and(|expires| now >= expires)
+    }
+}
+
+/// A source of random bytes.
+pub(crate) trait RandomSource: Send + Sync {
+    /// Fills `bytes`.
+    fn fill(&self, bytes: &mut [u8]);
+}
+
+/// The platform generator EC generation uses (`rand::thread_rng`).
+pub(crate) struct ThreadRandom;
+
+impl RandomSource for ThreadRandom {
+    fn fill(&self, bytes: &mut [u8]) {
+        rand::thread_rng().fill_bytes(bytes);
+    }
+}
+
+/// Deterministic bytes for tests: xorshift64* from a seed.
+#[cfg(any(test, feature = "test-utils"))]
+#[derive(Debug)]
+pub struct SeededRandom(std::sync::Mutex<u64>);
+
+#[cfg(any(test, feature = "test-utils"))]
+impl SeededRandom {
+    /// A generator that yields the same bytes for the same seed. A zero
+    /// seed is treated as one, since xorshift never leaves zero.
+    #[must_use]
+    pub fn new(seed: u64) -> Self {
+        Self(std::sync::Mutex::new(seed.max(1)))
+    }
+}
+
+#[cfg(any(test, feature = "test-utils"))]
+impl RandomSource for SeededRandom {
+    fn fill(&self, bytes: &mut [u8]) {
+        let mut state = self.0.lock().expect("should lock the seed");
+        for byte in bytes {
+            *state ^= *state >> 12;
+            *state ^= *state << 25;
+            *state ^= *state >> 27;
+            *byte = state.wrapping_mul(0x2545_F491_4F6C_DD1D).to_be_bytes()[0];
+        }
+    }
+}
+
+/// Every signal the coordinator holds for one request. Crate-private: a
+/// provider only ever sees a [`ResolveInput`] filtered by its descriptor.
+pub(crate) struct ResolveSignals<'a> {
+    pub(crate) client_ip: Option<IpAddr>,
+    pub(crate) user_agent: Option<&'a str>,
+    pub(crate) page_url: Option<Url>,
+    pub(crate) region: Option<Region>,
+    pub(crate) hashed_email: Option<HashedEmail>,
+    pub(crate) consent: ProviderConsent,
+    pub(crate) publisher_domain: &'a str,
+    pub(crate) now: UnixTime,
+    pub(crate) random: &'a dyn RandomSource,
+    pub(crate) ec_id: Option<String>,
+    pub(crate) stored: BTreeMap<SourceDomain, StoredId>,
+    pub(crate) state_json: Option<String>,
+}
+
+/// What one provider may read for one call.
+pub struct ResolveInput<'a> {
+    descriptor: &'a ProviderDescriptor,
+    kinds: BTreeMap<SourceDomain, ResolveKind>,
+    signals: &'a ResolveSignals<'a>,
+    declared: BTreeSet<Input>,
+    available: BTreeSet<Input>,
+    undeclared: RefCell<Vec<Access>>,
+    state_failed: RefCell<bool>,
+}
+
+impl fmt::Debug for ResolveInput<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ResolveInput")
+            .field("provider", self.descriptor.id())
+            .field("kinds", &self.kinds)
+            .finish_non_exhaustive()
+    }
+}
+
+impl<'a> ResolveInput<'a> {
+    /// The input for one call. `kinds` holds only the sources to resolve.
+    /// The inputs of every kind present are available, plus the wanted ones.
+    /// An input declared only for a kind this call does not hold is
+    /// declared, so reading it is not an error of the provider, but it is
+    /// unavailable (spec 4.4).
+    #[must_use]
+    pub(crate) fn new(
+        descriptor: &'a ProviderDescriptor,
+        kinds: BTreeMap<SourceDomain, ResolveKind>,
+        signals: &'a ResolveSignals<'a>,
+    ) -> Self {
+        let (declared, available) = descriptor.resolves().map_or_else(Default::default, |resolves| {
+            let mut available = resolves.wants().clone();
+            for kind in kinds.values().copied().collect::<BTreeSet<_>>() {
+                available.extend(resolves.needs(kind));
+            }
+            (resolves.declared_inputs(), available)
+        });
+        Self {
+            descriptor,
+            kinds,
+            signals,
+            declared,
+            available,
+            undeclared: RefCell::new(Vec::new()),
+            state_failed: RefCell::new(false),
+        }
+    }
+
+    fn record(&self, access: Access) -> Report<IdentityProviderError> {
+        self.undeclared.borrow_mut().push(access);
+        Report::new(IdentityProviderError::UndeclaredInput { access })
+    }
+
+    fn declared<T>(&self, input: Input, value: Option<T>) -> Result<T, Report<IdentityProviderError>> {
+        if !self.declared.contains(&input) {
+            return Err(self.record(Access::Input(input)));
+        }
+        if !self.available.contains(&input) {
+            return Err(Report::new(IdentityProviderError::InputUnavailable { input }));
+        }
+        value.ok_or_else(|| Report::new(IdentityProviderError::InputUnavailable { input }))
+    }
+
+    /// Undeclared reads recorded so far. The coordinator logs them as
+    /// `Config`, and the harness fails the test.
+    #[must_use]
+    pub(crate) fn recorded_errors(&self) -> Vec<Access> {
+        self.undeclared.borrow().clone()
+    }
+
+    /// Whether a `state()` call failed to decode.
+    #[must_use]
+    pub(crate) fn state_decode_failed(&self) -> bool {
+        *self.state_failed.borrow()
+    }
+
+    /// The sources to resolve this time, each with its own kind.
+    pub fn sources(&self) -> impl Iterator<Item = (&SourceDomain, ResolveKind)> + '_ {
+        self.kinds.iter().map(|(source, kind)| (source, *kind))
+    }
+
+    /// Whether `source` is being resolved for the first time.
+    #[must_use]
+    pub fn is_initial(&self, source: &SourceDomain) -> bool {
+        self.kinds.get(source) == Some(&ResolveKind::Initial)
+    }
+
+    /// Whether `source` is being refreshed.
+    #[must_use]
+    pub fn is_refresh(&self, source: &SourceDomain) -> bool {
+        self.kinds.get(source) == Some(&ResolveKind::Refresh)
+    }
+
+    /// The descriptor's primary source.
+    #[must_use]
+    pub fn primary_source(&self) -> &SourceDomain {
+        self.descriptor.primary_source()
+    }
+
+    /// The stored record for one of this provider's sources.
+    #[must_use]
+    pub fn stored(&self, source: &SourceDomain) -> Option<&StoredId> {
+        self.signals.stored.get(source)
+    }
+
+    /// This provider's private state, decoded. `Ok(None)` when there is none.
+    ///
+    /// # Errors
+    ///
+    /// `InvalidState` when the stored state does not decode as `T`. The
+    /// failure is recorded, and the coordinator clears the state whatever
+    /// the provider returns. `UndeclaredInput` without `with_private_state()`.
+    pub fn state<T: DeserializeOwned>(&self) -> Result<Option<T>, Report<IdentityProviderError>> {
+        if !self.descriptor.resolves().is_some_and(|resolves| resolves.has_private_state()) {
+            return Err(self.record(Access::PrivateState));
+        }
+        let Some(raw) = self.signals.state_json.as_deref() else {
+            return Ok(None);
+        };
+        serde_json::from_str(raw).map(Some).map_err(|_| {
+            *self.state_failed.borrow_mut() = true;
+            Report::new(IdentityProviderError::InvalidState)
+        })
+    }
+
+    /// The endpoint declared with `Resolves::with_endpoint`.
+    ///
+    /// # Errors
+    ///
+    /// `UndeclaredInput { access: Endpoint }` when none was declared.
+    pub fn endpoint(&self) -> Result<&Url, Report<IdentityProviderError>> {
+        self.descriptor.endpoint().ok_or_else(|| self.record(Access::Endpoint))
+    }
+
+    /// The consent strings to forward.
+    #[must_use]
+    pub fn consent(&self) -> &ProviderConsent {
+        &self.signals.consent
+    }
+
+    /// The publisher's domain.
+    #[must_use]
+    pub fn publisher_domain(&self) -> &str {
+        self.signals.publisher_domain
+    }
+
+    /// The request's time.
+    #[must_use]
+    pub fn now(&self) -> UnixTime {
+        self.signals.now
+    }
+
+    /// Random bytes from the platform generator. Fixed by the harness.
+    #[must_use]
+    pub fn random_bytes<const N: usize>(&self) -> [u8; N] {
+        let mut bytes = [0u8; N];
+        self.signals.random.fill(&mut bytes);
+        bytes
+    }
+
+    /// The platform's client address.
+    ///
+    /// # Errors
+    ///
+    /// `UndeclaredInput` when not declared, `InputUnavailable` when missing.
+    pub fn client_ip(&self) -> Result<IpAddr, Report<IdentityProviderError>> {
+        self.declared(Input::ClientIp, self.signals.client_ip)
+    }
+
+    /// The `User-Agent`.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn user_agent(&self) -> Result<&str, Report<IdentityProviderError>> {
+        self.declared(Input::UserAgent, self.signals.user_agent)
+    }
+
+    /// The page URL, without query string or fragment.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn page_url(&self) -> Result<&Url, Report<IdentityProviderError>> {
+        self.declared(Input::PageUrl, self.signals.page_url.as_ref())
+    }
+
+    /// Country and subdivision.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn region(&self) -> Result<&Region, Report<IdentityProviderError>> {
+        self.declared(Input::Region, self.signals.region.as_ref())
+    }
+
+    /// A hashed email. Never available in v1.
+    ///
+    /// # Errors
+    ///
+    /// As [`Self::client_ip`].
+    pub fn hashed_email(&self) -> Result<&HashedEmail, Report<IdentityProviderError>> {
+        self.declared(Input::HashedEmail, self.signals.hashed_email.as_ref())
+    }
+
+    /// The full EC ID. Only for a resolver declared `with_ec_id()`.
+    ///
+    /// # Errors
+    ///
+    /// `UndeclaredInput { access: EcId }` otherwise. `Config` when the
+    /// request has no EC ID, which the coordinator never allows: it does not
+    /// dispatch generic pull without one.
+    pub(in crate::ec::identity) fn ec_id(&self) -> Result<&str, Report<IdentityProviderError>> {
+        if !self.descriptor.resolves().is_some_and(|resolves| resolves.gets_ec_id()) {
+            return Err(self.record(Access::EcId));
+        }
+        self.signals
+            .ec_id
+            .as_deref()
+            .ok_or_else(|| IdentityProviderError::config("generic pull was called without an EC ID"))
+    }
+}
+```
+
+`StoredId::uid` returns the first UID of the first entry, the value `KvPartnerId::first_uid` (Task 6) reads, so `uid()` and `eids()[0].uids[0].id` always agree. The coordinator builds the `stored` map with `StoredId::from_record(source, record)` for each of the provider's sources in the row, skipping a `None`.
+
+`hex` is already a dependency of core (check with `grep -n '^hex' crates/trusted-server-core/Cargo.toml`). If it is only a build dependency, add `hex = { workspace = true }` to `[dependencies]`. `ResolveKind` stays in `descriptor.rs` and is re-exported from `mod.rs`. Update `mod.rs`:
+
+```rust
+pub mod input;
+pub use input::{HashedEmail, ProviderConsent, Region, ResolveInput, StoredId};
+```
+
+In `descriptor.rs`, add the variant to `Access` (Task 5), after `PrivateState`:
+
+```rust
+    /// The full EC ID, without `with_ec_id()`. Only generic pull declares it.
+    #[display("ec_id")]
+    EcId,
+```
+
+Add `ec/identity/input.rs` to `migration_guards.rs`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::input`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add declared-input enforcement for identity providers"
+```
+
+### Task 10: Requests, responses and resolutions
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/exchange.rs`
+- Modify: `crates/trusted-server-core/src/ec/identity/resolution.rs` (add `Resolution`, `ResolvedEid`, `ResolvedUid`, `When`, `StateChange`, and the crate-private entry-set check)
+- Modify: `crates/trusted-server-core/src/ec/identity/input.rs` (add `CaptureInput`, moved here from Task 9 because it holds a `ProviderResponse`)
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: all three files
+
+**Interfaces:**
+
+- Consumes: `KvEid`, `KvUid`, `entry_set_bytes(&[KvEid]) -> usize` and the limits `MAX_UID_LENGTH`, `MAX_PARTNER_EXT_BYTES` (2,048), `MAX_EID_FIELD_BYTES` (255), `MAX_ENTRIES_PER_SOURCE` (8), `MAX_UIDS_PER_SOURCE` (32), `MAX_ENTRY_SET_BYTES` (4,096) and `MAX_PROVIDER_STATE_BYTES` (1,024) from `ec/kv_types.rs` (Task 6). `entry_set_bytes` is the one measure of a set: the coordinator and `KvEntry::validate` both call it, so a set one accepts the other never rejects
+- Produces: everything listed in spec 4.5, plus:
+  - `ProviderRequest::call_context_json(&self) -> Option<&str>` (crate-private)
+  - `ProviderRequest::has_cookie_header(&self) -> bool` (crate-private)
+  - `ProviderResponse::new(status: StatusCode, headers: HeaderMap, body: Vec<u8>, call_context: Option<String>) -> Self` (crate-private)
+  - `ProviderResponse::for_test(status, body: &[u8]) -> Self` (test support)
+  - `pub(crate) fn entry_sets(eids: &[ResolvedEid], now: UnixTime) -> EntrySets`: groups a result's entries by source, in order, applies every limit of spec 4.5 ("From entries to an entry set") and resolves each set's timing to the earliest its entries set
+  - `pub(crate) struct EntrySet { entries: Vec<KvEid>, expires_at, refresh_at, refresh_until: Option<UnixTime> }`, `pub(crate) struct EntrySets { sets: BTreeMap<SourceDomain, EntrySet>, drops: Vec<EntryDrop>, oversized: Vec<SourceDomain> }`, `pub(crate) struct EntryDrop { source, part: DroppedPart }` and `pub(crate) enum DroppedPart`, all with `pub(crate)` fields
+  - `EntrySets::all_discarded(&self) -> bool`: the result named at least one source and every set was discarded. Task 20 handles such a result as `Malformed` (spec 4.5, 8): `f += 1` with its backoff, removals still applied. A source whose set is discarded is treated as not named, so its stored set stays as it is
+  - `CaptureInput<'a>` (in `input.rs`) with the spec 4.4 accessors and `pub(crate) fn new(...)`
+  - `Resolution` and its private `StateOp` have a `Debug` that never prints provider state (spec 9.3)
+  - `MAX_CALL_CONTEXT_BYTES = 1024`
+
+- [ ] **Step 1: Write the failing tests**
+
+In `exchange.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use http::{HeaderName, HeaderValue, Method, StatusCode};
+    use serde_json::json;
+
+    use super::*;
+
+    fn url() -> Url {
+        Url::parse("https://api.example.com/v1/fetch").expect("should parse")
+    }
+
+    #[test]
+    fn post_json_sets_body_and_content_type() {
+        let request = ProviderRequest::post_json(&url(), &json!({ "a": 1 })).expect("should build a JSON request");
+        assert_eq!(request.method(), Method::POST, "should use POST");
+        assert_eq!(request.headers()["content-type"], "application/json", "should set the JSON content type");
+        assert_eq!(request.body(), br#"{"a":1}"#, "should serialize the body");
+    }
+
+    #[test]
+    fn query_bearer_and_headers() {
+        let request = ProviderRequest::get(&url())
+            .with_query("pid", "1 2")
+            .with_bearer(&Redacted::new("token".to_owned()))
+            .try_with_header("x-example", "v")
+            .expect("should accept a valid header");
+        assert_eq!(request.url().as_str(), "https://api.example.com/v1/fetch?pid=1+2", "should encode the query");
+        assert_eq!(request.headers()["authorization"], "Bearer token", "should set the bearer token");
+        assert_eq!(request.headers()["x-example"], "v", "should set the header");
+        ProviderRequest::get(&url()).try_with_header("bad header", "v").expect_err("should reject a bad name");
+        ProviderRequest::get(&url()).try_with_header("x", "bad\nvalue").expect_err("should reject a bad value");
+    }
+
+    #[test]
+    fn cookie_headers_are_flagged_from_either_helper() {
+        let typed = ProviderRequest::get(&url())
+            .with_header(HeaderName::from_static("cookie"), HeaderValue::from_static("a=1"));
+        let dynamic = ProviderRequest::get(&url())
+            .try_with_header("Cookie", "a=1")
+            .expect("should accept a Cookie header from strings");
+        assert!(typed.has_cookie_header(), "should flag a Cookie header from the typed helper");
+        assert!(dynamic.has_cookie_header(), "should flag a Cookie header from the string helper");
+        assert!(!ProviderRequest::get(&url()).has_cookie_header(), "should not flag a request without one");
+    }
+
+    #[test]
+    fn call_context_round_trips_and_is_capped() {
+        let request = ProviderRequest::get(&url())
+            .try_with_call_context(&json!({ "nonce": [1, 2] }))
+            .expect("should accept a small call context");
+        let response = ProviderResponse::new(
+            StatusCode::OK,
+            http::HeaderMap::new(),
+            Vec::new(),
+            request.call_context_json().map(str::to_owned),
+        );
+        let context: serde_json::Value = response
+            .call_context()
+            .expect("should decode the call context")
+            .expect("should carry the call context");
+        assert_eq!(context, json!({ "nonce": [1, 2] }), "should round-trip");
+
+        let error = ProviderRequest::get(&url())
+            .try_with_call_context(&"x".repeat(MAX_CALL_CONTEXT_BYTES))
+            .expect_err("should reject an oversized call context");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::Config { .. }),
+            "should report an oversized call context as Config"
+        );
+    }
+
+    #[test]
+    fn success_helpers_check_status_and_encoding() {
+        let ok = ProviderResponse::for_test(StatusCode::OK, br#"{"uid":"u"}"#);
+        let value: serde_json::Value = ok.success_json().expect("should parse a 2xx JSON body");
+        assert_eq!(value["uid"], "u", "should read the uid");
+
+        let rejected = ProviderResponse::for_test(StatusCode::FORBIDDEN, br#"{}"#);
+        let error = rejected
+            .success_json::<serde_json::Value>()
+            .expect_err("should reject a non-2xx status");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::Rejected { status } if *status == StatusCode::FORBIDDEN),
+            "should report Rejected with the status"
+        );
+        rejected
+            .json::<serde_json::Value>()
+            .expect("should parse JSON whatever the status");
+
+        let binary = ProviderResponse::for_test(StatusCode::OK, &[0xff, 0xfe]);
+        let error = binary.success_text().expect_err("should reject non-UTF-8");
+        assert!(
+            matches!(error.current_context(), IdentityProviderError::Malformed),
+            "should report non-UTF-8 as Malformed"
+        );
+    }
+}
+```
+
+In `resolution.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use serde_json::json;
+
+    use super::*;
+
+    fn source(name: &str) -> SourceDomain {
+        name.parse().expect("should parse the source")
+    }
+
+    fn uid(id: &str) -> ResolvedUid {
+        ResolvedUid::new(id)
+    }
+
+    fn kv_uid(id: &str) -> KvUid {
+        KvUid { id: id.to_owned(), atype: None, ext: None }
+    }
+
+    fn now() -> UnixTime {
+        UnixTime::from_secs(1_000)
+    }
+
+    fn parts(sets: &EntrySets) -> Vec<DroppedPart> {
+        sets.drops.iter().map(|drop| drop.part).collect()
+    }
+
+    #[test]
+    fn empty_found_is_no_match() {
+        let resolution = Resolution::found([]);
+        assert!(resolution.is_no_match(), "should be no_match");
+        assert!(resolution.eids().is_empty(), "should hold no entries");
+    }
+
+    #[test]
+    fn a_one_uid_entry_becomes_a_one_entry_set_without_eid_level_fields() {
+        let a = source("a.example.com");
+        let resolution = Resolution::found([ResolvedEid::new(&a, uid("u").with_atype(3))]);
+
+        let sets = entry_sets(resolution.eids(), now());
+
+        assert_eq!(
+            sets.sets[&a].entries,
+            vec![KvEid {
+                uids: vec![KvUid { id: "u".to_owned(), atype: Some(3), ext: None }],
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            }],
+            "should produce the one-UID shape browser ingest stores"
+        );
+        assert!(sets.drops.is_empty() && sets.oversized.is_empty(), "should drop nothing");
+    }
+
+    #[test]
+    fn entries_group_by_source_and_keep_every_uid_and_field_in_order() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let first = ResolvedEid::new(&a, uid("a1").with_atype(1).with_ext(json!({ "rtiPartner": "TDID" })))
+            .with_uid(uid("a2"))
+            .with_inserter("inserter.example.com")
+            .with_matcher("matcher.example.com")
+            .with_mm(2)
+            .with_ext(json!({ "segments": ["s"] }));
+        let other = ResolvedEid::new(&b, uid("b1"));
+        let second = ResolvedEid::new(&a, uid("a3"));
+
+        let sets = entry_sets(&[first, other, second], now());
+
+        assert_eq!(
+            sets.sets[&a].entries,
+            vec![
+                KvEid {
+                    uids: vec![
+                        KvUid { id: "a1".to_owned(), atype: Some(1), ext: Some(json!({ "rtiPartner": "TDID" })) },
+                        kv_uid("a2"),
+                    ],
+                    inserter: Some("inserter.example.com".to_owned()),
+                    matcher: Some("matcher.example.com".to_owned()),
+                    mm: Some(2),
+                    ext: Some(json!({ "segments": ["s"] })),
+                },
+                KvEid { uids: vec![kv_uid("a3")], inserter: None, matcher: None, mm: None, ext: None },
+            ],
+            "should keep a's entries in the order returned"
+        );
+        assert_eq!(sets.sets[&b].entries.len(), 1, "should group b on its own");
+        assert!(sets.drops.is_empty(), "should drop nothing");
+    }
+
+    #[test]
+    fn bad_fields_are_dropped_and_their_entries_kept() {
+        let a = source("a.example.com");
+        let entry = ResolvedEid::new(&a, uid("u").with_atype(-1).with_ext(json!(["not", "an", "object"])))
+            .with_inserter("  ")
+            .with_matcher(&"m".repeat(MAX_EID_FIELD_BYTES + 1))
+            .with_mm(-2)
+            .with_ext(json!("not an object"));
+
+        let sets = entry_sets(&[entry], now());
+
+        assert_eq!(
+            sets.sets[&a].entries,
+            vec![KvEid { uids: vec![kv_uid("u")], inserter: None, matcher: None, mm: None, ext: None }],
+            "should keep the entry without its bad fields"
+        );
+        assert_eq!(
+            parts(&sets),
+            vec![
+                DroppedPart::Atype,
+                DroppedPart::UidExt,
+                DroppedPart::Inserter,
+                DroppedPart::Matcher,
+                DroppedPart::Mm,
+                DroppedPart::EidExt,
+            ],
+            "should name each dropped field"
+        );
+    }
+
+    #[test]
+    fn bad_uids_are_dropped_and_an_entry_without_uids_is_discarded() {
+        let a = source("a.example.com");
+        let mixed = ResolvedEid::new(&a, uid(" ")).with_uid(uid("kept"));
+        let empty = ResolvedEid::new(&a, uid(&"x".repeat(MAX_UID_LENGTH + 1))).with_inserter("inserter.example.com");
+
+        let sets = entry_sets(&[mixed, empty], now());
+
+        assert_eq!(sets.sets[&a].entries.len(), 1, "should discard the entry left with no UID");
+        assert_eq!(sets.sets[&a].entries[0].uids, vec![kv_uid("kept")], "should keep the valid UID");
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::Uid, DroppedPart::Uid, DroppedPart::EmptyEntry],
+            "should name the dropped UIDs and the discarded entry"
+        );
+    }
+
+    #[test]
+    fn a_source_with_no_kept_entry_is_not_named() {
+        let a = source("a.example.com");
+
+        let sets = entry_sets(&[ResolvedEid::new(&a, uid(""))], now());
+
+        assert!(!sets.sets.contains_key(&a), "should leave the stored set as it is");
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::Uid, DroppedPart::EmptyEntry],
+            "should record the dropped UID and the discarded entry"
+        );
+        assert!(sets.all_discarded(), "should report that every named set was discarded");
+    }
+
+    #[test]
+    fn all_discarded_only_when_nothing_was_kept() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+
+        let mixed = entry_sets(&[ResolvedEid::new(&a, uid("")), ResolvedEid::new(&b, uid("kept"))], now());
+        let empty = entry_sets(&[], now());
+
+        assert!(!mixed.all_discarded(), "should not report a result that kept one set");
+        assert!(!empty.all_discarded(), "should not report a result that named nothing");
+    }
+
+    #[test]
+    fn duplicates_and_entries_and_uids_over_the_limits_are_dropped() {
+        let a = source("a.example.com");
+        let mut eids = vec![
+            ResolvedEid::new(&a, uid("e0")),
+            ResolvedEid::new(&a, uid("e0")),
+        ];
+        // 7 more entries of 4 UIDs: 1 + 28 = 29 UIDs, then a ninth entry.
+        for entry in 1..=7 {
+            let mut eid = ResolvedEid::new(&a, uid(&format!("e{entry}u0")));
+            for index in 1..4 {
+                eid = eid.with_uid(uid(&format!("e{entry}u{index}")));
+            }
+            eids.push(eid);
+        }
+        eids.push(ResolvedEid::new(&a, uid("ninth")));
+
+        let sets = entry_sets(&eids, now());
+
+        let set = &sets.sets[&a];
+        assert_eq!(set.entries.len(), MAX_ENTRIES_PER_SOURCE, "should keep 8 entries");
+        let uid_count: usize = set.entries.iter().map(|entry| entry.uids.len()).sum();
+        assert_eq!(uid_count, 29, "should stay under the UID cap in this control");
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::DuplicateEntry, DroppedPart::ExtraEntry],
+            "should drop the duplicate and the ninth entry"
+        );
+
+        let mut wide = ResolvedEid::new(&a, uid("u0"));
+        for index in 1..=MAX_UIDS_PER_SOURCE {
+            wide = wide.with_uid(uid(&format!("u{index}")));
+        }
+        let sets = entry_sets(&[wide, ResolvedEid::new(&a, uid("later"))], now());
+        assert_eq!(sets.sets[&a].entries.len(), 1, "should discard the entry left with no room");
+        assert_eq!(sets.sets[&a].entries[0].uids.len(), MAX_UIDS_PER_SOURCE, "should keep 32 UIDs");
+        assert_eq!(
+            parts(&sets),
+            vec![DroppedPart::ExtraUid, DroppedPart::ExtraUid, DroppedPart::ExtraEntry],
+            "should drop the 33rd UID and the entry with no room"
+        );
+    }
+
+    #[test]
+    fn an_oversized_set_is_discarded_whole_and_others_are_kept() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+
+        let sets = entry_sets(&[oversized_entry(&a), ResolvedEid::new(&b, uid("small"))], now());
+
+        assert!(!sets.sets.contains_key(&a), "should never trim an oversized set");
+        assert_eq!(sets.oversized, vec![a.clone()], "should report the oversized source");
+        assert!(sets.sets.contains_key(&b), "should keep the other source");
+        assert!(!sets.all_discarded(), "should not report the result as all discarded");
+
+        let only = entry_sets(&[oversized_entry(&a)], now());
+        assert!(only.all_discarded(), "should report a result whose only set is oversized");
+    }
+
+    fn oversized_entry(source: &SourceDomain) -> ResolvedEid {
+        let mut big = ResolvedEid::new(source, uid(&"x".repeat(500)));
+        for index in 0..8 {
+            big = big.with_uid(uid(&format!("{index}{}", "x".repeat(499))));
+        }
+        big
+    }
+
+    #[test]
+    fn a_set_takes_the_earliest_times_its_entries_set() {
+        let a = source("a.example.com");
+        let first = ResolvedEid::new(&a, uid("one"))
+            .with_expires_in(Duration::from_secs(100))
+            .with_refresh_at(UnixTime::from_secs(1_080))
+            .with_refresh_until(UnixTime::from_secs(5_000));
+        let second = ResolvedEid::new(&a, uid("two"))
+            .with_expires_at(UnixTime::from_secs(1_050))
+            .with_refresh_in(Duration::from_secs(90))
+            .with_refresh_until(UnixTime::from_secs(4_000));
+        let third = ResolvedEid::new(&a, uid("three"));
+
+        let set = entry_sets(&[first, second, third], now()).sets.remove(&a).expect("should keep a");
+
+        assert_eq!(set.expires_at, Some(UnixTime::from_secs(1_050)), "should take the earliest expiry");
+        assert_eq!(set.refresh_at, Some(UnixTime::from_secs(1_080)), "should take the earliest refresh");
+        assert_eq!(set.refresh_until, Some(UnixTime::from_secs(4_000)), "should take the earliest refresh limit");
+    }
+
+    #[test]
+    fn dropped_entries_do_not_count_toward_timing() {
+        let a = source("a.example.com");
+        let kept = ResolvedEid::new(&a, uid("one")).with_expires_at(UnixTime::from_secs(2_000));
+        let duplicate = ResolvedEid::new(&a, uid("one")).with_expires_at(UnixTime::from_secs(1_100));
+        let empty = ResolvedEid::new(&a, uid("")).with_refresh_at(UnixTime::from_secs(1_010));
+
+        let set = entry_sets(&[kept, duplicate, empty], now()).sets.remove(&a).expect("should keep a");
+
+        assert_eq!(
+            set.expires_at,
+            Some(UnixTime::from_secs(2_000)),
+            "should ignore the expiry of a dropped duplicate"
+        );
+        assert_eq!(set.refresh_at, None, "should ignore the refresh time of a discarded entry");
+    }
+
+    #[test]
+    fn invalidations_chain_and_state_changes_are_reported() {
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let resolution = Resolution::found([ResolvedEid::new(&a, uid("u"))])
+            .also_invalidate(&b)
+            .with_retry_in(Duration::from_secs(60))
+            .replacing_state(&json!({ "signature": "s" }));
+        assert_eq!(resolution.invalidated(), &[b], "should invalidate b");
+        assert_eq!(resolution.retry_in(), Some(Duration::from_secs(60)), "should keep the retry delay");
+        assert_eq!(
+            resolution.state_change(),
+            StateChange::Replace(r#"{"signature":"s"}"#),
+            "should replace the state"
+        );
+        assert_eq!(
+            Resolution::no_match().clearing_state().state_change(),
+            StateChange::Clear,
+            "should clear the state"
+        );
+        assert_eq!(Resolution::no_match().state_change(), StateChange::Keep, "should keep the state by default");
+    }
+
+    #[test]
+    fn resolution_debug_redacts_state() {
+        let resolution = Resolution::no_match().replacing_state(&json!({ "signature": "secret-state" }));
+
+        let debug = format!("{resolution:?}");
+
+        assert!(!debug.contains("secret-state"), "should not print provider state");
+        assert!(debug.contains("Replace([redacted])"), "should show that state is replaced");
+    }
+
+    #[test]
+    fn oversized_state_is_marked_invalid_not_dropped_silently() {
+        let resolution = Resolution::found([ResolvedEid::new(&source("a.example.com"), uid("u"))])
+            .replacing_state(&"x".repeat(2000));
+        assert!(resolution.state_rejected(), "should flag the state as rejected");
+    }
+
+    #[test]
+    fn oversized_ext_is_dropped_and_the_uid_and_entry_kept() {
+        let pad = json!({ "pad": "x".repeat(MAX_PARTNER_EXT_BYTES) });
+        let resolved = uid("u").with_ext(pad.clone());
+        assert_eq!(resolved.id(), "u", "should keep the UID");
+        assert!(resolved.ext().is_none(), "should drop the UID-level ext");
+        let small = uid("u").with_ext(json!({ "linkType": 2 }));
+        assert_eq!(small.ext(), Some(&json!({ "linkType": 2 })), "should keep a small ext");
+
+        let eid = ResolvedEid::new(&source("a.example.com"), uid("u")).with_ext(pad);
+        assert_eq!(eid.uids().len(), 1, "should keep the entry");
+        assert!(eid.ext().is_none(), "should drop the EID-level ext");
+    }
+
+    #[test]
+    fn debug_redacts_every_uid() {
+        let eid = ResolvedEid::new(&source("a.example.com"), uid("secret-one")).with_uid(uid("secret-two"));
+        let debug = format!("{eid:?} {:?}", eid.uids()[0]);
+        assert!(!debug.contains("secret"), "should not print a UID");
+        assert!(debug.contains("a.example.com"), "should print the source");
+    }
+
+    #[test]
+    fn opted_out_is_reported() {
+        assert!(Resolution::opted_out().is_opted_out(), "should report the opt-out");
+        assert!(!Resolution::no_match().is_opted_out(), "should not report an opt-out for no_match");
+    }
+}
+```
+
+In `input.rs`, add `Captures` to the test module's `descriptor` import and `use crate::ec::identity::exchange::ProviderResponse;` beside it, then add the test that moved from Task 9:
+
+```rust
+    #[test]
+    fn capture_input_exposes_path_and_never_the_request_body() {
+        let descriptor = ProviderDescriptor::builder("c".parse().expect("should parse the provider id"))
+            .with_source("example.com".parse().expect("should parse the source"))
+            .with_captures(Captures::new().with_path(http::Method::POST, "/integrations/c/api"))
+            .build()
+            .expect("should build");
+        let response = ProviderResponse::for_test(http::StatusCode::OK, b"{}");
+        let consent = ProviderConsent::default();
+        let input = CaptureInput::new(
+            &descriptor,
+            "/integrations/c/api",
+            &response,
+            &BTreeMap::new(),
+            &consent,
+            "www.example.com",
+            UnixTime::from_secs(1),
+        );
+        assert_eq!(input.path(), "/integrations/c/api", "should expose the proxied path");
+        assert_eq!(input.primary_source().as_str(), "example.com", "should expose the primary source");
+    }
+```
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::exchange`, `cargo test-fastly -- ec::identity::resolution` and `cargo test-fastly -- ec::identity::input`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement `exchange.rs`**
+
+```rust
+//! What a provider sends and receives. The coordinator does all I/O.
+
+use core::fmt;
+
+use error_stack::Report;
+use http::header::{AUTHORIZATION, CONTENT_TYPE, COOKIE};
+use http::{HeaderMap, HeaderName, HeaderValue, Method, StatusCode};
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use url::Url;
+
+use super::resolution::IdentityProviderError;
+use crate::redacted::Redacted;
+
+/// Maximum JSON bytes of a call context.
+pub const MAX_CALL_CONTEXT_BYTES: usize = 1024;
+
+/// One call a provider wants made.
+#[derive(Clone)]
+pub struct ProviderRequest {
+    method: Method,
+    url: Url,
+    headers: HeaderMap,
+    body: Vec<u8>,
+    call_context: Option<String>,
+}
+
+impl fmt::Debug for ProviderRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderRequest")
+            .field("method", &self.method)
+            .field("host", &self.url.host_str())
+            .field("path", &self.url.path())
+            .field("headers", &self.headers.keys().collect::<Vec<_>>())
+            .field("body_len", &self.body.len())
+            .finish_non_exhaustive()
+    }
+}
+
+impl ProviderRequest {
+    /// Any method, with no body.
+    #[must_use]
+    pub fn new(method: Method, url: &Url) -> Self {
+        Self { method, url: url.clone(), headers: HeaderMap::new(), body: Vec::new(), call_context: None }
+    }
+
+    /// A `GET`.
+    #[must_use]
+    pub fn get(url: &Url) -> Self {
+        Self::new(Method::GET, url)
+    }
+
+    /// A `POST` with a JSON body.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when `body` does not serialize.
+    pub fn post_json(url: &Url, body: &impl Serialize) -> Result<Self, Report<IdentityProviderError>> {
+        let bytes = serde_json::to_vec(body)
+            .map_err(|_| IdentityProviderError::config("request body does not serialize"))?;
+        Self::new(Method::POST, url).with_body("application/json", bytes)
+    }
+
+    /// A `POST` with a `text/plain` body.
+    #[must_use]
+    pub fn post_text(url: &Url, body: &str) -> Self {
+        let mut request = Self::new(Method::POST, url);
+        request.headers.insert(CONTENT_TYPE, HeaderValue::from_static("text/plain"));
+        request.body = body.as_bytes().to_vec();
+        request
+    }
+
+    /// Sets the body and its `Content-Type`.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when `content_type` is not a valid header value.
+    pub fn with_body(mut self, content_type: &str, body: Vec<u8>) -> Result<Self, Report<IdentityProviderError>> {
+        let value = HeaderValue::from_str(content_type)
+            .map_err(|_| IdentityProviderError::config("invalid content type"))?;
+        self.headers.insert(CONTENT_TYPE, value);
+        self.body = body;
+        Ok(self)
+    }
+
+    /// Appends a query parameter, URL-encoded.
+    #[must_use]
+    pub fn with_query(mut self, name: &str, value: &str) -> Self {
+        self.url.query_pairs_mut().append_pair(name, value);
+        self
+    }
+
+    /// Sets a header. A `Cookie` header makes the coordinator refuse the call.
+    #[must_use]
+    pub fn with_header(mut self, name: HeaderName, value: HeaderValue) -> Self {
+        self.headers.insert(name, value);
+        self
+    }
+
+    /// Sets a header from strings.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when the name or value is invalid.
+    pub fn try_with_header(self, name: &str, value: &str) -> Result<Self, Report<IdentityProviderError>> {
+        let name = HeaderName::from_bytes(name.as_bytes())
+            .map_err(|_| IdentityProviderError::config("invalid header name"))?;
+        let value = HeaderValue::from_str(value)
+            .map_err(|_| IdentityProviderError::config("invalid header value"))?;
+        Ok(self.with_header(name, value))
+    }
+
+    /// Adds `Authorization: Bearer <token>`.
+    #[must_use]
+    pub fn with_bearer(mut self, token: &Redacted<String>) -> Self {
+        if let Ok(mut value) = HeaderValue::from_str(&format!("Bearer {}", token.expose())) {
+            value.set_sensitive(true);
+            self.headers.insert(AUTHORIZATION, value);
+        }
+        self
+    }
+
+    /// Data `response` needs from this call. Kept in memory, never sent.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when it does not serialize or is over 1,024 bytes of JSON.
+    pub fn try_with_call_context(mut self, context: &impl Serialize) -> Result<Self, Report<IdentityProviderError>> {
+        let json = serde_json::to_string(context)
+            .map_err(|_| IdentityProviderError::config("call context does not serialize"))?;
+        if json.len() > MAX_CALL_CONTEXT_BYTES {
+            return Err(IdentityProviderError::config("call context exceeds 1024 bytes"));
+        }
+        self.call_context = Some(json);
+        Ok(self)
+    }
+
+    /// The method.
+    #[must_use]
+    pub fn method(&self) -> &Method {
+        &self.method
+    }
+
+    /// The URL.
+    #[must_use]
+    pub fn url(&self) -> &Url {
+        &self.url
+    }
+
+    /// The headers.
+    #[must_use]
+    pub fn headers(&self) -> &HeaderMap {
+        &self.headers
+    }
+
+    /// The body.
+    #[must_use]
+    pub fn body(&self) -> &[u8] {
+        &self.body
+    }
+
+    /// The call context JSON.
+    #[must_use]
+    pub(crate) fn call_context_json(&self) -> Option<&str> {
+        self.call_context.as_deref()
+    }
+
+    /// Whether the provider set a `Cookie` header.
+    #[must_use]
+    pub(crate) fn has_cookie_header(&self) -> bool {
+        self.headers.contains_key(COOKIE)
+    }
+}
+
+/// A buffered, decoded provider response.
+#[derive(Clone)]
+pub struct ProviderResponse {
+    status: StatusCode,
+    headers: HeaderMap,
+    body: Vec<u8>,
+    call_context: Option<String>,
+}
+
+impl fmt::Debug for ProviderResponse {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderResponse")
+            .field("status", &self.status)
+            .field("body_len", &self.body.len())
+            .finish_non_exhaustive()
+    }
+}
+
+impl ProviderResponse {
+    /// Built by the coordinator after buffering and decoding.
+    #[must_use]
+    pub(crate) fn new(status: StatusCode, headers: HeaderMap, body: Vec<u8>, call_context: Option<String>) -> Self {
+        Self { status, headers, body, call_context }
+    }
+
+    /// A response for tests.
+    #[cfg(any(test, feature = "test-utils"))]
+    #[must_use]
+    pub fn for_test(status: StatusCode, body: &[u8]) -> Self {
+        Self::new(status, HeaderMap::new(), body.to_vec(), None)
+    }
+
+    /// The status.
+    #[must_use]
+    pub fn status(&self) -> StatusCode {
+        self.status
+    }
+
+    /// A header as a string, if present and visible ASCII.
+    #[must_use]
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).and_then(|value| value.to_str().ok())
+    }
+
+    /// The decoded body.
+    #[must_use]
+    pub fn body(&self) -> &[u8] {
+        &self.body
+    }
+
+    /// Parses the body as JSON, whatever the status.
+    ///
+    /// # Errors
+    ///
+    /// `Malformed` when it does not parse.
+    pub fn json<T: DeserializeOwned>(&self) -> Result<T, Report<IdentityProviderError>> {
+        serde_json::from_slice(&self.body).map_err(|_| IdentityProviderError::malformed())
+    }
+
+    /// Requires 2xx, then parses JSON.
+    ///
+    /// # Errors
+    ///
+    /// `Rejected` for a non-2xx status, `Malformed` for a bad body.
+    pub fn success_json<T: DeserializeOwned>(&self) -> Result<T, Report<IdentityProviderError>> {
+        self.require_success()?;
+        self.json()
+    }
+
+    /// Requires 2xx and a UTF-8 body.
+    ///
+    /// # Errors
+    ///
+    /// `Rejected` for a non-2xx status, `Malformed` for non-UTF-8.
+    pub fn success_text(&self) -> Result<&str, Report<IdentityProviderError>> {
+        self.require_success()?;
+        core::str::from_utf8(&self.body).map_err(|_| IdentityProviderError::malformed())
+    }
+
+    /// The context the request carried, decoded.
+    ///
+    /// # Errors
+    ///
+    /// `Config` when it does not decode as `T`.
+    pub fn call_context<T: DeserializeOwned>(&self) -> Result<Option<T>, Report<IdentityProviderError>> {
+        self.call_context
+            .as_deref()
+            .map(|json| {
+                serde_json::from_str(json)
+                    .map_err(|_| IdentityProviderError::config("call context does not decode"))
+            })
+            .transpose()
+    }
+
+    fn require_success(&self) -> Result<(), Report<IdentityProviderError>> {
+        if self.status.is_success() {
+            Ok(())
+        } else {
+            Err(IdentityProviderError::rejected(self.status))
+        }
+    }
+}
+```
+
+`Redacted` is `crate::redacted::Redacted` (`redacted.rs:28`).
+
+- [ ] **Step 4: Implement the rest of `resolution.rs` and `CaptureInput`**
+
+Merge these imports into the top import block of `resolution.rs` from Task 5, so the file keeps one block (`AGENTS.md` allows no imports after items):
+
+```rust
+use std::collections::BTreeMap;
+use std::iter;
+use std::time::Duration;
+
+use serde::Serialize;
+
+use super::ids::{SourceDomain, UnixTime};
+use crate::ec::kv_types::{
+    KvEid, KvUid, MAX_EID_FIELD_BYTES, MAX_ENTRIES_PER_SOURCE, MAX_ENTRY_SET_BYTES,
+    MAX_PARTNER_EXT_BYTES, MAX_PROVIDER_STATE_BYTES, MAX_UID_LENGTH, MAX_UIDS_PER_SOURCE,
+    entry_set_bytes,
+};
+```
+
+Then append the items:
+
+```rust
+/// A time as a provider gave it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum When {
+    /// Relative to the request's `now`.
+    In(Duration),
+    /// Absolute.
+    At(UnixTime),
+}
+
+impl When {
+    /// Resolves against `now`.
+    #[must_use]
+    pub(crate) fn resolve(self, now: UnixTime) -> UnixTime {
+        match self {
+            Self::In(delay) => now + delay,
+            Self::At(at) => at,
+        }
+    }
+}
+
+fn ext_fits(ext: &serde_json::Value) -> bool {
+    serde_json::to_vec(ext).is_ok_and(|bytes| bytes.len() <= MAX_PARTNER_EXT_BYTES)
+}
+
+/// One UID within a [`ResolvedEid`].
+#[derive(Clone, PartialEq)]
+pub struct ResolvedUid {
+    id: String,
+    atype: Option<i32>,
+    ext: Option<serde_json::Value>,
+}
+
+impl core::fmt::Debug for ResolvedUid {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("ResolvedUid")
+            .field("id", &"[redacted]")
+            .field("atype", &self.atype)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ResolvedUid {
+    /// A UID with no `atype` or ext.
+    #[must_use]
+    pub fn new(id: impl Into<String>) -> Self {
+        Self { id: id.into(), atype: None, ext: None }
+    }
+
+    /// Sets `atype`.
+    #[must_use]
+    pub fn with_atype(mut self, atype: i32) -> Self {
+        self.atype = Some(atype);
+        self
+    }
+
+    /// UID-level ext. Over 2,048 bytes as compact JSON it is dropped and the
+    /// UID kept.
+    #[must_use]
+    pub fn with_ext(mut self, ext: serde_json::Value) -> Self {
+        let fits = ext_fits(&ext);
+        if !fits {
+            log::debug!("Dropping an oversized UID-level ext");
+        }
+        self.ext = fits.then_some(ext);
+        self
+    }
+
+    /// The UID.
+    #[must_use]
+    pub fn id(&self) -> &str {
+        &self.id
+    }
+
+    /// `atype`.
+    #[must_use]
+    pub fn atype(&self) -> Option<i32> {
+        self.atype
+    }
+
+    /// UID-level ext.
+    #[must_use]
+    pub fn ext(&self) -> Option<&serde_json::Value> {
+        self.ext.as_ref()
+    }
+}
+
+/// One `OpenRTB` EID entry a provider returns: a source, its UIDs and its
+/// EID-level fields.
+#[derive(Clone, PartialEq)]
+pub struct ResolvedEid {
+    source: SourceDomain,
+    uids: Vec<ResolvedUid>,
+    inserter: Option<String>,
+    matcher: Option<String>,
+    mm: Option<i32>,
+    ext: Option<serde_json::Value>,
+    expiry: Option<When>,
+    refresh: Option<When>,
+    refresh_until: Option<UnixTime>,
+}
+
+impl core::fmt::Debug for ResolvedEid {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("ResolvedEid")
+            .field("source", &self.source)
+            .field("uids", &self.uids)
+            .field("mm", &self.mm)
+            .field("expiry", &self.expiry)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ResolvedEid {
+    /// An entry with one UID, the common case.
+    #[must_use]
+    pub fn new(source: &SourceDomain, uid: ResolvedUid) -> Self {
+        Self {
+            source: source.clone(),
+            uids: vec![uid],
+            inserter: None,
+            matcher: None,
+            mm: None,
+            ext: None,
+            expiry: None,
+            refresh: None,
+            refresh_until: None,
+        }
+    }
+
+    /// Adds another UID to this entry. Repeatable.
+    #[must_use]
+    pub fn with_uid(mut self, uid: ResolvedUid) -> Self {
+        self.uids.push(uid);
+        self
+    }
+
+    /// Sets `inserter`. An entry that sets any of `inserter`, `matcher` and
+    /// `mm` states its EID-level fields completely, so the descriptor's
+    /// `with_provenance` default no longer applies to it (spec 4.3).
+    #[must_use]
+    pub fn with_inserter(mut self, inserter: &str) -> Self {
+        self.inserter = Some(inserter.to_owned());
+        self
+    }
+
+    /// Sets `matcher`. As [`Self::with_inserter`], it turns off the
+    /// descriptor's default for this entry.
+    #[must_use]
+    pub fn with_matcher(mut self, matcher: &str) -> Self {
+        self.matcher = Some(matcher.to_owned());
+        self
+    }
+
+    /// Sets `mm`. As [`Self::with_inserter`], it turns off the descriptor's
+    /// default for this entry.
+    #[must_use]
+    pub fn with_mm(mut self, mm: i32) -> Self {
+        self.mm = Some(mm);
+        self
+    }
+
+    /// EID-level ext. Over 2,048 bytes as compact JSON it is dropped and the
+    /// entry kept.
+    #[must_use]
+    pub fn with_ext(mut self, ext: serde_json::Value) -> Self {
+        let fits = ext_fits(&ext);
+        if !fits {
+            log::debug!("Dropping an oversized EID-level ext for source {}", self.source);
+        }
+        self.ext = fits.then_some(ext);
+        self
+    }
+
+    /// Expires after `delay`. Timing applies to the source's whole entry
+    /// set, and the earliest time across its entries wins.
+    #[must_use]
+    pub fn with_expires_in(mut self, delay: Duration) -> Self {
+        self.expiry = Some(When::In(delay));
+        self
+    }
+
+    /// Expires at `at`.
+    #[must_use]
+    pub fn with_expires_at(mut self, at: UnixTime) -> Self {
+        self.expiry = Some(When::At(at));
+        self
+    }
+
+    /// Due for refresh after `delay`.
+    #[must_use]
+    pub fn with_refresh_in(mut self, delay: Duration) -> Self {
+        self.refresh = Some(When::In(delay));
+        self
+    }
+
+    /// Due for refresh at `at`.
+    #[must_use]
+    pub fn with_refresh_at(mut self, at: UnixTime) -> Self {
+        self.refresh = Some(When::At(at));
+        self
+    }
+
+    /// When this ID stops being refreshable. Only for a provider declared
+    /// `with_private_state()`; the coordinator ignores it otherwise.
+    #[must_use]
+    pub fn with_refresh_until(mut self, at: UnixTime) -> Self {
+        self.refresh_until = Some(at);
+        self
+    }
+
+    /// The source.
+    #[must_use]
+    pub fn source(&self) -> &SourceDomain {
+        &self.source
+    }
+
+    /// The UIDs, in order.
+    #[must_use]
+    pub fn uids(&self) -> &[ResolvedUid] {
+        &self.uids
+    }
+
+    /// `inserter`, if set.
+    #[must_use]
+    pub fn inserter(&self) -> Option<&str> {
+        self.inserter.as_deref()
+    }
+
+    /// `matcher`, if set.
+    #[must_use]
+    pub fn matcher(&self) -> Option<&str> {
+        self.matcher.as_deref()
+    }
+
+    /// `mm`, if set.
+    #[must_use]
+    pub fn mm(&self) -> Option<i32> {
+        self.mm
+    }
+
+    /// EID-level ext.
+    #[must_use]
+    pub fn ext(&self) -> Option<&serde_json::Value> {
+        self.ext.as_ref()
+    }
+
+    /// The expiry as given.
+    #[must_use]
+    pub fn expiry(&self) -> Option<When> {
+        self.expiry
+    }
+
+    /// The refresh hint as given.
+    #[must_use]
+    pub fn refresh(&self) -> Option<When> {
+        self.refresh
+    }
+
+    /// The refresh limit.
+    #[must_use]
+    pub fn refresh_until(&self) -> Option<UnixTime> {
+        self.refresh_until
+    }
+}
+
+/// How a result changes the provider's private state.
+#[derive(Debug, PartialEq, Eq)]
+pub enum StateChange<'a> {
+    /// Leave it.
+    Keep,
+    /// Replace it with this JSON.
+    Replace(&'a str),
+    /// Remove it.
+    Clear,
+}
+
+#[derive(Clone, PartialEq)]
+enum StateOp {
+    Keep,
+    Replace(String),
+    Clear,
+    Rejected,
+}
+
+impl core::fmt::Debug for StateOp {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::Keep => formatter.write_str("Keep"),
+            Self::Replace(_) => formatter.write_str("Replace([redacted])"),
+            Self::Clear => formatter.write_str("Clear"),
+            Self::Rejected => formatter.write_str("Rejected"),
+        }
+    }
+}
+
+/// What one provider call produced. Its `Debug` prints entries through
+/// [`ResolvedEid`]'s redacting `Debug` and never prints provider state.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Resolution {
+    eids: Vec<ResolvedEid>,
+    invalidated: Vec<SourceDomain>,
+    opted_out: bool,
+    retry_in: Option<Duration>,
+    state: StateOp,
+}
+
+impl Resolution {
+    fn empty() -> Self {
+        Self { eids: Vec::new(), invalidated: Vec::new(), opted_out: false, retry_in: None, state: StateOp::Keep }
+    }
+
+    /// One or more EID entries. A source may appear in several entries, in
+    /// the order bidders should see them. The entries of one source form its
+    /// new entry set, which replaces the stored set whole for an owned
+    /// source. For an unowned source the set only fills an absent or expired
+    /// record (spec 7.2). A source the result does not name, or whose set
+    /// the limits discard, is left as it is. An empty set is `no_match`.
+    #[must_use]
+    pub fn found(eids: impl IntoIterator<Item = ResolvedEid>) -> Self {
+        Self { eids: eids.into_iter().collect(), ..Self::empty() }
+    }
+
+    /// Nothing recognized, or a capture held nothing.
+    #[must_use]
+    pub fn no_match() -> Self {
+        Self::empty()
+    }
+
+    /// The stored ID for `source` is no longer valid.
+    #[must_use]
+    pub fn invalidate(source: &SourceDomain) -> Self {
+        Self { invalidated: vec![source.clone()], ..Self::empty() }
+    }
+
+    /// The provider reports the user opted out.
+    #[must_use]
+    pub fn opted_out() -> Self {
+        Self { opted_out: true, ..Self::empty() }
+    }
+
+    /// Also invalidates `source`.
+    #[must_use]
+    pub fn also_invalidate(mut self, source: &SourceDomain) -> Self {
+        if !self.invalidated.contains(source) {
+            self.invalidated.push(source.clone());
+        }
+        self
+    }
+
+    /// The earliest the coordinator may call again.
+    #[must_use]
+    pub fn with_retry_in(mut self, delay: Duration) -> Self {
+        self.retry_in = Some(delay);
+        self
+    }
+
+    /// Replaces the provider's private state. Over 1,024 bytes of JSON, or
+    /// not serializable, the positive part of the result is rejected whole.
+    #[must_use]
+    pub fn replacing_state(mut self, state: &impl Serialize) -> Self {
+        self.state = match serde_json::to_string(state) {
+            Ok(json) if json.len() <= MAX_PROVIDER_STATE_BYTES => StateOp::Replace(json),
+            _ => StateOp::Rejected,
+        };
+        self
+    }
+
+    /// Clears the provider's private state.
+    #[must_use]
+    pub fn clearing_state(mut self) -> Self {
+        self.state = StateOp::Clear;
+        self
+    }
+
+    /// The returned entries, as given.
+    #[must_use]
+    pub fn eids(&self) -> &[ResolvedEid] {
+        &self.eids
+    }
+
+    /// Invalidated sources.
+    #[must_use]
+    pub fn invalidated(&self) -> &[SourceDomain] {
+        &self.invalidated
+    }
+
+    /// Whether nothing was found, invalidated or opted out.
+    #[must_use]
+    pub fn is_no_match(&self) -> bool {
+        self.eids.is_empty() && self.invalidated.is_empty() && !self.opted_out
+    }
+
+    /// Whether the provider reported an opt-out.
+    #[must_use]
+    pub fn is_opted_out(&self) -> bool {
+        self.opted_out
+    }
+
+    /// The retry delay.
+    #[must_use]
+    pub fn retry_in(&self) -> Option<Duration> {
+        self.retry_in
+    }
+
+    /// The state change.
+    #[must_use]
+    pub fn state_change(&self) -> StateChange<'_> {
+        match &self.state {
+            StateOp::Keep | StateOp::Rejected => StateChange::Keep,
+            StateOp::Replace(json) => StateChange::Replace(json),
+            StateOp::Clear => StateChange::Clear,
+        }
+    }
+
+    /// Whether `replacing_state` was given an oversized or unserializable
+    /// value. The coordinator then rejects the positive part (spec 4.5, 8).
+    #[must_use]
+    pub(crate) fn state_rejected(&self) -> bool {
+        self.state == StateOp::Rejected
+    }
+
+    /// Whether this result changes state at all.
+    #[must_use]
+    pub(crate) fn changes_state(&self) -> bool {
+        self.state != StateOp::Keep
+    }
+}
+
+/// The part of a result that a spec 4.5 limit dropped.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, derive_more::Display)]
+pub(crate) enum DroppedPart {
+    /// A UID that is empty, blank or over `MAX_UID_LENGTH`.
+    #[display("uid")]
+    Uid,
+    /// A negative `atype`.
+    #[display("atype")]
+    Atype,
+    /// A UID-level ext that is not an object or is oversized.
+    #[display("uid ext")]
+    UidExt,
+    /// A blank or oversized `inserter`.
+    #[display("inserter")]
+    Inserter,
+    /// A blank or oversized `matcher`.
+    #[display("matcher")]
+    Matcher,
+    /// A negative `mm`.
+    #[display("mm")]
+    Mm,
+    /// An EID-level ext that is not an object or is oversized.
+    #[display("eid ext")]
+    EidExt,
+    /// An entry left with no UID.
+    #[display("entry without uid")]
+    EmptyEntry,
+    /// An entry equal to an earlier kept entry of its source.
+    #[display("duplicate entry")]
+    DuplicateEntry,
+    /// An entry past the source's first 8, or with no room left for a UID.
+    #[display("entry over the limit")]
+    ExtraEntry,
+    /// A UID past the source's first 32.
+    #[display("uid over the limit")]
+    ExtraUid,
+}
+
+/// One dropped part, for the coordinator's log line (provider, source and
+/// part only, never a value).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct EntryDrop {
+    pub(crate) source: SourceDomain,
+    pub(crate) part: DroppedPart,
+}
+
+/// One source's new entry set, as it is stored, and its timing resolved
+/// against `now`.
+#[derive(Clone, PartialEq)]
+pub(crate) struct EntrySet {
+    pub(crate) entries: Vec<KvEid>,
+    pub(crate) expires_at: Option<UnixTime>,
+    pub(crate) refresh_at: Option<UnixTime>,
+    pub(crate) refresh_until: Option<UnixTime>,
+}
+
+impl core::fmt::Debug for EntrySet {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter
+            .debug_struct("EntrySet")
+            .field("entries", &self.entries.len())
+            .field("expires_at", &self.expires_at)
+            .field("refresh_at", &self.refresh_at)
+            .field("refresh_until", &self.refresh_until)
+            .finish()
+    }
+}
+
+/// A result's entries, grouped by source and checked against spec 4.5.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub(crate) struct EntrySets {
+    /// Each source with at least one kept entry, under every limit.
+    pub(crate) sets: BTreeMap<SourceDomain, EntrySet>,
+    /// What the limits dropped, in order.
+    pub(crate) drops: Vec<EntryDrop>,
+    /// Sources whose set was over `MAX_ENTRY_SET_BYTES` and was discarded
+    /// whole. A stateful provider's positive part is then rejected.
+    pub(crate) oversized: Vec<SourceDomain>,
+}
+
+impl EntrySets {
+    /// Whether the result named at least one source and every set was
+    /// discarded. Every entry that is not kept records a drop, so a result
+    /// with entries and no kept set always has a drop or an oversized set.
+    /// The coordinator handles such a result as `Malformed` (spec 4.5).
+    #[must_use]
+    pub(crate) fn all_discarded(&self) -> bool {
+        self.sets.is_empty() && (!self.drops.is_empty() || !self.oversized.is_empty())
+    }
+}
+
+fn earliest(current: Option<UnixTime>, candidate: Option<UnixTime>) -> Option<UnixTime> {
+    match (current, candidate) {
+        (Some(current), Some(candidate)) => Some(current.min(candidate)),
+        (current, candidate) => current.or(candidate),
+    }
+}
+
+fn clean_text(value: Option<&str>, part: DroppedPart, dropped: &mut Vec<DroppedPart>) -> Option<String> {
+    let value = value?;
+    if value.trim().is_empty() || value.len() > MAX_EID_FIELD_BYTES {
+        dropped.push(part);
+        return None;
+    }
+    Some(value.to_owned())
+}
+
+fn clean_number(value: Option<i32>, part: DroppedPart, dropped: &mut Vec<DroppedPart>) -> Option<i32> {
+    let value = value?;
+    if value < 0 {
+        dropped.push(part);
+        return None;
+    }
+    Some(value)
+}
+
+fn clean_ext(
+    value: Option<&serde_json::Value>,
+    part: DroppedPart,
+    dropped: &mut Vec<DroppedPart>,
+) -> Option<serde_json::Value> {
+    let value = value?;
+    if !value.is_object() || !ext_fits(value) {
+        dropped.push(part);
+        return None;
+    }
+    Some(value.clone())
+}
+
+fn clean_uid(uid: &ResolvedUid, dropped: &mut Vec<DroppedPart>) -> Option<KvUid> {
+    if uid.id.trim().is_empty() || uid.id.len() > MAX_UID_LENGTH {
+        dropped.push(DroppedPart::Uid);
+        return None;
+    }
+    Some(KvUid {
+        id: uid.id.clone(),
+        atype: clean_number(uid.atype, DroppedPart::Atype, dropped),
+        ext: clean_ext(uid.ext.as_ref(), DroppedPart::UidExt, dropped),
+    })
+}
+
+fn clean_entry(eid: &ResolvedEid, dropped: &mut Vec<DroppedPart>) -> Option<KvEid> {
+    let uids: Vec<KvUid> = eid.uids.iter().filter_map(|uid| clean_uid(uid, dropped)).collect();
+    if uids.is_empty() {
+        return None;
+    }
+    Some(KvEid {
+        uids,
+        inserter: clean_text(eid.inserter.as_deref(), DroppedPart::Inserter, dropped),
+        matcher: clean_text(eid.matcher.as_deref(), DroppedPart::Matcher, dropped),
+        mm: clean_number(eid.mm, DroppedPart::Mm, dropped),
+        ext: clean_ext(eid.ext.as_ref(), DroppedPart::EidExt, dropped),
+    })
+}
+
+/// Groups `eids` by source, in order, and applies every limit of spec 4.5:
+/// the browser parser's field and UID rules, then per-source caps the
+/// browser parser does not have: duplicates, the first 8 entries and 32 UIDs
+/// of a source, and `MAX_ENTRY_SET_BYTES` as [`entry_set_bytes`] measures
+/// the stored set. A set over that is discarded whole, never trimmed: field
+/// caps do not guarantee the set cap. Each set's `exp`, `ra` and `ru` are
+/// the earliest its kept entries set; a dropped or discarded entry's times
+/// do not count.
+///
+/// Source claims and operator narrowing are the coordinator's, which drops
+/// a set for an unclaimed source before using the result.
+///
+/// # Performance
+///
+/// Serializes each set once to measure it, and compares each entry with
+/// the at most 8 entries already kept.
+#[must_use]
+pub(crate) fn entry_sets(eids: &[ResolvedEid], now: UnixTime) -> EntrySets {
+    let mut result = EntrySets::default();
+    for eid in eids {
+        let mut dropped = Vec::new();
+        let cleaned = clean_entry(eid, &mut dropped);
+        let set = result.sets.entry(eid.source.clone()).or_insert_with(|| EntrySet {
+            entries: Vec::new(),
+            expires_at: None,
+            refresh_at: None,
+            refresh_until: None,
+        });
+        match cleaned {
+            None => dropped.push(DroppedPart::EmptyEntry),
+            Some(entry) if set.entries.contains(&entry) => dropped.push(DroppedPart::DuplicateEntry),
+            Some(_) if set.entries.len() >= MAX_ENTRIES_PER_SOURCE => dropped.push(DroppedPart::ExtraEntry),
+            Some(mut entry) => {
+                let used: usize = set.entries.iter().map(|kept| kept.uids.len()).sum();
+                let room = MAX_UIDS_PER_SOURCE.saturating_sub(used);
+                if entry.uids.len() > room {
+                    dropped.extend(iter::repeat_n(DroppedPart::ExtraUid, entry.uids.len() - room));
+                    entry.uids.truncate(room);
+                }
+                if entry.uids.is_empty() {
+                    dropped.push(DroppedPart::ExtraEntry);
+                } else {
+                    set.expires_at = earliest(set.expires_at, eid.expiry.map(|when| when.resolve(now)));
+                    set.refresh_at = earliest(set.refresh_at, eid.refresh.map(|when| when.resolve(now)));
+                    set.refresh_until = earliest(set.refresh_until, eid.refresh_until);
+                    set.entries.push(entry);
+                }
+            }
+        }
+        result
+            .drops
+            .extend(dropped.into_iter().map(|part| EntryDrop { source: eid.source.clone(), part }));
+    }
+    result.sets.retain(|source, set| {
+        if set.entries.is_empty() {
+            return false;
+        }
+        let fits = entry_set_bytes(&set.entries) <= MAX_ENTRY_SET_BYTES;
+        if !fits {
+            result.oversized.push(source.clone());
+        }
+        fits
+    });
+    result
+}
+```
+
+`retain` borrows `result.sets` mutably while the closure pushes to `result.oversized`. The two are disjoint fields, and closures capture disjoint fields since edition 2021, so the borrows do not conflict.
+
+`entry_sets` does not apply the expiring-source fallback (an expiring set without `exp` keeps the stored `exp` when its entries are unchanged, and is discarded otherwise). That needs the descriptor and the stored record, so it belongs to the coordinator (Task 20). The coordinator also:
+
+- ignores `refresh_until` from a provider not declared `with_private_state()`
+- rejects a stateful result's positive part when `oversized` is not empty, keeping its removals
+- handles a result with `all_discarded()` as `Malformed`, keeping its removals, and otherwise leaves the stored set of a source not in `sets` as it is (spec 4.5)
+- logs each `EntryDrop` and oversized source with the provider ID, never a value
+
+An `EntrySet`'s `entries` are what Task 15's mutation stores as the record's `eids` (Task 6).
+
+In `input.rs`, add `use super::exchange::ProviderResponse;` to the import block and append `CaptureInput` after `ResolveInput`:
+
+```rust
+/// What a capture may read from one proxied response.
+pub struct CaptureInput<'a> {
+    descriptor: &'a ProviderDescriptor,
+    path: &'a str,
+    response: &'a ProviderResponse,
+    stored: &'a BTreeMap<SourceDomain, StoredId>,
+    consent: &'a ProviderConsent,
+    publisher_domain: &'a str,
+    now: UnixTime,
+}
+
+impl fmt::Debug for CaptureInput<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CaptureInput")
+            .field("provider", self.descriptor.id())
+            .field("path", &self.path)
+            .finish_non_exhaustive()
+    }
+}
+
+impl<'a> CaptureInput<'a> {
+    /// The input for one capture.
+    #[must_use]
+    pub(crate) fn new(
+        descriptor: &'a ProviderDescriptor,
+        path: &'a str,
+        response: &'a ProviderResponse,
+        stored: &'a BTreeMap<SourceDomain, StoredId>,
+        consent: &'a ProviderConsent,
+        publisher_domain: &'a str,
+        now: UnixTime,
+    ) -> Self {
+        Self { descriptor, path, response, stored, consent, publisher_domain, now }
+    }
+
+    /// The proxied request path, without query string.
+    #[must_use]
+    pub fn path(&self) -> &str {
+        self.path
+    }
+
+    /// The proxied response, decoded.
+    #[must_use]
+    pub fn response(&self) -> &ProviderResponse {
+        self.response
+    }
+
+    /// The descriptor's primary source.
+    #[must_use]
+    pub fn primary_source(&self) -> &SourceDomain {
+        self.descriptor.primary_source()
+    }
+
+    /// Finds a declared source by a vendor's spelling.
+    #[must_use]
+    pub fn source_named(&self, name: &str) -> Option<&SourceDomain> {
+        self.descriptor.source_named(name)
+    }
+
+    /// The stored record for a source.
+    #[must_use]
+    pub fn stored(&self, source: &SourceDomain) -> Option<&StoredId> {
+        self.stored.get(source)
+    }
+
+    /// The request's consent, from its cookies and headers. The request
+    /// body is never read (spec 4.7).
+    #[must_use]
+    pub fn consent(&self) -> &ProviderConsent {
+        self.consent
+    }
+
+    /// The publisher's domain.
+    #[must_use]
+    pub fn publisher_domain(&self) -> &str {
+        self.publisher_domain
+    }
+
+    /// The request's time.
+    #[must_use]
+    pub fn now(&self) -> UnixTime {
+        self.now
+    }
+}
+```
+
+`CaptureInput::new` takes 7 arguments, which is the maximum `AGENTS.md` allows. Do not add an eighth. Use a struct if you need one.
+
+Add `exchange.rs` to `mod.rs` (`pub mod exchange; pub use exchange::{ProviderRequest, ProviderResponse};`), `pub use resolution::{Resolution, ResolvedEid, ResolvedUid, StateChange, When};`, and add `CaptureInput` to the `pub use input::{...}` line. Add `exchange.rs` to `migration_guards.rs`.
+
+- [ ] **Step 5: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity`
+Expected: PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add provider requests, responses and resolutions"
+```
+
+### Task 11: The `IdentityProvider` trait
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/provider.rs`
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: `crates/trusted-server-core/src/ec/identity/provider.rs`
+
+**Interfaces:**
+
+- Consumes: Tasks 8 to 10
+- Produces: `pub trait IdentityProvider: Send + Sync` with `descriptor`, `request`, `response` and `capture` exactly as spec 4.2 shows, and `pub trait IdentityProviderConfig: IntegrationConfig { fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>>; }`. Also the compile-time guard `const _: Option<&dyn IdentityProvider> = None;`.
+
+- [ ] **Step 1: Write the failing test**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use http::Method;
+
+    use super::*;
+    use crate::ec::identity::descriptor::Captures;
+    use crate::ec::identity::exchange::ProviderResponse;
+    use crate::ec::identity::ids::UnixTime;
+    use crate::ec::identity::input::{CaptureInput, ProviderConsent};
+
+    struct DescriptorOnly(ProviderDescriptor);
+
+    impl IdentityProvider for DescriptorOnly {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.0
+        }
+    }
+
+    #[test]
+    fn default_capability_methods_return_the_not_implemented_marker() {
+        let provider = DescriptorOnly(
+            ProviderDescriptor::builder("p".parse().expect("should parse the provider id"))
+                .with_source("example.com".parse().expect("should parse the source"))
+                .with_captures(Captures::new().with_path(Method::POST, "/integrations/p/api"))
+                .build()
+                .expect("should build"),
+        );
+        let boxed: Box<dyn IdentityProvider> = Box::new(provider);
+        let response = ProviderResponse::for_test(http::StatusCode::OK, b"{}");
+        let consent = ProviderConsent::default();
+        let stored = BTreeMap::new();
+        let input = CaptureInput::new(
+            boxed.descriptor(),
+            "/integrations/p/api",
+            &response,
+            &stored,
+            &consent,
+            "www.example.com",
+            UnixTime::from_secs(1),
+        );
+
+        let error = boxed.capture(&input).expect_err("should return the not-implemented marker");
+        assert!(error.current_context().is_not_implemented(), "should carry the marker");
+        assert!(
+            !IdentityProviderError::config("other").current_context().is_not_implemented(),
+            "should not treat an ordinary Config error as the marker"
+        );
+    }
+}
+```
+
+- [ ] **Step 2: Run and see it fail**
+
+Run: `cargo test-fastly -- ec::identity::provider`
+Expected: compile error.
+
+- [ ] **Step 3: Implement**
+
+Copy the trait and config trait verbatim from spec 4.2, with these imports:
+
+```rust
+//! The identity provider trait.
+
+use error_stack::Report;
+
+use super::descriptor::ProviderDescriptor;
+use super::exchange::{ProviderRequest, ProviderResponse};
+use super::input::{CaptureInput, ResolveInput};
+use super::resolution::{IdentityProviderError, Resolution};
+use crate::settings::IntegrationConfig;
+
+// ... trait IdentityProvider and trait IdentityProviderConfig exactly as spec 4.2 ...
+
+// Keeps the trait object-safe. Fails to compile if a method gains generics.
+const _: Option<&dyn IdentityProvider> = None;
+```
+
+`IntegrationConfig` is `crate::settings::IntegrationConfig` (`settings.rs:235`). Write `OpenRTB`, `LiveRamp` and other mixed-case names in backticks in the copied doc comments (`clippy::doc_markdown`). Add `pub mod provider; pub use provider::{IdentityProvider, IdentityProviderConfig};` to `mod.rs`, and the file to `migration_guards.rs`.
+
+- [ ] **Step 4: Run and see it pass**
+
+Run: `cargo test-fastly -- ec::identity` and `cargo doc --no-deps --all-features -p trusted-server-core`
+Expected: PASS, with no broken intra-doc links.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add the IdentityProvider trait"
+```
+
+### Task 12: Consent policy evaluation with the signals TS decodes today
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/policy.rs`
+- Modify: `crates/trusted-server-core/src/consent/mod.rs` (make `effective_tcf` `pub(crate)`, visibility only)
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: `policy.rs`
+
+**Interfaces:**
+
+- Consumes: `ConsentPolicy` (Task 8), `ConsentContext`, the decoded forms `TcfConsent` (with `has_purpose_consent(usize)` and `has_vendor_consent(u16)`, `consent/types.rs:230-252`), `GppConsent` (with `eu_tcf` and `us_sale_opt_out: Option<bool>`) and `UsPrivacy` (with `opt_out_sale: PrivacyFlag`)
+- Produces:
+  - `pub(crate) struct PolicySignals { dnt: bool }`. DNT is not in `ConsentContext`, so the caller passes it.
+  - `pub(crate) fn policy_allows(policy: &ConsentPolicy, consent: &ConsentContext, signals: PolicySignals) -> bool`
+  - `pub(crate) fn tcf_applies(consent: &ConsentContext) -> bool`, the same test `consent_allows_server_side_auction` uses (`consent/mod.rs:298-308`)
+  - a private `fn us_sale_opt_out(consent: &ConsentContext) -> bool` in `policy.rs`: the GPP US sale opt-out or the US Privacy sale flag, the same two checks `allows_ec_creation` makes (`consent/mod.rs:539-547`). No consent function changes behaviour
+
+Vendor consent needs no new helper: `TcfConsent::has_vendor_consent` already exists (`consent/types.rs:250-252`).
+
+Part 2 (Task 34) extends `policy_allows` with the sharing and targeted-advertising opt-outs, GPP section 6, and the GPC and known-child fields. Until then, a strict policy blocks on the signals already decoded: TCF purposes and vendor, the US sale opt-out (GPP and US Privacy), `Sec-GPC`, DNT, and any raw string present without a decoded form.
+
+A GPP string that decodes but has no applicable section, such as the header-only `DBAA` a CMP sends when no section applies, has a decoded form and carries no opt-out, so it does not block `strict()` by itself (spec 9.1). Where TCF applies, the policy still needs TCF consent, from a TC string or from a GPP TCF section. Task 34 keeps both rules.
+
+- [ ] **Step 1: Write the failing tests**
+
+Build `ConsentContext` values the way existing consent tests do (`grep -n "fn .*consent_context\|ConsentContext {" crates/trusted-server-core/src/consent/mod.rs | head`). Reuse their helper. Then:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ec::identity::descriptor::{ConsentPolicy, UsOptOut};
+
+    #[test]
+    fn strict_blocks_each_signal_it_decodes() {
+        let strict = ConsentPolicy::strict();
+        let allowed = consent_with(Signals::default());
+        assert!(policy_allows(&strict, &allowed, PolicySignals { dnt: false }), "should allow a request with no signal set");
+
+        for (name, signals, dnt) in [
+            ("gdpr without purpose 4", Signals { gdpr: true, purposes: vec![1], ..Signals::default() }, false),
+            ("us sale opt-out", Signals { us_sale_opt_out: true, ..Signals::default() }, false),
+            ("gpc", Signals { gpc: true, ..Signals::default() }, false),
+            ("dnt", Signals::default(), true),
+            ("undecodable tc string", Signals { raw_tc_without_decode: true, ..Signals::default() }, false),
+        ] {
+            assert!(
+                !policy_allows(&strict, &consent_with(signals), PolicySignals { dnt }),
+                "should block under strict: {name}"
+            );
+        }
+    }
+
+    #[test]
+    fn relaxations_and_vendor_consent() {
+        let gpc = consent_with(Signals { gpc: true, ..Signals::default() });
+        assert!(
+            policy_allows(&ConsentPolicy::strict().allowing_gpc(), &gpc, PolicySignals { dnt: false }),
+            "should allow GPC when the policy relaxes it"
+        );
+        let sale = consent_with(Signals { us_sale_opt_out: true, ..Signals::default() });
+        assert!(
+            policy_allows(&ConsentPolicy::strict().allowing_us_opt_out(UsOptOut::Sale), &sale, PolicySignals { dnt: false }),
+            "should allow a sale opt-out when the policy relaxes it"
+        );
+        let gdpr = consent_with(Signals { gdpr: true, purposes: vec![1, 4], vendors: vec![9999], ..Signals::default() });
+        assert!(
+            policy_allows(&ConsentPolicy::strict().with_tcf_vendor(9999), &gdpr, PolicySignals { dnt: false }),
+            "should allow a granted vendor"
+        );
+        assert!(
+            !policy_allows(&ConsentPolicy::strict().with_tcf_vendor(1234), &gdpr, PolicySignals { dnt: false }),
+            "should block a vendor without consent"
+        );
+    }
+
+    #[test]
+    fn eid_persistence_only_ignores_provider_signals() {
+        let consent = consent_with(Signals { gpc: true, us_sale_opt_out: true, ..Signals::default() });
+        assert!(
+            policy_allows(&ConsentPolicy::eid_persistence_only(), &consent, PolicySignals { dnt: true }),
+            "should check only the global gates for generic pull's parity policy, which the coordinator applies separately"
+        );
+    }
+
+    #[test]
+    fn a_header_only_gpp_string_does_not_block_strict() {
+        let header_only = consent_with(Signals { gpp_header_only: true, ..Signals::default() });
+        assert!(
+            policy_allows(&ConsentPolicy::strict(), &header_only, PolicySignals { dnt: false }),
+            "should not block on a decoded GPP string with no applicable section"
+        );
+
+        let under_gdpr = consent_with(Signals { gdpr: true, gpp_header_only: true, ..Signals::default() });
+        assert!(
+            !policy_allows(&ConsentPolicy::strict(), &under_gdpr, PolicySignals { dnt: false }),
+            "should still need TCF consent where TCF applies"
+        );
+
+        let gpp_tcf = consent_with(Signals { gdpr: true, purposes: vec![1, 4], tcf_in_gpp: true, ..Signals::default() });
+        assert!(
+            policy_allows(&ConsentPolicy::strict(), &gpp_tcf, PolicySignals { dnt: false }),
+            "should accept TCF consent from a GPP TCF section"
+        );
+    }
+}
+```
+
+`Signals` and `consent_with` are a small test helper you write in this module. It builds a `ConsentContext` with the given TCF purposes and vendor consents decoded, the US sale opt-out decoded from a US Privacy string `1YYN`, `gpc` set, and, for `raw_tc_without_decode`, `raw_tc_string = Some(..)` with no decoded TCF. `gdpr: true` sets `gdpr_applies` and `Jurisdiction::Gdpr`; otherwise the jurisdiction is `Jurisdiction::UsState("CA".to_owned())`, because `tcf_applies` treats `Unknown` as TCF applying. `gpp_header_only` sets `raw_gpp_string = Some("DBAA")` and `gpp` to `decode_gpp_string("DBAA")`, with `gpp_section_ids = Some(vec![])`. `tcf_in_gpp` puts the decoded TCF in `gpp.eu_tcf` instead of `tcf`, with `raw_tc_string` unset. Build it on whatever constructor the consent tests use. Read `consent/types.rs` first. If `decode_gpp_string("DBAA")` fails with the pinned `iab_gpp`, stop: the fail-closed rule would then block it, and the spec 9.1 rule needs a decoder change that this task does not make. Report it instead of working around it.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::policy`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+`policy.rs`:
+
+```rust
+//! Evaluates a provider's [`ConsentPolicy`] against a request's consent.
+
+use super::descriptor::{ConsentPolicy, UsOptOut};
+use crate::consent::jurisdiction::Jurisdiction;
+use crate::consent::types::PrivacyFlag;
+use crate::consent::{ConsentContext, effective_tcf};
+
+/// Signals the consent context does not carry.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) struct PolicySignals {
+    /// `DNT: 1` was present.
+    pub(crate) dnt: bool,
+}
+
+/// Where TCF applies: `gdpr_applies`, or a jurisdiction of GDPR or unknown.
+#[must_use]
+pub(crate) fn tcf_applies(consent: &ConsentContext) -> bool {
+    consent.gdpr_applies || matches!(consent.jurisdiction, Jurisdiction::Gdpr | Jurisdiction::Unknown)
+}
+
+/// Whether the request carries a decoded US sale opt-out, from GPP or from
+/// the US Privacy string.
+fn us_sale_opt_out(consent: &ConsentContext) -> bool {
+    consent.gpp.as_ref().and_then(|gpp| gpp.us_sale_opt_out) == Some(true)
+        || consent
+            .us_privacy
+            .as_ref()
+            .is_some_and(|usp| usp.opt_out_sale == PrivacyFlag::Yes)
+}
+
+/// Whether `policy` allows a provider under this request's consent. The
+/// global EC and EID-persistence gates are checked separately (eligibility
+/// steps 1 and 2) and are not repeated here.
+#[must_use]
+pub(crate) fn policy_allows(policy: &ConsentPolicy, consent: &ConsentContext, signals: PolicySignals) -> bool {
+    if policy.is_eid_persistence_only() {
+        return true;
+    }
+    // Fail closed: a raw string with no decoded form blocks.
+    if (consent.raw_tc_string.is_some() && consent.tcf.is_none())
+        || (consent.raw_gpp_string.is_some() && consent.gpp.is_none())
+        || (consent.raw_us_privacy.is_some() && consent.us_privacy.is_none())
+    {
+        return false;
+    }
+    if tcf_applies(consent) {
+        // A TC string or a GPP TCF section. A header-only GPP string has
+        // neither, so TCF consent is still missing.
+        let Some(tcf) = effective_tcf(consent) else {
+            return false;
+        };
+        if !policy
+            .tcf_purposes()
+            .iter()
+            .all(|purpose| tcf.has_purpose_consent(usize::from(*purpose)))
+        {
+            return false;
+        }
+        if let Some(vendor) = policy.tcf_vendor()
+            && !tcf.has_vendor_consent(vendor)
+        {
+            return false;
+        }
+    }
+    if !policy.allows_us_opt_out(UsOptOut::Sale) && us_sale_opt_out(consent) {
+        return false;
+    }
+    if !policy.allows_gpc() && consent.gpc {
+        return false;
+    }
+    if !policy.allows_dnt() && signals.dnt {
+        return false;
+    }
+    true
+}
+```
+
+`effective_tcf` (`consent/mod.rs:283-288`) prefers `tcf` and falls back to `gpp.eu_tcf`, as the auction's consent checks do. Change only its visibility to `pub(crate)`. The fail-closed check needs no special case for `DBAA`: it decodes, so `consent.gpp` is `Some` and nothing blocks. The field names above (`raw_tc_string`, `tcf`, `raw_gpp_string`, `gpp`, `raw_us_privacy`, `us_privacy`, `gpc`, `gdpr_applies`, `jurisdiction`) are `ConsentContext`'s (`consent/types.rs:109-148`). `has_purpose_consent` takes a `usize`, so the `u8` purposes convert with `usize::from`. `us_sale_opt_out` reads the decoded `GppConsent::us_sale_opt_out` and `UsPrivacy::opt_out_sale`; it does not call the private `decode_us_sale_opt_out` (`gpp.rs:125`), which takes the parsed GPP string. Do not change any existing consent function's behaviour.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::policy` and `cargo test-fastly -- consent::`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/consent/mod.rs crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Evaluate provider consent policies against decoded consent"
+```
+
+### Task 13: Revisions and hashes
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/revision.rs`
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: `revision.rs`
+
+**Interfaces:**
+
+- Consumes: `KvPartnerId`, `KvEid`, `KvUid`, `RECORD_REVISION_HEX_LEN` (Task 6), `RandomSource` (Task 9)
+- Produces:
+  - `pub(crate) struct IdentityKeys`, derived once per settings load from `ec.passphrase`, with `pub(crate) fn from_settings(settings: &Settings) -> Self`. It holds one HMAC key, `visitor` (the rate-limit key), with the label `trusted-server/identity/visitor/v1`. Nothing stored in the row is keyed (spec 9.3), so this is the only key.
+  - `pub(crate) struct RecordRevision(String)`: 16 lowercase hex digits, with `as_str` and `from_stored(&str)`
+  - `pub(crate) enum Revision { Unset, Set(RecordRevision) }` (spec 5.4): a record's revision, `Unset` for a record without `rv`, which only a version 1 row holds
+  - `pub(crate) fn new_revision(random: &dyn RandomSource) -> RecordRevision`: 8 random bytes as hex
+  - `pub(crate) fn record_revision(record: &KvPartnerId) -> Revision`: `Set` of `rv` when present, else `Unset`. One `rv` covers a source's whole entry set (spec 5.4).
+  - `pub(crate) struct StateRevision(String)` with `pub(crate) fn of(st: Option<&serde_json::Value>) -> Self`: the first 16 hex digits of the unkeyed SHA-256 of `st` as compact JSON, or of the empty string when there is none. A `ProviderResult`'s `expected_state` (Task 15) holds one when its call read `ps.st`.
+  - `pub(crate) fn uid_hash(uid: &str) -> String`: the first 16 hex digits of the unkeyed SHA-256 of the UID (spec 6.1)
+  - `pub(crate) fn set_hashes(set: &[KvEid]) -> Vec<String>`: one `uid_hash` per UID of the set, in set order, without duplicates. A removal hashes every UID of the record it removes (spec 5.4), so a one-UID record costs one hash and a 32-UID set 32. The hashes come from the live record when the removal applies (Task 15).
+  - `pub(crate) fn push_hashes(list: &mut Vec<String>, hashes: Vec<String>)`: appends each hash to a `ps.iv` or `ps.ov` list, moving a hash already present to the end (spec 6.1). It does not truncate; Task 15's step 4 does.
+  - `pub(crate) fn visitor_key(keys: &IdentityKeys, ec_id: &str) -> String`: 16 hex
+
+The UID hash is unkeyed because the row stores every live UID in plain text, so a key would protect nothing, and an unkeyed hash survives an `ec.passphrase` rotation (spec 6.1, 9.3). It is not namespaced by provider: `ps.iv` and `ps.ov` already sit under a provider. There is no keyed legacy revision either. A version 1 record has the revision `Unset`, and an `OwnerRemove` naming it matches `Unset` until the record's next write (spec 14). The consent fingerprint is a plain bitmask that Task 20 builds, not a hash.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+    use sha2::{Digest as _, Sha256};
+
+    use super::*;
+    use crate::ec::identity::input::SeededRandom;
+    use crate::ec::kv_types::{KvEid, KvPartnerId, KvUid};
+    use crate::test_support::tests::create_test_settings;
+
+    fn uid(id: &str) -> KvUid {
+        KvUid { id: id.to_owned(), ..KvUid::default() }
+    }
+
+    #[test]
+    fn new_revisions_are_hex_and_differ() {
+        let random = SeededRandom::new(7);
+        let first = new_revision(&random);
+        let second = new_revision(&random);
+        assert_eq!(first.as_str().len(), 16, "should be 16 hex digits");
+        assert!(
+            first.as_str().bytes().all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase()),
+            "should be lowercase hex"
+        );
+        assert_ne!(first, second, "should give two writes of the same UID different revisions");
+    }
+
+    #[test]
+    fn record_revision_is_rv_or_unset() {
+        let with_rv = KvPartnerId { rv: Some("0123456789abcdef".to_owned()), ..KvPartnerId::new("u") };
+        assert_eq!(
+            record_revision(&with_rv),
+            Revision::Set(RecordRevision::from_stored("0123456789abcdef")),
+            "should use rv"
+        );
+        assert_eq!(
+            record_revision(&KvPartnerId::browser("u", Some(10))),
+            Revision::Unset,
+            "should be Unset without rv, whatever the UID and at"
+        );
+    }
+
+    #[test]
+    fn uid_hashes_are_unkeyed_sha256_prefixes() {
+        let expected = hex::encode(&Sha256::digest(b"example-uid")[..8]);
+        assert_eq!(uid_hash("example-uid"), expected, "should be the first 16 hex digits of SHA-256");
+
+        let mut other_settings = create_test_settings();
+        other_settings.ec.passphrase = crate::redacted::Redacted::new("another-example-passphrase-value".to_owned());
+        assert_ne!(
+            visitor_key(&IdentityKeys::from_settings(&other_settings), "ec"),
+            visitor_key(&IdentityKeys::from_settings(&create_test_settings()), "ec"),
+            "should key only the visitor key by the passphrase"
+        );
+    }
+
+    #[test]
+    fn a_removal_hashes_every_uid_of_the_set_and_push_moves_repeats_to_the_end() {
+        let set = vec![
+            KvEid { uids: vec![uid("a"), uid("b")], ..KvEid::default() },
+            KvEid { uids: vec![uid("c"), uid("a")], ..KvEid::default() },
+        ];
+
+        let hashes = set_hashes(&set);
+
+        let expected: Vec<String> = ["a", "b", "c"].iter().map(|id| uid_hash(id)).collect();
+        assert_eq!(hashes, expected, "should hash each UID once, in set order");
+        assert_eq!(
+            set_hashes(&KvPartnerId::new("u").eids),
+            vec![uid_hash("u")],
+            "should cost one hash for a one-UID record"
+        );
+
+        let mut list = vec![uid_hash("a"), uid_hash("z")];
+        push_hashes(&mut list, vec![uid_hash("a"), uid_hash("y")]);
+        assert_eq!(list, vec![uid_hash("z"), uid_hash("a"), uid_hash("y")], "should move a repeat to the end");
+    }
+
+    #[test]
+    fn state_revisions_tell_absent_and_changed_state_apart() {
+        let state = json!({ "token": "A0" });
+        assert_eq!(StateRevision::of(Some(&state)), StateRevision::of(Some(&state.clone())), "should be stable");
+        assert_ne!(
+            StateRevision::of(Some(&state)),
+            StateRevision::of(Some(&json!({ "token": "A1" }))),
+            "should change with the state"
+        );
+        assert_ne!(StateRevision::of(None), StateRevision::of(Some(&json!(""))), "should tell absent from empty");
+    }
+}
+```
+
+Find the settings test helper with `grep -rn "fn create_test_settings" crates/trusted-server-core/src`, and fix the import path to match.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::revision`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+```rust
+//! Record revisions, state revisions, UID hashes and the visitor key.
+
+use hmac::{Hmac, Mac as _};
+use sha2::{Digest as _, Sha256};
+
+use super::input::RandomSource;
+use crate::ec::kv_types::{KvEid, KvPartnerId};
+use crate::settings::Settings;
+
+type HmacSha256 = Hmac<Sha256>;
+
+/// The visitor key, derived from `ec.passphrase` once per settings load.
+///
+/// It is the only keyed value: nothing stored in the row is keyed
+/// (spec 9.3).
+#[derive(Clone)]
+pub(crate) struct IdentityKeys {
+    visitor: [u8; 32],
+}
+
+impl core::fmt::Debug for IdentityKeys {
+    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        formatter.write_str("IdentityKeys([redacted])")
+    }
+}
+
+impl IdentityKeys {
+    /// Derives the visitor key from `ec.passphrase`.
+    #[must_use]
+    pub(crate) fn from_settings(settings: &Settings) -> Self {
+        let passphrase = settings.ec.passphrase.expose().as_bytes();
+        let mut mac = HmacSha256::new_from_slice(passphrase).expect("should accept any HMAC key length");
+        mac.update(b"trusted-server/identity/visitor/v1");
+        Self { visitor: mac.finalize().into_bytes().into() }
+    }
+}
+
+fn hex16(digest: &[u8]) -> String {
+    hex::encode(&digest[..8])
+}
+
+/// A record's stored revision: 16 lowercase hex digits.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub(crate) struct RecordRevision(String);
+
+impl RecordRevision {
+    /// Wraps a stored `rv`. `KvEntry::validate` has checked the format.
+    #[must_use]
+    pub(crate) fn from_stored(value: &str) -> Self {
+        Self(value.to_owned())
+    }
+
+    /// The hex digits.
+    #[must_use]
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// A record's revision (spec 5.4). `Unset` for a record without `rv`, which
+/// only a schema version 1 row holds, until its next write gives it one.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub(crate) enum Revision {
+    Unset,
+    Set(RecordRevision),
+}
+
+/// A fresh random revision, drawn on every write of a record.
+#[must_use]
+pub(crate) fn new_revision(random: &dyn RandomSource) -> RecordRevision {
+    let mut bytes = [0u8; 8];
+    random.fill(&mut bytes);
+    RecordRevision(hex::encode(bytes))
+}
+
+/// The revision of a stored record. One revision covers the source's whole
+/// entry set.
+#[must_use]
+pub(crate) fn record_revision(record: &KvPartnerId) -> Revision {
+    record.rv.as_deref().map_or(Revision::Unset, |rv| Revision::Set(RecordRevision::from_stored(rv)))
+}
+
+/// The hash of a provider's `ps.st` a call read, so a later apply can tell
+/// whether another writer changed it since.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct StateRevision(String);
+
+impl StateRevision {
+    /// The first 16 hex digits of the SHA-256 of `st` as compact JSON, or of
+    /// the empty string when there is none. Compact JSON is never empty, so
+    /// absent and present state never share a revision.
+    #[must_use]
+    pub(crate) fn of(st: Option<&serde_json::Value>) -> Self {
+        let bytes = st.and_then(|value| serde_json::to_vec(value).ok()).unwrap_or_default();
+        Self(hex16(&Sha256::digest(bytes)))
+    }
+}
+
+/// The hash stored in `ps.iv` or `ps.ov` for a removed UID: the first 16 hex
+/// digits of its unkeyed SHA-256 (spec 6.1).
+#[must_use]
+pub(crate) fn uid_hash(uid: &str) -> String {
+    hex16(&Sha256::digest(uid.as_bytes()))
+}
+
+/// One hash per UID of a removed set, in set order, without duplicates.
+#[must_use]
+pub(crate) fn set_hashes(set: &[KvEid]) -> Vec<String> {
+    let mut hashes = Vec::new();
+    for uid in set.iter().flat_map(|entry| &entry.uids) {
+        let hash = uid_hash(&uid.id);
+        if !hashes.contains(&hash) {
+            hashes.push(hash);
+        }
+    }
+    hashes
+}
+
+/// Appends hashes to a `ps.iv` or `ps.ov` list, oldest first. A hash
+/// already present moves to the end. The caller truncates.
+pub(crate) fn push_hashes(list: &mut Vec<String>, hashes: Vec<String>) {
+    for hash in hashes {
+        list.retain(|existing| *existing != hash);
+        list.push(hash);
+    }
+}
+
+/// The per-visitor rate-limit key component, from the full EC ID.
+#[must_use]
+pub(crate) fn visitor_key(keys: &IdentityKeys, ec_id: &str) -> String {
+    let mut mac = HmacSha256::new_from_slice(&keys.visitor).expect("should accept a 32-byte key");
+    mac.update(ec_id.as_bytes());
+    hex16(&mac.finalize().into_bytes())
+}
+```
+
+Check that `Settings.ec.passphrase` is `Redacted<String>` with `.expose()`. `pull_sync_marker.rs:293` uses exactly that. `sha2`, `hmac` and `hex` are already dependencies of core (check with `grep -n '^sha2\|^hmac\|^hex' crates/trusted-server-core/Cargo.toml`). Register the module in `mod.rs` (`pub(crate) mod revision;`) and in `migration_guards.rs`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::revision`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add record revisions, state revisions and UID hashes" -m "A removal hashes every UID of the record it removes with an unkeyed SHA-256, since the row already holds the UIDs in plain text. A record without rv has the revision Unset. Only the rate-limit visitor key is derived from ec.passphrase."
+```
+
+---
+
+### Task 14: The provider catalog and the shared servability check
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/catalog.rs`
+- Create: `crates/trusted-server-core/src/ec/identity/servable.rs`
+- Create: `crates/trusted-server-core/src/ec/identity/test_support.rs`
+- Modify: `crates/trusted-server-core/src/ec/eids.rs` (`ResolvedPartnerId`, `resolve_partner_ids`, `to_eids`, and the stale module comment at lines 1-5)
+- Modify: `crates/trusted-server-core/src/openrtb.rs` (the `Eid` doc comment at about line 69 says KV-resolved entries leave the EID-level fields empty)
+- Modify: callers of `resolve_partner_ids`: `auction/endpoints.rs:465`, `ec/admin.rs:485`
+- Modify: `crates/trusted-server-core/src/ec/identify.rs` (`entry.ids` read at about lines 99-103)
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: `servable.rs`, `ec/eids.rs`, `ec/identify.rs`
+
+**Interfaces:**
+
+- Consumes: `KvPartnerId`, `KvEid`, `KvUid`, `first_uid()` (Task 6)
+- Produces:
+  - `pub(crate) struct ProviderCatalog` with `pub(crate) fn new(providers: Vec<Arc<dyn IdentityProvider>>, owners: BTreeMap<SourceDomain, IdentityProviderId>) -> Self`, `get(&IdentityProviderId) -> Option<&Arc<dyn IdentityProvider>>`, `providers() -> impl Iterator<Item = &Arc<dyn IdentityProvider>>`, `owner_of(&SourceDomain) -> Option<&IdentityProviderId>`, `is_configured(&IdentityProviderId) -> bool`, and `ProviderCatalog::empty()`. Part 1 builds it from generic pull providers only (Task 22), with no owners.
+  - Narrowed sources (spec 10.1): `with_narrowing(self, narrowing: BTreeMap<IdentityProviderId, Vec<SourceDomain>>) -> Self` keeps, for each listed provider, only the listed sources its descriptor declares. `sources_of(&IdentityProviderId) -> &[SourceDomain]` returns the narrowed list, else the descriptor's. Every other accessor reads sources through it, so a provider never claims a source it was narrowed away from.
+  - `claimants(&SourceDomain) -> impl Iterator<Item = &IdentityProviderId>`: every provider whose narrowed sources include the source. Task 28's `iv` and `ov` denials read the providers that claim a source through it.
+  - `is_capture_only(&IdentityProviderId) -> bool` (a descriptor with `captures` and no `resolves`) and `capture_only_sources(&IdentityProviderId) -> &[SourceDomain]` (its narrowed sources, empty for any other provider). An opt-out of a capture-only provider also removes the records of these sources that no provider wrote (spec 5.4), and its sticky `ps.o` denies the browser's value for them (spec 7.1).
+  - `pub(crate) struct ServeContext<'a> { now: UnixTime, consent: &'a ConsentContext, signals: PolicySignals, catalog: &'a ProviderCatalog, opted_out: &'a BTreeSet<IdentityProviderId> }`
+  - `pub(crate) fn is_servable(context: &ServeContext<'_>, source: &SourceDomain, record: &KvPartnerId) -> bool`. A record is the source's whole entry set, so the set is servable or not as a whole. No check looks at one entry or one UID.
+  - `pub(crate) fn resolve_partner_ids(registry: &PartnerRegistry, entry: &KvEntry, serve: &ServeContext<'_>) -> Vec<ResolvedPartnerId>`. The new third argument is required. It drops from `pub` to `pub(crate)`: its only callers are in core (`auction/endpoints.rs:465`, `ec/admin.rs:485`), and a `pub` function naming the crate-private `ServeContext` trips `private_interfaces` under `-D warnings`. `ResolvedPartnerId` keeps `source_domain`, `uid` (the first UID of the first stored entry, as before for a one-UID record) and `openrtb_atype` (the partner's), and gains `entries: Vec<KvEid>` (the record's `eids`, one entry for a one-UID record) and `writer: Option<IdentityProviderId>`.
+  - `to_eids` emits one `Eid` per stored entry, in stored order. Each UID uses its stored `atype`, else `openrtb_atype`, and its stored UID-level `ext`. Each entry keeps its stored `inserter`, `matcher`, `mm` and EID-level `ext`. A one-UID record without `atype` or `ext`, which is every record on `main`, gives exactly the `Eid` it gives today. Task 28 fills the EID-level fields of a provider-written entry that sets none of them from `with_provenance`.
+  - `x-ts-eids` truncation stays per entry, as today: `encode_eids_header` (`ec/eids.rs:106`) and `build_eids_header` are unchanged. The header also carries the browser's entries, whose truncation must not change, so it can hold part of a stored set; `user.eids` always holds the set whole (spec 7.1).
+  - `ec/identity/test_support.rs`, declared as `#[cfg(any(test, feature = "test-utils"))] pub mod test_support;`: `test_consent_allowing_everything`, `test_consent_gdpr_without_vendor`, `example_entry_set() -> Vec<KvEid>` (spec 6.1's two entries and three UIDs: `example-a` and `example-b` with `inserter` and `mm`, then `example-c` with `matcher`) and `full_record(writer: Option<&str>, set: Vec<KvEid>) -> KvPartnerId`, all `pub`. Later tasks add to it.
+
+The rule (spec 6.1 and 7.1), applied in this order:
+
+1. A record with an empty `eids` is not servable. `KvEntry::validate` never lets one through, so this only guards a caller that builds a record by hand.
+2. `exp` at or before `now` is not servable. The set's `exp` is the earliest any of its entries set (spec 4.5).
+3. A record with a writer `w`:
+   - The writer must be in the catalog. A disabled or unconfigured writer means not servable.
+   - The writer must not be in `opted_out`: the providers with a `ps.o` in the row the request read. The caller computes it from KV only (spec 7.1).
+   - The writer's consent policy must pass under this request's consent (`policy_allows`).
+4. An owned source (the catalog has an owner):
+   - The owner's policy must pass.
+   - If the owner's descriptor marks the source as expiring, the record must have `w == owner` and a set, unexpired `exp`. This is the rollback rule.
+5. Anything else, meaning no writer and an unowned source, is servable. The caller already applied the generic gates.
+
+- [ ] **Step 1: Write the failing tests**
+
+In `servable.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use std::collections::{BTreeMap, BTreeSet};
+    use std::sync::Arc;
+
+    use super::*;
+    use crate::ec::identity::descriptor::{Captures, ConsentPolicy, ProviderDescriptor, Resolves};
+    use crate::ec::identity::provider::IdentityProvider;
+    use crate::ec::identity::test_support::{
+        example_entry_set, full_record, test_consent_allowing_everything, test_consent_gdpr_without_vendor,
+    };
+    use crate::ec::kv_types::KvPartnerId;
+
+    struct Fixed(ProviderDescriptor);
+    impl IdentityProvider for Fixed {
+        fn descriptor(&self) -> &ProviderDescriptor {
+            &self.0
+        }
+    }
+
+    fn provider(id: &str, source: &str, policy: ConsentPolicy, expiring: bool) -> Arc<dyn IdentityProvider> {
+        let mut builder = ProviderDescriptor::builder(id.parse().expect("should parse the provider ID"))
+            .with_source(source.parse().expect("should parse the source"))
+            .with_resolves(Resolves::new().with_endpoint("https://api.example.com"))
+            .with_consent_policy(policy);
+        if expiring {
+            builder = builder.with_expiring_ids();
+        }
+        Arc::new(Fixed(builder.build().expect("should build")))
+    }
+
+    fn record(writer: Option<&str>, exp: Option<u64>) -> KvPartnerId {
+        KvPartnerId { w: writer.map(str::to_owned), exp, ..KvPartnerId::new("u") }
+    }
+
+    fn check(catalog: &ProviderCatalog, opted_out: &BTreeSet<IdentityProviderId>, source: &str, record: &KvPartnerId) -> bool {
+        let consent = test_consent_allowing_everything();
+        let context = ServeContext {
+            now: UnixTime::from_secs(100),
+            consent: &consent,
+            signals: PolicySignals::default(),
+            catalog,
+            opted_out,
+        };
+        is_servable(&context, &source.parse().expect("should parse the source"), record)
+    }
+
+    #[test]
+    fn expiry_writer_presence_and_opt_out() {
+        let catalog = ProviderCatalog::new(
+            vec![provider("p", "a.example.com", ConsentPolicy::eid_persistence_only(), false)],
+            BTreeMap::new(),
+        );
+        let none = BTreeSet::new();
+        assert!(check(&catalog, &none, "a.example.com", &record(Some("p"), Some(101))), "should serve a valid record");
+        assert!(!check(&catalog, &none, "a.example.com", &record(Some("p"), Some(100))), "should treat now == exp as expired");
+        assert!(!check(&catalog, &none, "a.example.com", &record(Some("gone"), None)), "should not serve an unknown writer");
+        let opted: BTreeSet<_> = ["p".parse().expect("should parse the provider ID")].into_iter().collect();
+        assert!(!check(&catalog, &opted, "a.example.com", &record(Some("p"), None)), "should not serve an opted-out writer");
+        // `an_opted_out_owner_stops_every_record_of_its_source`: with `owner`
+        // owning a.example.com and opted out, a browser-seeded record of
+        // a.example.com is not served; with no opt-out it is.
+        assert!(check(&catalog, &none, "b.example.com", &record(None, None)), "should serve an unowned browser record");
+    }
+
+    #[test]
+    fn a_full_record_is_servable_or_not_as_a_whole() {
+        let catalog = ProviderCatalog::new(
+            vec![provider("p", "a.example.com", ConsentPolicy::eid_persistence_only(), false)],
+            BTreeMap::new(),
+        );
+        let none = BTreeSet::new();
+        let valid = KvPartnerId { exp: Some(101), ..full_record(Some("p"), example_entry_set()) };
+        let expired = KvPartnerId { exp: Some(100), ..full_record(Some("p"), example_entry_set()) };
+        assert!(check(&catalog, &none, "a.example.com", &valid), "should serve the whole valid set");
+        assert!(!check(&catalog, &none, "a.example.com", &expired), "should never serve an expired set");
+    }
+
+    #[test]
+    fn rollback_rule_for_expiring_owned_sources() {
+        let owner: IdentityProviderId = "owner".parse().expect("should parse the provider ID");
+        let catalog = ProviderCatalog::new(
+            vec![provider("owner", "a.example.com", ConsentPolicy::eid_persistence_only(), true)],
+            [("a.example.com".parse().expect("should parse the source"), owner)].into_iter().collect(),
+        );
+        let none = BTreeSet::new();
+        assert!(check(&catalog, &none, "a.example.com", &record(Some("owner"), Some(200))), "should serve the owner's value");
+        assert!(!check(&catalog, &none, "a.example.com", &record(None, None)), "should never serve a browser-seeded value from the server");
+        assert!(!check(&catalog, &none, "a.example.com", &record(Some("owner"), None)), "should not serve a value with a stripped exp");
+    }
+
+    #[test]
+    fn narrowing_limits_claims_and_capture_only_sources() {
+        let capture_only: Arc<dyn IdentityProvider> = Arc::new(Fixed(
+            ProviderDescriptor::builder("c".parse().expect("should parse the provider ID"))
+                .with_source("a.example.com".parse().expect("should parse the source"))
+                .with_source("b.example.com".parse().expect("should parse the source"))
+                .with_captures(Captures::new().with_path_prefix("/integrations/c/"))
+                .build()
+                .expect("should build"),
+        ));
+        let resolver = provider("p", "a.example.com", ConsentPolicy::eid_persistence_only(), false);
+        let a: SourceDomain = "a.example.com".parse().expect("should parse the source");
+        let b: SourceDomain = "b.example.com".parse().expect("should parse the source");
+        let c: IdentityProviderId = "c".parse().expect("should parse the provider ID");
+        let p: IdentityProviderId = "p".parse().expect("should parse the provider ID");
+
+        let catalog = ProviderCatalog::new(vec![capture_only, resolver], BTreeMap::new())
+            .with_narrowing([(c.clone(), vec![b.clone()])].into_iter().collect());
+
+        assert_eq!(catalog.sources_of(&c), &[b.clone()], "should narrow the capture-only provider");
+        assert!(catalog.is_capture_only(&c) && !catalog.is_capture_only(&p), "should tell capture-only apart");
+        assert_eq!(catalog.capture_only_sources(&c), &[b.clone()], "should list its narrowed sources");
+        assert!(catalog.capture_only_sources(&p).is_empty(), "should list none for a resolver");
+        assert_eq!(catalog.claimants(&a).collect::<Vec<_>>(), vec![&p], "should drop a narrowed-away claim");
+        assert_eq!(catalog.claimants(&b).collect::<Vec<_>>(), vec![&c], "should keep the narrowed claim");
+    }
+
+    #[test]
+    fn writer_policy_applies_to_unowned_sources() {
+        let strict = ConsentPolicy::strict().with_tcf_vendor(9999);
+        let catalog = ProviderCatalog::new(vec![provider("p", "a.example.com", strict, false)], BTreeMap::new());
+        let consent = test_consent_gdpr_without_vendor(9999);
+        let none = BTreeSet::new();
+        let context = ServeContext {
+            now: UnixTime::from_secs(100),
+            consent: &consent,
+            signals: PolicySignals::default(),
+            catalog: &catalog,
+            opted_out: &none,
+        };
+        let source = "a.example.com".parse().expect("should parse the source");
+        assert!(!is_servable(&context, &source, &record(Some("p"), None)), "should not serve when the writer's vendor is denied");
+        assert!(is_servable(&context, &source, &record(None, None)), "should leave a browser value unaffected");
+    }
+}
+```
+
+`test_consent_allowing_everything` and `test_consent_gdpr_without_vendor` reuse the helper you wrote in Task 12. Move it to `ec/identity/test_support.rs` now so every identity test can share it. Declare the module in `mod.rs` as `#[cfg(any(test, feature = "test-utils"))] pub mod test_support;`, and keep it public from the start, as the crate's other `test-utils` items are (`IntegrationRegistry::from_request_filters`): adapter tests reach it in Part 1 (Task 30). A helper whose signature names only public types (`ConsentContext`, `KvEid`, `KvPartnerId`, `IdentityProvider`) is `pub` with a doc comment. A helper that takes or returns a crate-private type (`ProviderCatalog`, `IdentityKeys`) stays `pub(crate)`, because a `pub` function naming a `pub(crate)` type trips `private_interfaces` under `-D warnings`. Start the file with `#![cfg_attr(not(test), allow(dead_code, reason = "the test-utils library build compiles the crate-private helpers without their unit-test callers"))]`, so `cargo clippy-fastly`, which enables `test-utils` for the adapter's dev-dependency, does not flag them. Add the entry-set helpers next to it:
+
+```rust
+/// Spec 6.1's example set: two entries, three UIDs, with UID-level and
+/// EID-level fields.
+#[must_use]
+pub fn example_entry_set() -> Vec<KvEid> {
+    vec![
+        KvEid {
+            uids: vec![
+                KvUid { id: "example-a".to_owned(), atype: Some(1), ext: None },
+                KvUid { id: "example-b".to_owned(), atype: Some(3), ext: Some(json!({ "stype": "ppuid" })) },
+            ],
+            inserter: Some("example.com".to_owned()),
+            mm: Some(3),
+            ..KvEid::default()
+        },
+        KvEid {
+            uids: vec![KvUid { id: "example-c".to_owned(), atype: Some(1), ext: None }],
+            matcher: Some("partner.example.com".to_owned()),
+            ..KvEid::default()
+        },
+    ]
+}
+
+/// A record holding `set`, written by `writer`.
+#[must_use]
+pub fn full_record(writer: Option<&str>, set: Vec<KvEid>) -> KvPartnerId {
+    KvPartnerId { w: writer.map(str::to_owned), eids: set, ..KvPartnerId::default() }
+}
+```
+
+In `ec/eids.rs` tests, extend the existing `resolve_partner_ids` test (line 195) to pass a `ServeContext` built from `ProviderCatalog::empty()`, and add:
+
+```rust
+    #[test]
+    fn resolve_partner_ids_skips_expired_records_and_uses_stored_atype() {
+        let registry = registry_with(&["a.example.com", "b.example.com"]);
+        let mut entry = KvEntry::minimal("a.example.com", "ua", 1);
+        entry.ids.insert(
+            "b.example.com".to_owned(),
+            KvPartnerId { exp: Some(50), ..KvPartnerId::new("ub") },
+        );
+        entry.ids.get_mut("a.example.com").expect("should hold source a").eids[0].uids[0].atype = Some(3);
+
+        let resolved = resolve_partner_ids(&registry, &entry, &serve_context_at(100));
+
+        assert_eq!(resolved.len(), 1, "should drop the expired b");
+        assert_eq!(resolved[0].source_domain, "a.example.com", "should keep a");
+        assert_eq!(to_eids(&resolved)[0].uids[0].atype, Some(3), "should prefer the stored atype");
+    }
+
+    #[test]
+    fn a_one_uid_record_goes_out_as_on_main() {
+        let registry = registry_with(&["a.example.com"]);
+        let entry = KvEntry::minimal("a.example.com", "ua", 1);
+
+        let eids = to_eids(&resolve_partner_ids(&registry, &entry, &serve_context_at(100)));
+
+        assert_eq!(
+            eids,
+            vec![Eid::new(
+                "a.example.com".to_owned(),
+                vec![Uid { id: "ua".to_owned(), atype: Some(99), ext: None }],
+            )],
+            "should be the EID main sends"
+        );
+    }
+
+    #[test]
+    fn a_full_record_goes_out_as_one_eid_per_stored_entry() {
+        let registry = registry_with(&["a.example.com"]);
+        let mut set = example_entry_set();
+        set[1].uids[0].atype = None;
+        let mut entry = KvEntry::minimal("b.example.com", "unregistered", 1);
+        entry.ids.insert("a.example.com".to_owned(), full_record(None, set));
+
+        let eids = to_eids(&resolve_partner_ids(&registry, &entry, &serve_context_at(100)));
+
+        assert_eq!(
+            eids,
+            vec![
+                Eid {
+                    source: "a.example.com".to_owned(),
+                    uids: vec![
+                        Uid { id: "example-a".to_owned(), atype: Some(1), ext: None },
+                        Uid { id: "example-b".to_owned(), atype: Some(3), ext: Some(json!({ "stype": "ppuid" })) },
+                    ],
+                    inserter: Some("example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(3),
+                    ext: None,
+                },
+                Eid {
+                    source: "a.example.com".to_owned(),
+                    uids: vec![Uid { id: "example-c".to_owned(), atype: Some(99), ext: None }],
+                    inserter: None,
+                    matcher: Some("partner.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ],
+            "should send every entry in stored order, a UID without atype taking the partner's"
+        );
+    }
+```
+
+Write `registry_with` and `serve_context_at` as local helpers. `registry_with` follows the existing test's registry setup and gives every partner `openrtb_atype = 99`, so a fallback is visible. `serve_context_at` uses `ProviderCatalog::empty()` with permissive consent. The full record above has no writer, because an empty catalog holds no writer for it to pass.
+
+In `ec/identify.rs` tests, add two. Copy the setup from the nearest existing identify test (`grep -n "fn .*identify" crates/trusted-server-core/src/ec/identify.rs`):
+
+- A row with an expired record and a valid one: the identify response lists only the valid one.
+- A row whose partner source holds `full_record(None, example_entry_set())`: the response's `uid` is `example-a`, and its `eid` is `Eid::new(source, vec![Uid { id: "example-a", atype: Some(partner.openrtb_atype), ext: None }])`, the shape a one-UID record gives today. `/identify` never returns a full set (spec 7.1).
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::servable`, `cargo test-fastly -- ec::eids`, `cargo test-fastly -- ec::identify`
+Expected: compile errors, then the identify test fails because it returns the expired ID.
+
+- [ ] **Step 3: Implement `catalog.rs`**
+
+```rust
+//! The enabled identity providers and source ownership.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::Arc;
+
+use super::ids::{IdentityProviderId, SourceDomain};
+use super::provider::IdentityProvider;
+
+/// Enabled providers, their narrowed sources and source owners. Built once
+/// per settings load.
+#[derive(Clone)]
+pub(crate) struct ProviderCatalog {
+    providers: BTreeMap<IdentityProviderId, Arc<dyn IdentityProvider>>,
+    sources: BTreeMap<IdentityProviderId, Vec<SourceDomain>>,
+    owners: BTreeMap<SourceDomain, IdentityProviderId>,
+}
+
+impl ProviderCatalog {
+    /// A catalog with no providers.
+    #[must_use]
+    pub(crate) fn empty() -> Self {
+        Self::new(Vec::new(), BTreeMap::new())
+    }
+
+    /// Builds the catalog. Validation (ownership, duplicates) happens in
+    /// config validation before this is called.
+    #[must_use]
+    pub(crate) fn new(
+        providers: Vec<Arc<dyn IdentityProvider>>,
+        owners: BTreeMap<SourceDomain, IdentityProviderId>,
+    ) -> Self {
+        let providers: BTreeMap<_, _> = providers
+            .into_iter()
+            .map(|provider| (provider.descriptor().id().clone(), provider))
+            .collect();
+        let sources = providers
+            .iter()
+            .map(|(id, provider)| (id.clone(), provider.descriptor().sources().to_vec()))
+            .collect();
+        Self { providers, sources, owners }
+    }
+
+    /// Narrows providers to the listed sources their descriptors declare
+    /// (spec 10.1). Config validation has rejected a source a descriptor
+    /// does not declare and a narrowing to nothing.
+    #[must_use]
+    pub(crate) fn with_narrowing(mut self, narrowing: BTreeMap<IdentityProviderId, Vec<SourceDomain>>) -> Self {
+        for (id, listed) in narrowing {
+            if let Some(sources) = self.sources.get_mut(&id) {
+                sources.retain(|source| listed.contains(source));
+            }
+        }
+        self
+    }
+
+    /// A provider by ID.
+    #[must_use]
+    pub(crate) fn get(&self, id: &IdentityProviderId) -> Option<&Arc<dyn IdentityProvider>> {
+        self.providers.get(id)
+    }
+
+    /// Every provider, ordered by ID.
+    pub(crate) fn providers(&self) -> impl Iterator<Item = &Arc<dyn IdentityProvider>> {
+        self.providers.values()
+    }
+
+    /// Whether `id` is an enabled provider.
+    #[must_use]
+    pub(crate) fn is_configured(&self, id: &IdentityProviderId) -> bool {
+        self.providers.contains_key(id)
+    }
+
+    /// The owner of `source`, if any.
+    #[must_use]
+    pub(crate) fn owner_of(&self, source: &SourceDomain) -> Option<&IdentityProviderId> {
+        self.owners.get(source)
+    }
+
+    /// A provider's sources after narrowing. Empty for an unknown provider.
+    #[must_use]
+    pub(crate) fn sources_of(&self, id: &IdentityProviderId) -> &[SourceDomain] {
+        self.sources.get(id).map_or(&[], Vec::as_slice)
+    }
+
+    /// Every provider that claims `source` after narrowing, ordered by ID.
+    pub(crate) fn claimants<'a>(&'a self, source: &'a SourceDomain) -> impl Iterator<Item = &'a IdentityProviderId> {
+        self.sources.iter().filter(move |(_, sources)| sources.contains(source)).map(|(id, _)| id)
+    }
+
+    /// Whether `id` captures and never resolves.
+    #[must_use]
+    pub(crate) fn is_capture_only(&self, id: &IdentityProviderId) -> bool {
+        self.get(id).is_some_and(|provider| {
+            let descriptor = provider.descriptor();
+            descriptor.captures().is_some() && descriptor.resolves().is_none()
+        })
+    }
+
+    /// The narrowed sources of a capture-only provider. Empty for any other.
+    #[must_use]
+    pub(crate) fn capture_only_sources(&self, id: &IdentityProviderId) -> &[SourceDomain] {
+        if self.is_capture_only(id) { self.sources_of(id) } else { &[] }
+    }
+}
+```
+
+- [ ] **Step 4: Implement `servable.rs`**
+
+```rust
+//! The one servability check shared by the bidstream, the admin view and
+//! `/_ts/api/v1/identify` (spec 7.1).
+
+use std::collections::BTreeSet;
+
+use super::catalog::ProviderCatalog;
+use super::ids::{IdentityProviderId, SourceDomain, UnixTime};
+use super::policy::{PolicySignals, policy_allows};
+use crate::consent::ConsentContext;
+use crate::ec::kv_types::KvPartnerId;
+
+/// What a servability decision needs from the request.
+pub(crate) struct ServeContext<'a> {
+    pub(crate) now: UnixTime,
+    pub(crate) consent: &'a ConsentContext,
+    pub(crate) signals: PolicySignals,
+    pub(crate) catalog: &'a ProviderCatalog,
+    /// The providers with a `ps.o` in the row the request read.
+    pub(crate) opted_out: &'a BTreeSet<IdentityProviderId>,
+}
+
+/// Whether a stored record, the source's whole entry set, may be sent from
+/// the server.
+#[must_use]
+pub(crate) fn is_servable(context: &ServeContext<'_>, source: &SourceDomain, record: &KvPartnerId) -> bool {
+    if record.eids.is_empty() {
+        return false;
+    }
+    if record.exp.is_some_and(|exp| context.now.as_secs() >= exp) {
+        return false;
+    }
+    let writer = record.w.as_deref().and_then(|writer| writer.parse::<IdentityProviderId>().ok());
+    if record.w.is_some() {
+        let Some(writer) = writer.as_ref() else {
+            return false;
+        };
+        let Some(provider) = context.catalog.get(writer) else {
+            return false;
+        };
+        if context.opted_out.contains(writer)
+            || !policy_allows(provider.descriptor().consent_policy(), context.consent, context.signals)
+        {
+            return false;
+        }
+    }
+    if let Some(owner) = context.catalog.owner_of(source) {
+        let Some(owner_provider) = context.catalog.get(owner) else {
+            return false;
+        };
+        let descriptor = owner_provider.descriptor();
+        if !policy_allows(descriptor.consent_policy(), context.consent, context.signals) {
+            return false;
+        }
+        if descriptor.is_expiring(source) && (writer.as_ref() != Some(owner) || record.exp.is_none()) {
+            return false;
+        }
+    }
+    true
+}
+```
+
+- [ ] **Step 5: Switch the readers**
+
+In `ec/eids.rs`, replace the module comment at lines 1-5 with one that says KV IDs are filtered by the shared servability check in `ec::identity::servable`, and that a stored record goes out as one EID per stored entry. Add `serve: &ServeContext<'_>` to `resolve_partner_ids`, and inside the loop add `if !is_servable(serve, &source, partner_uid) { continue; }` after parsing `source_domain` into a `SourceDomain`. Skip any key that does not parse. Then change `ResolvedPartnerId` and `to_eids`:
+
+```rust
+/// A source-domain keyed record resolved from a KV entry against the partner
+/// registry and the servability check.
+///
+/// Only includes partners with `bidstream_enabled = true`, a non-empty UID and
+/// a servable record.
+pub struct ResolvedPartnerId {
+    /// The partner's identity source domain and EC KV `ids` key.
+    pub source_domain: String,
+    /// The first UID of the first stored entry.
+    pub uid: String,
+    /// The partner's `OpenRTB` agent type, used for a UID without a stored one.
+    pub openrtb_atype: i32,
+    /// The source's stored entry set, in order. One entry for a one-UID record.
+    pub entries: Vec<KvEid>,
+    /// The provider that wrote the record. `None` for browser ingest and version 1 rows.
+    pub writer: Option<IdentityProviderId>,
+}
+```
+
+In the loop, fill `uid` from `partner_uid.first_uid()`, `entries` with `partner_uid.eids.clone()` and `writer` with the parsed `w`.
+
+```rust
+/// Converts resolved partner IDs to `OpenRTB` `Eid` entries: one per stored
+/// entry, in stored order.
+#[must_use]
+pub fn to_eids(resolved: &[ResolvedPartnerId]) -> Vec<Eid> {
+    resolved
+        .iter()
+        .flat_map(|item| item.entries.iter().map(move |entry| stored_entry_to_eid(item, entry)))
+        .collect()
+}
+
+fn stored_entry_to_eid(item: &ResolvedPartnerId, entry: &KvEid) -> Eid {
+    let uids = entry
+        .uids
+        .iter()
+        .map(|uid| Uid {
+            id: uid.id.clone(),
+            atype: Some(uid.atype.unwrap_or(item.openrtb_atype)),
+            ext: uid.ext.clone(),
+        })
+        .collect();
+    Eid {
+        source: item.source_domain.clone(),
+        uids,
+        inserter: entry.inserter.clone(),
+        matcher: entry.matcher.clone(),
+        mm: entry.mm,
+        ext: entry.ext.clone(),
+    }
+}
+```
+
+Leave `encode_eids_header` and `build_eids_header` as they are. They truncate per `Eid` entry, so a full set can be cut part-way in `x-ts-eids` and reach the 4 KB cap sooner; `x-ts-eids-truncated` is set as today (spec 7.1). `user.eids` is built from `to_eids` without that cap, so bidders always get the set whole. Update the `Eid` doc comment in `openrtb.rs`: KV-resolved entries carry the EID-level fields a provider stored, and a record from browser ingest or a version 1 row has none.
+
+At each caller, build a `ServeContext` with the KV `ps.o` keys of the row as `opted_out`. Until Task 23 puts the request's `IdentityRuntime` on `EcContext`, pass `ProviderCatalog::empty()`. Task 23 replaces it with the runtime's catalog, and adds `generic_pull_record_with_writer_is_served_after_flush`: from Task 29 on, generic pull records carry `w = pull-…`, which an empty catalog would never serve. `now` comes from `checked_current_timestamp()`. If that fails, resolve no KV IDs, because a zero time would make every expiry check pass (spec 4.4). `consent` is the request's `ConsentContext`. DNT is read from the request header there (`auction/routing.rs:336` shows how). In `ec/admin.rs`, `build_auction_view` reports a record the check drops in `skipped` with the reason `not_servable`, so the view still explains every stored ID it leaves out.
+
+In `ec/identify.rs`, keep the lookup of this partner's own source and gate it with `is_servable`, using the same context built from the request's consent, never the row's stored `consent` (spec 7.1). Do not route it through `resolve_partner_ids`, which also drops partners with `bidstream_enabled = false`; `/identify` returns those today. The response keeps its shape: `uid` is `record.first_uid()`, the first UID of the first entry, and `eid` is still built from it with `partner.openrtb_atype` and no `ext` (`ec/identify.rs:127-135`).
+
+A provider-written record (`w` set) passes only with browser context (spec 7.1, 9.5): `classify_origin` allowed the `Origin` and `Sec-Fetch-Site` is `same-origin` or `same-site` (`is_same_site_fetch`; a missing header fails closed). A browser-seeded record keeps today's behaviour. Tests: `identify_returns_a_provider_written_id_only_with_browser_context` (same-site and same-origin return it; no `Origin`, no `Sec-Fetch-Site`, `cross-site` and `none` withhold it) and `identify_returns_a_browser_seeded_id_without_browser_context`. The Fastly adapter's `identify_request` test helper sends both headers, as a browser does.
+
+- [ ] **Step 6: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::` and `cargo test-fastly -- auction::`
+Expected: PASS.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src
+git commit --signoff -S -m "Filter served KV IDs through one servability check" -m "Expired IDs, IDs from disabled or opted-out writers, and IDs whose writer or owner policy fails are no longer sent to bidders, the admin view or /identify. /identify uses the request's consent, never the row's stored snapshot." -m "A stored record goes out as one EID per stored entry. A one-UID record goes out exactly as before, x-ts-eids keeps its per-entry truncation, and /identify keeps returning one UID."
+```
+
+### Task 15: `IdentityMutation` and its merge into a live row
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/mutation.rs`
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs`, `mod.rs`, `migration_guards.rs`
+- Test: `mutation.rs`
+
+**Interfaces:**
+
+- Consumes: `KvEntry`, `KvPartnerId`, `KvProviderState`, `KvOptOut`, `MAX_INVALIDATED_UIDS` (128), `MAX_PROVIDER_STATES` (Task 6), `Revision`, `StateRevision`, `new_revision`, `record_revision`, `set_hashes`, `push_hashes` (Task 13), `ProviderCatalog` with `claimants`, `is_capture_only` and `capture_only_sources` (Task 14), `RandomSource` (Task 9)
+- Produces:
+  - `pub(crate) enum PartnerIdChange` (spec 5.4):
+    - `FillMissing { source, record: KvPartnerId }`: from browser ingest (`record.w` is `None`) or an unowned provider (`record.w` names it)
+    - `OwnerWrite { source, record: KvPartnerId, expected: Option<Revision> }`: from the owning provider, whose ID `record.w` holds
+    - `OwnerRemove { source, provider: IdentityProviderId, expected: Revision }`: from `Resolution::invalidate` or `also_invalidate`. `provider` is the provider that invalidated, whose `ps.iv` receives the hashes. Spec 5.4's enum leaves it out, but step 3 reads the `ps.iv` of every provider that claims a source, owned or unowned, so the change must say whose list it feeds.
+    - `WriterRemove { source, writer: IdentityProviderId }`: from `Resolution::opted_out`. Removes the source's record if `writer` wrote it, at any revision, and for a capture-only `writer` also a record no provider wrote. Its hashes go to the writer's `ps.ov`.
+  - There is no `staged_at` and no `invalidate` flag: nothing is staged in a cookie, so every change comes from this request's own KV read (spec 5.4).
+  - Each `record` is the source's whole record: its `eids`, `w`, the timing fields and `rv`. Every change writes or removes a source's set whole. No change edits one entry or one UID, so one `rv` per source covers every entry in it.
+  - `pub(crate) enum StateUpdate { Keep, Replace(serde_json::Value), Clear }`, defaulting to `Keep`
+  - `pub(crate) struct ProviderStateChange { n: Option<u64>, f: Option<u32>, opt_out: Option<KvOptOut>, opt_out_clear: Option<u64>, st: StateUpdate }`, deriving `Default`. It has no `iv` or `ov` field: those hashes come only from applied removals.
+  - `pub(crate) struct ProviderResult { provider, ids: Vec<PartnerIdChange>, state: ProviderStateChange, expected_state: Option<StateRevision> }`. `None` means the call read no state, so the state check always passes.
+  - `pub(crate) struct IdentityMutation`, deriving `Default`, with `add_change(PartnerIdChange)`, `add_result(ProviderResult)`, `merge_state(IdentityProviderId, ProviderStateChange)`, `set_cluster_size(u32)`, `is_empty()`, `has_removals()` (any `OwnerRemove`, `WriterRemove`, opt-out or clear), and `removals(&self) -> IdentityMutation` (a copy holding only the removals, opt-outs and clears, which Task 18's removal write and Task 29's removal-only retry apply). Task 18 adds `removal_labels()`.
+  - `pub(crate) struct ApplyContext<'a> { now: u64, random: &'a dyn RandomSource, catalog: &'a ProviderCatalog }`
+  - `pub(crate) struct Applied { entry: KvEntry, changed: bool, removals_only: bool }`
+  - `pub(crate) fn apply(mutation: &IdentityMutation, live: &KvEntry, context: &ApplyContext<'_>) -> Option<Applied>`. `None` means drop everything: the live row is a tombstone, or even the removals-only result failed validation.
+  - `pub(crate) fn apply_removals_only(mutation: &IdentityMutation, live: &KvEntry, context: &ApplyContext<'_>) -> Option<Applied>`: spec 5.4's steps 1, 2, 4 (only `o`, `oc`, `iv` and `ov`), 5 and 6, for the capture removal write and the removal-only retry. It ignores every positive change, `n`, `f`, `st` and `cluster_size` in `mutation`.
+
+Apply order (spec 5.4). Copy it into the doc comment of `apply`:
+
+1. A tombstone (`consent.ok == false`) gives `None`.
+2. Removals, never skipped:
+   - Every `OwnerRemove` whose `expected` equals `record_revision(live_record)`. A version 1 record matches `Revision::Unset`. It appends `set_hashes(&live_record.eids)` to `ps[provider].iv`.
+   - Every `WriterRemove` whose live record has `w == writer`, or, when `writer` is capture-only and the source is one of its `capture_only_sources`, has no `w`. It appends the removed record's hashes to `ps[writer].ov`.
+   - Each new opt-out applies when `at > live.o.at` (or there is no live `o`) and `at >= live.oc` (or there is no live `oc`). Applying it stores `o` and removes every live record that provider wrote, at any revision, and for a capture-only provider every record of its sources that no provider wrote, each adding its hashes to `ps.ov`.
+   - Clears apply before opt-outs (revised after the round 14 review). A clear (`opt_out_clear`) carries a watermark, the `at` of the opt-out the clearing request read. It applies when the live `o.at` is at or before the watermark and the live `oc` is before it, stores the watermark as `oc` and empties `ps.ov`. One whose watermark is before the live `o.at`, or that finds no live opt-out, is dropped and writes nothing. `ps.iv` is never emptied.
+   - Hashes always come from the record KV held. A removal that no longer applies adds none.
+3. Positive changes:
+   - A provider is opted out when its live `o` is set and its `oc` is not strictly later than `o.at`. Every change whose `record.w` is opted out is skipped, `OwnerWrite` and `FillMissing` alike.
+   - `owner_denies`: for an owned source, every positive change is skipped while the owner is opted out, whoever wrote it, and an `OwnerWrite` or `FillMissing` any of whose UIDs hashes into the owner's `ps.iv` is skipped. Both read the entry after step 2. Tests: an invalidation and a browser refill of the same UID in one mutation leave it removed; an opted-out owner blocks a browser fill and another writer's fill of its source (control: an unowned source still fills); an owner opt-out in the same mutation blocks a browser refill; an owner write of an invalidated UID is skipped (control: another UID is stored).
+   - A `FillMissing` applies when the source is absent, or its record is expired, or its record's writer is not configured. It is skipped when the hash of any UID of its set is in the `ps.iv` or `ps.ov` of any provider in `catalog.claimants(source)`. A browser `FillMissing` (`record.w` is `None`) is also skipped when the source belongs to an opted-out capture-only provider's `capture_only_sources`.
+   - An `OwnerWrite` applies when the live revision equals `expected`, or when `expected` is `None` and the source has no valid record with `w == record.w`. A browser-seeded value never blocks the owner.
+   - A written record replaces the live record whole, never merges into it, so no entry of the old set survives. It gets a fresh `rv` and `at = record.at.or(now)`, and keeps the change's `w`.
+   - Each `ProviderResult` applies only when every one of its ID changes would apply on its own and, when `expected_state` is `Some`, `StateRevision::of(live ps.st)` equals it. Its state change, `n` and `f` then apply with its IDs. Otherwise the whole result is dropped.
+4. `ps` changes: `n` takes the later value, `f` is replaced, `st` is replaced or cleared. Then `cluster_size`. Then truncate each `ps.iv` and `ps.ov` from the front to `MAX_INVALIDATED_UIDS`. Then prune the `ps` entries of providers the catalog does not hold: each keeps only `o`, `oc` and `ov`, so a retired provider's opt-out survives its removal from config and holds again if it comes back, and an entry with none of them is dropped. While `ps` is over `MAX_PROVIDER_STATES`, drop retained entries first, oldest `o.at` first. Then drop expired records, except refresh anchors: the source's owner is configured and either holds a `st` while the record's `ru` has not passed, or wrote the record and declares `Resolves::with_refresh_grace` while `exp` plus the grace has not passed (added after the round 14 review).
+5. `validate()`. On failure, rebuild from the live entry through `apply_removals_only`, and if that also fails, give `None` and log. `validate()` checks the entry-set limits of spec 4.5, so a set that breaks one, such as a set over `MAX_ENTRY_SET_BYTES`, is dropped whole here and never trimmed.
+6. `changed` is whether the result differs from `live`. A caller skips the write when it is `false`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Add the fixtures to `ec/identity/test_support.rs`:
+
+- `pub fn fixed_provider(id: &str, sources: &[&str]) -> Arc<dyn IdentityProvider>`: a descriptor-only resolver with a dummy `https://api.example.com` endpoint and the `eid_persistence_only` policy
+- `pub fn fixed_capture_provider(id: &str, sources: &[&str]) -> Arc<dyn IdentityProvider>`: a descriptor-only provider with `Captures::new().with_path_prefix("/integrations/<id>/")` and no `resolves`
+
+Then the tests in `mutation.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+    use crate::ec::identity::catalog::ProviderCatalog;
+    use crate::ec::identity::input::SeededRandom;
+    use crate::ec::identity::revision::{RecordRevision, StateRevision, set_hashes, uid_hash};
+    use crate::ec::identity::test_support::{example_entry_set, fixed_capture_provider, fixed_provider, full_record};
+    use crate::ec::kv_types::{
+        KvEntry, KvOptOut, KvPartnerId, KvProviderState, KvUid, MAX_INVALIDATED_UIDS, MAX_PROVIDER_STATES,
+    };
+
+    const NOW: u64 = 1_000;
+
+    fn src(name: &str) -> SourceDomain {
+        name.parse().expect("should parse the source")
+    }
+
+    fn pid(name: &str) -> IdentityProviderId {
+        name.parse().expect("should parse the provider ID")
+    }
+
+    fn rev(value: &str) -> Revision {
+        Revision::Set(RecordRevision::from_stored(value))
+    }
+
+    /// `owner` owns a.example.com, `other` claims b.example.com unowned, and
+    /// the capture-only `cap` is narrowed to c.example.com.
+    fn catalog() -> ProviderCatalog {
+        ProviderCatalog::new(
+            vec![
+                fixed_provider("owner", &["a.example.com"]),
+                fixed_provider("other", &["b.example.com"]),
+                fixed_capture_provider("cap", &["c.example.com"]),
+            ],
+            [(src("a.example.com"), pid("owner"))].into_iter().collect(),
+        )
+    }
+
+    fn run(mutation: &IdentityMutation, live: &KvEntry) -> Option<Applied> {
+        let random = SeededRandom::new(1);
+        let catalog = catalog();
+        apply(mutation, live, &ApplyContext { now: NOW, random: &random, catalog: &catalog })
+    }
+
+    fn run_removals(mutation: &IdentityMutation, live: &KvEntry) -> Option<Applied> {
+        let random = SeededRandom::new(1);
+        let catalog = catalog();
+        apply_removals_only(mutation, live, &ApplyContext { now: NOW, random: &random, catalog: &catalog })
+    }
+
+    fn written(writer: &str, uid: &str, rv: &str) -> KvPartnerId {
+        KvPartnerId { w: Some(writer.to_owned()), rv: Some(rv.to_owned()), at: Some(900), ..KvPartnerId::new(uid) }
+    }
+
+    fn opt_out(at: u64) -> ProviderStateChange {
+        ProviderStateChange { opt_out: Some(KvOptOut { at, fp: "1".to_owned() }), ..ProviderStateChange::default() }
+    }
+
+    fn fill(source: &str, record: KvPartnerId) -> PartnerIdChange {
+        PartnerIdChange::FillMissing { source: src(source), record }
+    }
+
+    #[test]
+    fn tombstone_drops_everything() {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("b.example.com", KvPartnerId::browser("u", Some(NOW))));
+        assert!(run(&mutation, &KvEntry::tombstone(1)).is_none(), "should drop on a tombstone");
+        assert!(run_removals(&mutation, &KvEntry::tombstone(1)).is_none(), "should drop removals on a tombstone");
+    }
+
+    #[test]
+    fn fill_missing_fills_absent_expired_and_unconfigured_only() {
+        let mut live = KvEntry::minimal("b.example.com", "existing", 1);
+        live.ids.insert("d.example.com".to_owned(), KvPartnerId { exp: Some(NOW), ..KvPartnerId::new("old") });
+        live.ids.insert("f.example.com".to_owned(), written("retired", "stale", "1111111111111111"));
+        let mut mutation = IdentityMutation::default();
+        for source in ["b.example.com", "d.example.com", "e.example.com", "f.example.com"] {
+            mutation.add_change(fill(source, KvPartnerId::browser("new", Some(NOW))));
+        }
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        let uid = |source: &str| applied.entry.ids[source].first_uid().map(str::to_owned);
+        assert_eq!(uid("b.example.com").as_deref(), Some("existing"), "should not replace a live value");
+        assert_eq!(uid("d.example.com").as_deref(), Some("new"), "should replace an expired value");
+        assert_eq!(uid("e.example.com").as_deref(), Some("new"), "should fill an absent source");
+        assert_eq!(uid("f.example.com").as_deref(), Some("new"), "should treat an unconfigured writer as absent");
+        let record = &applied.entry.ids["e.example.com"];
+        assert_eq!((record.at, record.w.as_deref()), (Some(NOW), None), "should be a browser record");
+        assert!(record.rv.is_some(), "should give every record it writes an rv");
+    }
+
+    #[test]
+    fn owner_write_checks_revision_and_gets_a_fresh_rv() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert("a.example.com".to_owned(), written("owner", "v1", "1111111111111111"));
+        let write = |expected| {
+            let mut mutation = IdentityMutation::default();
+            mutation.add_change(PartnerIdChange::OwnerWrite {
+                source: src("a.example.com"),
+                record: KvPartnerId { w: Some("owner".to_owned()), ..KvPartnerId::new("v2") },
+                expected,
+            });
+            run(&mutation, &live).expect("should apply")
+        };
+
+        assert!(!write(Some(rev("2222222222222222"))).changed, "should lose a stale revision to the newer write");
+        let applied = write(Some(rev("1111111111111111")));
+        let record = &applied.entry.ids["a.example.com"];
+        assert_eq!(record.first_uid(), Some("v2"), "should write");
+        assert_eq!(record.w.as_deref(), Some("owner"), "should keep the writer");
+        assert_ne!(record.rv.as_deref(), Some("1111111111111111"), "should draw a new rv");
+        assert_eq!(record.at, Some(NOW), "should stamp at");
+    }
+
+    #[test]
+    fn owner_write_replaces_the_whole_set_and_leaves_other_sources() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId { rv: Some("1111111111111111".to_owned()), ..full_record(Some("owner"), example_entry_set()) },
+        );
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: KvPartnerId { w: Some("owner".to_owned()), ..KvPartnerId::new("only") },
+            expected: Some(rev("1111111111111111")),
+        });
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert_eq!(applied.entry.ids["a.example.com"], KvPartnerId {
+            rv: applied.entry.ids["a.example.com"].rv.clone(),
+            at: Some(NOW),
+            w: Some("owner".to_owned()),
+            ..KvPartnerId::new("only")
+        }, "should keep no entry of the old set");
+        assert_eq!(applied.entry.ids["b.example.com"].first_uid(), Some("x"), "should leave other sources alone");
+
+        let mut full = IdentityMutation::default();
+        full.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: full_record(Some("owner"), example_entry_set()),
+            expected: None,
+        });
+        let applied = run(&full, &KvEntry::minimal("b.example.com", "x", 1)).expect("should apply");
+        assert_eq!(applied.entry.ids["a.example.com"].eids, example_entry_set(), "should write every entry, in order");
+    }
+
+    #[test]
+    fn browser_seeded_and_version_1_values_never_block_the_owner() {
+        let live = KvEntry::minimal("a.example.com", "seeded", 1);
+        let mut write = IdentityMutation::default();
+        write.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: KvPartnerId { w: Some("owner".to_owned()), ..KvPartnerId::new("owned") },
+            expected: None,
+        });
+        assert_eq!(
+            run(&write, &live).expect("should apply").entry.ids["a.example.com"].first_uid(),
+            Some("owned"),
+            "should let the owner take over a seeded value"
+        );
+
+        let mut remove = IdentityMutation::default();
+        remove.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: Revision::Unset,
+        });
+        let applied = run(&remove, &live).expect("should apply");
+        assert!(!applied.entry.ids.contains_key("a.example.com"), "should match a record without rv as Unset");
+        assert_eq!(applied.entry.ps["owner"].iv, vec![uid_hash("seeded")], "should hash the removed UID into iv");
+    }
+
+    #[test]
+    fn an_applied_invalidation_hashes_every_uid_of_the_live_set() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId { rv: Some("1111111111111111".to_owned()), ..full_record(Some("owner"), example_entry_set()) },
+        );
+        let invalidate = |expected: &str| {
+            let mut mutation = IdentityMutation::default();
+            mutation.add_change(PartnerIdChange::OwnerRemove {
+                source: src("a.example.com"),
+                provider: pid("owner"),
+                expected: rev(expected),
+            });
+            run(&mutation, &live).expect("should apply")
+        };
+
+        let applied = invalidate("1111111111111111");
+        let stale = invalidate("2222222222222222");
+
+        assert!(!applied.entry.ids.contains_key("a.example.com"), "should remove the set");
+        assert_eq!(applied.entry.ps["owner"].iv, set_hashes(&example_entry_set()), "should hash every UID it removed");
+        assert!(stale.entry.ids.contains_key("a.example.com"), "should keep a set at another revision");
+        assert!(stale.entry.ps.get("owner").is_none_or(|state| state.iv.is_empty()), "should add no hash");
+    }
+
+    #[test]
+    fn iv_keeps_the_128_most_recent_hashes() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        let old: Vec<String> = (0..MAX_INVALIDATED_UIDS).map(|index| format!("{index:016x}")).collect();
+        live.ps.insert("owner".to_owned(), KvProviderState { iv: old.clone(), ..KvProviderState::default() });
+        live.ids.insert("a.example.com".to_owned(), written("owner", "u", "1111111111111111"));
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        let iv = &applied.entry.ps["owner"].iv;
+        assert_eq!(iv.len(), MAX_INVALIDATED_UIDS, "should cap at 128");
+        assert_eq!(iv[..127], old[1..], "should drop the oldest hash");
+        assert_eq!(iv[127], uid_hash("u"), "should append the new hash");
+    }
+
+    #[test]
+    fn opt_out_removes_what_the_writer_wrote_fills_ov_and_skips_its_changes() {
+        let mut live = KvEntry::minimal("e.example.com", "browser", 1);
+        live.ids.insert("a.example.com".to_owned(), written("owner", "v1", "1111111111111111"));
+        live.ids.insert("b.example.com".to_owned(), written("owner", "unowned-by-owner", "2222222222222222"));
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(pid("owner"), opt_out(NOW));
+        mutation.add_change(PartnerIdChange::OwnerWrite {
+            source: src("a.example.com"),
+            record: KvPartnerId { w: Some("owner".to_owned()), ..KvPartnerId::new("v2") },
+            expected: None,
+        });
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert!(!applied.entry.ids.contains_key("a.example.com"), "should remove the owned record");
+        assert!(!applied.entry.ids.contains_key("b.example.com"), "should remove the unowned record it wrote");
+        assert_eq!(applied.entry.ids["e.example.com"].first_uid(), Some("browser"), "should leave other records");
+        let state = &applied.entry.ps["owner"];
+        assert_eq!(state.o.as_ref().map(|o| o.at), Some(NOW), "should store the opt-out");
+        assert_eq!(state.ov, vec![uid_hash("v1"), uid_hash("unowned-by-owner")], "should hash what it removed into ov");
+        assert!(state.iv.is_empty(), "should leave iv for invalidations");
+    }
+
+    #[test]
+    fn a_capture_only_opt_out_removes_browser_records_of_its_sources_and_blocks_their_fill() {
+        let mut live = KvEntry::minimal("c.example.com", "browser-c", 1);
+        live.ids.insert("e.example.com".to_owned(), KvPartnerId::new("browser-e"));
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(pid("cap"), opt_out(NOW));
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert!(!applied.entry.ids.contains_key("c.example.com"), "should remove a browser record of its source");
+        assert!(applied.entry.ids.contains_key("e.example.com"), "should leave a source it is not narrowed to");
+
+        let mut refill = IdentityMutation::default();
+        refill.add_change(fill("c.example.com", KvPartnerId::browser("another", Some(NOW))));
+        let applied = run(&refill, &applied.entry).expect("should apply");
+        assert!(!applied.entry.ids.contains_key("c.example.com"), "should skip a browser fill while it is opted out");
+    }
+
+    #[test]
+    fn opt_out_and_clear_ordering() {
+        let live = KvEntry::minimal("b.example.com", "x", 1);
+        let mut same_second = IdentityMutation::default();
+        same_second.merge_state(pid("owner"), ProviderStateChange { opt_out_clear: Some(NOW), ..opt_out(NOW) });
+        let applied = run(&same_second, &live).expect("should apply");
+        assert!(applied.entry.ps["owner"].o.is_some(), "should stay opted out");
+        assert_eq!(applied.entry.ps["owner"].oc, None, "should drop a clear that is not later");
+
+        let mut no_opt_out = IdentityMutation::default();
+        no_opt_out.merge_state(pid("owner"), ProviderStateChange { opt_out_clear: Some(NOW), ..ProviderStateChange::default() });
+        assert!(!run(&no_opt_out, &live).expect("should apply").changed, "should drop a clear with nothing to clear");
+
+        let mut opted = live.clone();
+        opted.ps.insert(
+            "owner".to_owned(),
+            KvProviderState {
+                o: Some(KvOptOut { at: 900, fp: "1".to_owned() }),
+                iv: vec![uid_hash("invalidated")],
+                ov: vec![uid_hash("opted-out")],
+                ..KvProviderState::default()
+            },
+        );
+        let mut clear = IdentityMutation::default();
+        clear.merge_state(pid("owner"), ProviderStateChange { opt_out_clear: Some(NOW), ..ProviderStateChange::default() });
+        let state = &run(&clear, &opted).expect("should apply").entry.ps["owner"];
+        assert_eq!(state.oc, Some(NOW), "should store a later clear");
+        assert!(state.ov.is_empty(), "should empty ov");
+        assert_eq!(state.iv, vec![uid_hash("invalidated")], "should never empty iv");
+
+        let mut older = IdentityMutation::default();
+        older.merge_state(pid("owner"), opt_out(899));
+        assert!(!run(&older, &opted).expect("should apply").changed, "should drop an opt-out not after the live one");
+    }
+
+    #[test]
+    fn fill_missing_is_skipped_when_any_uid_is_in_a_claimants_iv_or_ov() {
+        let mut live = KvEntry::minimal("e.example.com", "x", 1);
+        live.ps.insert("owner".to_owned(), KvProviderState { iv: vec![uid_hash("example-b")], ..KvProviderState::default() });
+        live.ps.insert("other".to_owned(), KvProviderState { ov: vec![uid_hash("removed")], ..KvProviderState::default() });
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("a.example.com", full_record(None, example_entry_set())));
+        mutation.add_change(fill("b.example.com", KvPartnerId::browser("removed", Some(NOW))));
+        mutation.add_change(fill("d.example.com", KvPartnerId::browser("removed", Some(NOW))));
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert!(!applied.entry.ids.contains_key("a.example.com"), "should block an owned set on its second UID");
+        assert!(!applied.entry.ids.contains_key("b.example.com"), "should block an unowned source by its claimant's ov");
+        assert!(applied.entry.ids.contains_key("d.example.com"), "should not block a source no denying provider claims");
+    }
+
+    #[test]
+    fn provider_result_applies_atomically() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert("a.example.com".to_owned(), written("owner", "newer", "3333333333333333"));
+        live.ps.insert("owner".to_owned(), KvProviderState { st: Some(json!({ "token": "B" })), ..KvProviderState::default() });
+        let result = |expected, expected_state| ProviderResult {
+            provider: pid("owner"),
+            ids: vec![PartnerIdChange::OwnerWrite {
+                source: src("a.example.com"),
+                record: KvPartnerId { w: Some("owner".to_owned()), ..KvPartnerId::new("mine") },
+                expected: Some(expected),
+            }],
+            state: ProviderStateChange { st: StateUpdate::Replace(json!({ "token": "A" })), f: Some(0), ..ProviderStateChange::default() },
+            expected_state,
+        };
+
+        let mut lost_id = IdentityMutation::default();
+        lost_id.add_result(result(rev("1111111111111111"), Some(StateRevision::of(Some(&json!({ "token": "B" }))))));
+        let mut lost_state = IdentityMutation::default();
+        lost_state.add_result(result(rev("3333333333333333"), Some(StateRevision::of(Some(&json!({ "token": "A0" }))))));
+        let mut wins = IdentityMutation::default();
+        wins.add_result(result(rev("3333333333333333"), Some(StateRevision::of(Some(&json!({ "token": "B" }))))));
+
+        for (name, mutation) in [("an ID", lost_id), ("the state", lost_state)] {
+            assert!(!run(&mutation, &live).expect("should apply").changed, "should drop the whole result when {name} lost");
+        }
+        let applied = run(&wins, &live).expect("should apply");
+        assert_eq!(applied.entry.ids["a.example.com"].first_uid(), Some("mine"), "should write the ID");
+        assert_eq!(applied.entry.ps["owner"].st, Some(json!({ "token": "A" })), "should write the state with it");
+    }
+
+    #[test]
+    fn refresh_anchor_survives_until_ru_or_state_loss() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId { exp: Some(NOW - 1), ru: Some(NOW + 100), ..written("owner", "expired", "1111111111111111") },
+        );
+        live.ps.insert("owner".to_owned(), KvProviderState { st: Some(json!({ "r": 1 })), ..KvProviderState::default() });
+        let mut unrelated = IdentityMutation::default();
+        unrelated.set_cluster_size(1);
+
+        assert!(run(&unrelated, &live).expect("should apply").entry.ids.contains_key("a.example.com"), "should keep the anchor");
+        live.ps.get_mut("owner").expect("should hold the owner's state").st = None;
+        assert!(!run(&unrelated, &live).expect("should apply").entry.ids.contains_key("a.example.com"), "should drop it");
+    }
+
+    #[test]
+    fn unconfigured_provider_state_keeps_o_oc_and_ov() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        let kept = KvProviderState {
+            o: Some(KvOptOut { at: 7, fp: "1".to_owned() }),
+            oc: Some(6),
+            ov: vec![uid_hash("removed")],
+            ..KvProviderState::default()
+        };
+        live.ps.insert(
+            "retired".to_owned(),
+            KvProviderState { n: Some(5), iv: vec![uid_hash("invalidated")], st: Some(json!(1)), ..kept.clone() },
+        );
+        live.ps.insert("gone".to_owned(), KvProviderState { n: Some(5), ..KvProviderState::default() });
+        live.ps.insert("other".to_owned(), KvProviderState { n: Some(5), ..KvProviderState::default() });
+        let mut mutation = IdentityMutation::default();
+        mutation.set_cluster_size(1);
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert_eq!(applied.entry.ps["retired"], kept, "should keep only o, oc and ov");
+        assert!(!applied.entry.ps.contains_key("gone"), "should drop an entry with none of them");
+        assert_eq!(applied.entry.ps["other"].n, Some(5), "should leave a configured provider untouched");
+    }
+
+    #[test]
+    fn retained_opt_outs_are_pruned_first_when_over_the_state_cap() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ps.insert("other".to_owned(), KvProviderState { n: Some(5), ..KvProviderState::default() });
+        for (at, index) in (100_u64..).zip(0..MAX_PROVIDER_STATES) {
+            live.ps.insert(
+                format!("retired-{index:02}"),
+                KvProviderState { o: Some(KvOptOut { at, fp: "1".to_owned() }), ..KvProviderState::default() },
+            );
+        }
+        let mut mutation = IdentityMutation::default();
+        mutation.set_cluster_size(1);
+
+        let applied = run(&mutation, &live).expect("should apply");
+
+        assert_eq!(applied.entry.ps.len(), MAX_PROVIDER_STATES, "should fit the cap");
+        assert!(applied.entry.ps.contains_key("other"), "should keep the configured provider");
+        assert!(!applied.entry.ps.contains_key("retired-00"), "should drop the oldest retained opt-out");
+        assert!(applied.entry.ps.contains_key("retired-01"), "should keep the newer ones");
+    }
+
+    #[test]
+    fn an_invalid_result_falls_back_to_removals_only() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert("a.example.com".to_owned(), written("owner", "v1", "1111111111111111"));
+        let mut oversized = example_entry_set();
+        oversized[0].ext = Some(json!({ "segments": "x".repeat(2_000) }));
+        oversized[1].ext = Some(json!({ "segments": "y".repeat(2_000) }));
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("d.example.com", full_record(Some("other"), oversized)));
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+
+        let applied = run(&mutation, &live).expect("should apply removals");
+
+        assert!(applied.removals_only, "should fail validation for a set over MAX_ENTRY_SET_BYTES");
+        assert!(!applied.entry.ids.contains_key("d.example.com"), "should drop the set whole, never trim it");
+        assert!(!applied.entry.ids.contains_key("a.example.com"), "should still apply the removal");
+    }
+
+    #[test]
+    fn apply_removals_only_ignores_everything_but_removals() {
+        let mut live = KvEntry::minimal("b.example.com", "x", 1);
+        live.ids.insert("a.example.com".to_owned(), written("owner", "v1", "1111111111111111"));
+        live.ids.insert("d.example.com".to_owned(), KvPartnerId { exp: Some(NOW - 1), ..KvPartnerId::new("expired") });
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(fill("e.example.com", KvPartnerId::browser("new", Some(NOW))));
+        mutation.merge_state(pid("other"), ProviderStateChange { n: Some(5), f: Some(2), ..opt_out(NOW) });
+        mutation.set_cluster_size(3);
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: src("a.example.com"),
+            provider: pid("owner"),
+            expected: rev("1111111111111111"),
+        });
+
+        let applied = run_removals(&mutation, &live).expect("should apply");
+
+        assert!(!applied.entry.ids.contains_key("a.example.com"), "should apply the removal");
+        assert!(!applied.entry.ids.contains_key("e.example.com"), "should ignore a positive change");
+        assert!(applied.entry.ids.contains_key("d.example.com"), "should not prune expired records");
+        let state = &applied.entry.ps["other"];
+        assert_eq!((state.n, state.f), (None, 0), "should never touch n or f");
+        assert!(state.o.is_some(), "should store the opt-out");
+        assert_eq!(applied.entry.network, live.network, "should not touch cluster_size");
+
+        let nothing = IdentityMutation::default();
+        assert!(!run_removals(&nothing, &live).expect("should apply").changed, "should report no change");
+    }
+}
+```
+
+The ordering tests build `ProviderStateChange` with `..opt_out(..)` and `..ProviderStateChange::default()` because they test one field at a time. They are not exhaustiveness tests. Check the field name of `KvEntry`'s network block (`network` above) against `kv_types.rs` and use the real one.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::mutation`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Write `mutation.rs` with the types listed under Interfaces, then implement `apply` and `apply_removals_only` from private steps over a cloned `KvEntry`. Use one function per step so each rule can be read on its own:
+
+```rust
+pub(crate) fn apply(mutation: &IdentityMutation, live: &KvEntry, context: &ApplyContext<'_>) -> Option<Applied> {
+    if !live.consent.ok {
+        return None;
+    }
+
+    let mut entry = live.clone();
+    apply_removals(&mut entry, mutation, context);
+    apply_positive(&mut entry, mutation, context);
+    apply_state(&mut entry, mutation);
+    finish_removal_fields(&mut entry, context);
+    drop_expired_records(&mut entry, context);
+
+    if let Err(message) = entry.validate() {
+        log::warn!("Identity mutation produced an invalid row, keeping removals only: {message}");
+        return apply_removals_only(mutation, live, context).map(|applied| Applied { removals_only: true, ..applied });
+    }
+    let changed = &entry != live;
+    Some(Applied { entry, changed, removals_only: false })
+}
+
+pub(crate) fn apply_removals_only(
+    mutation: &IdentityMutation,
+    live: &KvEntry,
+    context: &ApplyContext<'_>,
+) -> Option<Applied> {
+    if !live.consent.ok {
+        return None;
+    }
+
+    let mut entry = live.clone();
+    apply_removals(&mut entry, mutation, context);
+    finish_removal_fields(&mut entry, context);
+
+    if let Err(message) = entry.validate() {
+        log::warn!("Identity removals produced an invalid row, dropping them: {message}");
+        return None;
+    }
+    let changed = &entry != live;
+    Some(Applied { entry, changed, removals_only: true })
+}
+```
+
+- `apply_removals`: collect every `OwnerRemove` and `WriterRemove` from `partner_ids`. The coordinator always puts removals there, never in `ProviderResult.ids` (spec 5.4's comment on `ProviderResult`). Then the opt-outs and clears from `provider_state` and from each result's `state`, in that order: opt-outs first, then clears, so an opt-out and a clear in the same second leave the provider opted out. Compare revisions with `record_revision(live_record)`. Hash a record with `set_hashes(&live_record.eids)` before removing it, and add the hashes with `push_hashes` to the provider's `iv` (an `OwnerRemove`) or `ov` (a `WriterRemove` or an applied opt-out).
+- `apply_positive`: for each plain change, call `fn change_applies(entry, change, context) -> bool` and, when true, `fn write_change(entry, change, context)`. `change_applies` checks the opted-out rule, the claimant `iv`/`ov` rule and the capture-only rule of step 3 before the change's own rule. `write_change` inserts the change's record in place of the live one, whole, with a fresh `rv` from `new_revision(context.random)` and `at = record.at.or(Some(now))`, and never copies a field from the live record. For each `ProviderResult`, first check that every ID change applies and that `expected_state` is `None` or equals `StateRevision::of(entry.ps[provider].st.as_ref())`. Then apply all of them and the result's `state` together.
+- `apply_state`: merge `provider_state` (`n` = max, `f` replaced when `Some`, `st` per `StateUpdate`) and set the network block's `cluster_size` when given (match the existing `KvNetwork` field).
+- `finish_removal_fields`: truncate each `iv` and `ov` from the front to `MAX_INVALIDATED_UIDS`. For each `ps` entry whose provider the catalog does not hold, keep only `o`, `oc` and `ov`, and drop the entry when all three are empty. While `entry.ps.len() > MAX_PROVIDER_STATES`, remove the retained entry with the oldest `o.at` (an entry without `o` sorts first). Configured providers' entries are never pruned here; if they alone exceed the cap, `validate()` reports it.
+- `drop_expired_records`: drop records with `exp <= now` unless they are anchors: the catalog's owner of that source is configured, and either `entry.ps[owner].st.is_some()` and `record.ru.is_some_and(|ru| now < ru)`, or `record.w` is the owner and `now < exp + grace` for the owner's `Resolves::refresh_grace()`. `Resolves::with_refresh_grace(Duration)` (descriptor.rs) is rejected by `build()` without `ResolveKind::Refresh` or with a zero grace. Tests: `stateless_refresh_anchor_survives_until_exp_plus_grace` and the two `build_rejects_invalid_descriptors` cases (round 14 review).
+
+`IdentityMutation::merge_state(provider, change)` merges into any existing change for the same provider: later `n`, last `f`, the later `opt_out`, the later `opt_out_clear`, and the last non-`Keep` `st`. `IdentityMutation::removals()` copies the `OwnerRemove` and `WriterRemove` changes and, from every `provider_state` entry and every result's `state`, only `opt_out` and `opt_out_clear`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::mutation`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add IdentityMutation and its merge into a live identity row" -m "Removals apply first and are never skipped. An opt-out removes every record its provider wrote, and for a capture-only provider the browser records of its sources, hashing each removed UID into ps.ov; a later clear empties ps.ov. An applied invalidation hashes every UID of the live set into ps.iv, and a fill is skipped when any of its UIDs is in the iv or ov of a provider that claims the source." -m "Stateful results apply atomically, refresh anchors survive while their owner holds state, an unconfigured provider keeps its opt-out and ov, and an invalid row falls back to removals only. apply_removals_only applies a removal-only mutation for the capture removal write and the removal-only retry."
+```
+
+### Task 17: The `ts-eids-s` mirror payload and its size cap
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/mirror.rs`
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: `mirror.rs`
+
+**Interfaces:**
+
+- Consumes: `crate::openrtb::Eid`
+- Produces:
+  - Constants `MIRROR_MAX_VALUE_BYTES = 2048` (the cookie value, after encoding) and `MIRROR_MAX_AGE_SEC = 86_400` (the lifetime of `ts-eids`)
+  - `pub(crate) struct MirrorSource { source: String, provider: Option<IdentityProviderId>, priority: i32, expires_at: Option<u64>, eids: Vec<Eid> }`, with `pub(crate)` fields: one source's servable server entries exactly as bidders receive them (spec 6.2), the provider whose `cookie_priority` ranks it, and the source's earliest `exp`
+  - `pub(crate) enum MirrorRead<'a> { NotRead, Cleared, Servable(&'a [MirrorSource]) }`: what the request's KV read gave. `Cleared` covers consent that denies EID persistence, a tombstone, `consent.ok = false` and a missing row.
+  - `pub(crate) enum MirrorPayload { Value { value: String, max_age: u64 }, Clear }` with `pub(crate) fn to_json(&self) -> serde_json::Value`: `{"value": ..., "max_age": ...}` or `{"clear": true}`
+  - `pub(crate) fn mirror_payload(read: MirrorRead<'_>, now: u64) -> Option<MirrorPayload>`: `None` for `NotRead`, so the response carries no member and the shim leaves the cookie as it is
+
+The rules (spec 6.2):
+
+1. `NotRead` gives `None`. `Cleared` gives `Clear`.
+2. `Servable` keeps every source, in the order given. While the encoded value is over `MIRROR_MAX_VALUE_BYTES`, it leaves out one whole source: the lowest `priority` first, then the largest (the most bytes of compact JSON), then the later in input order. It logs each omission at info with the provider ID and source, never a value. A source is mirrored whole or not at all.
+3. When no source is left, the payload is `Clear`, so the cookie never holds an empty or stale set.
+4. `value` is the unpadded base64url of the compact JSON `{"v":1,"eids":[...]}`, the kept sources' entries in order.
+5. `max_age` is the smaller of `MIRROR_MAX_AGE_SEC` and the time from `now` to the earliest `expires_at` among the kept sources. The servability check has already left out every record with `exp <= now`, so it is at least 1.
+
+The mirror never holds `ps`, a revision, a writer or a timing field. `MirrorSource.eids` is built from the merge's server set after `gate_eids_by_consent` (Task 26), so this module does no consent or servability check of its own.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+#[cfg(test)]
+mod tests {
+    use base64::Engine as _;
+    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+    use serde_json::json;
+
+    use super::*;
+    use crate::openrtb::{Eid, Uid};
+
+    const NOW: u64 = 1_760_000_000;
+
+    fn source(name: &str, priority: i32, expires_at: Option<u64>, ids: &[&str]) -> MirrorSource {
+        MirrorSource {
+            source: name.to_owned(),
+            provider: Some("p".parse().expect("should parse the provider ID")),
+            priority,
+            expires_at,
+            eids: vec![Eid::new(
+                name.to_owned(),
+                ids.iter().map(|id| Uid { id: (*id).to_owned(), atype: Some(1), ext: None }).collect(),
+            )],
+        }
+    }
+
+    fn decode(payload: &MirrorPayload) -> (serde_json::Value, u64) {
+        let MirrorPayload::Value { value, max_age } = payload else {
+            panic!("should hold a value");
+        };
+        let bytes = URL_SAFE_NO_PAD.decode(value).expect("should be unpadded base64url");
+        (serde_json::from_slice(&bytes).expect("should be JSON"), *max_age)
+    }
+
+    #[test]
+    fn no_read_is_absent_and_a_denial_or_empty_set_is_clear() {
+        assert_eq!(mirror_payload(MirrorRead::NotRead, NOW), None, "should leave the cookie as it is");
+        assert_eq!(mirror_payload(MirrorRead::Cleared, NOW), Some(MirrorPayload::Clear), "should clear on a denial");
+        assert_eq!(mirror_payload(MirrorRead::Servable(&[]), NOW), Some(MirrorPayload::Clear), "should clear an empty set");
+        assert_eq!(MirrorPayload::Clear.to_json(), json!({ "clear": true }), "should serialize the clear shape");
+    }
+
+    #[test]
+    fn value_is_the_v1_entries_in_unpadded_base64url() {
+        let sources = [source("example.com", 0, None, &["example-a"])];
+
+        let payload = mirror_payload(MirrorRead::Servable(&sources), NOW).expect("should return a payload");
+
+        let (decoded, max_age) = decode(&payload);
+        assert_eq!(
+            decoded,
+            json!({ "v": 1, "eids": [{ "source": "example.com", "uids": [{ "id": "example-a", "atype": 1 }] }] }),
+            "should hold the entries exactly as bidders receive them"
+        );
+        assert_eq!(max_age, MIRROR_MAX_AGE_SEC, "should live a day without an exp");
+        let MirrorPayload::Value { value, .. } = &payload else { panic!("should hold a value") };
+        assert_eq!(payload.to_json(), json!({ "value": value, "max_age": MIRROR_MAX_AGE_SEC }), "should serialize");
+    }
+
+    #[test]
+    fn max_age_never_outlives_the_earliest_exp() {
+        let sources = [
+            source("a.example.com", 0, Some(NOW + 3_600), &["a"]),
+            source("b.example.com", 0, Some(NOW + 600), &["b"]),
+            source("c.example.com", 0, Some(NOW + 999_999), &["c"]),
+        ];
+
+        let (_, max_age) = decode(&mirror_payload(MirrorRead::Servable(&sources), NOW).expect("should return a payload"));
+
+        assert_eq!(max_age, 600, "should take the earliest exp");
+    }
+
+    #[test]
+    fn an_oversized_set_drops_whole_sources_lowest_priority_then_largest() {
+        let big = |name: &str, priority, count| {
+            let ids: Vec<String> = (0..count).map(|index| format!("{name}-{index:040}")).collect();
+            source(name, priority, None, &ids.iter().map(String::as_str).collect::<Vec<_>>())
+        };
+        let sources = [
+            big("keep-high", 10, 6),
+            big("drop-low-large", 0, 12),
+            big("keep-low-small", 0, 6),
+            big("keep-mid", 5, 6),
+        ];
+
+        let payload = mirror_payload(MirrorRead::Servable(&sources), NOW).expect("should return a payload");
+
+        let MirrorPayload::Value { value, .. } = &payload else { panic!("should hold a value") };
+        assert!(value.len() <= MIRROR_MAX_VALUE_BYTES, "should fit the cap");
+        let (decoded, _) = decode(&payload);
+        let kept: Vec<&str> =
+            decoded["eids"].as_array().expect("should be an array").iter().map(|eid| eid["source"].as_str().expect("should name the source")).collect();
+        assert_eq!(kept, vec!["keep-high", "keep-low-small", "keep-mid"], "should drop the largest lowest-priority source whole");
+    }
+
+    #[test]
+    fn a_set_where_nothing_fits_is_clear() {
+        let ids: Vec<String> = (0..80).map(|index| format!("only-{index:040}")).collect();
+        let sources = [source("only.example.com", 0, None, &ids.iter().map(String::as_str).collect::<Vec<_>>())];
+
+        assert_eq!(
+            mirror_payload(MirrorRead::Servable(&sources), NOW),
+            Some(MirrorPayload::Clear),
+            "should clear rather than keep an empty or partial set"
+        );
+    }
+}
+```
+
+Check the sizes once before Step 3: in `an_oversized_set_drops_whole_sources_lowest_priority_then_largest`, the four sources together must encode to more than 2,048 bytes and the three kept ones to at most 2,048. Adjust the UID counts if the encoding differs, keeping the order of the rule the test pins.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::mirror`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+```rust
+//! The `ts-eids-s` mirror payload: the servable server set for page scripts,
+//! capped to one cookie (spec 6.2). The server never reads the cookie back.
+
+use base64::Engine as _;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use serde_json::json;
+
+use super::ids::IdentityProviderId;
+use crate::openrtb::Eid;
+
+/// Maximum bytes of the encoded cookie value.
+pub(crate) const MIRROR_MAX_VALUE_BYTES: usize = 2048;
+/// Maximum cookie lifetime: that of `ts-eids`.
+pub(crate) const MIRROR_MAX_AGE_SEC: u64 = 86_400;
+
+/// One source's servable server entries, as bidders receive them.
+pub(crate) struct MirrorSource {
+    pub(crate) source: String,
+    /// The provider whose `cookie_priority` ranks the source, for the log.
+    pub(crate) provider: Option<IdentityProviderId>,
+    pub(crate) priority: i32,
+    /// The source's earliest `exp`, in Unix seconds.
+    pub(crate) expires_at: Option<u64>,
+    pub(crate) eids: Vec<Eid>,
+}
+
+/// What the request's KV read gave the mirror.
+pub(crate) enum MirrorRead<'a> {
+    /// No KV read: the response carries no mirror member.
+    NotRead,
+    /// Consent denies EID persistence, or the row is a tombstone, withdrawn
+    /// or missing.
+    Cleared,
+    /// The servable server set, in output order.
+    Servable(&'a [MirrorSource]),
+}
+
+/// The mirror member of an `/auction` or `/_ts/page-bids` response.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum MirrorPayload {
+    Value { value: String, max_age: u64 },
+    Clear,
+}
+
+impl MirrorPayload {
+    /// The JSON the shim reads.
+    #[must_use]
+    pub(crate) fn to_json(&self) -> serde_json::Value {
+        match self {
+            Self::Value { value, max_age } => json!({ "value": value, "max_age": max_age }),
+            Self::Clear => json!({ "clear": true }),
+        }
+    }
+}
+
+fn encode(sources: &[&MirrorSource]) -> String {
+    let eids: Vec<&Eid> = sources.iter().flat_map(|source| &source.eids).collect();
+    let bytes = serde_json::to_vec(&json!({ "v": 1, "eids": eids })).expect("should serialize EIDs");
+    URL_SAFE_NO_PAD.encode(bytes)
+}
+
+fn source_bytes(source: &MirrorSource) -> usize {
+    serde_json::to_vec(&source.eids).map_or(usize::MAX, |bytes| bytes.len())
+}
+
+/// The mirror payload for a request (spec 6.2).
+///
+/// # Performance
+///
+/// Encodes the set once per omission. A set holds at most one entry set per
+/// configured source, so this stays small.
+#[must_use]
+pub(crate) fn mirror_payload(read: MirrorRead<'_>, now: u64) -> Option<MirrorPayload> {
+    let sources = match read {
+        MirrorRead::NotRead => return None,
+        MirrorRead::Cleared => return Some(MirrorPayload::Clear),
+        MirrorRead::Servable(sources) => sources,
+    };
+    let mut kept: Vec<&MirrorSource> = sources.iter().collect();
+    let mut value = encode(&kept);
+    while value.len() > MIRROR_MAX_VALUE_BYTES && !kept.is_empty() {
+        let index = (0..kept.len())
+            .min_by_key(|&index| (kept[index].priority, core::cmp::Reverse(source_bytes(kept[index])), core::cmp::Reverse(index)))
+            .expect("should hold a source");
+        let left_out = kept.remove(index);
+        log::info!(
+            "Leaving source '{}' of provider '{}' out of the ts-eids-s mirror, which exceeds {MIRROR_MAX_VALUE_BYTES} bytes",
+            left_out.source,
+            left_out.provider.as_ref().map_or("none", IdentityProviderId::as_str),
+        );
+        value = encode(&kept);
+    }
+    if kept.is_empty() {
+        return Some(MirrorPayload::Clear);
+    }
+    let max_age = kept
+        .iter()
+        .filter_map(|source| source.expires_at)
+        .map(|exp| exp.saturating_sub(now).max(1))
+        .fold(MIRROR_MAX_AGE_SEC, u64::min);
+    Some(MirrorPayload::Value { value, max_age })
+}
+```
+
+The `Reverse(index)` term makes "the later in input order" the tie-break, so the result never depends on sort stability. Register the module in `mod.rs` (`pub(crate) mod mirror;`) and in `migration_guards.rs`. `base64` is already a dependency of core: Task 9's `HashedEmail::to_base64` uses it.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::mirror`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add the ts-eids-s mirror payload and its size cap" -m "The payload holds the servable server entries as bidders receive them, base64url-encoded, or tells the shim to clear the cookie. A set over 2,048 bytes leaves out whole sources, lowest cookie_priority first, then largest, and max_age never outlives the earliest exp."
+```
+
+---
+
+### Task 18: The shared removal write
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/removal.rs`
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (a crate-visible generation-checked write)
+- Modify: `mod.rs`, `migration_guards.rs`
+- Test: `removal.rs`
+
+**Interfaces:**
+
+- Consumes: `IdentityMutation`, `removals()`, `removal_labels()`, `apply_removals_only`, `ApplyContext` (Task 15), `KvIdentityGraph::load_snapshot`, `EcKvSnapshot`, `MAX_CAS_RETRIES` (`ec/kv.rs:28`)
+- Produces:
+  - `KvIdentityGraph::write_if_generation(&self, ec_id: &str, entry: &KvEntry, generation: u64) -> Result<EcKvWriteOutcome, Report<TrustedServerError>>`, `pub(crate)`: serializes with `serialize_entry` (so `validate` runs) and writes with `ENTRY_TTL` and `EcKvWriteMode::IfGenerationMatch(generation)`. Phase 4's flush (Task 29) uses it too, so every identity write goes through one path.
+  - `pub(crate) const REMOVAL_WRITE_ATTEMPTS: u32 = MAX_CAS_RETRIES;` (5)
+  - `pub enum RemovalWriteOutcome { Written, NothingToWrite, Failed }`. `NothingToWrite` covers a tombstone, `consent.ok = false`, a missing row and removals that are already applied. `Failed` covers a failed read, a store error other than the per-key limit, a per-key limit before send, and five generation mismatches or per-key limits in a row. It is `pub`, not `pub(crate)`, because the public `FlushOutcome::WriteFailed` (Task 29) carries it, and `private_interfaces` would fail the clippy gate otherwise.
+  - `pub(crate) fn write_removals(graph: &KvIdentityGraph, ec_id: &str, removals: &IdentityMutation, context: &ApplyContext<'_>) -> RemovalWriteOutcome`
+  - `pub(crate) fn log_removal_lost(ec_id: &str, removals: &IdentityMutation)`: logs at error with `log_id(ec_id)` and the provider IDs and sources from `removal_labels()`, never a UID. The caller increments `removal_lost` (Task 23 adds the counter to `RequestIdentity`).
+
+This is the CAS loop the header's G4 note names: the capture removal write (spec 5.3, Task 38) and the removal-only retry of a failed flush (spec 5.2, phase 4, step 5; Task 29) both call `write_removals`. The withdrawal tombstone keeps its own loop in `ec/kv.rs` (`tombstone_existing_from_snapshot`, `kv.rs:1349`). Task 27 gives it its after-send attempt.
+
+The loop (spec 5.3):
+
+1. `graph.load_snapshot(ec_id)`. `Missing` gives `NothingToWrite`. `Failed` gives `Failed`. `Present` without a generation is treated as `Failed`, as `upsert_partner_ids_from_snapshot` does (`kv.rs:775-781`).
+2. `apply_removals_only(removals, &entry, context)`. `None` (a tombstone, `consent.ok = false`, or a removals-only row that fails validation) gives `NothingToWrite`. `changed == false` gives `NothingToWrite`: the removals already applied.
+3. `graph.write_if_generation(ec_id, &applied.entry, generation)`. `Written` gives `Written`. `PreconditionFailed` re-reads and goes back to step 1, up to `REMOVAL_WRITE_ATTEMPTS` writes in total. With `RemovalTiming::AfterSend`, an `Err` carrying `EcKvRateLimited` calls `graph.pause(PER_KEY_WRITE_WINDOW)` and is retried the same way. Any other `Err` gives `Failed` at once.
+
+   `write_removals` takes a `RemovalTiming`: `BeforeSend` for the capture write before send and the admin clear, `AfterSend` for the phase 4 removal-only retry and the capture's after-send attempt. `AfterSend` first calls `graph.pause(PER_KEY_WRITE_WINDOW)` (1 second), because the write it follows failed moments ago on the same key. `EcKvStore::pause` defaults to a no-op; the Fastly adapter sleeps, and maps `KVStoreError::TooManyRequests` to an error with an `EcKvRateLimited` attachment. Tests: before send never waits and stops at the limit; after send waits once before writing, waits again and retries a limit, gives up after five, and does not retry other errors; a failed flush waits one window before its removal write, and a written flush never waits.
+
+4. Five `PreconditionFailed` in a row give `Failed`.
+
+`write_removals` runs whatever the request's consent: a revocation can arrive when consent is unusable. It does not log a lost removal itself, because a capture tries once more after send (Task 38) before the removal counts as lost. `removals` must hold only removals, opt-outs and clears: callers pass `mutation.removals()`. `apply_removals_only` ignores anything else anyway.
+
+First add to Task 15's `IdentityMutation`: `pub(crate) fn removal_labels(&self) -> Vec<(IdentityProviderId, Option<SourceDomain>)>`, one pair per `OwnerRemove` (its provider and source), `WriterRemove` (its writer and source), opt-out and clear (the provider, no source), sorted and de-duplicated. Add a unit test for it to `mutation.rs`.
+
+- [ ] **Step 1: Write the failing tests**
+
+The tests drive `write_removals` against the in-memory store with generation tracking, `InMemoryEcKv` (`ec/kv_backend.rs:316`), and a local wrapper modelled on `ConflictInjectingEcKv` (`ec/kv.rs:1877`) that fails the first `n` generation-checked writes with `PreconditionFailed`, or every write with an error. Count writes the way `RecordingEcKv` (`ec/kv.rs:3449`) does.
+
+```rust
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use super::*;
+    use crate::ec::identity::catalog::ProviderCatalog;
+    use crate::ec::identity::input::SeededRandom;
+    use crate::ec::identity::mutation::{PartnerIdChange, ProviderStateChange};
+    use crate::ec::identity::revision::{RecordRevision, Revision};
+    use crate::ec::identity::test_support::fixed_provider;
+    use crate::ec::kv_types::{KvEntry, KvOptOut, KvPartnerId};
+
+    const EC_ID: &str = "0000000000000000000000000000000000000000000000000000000000000000.ABC123";
+
+    /// Fails the first `conflicts` generation-checked writes with
+    /// `PreconditionFailed`, or every write with an error when `error` is set.
+    struct ScriptedEcKv { /* inner: InMemoryEcKv, conflicts, error, writes */ }
+
+    /// Seeds `entry` with `create`, then wraps the store. Outline only:
+    /// write the body after `ConflictInjectingEcKv` (`ec/kv.rs:1877`).
+    fn graph_with(entry: Option<&KvEntry>, conflicts: u32, error: bool) -> (KvIdentityGraph, Arc<ScriptedEcKv>);
+
+    fn removal() -> IdentityMutation {
+        let mut mutation = IdentityMutation::default();
+        mutation.add_change(PartnerIdChange::OwnerRemove {
+            source: "a.example.com".parse().expect("should parse the source"),
+            provider: "owner".parse().expect("should parse the provider ID"),
+            expected: Revision::Set(RecordRevision::from_stored("1111111111111111")),
+        });
+        mutation
+    }
+
+    fn live() -> KvEntry {
+        let mut entry = KvEntry::minimal("b.example.com", "x", 1);
+        entry.ids.insert(
+            "a.example.com".to_owned(),
+            KvPartnerId { w: Some("owner".to_owned()), rv: Some("1111111111111111".to_owned()), ..KvPartnerId::new("u") },
+        );
+        entry
+    }
+
+    fn run(graph: &KvIdentityGraph, removals: &IdentityMutation) -> RemovalWriteOutcome {
+        let random = SeededRandom::new(1);
+        let catalog = ProviderCatalog::new(
+            vec![fixed_provider("owner", &["a.example.com"])],
+            [("a.example.com".parse().expect("should parse the source"), "owner".parse().expect("should parse the provider ID"))]
+                .into_iter()
+                .collect(),
+        );
+        write_removals(graph, EC_ID, removals, &ApplyContext { now: 1_000, random: &random, catalog: &catalog })
+    }
+
+    #[test]
+    fn writes_the_removal_once_with_a_generation_check() {
+        let (graph, store) = graph_with(Some(&live()), 0, false);
+
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::Written, "should write");
+
+        assert_eq!(store.generation_checked_writes(), 1, "should write once, with IfGenerationMatch");
+        let (entry, _) = graph.get(EC_ID).expect("should read").expect("should hold the row");
+        assert!(!entry.ids.contains_key("a.example.com"), "should remove the record");
+        assert_eq!(entry.ps["owner"].iv.len(), 1, "should hash the removed UID into iv");
+    }
+
+    #[test]
+    fn retries_only_a_generation_mismatch_up_to_five_writes() {
+        let (graph, store) = graph_with(Some(&live()), 2, false);
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::Written, "should win on the third write");
+        assert_eq!(store.generation_checked_writes(), 3, "should re-read and retry each conflict");
+
+        let (graph, store) = graph_with(Some(&live()), 5, false);
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::Failed, "should give up after five conflicts");
+        assert_eq!(store.generation_checked_writes(), 5, "should stop at five writes");
+
+        let (graph, store) = graph_with(Some(&live()), 0, true);
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::Failed, "should stop at a non-CAS error");
+        assert_eq!(store.generation_checked_writes(), 1, "should not retry a non-CAS error");
+    }
+
+    #[test]
+    fn writes_nothing_for_a_tombstone_a_missing_row_or_an_applied_removal() {
+        let (graph, store) = graph_with(Some(&KvEntry::tombstone(1)), 0, false);
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::NothingToWrite, "should skip a tombstone");
+
+        let (graph, _) = graph_with(None, 0, false);
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::NothingToWrite, "should skip a missing row");
+
+        let (graph, _) = graph_with(Some(&KvEntry::minimal("b.example.com", "x", 1)), 0, false);
+        assert_eq!(run(&graph, &removal()), RemovalWriteOutcome::NothingToWrite, "should skip an applied removal");
+        assert_eq!(store.generation_checked_writes(), 0, "should not write a tombstone");
+    }
+
+    #[test]
+    fn an_opt_out_and_its_clear_are_written_without_positive_changes() {
+        let (graph, _) = graph_with(Some(&live()), 0, false);
+        let mut mutation = IdentityMutation::default();
+        mutation.merge_state(
+            "owner".parse().expect("should parse the provider ID"),
+            ProviderStateChange { opt_out: Some(KvOptOut { at: 1_000, fp: "1".to_owned() }), ..ProviderStateChange::default() },
+        );
+
+        assert_eq!(run(&graph, &mutation.removals()), RemovalWriteOutcome::Written, "should write the opt-out");
+
+        let (entry, _) = graph.get(EC_ID).expect("should read").expect("should hold the row");
+        assert!(entry.ps["owner"].o.is_some(), "should store o");
+        assert!(!entry.ids.contains_key("a.example.com"), "should remove what the provider wrote");
+    }
+}
+```
+
+The `ScriptedEcKv` and `graph_with` bodies above are outlines: write them in full, after `ConflictInjectingEcKv`. Keep the `ProviderStateChange` struct update syntax: these tests set one field.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::removal`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+In `ec/kv.rs`, next to `upsert_partner_ids_from_snapshot`:
+
+```rust
+    /// Writes `entry` only if the row is still at `generation`.
+    ///
+    /// The identity removal write and the phase 4 flush share this path, so
+    /// every identity write is validated and generation-checked.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `entry` does not serialize or validate, or the
+    /// store write fails for a reason other than a generation mismatch.
+    pub(crate) fn write_if_generation(
+        &self,
+        ec_id: &str,
+        entry: &KvEntry,
+        generation: u64,
+    ) -> Result<EcKvWriteOutcome, Report<TrustedServerError>> {
+        let (body, metadata) = Self::serialize_entry(entry, self.store_name())?;
+        self.write_entry(ec_id, &body, &metadata, ENTRY_TTL, EcKvWriteMode::IfGenerationMatch(generation))
+    }
+```
+
+`removal.rs`:
+
+```rust
+//! The shared removal write: a removal-only mutation written with the
+//! withdrawal path's CAS loop (spec 5.2 phase 4, 5.3).
+
+use super::ids::SourceDomain;
+use super::mutation::{ApplyContext, IdentityMutation, apply_removals_only};
+use crate::ec::kv::{EcKvSnapshot, KvIdentityGraph, MAX_CAS_RETRIES};
+use crate::ec::kv_backend::EcKvWriteOutcome;
+use crate::ec::log_id;
+
+/// Writes the removal write makes at most, as the withdrawal path does.
+pub(crate) const REMOVAL_WRITE_ATTEMPTS: u32 = MAX_CAS_RETRIES;
+
+/// How a removal write ended.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RemovalWriteOutcome {
+    /// The removals are in KV.
+    Written,
+    /// Nothing to write: a tombstone, a missing row, or already applied.
+    NothingToWrite,
+    /// Not written. The caller may try once more after send.
+    Failed,
+}
+
+/// Reads the row, applies only `removals` and writes them with a CAS,
+/// retrying only a generation mismatch.
+#[must_use]
+pub(crate) fn write_removals(
+    graph: &KvIdentityGraph,
+    ec_id: &str,
+    removals: &IdentityMutation,
+    context: &ApplyContext<'_>,
+) -> RemovalWriteOutcome {
+    for _attempt in 0..REMOVAL_WRITE_ATTEMPTS {
+        let (entry, generation) = match graph.load_snapshot(ec_id) {
+            EcKvSnapshot::Present { entry, generation: Some(generation), .. } => (entry, generation),
+            EcKvSnapshot::Missing { .. } => return RemovalWriteOutcome::NothingToWrite,
+            _ => return RemovalWriteOutcome::Failed,
+        };
+        let Some(applied) = apply_removals_only(removals, &entry, context).filter(|applied| applied.changed) else {
+            return RemovalWriteOutcome::NothingToWrite;
+        };
+        match graph.write_if_generation(ec_id, &applied.entry, generation) {
+            Ok(EcKvWriteOutcome::Written) => return RemovalWriteOutcome::Written,
+            Ok(EcKvWriteOutcome::PreconditionFailed) => {}
+            Err(error) => {
+                log::warn!("Identity removal write failed for '{}': {error:?}", log_id(ec_id));
+                return RemovalWriteOutcome::Failed;
+            }
+        }
+    }
+    log::warn!(
+        "Identity removal write for '{}': CAS conflict after {REMOVAL_WRITE_ATTEMPTS} attempts",
+        log_id(ec_id)
+    );
+    RemovalWriteOutcome::Failed
+}
+
+/// Logs a removal that every attempt failed to write. Names providers and
+/// sources only, never a UID.
+pub(crate) fn log_removal_lost(ec_id: &str, removals: &IdentityMutation) {
+    for (provider, source) in removals.removal_labels() {
+        log::error!(
+            "Identity removal lost for '{}': provider '{provider}', source '{}'",
+            log_id(ec_id),
+            source.as_ref().map_or("*", SourceDomain::as_str),
+        );
+    }
+}
+```
+
+Check the real import paths of `EcKvSnapshot`, `EcKvWriteOutcome`, `MAX_CAS_RETRIES` and `log_id` against `ec/kv.rs`, and make `MAX_CAS_RETRIES` `pub(crate)` if it is private. Register the module in `mod.rs` (`pub(crate) mod removal;`) and in `migration_guards.rs`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::removal` and `cargo test-fastly -- ec::identity::mutation`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec
+git commit --signoff -S -m "Add the shared identity removal write" -m "A removal-only mutation is read, applied and written with the withdrawal path's CAS loop: up to five attempts, retrying only a generation mismatch. It writes nothing for a tombstone, a missing row or a removal that already applied. The capture removal write and the removal-only retry of a failed flush both use it."
+```
+
+---
+
+### Task 19: `[ec.identity]` settings
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs` (`IdentitySettings`, `ProviderSettings`, `ProviderMode` and `RevokeScope` added next to `Ec` at about line 542; `Ec.identity`; `Ec.pull_sync_concurrency` removed)
+- Modify: `crates/trusted-server-core/src/config.rs` (`validate_identity_settings` and `validate_removed_keys`, called from both validators)
+- Modify: `crates/trusted-server-core/src/ec/pull_sync.rs` (reads `[ec.identity].max_concurrency` until Task 29 removes it), `crates/trusted-server-core/src/config_payload.rs` (the round-trip test at about line 294)
+- Modify: `trusted-server.example.toml` (line 83), `crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml` (line 15), the Viceroy configs generated from it (`scripts/generate-integration-viceroy-configs.sh`), and `docs/guide/configuration.md` (the `pull_sync_concurrency` row at about line 646)
+- Test: `settings.rs`, `config.rs`, and the CLI overlay test `crates/trusted-server-cli/tests/config_env_overlay.rs`, which reads the integration fixture
+
+**Interfaces:**
+
+- Produces, all in `settings.rs` unless noted:
+  - `IdentitySettings { max_concurrency: usize, hold_budget_ms: u64, hold_retry_sec: u64, max_response_bytes: usize, providers: BTreeMap<String, ProviderSettings> }`, deriving `Debug, Clone, Deserialize, Serialize` (the settings envelope serializes `Ec`), with spec 10.1's defaults: 4, 100, 300 and 65,536
+  - A hand-written `impl Default for IdentitySettings` that calls the same `default_*` functions the serde attributes name. A derived `Default` would give `hold_budget_ms = 0` and the other zeros, which disagree with the serde defaults and fail validation.
+  - `ProviderSettings { mode: ProviderMode, timeout_ms: Option<u64>, after_send_timeout_ms: u64, sources: Option<Vec<String>>, refresh_after_sec: u64, max_calls_per_minute: u32, breaker_failures_per_minute: u32, cookie_priority: i32, revoke_scope: Option<RevokeScope> }`, with the same hand-written `impl Default`. Defaults: `AfterSend`, none, 1,000, none, 86,400, 1, 50, 0, none.
+  - `enum ProviderMode { Hold, AfterSend }`, serde `snake_case`, default `AfterSend`
+  - `pub enum RevokeScope { Provider, Global }`, serde `snake_case`, no `Default` derive: an unset value is `None`, and `ProviderSettings::revoke_scope(&self) -> RevokeScope` supplies `Provider`. Nothing in Part 1 reads it. Task 38 applies it.
+  - `ProviderSettings::hold_timeout_ms(&self, identity: &IdentitySettings) -> u64`: `timeout_ms`, else `hold_budget_ms`. The coordinator caps it at the remaining hold budget (Task 37). Any dispatch after send uses `after_send_timeout_ms`, including a hold-mode provider on a navigation that runs no auction (spec 10.1).
+  - `IdentitySettings::provider(&self, id: &IdentityProviderId) -> ProviderSettings`, which returns the defaults when there is no table. Task 22 adds `provider_with_base` beside it without changing this signature.
+  - `Ec.identity: IdentitySettings` with `#[serde(default)]`
+  - `Ec.pull_sync_concurrency` is removed. In its place, `#[serde(default, rename = "pull_sync_concurrency", skip_serializing)] pub removed_pull_sync_concurrency: Option<serde_json::Value>` catches the key, so `deny_unknown_fields` does not reject it with a generic message, and validation names its replacement instead.
+  - In `config.rs`: `pub(crate) fn validate_identity_settings(settings: &IdentitySettings) -> Result<(), Report<TrustedServerError>>`, covering the numeric rules of spec 10.2: `hold_budget_ms <= 1000`, `max_concurrency != 0`, `refresh_after_sec > 0`, `after_send_timeout_ms` in `1..=10_000`, and `timeout_ms <= hold_budget_ms` for a hold-mode provider. A `mode` or `revoke_scope` that is not one of its values fails to parse, so serde enforces those rules. Rules that need descriptors (an unknown provider ID, `revoke_scope` for a provider without `captures`) live in Task 22's `validate_identity_catalog`, which Task 33 extends.
+  - In `config.rs`: `pub(crate) fn validate_removed_keys(settings: &Settings) -> Result<(), Report<TrustedServerError>>`. In this task it rejects `ec.pull_sync_concurrency` with an error naming `[ec.identity].max_concurrency`. Task 22 adds `pull_sync_ttl_sec` and `pull_sync_rate_limit` on `[[ec.partners]]`.
+
+Spec 10.2 removes the key outright instead of deprecating it, so there is no fallback and no warning: `effective_max_concurrency` and its legacy argument do not exist. Every config that sets the key fails validation until it moves the value, and the error says where.
+
+- [ ] **Step 1: Write the failing tests**
+
+In the `settings.rs` test module (each name starts with `identity_settings_`, so one filter runs them all):
+
+```rust
+    #[test]
+    fn identity_settings_defaults_without_any_table() {
+        let settings: IdentitySettings = toml::from_str("").expect("should parse an empty table");
+        assert_eq!(settings.max_concurrency, 4, "should default the concurrency to 4");
+        assert_eq!(settings.hold_budget_ms, 100, "should default the hold budget to 100 ms");
+        assert_eq!(settings.hold_retry_sec, 300, "should default the hold retry to 300 s");
+        assert_eq!(settings.max_response_bytes, 65_536, "should default the response cap to 64 KiB");
+        let provider = settings.provider(&"anything".parse().expect("should parse the provider id"));
+        assert_eq!(provider.mode, ProviderMode::AfterSend, "should default to after-send mode");
+        assert_eq!(provider.after_send_timeout_ms, 1000, "should default the after-send timeout to 1 s");
+        assert_eq!(provider.hold_timeout_ms(&settings), 100, "should default the hold timeout to the budget");
+        assert_eq!(
+            (provider.refresh_after_sec, provider.max_calls_per_minute, provider.breaker_failures_per_minute, provider.cookie_priority),
+            (86_400, 1, 50, 0),
+            "should use the spec 10.1 provider defaults"
+        );
+        assert_eq!(provider.revoke_scope(), RevokeScope::Provider, "should scope revokes to the provider by default");
+        validate_identity_settings(&settings).expect("should accept the defaults");
+    }
+
+    #[test]
+    fn identity_settings_default_matches_an_empty_table() {
+        let parsed: IdentitySettings = toml::from_str("").expect("should parse an empty table");
+        assert_eq!(
+            serde_json::to_value(IdentitySettings::default()).expect("should serialize the default"),
+            serde_json::to_value(parsed).expect("should serialize the parsed value"),
+            "should give Default the serde defaults, not zeros"
+        );
+        let provider: ProviderSettings = toml::from_str("").expect("should parse an empty provider table");
+        assert_eq!(
+            serde_json::to_value(ProviderSettings::default()).expect("should serialize the default"),
+            serde_json::to_value(provider).expect("should serialize the parsed value"),
+            "should give the provider Default the serde defaults"
+        );
+    }
+
+    #[test]
+    fn identity_settings_timeouts_and_bounds_are_enforced() {
+        let settings: IdentitySettings = toml::from_str(
+            "hold_budget_ms = 120\n[providers.id5]\nmode = \"hold\"\nafter_send_timeout_ms = 2500\n",
+        )
+        .expect("should parse a hold-mode table");
+        let provider = settings.provider(&"id5".parse().expect("should parse the provider id"));
+        assert_eq!(provider.hold_timeout_ms(&settings), 120, "should use the budget as the hold timeout");
+        assert_eq!(provider.after_send_timeout_ms, 2500, "should read the after-send timeout");
+        validate_identity_settings(&settings).expect("should accept a 2.5 s after-send timeout");
+
+        for (name, toml_text) in [
+            ("budget over 1000", "hold_budget_ms = 1001"),
+            ("zero concurrency", "max_concurrency = 0"),
+            ("zero refresh", "[providers.p]\nrefresh_after_sec = 0"),
+            ("zero after-send timeout", "[providers.p]\nafter_send_timeout_ms = 0"),
+            ("after-send timeout over 10 s", "[providers.p]\nafter_send_timeout_ms = 10001"),
+            ("hold timeout over budget", "[providers.p]\nmode = \"hold\"\ntimeout_ms = 101"),
+        ] {
+            let settings: IdentitySettings = toml::from_str(toml_text).expect("should parse before validation");
+            validate_identity_settings(&settings).expect_err(&format!("should reject {name}"));
+        }
+        let edge: IdentitySettings = toml::from_str("[providers.p]\nafter_send_timeout_ms = 10000")
+            .expect("should parse the upper bound");
+        validate_identity_settings(&edge).expect("control: should accept exactly 10 s");
+        toml::from_str::<IdentitySettings>("[providers.p]\nmode = \"sometimes\"").expect_err("should reject an unknown mode");
+        toml::from_str::<IdentitySettings>("[providers.p]\nrevoke_scope = \"everyone\"").expect_err("should reject an unknown revoke scope");
+    }
+
+    #[test]
+    fn identity_settings_revoke_scope_parses_and_keeps_its_default_when_unset() {
+        let settings: IdentitySettings =
+            toml::from_str("[providers.lockr]\nrevoke_scope = \"global\"\n").expect("should parse the revoke scope");
+        let lockr = settings.provider(&"lockr".parse().expect("should parse the provider id"));
+        assert_eq!(lockr.revoke_scope(), RevokeScope::Global, "should read a global revoke scope");
+        let other = settings.provider(&"other".parse().expect("should parse the provider id"));
+        assert_eq!(other.revoke_scope(), RevokeScope::Provider, "control: another provider should keep the provider scope");
+        toml::from_str::<IdentitySettings>("[providers.lockr]\ncapture_enabled = true\n")
+            .expect("should still load a key this build does not know");
+    }
+```
+
+Core already has `toml` as a dependency (`crates/trusted-server-core/Cargo.toml`), so the tests parse with `toml::from_str`. The last assertion pins the lenient tables: a provider table holding a key this build does not know still loads, so a rollback from a later Part keeps loading its config. `capture_enabled` was a key of earlier spec revisions and is the example.
+
+Also in `settings.rs` tests, add `identity_settings_ec_without_identity_table_parses`: a full settings TOML with no `[ec.identity]`, loaded the way the existing `Ec` tests do, gets the defaults.
+
+In `config.rs` tests, add `removed_pull_sync_concurrency_is_rejected_with_its_replacement`: settings with `ec.pull_sync_concurrency = 3` parse, then fail both validators with an error whose text contains `[ec.identity].max_concurrency`. The control, the same settings with `[ec.identity] max_concurrency = 3` instead, passes.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- identity_settings` and `cargo test-fastly -- config::tests::removed_pull_sync_concurrency`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Add `IdentitySettings`, `ProviderSettings`, `ProviderMode` and `RevokeScope` in `settings.rs` next to `Ec`, with each field under `#[serde(default = "...")]` and the hand-written `Default` impls. Do not move these types to another file.
+
+`IdentitySettings` and `ProviderSettings` stay lenient: no `#[serde(deny_unknown_fields)]`, unlike the rest of `settings.rs`, so a rollback to an earlier Part still loads a config written for a later one (spec 14). Add `Ec.identity`:
+
+```rust
+    /// Server-side identity provider policy (`[ec.identity]`).
+    #[serde(default)]
+    pub identity: IdentitySettings,
+```
+
+Replace `Ec.pull_sync_concurrency` and `Ec::default_pull_sync_concurrency` with the catch field from Interfaces, documented as removed and rejected by validation. In `ec/pull_sync.rs`, read `settings.ec.identity.max_concurrency.max(1)` where it read `settings.ec.pull_sync_concurrency.max(1)` (`pull_sync.rs:184`), and move its tests' `settings.ec.pull_sync_concurrency = N` to `settings.ec.identity.max_concurrency = N`. Task 29 removes the file. Fix `config_payload.rs:294` to compare `ec.identity.max_concurrency`.
+
+With the new defaults, the serialized `Ec` holds every `[ec.identity]` default, so whole-config snapshot, envelope-hash and CLI snapshot tests change. Update their expected values in this task and name them in the commit body.
+
+Call `validate_identity_settings(&settings.ec.identity)` and `validate_removed_keys(settings)` from both `validate_settings_for_deploy` (`config.rs:249`) and `validate_settings_for_runtime` (`config.rs:270`), next to `PartnerRegistry::...`.
+
+Every config that sets the removed key must move it in this task:
+
+- `trusted-server.example.toml` (line 83): replace `pull_sync_concurrency = 3` with an `[ec.identity]` table holding `max_concurrency = 3`. Add spec 10.1's other `[ec.identity]` keys and one commented `[ec.identity.providers.<id>]` table (with `after_send_timeout_ms`, `cookie_priority` and `revoke_scope`) as a commented block, with `example.com` partner names.
+- `crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml` (line 15), which the parity tests, `src/bin/generate-viceroy-config.rs` and the CLI overlay test read: the same change. Then regenerate the Viceroy configs with `scripts/generate-integration-viceroy-configs.sh`.
+- `docs/guide/configuration.md`: replace the `pull_sync_concurrency` row with an `[ec.identity]` section that lists the keys and defaults of spec 10.1. Task 31 adds the rest of the docs.
+
+The example-config and CLI template tests must keep passing (`grep -rn "trusted-server.example.toml" crates/ --include=*.rs`); run `./scripts/test-cli.sh` for the CLI ones.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- identity_settings`, `cargo test-fastly -- settings`, `cargo test-fastly -- config::`, `cargo test-fastly -- ec::pull_sync`, `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity` and `./scripts/test-cli.sh`
+Expected: PASS. A config with no `[ec.identity]` still loads with the defaults. A config with `ec.pull_sync_concurrency` is rejected with an error that names its replacement.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/ trusted-server.example.toml docs/guide/configuration.md
+git commit --signoff -S -m "Add [ec.identity] coordinator settings" -m "Adds coordinator policy and per-provider tables, including after_send_timeout_ms and revoke_scope. ec.pull_sync_concurrency is removed: a config that sets it fails validation with an error naming [ec.identity].max_concurrency, and the example config and the integration fixture move their value there."
+```
+
+---
+
+### Task 20: Coordinator eligibility and outcomes
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/coordinator.rs` (pure logic only in this task)
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs`, `mod.rs`, `migration_guards.rs`
+- Test: `coordinator.rs`
+
+**Interfaces:**
+
+- Consumes: catalog, servable, mutation, revision, settings, policy (Tasks 12 to 19), and `entry_sets`, `EntrySets` and `EntrySet` (Task 10)
+- Produces:
+  - `pub(crate) struct EligibilityView`, the view of spec 4.7, built by `EligibilityView::from_kv(entry: &KvEntry) -> Self` from the row the request read, and nothing else. It holds the per-source records (whole `KvPartnerId`s) and, per provider, `n`, `f`, `o`, `oc`, `iv`, `ov` and the `st` the call reads. It never reads `ts-eids-s`: every removal is already in KV (spec 5.3).
+  - `EligibilityView::is_opted_out(&self, provider: &IdentityProviderId) -> bool`: `o` is set and `oc` is not strictly later than `o.at`
+  - `pub(crate) struct RequestFacts { is_real_browser, ec_persistence_allowed, policy_signals: PolicySignals, writer: bool, new_visitor: bool, runs_auction: bool, now: UnixTime, available_inputs: BTreeSet<Input> }`
+  - `pub(crate) enum Phase { Hold, AfterSend }`
+  - `pub(crate) enum Eligibility { Eligible { kinds: BTreeMap<SourceDomain, ResolveKind> }, Skip(SkipReason) }`, with a `SkipReason` enum naming each of steps 1 to 7 (step 6, the breaker, is Task 35's; step 8, the burst cap, is checked at dispatch)
+  - `pub(crate) struct EligibilityInput<'a> { provider: &'a dyn IdentityProvider, settings: &'a ProviderSettings, identity: &'a IdentitySettings, catalog: &'a ProviderCatalog, consent: &'a ConsentContext }`, so `eligibility` stays within 7 arguments
+  - `pub(crate) fn eligibility(input: &EligibilityInput<'_>, view: &EligibilityView, facts: &RequestFacts, phase: Phase) -> Eligibility`
+  - `pub(crate) fn fingerprint_bits(policy: &ConsentPolicy, consent: &ConsentContext, signals: PolicySignals) -> String`: the consent an opt-out's `fp` records, as a plain lowercase hex bitmask of at most 16 digits (`format!("{bits:x}")` of a `u64`), never a hash (spec 8, 9.3). Part 1 covers the signals TS decodes today, one bit each in this order: each TCF purpose the policy reads (1 to 10), the vendor bit when the policy names one, the US sale opt-out (from `us_privacy` or GPP), GPC and DNT. A signal the policy relaxes stays 0. Task 34 appends the sharing and targeted-advertising opt-outs after these and keeps these bits where they are.
+  - `pub(crate) enum CallOutcome { Resolved(Resolution), Skipped, InputUnavailable, InvalidState(Option<Resolution>), HoldCutOff, InputFailure, TransportFailure, BreakerOpen, BurstCapped, NotDispatched }`. `BurstCapped` is the burst cap's skip; `NotDispatched` is a limiter error's
+  - `pub(crate) fn outcome_to_changes(provider: &dyn IdentityProvider, outcome: CallOutcome, view: &EligibilityView, context: &OutcomeContext<'_>) -> OutcomeChanges`, where `OutcomeChanges { changes: Vec<PartnerIdChange>, result: Option<ProviderResult>, state: ProviderStateChange }`. This is the section 8 table, row by row. `changes` holds every removal, and the positive changes of a provider without private state. `OutcomeContext` holds `now`, `catalog`, provider settings, `identity` settings, `expected_state: Option<StateRevision>` and the consent fingerprint bits from `fingerprint_bits`.
+
+Eligibility steps, in order (spec 4.7):
+
+1. `facts.is_real_browser`
+2. `facts.ec_persistence_allowed`
+3. `policy_allows(descriptor.consent_policy(), consent, facts.policy_signals)`
+4. Per-source kinds, over `catalog.sources_of(provider)`:
+   - **Owned by this provider.** `Initial` when there is no record. `Refresh` when there is one and it is due: expired, written by someone else, `ra` passed, or no `ra` and `at + refresh_after_sec` passed or `at` missing. A browser-seeded record any of whose UIDs hashes into the provider's `iv` is never due (spec 7.2). An expired refresh anchor (spec 5.4) is a stored record, so its kind stays `Refresh`.
+   - **Unowned.** `Initial` only, and only when KV has no unexpired ID for the source. An expired record, or one whose writer is disabled or no longer configured, counts as absent. This is not the servability check: a record hidden only by this request's consent or by an opt-out still counts as present, because `FillMissing` would not replace it and the call would be wasted.
+   - A source whose kind the provider does not list, or whose needs (`resolves.needs(kind)`) are not in `facts.available_inputs`, is left out. No sources left means skip, logged at debug.
+5. `n` has passed, and `view.is_opted_out(provider)` is false.
+6. (Breaker: Task 35. Part 1 has no breaker.)
+7. Writer and mode:
+   - No provider runs when `facts.new_visitor` or when `!facts.writer`: stagers run no resolving provider in either mode (spec 5.1).
+   - `Phase::Hold` needs `settings.mode == Hold` and `facts.runs_auction`.
+   - `Phase::AfterSend` needs `settings.mode == AfterSend`, or `settings.mode == Hold` and `!facts.runs_auction`: a hold-mode provider on a writer navigation that runs no auction runs after send instead (spec 4.7 step 7), with `after_send_timeout_ms`.
+
+How `Resolved(resolution)` becomes changes (spec 4.5, "From entries to an entry set", and spec 8):
+
+1. Drop entries for sources the provider does not claim after narrowing (`catalog.sources_of`). Log each with the provider ID and source only.
+2. Call `entry_sets(&kept, context.now)` (Task 10). It groups the rest by source in order and applies every limit of spec 4.5. Log each `EntryDrop` and each `oversized` source with the provider ID, source and field only, never a value.
+3. A source listed in `oversized` has a **discarded set**. A source whose every entry `entry_sets` dropped is absent from `sets`, so the result does not name it and its stored set is left as it is. A set of an expiring source that carries no expiry keeps the stored `exp` when its entries equal the stored `eids`, and is a discarded set otherwise.
+4. For a provider with private state, any discarded set rejects the result's positive part whole, exactly as an oversized `replacing_state` does: no `ProviderResult`, `st` unchanged, `f` and `n` as for `Malformed`. The result's removals still apply. For a provider without private state, a discarded set leaves that source's stored record as it is, as if the result did not name the source, and every other set is kept.
+5. A result that named at least one source and all of whose sets are discarded is handled as `Malformed` (spec 4.5, section 8): `f += 1` with its backoff, and its removals still apply. Timing comes only from kept entries (Task 10).
+6. `EntrySet.refresh_until` from a provider without private state is ignored with a warning.
+7. Each kept set becomes `KvPartnerId { w: Some(provider), at: Some(now), exp, ra, ru, eids: set.entries, .. }`, with `exp`, `ra` and `ru` from the `EntrySet`. A one-UID result writes the same one-entry shape browser ingest writes. Descriptor provenance is not stored: Task 28 fills it in at output.
+   7a. A `Resolution::found` that steps 4, 5 and 12 do not turn into `Malformed` sets `f = 0`, even when `entry_sets` dropped every entry and nothing is stored. It sets `f = 0` in the state it writes, in the `ProviderResult` for a provider with private state and in `state` otherwise.
+8. Each record becomes `OwnerWrite` with `expected = Some(record_revision(stored))` (or `None` when no record) when this provider owns the source, else `FillMissing`. Either change replaces the source's set whole. A source the result does not name gets no change.
+9. `invalidated` becomes `OwnerRemove { source, provider, expected: record_revision(stored) }` for each named source that has a record in the view, plus `n = now`. It carries no hash: `mutation::apply` (Task 15) hashes every UID of the live record it removes into the provider's `ps.iv`. A named source with no record makes no change.
+10. `opted_out` becomes `WriterRemove { source, writer: provider }` for every source in the view whose record this provider wrote, and, for a capture-only provider, for every one of its `capture_only_sources` whose record has no writer. Plus `opt_out = KvOptOut { at: now, fp: fingerprint_bits }` and `st = Clear`. The mutation hashes each removed record into `ps.ov`.
+11. When the provider has private state, the positive changes plus the state change plus `n` and `f` go into one `ProviderResult` with `expected_state`. Otherwise they go into `changes`, and `n` and `f` into `state`.
+12. `state_rejected()` drops the positive part and applies the `Malformed` backoff.
+13. `with_retry_in` on any resolution, not only `no_match`: after steps 1 to 12 set `n`, raise it to `max(n, now + retry_in)`, with `retry_in` capped at 7 d. A `found`, `invalidate` or `opted_out` with no `n` of its own gets `n = now + retry_in`.
+
+The other rows of section 8: `Skipped` and `InputUnavailable` set `n = now + refresh_after_sec`. `BurstCapped` sets `n = max(n, now + 60)` and never counts a failure (spec 4.7 step 8). `InvalidState` clears `st`, keeps `f`, and sets `n = now + refresh_after_sec` unless its resolution sets `n`. `HoldCutOff` sets `n = now + hold_retry_sec` and never counts a failure; only a hold dispatch before the auction can be cut off. An after-send timeout is a `TransportFailure`. `InputFailure` is `f += 1`, `n = now + min(1 h × 2^(f-1), 24 h)`. `TransportFailure` is `f += 1`, `n = now + min(5 min × 2^(f-1), 1 h)`. `BreakerOpen` and `NotDispatched` change nothing. Backoff arithmetic uses `saturating_pow` and `min`, so a large `f` cannot overflow.
+
+- [ ] **Step 1: Write the failing tests**
+
+Write one test per eligibility step and one per section 8 row, using `fixed_provider` and `ProviderSettings::default()`. Name them after the rule, for example `skips_when_not_a_real_browser`, `skips_new_visitor_in_every_mode`, `stager_runs_no_provider_in_either_phase`, `owned_record_written_by_someone_else_is_due_for_refresh`, `browser_seeded_uid_in_iv_is_never_due`, `expired_refresh_anchor_stays_refresh`, `unowned_source_with_unexpired_record_is_not_initial_even_when_consent_hides_it`, `expired_unowned_record_counts_as_absent`, `record_of_an_unconfigured_writer_counts_as_absent`, `hold_provider_runs_before_the_auction_and_not_after_send`, `hold_provider_runs_after_send_when_the_navigation_runs_no_auction`, `after_send_provider_never_runs_in_hold`, `narrowed_away_source_is_never_a_kind`, `future_n_and_sticky_opt_out_block`, `a_later_clear_lifts_the_opt_out`, `no_match_waits_retry_in_capped_at_seven_days`, `input_failure_backs_off_exponentially_to_a_day`, `transport_failure_backs_off_to_an_hour`, `hold_cut_off_waits_hold_retry_without_counting_a_failure`, `skip_waits_refresh_after`, `invalid_state_clears_state_and_keeps_f`, `oversized_state_rejects_positive_part_but_keeps_removals`, `opted_out_removes_what_it_wrote_and_clears_state`, `capture_only_opt_out_also_removes_browser_records_of_its_sources`, `opted_out_records_the_fingerprint_of_the_current_consent`, `invalidate_removes_the_set_and_sets_n_now` and `invalidating_a_source_without_a_record_makes_no_change`. Add `fingerprint_bits_is_a_plain_hex_bitmask_and_changes_with_each_signal` (one case per signal, each against a control that differs only in it, and an assertion that the value parses with `u64::from_str_radix(.., 16)`).
+
+Then the entry-set rules (spec 13, "Complete provider EIDs (G13)"): `found_with_several_entries_becomes_one_whole_set_per_source`, `one_uid_result_without_eid_fields_becomes_a_one_entry_record`, `unclaimed_source_entries_are_discarded`, `oversized_set_from_a_stateless_provider_leaves_only_that_source_unchanged`, `oversized_set_from_a_stateful_provider_rejects_the_positive_part_and_keeps_removals`, `result_whose_every_set_is_discarded_is_malformed`, `invalidating_a_set_carries_no_hash_until_it_applies`, `expiring_set_without_expiry_keeps_stored_exp_only_when_unchanged`, `result_without_a_source_leaves_its_set_alone`, and `record_carries_the_earliest_times_of_its_set`. Task 10 tests the limits themselves. These tests check only what the coordinator does with `entry_sets`' output.
+
+Here are seven written out in full. Write the rest in the same shape:
+
+```rust
+    #[test]
+    fn skips_new_visitor_in_every_mode() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let view = EligibilityView::empty();
+        let catalog = ProviderCatalog::new(vec![provider.clone()], BTreeMap::new());
+        let settings = ProviderSettings::default();
+        let identity = IdentitySettings::default();
+        let consent = allowing_consent();
+        let input = EligibilityInput { provider: provider.as_ref(), settings: &settings, identity: &identity, catalog: &catalog, consent: &consent };
+        for phase in [Phase::Hold, Phase::AfterSend] {
+            let facts = RequestFacts { new_visitor: true, ..facts_for_writer() };
+            assert!(
+                matches!(eligibility(&input, &view, &facts, phase), Eligibility::Skip(SkipReason::NewVisitor)),
+                "should run no provider on a new visitor's first navigation ({phase:?})"
+            );
+        }
+        let returning = facts_for_writer();
+        assert!(
+            matches!(eligibility(&input, &view, &returning, Phase::AfterSend), Eligibility::Eligible { .. }),
+            "control: a returning writer should be eligible"
+        );
+    }
+
+    #[test]
+    fn hold_provider_runs_after_send_when_the_navigation_runs_no_auction() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let view = EligibilityView::empty();
+        let catalog = ProviderCatalog::new(vec![provider.clone()], BTreeMap::new());
+        let settings = ProviderSettings { mode: ProviderMode::Hold, ..ProviderSettings::default() };
+        let identity = IdentitySettings::default();
+        let consent = allowing_consent();
+        let input = EligibilityInput { provider: provider.as_ref(), settings: &settings, identity: &identity, catalog: &catalog, consent: &consent };
+        let eligible = |facts: &RequestFacts, phase| matches!(eligibility(&input, &view, facts, phase), Eligibility::Eligible { .. });
+
+        let no_auction = RequestFacts { runs_auction: false, ..facts_for_writer() };
+        let auction = RequestFacts { runs_auction: true, ..facts_for_writer() };
+        let stager = RequestFacts { writer: false, runs_auction: true, ..facts_for_writer() };
+
+        assert!(eligible(&no_auction, Phase::AfterSend), "should move after send without an auction");
+        assert!(!eligible(&no_auction, Phase::Hold), "should not hold without an auction");
+        assert!(eligible(&auction, Phase::Hold), "control: should hold before an auction");
+        assert!(!eligible(&auction, Phase::AfterSend), "should not also run after send");
+        assert!(!eligible(&stager, Phase::Hold), "should never run on a stager");
+    }
+
+    #[test]
+    fn no_match_waits_retry_in_capped_at_seven_days() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let fixture = OutcomeFixture::new();
+        let context = fixture.context_at(1_000);
+        let default = outcome_to_changes(provider.as_ref(), CallOutcome::Resolved(Resolution::no_match()), &EligibilityView::empty(), &context);
+        assert_eq!(default.state.n, Some(1_000 + 86_400), "should wait the 24 h default");
+        let long = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::no_match().with_retry_in(Duration::from_secs(30 * 86_400))),
+            &EligibilityView::empty(),
+            &context,
+        );
+        assert_eq!(long.state.n, Some(1_000 + 7 * 86_400), "should cap the wait at 7 days");
+    }
+
+    #[test]
+    fn found_resets_failures_and_retry_in_applies_to_every_resolution() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a: SourceDomain = "a.example.com".parse().expect("should parse the source");
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 3);
+        view.set_record_for_test(&a, record_for_test("example-old", Some("p"), 900));
+        let fixture = OutcomeFixture::new();
+        let context = fixture.context_at(1_000);
+
+        let found = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::found([ResolvedEid::new(&a, ResolvedUid::new("u"))]).with_retry_in(Duration::from_secs(600))),
+            &view,
+            &context,
+        );
+        let invalidated = outcome_to_changes(
+            provider.as_ref(),
+            CallOutcome::Resolved(Resolution::invalidate(&a).with_retry_in(Duration::from_secs(600))),
+            &view,
+            &context,
+        );
+
+        assert_eq!(found.state.f, Some(0), "should reset the failure count on found");
+        assert_eq!(found.state.n, Some(1_000 + 600), "should wait at least retry_in after found");
+        assert_eq!(invalidated.changes.len(), 1, "control: should remove the stored record");
+        assert_eq!(invalidated.state.n, Some(1_000 + 600), "should raise invalidate's n = now to retry_in");
+    }
+
+    #[test]
+    fn transport_failure_backs_off_to_an_hour() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let mut view = EligibilityView::empty();
+        view.set_failures_for_test("p", 5);
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(provider.as_ref(), CallOutcome::TransportFailure, &view, &fixture.context_at(1_000));
+        assert_eq!(changes.state.f, Some(6), "should count the failure");
+        assert_eq!(changes.state.n, Some(1_000 + 3_600), "should back off min(5 min x 2^5, 1 h) = 1 h");
+    }
+
+    #[test]
+    fn found_with_several_entries_becomes_one_whole_set_per_source() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let resolution = Resolution::found([
+            ResolvedEid::new(&a, ResolvedUid::new("example-a").with_atype(1))
+                .with_uid(ResolvedUid::new("example-b").with_atype(3).with_ext(json!({ "stype": "ppuid" })))
+                .with_inserter("example.com")
+                .with_mm(3),
+            ResolvedEid::new(&a, ResolvedUid::new("example-c")).with_matcher("partner.example.com"),
+        ]);
+
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(provider.as_ref(), CallOutcome::Resolved(resolution), &EligibilityView::empty(), &fixture.context_at(1_000));
+
+        assert_eq!(changes.changes.len(), 1, "should make one change for the one source");
+        let record = positive_record(&changes.changes[0]).expect("should be a positive change");
+        assert_eq!(record.w.as_deref(), Some("p"), "should name the writer");
+        assert_eq!(
+            record.eids,
+            vec![
+                KvEid {
+                    uids: vec![
+                        KvUid { id: "example-a".to_owned(), atype: Some(1), ext: None },
+                        KvUid { id: "example-b".to_owned(), atype: Some(3), ext: Some(json!({ "stype": "ppuid" })) },
+                    ],
+                    inserter: Some("example.com".to_owned()),
+                    matcher: None,
+                    mm: Some(3),
+                    ext: None,
+                },
+                KvEid {
+                    uids: vec![KvUid { id: "example-c".to_owned(), atype: None, ext: None }],
+                    inserter: None,
+                    matcher: Some("partner.example.com".to_owned()),
+                    mm: None,
+                    ext: None,
+                },
+            ],
+            "should store the whole set, in the order the provider returned it"
+        );
+    }
+
+    #[test]
+    fn oversized_set_from_a_stateful_provider_rejects_the_positive_part_and_keeps_removals() {
+        let provider = stateful_fixed_provider("p", &["a.example.com", "b.example.com"]);
+        let a = source("a.example.com");
+        let b = source("b.example.com");
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&b, record_for_test("example-old", Some("p"), 900));
+        // Three entries of about 2 KB each: the set is over MAX_ENTRY_SET_BYTES.
+        let large_ext = json!({ "segments": "x".repeat(2_000) });
+        let entries = (0..3).map(|index| ResolvedEid::new(&a, ResolvedUid::new(format!("example-{index}"))).with_ext(large_ext.clone()));
+        let resolution = Resolution::found(entries)
+            .also_invalidate(&b)
+            .replacing_state(&json!({ "token": "example-token" }));
+
+        let fixture = OutcomeFixture::new();
+        let changes = outcome_to_changes(provider.as_ref(), CallOutcome::Resolved(resolution), &view, &fixture.context_at(1_000));
+
+        assert!(changes.result.is_none(), "should store no ID and no state change");
+        assert!(
+            changes.changes.iter().any(|change| matches!(change, PartnerIdChange::OwnerRemove { source, .. } if *source == b)),
+            "should still apply the invalidation"
+        );
+        assert!(matches!(changes.state.st, StateUpdate::Keep), "should keep the old state");
+        assert_eq!(changes.state.f, Some(1), "should handle it as Malformed");
+        assert_eq!(changes.state.n, Some(1_000 + 3_600), "should back off min(1 h x 2^0, 24 h)");
+    }
+
+    #[test]
+    fn invalidating_a_set_carries_no_hash_until_it_applies() {
+        let provider = fixed_provider("p", &["a.example.com"]);
+        let a = source("a.example.com");
+        let fixture = OutcomeFixture::new();
+        let mut record = record_for_test("example-0-0", Some("p"), 900);
+        record.eids = (0..4)
+            .map(|chunk| KvEid {
+                uids: (0..8).map(|index| KvUid { id: format!("example-{chunk}-{index}"), atype: None, ext: None }).collect(),
+                inserter: None,
+                matcher: None,
+                mm: None,
+                ext: None,
+            })
+            .collect();
+        let expected = record_revision(&record);
+        let mut view = EligibilityView::empty();
+        view.set_record_for_test(&a, record);
+
+        let changes = outcome_to_changes(provider.as_ref(), CallOutcome::Resolved(Resolution::invalidate(&a)), &view, &fixture.context_at(1_000));
+
+        assert_eq!(changes.changes.len(), 1, "should make one removal for the 32-UID set");
+        assert!(
+            matches!(
+                &changes.changes[0],
+                PartnerIdChange::OwnerRemove { source, provider, expected: revision }
+                    if *source == a && provider.as_str() == "p" && *revision == expected
+            ),
+            "should remove the whole set at the revision it read"
+        );
+        assert_eq!(changes.state.n, Some(1_000), "should set n = now");
+    }
+```
+
+Add these to `test_support.rs`:
+
+- `facts_for_writer()`, which returns a real browser, persistence allowed, a writer, a returning visitor, no auction, and every input available
+- `allowing_consent()`
+- `OutcomeFixture`, an owned fixture holding the catalog, the provider and identity settings and the fingerprint bits, with `OutcomeFixture::new()` and `fn context_at(&self, now: u64) -> OutcomeContext<'_>`. A helper cannot return an `OutcomeContext` that borrows values it creates, so tests keep the fixture in a local and borrow from it.
+- `source(domain) -> SourceDomain` and `pid(id) -> IdentityProviderId`, if Task 14 did not already add them
+- `stateful_fixed_provider(id, sources)`, a `fixed_provider` declared `with_private_state()`
+- `record_for_test(uid, writer: Option<&str>, at) -> KvPartnerId`, a one-UID record with a fresh `rv`
+- `EligibilityView::empty()`, `set_record_for_test` and `set_failures_for_test`, `pub` under the gate
+
+Every item in `test_support.rs` is `pub` under the module's `#![cfg(any(test, feature = "test-utils"))]` (Global Constraints), except one that names a crate-private type, which stays `pub(crate)` (Task 14).
+
+Add `positive_record(&PartnerIdChange) -> Option<&KvPartnerId>` to the test module. It matches `FillMissing` and `OwnerWrite`, and returns `None` for the two removals.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::coordinator`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Implement `EligibilityView::from_kv`, `eligibility`, `fingerprint_bits` and `outcome_to_changes` as plain functions. Follow the numbered lists above. Give the entry-set steps 1 to 5 their own private helpers (`fn drop_unclaimed`, `fn discarded_sets`, `fn reject_positive_part`, `fn all_sets_discarded`), so a reviewer can match each to its spec bullet. The `iv` check of step 4 hashes each UID of the browser-seeded record with `uid_hash` (Task 13) and looks it up in the provider's `iv`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::coordinator`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/ec/identity crates/trusted-server-core/src/migration_guards.rs
+git commit --signoff -S -m "Add coordinator eligibility and outcome rules" -m "Eligibility reads the KV row alone. Only a returning writer runs providers; a hold-mode provider moves after send when the navigation runs no auction. Provider results become whole entry sets per source, an invalidation carries no hash until it applies, a discarded set rejects a stateful provider's positive part, and a result whose every set is discarded is Malformed. An opt-out's fingerprint is a plain consent bitmask."
+```
+
+### Task 21: Coordinator dispatch
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/identity/coordinator.rs`
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs` (fake HTTP client)
+- Test: `coordinator.rs`
+
+**Interfaces:**
+
+- Consumes: `RuntimeServices::http_client().send_async`, `services.backend().ensure(&PlatformBackendSpec { .. })` exactly as `dispatch_pull_sync` uses them (`ec/pull_sync.rs`, the body of `dispatch_pull_sync`), the bounded decoders in `streaming_processor.rs`, and the rate limiter's `exceeded_per_minute`
+- Produces:
+  - `pub(crate) struct IdentityDeps<'a> { settings: &'a Settings, catalog: &'a ProviderCatalog, keys: &'a IdentityKeys, random: &'a dyn RandomSource, services: &'a RuntimeServices, rate_limiter: Option<&'a dyn RateLimiter> }`. This one struct keeps `handle_auction` and `handle_publisher_request` within 7 arguments. `keys` holds only the visitor key (Task 13). `random` draws record revisions when a mutation applies. Task 23 builds `IdentityDeps` from `IdentityRuntime`.
+  - `pub(crate) struct Call { provider: IdentityProviderId, kinds: BTreeMap<SourceDomain, ResolveKind> }`
+  - `pub(crate) async fn dispatch(deps: &IdentityDeps<'_>, calls: Vec<Call>, signals: &ResolveSignals<'_>, budget: Option<Duration>) -> Vec<(IdentityProviderId, CallOutcome)>`. `budget` is `Some(remaining hold budget)` for a hold dispatch before the auction and `None` after send. It awaits `send_async` and each pending response instead of calling `futures::executor::block_on`: the hold dispatch runs inside the publisher handler's executor, where a nested `block_on` panics. Only phase 4 (`run_after_send`, Task 29), which runs after send outside any executor, blocks on it.
+  - `pub(crate) fn check_request(request: &ProviderRequest, descriptor: &ProviderDescriptor) -> Result<(), Report<IdentityProviderError>>`: `https` only, the host in `resolves.hosts()`, no `Cookie` header
+  - `pub(crate) fn decode_body(encoding: Option<&str>, body: Vec<u8>, cap: usize) -> Option<Vec<u8>>`: identity, `gzip` or `br`, the cap applied to the decoded size, `None` when over the cap or for an unknown encoding
+
+Dispatch per call:
+
+1. Build the `ResolveInput` and call `request`.
+   - `Ok(None)` is `Skipped`.
+   - `Err` with `InputUnavailable` is `InputUnavailable`.
+   - `Err` with `UndeclaredInput` or any other `Config` is `InputFailure`, logged as `Config` with `current_context()` only.
+   - Any recorded undeclared read is also logged as `Config` and turns the outcome into `InputFailure`.
+2. `check_request`. On failure: log `Config`, `InputFailure`.
+3. Order: calls are dispatched in a stable order. Generic pull providers keep today's fairness rule (spec 10.4, `pull_sync.rs:143-156`): sorted by source domain, then rotated left by `(now / 3600) % len`, so the starting partner changes each hour when `max_concurrency` limits a batch. Other providers follow, by provider ID.
+4. The burst cap: `rate_limiter.exceeded_per_minute(&format!("identity:{provider}:{}", visitor_key(keys, ec_id)), settings.max_calls_per_minute)`. Exceeded means not dispatched: the call's outcome is `BurstCapped`, which sets `n = max(n, now + 60)` (Task 20), never a failure. A limiter error is logged and the call's outcome is `NotDispatched`: not dispatched, `ps` unchanged (Task 35).
+5. `ensure` a backend with first-byte timeout `after_send_timeout_ms` after send, or for a hold dispatch `min(hold_timeout_ms, remaining budget)`, rounded up to the orchestrator's buckets (`auction/orchestrator.rs`, search for the bucket rounding). A hold dispatch also sets `connect_timeout: Some(timeout.min(1 s))`; after send it is `None` (revised after the round 14 review). `PlatformBackendSpec::connect_timeout: Option<Duration>` is new: `None` keeps the Fastly adapter's 1-second default and the existing backend name, and Fastly names a set value as `_ct<ms>` and folds it into the digest. Every other spec literal sets `None`. Tests: `hold_dispatch_caps_the_connect_timeout_at_the_call_timeout`, `fastly_prediction_names_a_connect_timeout_only_when_set`. Before the burst cap, skip the call as `CallOutcome::OverBackendBudget` (no `ps` change, no failure) when `http_client().requests_started()` plus the reserve reaches `[ec.identity] max_backend_requests` (default 32); a hold call reserves 1 for the origin plus one per `settings.auction.providers` when the auction is enabled, an after-send call nothing. `PlatformHttpClient::requests_started` defaults to `None` (unbudgeted); `FastlyPlatformHttpClient` counts `send` and `send_async` per request. Tests: `after_send_dispatch_stops_at_the_backend_request_budget`, `hold_dispatch_reserves_the_origin_and_the_auction` (round 14 review). After the burst cap, `ip_capped` checks `ProviderSettings::max_calls_per_ip_per_minute` (default 10, 0 off) on `identity-ip:<provider>:<visitor_key(keys, "ip:<client ip>")>`; a stop is `BurstCapped`, a limiter error `NotDispatched`, and a request without a client IP skips it. Test: `per_ip_ceiling_caps_calls_from_one_address`. Do not follow redirects. Send with `send_async`, keeping at most `[ec.identity].max_concurrency` in flight.
+6. Collect responses: check `Content-Length` against `max_response_bytes`, buffer, `decode_body`. Over the cap is `TransportFailure`. Build the `ProviderResponse` with the request's call context. Call `response`.
+   - `Ok(resolution)` is `Resolved`, or `InvalidState(Some(resolution))` when the input recorded a state decode failure.
+   - `Rejected` with 429 or 5xx is `TransportFailure`.
+   - Other `Rejected`, `Malformed` and `Config` are `InputFailure`.
+   - `InvalidState` is `InvalidState(None)`.
+7. A hold-mode call still pending when the budget runs out is dropped and becomes `HoldCutOff`. After send there is no budget: a call that misses `after_send_timeout_ms` is an ordinary timeout, `TransportFailure` (spec 4.7 step 7).
+
+- [ ] **Step 1: Write the failing tests**
+
+Add a `FakeHttpClient` to `test_support.rs`. It implements the platform HTTP client trait that `RuntimeServices` holds (`grep -n "trait .*HttpClient" crates/trusted-server-core/src/platform/*.rs`) and returns canned responses per host, with an optional delay counter for hold-budget tests. Check first whether `auction/test_support.rs` already has one, and reuse it if so. Then test:
+
+```rust
+    #[test]
+    fn check_request_enforces_https_host_and_no_cookie() {
+        let descriptor = fixed_provider("p", &["a.example.com"]).descriptor().clone();
+        let good = ProviderRequest::get(&"https://api.example.com/x".parse().expect("should parse the URL"));
+        check_request(&good, &descriptor).expect("should allow an https request to a declared host (control)");
+        for (name, request) in [
+            ("http", ProviderRequest::get(&"http://api.example.com/x".parse().expect("should parse the URL"))),
+            ("host", ProviderRequest::get(&"https://other.example.net/x".parse().expect("should parse the URL"))),
+            ("cookie", good.clone().try_with_header("cookie", "a=1").expect("should add the header")),
+        ] {
+            check_request(&request, &descriptor).expect_err(&format!("should reject the {name} case"));
+        }
+    }
+
+    #[test]
+    fn decode_body_caps_decoded_size() {
+        let mut encoder = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+        encoder.write_all(&vec![b'a'; 10_000]).expect("should write to the encoder");
+        let gzipped = encoder.finish().expect("should finish the gzip stream");
+        assert_eq!(decode_body(Some("gzip"), gzipped.clone(), 10_000).map(|b| b.len()), Some(10_000), "should decode a body that fits");
+        assert!(decode_body(Some("gzip"), gzipped, 9_999).is_none(), "should reject a body over the cap after decoding");
+        assert!(decode_body(Some("zstd"), vec![1], 10).is_none(), "should reject an unknown encoding");
+        assert_eq!(decode_body(None, b"ok".to_vec(), 10).as_deref(), Some(&b"ok"[..]), "should pass an identity body through");
+    }
+```
+
+The test module imports `std::io::Write as _` at its top for `write_all`.
+
+Also write `dispatch_maps_status_codes_to_outcomes` (200 is `Resolved`, 503 is `TransportFailure`, 400 is `InputFailure`, a body over the cap is `TransportFailure`), `after_send_timeout_is_a_transport_failure_not_a_cut_off`, `burst_cap_skips_without_counting_a_failure` and `undeclared_read_is_an_input_failure_even_when_ignored`, using a provider that reads `user_agent().ok()` without declaring it, against the fake client. Port today's rotation test as `generic_pull_dispatch_order_rotates_hourly`: three generic pull providers, dispatch at `now` and at `now + 3600` with `max_concurrency = 1`, and a different first host each hour, in the order `pull_sync.rs` gives today.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::coordinator`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Follow the transport code in `dispatch_pull_sync` closely. It already handles backend resolution, `send_async`, draining the in-flight batch (`drain_pull_batch`), the `Content-Length` check (`response_content_length_exceeds_limit`) and buffering (`extract_pull_uid`). Move those three helpers out of `pull_sync.rs` into `coordinator.rs`, generalized to `max_response_bytes`, and make `pull_sync.rs` call the moved versions until Task 29 deletes its dispatcher. For decoding, reuse the bounded decoders in `streaming_processor.rs` if a buffered entry point exists (`grep -n "pub(crate) fn\|pub fn" crates/trusted-server-core/src/streaming_processor.rs`). Otherwise use `flate2::read::MultiGzDecoder` and `brotli::Decompressor` with `Read::take(cap as u64 + 1)` and reject when more than `cap` bytes come out.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity::coordinator` and `cargo test-fastly -- ec::pull_sync`
+Expected: PASS. Pull sync behaviour is unchanged so far.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src
+git commit --signoff -S -m "Add coordinator dispatch with request checks and byte caps"
+```
+
+### Task 22: `GenericPullProvider`, the write-counting store and the basic harness
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/generic_pull.rs`
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs` (`ProviderHarness` basics, `WriteCountingEcKv`)
+- Modify: `crates/trusted-server-core/src/ec/identity/catalog.rs` (`ProviderCatalog::from_settings`, `validate_identity_catalog`)
+- Modify: `crates/trusted-server-core/src/ec/pull_sync.rs` (`validated_pull_sync_url` takes the URL fields instead of a `PartnerConfig`, and becomes `pub(crate)` with `build_pull_request_url`)
+- Modify: `crates/trusted-server-core/src/settings.rs` (`EcPartner.pull_sync_ttl_sec` and `pull_sync_rate_limit` removed, with catch fields), and every `EcPartner` literal that sets them (`ec/finalize.rs:628`, `auction/endpoints.rs:617`, `publisher.rs:7905`, `settings.rs:4047` and `:5859`, and the `PartnerConfig` fixtures in `ec/pull_sync.rs` tests)
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (`KvIdentityGraph::write_counting` constructor, test support)
+- Modify: `crates/trusted-server-core/src/config.rs` (call `validate_identity_catalog` from both validators; extend `validate_removed_keys`)
+- Modify: `crates/trusted-server-core/src/ec/registry.rs` (`PartnerConfig`, if it copies the two removed fields)
+- Modify: `trusted-server.example.toml`, the integration fixture and `docs/guide/configuration.md`, wherever they set the two removed partner keys
+- Test: `generic_pull.rs`, `catalog.rs`
+
+**Interfaces:**
+
+- Consumes: `EcPartner` (`settings.rs:385`, the settings type: `settings.ec.partners` is `Vec<EcPartner>`, `settings.rs:572`), `build_pull_request_url` (`ec/pull_sync.rs:368`), `ResolvedEid` and `ResolvedUid` (Task 10)
+- Produces:
+  - `pub(crate) fn validated_pull_sync_url(pull_sync_url: Option<&str>, allowed_domains: &[String]) -> Option<Url>`. Today's caller passes a `PartnerConfig`'s two fields. The rules do not change.
+  - `pub(crate) struct GenericPullProvider` with `pub(crate) fn from_partner(partner: &EcPartner) -> Result<Self, Report<IdentityProviderError>>`. The descriptor reads only `source_domain`, `pull_sync_url` and `pull_sync_allowed_domains`, which are not secret, so it builds from unresolved deploy-time settings too. The provider keeps `ts_pull_token` and reads it only in `request`. At runtime the settings are resolved, so it holds the token there.
+  - `pub(crate) fn generic_pull_id(source_domain: &str) -> IdentityProviderId`: `pull-` plus the domain with `.` replaced by `-`. A domain that already contains `-` gets `-` and the first 8 hex digits of SHA-256 of the full domain appended, so `a-b.example.com` and `a.b.example.com` (both valid under `normalize_partner_source_domain`) get different IDs. Over 63 characters, the readable part is cut to 54 characters before the `-` and the hash.
+  - `pub(crate) fn validate_identity_catalog(descriptors: &[ProviderDescriptor], partners: &[EcPartner], identity: &IdentitySettings) -> Result<(), Report<TrustedServerError>>`: the one validator for the catalog rules of spec 10.2. In this task it rejects a duplicate provider ID, more than 32 providers, an `[ec.identity.providers.<id>]` table naming an unknown provider, and `revoke_scope` set for a provider whose descriptor declares no `captures`. No generic pull provider declares `captures`, so in Part 1 `revoke_scope` on any table is an error. Task 33 adds its rules to this same function. Nothing else repeats them.
+  - `validate_removed_keys` (Task 19) also rejects `pull_sync_ttl_sec` and `pull_sync_rate_limit` on any `[[ec.partners]]` entry, with an error that names the partner and the replacement: `refresh_after_sec`, and `max_calls_per_minute = ceil(N / 60)`, in `[ec.identity.providers.<generic_pull_id>]` (spec 10.2, 10.4). `EcPartner` keeps a catch field for each, as Task 19 does for `pull_sync_concurrency`.
+  - `pub(crate) fn generic_pull_descriptors(partners: &[EcPartner]) -> Result<Vec<ProviderDescriptor>, Report<TrustedServerError>>`, for the pull-enabled partners
+  - `ProviderCatalog::from_settings(settings: &Settings) -> Result<Self, Report<TrustedServerError>>`. It reads `settings.ec.partners` directly and never builds a `PartnerRegistry`, so no secret is checked. In Part 1 it holds generic pull providers only, with no owners, and it calls `validate_identity_catalog` on their descriptors before building. Task 32 adds the integration registry's providers.
+  - Test support, all `pub` in the `pub mod test_support` module behind `#[cfg(any(test, feature = "test-utils"))]`, so Task 30's adapter tests can reach them (the adapter's dev-dependency already enables `trusted-server-core/test-utils`, `adapter-fastly/Cargo.toml:45`):
+    - `WriteCountingEcKv` (an in-memory store that counts `Add`, `IfGenerationMatch` and `Overwrite` writes and lookups) with `pub fn writes(&self) -> WriteCounts`
+    - `KvIdentityGraph::write_counting(name) -> (KvIdentityGraph, Arc<WriteCountingEcKv>)`, `pub` under the same gate
+    - `FakeHttpClient` (Task 21), made `pub` here if Task 21 left it crate-private
+    - `ProviderHarness` with `new`, the `with_*` setters, `request`, `request_json`, `respond`, `respond_raw` and `resolve`. Conformance checks come in Task 39.
+
+Generic pull's descriptor:
+
+```rust
+let id = generic_pull_id(&partner.source_domain);
+let mut resolves = Resolves::new().with_ec_id();
+for host in &partner.pull_sync_allowed_domains {
+    resolves = resolves.with_host(host);
+}
+ProviderDescriptor::builder(id)
+    .with_source(partner.source_domain.parse()?)
+    .with_resolves(resolves)
+    .with_consent_policy(ConsentPolicy::eid_persistence_only())
+    .build()
+```
+
+Its `request` is a `GET` of `validated_pull_sync_url(partner.pull_sync_url.as_deref(), &partner.pull_sync_allowed_domains)` with `?ec_id=<input.ec_id()?>` (via `build_pull_request_url`) and `with_bearer(ts_pull_token)`. Skip (`Ok(None)`) when there is no valid URL or token. Its `response` keeps today's no-op answers (`pull_sync.rs:55-57`, `:447-453`):
+
+- A 404 is `Resolution::no_match()`, checked before `success_json`, as today's "treating as no-op".
+- The body is `success_json::<{ uid: Option<String> }>()`. `None`, an empty UID or one over `MAX_UID_LENGTH` (`is_valid_eid_uid`) is `no_match`, never `Malformed`, so a partner's "no user" answer waits the `no_match` 24 h instead of counting a failure.
+- Any other UID is `found([ResolvedEid::new(&source, ResolvedUid::new(uid))])`: one entry, one UID, no `atype`, no `ext` and no EID-level fields, so the coordinator stores the one-entry record pull sync stores today (G13).
+
+A generic pull provider's settings are `settings.ec.identity.provider(&generic_pull_id(&partner.source_domain))` like any other provider's: `ProviderSettings::default()` unless the operator writes an `[ec.identity.providers.<pull-id>]` table, where `<pull-id>` is `generic_pull_id(source_domain)` (below). The unknown-provider validation error lists every configured provider ID, so an operator who writes the plain form for a hyphenated domain sees the real ID. Pacing moves there (spec 10.4): an operator who had `pull_sync_rate_limit = N` per hour sets `max_calls_per_minute = ceil(N / 60)`, and one who had `pull_sync_ttl_sec` sets `refresh_after_sec`. The changelog (Task 31) gives both conversions.
+
+Until Task 29 deletes `dispatch_pull_sync`, `ec/pull_sync.rs` reads the same table: its rate check becomes `rate_limiter.exceeded_per_minute(&rate_key, provider_settings.max_calls_per_minute)` (`pull_sync.rs:200`), and its marker TTL uses `provider_settings.refresh_after_sec`. Its tests set those through `settings.ec.identity.providers` instead of the removed partner fields.
+
+- [ ] **Step 1: Port today's pull sync tests**
+
+List them with `grep -n "fn " crates/trusted-server-core/src/ec/pull_sync.rs | sed -n '/mod tests/,$p'`. For each test of protocol behaviour (URL building, bearer, response parsing, 64 KiB cap, allowlist, empty or oversized UID), write the equivalent against `GenericPullProvider` through `ProviderHarness`. For example:
+
+```rust
+    #[test]
+    fn calls_the_partner_url_with_the_ec_id_and_bearer() {
+        let partner = ec_partner("ssp.example.com", "https://sync.ssp.example.com/pull", "example-token-value-0123456789abcdef");
+        let provider = GenericPullProvider::from_partner(&partner).expect("should build");
+        let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+
+        let request = harness.request().expect("should build").expect("should not skip");
+
+        assert_eq!(request.url().host_str(), Some("sync.ssp.example.com"), "should call the partner host");
+        assert_eq!(
+            request.url().query_pairs().find(|(name, _)| name == "ec_id").map(|(_, value)| value.into_owned()),
+            Some(TEST_EC_ID.to_owned()),
+            "should pass the EC ID"
+        );
+        assert_eq!(request.headers()["authorization"], "Bearer example-token-value-0123456789abcdef", "should send the bearer token");
+
+        let resolution = harness.respond(StatusCode::OK, &json!({ "uid": "partner-uid" })).expect("should parse the answer");
+        assert_eq!(resolution.eids().len(), 1, "should return one entry");
+        let eid = &resolution.eids()[0];
+        assert_eq!(eid.uids().len(), 1, "should return one UID");
+        assert_eq!(eid.uids()[0].id(), "partner-uid", "should return the partner's UID");
+        assert_eq!(
+            (eid.uids()[0].atype(), eid.uids()[0].ext(), eid.inserter(), eid.matcher(), eid.mm(), eid.ext()),
+            (None, None, None, None, None, None),
+            "should set nothing beyond the UID, so it is stored as one entry with one UID"
+        );
+    }
+
+    #[test]
+    fn not_found_and_null_uid_are_no_match_as_today() {
+        let partner = ec_partner("ssp.example.com", "https://sync.ssp.example.com/pull", "example-token-value-0123456789abcdef");
+        let provider = GenericPullProvider::from_partner(&partner).expect("should build");
+        for (name, status, body) in [
+            ("404", StatusCode::NOT_FOUND, json!({})),
+            ("null uid", StatusCode::OK, json!({ "uid": null })),
+            ("empty uid", StatusCode::OK, json!({ "uid": "" })),
+        ] {
+            let mut harness = ProviderHarness::new(&provider).with_ec_id(TEST_EC_ID);
+            harness.request().expect("should build").expect("should not skip");
+            let resolution = harness.respond(status, &body).expect("should not be an error");
+            assert!(resolution.is_no_match(), "should be no_match for {name}");
+        }
+    }
+
+    #[test]
+    fn provider_ids_are_derived_and_bounded() {
+        assert_eq!(generic_pull_id("ssp.example.com").as_str(), "pull-ssp-example-com", "should keep a dot-only domain readable");
+        let long = format!("{}.example.com", "a".repeat(70));
+        let id = generic_pull_id(&long);
+        assert!(id.as_str().len() <= 63, "should bound the ID to 63 characters");
+        assert_ne!(id, generic_pull_id(&format!("{}.example.com", "a".repeat(71))), "should keep long IDs unique by hash");
+        assert_ne!(
+            generic_pull_id("a-b.example.com"),
+            generic_pull_id("a.b.example.com"),
+            "should not collide when a domain already contains a hyphen"
+        );
+    }
+
+```
+
+`ProviderHarness::with_ec_id` is crate-private (only generic pull reads the EC ID). Add it next to the public setters with `pub(crate)`.
+
+`ec_partner(source, url, token)` builds an `EcPartner` with pull sync enabled and `url`'s host allowed. Add it to `test_support.rs`.
+
+Also add `generic_pull_pacing_comes_from_its_provider_table`: a partner with no table gets `refresh_after_sec = 86_400` and `max_calls_per_minute = 1`, and one with `[ec.identity.providers.pull-ssp-example-com]` holding `max_calls_per_minute = 2` gets 2. In `config.rs` tests, add `removed_partner_pull_keys_are_rejected_with_their_replacements`: a partner with `pull_sync_ttl_sec` fails both validators with an error naming `refresh_after_sec`, one with `pull_sync_rate_limit` with an error naming `max_calls_per_minute`, and the control without either passes.
+
+In `catalog.rs`, add `validate_identity_catalog_rejects_unknown_provider_tables`, `validate_identity_catalog_rejects_revoke_scope_without_captures`, `validate_identity_catalog_rejects_duplicate_ids_and_more_than_32_providers` and `from_settings_builds_from_unresolved_settings`. Each rejection pairs a rejected config with a control that differs only in the key under test: a table for the partner's real `pull-` ID passes, and the same table with `revoke_scope = "provider"` does not. The last one builds the catalog from settings whose `api_token` holds a short secret-store key name, which `PartnerRegistry::from_config` would reject (`ec/registry.rs:279`).
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identity::generic_pull` and `cargo test-fastly -- ec::identity::catalog`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Write `generic_pull.rs`, `ProviderCatalog::from_settings`, the harness basics and the counting store. The harness builds `ResolveSignals` from its setters (`SeededRandom` from `with_random_seed`, default seed `1`, default `now` 1,760,000,000). It computes kinds as spec 13 says: a source with a `with_stored` record is `Refresh`, any other is `Initial`, and sources whose kind's needs are missing are dropped, with `Ok(None)` and no provider call when none are left. It keeps the built request's call context for `respond`. `respond` builds a `ProviderResponse` from `serde_json::to_vec(body)`.
+
+Call `validate_identity_catalog(&generic_pull_descriptors(&settings.ec.partners)?, &settings.ec.partners, &settings.ec.identity)` from `validate_settings_for_deploy` and `validate_settings_for_runtime`, after the partner check. Deploy validation calls only `PartnerRegistry::validate_config_for_deploy` today (`config.rs:259`) and must never build a `PartnerRegistry`: `from_config` checks API token lengths, and at deploy time `api_token` holds a key name. Building generic pull descriptors reads no secret (spec 10.2), so this works on unresolved settings.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identity`, `cargo test-fastly -- ec::pull_sync`, `cargo test-fastly -- config::`, `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity` and `./scripts/test-cli.sh`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src
+git commit --signoff -S -m "Model pull sync partners as GenericPullProvider" -m "Adds the provider harness basics and a KV store that counts writes by mode. Generic pull results stay one UID per source, a 404 or null UID stays a no-op, and one catalog validator rejects provider tables it cannot apply." -m "pull_sync_ttl_sec and pull_sync_rate_limit are removed from [[ec.partners]]: pacing comes from each pull partner's [ec.identity.providers.<pull-id>] table, and a config that sets either key fails validation with an error naming its replacement."
+```
+
+---
+
+### Task 23: The writer decision and request-scoped identity state on `EcContext`
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/ec/identity/runtime.rs` (`IdentityRuntime`)
+- Create: `crates/trusted-server-core/src/ec/identity/request.rs` (`RequestIdentity`)
+- Modify: `crates/trusted-server-core/src/http_util.rs` (add `is_document_navigation`, move `is_prefetch_request` here)
+- Modify: `crates/trusted-server-core/src/publisher.rs` (`is_prefetch_request` at about line 3200 moves out; the navigation and page-bids merge build their `ServeContext` from the runtime)
+- Modify: `crates/trusted-server-core/src/integrations/gpt_diagnostics.rs` (its call at line 274 switches to `crate::http_util::is_prefetch_request`)
+- Modify: `crates/trusted-server-core/src/ec/mod.rs` (`EcContext` fields and accessors)
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs`, `crates/trusted-server-core/src/ec/identify.rs` and `crates/trusted-server-core/src/ec/admin.rs` (the servability callers Task 14 left on `ProviderCatalog::empty()`)
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` (`AppState`, `build_state_from_settings`, `build_ec_request_state`, the publisher fallback, the integration-proxy EC generation path, the admin lookup call, and the `AppState` test literal at about line 1579)
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (the settings-reload branch that runs without an `AppState`, about line 526)
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs` (integration-proxy EC generation, about line 1046, gains the real-browser check)
+- Test: `http_util.rs`, `ec/mod.rs`, `ec/identity/runtime.rs`, `auction/endpoints.rs`, `adapter-fastly/src/app.rs`
+
+**Interfaces:**
+
+- Consumes: `ProviderCatalog::from_settings` (Task 22), `IdentityKeys::from_settings` (Task 13), `IdentityMutation` (Task 15), `ServeContext` (Task 14)
+- Produces:
+  - `pub struct IdentityRuntime`, built once per settings load. Its fields are private: the `ProviderCatalog`, the `IdentityKeys` and a clone of `IdentitySettings` (`identity()`). It is the one identity type the adapter names, so the crate-private catalog and keys never cross the crate boundary or appear in a `pub` signature (`private_interfaces` is an error under `-D warnings`).
+    - `pub fn from_settings(settings: &Settings) -> Result<Self, Report<TrustedServerError>>`: `ProviderCatalog::from_settings(settings)?` narrowed with each provider table's `sources` (`with_narrowing`, Task 14), and `IdentityKeys::from_settings(settings)`. Task 32 adds a second parameter, the integration registry, for registered providers. Keep the body a short sequence of builder calls so that parameter slots in.
+    - `pub(crate) fn catalog(&self) -> &ProviderCatalog`, `keys(&self) -> &IdentityKeys`, `identity(&self) -> &IdentitySettings`
+    - `pub(crate) fn deps<'a>(&'a self, settings: &'a Settings, services: &'a RuntimeServices, random: &'a dyn RandomSource, rate_limiter: Option<&'a dyn RateLimiter>) -> IdentityDeps<'a>` (Task 21)
+    - A hand-written `Debug` that prints the provider count, never key material.
+  - `EcContext::set_identity_runtime(&mut self, runtime: Arc<IdentityRuntime>)` (`pub`), which the adapter calls where it builds `EcRequestState`, and `pub(crate) fn identity_runtime(&self) -> Option<&IdentityRuntime>`. Without `ec.ec_store` there is no KV and no record to serve, so no runtime is needed there.
+  - `pub(crate) fn opted_out(entry: &KvEntry) -> BTreeSet<IdentityProviderId>` (in `request.rs`): the providers with a sticky opt-out in KV `ps.o`, unless a later `oc` clears it (spec 7.1). KV is the only source: no cookie carries an opt-out.
+  - `pub fn is_document_navigation(req: &Request<EdgeBody>) -> bool`: `Sec-Fetch-Dest: document` only, with no `Accept` fallback
+  - `pub fn is_prefetch_request(req: &Request<EdgeBody>) -> bool`, moved unchanged and made public
+  - `pub(crate) struct RequestIdentity` stored on `EcContext`. It derives `Default` and `Clone` and has a hand-written `Debug` that prints only counts and flags (the number of mutation changes, `writer`, `is_real_browser`, `removal_lost`), because the derived `Debug` of `IdentityMutation` and `KvPartnerId` would print UIDs whenever `EcContext` is debug-printed (spec 9.3). Accessors:
+    - `writer: bool`
+    - `is_real_browser: bool`, which Task 38 reads for the real-browser gate on capture
+    - `user_agent: Option<String>`, `dnt: bool`, `page_url: Option<Url>` (captured in phase 1)
+    - `runtime: Option<Arc<IdentityRuntime>>`
+    - `mutation: IdentityMutation`: the writer's one flush (Task 25 fills it, Task 29 writes it)
+    - `pending_removals: Option<IdentityMutation>`: a removal write that failed before send, to try once more after send (Task 38)
+    - `removal_lost: u32` with `record_removal_lost(&mut self)`: removals every attempt failed to write (spec 5.2 phase 4, 5.3). Task 31 reports it.
+    - `capture_unpersisted: BTreeMap<(IdentityProviderId, SourceDomain), u32>` with `record_unpersisted(provider, source)`: positive capture IDs counted, never stored (spec 4.7). Task 38 fills it and Task 31 reports it.
+  - `pub(crate) fn EcContext::identity(&self) -> &RequestIdentity` and `pub(crate) fn identity_mut(&mut self) -> &mut RequestIdentity`. They are crate-private because `RequestIdentity` is. The adapter never calls them.
+  - `pub fn EcContext::decide_writer(&mut self, req: &Request<EdgeBody>, organic_route: bool, is_real_browser: bool)`, called from the adapter. It sets `writer = organic_route && is_document_navigation(req) && !is_prefetch_request(req) && is_real_browser`, records `is_real_browser`, and captures the user agent, DNT and the page URL (the request URL without query or fragment).
+  - `pub fn EcContext::set_real_browser(&mut self, is_real_browser: bool)`, called from the adapter
+
+The writer decision is made in the adapter where routing already decides EC generation (spec 5.1). That is after pre-route filters allow dispatch:
+
+- In the publisher fallback branch of `app.rs`, next to `let is_navigation = is_navigation_request(&req);`, call `ec.ec_context.decide_writer(&req, true, ec.is_real_browser)`.
+- In the integration-proxy branch, call `decide_writer(&req, true, is_real_browser)` before `handle_proxy`, and make proxy EC generation require `is_real_browser` explicitly, not just a present KV graph (`registry.rs:1048`). `ProxyDispatchInput` gains `is_real_browser: bool` for this. EC generation is its only reader: capture reads the flag from `EcContext`. The Fastly adapter passes integration proxy dispatch the identity graph for every client (`proxy_kv_graph`), so a non-browser's captured revocations reach KV.
+- Every other route leaves `writer = false` and still records `is_real_browser` through `EcContext::set_real_browser(bool)`, called where the adapter builds `EcRequestState`, so a stager's capture knows whether its clear passes the real-browser gate (Task 38).
+
+The adapter holds the runtime (spec 10.3: built once per settings load):
+
+- `AppState` gains `identity: Arc<IdentityRuntime>`. Add `fn build_identity_runtime(settings: &Settings) -> Result<Arc<IdentityRuntime>, Report<TrustedServerError>>` in `app.rs`, called by `build_state_from_settings` and by the settings-reload branch in `main.rs` that runs when `app_state` is `None` (`load_settings_from_config_store`, about line 526), so both paths have one. Update the `AppState` test literal (about `app.rs:1579`).
+- `build_ec_request_state` calls `ec_context.set_identity_runtime(Arc::clone(&state.identity))`.
+
+The servability callers get the real catalog from here on (spec 7.1). Task 14 passed `ProviderCatalog::empty()`. From Task 29 on, generic pull results are written with `w = pull-…`, and `is_servable` rule 3 drops any record whose writer is not in the catalog, so an empty catalog would silently stop every pull ID reaching bidders (G13). Replace it at each caller:
+
+- `/auction` (`auction/endpoints.rs`, where it calls `resolve_partner_ids`), the publisher navigation and page-bids merge (`publisher.rs`) and `/identify` (`ec/identify.rs`, which already takes `ec_context`): `catalog = ec_context.identity_runtime().map(IdentityRuntime::catalog)`, falling back to `ProviderCatalog::empty()` only when there is no runtime, and `opted_out = request::opted_out(&entry)`.
+- The admin view (`handle_admin_ec_lookup`, `ec/admin.rs:276`) gains `runtime: Option<&IdentityRuntime>`, and the Fastly adapter passes `Some(&state.identity)`. Its `opted_out` is the same KV `ps.o` set. The other adapters return the "not supported" response before reaching it.
+
+`resolve_partner_ids` becomes `pub(crate)`. Its only callers are `auction/endpoints.rs` and `ec/admin.rs`, and it now takes the crate-private `ServeContext`.
+
+- [ ] **Step 1: Write the failing tests**
+
+In `http_util.rs`:
+
+```rust
+    #[test]
+    fn document_navigation_requires_sec_fetch_dest_document() {
+        let with_dest = Request::builder()
+            .header("sec-fetch-dest", "document")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        let accept_only = Request::builder()
+            .header(header::ACCEPT, "text/html")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        let iframe = Request::builder()
+            .header("sec-fetch-dest", "iframe")
+            .body(EdgeBody::empty())
+            .expect("should build the request");
+        assert!(is_document_navigation(&with_dest), "should count a document destination");
+        assert!(!is_document_navigation(&accept_only), "should not count the Accept fallback");
+        assert!(is_navigation_request(&accept_only), "control: the broad check should still accept it");
+        assert!(!is_document_navigation(&iframe), "should not count an iframe");
+    }
+```
+
+In `ec/mod.rs` tests:
+
+```rust
+    #[test]
+    fn decide_writer_needs_every_condition() {
+        let navigation = || {
+            Request::builder()
+                .uri("https://www.example.com/a?b=c#d")
+                .header("sec-fetch-dest", "document")
+                .header(header::USER_AGENT, "ExampleBrowser/1.0")
+                .header("dnt", "1")
+                .body(EdgeBody::empty())
+                .expect("should build the request")
+        };
+        let mut context = EcContext::default();
+        context.decide_writer(&navigation(), true, true);
+        assert!(context.identity().writer(), "should make an organic real-browser document navigation the writer");
+        assert!(context.identity().is_real_browser(), "should record the real browser");
+        assert_eq!(context.identity().page_url().map(Url::as_str), Some("https://www.example.com/a"), "should drop the query and fragment");
+        assert_eq!(context.identity().user_agent(), Some("ExampleBrowser/1.0"), "should capture the user agent");
+        assert!(context.identity().dnt(), "should capture DNT");
+
+        for (name, organic, browser, request) in [
+            ("named route", false, true, navigation()),
+            ("bot", true, false, navigation()),
+            (
+                "prefetch",
+                true,
+                true,
+                Request::builder()
+                    .header("sec-fetch-dest", "document")
+                    .header("sec-purpose", "prefetch")
+                    .body(EdgeBody::empty())
+                    .expect("should build the request"),
+            ),
+        ] {
+            let mut context = EcContext::default();
+            context.decide_writer(&request, organic, browser);
+            assert!(!context.identity().writer(), "should not be a writer: {name}");
+            assert_eq!(context.identity().is_real_browser(), browser, "should keep the real-browser flag: {name}");
+        }
+    }
+```
+
+Use the prefetch headers `is_prefetch_request` actually checks. Read it before writing the test.
+
+Also write:
+
+- `request_identity_debug_prints_no_uid` (a `RequestIdentity` whose mutation holds a `FillMissing` and an `OwnerRemove`: `format!("{:?}", identity)` contains no UID)
+- `opted_out_reads_ps_o_and_honours_a_later_clear`: a row with `ps.a.o` set, `ps.b.o` set and `ps.b.oc` strictly later, and `ps.c` with only `oc`. Only `a` is opted out.
+- in `runtime.rs`, `runtime_debug_prints_no_key_material` and `runtime_narrows_providers_by_their_sources_table`
+- in `auction/endpoints.rs`, `generic_pull_record_with_writer_is_served_after_flush`: a row whose record for `ssp.example.com` has `w = pull-ssp-example-com`, and a context whose runtime's catalog holds that generic pull provider. `/auction` sends the UID. The control, with a runtime whose catalog lacks the provider, does not.
+- in `ec/admin.rs`, `admin_view_serves_generic_pull_records_with_the_runtime_catalog`
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- http_util::tests::document_navigation`, `cargo test-fastly -- ec::tests::decide_writer`, `cargo test-fastly -- ec::identity::request`, `cargo test-fastly -- ec::identity::runtime`, `cargo test-fastly -- generic_pull_record_with_writer_is_served_after_flush` and `cargo test-fastly -- admin_view_serves_generic_pull_records`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Add `IdentityRuntime` (`pub mod runtime;` in `ec/identity/mod.rs`, re-exported as `ec::identity::IdentityRuntime`) and `RequestIdentity` (`pub(crate) mod request;`, file `ec/identity/request.rs`), both registered in `migration_guards.rs`. Give `RequestIdentity` `Default`, `Clone`, the redacting `Debug`, the accessors above, and setters used by later tasks. Add the field `identity: RequestIdentity` to `EcContext` (it already derives `Debug, Default, Clone`, `ec/mod.rs:249`, so this needs `RequestIdentity: Debug + Default + Clone`). `IdentityMutation` needs `Clone`, so add `#[derive(Clone)]` to it and its parts where it is missing. `EcFinalizeState` must stay `Clone + Send + Sync`. `IdentityRuntime` is shared through `Arc` and holds `Arc<dyn IdentityProvider>`s, which are `Send + Sync` (Task 11), so it does.
+
+Move `is_prefetch_request` into `http_util.rs` as `pub`. In `publisher.rs`, delete the old definition and import it with `use crate::http_util::is_prefetch_request;` at the top. Switch `gpt_diagnostics.rs:274` from `crate::publisher::is_prefetch_request` to `crate::http_util::is_prefetch_request`; a private `use` in `publisher.rs` would not be visible on that path.
+
+Wire `decide_writer`, `set_real_browser` and `set_identity_runtime` in `app.rs` as described above, and the runtime into `AppState` and the reload branch. Add `is_real_browser` to `ProxyDispatchInput` and set it from `EcRequestState`. In `IntegrationRegistry::handle_proxy`, require it before proxy EC generation. Switch the servability callers to the runtime's catalog and the request's opt-outs.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly` (full: the adapter and core)
+Expected: PASS. Behaviour is unchanged so far, apart from integration-proxy EC generation now needing a real browser. If an existing proxy test minted an EC for a non-browser request, update it and note the change in the commit body.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Decide the writer request once routing allows dispatch" -m "Only an organic real-browser top-level document navigation that is not a prefetch is the writer. Integration-proxy EC generation now requires a real browser explicitly." -m "The adapter builds one IdentityRuntime per settings load, and the auction, publisher, identify and admin readers check servability against its catalog and the row's opt-outs."
+```
+
+### Task 24: `/identify` stops writing; cluster size rides on the writer
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/identify.rs` (the `evaluate_cluster` call at about line 107)
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (`evaluate_cluster` at about line 1484 gains a non-writing variant)
+- Test: `ec/identify.rs`, `ec/kv.rs`
+
+**Interfaces:**
+
+- Produces:
+  - `KvIdentityGraph::compute_cluster_size(&self, ec_id: &str) -> Result<u32, Report<TrustedServerError>>`: the prefix list and count only, no write
+  - `/identify` uses a stored `cluster_size` when present and `compute_cluster_size` otherwise, and never writes. Phase 4 (Task 29) adds a missing `cluster_size` to its one write with `compute_cluster_size` and `IdentityMutation::set_cluster_size`.
+
+`/identify`'s response shape does not change (spec 7.1). Task 14 gates the partner's own record with `is_servable`, not `resolve_partner_ids`. Its `uid` is the stored record's `first_uid()`, the first UID of the first entry, and its `eid` is built from that UID with the partner's `openrtb_atype`, exactly as `ec/identify.rs:127-135` builds it today. A multi-entry record's other UIDs and EID-level fields are never returned there.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+    #[test]
+    fn identify_computes_cluster_size_without_writing() {
+        let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+        let ec_id = seed_row_without_cluster_size(&graph);
+        let response = identify_for_test(&graph, &ec_id);
+
+        assert_eq!(response.status(), StatusCode::OK, "should answer");
+        assert!(response_body_json(response)["cluster_size"].is_number(), "should report a size");
+        assert_eq!(store.writes().total(), 0, "should not write");
+    }
+
+    #[test]
+    fn identify_returns_the_first_uid_of_a_multi_entry_record_with_the_partner_atype() {
+        let (graph, _store) = KvIdentityGraph::write_counting("ec-store");
+        let ec_id = seed_row_with_entry_set(&graph, "partner.example.com", &[&["example-a", "example-b"], &["example-c"]]);
+
+        let body = response_body_json(identify_for_test(&graph, &ec_id));
+
+        assert_eq!(body["uid"], json!("example-a"), "should return the first UID of the first entry");
+        assert_eq!(
+            body["eid"],
+            json!({ "source": "partner.example.com", "uids": [{ "id": "example-a", "atype": 3 }] }),
+            "should return one UID with the partner's openrtb_atype, as for a one-UID record"
+        );
+    }
+```
+
+`seed_row_without_cluster_size`, `identify_for_test` and `response_body_json` are thin wrappers around what the existing identify tests already do. Write them in the test module from that setup. `seed_row_with_entry_set` seeds a row whose record for the source holds a set with each inner slice one entry, stored `atype: 1` on every UID and `inserter: "example.com"` on the first entry, so the test also shows that stored fields do not leak into `/identify`. Register the partner with `openrtb_atype = 3` and `bidstream_enabled = true`.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::identify::tests::identify_`
+Expected: the cluster test fails with one write. The multi-entry test may already pass, since Task 14 reads `first_uid()`. Keep it: it pins the shape.
+
+- [ ] **Step 3: Implement**
+
+Split `evaluate_cluster` into `compute_cluster_size` (list and count) and the existing write. `/identify` calls only `compute_cluster_size`. Keep `evaluate_cluster` for now, because other callers may still use it. Task 29 adds the size to the mutation with `compute_cluster_size` and `IdentityMutation::set_cluster_size`, and removes `evaluate_cluster` in its Step 3 once nothing calls it.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::identify` and `cargo test-fastly -- ec::kv`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src/ec
+git commit --signoff -S -m "Stop writing cluster size from /identify" -m "Pins the response shape for multi-entry records: the first UID with the partner's atype, as for a one-UID record."
+```
+
+### Task 25: Finalize builds the mutation, and stagers write nothing
+
+This is the core behaviour change of Part 1. `ec_finalize_response` stops writing KV for returning visitors. On the writer request it adds browser ingest to the mutation that phase 4 (Task 29) flushes. On stagers it ingests nothing and writes nothing. No identity cookie is set on any path (spec 5.2 phase 3, 9.4).
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/finalize.rs` (`ec_finalize_response`, `confirm_then_recover_orphaned_ec`, `recover_orphaned_ec`, and the new `browser_seed`)
+- Modify: `crates/trusted-server-core/src/ec/mod.rs` (`generate_if_needed` takes the browser ingest; its three callers in `ec/mod.rs` tests)
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` (`create_if_absent` callers pass the seeded entry)
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs` (`ProxyDispatchInput` gains the seed, and `handle_proxy`'s `generate_if_needed` call at about line 1047 passes it)
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs` and `crates/trusted-server-core/src/publisher.rs` (their test callers of `ec_finalize_response`, whose expectations change)
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` (build the seed for `generate_if_needed` and `ProxyDispatchInput`)
+- Test: `ec/finalize.rs`
+
+**Interfaces:**
+
+- Consumes: `RequestIdentity` (Task 23), `IdentityMutation` and `PartnerIdChange::FillMissing` (Task 15), `KvPartnerId::browser` (Task 6), `collect_eid_updates` with `now` (Task 7)
+- Produces:
+  - Writer, returning EC, live row: adds one `FillMissing { source, record: KvPartnerId::browser(uid, Some(now)) }` per consent-gated browser-ingest update from `ts-eids` and sharedId to `ec_context.identity_mut().mutation`. It covers owned sources too, which seeds them for their owner (spec 7.2). It writes nothing.
+  - Stager, returning EC: no ingest and no write. Today's returning-visitor `sync_eid_cookie_updates` call (`ec/finalize.rs:110-112`) is gone for `/auction`, `/_ts/page-bids` and every other stager (spec 5.3).
+  - `ec_finalize_response` keeps its signature. It sets no `Set-Cookie` beyond today's `ts-ec` and the pull-sync marker that Task 29 removes.
+  - `pub struct BrowserSeed`, an opaque wrapper over `Vec<PartnerIdUpdate>`, built by `pub fn browser_seed(settings: &Settings, registry: &PartnerRegistry, consent: &ConsentContext, eids_cookie: Option<&str>, sharedid_cookie: Option<&str>, now: u64) -> BrowserSeed` in `ec/finalize.rs`. It calls `collect_eid_updates` and the private `gate_eid_updates_by_consent` (`ec/finalize.rs:268`), so it must live in that file. `BrowserSeed::empty()` is for callers with nothing to seed. `PartnerIdUpdate` (`ec/kv.rs:75`) stays `pub(crate)`.
+  - `pub fn generate_if_needed(settings, kv, seed: &BrowserSeed)`: the new-visitor create carries the browser ingest, so finalize no longer writes for a new EC (spec 5.2, phase 1). `ProxyDispatchInput` gains `seed: &'a BrowserSeed`, which the adapter builds with the same `browser_seed` call, so an EC minted on an integration-proxy navigation carries its ingest in the same one write.
+  - Orphan rotation creates the new row carrying this request's browser ingest, as today (`ec/finalize.rs:323`). It is the page load's one write: rotation empties the mutation, and phase 4 skips (spec 5.2 phase 1). If the confirm read finds the row after all, no rotation happens, that read becomes the phase 1 snapshot, and the ingest joins the mutation instead of today's immediate write (`ec/finalize.rs:383-386`).
+
+Browser ingest keeps writing one entry with one UID per registered source (G13). `collect_eid_updates` already picks one UID per registered source and drops unregistered sources: for a repeated source, the first valid UID of its last entry, with the sharedId cookie applied last (`ec/prebid_eids.rs:146-151`). Nothing in this task changes that rule or widens what is stored. A browser entry's extra UIDs and EID-level fields still reach bidders through the `/auction` body and the merge, as today, and never KV. The ingest reads `ts-eids` and sharedId only: the `/auction` body is no longer an ingest input (spec G10), and Task 26 removes that plumbing.
+
+What each path does (spec 5.1, 5.2, 5.5):
+
+| Path                               | KV                                                                                                                  |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| New EC (writer or not)             | the create before routing, carrying browser ingest (`generate_if_needed`). `ts-ec` set as today.                    |
+| Returning EC, writer, live row     | none. Ingest joins the mutation, and phase 4 flushes it.                                                            |
+| Returning EC, writer, missing row  | today's orphan recovery: confirm, then rotate with ingest in the create. An integration-proxy writer never rotates. |
+| Returning EC, stager               | none                                                                                                                |
+| Unusable consent, not withdrawn    | none                                                                                                                |
+| Consent withdrawn                  | today's tombstone path, unchanged here (Task 27 adds the after-send attempt)                                        |
+| Any KV read that found a tombstone | none, and the mutation stays empty                                                                                  |
+
+- [ ] **Step 1: Write the failing tests**
+
+Add a `mod identity_flow` test module nested inside `finalize.rs`'s existing `mod tests`, so the filter `ec::finalize::tests::identity_flow` matches it. Build requests and contexts the way the existing finalize tests do (`grep -n "fn finalize_" crates/trusted-server-core/src/ec/finalize.rs | head -40`). Use `KvIdentityGraph::write_counting` (Task 22). Write these tests. The first two are shown in full:
+
+```rust
+    #[test]
+    fn returning_writer_navigation_adds_ingest_to_the_mutation_and_writes_nothing() {
+        let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+        let ec_id = seed_live_row(&graph, KvEntry::minimal("other.example.com", "x", 1));
+        let mut context = returning_context(&ec_id, Writer::Yes);
+        context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+        let mut response = html_response();
+
+        ec_finalize_response(
+            &settings_with_partner("sharedid.org"),
+            &mut context,
+            Some(&graph),
+            &registry_with_partner("sharedid.org"),
+            None,
+            Some("example-shared-id"),
+            &mut response,
+        );
+
+        assert_eq!(store.writes().total(), 0, "should not write in finalize for a returning writer");
+        let records = queued_records(context.identity().mutation());
+        assert_eq!(records.len(), 1, "should queue the sharedId fill");
+        assert_eq!(records[0].1.first_uid(), Some("example-shared-id"), "should queue the cookie's UID");
+        assert!(set_cookie_names(&response).is_empty(), "should set no cookie on a returning HTML response");
+    }
+
+    #[test]
+    fn golden_browser_ingest_stays_one_uid_whatever_the_browser_sent() {
+        let (graph, store) = KvIdentityGraph::write_counting("ec-store");
+        let ec_id = seed_live_row(&graph, KvEntry::minimal("other.example.com", "x", 1));
+        let mut context = returning_context(&ec_id, Writer::Yes);
+        context.set_kv_snapshot(graph.load_snapshot(&ec_id));
+        let eids_cookie = ts_eids_cookie(&json!([
+            {
+                "source": "partner.example.com",
+                "uids": [
+                    { "id": "example-a", "atype": 1, "ext": { "stype": "ppuid" } },
+                    { "id": "example-b", "atype": 3 }
+                ],
+                "inserter": "example.com",
+                "mm": 3
+            },
+            { "source": "unregistered.example.com", "uids": [{ "id": "example-c", "atype": 1 }] }
+        ]));
+        let mut response = html_response();
+
+        ec_finalize_response(
+            &settings_with_partner("partner.example.com"),
+            &mut context,
+            Some(&graph),
+            &registry_with_partner("partner.example.com"),
+            Some(&eids_cookie),
+            None,
+            &mut response,
+        );
+
+        assert_eq!(store.writes().total(), 0, "should not write in finalize");
+        let records = queued_records(context.identity().mutation());
+        assert_eq!(records.len(), 1, "should queue only the registered source, as today");
+        let (source, record) = &records[0];
+        assert_eq!(source.as_str(), "partner.example.com", "should queue the registered source");
+        assert_eq!(
+            serde_json::to_value(record).expect("should serialize the record"),
+            json!({ "at": record.at, "eids": [{ "uids": [{ "id": "example-a" }] }] }),
+            "should store the UID collect_eid_updates picks today, with no atype, ext or EID-level field"
+        );
+    }
+```
+
+The others:
+
+- `stagers_ingest_nothing_and_write_nothing`: the same row and cookies on `/auction` (`EidSyncSource::Auction`, with body EIDs), `/_ts/page-bids` and a non-navigation proxy call. Zero writes, an empty mutation, no `Set-Cookie`. This replaces today's tests that assert a returning-visitor ingest write on those routes.
+- `unusable_consent_writes_nothing_and_queues_nothing`
+- `withdrawal_still_writes_its_tombstone_on_any_request`: the existing withdrawal tests keep passing, on a writer and on a stager.
+- `tombstone_read_leaves_the_mutation_empty`
+- `orphan_rotation_carries_browser_ingest_in_one_create`: a missing row on a writer navigation. One `Add` write, holding the sharedId as a one-UID record, and an empty mutation afterwards.
+- `confirm_read_that_finds_the_row_queues_ingest_instead_of_writing`
+- `integration_proxy_writer_never_rotates_on_missing_row` (an integration-proxy writer navigation and a missing row: no create, as today, spec 5.1)
+- `new_visitor_create_carries_browser_ingest_in_one_write` (one `Add` write, and the row holds the sharedId as a one-UID record)
+- `integration_proxy_new_ec_carries_browser_ingest` (`handle_proxy` minting an EC with a seed: one `Add` write holding the seeded UID)
+
+`ts_eids_cookie`, `queued_records`, `set_cookie_names`, `seed_live_row`, `returning_context` and the response builders go in the test module. Build them on `ec/identity/test_support.rs`. `queued_records` lists the `(source, record)` of every positive change in the mutation, in order.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::finalize::tests::identity_flow`
+Expected: compile errors, then assertion failures (finalize still writes).
+
+- [ ] **Step 3: Implement**
+
+Restructure the returning-EC branch of `ec_finalize_response` (`ec/finalize.rs:80-121`):
+
+1. Collect browser ingest from `ts-eids` and sharedId as today, with `now` (Task 7), then consent-gate it.
+2. **Writer** (`ec_context.identity().writer()`): when the snapshot is a live row, add each update to the mutation as `FillMissing`. When it is `NotRead` (a failed or skipped phase 1 read), still add them: phase 4 re-reads before it writes (spec 5.2 phase 4 step 2). A missing row keeps today's orphan recovery; pass the updates into `confirm_then_recover_orphaned_ec` so the create carries them, and clear the mutation when the create is `Written`. A confirm read that finds the row sets the snapshot and queues the updates.
+3. **Stager:** do nothing. Remove the `sync_eid_cookie_updates` call and the snapshot refresh around it for these paths. The `EidCookieSyncOutcome` measurement line (`EID sync measurement: ...`) goes with it for returning visitors, and Task 31's per-request counters replace it. Keep `record_eid_sync_terminal` for the new-EC create. Name the removed line and its replacement in this commit's body and in Task 31's CHANGELOG entry, because operator dashboards may read it.
+4. New EC: `generate_if_needed` already wrote the seeded row. Finalize sets `ts-ec` as today and stops writing ingest for it (`ec/finalize.rs:144`).
+5. Call `reconcile_pull_sync_marker` as today. Task 29 removes it.
+
+In `ec/mod.rs`, give `generate_if_needed` a `seed: &BrowserSeed` parameter and apply its updates to the `KvEntry::new(..)` it creates, via `apply_partner_id_updates`, before `create_if_absent`. In `app.rs`, build the seed with `browser_seed(settings, registry, consent, ec.eids_cookie, ec.sharedid_cookie, now)` before calling `generate_if_needed`, and pass the same seed in `ProxyDispatchInput` for `handle_proxy`'s call (`registry.rs:1047`). `ec/mod.rs`'s own test callers pass `&BrowserSeed::empty()`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::finalize`, `cargo test-fastly -- golden_browser_ingest` and then the full `cargo test-fastly`
+Expected: PASS. Existing finalize, auction and publisher tests that asserted a KV write on a returning navigation, `/auction` or `/_ts/page-bids` must now assert no write, plus a queued mutation on the writer. Update each one and list them in the commit body.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Queue browser ingest in the writer's mutation and stop stager writes" -m "Returning-visitor finalize no longer writes KV. The writer navigation adds ingest from ts-eids and sharedId to its single mutation; /auction, /_ts/page-bids and other stagers ingest nothing. A new visitor's create, from the publisher fallback or an integration proxy, and an orphan rotation carry browser ingest, so each stays one write." -m "Browser ingest still writes one UID per registered source. The EID sync measurement line no longer runs for returning visitors; the identity counters of the Part 1 metrics task replace it."
+```
+
+### Task 26: `/auction` and `/_ts/page-bids` stop ingesting and return the mirror payload
+
+> Revised after the round 14 review (spec 15, question 5): the mirror ships gated off. `IdentitySettings::mirror_enabled` (`[ec.identity] mirror_enabled`, `#[serde(default)]`, `false`) is read by `mirror_enabled(ec_context)` in `auction/endpoints.rs`. `AuctionIdentity::mirror_member` returns `None` while it is off, and `/_ts/page-bids` sends its consent-denial `clear` only while it is on. Tests: `auction_omits_the_mirror_while_it_is_disabled` and `page_bids_omits_the_mirror_while_it_is_disabled`. Tests that exercise the mirror turn it on with `EcContext::enable_mirror_for_test`, and the adapter's identity scenarios set `settings.ec.identity.mirror_enabled = true`.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs` (the client EID plumbing at about lines 290-302, and the response build)
+- Modify: `crates/trusted-server-core/src/openrtb.rs` (`ResponseExt` at line 232 gains `ts_eids_s`)
+- Modify: `crates/trusted-server-core/src/publisher.rs` (`handle_page_bids` at about line 6904, and its response body at about line 7232)
+- Modify: `crates/trusted-server-core/src/ec/mod.rs` (`EcContext.client_eids` loses its ingest role)
+- Modify: `crates/trusted-server-core/src/integrations/prebid.rs` (the injected `window.__tsjs_prebid` config at about line 1485 gains `registeredSources`)
+- Create: `crates/trusted-server-js/lib/src/core/eids_mirror.ts` (writes `__Host-ts-eids-s` from a payload)
+- Modify: `crates/trusted-server-js/lib/src/integrations/prebid/eids.ts` (the shim writes only registered sources into `ts-eids`, merged per source) and `prebid/index.ts` (reads the `/auction` payload)
+- Modify: `crates/trusted-server-js/lib/src/integrations/gpt/index.ts` (`PageBidsResponse` and its handler read the page-bids payload)
+- Test: `auction/endpoints.rs`, `publisher.rs`, `integrations/prebid.rs`, and the Vitest files next to each changed TS file
+
+**Interfaces:**
+
+- Consumes: `mirror_payload` and `MirrorRead` (Task 17), the servable records (Task 14) and `to_eids`, `gate_eids_by_consent`, `ServeContext` from the runtime (Task 23)
+- Produces:
+  - `pub(crate) fn mirror_read<'a>(context: &EcContext, serve: &ServeContext<'_>, sources: &'a mut Vec<MirrorSource>) -> MirrorRead<'a>`: `NotRead` when the request read no KV; `Cleared` when consent denies EID persistence, or the read found a tombstone, `consent.ok = false` or a missing row; else `Servable` over the servable records with `bidstream_enabled = true`, after `gate_eids_by_consent`, one `MirrorSource` per source with its writer's `cookie_priority` (0 for a browser-seeded record) and the earliest `exp` of its set (spec 6.2). The EIDs are the server entries the merge would send, before browser precedence, provenance defaults included once Task 28 adds them.
+  - `ResponseExt { orchestrator, ts_eids_s: Option<serde_json::Value> }`, with `#[serde(skip_serializing_if = "Option::is_none")]`, holding `MirrorPayload::to_json()`. The page-bids body gains a `ts_eids_s` member under the same rule.
+  - `/auction`'s consent-denied early return still answers with `ts_eids_s = {"clear": true}`, so a withdrawal clears the mirror (spec 5.6).
+  - TS: `writeEidsMirror(payload: unknown): void` in `core/eids_mirror.ts`. On `{value, max_age}` it writes `__Host-ts-eids-s=<value>; Path=/; Secure; SameSite=Lax; Max-Age=<max_age>`, skipping the write when the cookie already holds that value. On `{clear: true}` it expires the cookie. On anything else, absent included, it does nothing. It never reads the cookie for any other purpose and never copies it anywhere (spec 6.2, "No feedback").
+  - TS: the shim keeps only entries whose source is in `registeredSources` and writes no `ts-eids` when no list is injected. It decodes the current cookie (`decodeEidCookie`), replaces its entries per source with the request's registered entries, keeps sources the request lacks, and then runs the EID fidelity trim on the merged set. A request with no EIDs leaves the cookie as it is; a TCF block still clears it (spec 5.3).
+
+What stops (spec 5.3, G10):
+
+- `/auction` no longer ingests its body EIDs or `ts-eids` into KV. The body EIDs still feed the auction merge exactly as today. `ec_context.set_client_eids` stays only if the merge or finalize logging still reads it; otherwise remove it with `client_eids()` and their callers.
+- `/_ts/page-bids` no longer ingests `ts-eids` into KV.
+- `EidSyncSource::Auction` and `EidSyncSource::PageBids` no longer select an ingest path in finalize. Keep the enum only if Task 31's counters label requests with it.
+
+- [ ] **Step 1: Write the failing tests**
+
+In `auction/endpoints.rs`, next to the existing `/auction` + KV tests:
+
+- `auction_body_eids_are_not_written_to_kv`: a registered source in the body and not in KV. Zero writes, and the body's UID still reaches the bidder request.
+- `auction_returns_the_mirror_of_its_servable_set`: a row with one servable record. `ext.ts_eids_s.value` decodes (base64url, no padding) to `{"v":1,"eids":[...]}` holding exactly that record's EID, and `max_age` is 86,400.
+- `auction_mirror_max_age_follows_the_earliest_exp`
+- `auction_mirror_leaves_out_bidstream_disabled_and_consent_gated_sources`
+- `auction_returns_clear_on_consent_denial_tombstone_and_missing_row` (one case each, plus a control with a live row)
+- `auction_returns_clear_when_the_servable_set_is_empty`
+- `auction_without_a_kv_read_omits_the_mirror` (no `ts_eids_s` key at all in `ext`)
+
+In `publisher.rs`:
+
+- `page_bids_never_writes_kv`: with a `ts-eids` cookie holding a registered source missing from KV, zero writes.
+- `page_bids_returns_the_mirror_payload` and `page_bids_without_an_auction_omits_the_mirror`
+
+In `integrations/prebid.rs`:
+
+- `injected_config_lists_registered_sources`: the `window.__tsjs_prebid` config holds `registeredSources` with every `[[ec.partners]]` source domain, sorted, and nothing else from the partner table.
+
+In Vitest:
+
+- `eids_mirror.test.ts`: writes the value with the given `Max-Age` and the `__Host-` attributes; skips an unchanged value; expires on `clear`; ignores an absent or malformed payload; never touches `ts-eids`.
+- `eids.test.ts`: `keeps_registered_sources_before_unregistered_ones` (a set over 3,072 bytes whose registered source comes last: the cookie keeps it and drops unregistered ones first), and a control showing the order within each group is unchanged.
+- In `prebid/index.test.ts` and `gpt/index.test.ts`: a response carrying `ts_eids_s` calls `writeEidsMirror` with it, and one without it does not.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- auction::endpoints::tests::auction_`, `cargo test-fastly -- publisher::tests::page_bids_`, `cargo test-fastly -- injected_config_lists_registered_sources`, and `cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run`
+Expected: failures (today `/auction` and page-bids write, and there is no mirror).
+
+- [ ] **Step 3: Implement**
+
+In `auction/endpoints.rs`, remove the ingest of body and cookie EIDs; keep the merge input. Build the payload with `mirror_read` and `mirror_payload` once the KV read is done, and put it in `ResponseExt`. In `publisher.rs`, remove the page-bids path that leads to a KV write (with Task 25 in place finalize no longer writes for a returning EC, so check that page-bids has no other direct write: `grep -n "upsert\|sync_eid\|create" crates/trusted-server-core/src/publisher.rs`) and add `ts_eids_s` to the body. In `prebid.rs`, add `registeredSources` to the injected config. In TS, add `core/eids_mirror.ts`, call it from the `/auction` response handler in `prebid/index.ts` and the page-bids handler in `gpt/index.ts`, and pass the injected `registeredSources` (an empty set when absent, which keeps today's trim) to `fitEidCookie`.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- auction::`, `cargo test-fastly -- publisher::`, `cargo test-fastly -- integrations::prebid`, and in `crates/trusted-server-js/lib`: `mise exec node@24.12.0 -- npx vitest run`, `mise exec node@24.12.0 -- npm run lint` and `mise exec node@24.12.0 -- npm run format`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src crates/trusted-server-js/lib/src
+git commit --signoff -S -m "Return the ts-eids-s mirror from /auction and stop stager ingest" -m "/auction and /_ts/page-bids no longer write browser EIDs to KV. Both return a ts_eids_s payload built from the servable server set, which the shim writes as the client-only __Host-ts-eids-s cookie, or a clear on denied consent, a tombstone or a missing row." -m "The shim writes only registered sources into ts-eids, merged per source, so the writer navigation's ingest still sees every registered source /auction used to ingest."
+```
+
+### Task 27: The withdrawal tombstone's after-send attempt
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/finalize.rs` (the withdrawal path at about lines 470-505, `apply_withdrawal_tombstones` at about line 527)
+- Modify: `crates/trusted-server-core/src/ec/mod.rs` (`EcContext` records the failed IDs)
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (the after-send hook at about lines 517 and 536)
+- Test: `ec/finalize.rs`, `adapter-fastly/src/main.rs`
+
+**Interfaces:**
+
+- Produces:
+  - `EcContext::failed_withdrawals(&self) -> &[String]` (`pub(crate)`), the withdrawn EC IDs whose before-send tombstone returned `EcKvSnapshot::Failed` after its five CAS attempts (`ec/kv.rs:1349`). The withdrawal closure records each one where it logs the failure today (`ec/finalize.rs:495`).
+  - `pub fn retry_failed_withdrawals(context: &mut EcContext, kv: &KvIdentityGraph)`: after send, calls `tombstone_existing_from_snapshot(ec_id, EcKvSnapshot::NotRead)` once for each failed ID, so it re-reads first (spec 5.1). It is one more run of the same path, with its own five CAS attempts and completion marker, never a second retry. A second failure is logged at `warn` with the EC ID through `log_id` only and counted (Task 31). A success updates the context's snapshot when the ID is the active one, as the before-send path does.
+
+This is the withdrawal's existing exception to G4, extended by one after-send run (spec 5.1). Nothing else rides on it in Part 1. Task 38's captured global opt-out reuses it.
+
+- [ ] **Step 1: Write the failing tests**
+
+In `ec/finalize.rs`:
+
+- `failed_withdrawal_is_recorded_for_after_send`: a store that fails every tombstone write. After finalize, `failed_withdrawals()` holds the active ID.
+- `successful_withdrawal_records_nothing`
+- `after_send_retry_writes_the_tombstone_once`: a store that fails five times and then succeeds. Finalize records the ID; `retry_failed_withdrawals` writes the tombstone and the completion marker; the row reads as a tombstone.
+- `after_send_retry_is_the_last_attempt`: a store that always fails. The retry makes one run of at most five CAS attempts, logs, and leaves `failed_withdrawals()` unchanged for the counters.
+- `withdrawal_of_two_ids_retries_only_the_failed_one`: the cookie ID's tombstone fails and the active ID's succeeds. The retry touches only the cookie ID.
+
+In the adapter:
+
+- `after_send_runs_the_withdrawal_retry_before_identity_work`: with a failed withdrawal recorded, the after-send hook calls the retry and runs no provider dispatch, since the row is now a tombstone or still unwritten.
+
+- [ ] **Step 2: Run and see them fail**
+
+Run: `cargo test-fastly -- ec::finalize::tests::failed_withdrawal`, `cargo test-fastly -- ec::finalize::tests::after_send_retry` and `cargo test-fastly -- after_send_runs_the_withdrawal_retry`
+Expected: compile errors.
+
+- [ ] **Step 3: Implement**
+
+Record each `Failed` outcome in the withdrawal closure. Add `retry_failed_withdrawals` next to `apply_withdrawal_tombstones`. In `main.rs`, call it first in the after-send hook, before `run_edgezero_pull_sync_after_send` (which Task 29 replaces with phase 4), whenever the request has a graph and a failed withdrawal. A withdrawal request never runs providers or flushes a mutation, so the order matters only for logs.
+
+- [ ] **Step 4: Run and see them pass**
+
+Run: `cargo test-fastly -- ec::finalize` and `cargo test-fastly`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Retry a failed withdrawal tombstone once after send" -m "A tombstone whose five CAS attempts fail before send runs the same path once more after send, by which time the per-key write limit has usually passed. A second failure is logged and counted."
+```
+
+### Task 28: The server set and provider denials in the auction merge
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs` (`merge_auction_eids`, about line 505)
+- Modify: `crates/trusted-server-core/src/publisher.rs` (navigation and page-bids merge, about lines 5547-5568)
+- Modify: `crates/trusted-server-core/src/ec/eids.rs` (`to_eids` fills provenance defaults)
+- Create: `crates/trusted-server-core/src/ec/identity/denials.rs`
+- Test: `auction/endpoints.rs`, `publisher.rs`, `ec/eids.rs`, `denials.rs`
+
+**Interfaces:**
+
+- Consumes: `ProviderDescriptor::provenance(source)` and the `with_provenance` default (Task 8), `uid_hash` (Task 13), `ProviderCatalog::claimants`, `is_capture_only` and `sources_of` (Task 14), the servability check, `ResolvedPartnerId { entries, writer, .. }` and `to_eids`, which already emits one `Eid` per stored entry (Task 14), and `opted_out` (Task 23)
+- Produces:
+  - `pub(crate) struct ServerSet<'a>`, built by `pub(crate) fn server_set<'a>(entry: Option<&'a KvEntry>, serve: &ServeContext<'_>) -> ServerSet<'a>`: per source, the servable record of the KV row the request read, with its writer. It never holds anything from `ts-eids-s` (spec 7.1). No KV read, or a row that is not live and consenting, gives an empty set.
+  - `pub(crate) struct Denials`, built by `pub(crate) fn denials(entry: &KvEntry, catalog: &ProviderCatalog) -> Denials` in `denials.rs`, read from KV only (spec 7.1, "Provider denials apply to browser candidates"):
+    - per source, the union of the `ps.iv` and `ps.ov` hashes of every provider in `catalog.claimants(source)`
+    - the set of sources whose browser value is dropped whole: every source the owner of which has a sticky `ps.o`, and every source of a capture-only provider (`is_capture_only`) with a sticky `ps.o`, owned or not (`opted_out`, Task 23, decides "sticky")
+  - `pub(crate) fn filter_browser_candidates(client: &[Eid], denials: &Denials) -> Vec<Eid>`: drops each entry of a dropped-whole source; otherwise drops each UID whose `uid_hash` is in that source's hashes, then each entry left with no UID. It runs before the precedence table and before `gate_eids_by_consent`. Without a KV read there are no denials (a stager without a read has no browser candidates to check against, and the writer always reads, Task 29).
+  - `merge_auction_eids(client: &[Eid], server: &ServerSet<'_>, denials: &Denials, registry: &PartnerRegistry) -> Vec<Eid>`
+  - `pub(crate) fn fill_provenance(eids: &mut [Eid], writer: Option<&IdentityProviderId>, source: &SourceDomain, catalog: &ProviderCatalog)`, called on a provider-written record's output
+
+Part 1's catalog holds only generic pull providers, which claim one source each, own nothing and capture nothing, so in production the denials hold only `iv` and `ov` hashes, and only once a provider writes them. The tests build test catalogs with owners and capture-only providers (`test_support`), so every rule lands and is tested here, and Task 36 adds only the owned precedence row.
+
+Precedence (spec 7.1):
+
+| Source  | Browser sent it                                                         | Browser did not send it                                                            |
+| ------- | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
+| Owned   | the owner's valid value (`w == owner`, not expired), else the browser's | the owner's valid value, else a browser-seeded value if the source does not expire |
+| Unowned | the browser's (today)                                                   | the server value (today)                                                           |
+
+This task implements the unowned row. Task 36 adds the owned row.
+
+How a server value goes out (spec 7.1):
+
+- The source's whole entry set, one `Eid` per stored entry, in stored order, after the browser entries. Task 14's `to_eids` already does this, with each UID's stored `atype`, else the partner's `openrtb_atype`, and its stored UID-level `ext`, and each entry's stored EID-level fields. A one-UID record is one entry, exactly as today (`ec/eids.rs:64-76`).
+- For a record a provider wrote (`w` names a configured provider), the provider's `with_provenance` default for the source (`descriptor.provenance(source)`) applies only to an entry that sets none of `inserter`, `matcher` and `mm` (spec 4.3). Then each field the default sets is filled. An entry that sets any of the three is the vendor's complete statement and is left as stored, so vendor and config provenance never mix in one entry. A browser-seeded or version 1 record (no `w`) gets no default.
+- An unowned server set goes out only when the browser did not send the source (after the denials). It is never mixed with browser entries.
+
+Sources with `bidstream_enabled = false` are left out. The merged set goes through `gate_eids_by_consent` and into `x-ts-eids` exactly as today, with the same 4 KB cap and `x-ts-eids-truncated` when an entry is cut. `encode_eids_header` and `build_eids_header` are unchanged and still truncate per entry (Task 14), so the header can carry part of a stored set; `user.eids` always carries it whole (spec 7.1).
+
+Browser entries that pass the denials keep today's path untouched: they come first, in the browser's order, with the browser's own EID-level fields, and the merge never edits one beyond dropping a denied UID.
+
+Task 26's mirror payload reads the same `ServerSet` (before browser precedence), so it carries the provenance defaults too.
+
+- [ ] **Step 1: Write the failing tests**
+
+Every test name in this task starts with `merge_`, `denial_` or `golden_merge_`, so the filters below run them all:
+
+- `merge_browser_value_wins_for_unowned_source` (control: today's rule)
+- `merge_server_value_goes_out_when_the_browser_did_not_send_the_source`
+- `merge_never_reads_the_mirror_cookie`: the same request with and without a `__Host-ts-eids-s` cookie gives the same `Vec<Eid>`.
+- `merge_expired_entry_is_not_sent`
+- `merge_stored_atype_and_ext_are_emitted`
+- `merge_x_ts_eids_matches_what_was_sent`
+- `merge_entry_set_goes_out_one_eid_per_entry_in_stored_order_after_browser_entries`
+- `merge_provenance_applies_only_to_an_entry_with_no_eid_level_fields` (three entries of a provider-written set: one with no EID-level field gets the whole default; one with `inserter` set keeps its `inserter` and gets no `matcher` or `mm`; and a browser-seeded record gets none)
+- `merge_header_still_truncates_per_entry` (a stored set whose entries pass 4 KB: `x-ts-eids` holds the entries that fit, `x-ts-eids-truncated` is set, and `user.eids` holds the whole set)
+- `denial_drops_a_browser_uid_in_a_claimants_iv_for_an_unowned_source`
+- `denial_drops_a_browser_uid_in_a_claimants_ov`
+- `denial_filters_uid_by_uid_and_drops_an_emptied_entry`: a browser entry with UIDs A and B, where only A is in `iv`, goes out with B alone; a second entry holding only A is dropped.
+- `denial_ignores_hashes_of_a_provider_that_does_not_claim_the_source` (control)
+- `denial_drops_every_owned_source_while_the_owner_is_opted_out`
+- `denial_drops_every_source_of_an_opted_out_capture_only_provider`: owned and unowned sources alike. Control: after a later `oc`, the browser values go out again.
+- `denial_mirror_id_fed_back_through_the_body_is_filtered`: a UID that only the mirror once held, now in `ps.iv`, sent back in the `/auction` body, is not sent.
+- `golden_merge_one_uid_row_goes_out_as_on_main` (G13): the merge of an empty client set with a row of one-UID records gives the exact `Vec<Eid>` today's `merge_auction_eids(None, Some(to_eids(..)))` gives. Write the expected value from `main`'s code, and do not edit it afterwards.
+- `golden_merge_browser_entries_are_forwarded_unchanged` (G13): a client set with repeated sources, several UIDs and EID-level fields, no denials and an empty server set: the merge returns the client set as today's `merge_auction_eids` does, minus entries without UIDs.
+
+Put the `publisher.rs` cases (the navigation and page-bids merge) under the same names with a `merge_publisher_` prefix. Compare whole `Vec<Eid>` values with every field written out, with no `..Default::default()`.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- merge_`, `cargo test-fastly -- denial_`, `cargo test-fastly -- golden_merge_`, `cargo test-fastly -- ec::eids` and `cargo test-fastly -- auction::endpoints`
+Expected: FAIL, then PASS. The existing `merge_auction_eids_*` tests and the PBS and APS goldens (`pbs_request_serialization_goldens_cover_disabled_and_deterministic_enabled_signing` at `integrations/prebid.rs:9981`, and `aps_request_forwards_eid_provenance_fields_and_repeated_sources` at `integrations/aps.rs:2312`, the closest APS test; there is no APS golden) still pass with their expected values unchanged. Port the existing merge tests to the new signature without changing what they assert.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src
+git commit --signoff -S -m "Merge the server identity set into auction EIDs and apply provider denials" -m "A server value goes out as its whole entry set, one EID per stored entry, from KV only. A provider's provenance default applies only to an entry that sets no EID-level field. Browser candidates lose each UID a claiming provider invalidated or removed on opt-out, and every source of an opted-out owner or capture-only provider. Browser entries and one-UID records otherwise go out exactly as before."
+```
+
+### Task 29: Phase 4: the single flush after send, replacing pull sync
+
+**Files:**
+
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (the post-route part of `edgezero_main` at about lines 506-557 becomes `finalize_send_and_flush`; `apply_edgezero_ec_finalize`, `run_edgezero_pull_sync_after_send` and `prepare_pull_sync_after_send` at about lines 595-666)
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` (`AppState` gains `identity_graph: Option<KvIdentityGraph>`, used by `build_ec_request_state` (about line 450) and the admin lookup (about line 585) in place of per-request `maybe_identity_graph` calls; `app_state_for_settings` at about line 1462 gains a graph-taking twin for tests)
+- Create: `crates/trusted-server-core/src/ec/identity/flush.rs` (`run_after_send`)
+- Modify: `crates/trusted-server-core/src/ec/pull_sync.rs` (delete `dispatch_pull_sync`, `build_pull_sync_context` and `PullSyncContext`; keep the helpers generic pull uses)
+- Delete: `crates/trusted-server-core/src/ec/pull_sync_marker.rs`, with `COOKIE_TS_EC_PULL_COMPLETE` (`constants.rs:5`), the `EcContext` marker field and its accessors (`ec/mod.rs:187-212`, `:283`, `:366`, `:454`, `:581-616`), `validate_pull_sync_marker` and `reconcile_pull_sync_marker` calls (`ec/finalize.rs`, `publisher.rs:4495`), and the marker probe tests (`publisher.rs` at about line 8014)
+- Modify: `crates/trusted-server-core/src/publisher.rs` (the preload decision at about lines 4819-4831 drops `marker_valid`)
+- Modify: `crates/trusted-server-core/src/ec/kv.rs` and `ec/identify.rs` (delete `evaluate_cluster` once no caller is left, Step 3)
+- Test: `flush.rs`, `adapter-fastly/src/main.rs`, `adapter-fastly/src/app.rs`, `publisher.rs`
+
+**Interfaces:**
+
+- Consumes: `eligibility` with `Phase::AfterSend` and `outcome_to_changes` (Task 20), `dispatch` (Task 21), `mutation::apply` (Task 15), `write_removals` and `log_removal_lost` (Task 18), `compute_cluster_size` (Task 24)
+- Produces:
+  - `pub fn run_after_send(input: AfterSendInput<'_>) -> FlushOutcome`. `pub struct AfterSendInput<'a> { runtime: &'a IdentityRuntime, settings: &'a Settings, services: &'a RuntimeServices, graph: &'a KvIdentityGraph, context: &'a mut EcContext, status: StatusCode, rate_limiter: &'a dyn RateLimiter }`. The catalog and keys come from the runtime (Task 23), so no crate-private type is in the signature (P1). `#[derive(Debug, Clone, Copy, PartialEq, Eq)] pub enum FlushOutcome { Skipped, NoChange, Written, Dropped(&'static str), WriteFailed { removals: RemovalWriteOutcome } }`.
+  - In the adapter's `main.rs`: `fn finalize_send_and_flush(input: PostRouteInput<'_>, response: HttpResponse, send: &mut dyn FnMut(HttpResponse)) -> Option<FlushOutcome>` with `struct PostRouteInput<'a> { runtime: &'a IdentityRuntime, settings: &'a Settings, ec_state: &'a mut EcFinalizeState, graph: &'a dyn Fn() -> Option<KvIdentityGraph>, rate_limiter: &'a dyn RateLimiter }`. It takes the runtime and settings rather than `&AppState`, because the reload branch has no `AppState`. It runs finalize (Task 25) with the graph from `graph`, captures the status, hands the finalized response to `send`, runs the withdrawal retry (Task 27), then `run_after_send` with `ec_state.services`, and returns its outcome (`None` when there is no EC state). `edgezero_main` calls it with `send_edgezero_response` as `send`, `&state.identity` and `|| state.identity_graph.clone()` as `graph` (or `maybe_identity_graph(&settings)` on the reload branch, with that branch's runtime from Task 23's `build_identity_runtime`) and `FastlyRateLimiter::new(RATE_COUNTER_NAME)`. `send` is a callback, not a return value, so phase 4 still runs after the response is sent.
+  - In `main.rs` tests: `fn drive_request_for_test(state: &Arc<AppState>, request: HttpRequest) -> (HttpResponse, Option<FlushOutcome>)`. It routes the request with the router the existing `app.rs` tests use (`block_on(router.oneshot(request))`), then calls `finalize_send_and_flush` with a `send` that keeps the response, `|| state.identity_graph.clone()` and an allow-all rate limiter. Tests build `state` with `app_state_with_graph_for_test(settings, graph)` in `app.rs`, passing the graph from `KvIdentityGraph::write_counting` (Task 22), so routing, finalize and phase 4 all count against one store. Tasks 30 and 39b drive every request-level test through it.
+- `AppState` already holds the runtime (Task 23). This task adds only `identity_graph`.
+
+**Phase 1 reads on every returning writer navigation** (spec 5.2 phase 1, 6.3 step 1). The publisher preload (`publisher.rs`, `auction_needs_row` and the preload at about lines 3110-3117 and 4819-4831) reads the row whenever `ec_context.identity().writer()` and the EC is returning, in addition to today's auction rule, and without the pull-complete marker's skip. That one read finds orphans, answers eligibility and filters browser candidates (Task 36), so nothing needs a cookie copy of the row. `/auction` and `/_ts/page-bids` keep their reads unchanged.
+
+Phase 4 (`run_after_send`, spec 5.2 steps 1 to 5):
+
+1. If the request is not a returning-EC writer: `Skipped`. If `status` is not 2xx or 304 (spec 5.1), no after-send provider is due, and the mutation is cut down with `IdentityMutation::retain_for_error_status()` (added here): it keeps every removal, opt-out and clear, and the `ps.n` and `ps.f` of every outcome other than `found`, and drops browser ingest and every positive result with its state and scheduling. In Part 1 the mutation holds only browser ingest, so this empties it; Task 37's hold-mode outcomes are what it keeps.
+2. Collect the after-send providers: each provider `eligibility(.., Phase::AfterSend)` passes on the phase 1 view (`EligibilityView::from_kv`, Task 20). Without a phase 1 view (a failed read), use an empty view: step 3 re-reads before anything dispatches. If the mutation is empty and none is due: `Skipped`. No read.
+3. If phase 1 read the row (`Present` with a generation) and no after-send provider is due, use that snapshot. Otherwise call `graph.get(ec_id)`. A tombstone, `consent.ok = false`, a missing row or a failed read: `Dropped(reason)`, and stop. No provider is called before this check, so no EC ID is disclosed before consent is confirmed (as `ec/pull_sync.rs:100-110` does today).
+4. Recompute eligibility steps 4 and 5 for each after-send provider from the live row, rebuild its request from it (the live `ps.st` for a stateful provider), dispatch with `coordinator::dispatch(.., budget: None)`, and turn the outcomes into changes added to the mutation.
+5. If the live row has no `cluster_size`, add it with `compute_cluster_size` and `set_cluster_size`.
+6. `mutation::apply` against the live entry. If `changed`, write once with `IfGenerationMatch(generation)`: `Written`, or `NoChange` when nothing changed. Never retry the whole flush.
+7. On a failed write (a precondition failure, Fastly's per-key rate limit or any other error), log at `warn` with `log_id`. When `mutation.removals()` (Task 15) is not empty, run `write_removals(graph, ec_id, &removals, &context)` (Task 18): a re-read, the removal rules of section 5.4, and up to five attempts. `Failed` there calls `log_removal_lost` and `RequestIdentity::record_removal_lost` (Task 23) once per lost removal. Return `FlushOutcome::WriteFailed { removals }` with that `RemovalWriteOutcome`, using `RemovalWriteOutcome::NothingToWrite` when the mutation held no removal.
+
+`mutation::apply` writes each source's record whole (Task 15), so a multi-entry record the mutation does not touch keeps its `eids` byte for byte, and a version 1 row upgraded on write serializes as Task 6's golden expects.
+
+Remove `run_edgezero_pull_sync_after_send` and `prepare_pull_sync_after_send`. Their callers call `finalize_send_and_flush`. Build the KV graph after send exactly as today (`require_identity_graph`).
+
+- [ ] **Step 1: Write the failing tests**
+
+In `flush.rs`:
+
+- `writer_flushes_mutation_once_with_generation_match` (1 `IfGenerationMatch` write, no read after phase 1)
+- `writer_with_nothing_to_do_reads_and_writes_nothing` (0 reads, 0 writes)
+- `non_2xx_or_304_status_drops_ingest_and_dispatches_nothing` (and `retain_for_error_status_keeps_removals_and_backoff` in `mutation.rs`: a mutation with a `FillMissing`, an `OwnerWrite` from a `found`, an `OwnerRemove` and a `no_match` backoff keeps only the last two)
+- `tombstone_on_reread_drops_mutation_and_calls_no_provider` (the fake HTTP client sees zero calls)
+- `failed_phase_one_read_rereads_before_writing`
+- `due_generic_pull_provider_dispatches_after_reread_and_its_uid_lands_in_the_same_write` (and the record it lands is a one-entry record with `w = pull-…`)
+- `hold_provider_on_a_navigation_without_an_auction_runs_in_phase_four`
+- `cas_conflict_is_not_retried_as_a_whole` (1 flush attempt, `WriteFailed`)
+- `failed_flush_writes_its_removals_alone`: a mutation holding a `FillMissing`, an `OwnerRemove` and an opt-out, and a store that refuses the flush once. One flush attempt, then one removal write holding only the removal and the opt-out.
+- `failed_removal_retry_counts_removal_lost`: a store that refuses every write. Five removal attempts, then `removal_lost` counts each removal.
+- `burst_capped_provider_gets_sixty_second_backoff_in_the_write`
+- `missing_cluster_size_is_added_to_the_one_write`
+- `untouched_entry_set_is_preserved_by_the_flush` (a live row holding a multi-entry record and a sharedId fill in the mutation: the written row's record equals the live one, field for field)
+
+In `publisher.rs`: `returning_writer_navigation_reads_kv_without_an_auction` (one read, and a control: a stager navigation without an auction reads nothing), replacing the marker probe tests.
+
+In the adapter (`main.rs` tests): replace `pull_sync_noop_states_skip_post_send_graph_factory` with `after_send_noop_states_skip_post_send_graph_factory`, which checks that no graph is built when there is nothing to flush. Add `finalize_send_and_flush_sends_before_it_flushes`: a `send` callback that records the store's write count when it runs sees 0, and the outcome is `Written` with 1 write. Add `drive_request_for_test_counts_routing_finalize_and_flush_against_one_store`: a returning writer navigation with one change gives one read and one `IfGenerationMatch` write on the injected store. Add `no_response_sets_or_reads_the_pull_complete_cookie`.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- flush`, `cargo test-fastly -- returning_writer_navigation_reads_kv` and `cargo test-fastly`
+Expected: FAIL, then PASS.
+
+- [ ] **Step 3: Delete pull sync's dispatcher and the marker**
+
+Delete `dispatch_pull_sync`, `build_pull_sync_context`, `PullSyncContext`, `InFlightPull`, `pull_rate_limit_key` and `AllowAllRateLimiter` (its tests move with them; `drive_request_for_test` uses core's `test_support` allow-all limiter, or adds one there) from `ec/pull_sync.rs`, and `pull_sync_marker.rs` with every caller listed above. Then delete `KvIdentityGraph::evaluate_cluster` (`ec/kv.rs:1484`) and its two tests: Task 24 moved `/identify` to `compute_cluster_size`, and phase 4 writes the size through the mutation. `grep -rn "evaluate_cluster\|pull_sync_marker\|PULL_COMPLETE" crates/` must come back empty. Port every remaining pull sync test whose behaviour is unchanged to `generic_pull.rs` or `flush.rs` before deleting it. For each behaviour change in spec 10.4, write a test named after it:
+
+- `generic_pull_runs_only_on_returning_writer`
+- `new_visitor_reaches_pull_partners_from_second_page_load`
+- `generic_pull_results_join_the_single_flush`
+- `failing_pull_partner_backs_off_through_ps`
+- `rate_limit_key_is_per_visitor_not_per_ip`
+
+- [ ] **Step 4: Run everything**
+
+Run: `cargo test-fastly && cargo test-fastly-reuse && cargo clippy-fastly`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Flush identity changes once after send and run pull partners there" -m "Phase 4 replaces the pull sync after-send hook. It reuses the phase 1 snapshot when no after-send provider is due, otherwise re-reads the row, dispatches the due providers, and applies the whole mutation in one IfGenerationMatch write. A failed flush is not retried, but its removals are written alone with the shared CAS loop, and any that still fail are counted as lost." -m "Every returning writer navigation now reads KV in phase 1, so the pull-complete marker cookie is removed. Pull partners run only on a returning visitor's writer navigation and back off through ps. evaluate_cluster is removed."
+```
+
+### Task 30: Prove the one-write invariant, reads, G10 and G13
+
+**Files:**
+
+- Modify (tests only): `crates/trusted-server-adapter-fastly/src/main.rs`, a `#[cfg(test)] mod identity_writes` nested in its `mod tests`. The adapter is a binary crate with no `src/lib.rs`, so a `tests/` file could not import its items; every test here drives a request through Task 29's `drive_request_for_test`.
+- Modify (tests only): `crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts` or `eids.test.ts`, for the `ortb2` half of G10, the registered-only merge and the `ts-eids` golden
+- Test only
+
+**Interfaces:**
+
+- Consumes: `KvIdentityGraph::write_counting` and `WriteCountingEcKv` (Task 22), the fake HTTP client (Task 21), and Task 29's `drive_request_for_test` and `app_state_with_graph_for_test`. Core's `test_support` items are `pub` behind `test-utils`, which the adapter's dev-dependency on core enables.
+
+- [ ] **Step 1: Write the scenario table as tests**
+
+One test per row of spec 13's "One-write invariant" table that Part 1 can exercise. Each drives a full request through `drive_request_for_test` (routing, finalize, phase 4) and asserts the exact write counts by mode. The table's capture rows need Task 38, so they land in Task 39b as `captured_revocation_writes_with_cas`, `global_revoke_from_real_browser_writes_as_withdrawal` and `non_browser_capture_writes_nothing`. Part 1 has no hold mode, so the 3xx, 4xx and 5xx row is 0 here, and Task 39b adds its hold-mode half:
+
+| Test                                                        | Writes                                                        |
+| ----------------------------------------------------------- | ------------------------------------------------------------- |
+| `new_visitor_navigation_writes_once`                        | 1 `Add`                                                       |
+| `new_visitor_collision_remints_and_writes_once`             | 1 `Add` that lands (a precondition failure first)             |
+| `returning_visitor_with_changes_writes_once`                | 1 `IfGenerationMatch`                                         |
+| `returning_visitor_without_changes_writes_nothing`          | 0                                                             |
+| `revalidation_304_with_changes_writes_once`                 | 1                                                             |
+| `returning_navigation_answered_3xx_4xx_5xx_writes_nothing`  | 0 each                                                        |
+| `new_visitor_prefetch_writes_once`                          | 1 `Add`                                                       |
+| `returning_prefetch_writes_nothing`                         | 0                                                             |
+| `new_visitor_without_sec_fetch_dest_writes_once`            | 1 `Add`                                                       |
+| `returning_iframe_or_no_sec_fetch_dest_writes_nothing`      | 0                                                             |
+| `integration_proxy_navigation_minting_ec_writes_once`       | 1 `Add`                                                       |
+| `auction_page_bids_identify_proxy_and_assets_write_nothing` | 0 each                                                        |
+| `consent_withdrawal_writes_tombstone_and_marker`            | today's count, per ID, plus one after-send run when it failed |
+| `cas_conflict_on_flush_is_one_attempt`                      | 1 failed flush, then its removals alone (up to 5), or none    |
+
+Also write:
+
+- **Reads:** `returning_writer_navigation_reads_once`, `due_after_send_provider_adds_one_reread`, and `auction_and_page_bids_keep_one_read`. Each counts reads with the same store.
+- **No server identity cookie:** `no_response_sets_an_identity_cookie_other_than_ts_ec`: across every scenario above, no `Set-Cookie` names `ts-eids`, `__Host-ts-eids-s`, any `ts-eids-r` or `ts-ec-pull-complete`.
+- **The server never reads the mirror:** `forged_mirror_cookie_changes_nothing`: the same navigation and `/auction`, once without `__Host-ts-eids-s` and once with a forged, stale or malformed one. The bidder requests, the `/identify` answer and every KV write are identical.
+- **G10:** `registered_source_beyond_todays_trim_reaches_kv_on_next_navigation` (the shim's `ts-eids` from Task 26's trim, carrying a registered source today's trim would drop: the next navigation's single write holds it) and `ortb2_only_eid_reaches_kv` (below).
+- **Failed flush:** `refused_flush_is_rederived_by_the_next_navigation` (a refused write, then a second navigation with the same cookies: the second write holds the ingest) and `refused_flush_writes_its_removals_alone`.
+- **Orphans:** `deleted_row_is_found_by_the_next_writer_and_rotated` and `stager_that_sees_missing_row_returns_clear_and_next_writer_recovers`.
+- **Withdrawal:** `withdrawal_on_auction_after_navigation_send_makes_phase_four_drop_and_call_nothing`, and `withdrawal_returns_clear_for_the_mirror`.
+- **Servability (P2):** `generic_pull_uid_written_after_send_is_served_on_the_next_auction`: a returning writer navigation whose phase 4 lands a generic pull UID (`w = pull-…`), then an `/auction`: `user.ext.eids` carries the UID, and `ext.ts_eids_s` mirrors it. This is Task 23's `generic_pull_record_with_writer_is_served_after_flush` driven end to end.
+
+**R8: an EID present only in Prebid's `ortb2` config reaches `ts-eids` and KV (spec 13, G10).** Lockr writes its ID5 there. Two halves:
+
+1. In the shim's Prebid tests, add `ortb2_config_only_eid_reaches_ts_eids_and_the_auction_body` if the existing tests do not already cover it (`grep -n "ortb2" crates/trusted-server-js/lib/test/integrations/prebid/*.ts`). A bidder request whose `ortb2.user.ext.eids` holds an `id5-sync.com` entry that `getUserIdsAsEids()` does not return: `buildRequests` writes it into `ts-eids` and the `/auction` body. Assert the exact cookie value, and copy it into the Rust test as a fixture.
+2. `ortb2_only_eid_reaches_kv`: a returning writer navigation carrying that exact `ts-eids` value, with `id5-sync.com` registered and absent from KV. After the one write, KV holds the UID.
+
+**Complete provider EIDs (G13, spec 13).** Part 1 writes no multi-entry record, but reads, preserves and serves one (spec 14, step 1), so these seed version 2 records directly:
+
+- `entry_set_round_trips_from_kv_to_bidders`: a row holding a two-entry, three-UID record with every UID-level and EID-level field, for a registered unowned source the browser does not send. One `/auction`: `user.ext.eids` and `x-ts-eids` carry both entries after the browser entries, in stored order, every field intact, and the mirror payload holds the same entries.
+- `entry_set_survives_an_unrelated_flush`: the same row, then a navigation that flushes a sharedId fill. The written row's record is unchanged.
+- `expired_entry_set_is_never_served_or_mirrored`.
+- `version_1_row_is_served_and_upgraded_by_the_next_write`: a version 1 row with `uid` records. `/auction` serves them as today; the next writer navigation with a change writes version 2.
+
+**Behaviour that predates this spec (G13, spec 13).** Golden tests pin each path G13 must not change. Write each expected value from the code on `main`: run the test body in a worktree of `main` (`git worktree add`) and copy what it prints into the assertion, then never edit it. Where the row shape differs only by the version 2 encoding (Task 6), the assertion compares the decoded records:
+
+- `golden_browser_ingest_writes_the_first_uid`: a navigation whose `ts-eids` holds a registered source with two UIDs, `inserter`, `mm` and EID-level `ext`, and an unregistered source. The created or flushed row holds the same UID for the same sources as `main`'s row for the same input, apart from the record metadata Part 1 adds (`at`, `rv`).
+- `golden_one_uid_row_goes_out_unchanged`: a row of one-UID records, `/auction`, browser sends nothing. `user.ext.eids` and `x-ts-eids` equal `main`'s, byte for byte.
+- `golden_auction_body_forwarding_is_unchanged`: a body with repeated sources and EID-level fields and an empty KV row. `user.ext.eids` equals `main`'s.
+- The `ts-eids` cookie's content and EID-level `ext` removal belong to the shim, and Part 1 changes only its trim order. Check that the shim's Prebid tests pin both (`grep -n "MAX_EID_COOKIE_BYTES\|ts-eids" crates/trusted-server-js/lib/test/integrations/prebid/*.ts`), and add `ts_eids_cookie_golden` with a pinned value of a set with no unregistered source, which Task 26's trim leaves exactly as today.
+- The PBS and APS golden requests named in Task 28 pass unchanged.
+
+- [ ] **Step 2: Run them**
+
+Run: `cargo test-fastly -- identity_writes`, `cargo test-fastly -- golden_`, then `cd crates/trusted-server-js/lib && mise exec node@24.12.0 -- npx vitest run`
+Expected: PASS. A failure here is a real bug in Tasks 23 to 29. Fix it in the task that owns the behaviour, and do not loosen the test.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/trusted-server-adapter-fastly crates/trusted-server-js/lib/test
+git commit --signoff -S -m "Test the one-write-per-page-load invariant end to end" -m "Also pins the paths complete provider EIDs must not change, the ortb2-only EID reaching KV, entry sets read and served whole, version 1 rows upgraded on write, and a server that never reads the ts-eids-s mirror."
+```
+
+### Task 31: Metrics, docs and the Part 1 PR
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/finalize.rs` or `ec/identity/request.rs` (metrics)
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (emit the line after phase 4)
+- Modify: `docs/guide/edge-cookies.md`, `docs/guide/configuration.md`, `docs/guide/ec-setup-guide.md`, `docs/guide/api-reference.md`, `CHANGELOG.md`, `trusted-server.example.toml`
+
+- [ ] **Step 1: Metrics**
+
+Find how the repo emits request metrics or counters today (`grep -rn "record_eid_sync_terminal\|metric\|counter" crates/trusted-server-core/src/ec/finalize.rs | head`). Today that is a structured `log::info!` line (`EID sync measurement: ...`), which Task 25 removed for returning visitors (the new-EC `record_eid_sync_terminal` stays). These counters replace it. Emit them the same way, as one `log::info!("identity request measurement: ...")` line per request after phase 4, with no IDs and no cookie values:
+
+- the inbound `Cookie` header size in bytes (spec 14 step 1)
+- KV reads and writes per request, labelled by route kind (writer, stager, new EC)
+- the phase 4 outcome (`FlushOutcome` as a label)
+- `removal_lost` (Task 23), and whether a withdrawal tombstone needed its after-send run and whether that run failed (Task 27)
+
+Task 38 adds `capture_unpersisted` to the same line.
+
+Add `identity_measurement_records_counts_for_a_writer_navigation` (a writer navigation with one change: the measurement holds the `Cookie` header size, one read, one write and `Written`), and a control `identity_measurement_holds_no_identifier` that checks the formatted line contains neither the EC ID nor any UID or cookie value.
+
+- [ ] **Step 2: Docs**
+
+- `edge-cookies.md`: add a section for `__Host-ts-eids-s`: a client-only mirror of the server IDs that the shim writes from `/auction` and `/_ts/page-bids` responses for page scripts, with `Path=/; Secure; SameSite=Lax`, not `HttpOnly`, a `Max-Age` of at most one day and never past the earliest ID expiry, and a 2,048-byte cap that leaves out whole sources by `cookie_priority`. The server never reads it, and it is stripped from origin and Prebid Server requests (Tasks 1 to 4). Note that `ts-ec-pull-complete` is gone. Describe the writer-request rule in plain words: only a full page navigation from a returning visitor writes KV, once, after the page is sent. Say that the shim now writes only registered sources into `ts-eids` and merges each auction's entries per source.
+- `configuration.md`: the `[ec.identity]` table, with every key, its default and its meaning, from spec 10.1. Name `revoke_scope` as applying from Part 2. Name the removed keys and their replacements: `ec.pull_sync_concurrency` becomes `[ec.identity].max_concurrency`; `pull_sync_ttl_sec` becomes `refresh_after_sec` and `pull_sync_rate_limit = N` becomes `max_calls_per_minute = ceil(N / 60)`, both in `[ec.identity.providers.<pull-id>]` (Tasks 19 and 22). Give the ID rule with examples: `ssp.example.com` is `pull-ssp-example-com`, and a domain that contains `-`, or an ID over 63 characters, also gets `-` and 8 hex digits of the domain's SHA-256 (spec 10.4). Validation rejects the old keys. The capture provider checklist lands with capture, in Task 41.
+- `ec-setup-guide.md`: pull partners now run from a visitor's second page load, back off on errors, and are paced by their provider table.
+- `api-reference.md`: `/_ts/api/v1/identify`, `/auction` and `/_ts/page-bids` no longer write KV, and `/identify` omits expired IDs. `/identify`'s response shape is unchanged: one UID per source, even for a record that holds several. Document `ext.ts_eids_s` in the `/auction` response and `ts_eids_s` in the page-bids body, with the `value`, `clear` and absent cases (spec 6.2).
+- `configuration.md`, a "Rolling back" subsection after the `[ec.identity]` table (spec 14). This release moves KV to schema version 2, and a release before it cannot read a version 2 row, so a rollback past it is unsupported once it has written. For a later vendor release rolled back to this one: remove `owner` and every vendor `[ec.identity.providers.*]` table from the config first, because this release rejects an owner or a provider table it does not know; entry sets stay readable but are not served while their writer is not configured; and a write prunes an unconfigured provider's `ps` to `o`, `oc` and `ov`, so opt-outs survive while `ps.iv` and `ps.st` do not.
+- `CHANGELOG.md` `### Changed`: one entry each for:
+  - fewer KV writes, with the writer-request rule
+  - `/auction`, `/_ts/page-bids` and `/identify` no longer writing
+  - pull partners from the second page load, paced by their provider table
+  - the removed config keys and their replacements, and that validation now rejects the old ones
+  - the `ts-eids-s` mirror payload and the shim's registered-only `ts-eids` merge
+  - the removed `ts-ec-pull-complete` cookie
+  - KV schema version 2, and that rolling back past this release is unsupported
+  - the removed `EID sync measurement: ...` log line for returning visitors and its replacement, the `identity request measurement: ...` line, because operator dashboards may read it
+
+  Link the "Rolling back" subsection.
+
+Update `trusted-server.example.toml` with a commented `[ec.identity]` table and one commented `[ec.identity.providers.pull-ssp-example-com]` table.
+
+Run `cd docs && npm run format` and the root markdown prettier command from `AGENTS.md` gate 8.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/ docs/ CHANGELOG.md trusted-server.example.toml
+git commit --signoff -S -m "Document the single identity write and the ts-eids-s mirror"
+```
+
+- [ ] **Step 4: Part 1 gate and PR**
+
+Run `/check-ci`. Every gate must pass, including `scripts/lint-wasm-clock.sh` (new core code must not call `std::time::{Instant,SystemTime}::now`. Use `checked_current_timestamp()` and `web_time` where you need a clock), the parity crate, `./scripts/test-cli.sh`, and the shim's `npm run lint`, which CI's `format-typescript` job runs beside the format check. Open the implementation PR against the spec branch with `pr-creator`. Title: "Write identity KV once per page load". The description lists the behaviour changes from spec 14 step 1, the removed config keys, the `test-utils` feature reuse, and the rollback limit.
+
+# Part 2: Providers (spec 14, step 2)
+
+Part 2 lets integrations register providers, and adds ownership, hold mode, revoke-only passive capture (the capture removal write, its `capture_unpersisted` and `removal_lost` counters, the real-browser gate, and `revoke_scope` defaulting to `"provider"`), provider state and sticky opt-outs, the circuit breaker, and the consent decoding that strict policies need. It also brings the first full-set writes (G13): Part 1 already reads, preserves, serves and validates complete entry sets, and here registered providers start returning several entries or UIDs per source, or EID-level fields. Every path that predates the spec (browser ingest, `ts-eids`, batch sync, generic pull and the `/identify` response shape) keeps its Part 1 golden tests (the `golden_` tests) unchanged. No vendor ships here: ID5, LiveRamp, Lockr and UID2 each get their own spec and plan (spec 2.2). This part proves the framework with the fictional `exampleid` and capture providers from spec 4.6, registered only in tests.
+
+Before you start: `git switch feat/1246-identity-single-write && git switch -c feat/1246-identity-providers`.
+
+### Task 32: Registering identity providers
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs` (`IntegrationRegistration`, the builder around line 641, `with_plan` around line 842, and a new `from_registrations`)
+- Modify: `crates/trusted-server-core/src/ec/identity/catalog.rs` (`from_settings` adds registered providers)
+- Modify: `crates/trusted-server-core/src/ec/identity/runtime.rs` (`IdentityRuntime::from_settings` takes the integration registry)
+- Modify: `crates/trusted-server-core/src/config.rs` (`identity_descriptors_for_deploy`)
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` (`build_identity_runtime` passes the registry `build_state_from_settings` already builds, at about line 226)
+- Create: `crates/trusted-server-core/src/ec/identity/examples.rs` (`#[cfg(test)] pub(crate) mod examples;` in `mod.rs`)
+- Test: `integrations/registry.rs`, `ec/identity/catalog.rs`
+
+**Interfaces:**
+
+- Consumes: `IdentityRuntime` (Task 23), `ProviderCatalog::from_settings` and `validate_identity_catalog` (Task 22)
+- Produces:
+  - `IntegrationRegistrationBuilder::with_identity_provider(self, provider: Arc<dyn IdentityProvider>) -> Self`
+  - `IntegrationRegistrationBuilder::try_with_identity_provider<P: IdentityProvider + 'static>(self, provider: Result<P, Report<IdentityProviderError>>) -> Result<Self, Report<TrustedServerError>>`. A failure becomes `TrustedServerError::Integration { integration: <id>, message: <current_context()> }`.
+  - `IntegrationRegistry::identity_providers(&self) -> Vec<Arc<dyn IdentityProvider>>`
+  - `pub(crate) fn IntegrationRegistry::from_registrations(registrations: Vec<IntegrationRegistration>) -> Result<Self, Report<TrustedServerError>>`. `with_plan` gathers its registrations as today (`prebid::register_for_plan`, `aps::register_for_plan` and `crate::integrations::builders()`, `integrations/mod.rs:292`) and then calls it. The merge and validation loop moves into it, so tests can pass a test integration that no settings can add.
+  - In `from_registrations`: every capture path and prefix must lie under one of the registering integration's `IntegrationProxy::routes()`. Otherwise it is a `Configuration` error naming the integration.
+  - `ProviderCatalog::from_settings(settings, registered: &[Arc<dyn IdentityProvider>])` adds the registered providers after generic pull and runs Task 22's `validate_identity_catalog` over every descriptor, so a duplicate ID is reported by the one validator. `IdentityRuntime::from_settings(settings, integrations: &IntegrationRegistry)` passes `integrations.identity_providers()`. The adapter's `build_identity_runtime` passes `&registry`, both from `build_state_from_settings` and from the settings-reload branch.
+  - `pub(crate) fn identity_descriptors_for_deploy(settings: &Settings) -> Result<Vec<ProviderDescriptor>, Report<TrustedServerError>>`: the generic pull descriptors built from `settings.ec.partners` (Task 22, secret-free) plus one line per identity integration. No integration has a line in this PR. Task 33 adds the mechanism for one and the test line.
+  - `examples.rs` (`#[cfg(test)]`): `ExampleIdConfig`, `ExampleIdState`, `ExampleIdProvider` and the capture-only `ExampleCaptureProvider`, copied verbatim from spec 4.6, plus `example_config()`. Tasks 33, 38 and 39 import from here.
+
+- [ ] **Step 1: Write the failing tests**
+
+```rust
+    #[test]
+    fn try_with_identity_provider_converts_a_constructor_error_once() {
+        let failing: Result<ExampleIdProvider, Report<IdentityProviderError>> =
+            Err(IdentityProviderError::config("bad partner id"));
+        let error = IntegrationRegistration::builder("exampleid")
+            .try_with_identity_provider(failing)
+            .expect_err("should fail on a constructor error");
+        assert!(
+            matches!(error.current_context(), TrustedServerError::Integration { integration, .. } if integration == "exampleid"),
+            "should name the integration"
+        );
+
+        let built = IntegrationRegistration::builder("exampleid")
+            .try_with_identity_provider(ExampleIdProvider::new(&example_config()))
+            .expect("should register a valid provider")
+            .build();
+        assert_eq!(built.identity_providers.len(), 1, "should hold one registered provider");
+    }
+
+    #[test]
+    fn capture_rule_outside_the_integrations_routes_is_rejected_at_startup() {
+        let error = IntegrationRegistry::from_registrations(vec![capture_registration("/integrations/other/api")])
+            .expect_err("should reject a capture rule outside the integration's routes");
+        assert!(format!("{error}").contains("examplecapture"), "should name the integration");
+
+        IntegrationRegistry::from_registrations(vec![capture_registration("/integrations/examplecapture/api/token")])
+            .expect("should accept a capture rule under the integration's own routes");
+    }
+```
+
+`capture_registration(path)` is a test helper in this module. It builds an `IntegrationRegistration` for `examplecapture` with an `IntegrationProxy` whose routes sit under `/integrations/examplecapture/`, and an `ExampleCaptureProvider` whose capture path is `path`. Follow how existing registry tests build a stub integration (`grep -n "from_request_filters\|fn stub_" crates/trusted-server-core/src/integrations/registry.rs | head`).
+
+In `catalog.rs`: `registered_provider_with_a_generic_pull_id_is_rejected_by_the_shared_validator`. A registered provider whose ID equals a generic pull ID fails with Task 22's duplicate-ID error text. The control registers `exampleid` next to one pull partner and builds.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- integrations::registry::tests` and `cargo test-fastly -- ec::identity::catalog`
+Expected: FAIL, then PASS. Add `identity_providers: Vec<Arc<dyn IdentityProvider>>` to `IntegrationRegistration` and merge it in `from_registrations`, as proxies are merged. A route matches a capture path when the path equals the route's path or, for a wildcard route, starts with its prefix. Mirror how `handle_proxy` matches routes today. Existing `with_plan` tests must pass unchanged.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Let integrations register identity providers"
+```
+
+### Task 33: Ownership and deploy-time validation
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs` (`EcPartner` gains `owner`)
+- Modify: `crates/trusted-server-core/src/ec/registry.rs` (`PartnerConfig.owner`)
+- Modify: `crates/trusted-server-core/src/config.rs` (`validate_identity_integration`, and `identity_descriptors_for_deploy` gains its test line)
+- Modify: the module that holds Task 22's `validate_identity_catalog` (the ownership rules)
+- Modify: `crates/trusted-server-core/src/ec/identity/catalog.rs` (owners from `[[ec.partners]].owner`; Task 14's `sources` narrowing already applies)
+- Test: `config.rs`, and the `validate_identity_catalog` test module
+
+**Interfaces:**
+
+- Consumes: Task 22's `validate_identity_catalog(descriptors, partners, identity)`, which already rejects a duplicate provider ID, more than 32 providers (generic pull included), an `[ec.identity.providers.<id>]` table naming an unknown provider, and `revoke_scope` set for a provider whose descriptor declares no `captures`. This task adds rules to that one function. It does not add a second validator.
+- Produces:
+  - `EcPartner.owner: Option<String>` and `PartnerConfig.owner: Option<String>`, `#[serde(default, skip_serializing_if = "Option::is_none")]`
+  - `fn validate_identity_integration<T: IdentityProviderConfig + DeserializeOwned>(settings: &Settings, id: &str) -> Result<Option<ProviderDescriptor>, Report<TrustedServerError>>`. It parses `[integrations.<id>]` as `T` and, when enabled, calls `build_descriptor`. It never builds a provider and never reads secrets.
+  - New rules in `validate_identity_catalog`, every remaining error of spec 10.2:
+    - `owner` names a provider that is not enabled
+    - `owner` names a provider whose (narrowed) descriptor lacks that source
+    - an enabled provider claims a source with no `[[ec.partners]]` entry
+    - two enabled providers claim a source one of them owns (`sources` narrowing applied first)
+    - `sources` names an undeclared source, or narrows to nothing
+    - a capture-only provider (one that declares `captures` and no `resolves`) has no `[ec.identity.providers.<id>].sources` list: it must name the sources it is the delivery path for (spec 10.2)
+    - `owner` names a capture-only provider: a capture-only provider cannot own a source, because it stores no positive ID (spec 4.7)
+  - The deploy path (`validate_settings_for_deploy`, next to `PartnerRegistry::validate_config_for_deploy`) calls `validate_identity_catalog` on `identity_descriptors_for_deploy(settings)`. It never builds a `PartnerRegistry`, because `PartnerRegistry::from_config` validates API tokens that are still key names at deploy time. The runtime path validates through `IdentityRuntime::from_settings` (Task 32). `identity_descriptors_for_deploy` has one `validate_identity_integration::<T>` line per identity integration. No production integration has one in this PR. Under `#[cfg(test)]` it has one for `examples::ExampleIdConfig` (Task 32), so the list's shape is exercised.
+
+- [ ] **Step 1: Write the failing tests**
+
+One test per new rule above, each paired with a control config that passes. Also:
+
+- `config_without_ec_identity_is_accepted`
+- `build_descriptor_runs_in_deploy_validation_without_secrets`: a config whose secret field holds a key name, not a value, still validates
+- `capture_settings_on_a_provider_without_captures_are_rejected_at_deploy`: through `validate_settings_for_deploy`, `revoke_scope = "global"` on the resolve-only `exampleid` fails, naming the provider. The rule is Task 22's; this test proves the deploy path reaches it with an integration descriptor. The control is the same key on `ExampleCaptureProvider`'s descriptor, with its `sources` listed, which validates.
+- `capture_only_provider_without_sources_is_rejected` and `capture_only_provider_cannot_own_a_source`, each with a control.
+- `capture_enabled_has_no_effect`: a provider table holding `capture_enabled = true` loads (Task 19 keeps provider tables lenient) and changes nothing: a capture still stores no positive ID.
+
+For example:
+
+```rust
+    #[test]
+    fn owner_must_name_an_enabled_provider_that_declares_the_source() {
+        let descriptors = vec![descriptor("exampleid", &["exampleid.example.com"])];
+        let ok = vec![partner("exampleid.example.com", Some("exampleid"))];
+        validate_identity_catalog(&descriptors, &ok, &IdentitySettings::default())
+            .expect("should accept an owner that declares the source");
+
+        let unknown = vec![partner("exampleid.example.com", Some("missing"))];
+        let error = validate_identity_catalog(&descriptors, &unknown, &IdentitySettings::default())
+            .expect_err("should reject an owner that is not enabled");
+        assert!(format!("{error}").contains("missing"), "should name the owner");
+
+        let wrong_source = vec![
+            partner("exampleid.example.com", None),
+            partner("other.example.com", Some("exampleid")),
+        ];
+        validate_identity_catalog(&descriptors, &wrong_source, &IdentitySettings::default())
+            .expect_err("should reject an owner whose descriptor lacks the source");
+    }
+```
+
+`descriptor` and `partner` are test helpers in that module. `partner` builds the partner type Task 22's signature takes.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- validate_identity_catalog`, `cargo test-fastly -- owner`, and `cargo test-fastly -- config::`
+Expected: FAIL, then PASS.
+
+- [ ] **Step 3: CLI check**
+
+Run: `./scripts/test-cli.sh`
+Expected: PASS. `ts config validate` and `ts config push` call the deploy validation, so the CLI tests exercise the new pass. If a CLI fixture config now fails, it is a real config error by the new rules. Fix the fixture and say so in the commit.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Add source ownership and validate identity provider config at deploy"
+```
+
+### Task 34: Consent decoding for strict policies, and the consent fingerprint
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/consent/gpp.rs` (around `decode_us_sale_opt_out` at line 125, and the section-6 skip at line 112)
+- Modify: `crates/trusted-server-core/src/consent/types.rs` (decoded fields, and a redacting `Debug` for `ConsentContext`)
+- Modify: `crates/trusted-server-core/src/ec/identity/policy.rs` (new blocks, and the fingerprint bits)
+- Test: `consent/gpp.rs`, `consent/types.rs`, `policy.rs`
+
+**Interfaces:**
+
+- Consumes: Task 20's `fingerprint_bits` (TCF purposes, the vendor bit, the US sale opt-out, GPC and DNT, as a plain hex bitmask), which this task extends
+- Produces:
+  - Decoded on the GPP form: `us_sharing_opt_out: Option<bool>`, `us_targeted_advertising_opt_out: Option<bool>`, `us_gpc: Option<bool>` and `us_known_child: Option<bool>` (US National section), and the section 6 US Privacy string read through the existing US Privacy decoder. Use the `iab_gpp` fields the spec names: `sharing_opt_out` (US National, California) and `targeted_advertising_opt_out` (US National and the state sections that define it). Check the `iab_gpp` version in `Cargo.lock` and read its section structs before writing the extraction.
+  - `policy_allows` additionally blocks a strict policy on the sharing opt-out, the targeted-advertising opt-out, GPP's GPC field, and a known child without consent (a known child blocks every provider, whatever the relaxations).
+  - A GPP string that decodes but has no applicable section, such as the header-only `DBAA` (spec 9.1), keeps its decoded form with every new field `None`. It carries no opt-out, so it does not block `strict()` by itself. Task 12 owns the fail-closed rule (a raw string with no decoded form blocks). The new decoders must not turn an empty section list into a missing decoded form. Where TCF applies, the policy still needs TCF consent from a TC string or a GPP TCF section.
+  - `fingerprint_bits(policy, consent, signals)` appends two bits after Task 20's: the sharing and the targeted-advertising opt-out, each 0 when the policy relaxes it (spec 8). GPP's GPC field sets the existing GPC bit. Each signal keeps its own named bit position (`const FP_US_SALE: u32`, and so on, in `policy.rs`), so Task 36 can test the US opt-out bits by mask. Never the raw consent string.
+  - Pub(crate) consts `FP_US_OPT_OUT_MASK` (sale, sharing, targeted advertising, GPC) for Task 36.
+  - A hand-written `impl fmt::Debug for ConsentContext` that prints `[redacted]` for every raw string
+
+- [ ] **Step 1: Write the failing tests**
+
+- In `gpp.rs`: one decode test per new field, per section that defines it, using GPP strings built the way existing tests build them. Each asserts the decoded value, next to a control string where the field is not set.
+- In `policy.rs`: `strict_blocks_sharing_targeted_gpc_field_and_known_child`, and `targeted_advertising_opt_out_without_sale_opt_out_blocks_strict`.
+- In `policy.rs`: `header_only_gpp_does_not_block_strict_where_tcf_does_not_apply`. A request outside TCF jurisdiction with only the GPP string `DBAA` passes `strict()`. Two controls: the same string with `gdpr_applies` and no TC string fails for lack of TCF consent, and an undecodable GPP string fails closed, as Task 12 has it.
+- In `gpp.rs`: `header_only_gpp_decodes_with_no_section_fields`. `DBAA` decodes, `section_ids` is empty, and every new field is `None`.
+- `consent_context_debug_redacts_raw_strings`: `format!("{context:?}")` does not contain the TC string.
+- `fingerprint_is_stable_across_cmp_resaves_and_changes_with_a_purpose`: two TC strings with identical decisions but different `LastUpdated` give the same bits, and dropping purpose 4 changes them.
+- `fingerprint_bits_name_each_opt_out_separately`: setting only the sharing opt-out and setting only the targeted-advertising opt-out give two different bitmasks, both different from neither, and each sets only its own bit.
+- `fingerprint_keeps_part_1_bit_positions`: a consent that sets only Part 1 signals gives the same hex value as Task 20's function did (pinned).
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- consent::` and `cargo test-fastly -- ec::identity::policy`
+Expected: FAIL, then PASS. Do not change any existing auction consent decision. Run `cargo test-fastly -- auction::` and `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity` to confirm.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src/consent crates/trusted-server-core/src/ec/identity
+git commit --signoff -S -m "Decode the GPP opt-outs strict identity policies need" -m "Adds the US sharing and targeted-advertising opt-outs, GPP section 6, and the US National GPC and known-child fields. A header-only GPP string with no applicable section still does not block a strict policy. ConsentContext's Debug output no longer prints raw consent strings."
+```
+
+### Task 35: Rate-limiter `record` and `count`, and the circuit breaker
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/rate_limiter.rs` (trait)
+- Modify: `crates/trusted-server-core/src/ec/batch_sync.rs` (`MockRateLimiter`, about line 328, implements the new methods)
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs` (`FakeRateLimiter`)
+- Modify: `crates/trusted-server-adapter-fastly/src/rate_limiter.rs` (`FastlyRateLimiter`)
+- Modify: `crates/trusted-server-core/src/ec/identity/coordinator.rs` (breaker in dispatch, eligibility step 6)
+- Test: `rate_limiter.rs` (adapter), `coordinator.rs`
+
+**Interfaces:**
+
+- Produces:
+  - `RateLimiter::record(&self, key: &str) -> Result<(), Report<TrustedServerError>>` and `RateLimiter::count(&self, key: &str) -> Result<u32, Report<TrustedServerError>>`. Both are trait methods without defaults, so every implementation must decide: `FastlyRateLimiter`, `MockRateLimiter` in `ec/batch_sync.rs`, and `FakeRateLimiter`. (`AllowAllRateLimiter` in `ec/pull_sync.rs` is gone since Task 29.) Fastly uses `counter.increment(key, 1)` and `counter.lookup_count(key, CounterDuration::SixtySecs)`, and maps errors the way `exceeded` does.
+  - `pub struct FakeRateLimiter` in `test_support.rs` (public under `test-utils`, as the module's other items), storing counts in a `Mutex<HashMap<String, u32>>`
+  - Breaker: before dispatch, `count("identity-fail:<provider>") >= breaker_failures_per_minute` gives `CallOutcome::BreakerOpen` (not dispatched, `ps` unchanged). After dispatch, only `TransportFailure` outcomes (transport errors, timeouts, 429 and 5xx) call `record("identity-fail:<provider>")`. `HoldCutOff` is a budget cut, not a provider failure, and never records (spec 4.7).
+  - Limiter errors. If `count` fails, log it and treat the breaker as closed. If the burst-cap check fails, log it and do not dispatch that provider on this request. If `record` fails, log it and keep the outcome.
+
+- [ ] **Step 1: Write the failing tests**
+
+In core, with `FakeRateLimiter`, which can also be set to fail each method:
+
+- `breaker_opens_at_threshold_and_skips_every_visitor`
+- `four_xx_and_malformed_never_open_the_breaker`: 1,000 visitors with 400 responses leave `count` at 0
+- `hold_cut_off_does_not_record_a_failure`
+- `burst_cap_is_checked_after_every_other_eligibility_step`: an ineligible provider never increments the burst counter
+- `breaker_count_error_treats_the_breaker_as_closed`
+- `burst_cap_error_skips_the_dispatch`
+
+In the adapter: the existing `mod tests` in `rate_limiter.rs` tests only pure helpers and never calls the counter, because Viceroy 0.17's Edge Rate Limiting host calls cannot be relied on to count (this plan has not confirmed that they do). Keep that pattern. Put the two counter calls behind a private `trait CounterOps { fn increment(&self, key: &str) -> ...; fn lookup_count(&self, key: &str) -> ...; }`, implemented for `RateCounter`, and test `record` and `count` against a fake `CounterOps`: `record_increments_once`, `count_reads_the_sixty_second_window`, and `counter_errors_map_to_kv_store_errors`.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- rate_limiter`, `cargo test-fastly -- breaker`, `cargo test-fastly -- burst_cap` and `cargo test-fastly -- ec::batch_sync`
+Expected: FAIL, then PASS.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Add a per-provider circuit breaker on transport failures"
+```
+
+### Task 36: Owner precedence, opt-out re-grants and the admin clear
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/identity/coordinator.rs` (opt-out clearing on re-grant)
+- Modify: `crates/trusted-server-core/src/auction/endpoints.rs` and `publisher.rs` (the owned precedence row)
+- Modify: `crates/trusted-server-core/src/ec/admin.rs` (an operator clear of `ps.o`)
+- Modify: `crates/trusted-server-core/src/settings.rs` (`Settings::ADMIN_ENDPOINTS`, about line 3346)
+- Modify: the admin route tables of all four adapters: `crates/trusted-server-adapter-fastly/src/app.rs` (routes at about line 1149, the module doc table at lines 25-26), `crates/trusted-server-adapter-axum/src/app.rs` (about line 365), `crates/trusted-server-adapter-cloudflare/src/app.rs` (about line 640) and `crates/trusted-server-adapter-spin/src/app.rs` (`named_fallback_paths`, about line 224, whose array length grows by one)
+- Test: `coordinator.rs`, `auction/endpoints.rs`, `publisher.rs`, `ec/admin.rs`, `settings.rs`, adapter `app.rs` tests
+
+**Interfaces:**
+
+- Consumes: Task 28's `ServerSet`, `Denials` and `filter_browser_candidates`, which already drop denied browser UIDs and every source of an opted-out owner or capture-only provider; Task 34's `fingerprint_bits` and `FP_US_OPT_OUT_MASK`; Task 15's `opt_out_clear`, which also empties `ps.ov`
+- Produces:
+  - `pub(crate) fn regrant_clears_opt_out(descriptor: &ProviderDescriptor, opt_out: &KvOptOut, consent: &ConsentContext, signals: PolicySignals) -> bool` (spec 8):
+    - **GVL vendor:** `o.fp` has the TCF bit (`FP_TCF`, bit 16) and lacks the vendor bit or a required purpose bit, and the current TC string grants the vendor and every required purpose. No `LastUpdated` comparison (revised after the round 14 review; test `tcf_regrant_clears_only_a_denial_the_opt_out_recorded`).
+    - **Watermark:** `opt_out_clears` returns `(provider, o.at)` for the opt-out the request read, and the clear stores that `at` as `oc`, not `now`. `apply_clear` lifts the opt-out when `o.at <= watermark` and `oc < watermark`; `is_opted_out` holds while `oc` is absent or `< o.at`; an opt-out applies when `at > oc`. Clears apply before opt-outs in `apply_state`. Tests: `opt_out_clears_carry_the_opt_out_they_saw`, `a_clear_lifts_only_the_opt_out_it_saw`, `a_clear_watermark_lifts_the_opt_out_it_saw`.
+    - **Any provider, under GPP:** parse `o.fp` as a `u64` (Task 6 validates it as hex). Clear when `fp & FP_US_OPT_OUT_MASK` is not 0 and the current `fingerprint_bits` has none of the US opt-out bits `fp` recorded set: `current & fp & FP_US_OPT_OUT_MASK == 0`. Other bits may differ; the spec clears "whatever else changed" (spec 13).
+    - A jurisdiction change, a newly present GPP string, or a relaxed signal never clears. A `fp` that does not parse never clears.
+  - When it clears, the writer adds `opt_out_clear = Some(now)` to that provider's `ProviderStateChange`. Clears are writer-only on the resolve path, so they ride the one flush; Task 38 adds the capture-only clear through the capture removal write.
+  - The owned row of the precedence table becomes active (spec 7.1). The owner's valid value (`w == owner`, not expired) is its whole entry set, and it replaces every browser entry for the source, all of them when the browser repeated the source. The two are never mixed. Task 28's output rules then send it, one `Eid` per stored entry in stored order, after the browser entries. Without an owner's valid value, the browser's value goes out after Task 28's denials. When the browser did not send the source, a browser-seeded value is used only if the source does not expire. A browser-seeded record never beats the browser's current value.
+  - Admin: `DELETE /_ts/admin/ec/{id}/providers/{provider}/opt-out`, which clears `ps.o` by writing `oc = now` through the existing admin write path, behind the same Basic-auth coverage. The clear empties `ps.ov` (Task 15). Add the path to `Settings::ADMIN_ENDPOINTS` so its sync test (about `settings.rs:8191`) covers it. Add the route to all four adapters. The Fastly adapter calls the core handler; Axum, Cloudflare and Spin return the same "not available on this adapter" response they give the EC lookup. Keep the Fastly reserved-path test's `/_ts/admin/ec/{ec_id}/extra` case (app.rs, about line 2078) as a path that must not route.
+
+- [ ] **Step 1: Write the failing tests**
+
+- `tcf_regrant_after_opt_out_clears_it` and `jurisdiction_change_never_clears_it`
+- `gpp_regrant_clears_when_none_of_the_recorded_opt_outs_remain`: the opt-out was stored with the sale bit set, and the current section shows no opt-out. It clears even with purpose 4 also changed. Two controls: a current section that still shows the sale opt-out does not clear, and a stored `fp` with no US opt-out bit never clears by GPP.
+- `regrant_clear_empties_ov`: after the clear flushes, `ps.ov` is empty and the browser UID it held goes out again.
+- `owner_valid_value_beats_browser_value`
+- `owner_valid_set_replaces_every_repeated_browser_entry`: the browser sends the owned source twice, and the owner's stored set has two entries with three UIDs and EID-level fields. Exactly the owner's two entries go out, in stored order, with every field written out.
+- `targeted_opt_out_blocks_server_ids_flush_and_mirror` (spec 13): a targeted-advertising opt-out without a sale opt-out gives no server-side IDs in `user.eids`, no flush of that provider's entries, and none in the `ts-eids-s` mirror payload
+- `browser_seeded_value_never_beats_browser_current_value`
+- `expiring_owned_source_never_serves_browser_seeded_value`
+- `unowned_source_keeps_the_browser_first_rule` (control)
+- `admin_clears_provider_opt_out`, `admin_opt_out_route_is_in_admin_endpoints`, and, per adapter, a test that the `DELETE` path routes (Fastly) or returns the not-available response (the others)
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- regrant`, `cargo test-fastly -- owner`, `cargo test-fastly -- targeted_opt_out`, `cargo test-fastly -- browser_`, `cargo test-fastly -- ec::admin`, `cargo test-fastly -- admin`, `cargo test-axum`, `cargo test-cloudflare` and `cargo test-spin`
+Expected: FAIL, then PASS. The merge tests compare whole `Vec<Eid>` values with every field written out, with no `..Default::default()`. Task 28's `merge_` and `denial_` tests and the Part 1 `golden_` tests for browser entries must pass unchanged.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Apply owner precedence and clear provider opt-outs on re-grant"
+```
+
+### Task 37: Hold mode on the writer navigation
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs` (before the navigation auction dispatch, about lines 4886-4889)
+- Modify: `crates/trusted-server-core/src/ec/identity/coordinator.rs` (`run_hold`, `HoldResults`)
+- Modify: `crates/trusted-server-core/src/ec/identity/mutation.rs` (tag hold outcomes for `retain_for_error_status`, Task 29)
+- Test: `coordinator.rs`, `publisher.rs`, `mutation.rs`
+
+**Interfaces:**
+
+- Consumes: `IdentityDeps` (Task 21), `eligibility` with `Phase::Hold` and `outcome_to_changes` (Task 20), `dispatch` with a budget (Task 21), the `ServerSet` (Task 28), and `IdentityMutation::retain_for_error_status` (Task 29)
+- Produces:
+  - `pub(crate) struct HoldResults { additions: BTreeMap<SourceDomain, Vec<KvEid>>, writer: BTreeMap<SourceDomain, IdentityProviderId> }`: the answers this auction's server set adds, per source, with the provider that wrote each, so Task 28's output rules can apply that provider's provenance default. `ServerSet::with_hold_results(&mut self, results: HoldResults)` overlays them, replacing the stored value for each source they name.
+  - `pub(crate) async fn run_hold(deps: &IdentityDeps<'_>, context: &mut EcContext) -> HoldResults`, awaited by `hold_before_auction` in `handle_publisher_request` (see `dispatch`, Task 21, for why it must not block). On a returning writer navigation that runs an auction, it dispatches every provider `eligibility(.., Phase::Hold)` passes on the phase 1 view, within `hold_budget_ms` measured from the first dispatch, each waiting `min(hold_timeout_ms, remaining budget)` (spec 4.7). The phase 1 read already confirmed a live, consenting row, so no EC ID is disclosed before consent is confirmed.
+    - Each outcome becomes changes through `outcome_to_changes` and joins the writer's mutation, stateful providers included. No answer goes into a cookie (spec 4.7, "Results").
+    - Each `found` set also feeds this auction through `HoldResults`: one `Eid` per entry, in the order the provider returned it, after the browser entries, with the provider's provenance default applied (Task 28).
+    - A cut-off call is `HoldCutOff`: `n = now + hold_retry_sec`, and no failure is counted.
+  - The mutation tags each change and state change with whether it came from a `found` outcome, so `retain_for_error_status` (Task 29) keeps a hold call's removals, opt-outs and the `ps.n`/`ps.f` of every outcome other than `found`, and drops its positive answers, when the origin answers with a status other than 2xx or 304 (spec 5.1).
+- Nothing else runs hold mode. `/auction`, `/_ts/page-bids` and every other stager run no resolving provider (spec 5.3). A hold-mode provider on a writer navigation without an auction runs after send in phase 4 (Task 20's `Phase::AfterSend` rule, Task 29), with `after_send_timeout_ms`.
+- The navigation takes `IdentityDeps` inside its existing deps or context struct, so it passes no more than 7 arguments.
+
+- [ ] **Step 1: Write the failing tests**
+
+With the fake HTTP client's latency control. Every test name contains `hold`:
+
+- `auction_starts_at_the_hold_budget_when_a_provider_is_slow` (the elapsed fake time equals the budget, and the auction ran)
+- `hold_answer_feeds_this_auction_and_joins_the_mutation`
+- `full_set_hold_answer_is_sent_in_order_and_flushed_whole`: two entries, three UIDs, no EID-level fields on the second entry and `inserter` on the first. `user.ext.eids` carries both entries in order. The first entry goes out exactly as returned. The second, which sets none of `inserter`, `matcher` or `mm`, gets the provider's provenance default. The one flush stores the set as returned, without the default.
+- `hold_sets_no_cookie`: no `Set-Cookie` beyond today's on the navigation response.
+- `stateful_hold_answer_flushes_its_state_with_its_ids`
+- `cut_off_hold_call_sets_hold_retry_without_counting_a_failure`
+- `no_hold_on_a_stager`: `/auction` and `/_ts/page-bids` for the same visitor, with the hold provider due, make no provider call.
+- `hold_provider_moves_after_send_on_a_navigation_without_an_auction`: dispatched in phase 4 with `after_send_timeout_ms`, and a miss is a transport failure, not a cut-off.
+- `writer_navigation_with_non_2xx_status_flushes_hold_removals_and_backoff_only`: a 404 navigation whose hold calls returned one `found`, one `no_match` and one `invalidate`. The one write holds the `no_match` `ps.n` and the removal, and no ID from the `found`.
+- `hold_no_match_on_a_writer_stops_recalls_from_the_spa_session`: after the writer's flush, a run of `/auction` and `/_ts/page-bids` calls never calls the provider before `ps.n`.
+- `hold_kv_opt_out_blocks_dispatch`
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- hold`
+Expected: FAIL, then PASS. Use the platform's time source the auction orchestrator uses for its own timeouts. Do not use `std::time::Instant::now` (`scripts/lint-wasm-clock.sh` rejects it in shared crates).
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src
+git commit --signoff -S -m "Run hold-mode identity providers before the writer navigation's auction" -m "Answers feed that auction and join the writer's single flush. Stagers run no provider, and a navigation without an auction runs hold-mode providers after send instead."
+```
+
+### Task 38: Revoke-only passive capture
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs` (`handle_proxy`, about lines 1031-1065)
+- Modify: `crates/trusted-server-core/src/ec/identity/coordinator.rs` (`run_capture`)
+- Modify: `crates/trusted-server-core/src/ec/finalize.rs` (`ec_finalize_response`: a requested global revoke takes the withdrawal branch)
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs` (`finalize_send_and_flush` runs the pending removal retry after send)
+- Modify: the identity measurement line of Task 31 (`capture_unpersisted`)
+- Modify: `crates/trusted-server-core/src/integrations/lockr.rs` (log only the upstream path, about line 204)
+- Test: `integrations/registry.rs`, `coordinator.rs`, `ec/finalize.rs`, `integrations/lockr.rs`, `adapter-fastly/src/main.rs`
+
+**Interfaces:**
+
+- Consumes: `ProxyDispatchInput.is_real_browser` (Task 23), `decode_body` (Task 21), `outcome_to_changes` (Task 20), `PartnerIdChange` and `ProviderStateChange` (Task 15), `write_removals`, `RemovalWriteOutcome` and `log_removal_lost` (Task 18), `RequestIdentity::pending_removals`, `record_removal_lost` and `record_unpersisted` (Task 23), `ProviderSettings.revoke_scope` (Task 19), `regrant_clears_opt_out` (Task 36), and `ExampleCaptureProvider` and `capture_registration` (Task 32)
+- Produces:
+  - `pub(crate) struct CaptureCall<'a> { method: &'a Method, path: &'a str, status: StatusCode, headers: &'a HeaderMap, body: &'a [u8] }`. One struct, so `run_capture` stays under 7 arguments. There is no request-body consent: the request body is never read (spec 4.7).
+  - `pub(crate) fn run_capture(deps: &IdentityDeps<'_>, graph: Option<&KvIdentityGraph>, context: &mut EcContext, call: &CaptureCall<'_>)`
+  - `EcContext::request_global_revoke(&mut self)` and `EcContext::global_revoke_requested(&self) -> bool`. `run_capture` sets it from any client. `global_revoke_requested` is `pub`: the Fastly adapter gives finalize the identity graph when it is set, whatever the client, as it does for a consent withdrawal.
+  - `pub fn retry_pending_removals(context: &mut EcContext, graph: &KvIdentityGraph)`: after send, one more `write_removals` for a capture removal write that failed before send.
+
+`handle_proxy` per request, only when some provider's `Captures::matches(method, path)`:
+
+1. **After `handle`,** on 2xx only: buffer the response up to `max_response_bytes`. A larger body is passed through uncaptured. Decode a copy with `decode_body`, call `capture` per matching provider, and re-wrap the original bytes with `EdgeBody::from(bytes)` so the browser receives the response unchanged. The request body is never read or buffered.
+2. **The real-browser gate covers clears only** (spec 4.7). Removals, opt-outs and global revokes apply whatever the client, as consent withdrawals do. A clear passes `passes_consent_steps`, which requires the request's `is_real_browser`, so a client that fails `looks_like_browser()` never clears an opt-out.
+3. **Build the removal mutation** from any client. From each capture result, through `outcome_to_changes` on the request's KV view, keep only:
+   - its removals: `OwnerRemove` for `invalidate` and `also_invalidate`, and the opt-out's `WriterRemove`s, including a capture-only provider's browser records of its sources (Task 20). The hashes are derived when the mutation applies (Task 15).
+   - its opt-out: `ps.o = {at: now, fp}` and `st = Clear`
+   - a clear: when the result has positive IDs, eligibility steps 1 to 3 pass under the request's consent, and the provider has a sticky `ps.o` that only a capture can clear (a capture-only provider without a GVL ID, spec 8): `opt_out_clear = Some(now)`
+   - nothing else. Capture never touches `n`, `f` or the breaker. A state change in a result is ignored with a warning. Each positive source is counted in `capture_unpersisted` (`record_unpersisted(provider, source)`) and never stored.
+4. **The capture removal write** (spec 5.3), before the proxied response is sent: `write_removals(graph, ec_id, &mutation, &context)` (Task 18). It re-reads, applies the removal rules of section 5.4, and writes with a CAS, up to five attempts, retrying only on a generation mismatch. `NothingToWrite` covers a tombstone, a missing row and a removal already applied. On `Failed`, the mutation is kept in `RequestIdentity::pending_removals`, and `finalize_send_and_flush` calls `retry_pending_removals` once after send. When that fails too, `log_removal_lost` logs at error with the provider ID and source only, and `record_removal_lost` counts each removal. Without a graph, there is nothing to write.
+5. **On an integration-proxy writer navigation** the capture still goes through the capture removal write, never into the writer's mutation (spec 5.2 phase 3). The writer's own phase 4 flush then fails its CAS if the capture write landed first, which is the existing rule (spec 5.2 phase 4 step 2), and its removals are retried alone.
+6. **Revoke scope** (spec 8). A captured `opted_out` with `revoke_scope = "provider"` (the default) is the provider opt-out above. With `"global"`, from any client, `run_capture` calls `context.request_global_revoke()` and writes nothing else for that result. `ec_finalize_response` treats a requested global revoke exactly like `ec_consent_withdrawn`: the row is tombstoned through `tombstone_existing_from_snapshot`, the EC cookie is expired, the request's mutation is dropped, and a failed tombstone gets Task 27's after-send run. This is the withdrawal's existing page-load exception, not a new one. After the round 14 review, finalize also calls `set_revoke_marker` (`ec/cookies.rs`): `ts-ec-revoked` holds `revoke_marker_value(consent)`, the strict policy's `fingerprint_bits` without DNT. `EcContext` reads the cookie in `read_from_request`; `generate_if_needed` returns early while `revoke_blocks_minting()`; a minted EC's response expires a marker the request carried. Tests: `a_revoke_marker_for_this_consent_stops_minting_until_consent_changes`, `read_from_request_reads_the_revoke_marker`, `capture_global_revoke_sets_the_minting_marker`, `minting_under_changed_consent_expires_a_stale_marker`.
+7. **Pending key** (spec 5.3, added after the round 14 review). `ec/identity/pending.rs` holds `KvPending` (`items: [{g, at, ch, ps}]`), `append_pending` (CAS append, one-day TTL, 16 items, `g = max(last + 1, now * 1000)`) and `load_pending(graph, ec_id, applied)`. `KvEntry` gains `pg`. `run_after_send` reads the key for every returning writer, merges items above `pg` before the request's mutation, and stores the newest `g`; `write_failed` and `retry_pending_removals` append the request's own removals through `defer_or_lose` and count `removal_deferred`, or `removal_lost` when the append fails. `capture_ask` keeps positive changes that pass the consent steps and differ from the view: the writer stages them, any other request appends them after send through `defer_capture_writes`, which the Fastly adapter calls after the capture retry. Tests: `appended_items_merge_once_past_the_watermark`, `a_full_key_refuses_and_expired_items_make_room`, `a_generation_never_falls_below_the_clock`, `a_removal_the_row_write_missed_goes_to_the_pending_key`, `the_next_writer_merges_the_pending_key_once`, `capture_removal_after_both_attempts_goes_to_the_pending_key`, `capture_positive_from_another_request_waits_in_the_pending_key`, `capture_positive_from_the_writer_joins_its_flush`, `capture_positive_is_kept_only_from_a_browser_and_when_it_changes_kv`, and the adapter's `capture_removal_after_both_attempts_reaches_the_row_through_the_pending_key`.
+8. **SPA writer** (spec 5.1, added after the round 14 review). `IdentitySettings.spa_writer_interval_sec` (default 300). `KvEntry` gains `wa`, set by every writer flush that writes. `EcContext::decide_spa_writer(req, interval)`, called by `handle_page_bids` after its cross-site gate, makes a real-browser `Sec-Fetch-Site: same-origin` call the writer and sets `RequestIdentity::spa_writer`. `run_after_send` skips an SPA writer without a phase 1 row or within the interval of `wa`, and `due_providers` drops hold-mode providers for it. Tests: `decide_spa_writer_needs_a_same_origin_browser_and_an_interval`, `spa_writer_waits_out_the_interval_since_the_last_write`, `spa_writer_runs_no_hold_mode_provider`, and the adapter's `same_origin_page_bids_is_the_spa_writer_once_the_interval_passes`.
+9. **New-visitor hold** (spec 4.7, added after the round 14 review). `EcContext::generate_if_needed` splits into `new_entry_if_needed` and `create_entry`; `mint_deferred` mints without writing and `complete_deferred_create` creates with one attempt. `IdentityRuntime::holds_on_first_navigation` makes the Fastly publisher fallback mint deferred. `run_hold` dispatches a new visitor on the deferred row, skipping `gets_ec_id` providers, and stores its answers in that row; `request_facts` treats a deferred EC as not a new visitor. `handle_publisher_request` runs that hold and the create before the preload; `ec_finalize_response` creates a row nothing else did. Tests: `new_visitor_hold_answer_feeds_the_auction_and_rides_the_create`, `mint_deferred_writes_nothing_until_the_create`, `deferred_create_fails_on_a_collision_instead_of_reminting`, `finalize_creates_a_deferred_ec_its_navigation_did_not`, and the adapter's `new_visitor_hold_answer_is_created_with_the_row_in_one_write`.
+10. **Declared consent purposes** (spec 4.3, added after the round 14 review). `ConsentPolicy::strict()` requires Purpose 1 only; `with_tcf_purposes` records that purposes were declared, and the new `without_tcf_vendor` opts out of vendor consent. `ProviderDescriptorBuilder::build` rejects a resolver whose policy declares no purposes, or names no vendor without that opt-out; `eid_persistence_only` satisfies both. `revoke_marker_value` fingerprints all ten purposes. Test fixtures use `test_support::resolver_policy()` (Purposes 1 and 4, no vendor), today's behaviour. Tests: `strict_requires_only_purpose_one_until_purposes_are_declared`, `a_resolver_must_declare_its_purposes_and_vendor`, `revoke_marker_changes_with_any_purpose_decision`. The #1461 vendors declare their GVL purposes.
+11. **Lockr proxy logging** (spec 9.3). In `integrations/lockr.rs`, log only the upstream path: `log::info!("Forwarding to Lockr API path: {target_path}")`. The query string can carry identifiers and never reaches a log.
+
+Add `capture_unpersisted` (per provider and source, counts only) to Task 31's measurement line.
+
+- [ ] **Step 1: Write the failing tests**
+
+Using `capture_registration` and `ExampleCaptureProvider` (Task 32), and `KvIdentityGraph::write_counting` (Task 22). Every test name contains `capture`:
+
+- `capture_runs_only_for_matching_rules`
+- `capture_decodes_gzip_and_brotli_responses_and_forwards_them_unchanged` (byte-equal body to the browser)
+- `capture_never_reads_the_request_body` (a request body with an email field: the body reaches the upstream unchanged, the provider sees none, and a log capture shows no email)
+- `capture_stores_no_positive_id_and_counts_it`: a capture returning two sources stores nothing for them, and `capture_unpersisted` holds one count for each, with no value.
+- `capture_removal_is_written_before_send`: an `also_invalidate` from a real browser gives one CAS write before the response is sent, and the row's `ps.iv` holds the record's hashes.
+- `capture_removal_applies_whatever_the_consent`: the same capture under denied consent writes the same removal.
+- `capture_removal_write_retries_only_on_generation_mismatch` (a store that fails the CAS twice then succeeds: 3 attempts; a non-CAS error: 1 attempt)
+- `failed_capture_removal_write_runs_once_more_after_send`, and `capture_removal_lost_after_both_attempts_is_counted_and_logged_without_a_value`
+- `capture_removal_write_skips_a_tombstone_a_missing_row_and_an_applied_removal` (0 writes each)
+- `capture_opt_out_removes_every_record_the_provider_wrote`
+- `capture_only_opt_out_also_removes_browser_records_of_its_sources`
+- `capture_only_provider_clears_its_opt_out_on_a_consenting_positive_result`: a later 2xx capture with IDs writes `ps.oc` set to the `at` of the opt-out it read (its watermark) and no ID. Two controls: the same capture under denied consent writes no clear, and a provider with a GVL ID never clears by capture.
+- `capture_global_revoke_from_a_real_browser_tombstones_the_row_and_clears_the_ec_cookie`: `revoke_scope = "global"`. Exactly one tombstone write and the EC cookie's expiry header. The control with `"provider"` removes only that provider's records and keeps the row live.
+- `capture_from_a_non_browser_applies_its_removals_and_opt_out`: a client that fails the check has its invalidation and opt-out written, and a `"global"` revoke requests the tombstone.
+- `capture_from_a_non_browser_never_clears_an_opt_out`: a positive result from such a client writes nothing and still counts the ID in `capture_unpersisted`.
+- `capture_with_replayed_ec_cookie_changes_no_kv_row`: a non-browser request with a copied `ts-ec` and a revoke-style response. The counting store records zero writes.
+- `capture_on_a_proxy_writer_navigation_uses_the_removal_write_not_the_mutation`
+- `capture_never_touches_n_f_or_the_breaker`
+- `capture_state_change_is_ignored`
+- `capture_skips_an_oversized_proxied_body`
+- In `integrations/lockr.rs`: `lockr_proxy_log_omits_query`, using a log capture, with a request whose query holds an identifier
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- capture`, `cargo test-fastly -- lockr_proxy_log` and `cargo test-fastly -- ec::finalize`
+Expected: FAIL, then PASS. Today's withdrawal tests in `ec/finalize.rs` must pass unchanged.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Capture identity revocations from proxied provider responses" -m "Capture is revoke-only: a real browser's captured removals, opt-outs and clears are written to KV on the proxied request with a CAS loop, retried once after send, and counted as lost if both fail. Positive IDs are counted, never stored. Removals and opt-outs apply from any client; only clears need a real browser. revoke_scope = \"global\" runs the consent-withdrawal tombstone from any client." -m "The Lockr proxy now logs only the upstream path, not its query."
+```
+
+### Task 39: The full provider harness and conformance checks
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs`
+- Modify: `crates/trusted-server-core/src/ec/identity/examples.rs` (created in Task 32): the harness tests
+- Test: `examples.rs`
+
+**Interfaces:**
+
+- Produces everything in spec 13's harness listing: `ProviderHarness::{with_setup, with_client_ip, with_user_agent, with_page_url, with_region, with_hashed_email, with_consent, with_stored, with_state, with_now, with_random_seed, request, request_json, respond, respond_raw, capture, resolve, state_of, output_eids, check_conformance, check_conformance_with_state, try_check_conformance, try_check_conformance_with_state}`, `HarnessSetup`, `TestConsent`, `CaptureFixture`, `ConformanceCases`, `ConformanceFailure`, `StoredId::{for_test, with_eids, written_by, expiring_at}`, `HashedEmail::for_test`, and `check_descriptor_ignores_secrets`. The module and every item are `pub` under `#[cfg(any(test, feature = "test-utils"))]` (it has been since Task 14), and reachable from outside the crate as `trusted_server_core::ec::identity::test_support::*`.
+  - `StoredId::for_test` builds a one-entry, one-UID `KvPartnerId` with `KvPartnerId::new` and goes through `StoredId::from_record(source, &record)` (Task 9), so `eids()` holds one entry and `uid()` is its first UID.
+  - `StoredId::with_eids(self, eids: Vec<Eid>) -> Self` replaces the set with a full one, and sets `uid()` to its first UID (spec 13), so a test can give a refreshing provider a stored full set.
+  - `HashedEmail::for_test(bytes: [u8; 32]) -> HashedEmail` calls Task 9's gated `HashedEmail::from_bytes`. There is one constructor, so the two cannot drift.
+  - `ProviderHarness::output_eids(&self, resolution: &Resolution) -> Vec<Eid>` applies `entry_sets` (Task 10) and the descriptor's provenance default (Task 28) as the bidstream would. Provenance is applied only here; `Resolution`'s getters show what the provider set.
+  - `#[derive(Debug, derive_more::Display)] #[non_exhaustive] pub enum ConformanceFailure`, one variant per conformance bullet below (`UndeclaredInput`, `UndeclaredHost`, `CookieHeader`, `UndeclaredSource`, `LimitHit`, `NotImplemented`, `StatelessState`, `CaptureStateChange`, `MissingExpiry`, `BareStringStateAccepted`, and the rest), each naming what failed and never a value. It implements `core::error::Error`.
+  - `try_check_conformance(&self, cases: &ConformanceCases) -> Result<(), Report<ConformanceFailure>>` and `try_check_conformance_with_state::<S>`. `check_conformance` and `check_conformance_with_state` call them and `expect("should conform: ...")`, for provider authors. `cargo test-fastly` runs on `wasm32-wasip1`, where a panic aborts the whole test binary and `catch_unwind` never returns `Err`, so the harness's own negative tests use the `try_` forms. No `panic!` anywhere in this code: the workspace denies `clippy::panic`.
+
+`try_check_conformance` checks every bullet of spec 13's conformance list:
+
+- inputs hold only what the descriptor declares
+- a resolver returns `Some` for at least one listed setup, and its `response` never returns the `not_implemented` marker
+- a capturer returns a non-`no_match` result for at least one fixture, and never the marker
+- no undeclared input or state read is recorded
+- no state is returned without `with_private_state()`
+- requests go only to declared hosts, over HTTPS, with no `Cookie` header and with valid headers
+- entries are only for declared sources, and no fixture's result hits a limit of spec 4.5: no dropped UID or field, no discarded entry, and no set over `MAX_ENTRY_SET_BYTES`. The harness runs `entry_sets` (Task 10) on each result and fails when `drops` or `oversized` is not empty.
+- `ResolvedEid::expiry()` and `refresh()` report what was set, and a fixture set of an expiring source carries an expiry
+- `capture` never returns a state change
+- a bare-JSON-string stored state is never treated as valid
+
+`try_check_conformance` returns an error with a pointer to `try_check_conformance_with_state` for a stateful provider. `try_check_conformance_with_state::<S>` also round-trips `S` through `replacing_state` and `input.state()`.
+
+- [ ] **Step 1: Write the tests (the spec's examples are the first harness cases)**
+
+In `examples.rs`, next to the Task 32 copies of spec 4.6:
+
+```rust
+    #[test]
+    fn example_provider_round_trip() {
+        let provider = ExampleIdProvider::new(&example_config()).expect("should build the provider");
+        let mut harness = ProviderHarness::new(&provider)
+            .with_client_ip("192.0.2.10")
+            .with_user_agent("ExampleBrowser/1.0");
+
+        let request = harness
+            .request()
+            .expect("should build a request")
+            .expect("should not skip the request");
+        assert_eq!(request.url().host_str(), Some("api.exampleid.example.com"), "should call the declared host");
+
+        let resolution = harness
+            .respond(StatusCode::OK, &json!({ "uid": "example-uid", "signature": "example-signature" }))
+            .expect("should parse the response");
+        assert_eq!(
+            resolution.eids()[0].uids()[0].id(),
+            "example-uid",
+            "should return the uid"
+        );
+        let state: ExampleIdState = harness.state_of(&resolution).expect("should replace state");
+        assert_eq!(state.signature, "example-signature", "should keep the signature");
+    }
+
+    #[test]
+    fn example_provider_conforms() {
+        let provider = ExampleIdProvider::new(&example_config()).expect("should build the provider");
+        ProviderHarness::new(&provider).check_conformance_with_state::<ExampleIdState>(
+            &ConformanceCases::default().with_resolve_case(
+                HarnessSetup::default().with_client_ip("192.0.2.10").with_user_agent("ExampleBrowser/1.0"),
+                StatusCode::OK,
+                &json!({ "uid": "example-uid", "signature": "s" }),
+            ),
+        );
+    }
+
+    #[test]
+    fn conformance_catches_an_undeclared_read() {
+        let provider = UndeclaredUserAgentReader::new();
+        let error = ProviderHarness::new(&provider)
+            .try_check_conformance(
+                &ConformanceCases::default().with_resolve_case(HarnessSetup::default(), StatusCode::OK, &json!({})),
+            )
+            .expect_err("should fail a provider that reads an undeclared input through .ok()");
+        assert!(
+            matches!(error.current_context(), ConformanceFailure::UndeclaredInput { .. }),
+            "should report the undeclared input"
+        );
+    }
+
+    #[test]
+    fn descriptor_ignores_secrets() {
+        check_descriptor_ignores_secrets(&example_config(), &example_config());
+    }
+
+    #[test]
+    fn output_eids_applies_the_provenance_default_only_to_bare_entries() {
+        let provider = ProvenanceTestProvider::new();
+        let harness = ProviderHarness::new(&provider);
+        let resolution = harness
+            .resolve(&HarnessSetup::default())
+            .expect("should resolve")
+            .expect("should not skip the request");
+        let eids = harness.output_eids(&resolution);
+        assert_eq!(eids[0].inserter.as_deref(), Some("vendor-inserter"), "should keep the entry's own fields");
+        assert_eq!(eids[0].matcher, None, "should not mix the default into an entry that sets a field");
+        assert_eq!(eids[1].inserter.as_deref(), Some("default-inserter"), "should apply the default to a bare entry");
+    }
+```
+
+Add negative conformance tests the same way, each with a tiny test provider in the test module and each asserting `try_check_conformance(...)` returns the matching `ConformanceFailure` variant: a `Cookie` header, a request to an undeclared host, an entry for an undeclared source, a fixture result that hits a spec 4.5 limit (a 33rd UID for one source, and a blank `inserter`), a capability declared but not overridden (the `not_implemented` marker), a stateless provider returning state, a capture returning a state change, a stateful provider that accepts a bare-JSON-string stored state, and an expiring source without an expiry.
+
+Several entries and UIDs for one source are valid (G13), so add a positive control too: `conformance_accepts_a_complete_set_within_the_limits`. A test provider returns two entries for one source, three UIDs in all, with `inserter`, `matcher`, `mm`, an EID-level `ext` and a UID-level `ext`, and `try_check_conformance` returns `Ok`. Add `stored_full_set_reaches_a_refreshing_provider`: `with_stored(StoredId::for_test(..).with_eids(..))` gives the provider `stored(source).eids()` equal to the set.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- ec::identity::examples`
+Expected: FAIL, then PASS.
+
+- [ ] **Step 3: Check the feature gate from outside the crate**
+
+Run: `cargo check -p trusted-server-adapter-fastly --target wasm32-wasip1 --tests` (the Fastly adapter's dev-dependency already enables `trusted-server-core/test-utils`, `crates/trusted-server-adapter-fastly/Cargo.toml:45`), then `cargo clippy-fastly`
+Expected: both pass. This proves a provider crate can use the harness, and that the `pub` gated items raise no `dead_code` warning.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add -A crates/trusted-server-core/src
+git commit --signoff -S -m "Add the provider harness and conformance checks"
+```
+
+### Task 39b: Complete provider EIDs from a registered provider, end to end
+
+Part 1 built and tested multi-entry records at unit level and in the invariant tests (Tasks 6, 10, 15, 17, 28 and 30). This task proves that a provider registered through `try_with_identity_provider` gets a complete set from its response to KV, the mirror payload and the bidstream, and that nothing that predates the spec moved.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/identity/test_support.rs` (`MultiEntryTestProvider`, `pub` under `test-utils`)
+- Test: the Fastly adapter's request-level test module from Task 30 (`crates/trusted-server-adapter-fastly/src/main.rs` tests), using `drive_request_for_test` (Task 29)
+
+**Interfaces:**
+
+- Consumes: Tasks 32, 37, 38, the counting store (Task 22), and Task 29's `drive_request_for_test` and Task 30's request-level helpers
+- Produces: no production code. `MultiEntryTestProvider`, a test-only resolver for `exampleid.example.com` that returns two entries: the first with UIDs `uid-a` (`atype: 1`, a UID-level `ext`) and `uid-b`, plus `inserter`, `matcher` and `mm`; the second with `uid-c` and an EID-level `ext`, and no `inserter`, `matcher` or `mm`. Its descriptor declares `with_provenance` with an `inserter` and `matcher` default for the source. `MultiEntryTestProvider::stateful()` is the same provider declared `with_private_state()`, for the stateful case. It lives in core `test_support` because the adapter tests cannot see core's `#[cfg(test)]` items.
+
+- [ ] **Step 1: Write the failing tests**
+
+Each test registers `MultiEntryTestProvider` through `IntegrationRegistration::builder("exampleid").try_with_identity_provider(...)`, owning the source, and drives requests through `drive_request_for_test`:
+
+- `registered_provider_full_set_reaches_kv_mirror_and_bidstream_in_order`: a writer navigation in hold mode. The flush writes the record with `eids` holding both entries as returned, `w = exampleid` and a fresh `rv`. `user.ext.eids` and `x-ts-eids` carry both entries in the order returned, after the browser entries. The first entry keeps exactly its own `inserter`, `matcher` and `mm`. The second, which sets none of them, gets the provenance default. The next `/auction`'s `ext.ts_eids_s` decodes to the same two entries, defaults included.
+- `one_entry_one_uid_result_is_written_as_one_entry`: the same provider configured to return only `uid-a` with no EID-level fields. The KV record is `{w, rv, at, eids: [{uids: [{id: "uid-a", atype: 1, ext}]}]}`, the one shape of spec 6.1.
+- `later_result_without_an_entry_removes_it`: a refresh that returns only the first entry leaves exactly that entry in KV and in the bidstream. A source the result does not name keeps its record.
+- `stateful_result_with_an_oversized_set_keeps_only_its_removals`: a set over `MAX_ENTRY_SET_BYTES` from `MultiEntryTestProvider::stateful()`. The positive part, its state included, is rejected, and its `also_invalidate` still applies.
+- `identify_returns_the_first_uid_of_a_full_record`: `/_ts/api/v1/identify` returns `uid: "uid-a"` and an `eid` with the partner's `openrtb_atype`, the same shape as for a one-UID record.
+- `rollback_to_part_1_config_keeps_the_owners_opt_out`: a row with the provider's `ps.o`, `ps.ov` and a multi-entry record, flushed once by a build whose catalog no longer has the provider. The provider's `ps` keeps `o`, `oc` and `ov` and loses `n`, `f`, `iv` and `st`. The record stays readable but is not served (spec 14). There is no test of a rollback past Part 1: a release before it cannot read schema version 2, and that rollback is unsupported.
+- `captured_revocation_writes_with_cas`, `global_revoke_from_real_browser_writes_as_withdrawal` and `non_browser_capture_writes_nothing`: the capture rows of spec 13's one-write table that Task 30 leaves to this task, driven through a capture registration (Task 32). The first gives one CAS write before send (up to five attempts), and one more after send only when it failed.
+- `returning_navigation_answered_404_flushes_only_hold_removals_and_backoff`: the hold-mode half of the 3xx, 4xx and 5xx row.
+
+Then rerun Part 1's `golden_` tests for paths that predate the spec with the multi-entry provider registered on another source: browser ingest writes one-UID records, `ts-eids` content is unchanged, `/auction` body forwarding is unchanged, and a one-UID row goes out as on `main`. Do not edit those tests. If one fails, the change is wrong, not the test.
+
+Compare whole `Vec<Eid>` values and whole `KvPartnerId` values with every field written out, with no `..Default::default()`.
+
+- [ ] **Step 2: Run, see them fail, implement, see them pass**
+
+Run: `cargo test-fastly -- registered_provider`, `cargo test-fastly -- one_entry_one_uid`, `cargo test-fastly -- later_result`, `cargo test-fastly -- stateful_result`, `cargo test-fastly -- identify_returns`, `cargo test-fastly -- rollback_to_part_1`, `cargo test-fastly -- captured_revocation`, `cargo test-fastly -- global_revoke_from_real_browser`, `cargo test-fastly -- returning_navigation_answered_404`, `cargo test-fastly -- non_browser_capture` and `cargo test-fastly -- golden_`
+Expected: the new tests FAIL until `MultiEntryTestProvider` exists, then PASS. A failure after that points at a gap in Tasks 32 to 38, not here. Fix it in the task that owns the code, and note the fix in this task's commit message.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Prove complete provider EIDs end to end through a registered provider"
+```
+
+### Task 40: Batch sync never replaces an owned value
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/ec/batch_sync.rs` (`handle_batch_sync` at about line 114, the upsert around line 247)
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` (`run_batch_sync`, about line 737, passes `&state.identity`)
+- Test: `ec/batch_sync.rs`
+
+**Interfaces:**
+
+- Produces: `pub fn handle_batch_sync(kv: &KvIdentityGraph, registry: &PartnerRegistry, rate_limiter: &dyn RateLimiter, identity: &IdentityRuntime, req: Request<EdgeBody>) -> Result<Response<EdgeBody>, Report<TrustedServerError>>`. `IdentityRuntime` is `pub` (Task 23), so the adapter can pass it. The handler reads the owned sources from its catalog.
+
+- [ ] **Step 1: Write the failing test**
+
+`batch_sync_update_to_owned_source_applies_only_when_absent`: with the source owned by a provider, a batch update applies when the source is absent, and is `Unchanged` (no write) when a value exists. A control update to an unowned source keeps today's behaviour.
+
+`batch_sync_never_touches_an_owners_entry_set`: the owner's record holds two entries. A batch update to the source is `Unchanged`, and the row's `eids` are byte-equal before and after. A batch write that does apply (an absent owned source, or an unowned source) writes a one-entry, one-UID record without `w` or `rv`, as Task 6's `KvPartnerId::new` builds it.
+
+- [ ] **Step 2: Run, see it fail, implement, see it pass**
+
+Run: `cargo test-fastly -- ec::batch_sync` and `cargo test-fastly -- batch_sync`
+Expected: FAIL, then PASS. Existing batch sync tests pass an `IdentityRuntime` with an empty catalog and are otherwise unchanged.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A crates/
+git commit --signoff -S -m "Keep batch sync from replacing an owned source's value"
+```
+
+### Task 41: Docs, the provider author guide, and final verification
+
+**Files:**
+
+- Create: `docs/guide/identity-providers.md` (provider author guide)
+- Modify: `docs/guide/configuration.md` (`[[ec.partners]].owner`, per-provider tables, `revoke_scope`), `docs/guide/edge-cookies.md` (the capture provider checklist, complete provider EIDs, rollback), `docs/.vitepress` sidebar config (find it with `grep -rn "edge-cookies" docs/.vitepress`), `CHANGELOG.md`, `trusted-server.example.toml`
+
+- [ ] **Step 1: Write the author guide**
+
+Base it on spec 4.2 to 4.6 and 13, using only the fictional `exampleid` provider:
+
+- what a provider is
+- the descriptor
+- declaring inputs and reading them with `?` or `.ok()`
+- building requests
+- parsing responses
+- returning a `Resolution` of `ResolvedEid` entries, each with one or more `ResolvedUid`s: several entries and UIDs per source, UID-level `atype` and `ext`, and EID-level `inserter`, `matcher`, `mm` and `ext`
+- the limits of spec 4.5: the browser parser's field rules, plus per-source caps the browser parser does not have (8 entries and 32 UIDs per source, 4,096 bytes per set). Each `ext` may hold 2,048 bytes and each `inserter` or `matcher` 255 bytes, but the field caps do not guarantee the set cap: a set whose legal fields exceed 4,096 bytes is discarded whole, never trimmed. A discarded set leaves the stored set as it is, and a result all of whose sets are discarded counts as malformed.
+- that a result replaces an owned source's whole set, while for an unowned source it only fills an absent or expired record
+- `with_provenance`: a default applied at output only to an entry that sets none of `inserter`, `matcher` and `mm`. An entry that sets any of them is the vendor's complete statement. A blank provenance `inserter` or `matcher` fails `build()`.
+- what vendor `ext` data means for privacy: it is stored only in KV, never in `ts-eids`, and reaches bidders, `x-ts-eids` and the `ts-eids-s` mirror under the same consent gates as the UIDs (spec 9.3). The mirror is readable by every page script. A vendor spec that stores such data says what it holds.
+- private state
+- capture: revoke-only, so a capture's removals, opt-out and clear are written to KV and its positive IDs are only counted in `capture_unpersisted`; `revoke_scope`; the real-browser gate on capture clears; and that a capture-only provider must list its `sources` and cannot own one
+- registration with `try_with_identity_provider`
+- testing with `ProviderHarness`, `check_conformance` and `output_eids`
+- what the coordinator does for you (consent, transport, backoff, KV)
+
+Link to the spec for the protocol.
+
+- [ ] **Step 2: Config and changelog**
+
+Document `owner`, `mode`, `timeout_ms`, `after_send_timeout_ms`, `sources` narrowing, `refresh_after_sec`, `max_calls_per_minute`, `breaker_failures_per_minute`, `cookie_priority` and `revoke_scope`, each with its default and a validation error example. Add the commented `[ec.identity.providers.<id>]` capture keys to `trusted-server.example.toml`, as spec 10.1 shows them, with `revoke_scope = "provider"`.
+
+In `docs/guide/edge-cookies.md`:
+
+- Add the capture provider checklist from spec 14 as the steps an operator follows before enabling a capture provider:
+  - each captured source has an `[[ec.partners]]` entry with `bidstream_enabled = true` and the right `openrtb_atype`
+  - a source moving to an owner comes off pull sync first
+  - the provider's `sources` list holds only the sources it is the delivery path for
+  - the live acceptance check through `/_ts/admin/eids` and `/_ts/admin/ec`, including that `removal_lost` stays at zero
+- Say what `revoke_scope = "global"` does (a captured opt-out from a real browser runs the consent-withdrawal tombstone), and that a non-browser client's capture never changes the KV row.
+- Add a short section on complete provider EIDs: what a multi-entry record looks like in the admin lookup, and that `/identify` still returns one UID per source.
+- Add the rollback steps of spec 14. Before rolling back to Part 1, remove every `owner` and vendor `[ec.identity.providers.*]` table, because Part 1's validation rejects them. After the rollback, multi-entry records stay readable but are not served while their writer is unconfigured, and browser ingest may replace them. Each provider's `ps.o`, `ps.oc` and `ps.ov` are kept, and the rest of its `ps` is pruned. Rolling back past Part 1 is unsupported, because a release before it cannot read schema version 2.
+
+In `CHANGELOG.md` under `### Added`, add the provider framework, ownership, hold mode, revoke-only passive capture (with `revoke_scope` and the capture removal write), complete provider EIDs, the `capture_unpersisted` and `removal_lost` counters and the breaker. Under `### Changed`, add stricter consent decoding for identity providers, and that the Lockr proxy logs only the upstream path.
+
+Run the docs and markdown format commands.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add docs/ CHANGELOG.md trusted-server.example.toml
+git commit --signoff -S -m "Document the identity provider framework for operators and authors"
+```
+
+- [ ] **Step 4: Full verification**
+
+Run `/check-ci`, then `cargo test-fastly-reuse`, `./scripts/test-cli.sh`, the parity crate, `scripts/lint-wasm-clock.sh`, and `cargo doc --no-deps --all-features -p trusted-server-core`. Every one must pass. Then use the `verify-app` agent for an independent pass.
+
+- [ ] **Step 5: PR**
+
+Open the PR against `feat/1246-identity-single-write` with `pr-creator`. Title: "Add server-side identity providers". The description lists spec 14 step 2's contents, says no vendor ships in it, says that capture is revoke-only and that each capture provider is enabled only after its checklist has passed on a live service, and names the follow-up vendor specs (ID5, LiveRamp, Lockr, UID2).
+
+---
+
+## Spec coverage
+
+| Spec section                                                                            | Tasks                                                                                          |
+| --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| 2.1 G1, G2, G11 (trait, coordinator, ergonomics)                                        | 8 to 11, 20, 21, 39                                                                            |
+| 2.1 G3 (hold or after-send)                                                             | 19, 20, 29, 37                                                                                 |
+| 2.1 G4 (one write; withdrawal, removal-retry and capture-removal exceptions)            | 18, 25, 26, 27, 29, 30, 38, 39b                                                                |
+| 2.1 G5 (KV, mirrored in `ts-eids-s`)                                                    | 17, 26, 28                                                                                     |
+| 2.1 G6 (ownership)                                                                      | 33, 36                                                                                         |
+| 2.1 G7 (expiry, refresh)                                                                | 14, 15, 20, 36                                                                                 |
+| 2.1 G8 (pull sync on the trait)                                                         | 21 (hourly rotation), 22, 29                                                                   |
+| 2.1 G9 (HEM slot)                                                                       | 9 (always empty in v1)                                                                         |
+| 2.1 G10 (no lost EIDs; registered-only merge)                                           | 25, 26, 30 (including an `ortb2`-only EID)                                                     |
+| 2.1 G12 (removals win)                                                                  | 15, 18, 27, 28 (denials), 29 (removal-only retry), 36, 38                                      |
+| 2.1 G13 (complete provider EIDs, nothing that predates the spec changes)                | 6, 7, 8, 9, 10, 13, 14, 15, 17, 22, 24, 25, 26, 28, 30, 36, 37, 39, 39b, 40                    |
+| 3.4 platform facts (status capture, real-browser gate, clock failure)                   | 14, 23, 29, 38                                                                                 |
+| 4.1 file layout                                                                         | 5 and each task's Files list                                                                   |
+| 4.2 trait and additivity rules                                                          | 11, 39                                                                                         |
+| 4.3 descriptor, provenance default                                                      | 8, 28, 32 (capture-path check), 39 (`output_eids`)                                             |
+| 4.4 inputs, per-kind availability                                                       | 9, 10 (`CaptureInput`), 23 (phase-1 captures)                                                  |
+| 4.5 requests, responses, results, entry-set limits, discarded sets                      | 10, 20, 39                                                                                     |
+| 4.6 example provider and registration                                                   | 32, 39, 39b                                                                                    |
+| 4.7 eligibility, dispatch, hold timing, breaker, revoke-only capture, real-browser gate | 20, 21, 35, 37, 38                                                                             |
+| 5.1 writer and stagers, status rule, withdrawal exception and its after-send run        | 23, 25, 27, 29, 38, 39b                                                                        |
+| 5.2 phases 1 to 4, phase 1 read on every writer, removal-only retry                     | 23, 25, 29                                                                                     |
+| 5.3 stagers, the capture removal write, the mirror payload, registered-only merge       | 18, 25, 26, 38                                                                                 |
+| 5.4 `IdentityMutation`, whole-set writes, `iv` and `ov` at apply, `ps` pruning          | 15                                                                                             |
+| 5.5 orphans, collisions, deletion                                                       | 25, 30 (the deletion framework itself is deferred; its tombstone rule is a note for that work) |
+| 5.6 rules that keep removals winning                                                    | 15, 18, 26, 29, 38                                                                             |
+| 6.1 KV schema version 2, version 1 read, `ps`, admin redaction                          | 6, 13, 14, 39b                                                                                 |
+| 6.2 the `ts-eids-s` mirror, its payload, cap and strips                                 | 1 to 4, 17, 26                                                                                 |
+| 6.3 read order                                                                          | 26, 29                                                                                         |
+| 7.1 merge, entry-set output, provider denials, servability, `/identify` shape           | 14, 24, 28, 36                                                                                 |
+| 7.2 ownership semantics, whole-set replacement, batch sync                              | 33, 36, 40                                                                                     |
+| 8 errors and outcomes, sticky opt-outs, re-grants, revoke scope, plain fingerprint      | 15, 20, 34, 36, 38                                                                             |
+| 9.1 consent, header-only GPP                                                            | 12, 34                                                                                         |
+| 9.2 outbound requests                                                                   | 1 to 3, 21                                                                                     |
+| 9.3 logging, redaction, vendor `ext`, Lockr path-only log                               | 9, 10 (`Resolution` `Debug`), 23 (`RequestIdentity` `Debug`), 34, 38, 41, every task's logging |
+| 9.4 caching                                                                             | 4, 25 (no identity cookie on HTML responses)                                                   |
+| 10.1 to 10.3 configuration, removed keys, validation, registration                      | 4, 19, 22 (catalog validator, removed partner keys), 32, 33                                    |
+| 10.4 pull sync on the trait, pull-complete marker removed                               | 21 (hourly rotation), 22, 29                                                                   |
+| 11 adapters                                                                             | 3 (strips on every adapter), 36 (admin route on every adapter); parity gate in 22 and 34       |
+| 12 vendor examples                                                                      | Out of scope (spec 2.2). The fictional examples in 32, 39 and 39b prove the API                |
+| 13 testing                                                                              | each task, 30, 39, 39b                                                                         |
+| 14 rollout, rollback, capture checklist                                                 | Parts 1 and 2; 31 (metrics, rollback note), 39b, 41 (checklist, rollback)                      |
+| 15 open questions                                                                       | Not implemented. Track as issues after Part 1 ships                                            |
diff --git a/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md b/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md
new file mode 100644
index 0000000000..30ae4ce553
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md
@@ -0,0 +1,787 @@
+# Request phase timing: Server-Timing subtimings and access telemetry
+
+**Date:** 2026-08-24
+**Status:** Approved design, revised for review rounds 1 and 2, pending implementation
+plan.
+**Scope:** `trusted-server-core`, Fastly and Axum adapters, `tinybird/` schema,
+performance dashboard (separate repo).
+
+---
+
+## 1. Problem
+
+On 2026-08-21 a production deployment (publisher redacted, `prospect-a.example`) showed
+an episodic stall: for a window of roughly 40 minutes, every request that reached the
+application path carried a uniform extra ~600 ms of Fastly `time-elapsed`, and then
+recovered to 20-50 ms with no deploy or config change we could observe. `/health`
+(2-4 ms, short-circuits before app construction) and `/_ts/debug/ja4` (6-9 ms, settings
+load only) stayed fast throughout, so the stall lived between app construction and
+response send.
+
+Attributing that window required a live probing session: route-by-route bisection,
+cookie-deletion experiments, and an eight-agent code trace. The trace found no
+unconditional await on the path that could cost 570 ms, and exactly two
+config-conditional candidates (the pre-route request filter's synchronous verification
+POST, and EC identity KV writes before send), plus one dependency shared by every
+application route (two geo hostcalls per request). We could not tell which one stalled,
+because nothing in the response says where server time went.
+
+The Compute CPU budget is ~50 ms per request, so a large `time-elapsed` strongly
+suggests wall-clock time outside active guest CPU: dependency awaits are the leading
+explanation, with platform scheduling and hostcall queueing as the residual ones. The
+comparison figure here is the fronting delivery layer's `time-elapsed` Server-Timing
+entry, observed at its deliver phase. Either way, these are exactly the numbers a
+response can carry about itself.
+
+## 2. Goals
+
+1. Every normal application response attributes its own server time by phase in a
+   standard header. Browsers expose the values to same-origin JavaScript via
+   `PerformanceResourceTiming.serverTiming`, so RUM tooling that reads that API can
+   surface the breakdown. Whether a given vendor or the publisher's own monitoring
+   extension actually collects it is verified separately in rollout; the publisher
+   extension needs a small change to render it.
+2. The same numbers flow to Tinybird so we hold p50/p95/p99 per phase, per route class,
+   per PoP, per deployed version, and a future stall window self-diagnoses in one query.
+3. No additional awaited I/O before first byte. The pre-send cost is a handful of
+   monotonic clock reads, one small allocation at entry, and rendering one header;
+   telemetry emission happens strictly after the last body byte.
+
+Scope note: phases cover the application lifecycle after T0. The `/health` and
+`/_ts/debug/ja4` short-circuits, config-store open failures, and request-conversion
+failures bypass the lifecycle and emit nothing. Requests served entirely by the
+fronting cache never reach the guest and produce neither header entries nor rows.
+
+## 3. Non-goals
+
+- No trailer-based Server-Timing for body-phase spans (browsers do not expose trailer
+  values to JavaScript).
+- No per-filter naming in any emitted surface. The request-filter span is `ts-filter`
+  regardless of which filter runs; vendor identity stays out of headers and telemetry.
+- No Cloudflare or Spin emission wiring in v1. Core collection is adapter-neutral; those
+  adapters can wire emission later without core changes.
+- No Tinybird endpoint pipe and no rollup materialized views in v1. Grafana queries the
+  datasource through the ClickHouse connector, matching the auction dashboards; rollups
+  only if panel latency demands them.
+- No sampling of the header. The header is all-traffic when enabled; only Tinybird rows
+  sample.
+- No cross-request circuit breaker for telemetry emission. Compute runs one isolate per
+  request; there is no shared mutable state to hold breaker state. The controls are the
+  bounded per-request cost and the `access_sample_rate` lever (section 10).
+
+## 4. Design overview
+
+```
+adapter entry (T0)
+  |  RequestTimings::new() -> shared handle
+  v
+app construction ................ ts-appbuild        (adapter)
+pre-route request filters ....... ts-filter          (adapter wrapper)
+geo lookup (single, deduped) .... ts-geo             (adapter; result carried forward)
+template cache lookup ........... ts-template-cache  (core: publisher.rs)
+origin fetch to resp headers .... ts-origin          (core: publisher.rs)
+EC identity KV, pre-send ........ ts-kv              (core: KV abstraction)
+auction wait, buffered mode ..... auction_wait_ms    (row only; pre-header in this mode)
+  |
+send_edgezero_response, immediately before into_parts():
+  mark_headers_ready() snapshot (unconditional)
+  build AccessTelemetrySnapshot (only when tinybird.access_enabled)
+  append Server-Timing header (flag-gated, only on conclusively private responses)
+  |
+headers committed; body streams
+  auction hold at seam .......... auction_wait_ms    (row only; in-stream in this mode)
+  stream duration, bytes ........ stream_ms, resp_bytes (row only)
+  |
+post-send (adapter main):
+  request_elapsed snapshot, then existing pull-sync, then:
+  sample gate -> one NDJSON row -> Tinybird Events API
+  bounded response await, 2xx validated
+```
+
+Collection is always-on and flag-free, including the `mark_headers_ready()` snapshot.
+Two independent flags gate emission: the header (`observability.server_timing_enabled`)
+and the telemetry row (`tinybird.access_enabled`).
+
+## 5. `RequestTimings` (core)
+
+New module `crates/trusted-server-core/src/request_timing.rs`.
+
+- `Phase`: a closed enum: `AppBuild`, `Filter`, `Geo`, `EcKv`, `Origin`,
+  `TemplateCacheLookup`, `AuctionWait`, `Stream`. Header rendering covers the first six
+  plus the stored total; the last two are row-only.
+- Inner state: one fixed-size array of `Option<Duration>` slots indexed by phase,
+  `t0: Instant`, `headers_ready_total: Option<Duration>`,
+  `auction_wait_placement: Option<AuctionWaitPlacement>` (`PreHeader` or `InStream`),
+  and `resp_bytes: Option<u64>`. Phases that repeat within a request (geo, KV)
+  accumulate by saturating addition into the same slot.
+- `mark_headers_ready()`: stores `t0.elapsed()` once at the response-commit boundary,
+  unconditionally, before either emission flag is consulted. The header renders this
+  stored value as `ts-total`; the telemetry row reads the same stored value as
+  `time_elapsed_ms`. The two surfaces cannot disagree, and the row stays correct when
+  the header flag is off. Full request duration is captured separately as
+  `request_elapsed_ms`, snapshotted immediately after the body-stream drive returns and
+  before any other post-send work, so pull-sync and telemetry emission are never
+  included in it.
+- Sharing: `RequestTimings` is a cheap-clone handle, `Arc<Mutex<Inner>>`. It crosses
+  three boundaries: adapter entry to core handlers, the streaming body closure (records
+  body-phase spans after the response object has been handed off), and the adapter's
+  post-send emission read. Access is exclusively `try_lock()`: a contended lock
+  drops the one sample rather than waiting, so recording can never delay a
+  request, and a poisoned lock is recovered (the guarded data are plain counters
+  with no invariant a panic can break) so one panic cannot silence the rest of
+  the request's timing.
+- Recording API: `timings.record(Phase::Geo, dur)` and a scope guard
+  `timings.span(Phase::Origin)` that records on drop. Guards use saturating duration
+  math; a non-monotonic reading records zero rather than panicking. The auction-wait
+  recorder takes the placement explicitly so the two modes cannot be conflated.
+- Rendering: `server_timing_value(&self) -> Option<String>` produces
+  `ts-total;dur=41.2, ts-appbuild;dur=18.4, ts-filter;dur=9.1` with durations in
+  milliseconds at one decimal. Phases never recorded are omitted. Returns `None` when
+  `mark_headers_ready()` has not run.
+
+`Instant` is already used freely in the guest (`publisher.rs`, `auction/telemetry.rs`),
+so no new clock abstraction is needed.
+
+## 6. Span taxonomy and recording sites
+
+| Entry               | Measures                                                                              | Site                                                                                    |
+| ------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| `ts-total`          | T0 to `mark_headers_ready()` at the response-commit boundary                          | stored snapshot                                                                         |
+| `ts-appbuild`       | config-store open, Settings parse, orchestrator + registry + router build             | Fastly `main.rs` around `open_trusted_server_config_store()` + `build_app_with_state()` |
+| `ts-filter`         | pre-route request filters, end to end (backend ensure, secret read, POST)             | around `run_pre_route_filters` (`app.rs:751`)                                           |
+| `ts-geo`            | geo hostcall (single after dedupe; accumulates if any path still repeats)             | `build_ec_request_state` (`app.rs:410`) and timed finalizer fallback lookups            |
+| `ts-kv`             | EC identity KV operations before response send (see enumeration below)                | the shared KV abstraction                                                               |
+| `ts-origin`         | publisher backend send to response headers available (read-through cache hit or miss) | `publisher.rs` around the origin `send`                                                 |
+| `ts-template-cache` | template cache `lookup_or_reserve`, including the hit-path full-body read             | `publisher.rs` around the lookup                                                        |
+
+Naming follows the completed template-cache terminology migration (`x-ts-template-cache`
+is the emitted header on `main`; `c2` naming is retired).
+
+`ts-kv` is instrumented by a timing decorator implementing both `PlatformKvStore` and
+the EC store trait, wrapping the store handed to request-scoped consumers, because EC
+graph operations go through `KvIdentityGraph` and graphs are constructed independently
+in request setup, identify, admin lookup, batch sync, and finalization. Every
+request-path graph construction receives the timed store; pull-sync explicitly
+constructs its graph from an untimed store. Included pre-send operations: EC
+generation `create_or_revive`, identify-path graph reads and evaluation, finalize-path
+`ingest_eid_cookies`/`upsert_partner_ids` and withdrawal tombstones, and batch-sync
+graph access when it runs before send. The legacy consent KV store was removed on
+`main` (#903), so there is no separate consent-store read to time.
+Explicitly excluded: pull-sync work, which runs strictly after `send_to_client` and is
+invisible to both surfaces. The decorator measures store-call latency only: no value
+passing through it is read, parsed, or recorded, and the emitted surfaces carry no
+consent or identity payloads. This feature therefore needs no consent gate; it is the
+site measuring its own infrastructure, not processing user data. The timings handle
+reaches `ec_finalize_response` inside the graph it already receives; that function
+keeps the repository maximum of seven arguments and does not gain an eighth.
+
+Row-only fields:
+
+| Field                | Measures                                                  | Site                                             |
+| -------------------- | --------------------------------------------------------- | ------------------------------------------------ |
+| `auction_wait_ms`    | wait on the dispatched auction (placement varies by mode) | seam hold (streaming) or buffered finalizer wait |
+| `body_mode`          | `streamed` or `buffered` response assembly                | set where the response body is built             |
+| `stream_ms`          | headers committed to last body byte                       | adapter around the body-stream drive             |
+| `resp_bytes`         | bytes written to the client body                          | same                                             |
+| `request_elapsed_ms` | T0 to immediately after the body-stream drive returns     | post-send snapshot, before pull-sync             |
+
+Auction-wait placement is not universal. On the ordinary streaming path the wait
+happens at the `</body>` seam inside the body stream and nests inside `stream_ms`. On
+buffered paths (the Fastly shared-template authorized miss, which buffers the full
+transform and auction before returning a response, and every Axum response) the wait
+completes before headers commit. The row therefore carries `body_mode` plus
+`auction_wait_placement` (`pre_header` or `in_stream`), and derivations are
+conditional:
+
+- `in_stream`: `stream_other_ms = greatest(coalesce(stream_ms, 0) - coalesce(auction_wait_ms, 0), 0)`.
+- `pre_header`: `auction_wait_ms` joins the pre-header phase set, and `stream_other_ms = coalesce(stream_ms, 0)`.
+
+`unattributed_ms = greatest(coalesce(time_elapsed_ms, 0) - (coalesce(appbuild_ms, 0) +
+coalesce(filter_ms, 0) + coalesce(geo_ms, 0) + coalesce(kv_ms, 0) +
+coalesce(origin_ms, 0) + coalesce(template_cache_ms, 0) + pre-header auction wait), 0)`.
+Every phase column is nullable, so every query-time formula wraps each term in
+`coalesce(column, 0)` and every subtraction in `greatest(..., 0)`; query tests cover
+sparse phase combinations.
+
+## 7. Freeze point and header emission
+
+The freeze-and-emit point is `send_edgezero_response` (Fastly `main.rs`), immediately
+before `response.into_parts()`. This is the single choke point every send path shares,
+and it runs after everything that can still mutate the response: the router middleware,
+entry-point finalize (`apply_finalize_headers`, asset-policy reapplication), EC
+finalization and its KV work, and terminal filter/privacy effects.
+`apply_finalize_headers` itself does not emit; the `HEADER_X_TS_FINALIZED` sentinel
+marks middleware finalization, not header commitment, and must not be treated as the
+timing boundary.
+
+At the freeze point, in order: `mark_headers_ready()` (unconditional), the
+`AccessTelemetrySnapshot` build (gated on `tinybird.access_enabled`,
+section 10), then, gated on
+`observability.server_timing_enabled`, append one `Server-Timing` header from
+`server_timing_value()`. Append semantics, never insert: an origin-supplied
+Server-Timing survives, and the fronting delivery layer's own entries (`time-elapsed`,
+`hit-state`) are additive per the header's list semantics.
+
+Header emission is conservative: it happens only when the response is conclusively
+non-storable by any shared cache, meaning `Cache-Control` contains `private` or
+`no-store` (the existing `cache_control_headers_are_private_or_no_store` predicate).
+Anything else, including bare `max-age`, `s-maxage` without `private`,
+heuristically-cacheable responses with no cache header at all, and anything a fronting
+cache override might store, emits no header, because a stored object would replay one
+request's timings for its full lifetime. The long-lived immutable `tsjs` asset route
+is the concrete excluded case. The snapshot and the telemetry row are unaffected by
+this skip, so excluded routes still report through Tinybird.
+
+The Axum adapter applies the same emission rule at its terminal point before response
+serialization, with adapter-specific phase semantics (section 8a).
+
+## 8. Geo lookup dedupe (rider)
+
+Today every dispatched request pays two geo hostcalls for one answer: request-phase in
+`build_ec_request_state` (`app.rs:410`) and response-phase in
+`FinalizeResponseMiddleware` (`middleware.rs:83`, alternate site `main.rs:285`).
+
+Plain request extensions cannot carry the result out: the middleware moves the request
+context into `next.run(ctx)` and holds only the response afterward. The resolved geo
+travels on a dedicated `GeoLookupState` response extension, attached on every exit
+path that attempted a lookup, including the asset fallback, which runs
+`build_ec_request_state` and then returns without `EcFinalizeState` (which is why
+`EcFinalizeState` is not an acceptable carrier). States: `NotAttempted`,
+`Attempted(None)` (lookup ran and failed, do not retry), and `Resolved(GeoInfo)`. The
+finalize path consumes the carried value and performs a live lookup only in the
+`NotAttempted` state; those legitimate fallback lookups (admin, batch, error paths)
+are themselves timed into `ts-geo` so degraded geo cannot hide inside
+`unattributed_ms`. The 401 rule (`resolve_geo_for_response` skips lookup for
+unauthorized responses) is preserved.
+
+## 8a. Adapter phase semantics
+
+The Fastly adapter is the reference implementation of the taxonomy. Axum differs
+structurally and its emissions are defined accordingly rather than pretending parity:
+
+- `ts-appbuild` is absent: Axum builds application state once at startup.
+- Axum records no `Phase::Stream`; `stream_ms` is not a buffered-body write-out
+  measurement there. Core auction collection occurs before headers are sent.
+- The freeze point is `TimingService` around `EdgeZeroAxumService`, driven by
+  the adapter's own `axum::serve` loop rather than `AxumDevServer`. It sees
+  every response before serialization, independently of router middleware and
+  router-generated error handling. `/health` is excluded by path match.
+- Axum emits the header only; no Tinybird rows in v1 (unchanged).
+
+Cloudflare and Spin attach the per-request collector so core request-scoped consumers
+share the adapter clock, but have no header or telemetry emission wiring in v1.
+
+The request-clock origins differ:
+
+| Adapter           | T0 boundary                                                  | App-build meaning                                                                                |
+| ----------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
+| Fastly            | Before per-request config-store opening and setup            | Per-request setup, plus cold application construction when required; warm values can be non-null |
+| Axum              | Entry to `TimingService::call`                               | State is built once at startup; no per-request app-build phase                                   |
+| Cloudflare / Spin | Router timing middleware after per-request application setup | Setup precedes the collector; not comparable to Fastly app-build                                 |
+
+`origin_ms` is caller-blocking wait. An early-dispatched origin request overlaps
+other work, so its span measures only the remaining wait. Neither this phase nor
+`appbuild_ms` is a cross-adapter transport-latency or cold-start indicator.
+
+## 9. Access telemetry row
+
+Creates `tinybird/datasources/access_logs_v2.datasource`, preserving the reserved
+nine-column `access_logs_raw` datasource unchanged. There is no backfill or
+`FORWARD_QUERY`; historical raw paths do not enter the new dataset.
+
+Retained concepts: `event_ts`, `method`, `status`, `time_elapsed_ms` (defined as the
+`mark_headers_ready()` snapshot; nullable because a contended lock drop can lose the
+snapshot), `sample_rate`, 30-day TTL. The new sorting key uses `toDate(event_ts)`
+rather than the legacy `event_date` column.
+
+Excluded from the new row: raw `path`. Route identifiers like `/_ts/admin/ec/{id}` would otherwise put
+EC identifiers into a 30-day dataset, and publisher paths carry unbounded cardinality
+and user-generated content (search terms, usernames, emails in slugs). Replaced by
+`route_template`:
+
+- Named routes: the matched route-table pattern verbatim, parameters left as
+  placeholders.
+- Asset routes: the configured prefix followed by `/*`. Responses without route
+  metadata use `unknown`.
+- Publisher templates come from an operator-configured allowlist of section names
+  (`observability.route_sections`, default empty), not from the request: a path
+  whose first segment matches an allowlist entry and that has at least one further
+  segment emits `/{section}/*` (the lowercased allowlist entry itself); everything
+  else emits `/other/*`, and the root path emits `/`. This replaces the earlier
+  shape heuristics (charset, length, digit bounds), which review showed cannot
+  bound identity: depth-2 first segments are usernames on `/{username}/posts`
+  shapes, and single-segment paths are documents under `/%postname%/` permalinks.
+  With the allowlist, the emitted value set is fixed by configuration, so no
+  request-derived byte ever reaches the row.
+- Tests are adversarial, not just the happy path: a literal EC identifier on the admin
+  route, an email address in a path segment, search-term-shaped segments, overlong
+  segments, UUIDs, hex ids, reset tokens, and full article slugs must all normalize
+  to bounded, content-free templates.
+
+Added columns (all dimension columns non-nullable with an `unknown` sentinel, because
+ClickHouse sorting keys cannot contain nullable columns):
+
+```
+`service_id`            LowCardinality(String),      -- FASTLY_SERVICE_ID; immutable deployment identity
+`publisher_domain`      LowCardinality(String),      -- matches auction schema
+`env`                   LowCardinality(String),      -- adapter-derived: production | staging | unknown
+`route_class`           LowCardinality(String),      -- publisher_html | tsjs | integration_proxy | ec | auction_api | asset | other
+`route_template`        String,                      -- bounded, normalized; replaces path
+`body_mode`             LowCardinality(String),      -- streamed | buffered
+`delivery_result`       LowCardinality(String),      -- complete | partial | error; transport handoff only
+`auction_wait_placement` LowCardinality(String),     -- pre_header | in_stream | none
+`appbuild_ms`           Nullable(UInt32),
+`filter_ms`             Nullable(UInt32),
+`geo_ms`                Nullable(UInt32),
+`kv_ms`                 Nullable(UInt32),
+`origin_ms`             Nullable(UInt32),
+`template_cache_ms`     Nullable(UInt32),
+`auction_wait_ms`       Nullable(UInt32),
+`stream_ms`             Nullable(UInt32),
+`request_elapsed_ms`    Nullable(UInt32),
+`resp_bytes`            Nullable(UInt64),
+`template_cache_state`  LowCardinality(String),      -- from the typed response extension, not the public header
+`country`               LowCardinality(String),
+`ts_version`            LowCardinality(String),      -- compiled TS build identifier, matching x-ts-version
+`pop`                   LowCardinality(String),      -- FASTLY_POP, 'unknown' when absent
+`auction_dispatched_ms` Nullable(UInt32),            -- section 18
+`auction_collected_ms`   Nullable(UInt32),            -- section 18
+`auction_committed_ms`  Nullable(UInt32),            -- section 18
+`auction_id`            Nullable(UUID)               -- section 18; join key to auction_events_raw
+```
+
+The four auction columns are specified in section 18; they are listed here so
+this block stays the single canonical column list.
+
+The matched route pattern does not survive dispatch today, so a typed
+`RouteMetadata` response extension carries `route_class` and `route_template`: each
+named-route handler wrapper attaches its route-table pattern verbatim (handlers
+serving multiple patterns attach the one that matched), and the fallback and tsjs
+handlers attach their class plus the coarse template. The freeze point consumes the
+extension; nothing reconstructs routes from a handler enum or path regex.
+
+Typed sources only: `env` is adapter-owned, derived from the same Fastly
+`FASTLY_IS_STAGING` input that drives `x-ts-env` (`Settings` has no environment
+field and does not gain one). `template_cache_state` comes from a typed response
+extension, not the `x-ts-template-cache` header (operator-configured response
+headers can override managed headers): the currently private
+`TemplateCacheResponseState` in `publisher.rs` becomes a typed response extension,
+and every state transition sets the managed header and the extension together so
+the two can never drift. `service_id` and `pop` come from the Fastly environment. `cache_state`
+from the reserved schema is dropped: the guest cannot observe the fronting cache, and
+guest-visible cache behavior is already carried by `template_cache_state` and
+`origin_ms`. Rows exist only for guest-handled requests; fronting-cache hits are
+invisible by construction and the dashboard documentation says so.
+
+Sorting key: `(toDate(event_ts), service_id, publisher_domain, env, route_class,
+pop, status)`. Every column carries a `json:$.<name>` path (the Events API rejects
+NDJSON into a datasource without JSONPaths, discovered live); `event_date` was
+dropped in favor of the sorting-key expression because a DEFAULT column cannot
+carry a JSONPath the producer never sends. Grafana time filtering uses `$__timeFilter(event_ts)` and every panel query
+also carries a `toDate(event_ts)` predicate so the primary index prunes; rollout validates
+the panel queries with `EXPLAIN` before the dashboard is committed. This replaces the
+reserved key `(event_date, path, status, method)` only in the new datasource.
+The legacy datasource and its key remain unchanged. Rollout step 4 creates the
+versioned replacement and cuts consumers over after verifying ingestion.
+
+## 10. Emission mechanics
+
+- `AccessTelemetrySnapshot`: built at the freeze point when
+  `tinybird.access_enabled` is set (revised in review from the original
+  unconditional build, so a disabled deployment pays nothing here), before
+  `into_parts()` consumes the response. It captures method, status, route metadata
+  (from the `RouteMetadata` extension), and typed dimension states (`env`,
+  `template_cache_state`, geo country). It exists because nothing else survives to
+  post-send on every path: the request is consumed by dispatch, the response by
+  `into_parts()`, and `EcFinalizeState` is absent on asset, admin, and error paths.
+- The emitter's transport context is adapter-owned and route-independent: the
+  Events API target (backend spec, secret store name, dataset, token secret, sample
+  rate) derives from settings once at entry in `main.rs`, and the HTTP client is the
+  adapter's stateless platform client. Asset, admin, and error responses therefore
+  emit without `RuntimeServices` or `EcFinalizeState`.
+- `send_edgezero_response` returns a delivery outcome instead of `()`, with
+  per-mode semantics because the two body paths observe different things. Streamed
+  bodies: a counting writer reports bytes written and distinguishes complete,
+  partial (truncated), and error outcomes. Buffered bodies: `send_to_client()`
+  returns no delivery result, so the byte count is captured from the body length
+  before the send and the outcome is complete-on-return with no partial detection;
+  `body_mode` in the row keeps the two regimes distinguishable in analysis.
+- Ordering after the body-stream drive returns: snapshot `request_elapsed_ms` first,
+  run the existing pull-sync dispatch unchanged, then telemetry emission last, so
+  pull-sync is never delayed behind the ingest await and never included in
+  `request_elapsed_ms`.
+- Sampling: uniform per-request decision against `tinybird.access_sample_rate`. No
+  client stickiness. Sampled-out requests are silent; every other drop (row build
+  failure, send failure, non-2xx) logs one warning naming the reason. There is no
+  cross-request warning suppression (per-request isolates hold no shared state); the
+  overload controls are the 2 s bounded await, the single-warning-per-request cap, and
+  `access_sample_rate` pushed down by config as the operational abort lever. Ingest
+  health is monitored from the Tinybird side via ingestion freshness on the
+  datasource, which catches quarantine and schema rejection that per-request warnings
+  cannot.
+- Transport: one NDJSON row to the Tinybird Events API: same `api_host`, reserved
+  `access_dataset` and `access_token_secret`, 2 s first-byte and between-bytes
+  timeouts, `max_body_bytes` guard, no retry.
+- Delivery confirmation: unlike the auction sink, which starts `send_async` and drops
+  the pending response (it runs before delivery completes and cannot afford to wait),
+  the access emitter runs after the client has the full response and therefore awaits
+  the bounded ingest response and validates 2xx. A non-2xx or timeout logs a warning
+  with the status.
+- Budget: at `access_sample_rate = 1.0` this adds one backend request per request to
+  the service, after delivery; during a Tinybird outage each such request holds its
+  sandbox for up to the bounded timeout. The sample rate is the budget control; 1.0 is
+  a diagnosis setting, not a steady state, and rollout treats sustained emission
+  warnings as the signal to dial it down.
+- Axum adapter: emits the header only; no Tinybird rows in v1.
+
+## 11. Dashboard and query model
+
+No endpoint pipe in v1. Grafana queries `access_logs_v2` directly through the
+ClickHouse connector with `$__timeFilter(event_ts)` plus a `toDate(event_ts)`
+predicate, matching the auction dashboards.
+
+Dashboard: a new standalone `grafana/dashboards/edge-performance.json` in the
+telemetry repo (`trusted-server-tinybird`), performance only, no panels shared with
+the revenue and auction dashboards. Panels:
+
+- Phase percentiles (p50/p95/p99) by `route_class`, per phase column.
+- Stacked phase breakdown over time using the non-overlapping set: `appbuild_ms`,
+  `filter_ms`, `geo_ms`, `kv_ms`, `origin_ms`, `template_cache_ms`, pre-header
+  auction wait (where `auction_wait_placement = 'pre_header'`), and derived
+  `unattributed_ms`. In-stream auction wait and derived `stream_other_ms` chart in a
+  separate body-phase panel and never stack with pre-header phases.
+- PoP split, `ts_version` overlay, template-cache state rates.
+- Stall panel: rows with `request_elapsed_ms > 500` (post-body total, so body-only
+  stalls are caught) grouped by dominant phase, where `unattributed_ms` competes as a
+  phase so the panel cannot confidently blame a small measured span while most time is
+  uninstrumented.
+
+All derivations use the `coalesce`/`greatest` forms from section 6; query tests cover
+sparse phase combinations and both `auction_wait_placement` modes.
+
+Sampling semantics for every aggregate: `sample_rate` must be operationally stable
+within any queried window. Quantile panels filter strictly to a single `sample_rate`
+value. Volume panels weight each row by `1.0 / sample_rate` (the inverse-probability
+estimator is `sum(1.0 / sample_rate)` over emitted rows; `count() / rate` is valid
+only when the query is already filtered to one rate). Pooled unweighted quantiles
+across a rate change are documented as invalid.
+
+## 12. Config surface
+
+```toml
+[observability]
+# Append TS phase timings to the Server-Timing response header.
+server_timing_enabled = false  # example default
+```
+
+New `ObservabilitySettings` struct with the single boolean, default off, standard
+environment override (`TRUSTED_SERVER__OBSERVABILITY__SERVER_TIMING_ENABLED`).
+Collection has no flag: the flags gate the two emission surfaces independently.
+
+Tinybird flag structure: `tinybird.enabled` today arms the auction sink by itself, so
+"enable Tinybird for access telemetry" would silently enable auction emission too. The
+master flag is demoted to transport-only (host, store, credentials), and each emitter
+gets its own switch: a new `tinybird.auction_enabled` defaulting to `true` (preserving
+current behavior for existing configs) and the reserved `tinybird.access_enabled`
+defaulting to `false`. A settings test locks the decoupling in both directions.
+
+Validation when `access_enabled = true`: `tinybird.enabled`, non-empty `api_host`,
+non-empty `secret_store`, `access_dataset`, and `access_token_secret`, a positive
+`max_body_bytes`, and `access_sample_rate > 0`. An armed-but-silent configuration
+(`access_enabled = true`, `access_sample_rate = 0`) is a configuration error, not a
+valid state; disabling is done with the flag, not the rate.
+
+Rollback and compatibility, because `Settings` is `deny_unknown_fields`:
+
+- Deployment order is binary first, config second. Rollback order is config first
+  (remove the `[observability]` table and any new tinybird keys), binary second. A
+  config containing the new fields must never be pushed while a pre-observability
+  binary can still run.
+- Config serialization omits the table when it equals the default, so round-tripping a
+  config through tooling does not inject a field an older binary rejects. A
+  compatibility test asserts the serialized default config parses under the previous
+  schema.
+- The environment-variable overlay cannot create a missing leaf, so the key ships
+  present-but-false in the base operator TOML (the same pattern the GPT integration
+  documents in `trusted-server.example.toml`) and is flipped by config push.
+
+## 13. Error handling
+
+- Recording is infallible: saturating math, lock-failure drops the sample, no panics.
+- Header rendering failure (defensive `HeaderValue::from_str` error) logs and skips
+  the header.
+- Row emission failure logs one warning naming the reason and drops the row. The
+  response has already been delivered; there is nothing to degrade.
+
+## 14. Testing
+
+- Core unit tests: phase accumulation, saturating math, `mark_headers_ready()`
+  idempotence and both-surface consistency, render format (one decimal, omission of
+  unrecorded phases), row serialization shape, auction-wait placement recording.
+- Adapter tests (Fastly via Viceroy, Axum native): header present and well-formed on a
+  conclusively-private publisher route with the flag on; absent with the flag off;
+  absent on the shared-cacheable tsjs route and on a bare `max-age` response with the
+  flag on; exactly one TS-owned metric set (a single `ts-total`) with every
+  pre-existing Server-Timing value preserved, across all send paths; `ts-kv` captures
+  EC finalize work (proving the freeze point sits after it).
+- Body-mode tests: ordinary streaming (in-stream wait nested in `stream_ms`),
+  Fastly shared-template authorized miss (buffered, pre-header wait), and Axum
+  (always buffered), each asserting placement and non-negative derivations.
+- Geo dedupe: finalize consumes `Resolved`; no retry on `Attempted(None)`; live
+  lookup only on `NotAttempted`; fallback lookups timed into `ts-geo`; asset-fallback
+  path carries `GeoLookupState` without `EcFinalizeState`; 401 skip preserved.
+- Route template: adversarial normalization tests (literal EC identifier on the admin
+  route, email address in a segment, search-term segments, overlong segments) all
+  producing bounded content-free templates.
+- Settings: the access validation matrix including the armed-but-silent rejection;
+  auction/access flag decoupling in both directions; the former rejection test becomes
+  the wiring test; the serialized-default-config compatibility test against the
+  previous schema.
+- Sink tests: `RecordingHttpClient` pattern; assert URI, NDJSON body shape, token
+  header, 2xx validation and warning on non-2xx, skip when sampled out, ordering after
+  pull-sync.
+- Query tests: derivation formulas against sparse rows and both placements.
+
+## 15. Rollout and verification
+
+1. Land collection + freeze point + header emission behind the flag, off everywhere.
+   Full CI gate.
+2. Staging deploy with the flag on. Delivery-layer verification is two-sided: a
+   pass-through request confirming the appended Server-Timing survives the fronting
+   VCL, and a MISS-then-HIT replay against a cacheable route confirming no stale
+   timing header is ever served from cache. Fallback if the VCL clobbers the header: a
+   one-line VCL change on the delivery service, or mirroring the value to
+   `x-ts-timing` while that lands.
+3. Production flag on. Confirm
+   `performance.getEntriesByType('navigation')[0].serverTiming` shows `ts-*` entries
+   in a real browser session, and separately confirm what the publisher's RUM tooling
+   actually collects; the publisher monitoring extension renders it only after a small
+   change on their side.
+4. Inspect the deployed workspace, preserving any `access_logs_raw` datasource.
+   Deploy `access_logs_v2` and its `ts_access_v2_ingest` APPEND token before the
+   emitting binary. Update explicit dataset names and token references, then
+   enable sampling and verify ingestion/quarantine before switching dashboards.
+   Validate panel queries with `EXPLAIN` against the new sorting key. Sample at
+   1.0 only deliberately during stall diagnosis, accounting for the post-send
+   ingest wait. Follow the cutover and rollback steps in `tinybird/README.md`.
+5. Success criterion: the next stall window is attributable from one response header
+   or one dashboard query, with no live probing session.
+
+## 16. Overhead
+
+Roughly ten monotonic clock reads, two stored snapshots, and one ~130-byte header per
+request; one sampled HTTP POST with a bounded await after the response has fully
+streamed. No allocation in the hot path beyond the one `Arc` at entry, the
+`AccessTelemetrySnapshot` at the freeze point, and the rendered header string.
+
+## 17. Decisions and open questions
+
+- **Public exposure is a decision, not an open question.** The header is all-traffic
+  when enabled. Rationale: values are durations only; the delivery layer already
+  exposes `hit-state` and `time-elapsed` publicly on every response; filter vendor
+  identity is masked; emission is restricted to conclusively-private responses so no
+  cache can replay stale timings. Revisit (quantization or gating) only if a concrete
+  abuse surfaces.
+- The fronting delivery layer's Server-Timing pass-through is unverified until the
+  first staging deploy (step 2). This is the only known external dependency.
+- Body-phase capture threads the timings handle into the streaming closure in
+  `publisher.rs`; the exact seam is an implementation-plan detail, with the constraint
+  that a dropped handle (error paths, early client disconnect) must still yield a
+  valid row with null body-phase fields and a recorded delivery outcome.
+- The stall window itself remains unattributed until this ships. If it recurs first,
+  the bisection runbook from 2026-08-21 (cookie-free curl UA request, static-asset
+  path versus HTML path) is the fallback.
+
+## 18. Auction timeline offsets (follow-up increment)
+
+Status: spec amendment written ahead of implementation, then implemented in the
+same PR on top of the initial implementation (#1074). Builds only on machinery
+that spec sections 5, 9, and 10 already define.
+
+### Problem
+
+The pipeline has two clocks that never meet. The auction dataset
+(`auction_events_raw`, PR #813) measures the auction internally: `total_time_ms`
+from auction start to terminal, `provider_response_time_ms` per bidder call. Its
+clock starts when the auction observation is created, so nothing places those
+numbers on the request timeline. The access row is T0-anchored but records only
+`auction_wait_ms`: time the handler was blocked at collect, deliberately not the
+auction's own timeline.
+
+That leaves three questions unanswerable today:
+
+1. At what request-relative time did the auction start (dispatch leave the edge)?
+2. At what request-relative time did the auction resolve (final bid or timeout)?
+3. At what request-relative time were the results committed toward GAM?
+
+These are the overlap-proof questions. A client-side wrapper cannot dispatch until
+the browser boots (t~3000ms on measured prospect pages); the server-side auction
+dispatches while the origin fetch is in flight. Proving that requires all
+milestones on one clock.
+
+### Design
+
+One first-call-wins id setter and three first-call-wins marks on
+`RequestTimings`, in the style of `mark_headers_ready()`, each mark storing
+`Option<Duration>` since T0:
+
+| Call                        | Recorded at                                                                  | Meaning                                               |
+| --------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------- |
+| `set_auction_id()`          | where the `AuctionObservationContext` is built, on all three auction sources | the join key to `auction_events_raw` for this request |
+| `mark_auction_dispatched()` | where the bid requests leave the edge                                        | bid requests have left the edge                       |
+| `mark_auction_resolved()`   | where the auction returns, terminal on success, failure, or timeout          | final bid returned or auction timed out               |
+| `mark_auction_committed()`  | where winning bids become available to the response pipeline                 | targeting is committed                                |
+
+All three auction sources are instrumented, because all three emit rows to
+`auction_events_raw` and all three emit an access row:
+
+| Source              | Route            | Dispatch / resolve bracket   | Commit                     |
+| ------------------- | ---------------- | ---------------------------- | -------------------------- |
+| `InitialNavigation` | publisher HTML   | `dispatch_auction` / collect | `write_bids_to_state`      |
+| `SpaNavigation`     | `/_ts/page-bids` | `run_auction`                | bid map built              |
+| `AuctionApi`        | `POST /auction`  | `run_auction`                | OpenRTB response converted |
+
+Notes on the definitions:
+
+- "Committed toward GAM" is defined as the point where targeting becomes part of
+  the response: `write_bids_to_state` returning on the navigation path, the bid
+  map on page-bids, the converted OpenRTB response on `/auction`. TS never calls
+  GAM server-side; the browser's GPT call carries the targeting, and that half of
+  the timeline belongs to client-side measurement. The edge proves when targeting
+  was available; the client proves when GAM saw it.
+- The id is set separately from the dispatch mark, and earlier. Every auction
+  outcome emits an `auction_events_raw` row under that id, including skipped and
+  dispatch-failed auctions, so stamping the id at dispatch would leave exactly
+  those rows unjoinable. It also means a dropped dispatch sample cannot take the
+  join key with it.
+- First-call-wins on the id and all three marks. A request produces at most one
+  auction today; if a second ever occurs in one request, the row describes the
+  first and the auction dataset still carries both in full.
+- Same locking and failure model as every other `RequestTimings` write:
+  `try_lock`, drop on contention, poisoned lock recovered, saturating conversion
+  at serialization.
+
+### Row changes
+
+Four auction columns on the new `access_logs_v2` row, all populated from the
+`TimingSnapshot` at the existing freeze/emission points (no new emission path):
+
+```
+`auction_dispatched_ms`  Nullable(UInt32),  `json:$.auction_dispatched_ms`
+`auction_collected_ms`    Nullable(UInt32),  `json:$.auction_collected_ms`
+`auction_committed_ms`   Nullable(UInt32),  `json:$.auction_committed_ms`
+`auction_id`             Nullable(UUID),    `json:$.auction_id`
+```
+
+Null on an offset means "this milestone was not reached", not "no auction ran".
+`auction_id` is what separates the cases, and the two read together:
+
+| `auction_id` | `dispatched` | `collected` | `committed` | Meaning                                                                   |
+| ------------ | ------------ | ----------- | ----------- | ------------------------------------------------------------------------- |
+| null         | null         | null        | null        | no auction observation, including disabled auctions                       |
+| set          | null         | null        | null        | observed, then skipped or failed before network work                      |
+| set          | set          | null        | null        | provider dispatched, never collected, such as origin error or disconnect  |
+| set          | set          | set         | null        | collected, targeting not committed                                        |
+| set          | set          | set         | set         | provider work collected and targeting committed, including no-bid/timeout |
+| set          | null         | set         | null        | mediator-only network work collected, targeting not committed             |
+| set          | null         | set         | set         | mediator-only network work collected and targeting committed              |
+
+Dispatch evidence means at least one provider started a request; routing-only
+outcomes do not qualify. Collection can observe a mediator Pending result or a
+started-request error without provider dispatch. A configured mediator or an
+Immediate result alone is not launch evidence. Existing dispatch/admission choices
+are unchanged. The internal and browser fields retain their resolved names;
+`auction_collected_ms` names the persisted milestone, not transport completion.
+Whenever all three milestones exist, `dispatched <= collected <= committed`.
+Headers-ready can fall before or after these milestones, as described below.
+
+The third row is the case worth watching: bid requests went out and the response
+they were for never used them. It is distinguishable now, where before it was
+indistinguishable from "no auction".
+
+- `auction_id` is the telemetry auction UUID already present on every
+  `auction_events_raw` row, carried onto the access row as the join key between
+  the T0 timeline and per-bidder detail. It is `Nullable(UUID)` rather than a
+  String with a sentinel so it joins natively against `auction_events_raw`
+  .`auction_id`, which is `UUID`: a String column would make the join a type
+  error, and casting a `'none'` sentinel through `toUUID` throws. It is a random
+  UUID, not identity-bearing; unbounded cardinality is accepted for the same
+  reason it is accepted in the auction dataset. It is not in the sorting key, so
+  the section 9 non-nullable-dimension rule (which exists because ClickHouse
+  sorting keys cannot contain nullable columns) does not apply to it.
+- The versioned `access_logs_v2` datasource uses JSONPaths on every column and
+  no `FORWARD_QUERY`. The nine-column legacy datasource remains intact. Validate
+  deployment against the intended workspace before cutover; local field
+  alignment is not evidence of a successful remote deployment.
+
+### Interpretation model
+
+Combined with existing columns, one access row now reads as a timeline:
+
+```
+t=0 ......... request entry
+t=D ......... auction_dispatched_ms      (bids out; origin fetch typically in flight)
+t=R ......... auction_collected_ms        (collection returned, not transport completion)
+t=C ......... auction_committed_ms       (targeting available to the response)
+```
+
+`time_elapsed_ms` (t=H, headers committed) does **not** belong at the end of that
+ladder, and where it lands depends on `body_mode`:
+
+- Buffered (`auction_wait_placement = 'pre_header'`): H comes after C. The auction
+  is collected before the response headers are built, so D < R < C < H.
+- Streamed (`auction_wait_placement = 'in_stream'`): H comes **before** R and C.
+  `mark_headers_ready` is stamped at the terminal layer before the lazy body is
+  polled, while the collect happens at the `</body>` seam inside that body. So
+  D < H < R < C is the normal ordering for a streamed HTML page.
+
+Requiring `auction_committed_ms <= time_elapsed_ms` can discard valid streamed
+rows. Slice by wait placement before comparing auction marks against H. The
+illustrated ordering assumes distinct millisecond values; adjacent marks can be
+equal after whole-millisecond conversion.
+
+`C - R` measures whole-millisecond commit latency. On the navigation path it
+brackets `write_bids_to_state`, including per-winning-bid creative processing.
+Expect 0 on light auctions and non-zero as creative count and size grow.
+
+`R - D` is the dispatch-to-collection window, not auction duration. On streamed
+pages, collection can wait until the `</body>` seam even if provider transport
+finished earlier. Neither `R - D` nor its difference from `auction_wait_ms`
+establishes auction/origin overlap. `origin_ms` can itself measure only the
+remaining origin wait after early dispatch. Transport-completion timestamps would
+be needed to derive that overlap.
+
+`auction_wait_ms` measures actual collection after provider or mediator launch.
+`/auction` and `/_ts/page-bids` record `pre_header`; HTML uses its actual pre-header
+or in-stream placement. No-work outcomes leave wait null with `none` placement.
+A measured zero retains its placement, and mediator-only collection may have wait
+and collected/committed offsets while provider dispatch remains null.
+
+Joining to per-bidder detail, now that both sides are `UUID`:
+
+```sql
+SELECT a.auction_id, a.auction_collected_ms - a.auction_dispatched_ms AS edge_window,
+       e.provider, e.provider_response_time_ms
+FROM access_logs_v2 a
+INNER JOIN auction_events_raw e ON a.auction_id = e.auction_id
+WHERE a.auction_id IS NOT NULL AND e.event_kind = 'provider_call'
+```
+
+D is stamped where dispatch returns to the caller, while the auction dataset's
+`total_time_ms` and `provider_response_time_ms` start inside the orchestrator's
+launch loop. R is stamped when collection returns and includes any delay before
+the caller starts collection. Use the auction dataset for per-bidder duration;
+the access-row window is not a transport-duration measurement.
+
+### Scope
+
+- Fastly emits. Axum, Cloudflare, and Spin attach a collector and record the marks but
+  do not emit them. Cloudflare and Spin added collection when GPT diagnostics began
+  exposing request-scoped auction offsets; without an adapter collector those offsets
+  silently used a different handler-entry clock. This matches section 8a adapter
+  semantics: collection is portable, while emission remains adapter-specific.
+- No header emission for any of these values: they are post-hoc analysis fields,
+  and two of the three are typically unknown at the header freeze point in
+  streaming mode.
+- No config surface: the marks are always-on collection like every other phase,
+  gated at emission by the existing `tinybird.access_enabled`.
diff --git a/docs/superpowers/specs/2026-10-16-1199-sdk-url-ownership-design.md b/docs/superpowers/specs/2026-10-16-1199-sdk-url-ownership-design.md
new file mode 100644
index 0000000000..b2f5f1f411
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-16-1199-sdk-url-ownership-design.md
@@ -0,0 +1,305 @@
+# Lockr and Permutive SDK URL ownership
+
+Status: Implemented and independently reviewed. Validation results are recorded below.
+
+Issue: [#1199](https://github.com/IABTechLab/trusted-server/issues/1199).
+
+## Problem and invariant
+
+The browser Lockr guard claims any script URL containing `aim.loc.kr`, including
+another vendor's query string, a path segment, or a lookalike hostname. The
+server matcher is narrower but still searches the entire string. Both Permutive
+matchers have the same host-substring defect. Full-string extension checks also
+miss genuine SDK URLs with query strings.
+
+With all six insertion guards installed, a GPT URL whose query mentions Lockr
+has two claimants. GPT rewrites `script.src` at assignment time, preserving the
+query. Lockr then claims the first-party URL at insertion and replaces GPT with
+the configured Lockr SDK. Changing dispatcher order cannot fix that path.
+
+```mermaid
+flowchart TD
+    A[GPT URL with Lockr text in its query] --> B[GPT src setter rewrites it first-party]
+    B --> C[Dispatcher offers the URL to insertion guards]
+    C --> D[Old Lockr substring matcher claims the query text]
+    D --> E[Configured Lockr SDK replaces GPT]
+```
+
+For the URL cases covered by this change, each original vendor URL must have
+exactly its expected claimant, or none for an unowned URL. Lockr and Permutive
+must make the same ownership decision in browser and Rust code. Recognition
+must depend on the parsed vendor hostname and SDK pathname, never a vendor name
+elsewhere in the URL.
+
+## Scope
+
+Change only the Lockr and Permutive URL matchers, their tests, the shared URL
+fixture, and the relevant integration documentation. Leave dispatcher behavior,
+other vendors' matching rules, logging, configuration, upstream SDK serving,
+and proxy destinations unchanged.
+
+Issue #1247 and Lockr initialization, polling, and shim behavior are excluded.
+In particular, do not edit `src/integrations/lockr/index.ts` in the JS library.
+
+## Matching contract
+
+Use the browser `URL` parser and Rust's existing `url::Url` dependency. Keep the
+input normalization and parsing policy shared within each language. Keep vendor
+hostname and pathname checks local to each integration. Do not redesign shared
+guards.
+
+### Input forms
+
+- Reject literal NULs in raw matcher inputs: HTML replaces them with U+FFFD,
+  unlike direct URL-property assignment, which can trim them. A leading NUL
+  makes the markup URL a publisher-relative path, so rejecting it matches the
+  browser. A NUL after the authority can leave the vendor hostname and SDK
+  pathname intact: markup `//aim.loc.kr/<NUL>identity-lockr.js` loads
+  `https://aim.loc.kr/%EF%BF%BDidentity-lockr.js` from the vendor, while server
+  matching leaves it unowned. That fail-open case is accepted.
+- Before checking the prefix, apply the browser URL preprocessing rules: trim
+  leading/trailing C0 controls and space (U+0001–U+0020), then remove tab, LF, and
+  CR throughout the input. Do not trim Unicode whitespace such as U+FEFF or
+  U+0085. These boundary cases remain in the shared corpus.
+- Server matching reads the attribute text lol_html returns, which differs from
+  what a browser resolves. Character references stay encoded, so
+  `https:&#x2F;&#x2F;aim.loc.kr&#x2F;identity-lockr.js` (mustache.js escapes `/`
+  this way) is not recognized and the browser loads the vendor SDK directly,
+  while `https://static.example.com&quest;@aim.loc.kr/identity-lockr.js` is
+  claimed although the browser loads another host. A leading U+FEFF is dropped,
+  so the "Lockr BOM whitespace" input is claimed in served HTML although a
+  browser resolves it as a publisher path. Reading decoded attribute values
+  belongs in the HTML processor, for every attribute rewriter, and is out of
+  scope here. Follow-up [#1480](https://github.com/IABTechLab/trusted-server/issues/1480)
+  tracks character-reference decoding and the leading-BOM discrepancy.
+- Require an explicit HTTP(S) scheme followed by two authority separators, or
+  two separators for a protocol-relative URL. Each separator may be `/` or `\`,
+  matching browser HTTP(S) backslash handling. Scheme matching is case-insensitive.
+  Leave path/query interpretation to the native parser rather than replacing
+  backslashes globally.
+- Reject base-dependent shorthand such as `https:host/path` and `https:/host/path`
+  in raw/server matching. Whether those forms resolve to a vendor host or a
+  publisher path depends on the document scheme and base URL. Dynamic insertion
+  guards can recognize the DOM-resolved URL, but static markup using these forms
+  can still load the vendor SDK directly.
+- Accept absolute HTTP and HTTPS URLs, including uppercase schemes and hosts.
+  After preprocessing and the authority check, malformed means rejected by the
+  native URL parser. Normal parser normalization is allowed, but runtimes differ:
+  Node and Chromium accept some punycode labels rejected by Rust's `url` crate
+  and jsdom; Chromium also normalizes some fullwidth-percent encoded-dot host
+  spellings rejected by those runtimes. These remain fail-open recognition
+  limits, not a promise to recognize every browser-loadable spelling.
+- Accept protocol-relative URLs by adding `https:` before parsing. Ownership is
+  independent of the page's HTTP/HTTPS scheme.
+- Reject empty, malformed, non-network, relative-path, and bare-host inputs.
+  A bare hostname is not an authority in a browser script attribute. The DOM
+  resolves relative attributes before insertion handlers see them; on a normal
+  publisher page they remain publisher URLs and must not be claimed.
+- Match the parsed hostname, not the authority string. A port does not change
+  hostname ownership. User information must not make an unrelated host match.
+- Use exact hostname boundaries. Do not strip a trailing dot or invent extra
+  hostname aliases. Rely on the parsers' normal hostname normalization.
+- Inspect the parsed pathname without percent-decoding it. Query strings and
+  fragments do not participate in SDK recognition. Preserve existing
+  case-insensitive ASCII SDK path matching.
+
+### Lockr
+
+The hostname must be exactly `aim.loc.kr` or `identity.loc.kr`. The lowercased
+pathname must contain `identity-lockr` and end in `.js`.
+
+This retains the existing Rust SDK path family, including versioned and
+trust-server SDK names, rather than introducing a new basename allowlist. It
+intentionally stops claiming unrelated scripts or assets on the Lockr host.
+
+### Permutive
+
+The hostname must be exactly `cdn.permutive.com`, or have a nonempty subdomain
+prefix before `.edge.permutive.app`. The lowercased pathname must end in
+`-web.js`. Neither the bare `edge.permutive.app` hostname nor a lookalike suffix
+such as `.edge.permutive.app.example.com` matches.
+
+### Rewriting and compatibility
+
+Recognition of query-bearing and fragment-bearing SDK URLs is new for the Rust
+Lockr matcher, browser Lockr on `identity.loc.kr`, and both Permutive matchers.
+Cover both Lockr hosts explicitly. Those URLs must now take the existing proxy
+route. This does not forward their query or fragment to upstream: Lockr
+and Permutive serve the SDK selected by existing integration configuration.
+Keep `/integrations/lockr/sdk` and `/integrations/permutive/sdk` unchanged.
+
+Malformed inputs fail without throwing or preventing another guard from running.
+Narrowing non-network and bare-host strings is intentional. Preserve normal
+absolute and protocol-relative SDK URLs, and case-insensitive matching.
+
+## Files and test data
+
+Runtime changes belong in:
+
+- `crates/trusted-server-js/lib/src/integrations/lockr/script_guard.ts`
+- `crates/trusted-server-js/lib/src/integrations/permutive/script_guard.ts`
+- `crates/trusted-server-core/src/integrations/lockr.rs`
+- `crates/trusted-server-core/src/integrations/permutive.rs`
+- `crates/trusted-server-core/src/integrations/sdk_url.rs`
+- `crates/trusted-server-js/lib/src/shared/sdk_url.ts`
+
+Rust corpus loading and attribute-rewrite assertions are shared in the test-only
+`crates/trusted-server-core/src/integrations/sdk_url_test_support.rs` module.
+Direct private-matcher assertions remain in each integration's tests.
+
+Create `crates/trusted-server-js/lib/test/fixtures/sdk-url-ownership.json`. Each
+case records a descriptive name, input URL, and expected integration ID or null.
+An optional `insertionOwner` records a different expectation after native DOM URL
+resolution. In particular, raw matchers reject shorthand schemes. With the
+fixture's `https:` shorthand and jsdom's `http:` page, script and link URL getters
+resolve them to absolute vendor URLs before insertion. On an `https:` publisher
+page, the same inputs resolve to publisher paths and remain unowned.
+Rust tests and raw browser claimant tests use `owner`; DOM insertion tests use
+`insertionOwner` when present. This distinguishes parser input policy from the
+browser's existing attribute-resolution behavior. An optional `serverHtmlOwner`
+records a different expectation once lol_html has read the attribute from
+markup; the Rust HTML tests use it when present.
+Use fictional publisher/customer data. Public vendor hosts are necessary here
+to test the actual hard-coded ownership rules, not illustrative customer URLs.
+Import the same fixture in Vitest and Rust's inline test modules using the
+existing `aps-renderer-v1.json` include/import convention.
+
+The corpus must cover:
+
+- Canonical URLs for all six guards: Permutive, Lockr, Sourcepoint, GTM,
+  DataDome, and GPT.
+- Both Lockr hosts and both Permutive host families.
+- Real SDK paths with query strings, fragments, uppercase text, protocol-relative
+  forms, and ports.
+- Other vendors' URLs mentioning either affected vendor in queries or paths.
+- Host prefixes, suffixes, path mentions, and user-information lookalikes.
+- Unrelated resources on genuine vendor hosts and wrong SDK extensions.
+- Already-rewritten first-party GPT URLs whose query mentions a vendor host.
+- Empty/malformed, relative, bare-host, shorthand-scheme, and non-network inputs.
+- Trailing-dot hostnames, percent-encoded SDK path text, the bare
+  `edge.permutive.app` host, and C0/space/Unicode whitespace boundaries.
+- Tab/CR/LF preprocessing, backslash and mixed authority separators, and
+  normalized lookalike/user-information/path/query negatives.
+- NUL-containing raw attributes versus DOM URL properties and HTML tokenization.
+
+Replace stale comments pointing to Rust line numbers with pointers to this
+shared corpus.
+
+## Regression tests
+
+### Matcher and server tests
+
+For each corpus case, run both Rust matchers and assert whether the expected
+owner equals that integration. Run the corresponding JS guards against the
+same input URL so parser decisions cannot drift behind duplicated case lists.
+Also assert server attribute rewrite actions for matching and nonmatching cases,
+including `src` and `href`, while retaining disabled-rewrite coverage. Check
+attribute-routing eligibility before calling the rewriter. For every corpus
+case, also tokenize actual script/link markup with lol_html and assert the
+output: the SDK route when the case's server HTML owner is that integration,
+and the unchanged markup otherwise.
+
+### All-guard ownership and insertion tests
+
+Install all six real guards. Examine every registered handler against the
+original corpus URL, using a fresh untouched element per handler and passing the
+raw URL directly in the candidate. Do not initialize it through `script.src`,
+which would let GPT's assignment patches hide a claimant. This also prevents
+mutations by one handler influencing another. Assert the exact claimant ID list,
+not only a successful final rewrite. Do this entirely in test code without adding a new
+production dispatcher API.
+
+Separately exercise actual insertion through both `script.src = url` and native
+`Element.prototype.setAttribute.call(script, 'src', url)`, then append the node.
+Assert the final first-party route or unchanged attribute. Account for ordinary
+DOM relative-URL resolution separately from the raw matcher assertion. Exercise
+shorthand URLs with both HTTP and HTTPS document bases in
+`test/shared/sdk_url.test.ts`; same-scheme shorthand must remain a publisher path.
+
+Include the issue's three reproduced Lockr collision cases in
+`test/integrations/lockr/url_collision.test.ts`. Force Lockr ahead of GPT/GTM in
+test-only handler ordering as well as using normal dispatcher order. Reversing
+installation alone is insufficient because priorities and IDs set dispatch order.
+Ensure tests clean up guards, GPT's extra patches/observer, and dispatcher state.
+
+Cover preload and prefetch script links for both affected integrations, including
+query-bearing valid SDKs and false positives, through append and insertBefore.
+
+## Delivery and validation
+
+1. Record an independent fresh-context review of this spec, verify its findings,
+   and revise the contract where warranted before implementation.
+2. Add the shared corpus and regression tests. Confirm the relevant cases fail
+   against the original matchers before fixing runtime code.
+3. Apply the four matcher corrections and run focused JS and native Rust tests.
+4. Update the Lockr/Permutive guides with SDK ownership and query behavior.
+5. Run broader suites and repository-required handoff gates. Reuse passing checks
+   while their relevant inputs remain unchanged. Record failures and unavailable
+   checks explicitly and keep the pull request in draft.
+
+Focused checks from the JS library directory:
+
+```sh
+npx vitest run test/integrations/lockr test/integrations/permutive test/shared/sdk_url.test.ts test/shared/dom_insertion_dispatcher.test.ts
+```
+
+Focused checks from the repository root, using the pinned Rust toolchain
+and core's default feature set:
+
+```sh
+cargo test -p trusted-server-core integrations::lockr::tests
+cargo test -p trusted-server-core integrations::permutive::tests
+cargo fmt --all -- --check
+```
+
+At the combined checkpoint, run the full JS suite, JS lint/format/build, docs
+format, and the CI gates specified in `AGENTS.md`, including target-matched
+adapter tests/clippy and integration parity. Cargo builds depend on the JS
+crate, whose build script installs missing npm dependencies and builds bundles;
+coordinate those commands instead of running competing dependency installs.
+
+## Independent review
+
+A fresh-context reviewer read this spec, the full
+issue, and current code without conversation history or edits. It found no
+blocking defects. Its suggestions were accepted: bypass GPT assignment patches
+in raw claimant tests, add explicit trailing-dot/encoded-path/bare-edge-host
+fixture rows, and document query/fragment recognition on browser Lockr's
+`identity.loc.kr` host. Its open questions about whitespace and malformed URL
+spellings were resolved by the explicit common input rules above.
+
+A second fresh-context correctness review inspected the implementation, tests,
+fixture, and guides, traced the insertion and server rewrite paths, and ran the
+focused JS tests. It reported no findings.
+
+## Validation results
+
+The original regression tests failed against the substring matchers before the
+ownership fixes. The normalization regressions also failed before expanding the
+common preprocessing policy. The shared corpus now contains 106 cases, including
+23 normalization positives and negatives. The all-guard test expands them into
+1,390 ownership and insertion checks across both handler orders and DOM paths.
+
+| Check                                                                                                         | Result                                                                                           |
+| ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| Full JS suite, `npx vitest run --maxWorkers=4`                                                                | Passed, 2,640 tests across 52 files; scoped Vitest type assertions pass                          |
+| JS `npm run lint`, `npm run format`, `npm run build`                                                          | Passed                                                                                           |
+| Native Lockr and Permutive inline test modules                                                                | Passed, 11 and 9 tests, including the shared corpus and attribute rewriting                      |
+| `cargo test-fastly`, `cargo test-fastly-reuse`, `cargo test-axum`, `cargo test-cloudflare`, `cargo test-spin` | Passed (the Fastly aliases in CI with the pinned Viceroy); existing ignored tests remain ignored |
+| All eight target-specific clippy aliases listed in `AGENTS.md`                                                | Passed                                                                                           |
+| Integration parity test                                                                                       | Passed                                                                                           |
+| Native template build-digest tests and clippy                                                                 | Passed                                                                                           |
+| `cargo fmt --all -- --check`, wasm clock lint                                                                 | Passed                                                                                           |
+| Docs and repository Markdown formatting                                                                       | Passed                                                                                           |
+| URL-host lint on added lines                                                                                  | Passed                                                                                           |
+
+No live vendor SDK fetch or production deployment smoke test was performed.
+
+## Investigation evidence
+
+At `5bc388625`, an in-memory esbuild bundle of the actual guard source executed
+in JSDOM with all six guards installed reproduces GPT replacement via `script.src`,
+Lockr query/path/lookalike false positives, Permutive lookalike false positives,
+and the Permutive query-string false negative. The native setAttribute path
+leaves GPT correctly owned under current ordering. This is diagnostic evidence,
+not a substitute for the committed regression tests or full validation.
diff --git a/docs/superpowers/specs/2026-10-18-prebid-eid-fidelity-design.md b/docs/superpowers/specs/2026-10-18-prebid-eid-fidelity-design.md
new file mode 100644
index 0000000000..f3f2e72442
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-18-prebid-eid-fidelity-design.md
@@ -0,0 +1,1617 @@
+# Prebid EID fidelity
+
+Status: Reviewed. Round 5 found nothing blocking (see the review log). Backwards
+compatibility was explicitly not a constraint; section 8.2 lists what breaks.
+
+Issue: [#1246](https://github.com/IABTechLab/trusted-server/issues/1246), "Write
+Lockr IDs to KV store".
+
+Designed against `main` at `a9037770a`. Every `file:line` reference below is to
+that commit. Prebid.js references are to version 10.26.0, the version
+`crates/trusted-server-js/lib/package-lock.json` pins, read from
+`crates/trusted-server-js/lib/node_modules/prebid.js/`. References marked
+"(11.43)" are to Prebid.js 11.43.0-pre at commit `51e968dba`, audited in
+section 3.5 to check how the design holds across a future upgrade.
+
+Related work:
+
+- [KV EID request snapshot and EC recovery](2026-07-10-kv-eid-request-snapshot-ec-recovery-design.md)
+  defines the `/auction` body to KV path this spec keeps.
+- Draft PR #1382 (pluggable modules stack, #777) moves the `ts-eids` cookie
+  parser out of core. Section 8.4 covers the overlap.
+- Open PR #1406 changes Lockr API routing. It does not touch EIDs.
+
+Terms used throughout:
+
+- **EID**: an OpenRTB extended identifier object, `{source, uids[]}` plus
+  optional `inserter`, `matcher`, `mm` and `ext` (OpenRTB 2.6 §3.2.27). A
+  **UID** is one entry of `uids`, `{id, atype?, ext?}` (§3.2.28).
+- **EID-level fields**: `inserter`, `matcher`, `mm` and the EID's own `ext`, as
+  opposed to a UID's `atype` and `ext`. They say who added an ID and how it was
+  matched.
+- **`ortb2` / FPD**: Prebid's first-party data, the OpenRTB fragments that
+  Prebid merges into each bidder's request.
+- **Shim**: the `tsjs-prebid` script Trusted Server (TS) serves. It registers
+  the `trustedServer` Prebid bid adapter, which sends bids to `/auction`.
+- **EC / KV identity graph**: the Edge Cookie ID and the KV store row that maps
+  it to partner UIDs registered under `[[ec.partners]]`.
+- **`ts-eids`**: the first-party cookie in which the shim copies the browser's
+  EIDs for requests that carry no EID body.
+- **Body-less routes**: requests that carry no EID body and read `ts-eids`
+  instead: the server-side auction at page navigation, `/_ts/page-bids`, and
+  `/auction` calls from `tsjs.requestAds`.
+- **`x-ts-eids`**: the `/auction` response header that shows the consent-gated
+  EIDs TS sent to providers. Used for validation and troubleshooting.
+
+## 1. Problem statement
+
+The `trustedServer` adapter should forward to `/auction`, and copy into
+`ts-eids`, the same EIDs Prebid.js gives that bidder, and KV should learn only
+those. Today the adapter reads a different Prebid API, misses whole EID
+sources, leaks IDs Prebid withholds, drops OpenRTB fields, and copies a
+different set into the cookie than it sends.
+
+### D1. IDs Prebid withholds from `trustedServer` are forwarded (privacy, contract)
+
+- `collectAuctionEids` reads only `pbjs.getUserIdsAsEids()`
+  (`crates/trusted-server-js/lib/src/integrations/prebid/index.ts:1891-1914`).
+- In Prebid that call returns `getEids(initializedSubmodules.combined)`
+  (`modules/userId/index.ts:675-677`). `combined` folds every bidder-restricted
+  module map into the global one (`modules/userId/index.ts:440`). A
+  `userSync.userIds[]` entry with `bidders: ['otherBidder']` is therefore
+  returned too.
+- It also skips per-bidder redaction. Prebid applies the `transmitEids`
+  activity to `bidderRequest.ortb2` and `bid.userIdAsEids` only
+  (`src/activities/redactor.ts:127-160`). EIDs that TCF enforcement
+  (`modules/tcfControl.ts:291-316`) or US-state GPP rules
+  (`libraries/mspa/activityControls.ts:130-131`, 11.43) strip from
+  `trustedServer` are still returned. It does honor the module-level
+  `enrichEids` activity (`modules/userId/index.ts:385`).
+- The result feeds the `/auction` body (`index.ts:2361`, `:2365`) and the
+  `ts-eids` cookie (`index.ts:2990`). The server forwards client EIDs to every
+  server-side provider (`auction/endpoints.rs:347-350`) and ingests registered
+  sources into KV (`ec/finalize.rs:84`, `:142`). The server's own consent gates
+  (4.8) catch most consent cases, but not bidder restrictions.
+- Observed: not seen on the investigated live page, which had no restricted
+  entries and no consent denial. It follows directly from the Prebid source.
+
+### D2. EIDs from `ortb2` never reach Trusted Server (#1246)
+
+- `buildRequests(validBidRequests)` (`index.ts:2357`) ignores the second
+  argument Prebid passes, `bidderRequest`
+  (`src/adapters/bidderFactory.ts:140`, called at `:438`). Nothing in the
+  collector reads `ortb2`.
+- So EIDs set with `setConfig({ortb2})`, `mergeConfig`, `setBidderConfig`,
+  per-call `requestBids({ortb2})` or RTD modules are invisible. The Lockr SDK
+  writes its ID5 EID through `setConfig({ortb2: {user: {ext: {eids}}}})`.
+- Without the userId module, `buildRequests` sends no EIDs at all and
+  `syncPrebidEidsCookie` clears the cookie (`index.ts:2984-2987`), even when
+  `ortb2` holds EIDs.
+- Observed: #1246 reports `getUserIdsAsEids()` returning only `criteo.com` and
+  `pubcid.org` on a Lockr page whose client-side bidders received Lockr's ID5.
+  In a later live session, 13 of 14 `bidRequested` events for `trustedServer`
+  carried Lockr's `id5-sync.com` entry in `bidderRequest.ortb2`. The
+  `/auction` body is built from `getUserIdsAsEids()`, so it cannot carry that
+  entry. Lockr does put the ID into Prebid; TS reads the wrong API.
+
+### D3. EID-level OpenRTB fields are dropped
+
+- TSJS: `AuctionEid` is `{source, uids}` (`src/core/auction.ts:30-33`), the
+  collector pushes `{source: eid.source, uids}` (`index.ts:1910`) and the
+  cookie writer rebuilds `{source, uids}` (`index.ts:2926`).
+- Rust: `Eid` holds `source` and `uids` with `deny_unknown_fields`
+  (`crates/trusted-server-core/src/openrtb.rs:67-75`). The body parser builds
+  `Eid { source, uids }` (`auction/endpoints.rs:533`). The cookie parser's
+  structs have no such fields (`ec/prebid_eids.rs:33-47`).
+- `merge_auction_eids` folds every entry of a source into one
+  (`auction/endpoints.rs:564-622`), so even with the fields carried it could
+  keep only one entry's values per source.
+- Prebid sets them. unifiedId's `adserver.org` entry carries `inserter` and
+  `matcher` `adserver.org` and `mm: 4` (`modules/unifiedIdSystem.js:78-85`).
+  LiveIntent puts `segments` in the EID's own `ext`
+  (`libraries/liveIntentId/shared.js:156-168`). sharedId adds an `inserter`
+  when configured (`modules/sharedIdSystem.ts:194-203`). Lockr's `ortb2` entry
+  was observed with `inserter` and `mm: 2`. Section 3.5 lists the rest.
+
+### D4. TS forces `auctionDelay: 0` (yield)
+
+Prebid 10.26.0 behavior:
+
+- `auctionDelay` defaults to 500 ms (`src/userSync.ts:59-70`).
+- `userSync` settings accumulate across `setConfig` calls. The userSync module
+  merges each new `userSync` config into the object Prebid also uses as that
+  topic's defaults (`src/userSync.ts:103-120`, `:383-384`), so a later call
+  keeps earlier keys such as `userIds`. A repo test characterizes this
+  (`test/prebid-artifact-integration.test.mjs:432-446`).
+- The userId module reads `auctionDelay` and `syncDelay` whenever a `userSync`
+  config containing `userIds` is set (`modules/userId/index.ts:1245-1256`).
+- At its first initialization the module decides when asynchronous `getId`
+  calls start: immediately if `auctionDelay > 0`, otherwise only after the
+  first auction ends plus `syncDelay` (`modules/userId/index.ts:536-547`).
+- Each auction waits for pending IDs or `auctionDelay`, whichever comes first
+  (`modules/userId/index.ts:596-606`).
+
+Trusted Server behavior:
+
+- `installUserIdModules()` (`index.ts:2881-2898`) runs on `window.load`, or at
+  install if the page has already loaded (`index.ts:3020-3033`). It calls
+  `setConfig({userSync: {syncEnabled: true, filterSettings: {all: …},
+auctionDelay: 0, syncsPerBidder: 5, syncDelay: 3000}})`.
+- Because settings accumulate, the result still carries `userIds`, so the
+  userId module applies `auctionDelay: 0` to every auction after `window.load`.
+  The call also overwrites whatever the publisher set for `syncEnabled`,
+  `syncsPerBidder` and `syncDelay`, and its `filterSettings.all` enables iframe
+  user syncs for every bidder, where Prebid's default allows image syncs only.
+- A module first initialized after `window.load` starts with TS's `0`. How it
+  then behaves depends on the path:
+  - A publisher `userIds` config set after load defers every vendor call until
+    after the first auction ends plus `syncDelay`.
+  - TS's managed User ID seed after a late CMP answer sets `autoRefresh: true`
+    (`index.ts:2247-2256`). Prebid then runs the new modules' callbacks at once
+    (`modules/userId/index.ts:1093-1097`, `:549-566`). Vendor calls start, but
+    with `0` no auction waits for them.
+- `auctionDelay` never covers vendors that write `ortb2` asynchronously, such
+  as Lockr. Only User ID module `getId` calls are awaited.
+
+Observed: the first of 14 `trustedServer` requests on the live page carried
+only `pubcid.org` and `adserver.org`, both read from storage synchronously. The
+other 13 carried 13 sources, including criteo, LiveIntent and 8 LiveIntent
+partner sources, and Lockr's ID5. The page's effective `auctionDelay` and the
+order of `window.load`, CMP answer and first auction were not captured, so
+TS's `0` is the likely cause, not a proven one. Section 7.5 proves the
+mechanism; the live check in 7.6 decides whether it was the cause on that page.
+
+### D5. The cookie copies a different set from the request
+
+- `syncPrebidEidsCookie()` (`index.ts:2982-3009`) collects EIDs again in the
+  chained `bidsBackHandler` (`index.ts:2537-2541`), without the bidder request,
+  after every auction routed through the shim.
+- Once D2 is fixed in `buildRequests` alone, the cookie and the body would
+  carry different sets. Body-less routes (`publisher.rs:5531-5556`,
+  `auction/endpoints.rs:472-477`) and KV ingestion read the cookie.
+- Keying a copy of the body by auction in `bidsBackHandler` does not work:
+  `bidderRequest.auctionId` is `null` unless the publisher sets `enableTIDs`
+  (`src/adapters/bidderFactory.ts:200-232`,
+  `src/activities/redactor.ts:225-230`).
+
+### D6. Dead registry metadata (low)
+
+`user_id_modules.json` carries `eidSources` per module, and
+`resolvePrebidUserIdModulesFromEids`
+(`src/integrations/prebid/user_id_modules.ts:104-112`) maps sources back to
+modules. Only tests read either; the CLI reads only `moduleName` and
+`configNames`. The data is also wrong in places: ID5 emits
+`true-link-id5-sync.com` (`modules/id5IdSystem.js:41`), and LiveIntent's
+`adserver.org` and `uidapi.com` entries cannot be listed without taking those
+sources from unifiedId and uid2.
+
+### D7. Prebid identityLink disables itself on a malformed `_lr_env` (upstream)
+
+`modules/identityLinkIdSystem.js` calls `JSON.parse(envelope).envelope` without
+a guard in the ATS branch (`:83`) and the storage branch (`:93`). The userId
+core catches the exception, so the module never falls back to the LiveRamp
+endpoint and never stores an ID. On the live page `_lr_env` base64-decoded to
+text that is not JSON. Which script writes that value is unconfirmed.
+
+### D8. One bad EID fails a whole request or cookie
+
+- `JSON.stringify` writes a lone UTF-16 surrogate as an escape such as
+  `"\ud800"`. The server parses the body in one `serde_json::from_slice`
+  (`auction/endpoints.rs:161`), and serde_json rejects a lone surrogate escape
+  (`src/read.rs:900-960` in 1.0.150 as locked; the error is
+  `UnexpectedEndOfHexEscape` or `LoneLeadingSurrogateInHexEscape`, depending on
+  what follows). One bad string in any EID, from any vendor or publisher, turns
+  the request into a 400 and drops all `trustedServer` demand for that auction.
+- UID-level `ext` has no size limit in TSJS or Rust. An oversized vendor `ext`
+  can push the body past 256 KiB (`auction/endpoints.rs:46`), with the same
+  result.
+- The cookie is validated differently from the body. The body parser drops a
+  bad field and keeps the entry (`auction/endpoints.rs:491-562`); the cookie
+  parser deserializes into typed structs (`ec/prebid_eids.rs:33-47`, `:90-95`),
+  so one mistyped field such as `"atype": "1"` rejects the whole cookie, and no
+  caps apply. The shim's `btoa` throws on characters above U+00FF
+  (`index.ts:2931`, `:3002`), leaving the previous cookie in place.
+
+### D9. KV's stale copy overrides the browser's
+
+`merge_auction_eids` lists KV-resolved EIDs first, deduplicates UIDs by `id`,
+and keeps the first copy's `atype` and `ext` (`auction/endpoints.rs:564-622`,
+pinned by the test at `:1721`). KV keeps the first value it stored and never
+replaces it from the browser (KV snapshot spec, "Finalization Contract";
+`ec/kv.rs:560-600` defers a different existing value), and its `atype` comes
+from operator config (`openrtb_atype`, `ec/registry.rs:28`). So for rotating
+IDs bidders receive the old KV value next to the fresh browser value, and KV's
+operator-configured `atype` overrides the vendor's own.
+
+| #   | Severity                    | Fixed by       |
+| --- | --------------------------- | -------------- |
+| D1  | Privacy / contract          | 4.2, 4.6       |
+| D2  | High                        | 4.2            |
+| D3  | Medium                      | 4.3, 4.4, 4.5  |
+| D4  | Medium (yield)              | 4.9            |
+| D5  | Medium                      | 4.3            |
+| D6  | Low                         | Section 6, O6  |
+| D7  | External                    | Follow-up, 8.5 |
+| D8  | Low likelihood, high impact | 4.2, 4.3, 4.4  |
+| D9  | Medium                      | 4.5            |
+
+## 2. Goals and non-goals
+
+Goals:
+
+- **G1.** The `/auction` body carries exactly the EIDs Prebid placed in the
+  `trustedServer` bidder request, as plain data. (D1, D2)
+- **G2.** `ts-eids` copies the body set of the latest `trustedServer` request,
+  without EID-level `ext` and within 3,072 bytes. It is cleared when that set
+  is empty or Prebid's TCF rules block `trustedServer`, and left alone by
+  auctions that do not include `trustedServer`. (D5)
+- **G3.** KV ingestion on `/auction` uses exactly the client EIDs the auction
+  used. (D1 for KV; #1246)
+- **G4.** Browser entries reach the outbound `user.ext.eids` as Prebid sent
+  them, EID-level fields included. KV adds entries only for registered sources
+  the browser did not send. (D3, D9)
+- **G5.** One parser for body and cookie. A bad entry costs only that entry,
+  and EIDs cannot push the body over its limit. (D8)
+- **G6.** TS stops overriding the publisher's Prebid `userSync` config, so the
+  publisher's or Prebid's `auctionDelay` applies from the first auction. (D4)
+- **G7.** The `x-ts-eids` response header stays, now with EID-level fields, for
+  validation and troubleshooting.
+
+Non-goals:
+
+- **Changing who writes `ts-eids`, its lifetime, or moving it server-side.**
+  The cookie stays a browser-written first-party cookie that TS reads before
+  KV (O1).
+- **Fixing D7 in Trusted Server.** The bug is in a Prebid module that TS does
+  not fork. An upstream fix is a follow-up (8.5).
+- **Waiting for asynchronous `ortb2` vendors before the first auction.** After
+  their first `/auction`, registered partners such as Lockr's ID5 come from the
+  cookie and KV on later requests.
+- **Forwarding first-party data other than EIDs** (`user.data` segments,
+  `site`, `device`) from `bidderRequest.ortb2`. A separate contract; Permutive
+  segments already travel through the auction `config` (3.6).
+- **Allowing RTD modules in generated bundles.** The CLI rejects them today
+  (3.5). The collector handles their EIDs if that changes.
+- **Changing KV storage rules or the identity graph schema**, including how
+  browser-sourced partner IDs are refreshed. Those belong to the identity
+  architecture work; this spec stores nothing new.
+- **Moving outbound EIDs from `user.ext.eids` to OpenRTB 2.6 `user.eids`.**
+  Prebid Server moves `user.ext.eids` to `user.eids` itself
+  (`moveEIDFrom25To26` in `openrtb_ext/convert_up.go`), Prebid normalizes to
+  `user.ext.eids` (11.43 `src/fpd/normalize.js:28-45`), and APS receives that
+  shape from Prebid's own adapter. Moving gains nothing and risks APS.
+- **TS's own TCF identity**: registering `trustedServer` as Prebid's
+  `VENDORLESS_GVLID`, a server-side per-provider vendor check, and the upstream
+  fix it needs. Needs legal review; its own spec (3.7, 8.5).
+- **Server-side ingestion of Prebid's `_sharedid` cookie**, which ignores
+  Prebid's bidder restrictions. A follow-up issue (O10, 8.5).
+- **Restricting EIDs per server-side bidder** through Prebid Server
+  `eidpermissions`. The adapter cannot see other bidders' fragments (4.8).
+- **Adding Permutive identity (`permutiveIdentityManagerIdSystem`).** Product
+  decision.
+- **A public `tsjs.addEids` API or server-side reads of vendor cookies.**
+  Separate features with their own contracts; #1246 does not need them.
+- **A lenient parse of the rest of the `/auction` body.** Only `eids` is
+  isolated (4.4).
+
+## 3. Background
+
+### 3.1 Where Prebid comes from
+
+- `ts prebid client` generates a pure Prebid.js external bundle. Its entry
+  imports Prebid core, the consent modules, `tcfControl` and `userId`
+  (`crates/trusted-server-js/lib/build-prebid-external.mjs:519-556`). The
+  operator hosts it and sets `external_bundle_url`.
+- TS serves the shim as a deferred script that runs after the external bundle
+  (`integrations/prebid.rs:1377`, asserted at `:4567-4570`).
+- The shim registers the adapter, wraps `requestBids`, then calls
+  `pbjs.processQueue()` (`index.ts:2592`). Publisher `pbjs.que` commands
+  therefore run after TS's wrappers exist. The external bundle drains the queue
+  itself only if the shim never installs (`build-prebid-external.mjs:547-553`).
+- External bundles generated before the shim split carry a baked-in shim.
+  `window.__tsjsPrebidShimInstalled` (`index.ts:2002-2009`) lets the first one
+  win (`docs/guide/integrations/prebid.md:236-241`).
+
+### 3.2 How Prebid builds a bidder's EIDs
+
+1. `requestBids` builds `ortb2Fragments`: `global` is the `ortb2` config merged
+   with per-call `ortb2`; `bidder[code]` is that bidder's `setBidderConfig`
+   data (`src/prebid.ts:800-803`).
+2. `normalizeFPD` moves `user.eids` into `user.ext.eids`, removing only
+   deep-equal duplicates (`src/fpd/normalize.js:25-47`, called at
+   `src/prebid.ts:804`).
+3. The userId hook waits (3.3), then `enrichEids` appends unrestricted module
+   EIDs to `global.user.ext.eids` and restricted ones to
+   `bidder[code].user.ext.eids` (`modules/userId/index.ts:446-465`). RTD
+   modules write into the same fragments, after normalization, so an RTD
+   module that writes `user.eids` leaves it there (3.5).
+4. `adapterManager` sets each bidder's `bidderRequest.ortb2` to global data
+   merged with that bidder's fragment, redacted by activity controls
+   (`src/adapterManager.ts:519-545`, `:588-597`). Redaction covers both
+   `user.eids` and `user.ext.eids` (`ORTB_EIDS_PATHS`,
+   `src/activities/redactor.ts:23`).
+5. The adapter receives it as `buildRequests(validBidRequests, bidderRequest)`
+   through a proxy that hides `auctionId` and `transactionId` unless
+   `transmitTid` is allowed (`src/adapters/bidderFactory.ts:200-232`, `:438`).
+   Each bid's `userIdAsEids` is a getter for the same `user.ext.eids` array
+   (`modules/userId/index.ts:612-621`).
+
+`pbjs.getUserIdsAsEids()` sits outside this pipeline. It returns every module
+EID, restricted and redacted ones included, and nothing from `ortb2` (D1).
+
+`createEidsArray` (`modules/userId/eids.js:49-90`) keys module EIDs by the
+lowercased source plus the values of every other EID-level field. Same-source
+entries with different `inserter`, `matcher`, `mm` or `ext` stay separate. For
+example, unifiedId's TDID (`matcher: adserver.org`) and LiveIntent's TDID
+(`matcher: liveintent.com`) are two `adserver.org` entries. Prebid passes
+`ortb2` entries through without grouping.
+
+### 3.3 Prebid timing
+
+D4 lists the mechanics. In page order today:
+
+1. The HTML loads the `pbjs` stub, the external bundle and the deferred shim.
+2. The shim installs and runs the publisher queue. The first `userSync` config
+   with `userIds` initializes the userId module with the publisher's
+   `auctionDelay`, or Prebid's 500 ms.
+3. Managed User ID seeding runs once a TCF CMP answers or the publisher
+   configures `consentManagement` (`index.ts:2261-2323`), building its config
+   from the effective `userSync`.
+4. `window.load` fires and `installUserIdModules()` sets `auctionDelay: 0` and
+   TS's sync settings. Every later auction waits for nothing. A module a
+   publisher first configures after this point defers its vendor calls; one TS
+   seeds after a late CMP answer calls its vendor at once, but no auction waits
+   for it.
+5. Vendors that call their own API, such as Lockr, write `ortb2` when their
+   response arrives. Auctions that start after that see it.
+
+### 3.4 Current Trusted Server data flow
+
+```mermaid
+flowchart LR
+  subgraph Browser["Browser: tsjs-prebid shim"]
+    GU["pbjs.getUserIdsAsEids()<br/>all module EIDs, restricted included;<br/>nothing from ortb2"]
+    BR["trustedServer.buildRequests<br/>(ignores bidderRequest)"]
+    BB["bidsBackHandler:<br/>syncPrebidEidsCookie()"]
+    GU --> BR
+    GU --> BB
+  end
+  BR -- "POST /auction<br/>body.eids {source, uids}" --> PB
+  BB -- "ts-eids cookie<br/>base64 JSON, at most 3 KB" --> PC
+  subgraph Edge["trusted-server-core"]
+    PB["parse_client_auction_eids<br/>(lenient)"]
+    PC["parse_prebid_eids_cookie<br/>(strict serde)"]
+    SEL["body, else cookie"]
+    NAV["navigation auction, page-bids:<br/>cookie only"]
+    KV[("KV identity graph")]
+    RK["resolve_auction_eids"]
+    M["merge_auction_eids<br/>by source, KV first"]
+    G["gate_eids_by_consent"]
+    OUT["providers:<br/>user.ext.eids"]
+    ING["collect_eid_updates:<br/>cookie, then body, then sharedId"]
+    PB --> SEL
+    PC --> SEL
+    PC --> NAV --> M
+    SEL --> M
+    KV --> RK --> M --> G --> OUT
+    PC --> ING
+    SEL --> ING
+    ING -- "fill absent partner IDs" --> KV
+  end
+```
+
+- `/auction` uses the body EIDs, or the cookie when the body has none
+  (`auction/endpoints.rs:472-477`), only when the request has an allowed EC
+  (`auction/endpoints.rs:293-300`). `tsjs.requestAds` never sends a body set
+  (`src/core/request.ts:45`), so it always uses the cookie.
+- The navigation auction and `/_ts/page-bids` read only the cookie, through
+  `apply_auction_eids_and_device` (`publisher.rs:5526-5556`).
+- `merge_auction_eids` (`auction/endpoints.rs:564-622`) lists KV-resolved EIDs
+  first, then client EIDs, grouped by `source`, deduplicates UIDs by `id`, and
+  lets the KV value win for `atype` and UID `ext` (D9).
+- Outbound EIDs go to `user.ext.eids` through one shared `UserExt`
+  (`openrtb.rs:33-48`): config-first providers (`auction/openrtb.rs:372`),
+  Prebid Server (`integrations/prebid.rs:2731`) and APS
+  (`integrations/aps.rs:1119`). No other code path serializes EIDs; the
+  orchestrator, routing, telemetry and mock ad server only build empty ones.
+- The `/auction` response carries the consent-gated outbound set in
+  `x-ts-eids` (`auction/formats.rs:536-548`).
+- On response finalization (`ec/finalize.rs:84`, `:142`), `collect_eid_updates`
+  (`ec/prebid_eids.rs:138-161`) reads the cookie, then the request's client
+  EIDs, then the `sharedId` cookie, keeps one UID per registered partner, and
+  writes only partners KV does not yet hold (`ec/kv.rs:145-155`). This runs on
+  navigation, `/auction` and `/_ts/page-bids` responses. The Fastly adapter
+  reads both cookies before routing
+  (`trusted-server-adapter-fastly/src/app.rs:420`, `:740`).
+
+### 3.5 Prebid module audit
+
+All 1,579 entries of Prebid.js 11.43 `modules/` were checked against 10.26.0
+for anything that produces, filters or moves EIDs. Everything below reaches
+the adapter through `bidderRequest.ortb2`, so the collector (4.2) handles it
+without module-specific code.
+
+The EID pipeline in 3.2 is the same in 11.43: `enrichEids` still writes
+`user.ext.eids` (11.43 `modules/userId/index.ts:461-480`), `normalizeFPD` and
+`createEidsArray` are unchanged apart from formatting, `auctionDelay` is read
+only with `userIds` (11.43 `:1349-1353`), callbacks start at initialization
+only when it is above 0 (11.43 `:599-606`), and `getUserIdsAsEids()` still
+returns `combined` (11.43 `:757-758`). 11.43 adds batching of in-flight
+callbacks and an `acpId` (Google Additional Consent provider ID) for adapters
+without a GVL ID.
+
+| Category                                   | What they do with EIDs                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| User ID modules (63 in 10.26, 67 in 11.43) | `enrichEids` adds them to `user.ext.eids`, globally or per bidder. `lockrAIMIdSystem`, `growthCodeIdSystem` and `adriverIdSystem` have no `eids` mapping in either version, so they never produce an EID through Prebid                                                                                                                                                                                                                                                                                                                           |
+| Modules that set EID-level fields          | unifiedId (`inserter`, `matcher`, `mm: 4`), openPair (`mm: 3`, `inserter` and `matcher` from config and possibly `undefined`), sharedId (`inserter` from params), LiveIntent (TDID `matcher`; `ext.segments`), oneKey (`ext.preferences`), pubProvidedId (whatever the publisher passes, deep-cloned)                                                                                                                                                                                                                                             |
+| Sources emitted by more than one module    | `adserver.org` (unifiedId, LiveIntent), `uidapi.com` (uid2, LiveIntent, Permutive identity manager), `id5-sync.com` (ID5, Permutive, Lockr via `ortb2`), `liveramp.com` (identityLink, Permutive), `google.com` (pairId, Permutive). Prebid keeps them as separate entries when their EID-level fields differ                                                                                                                                                                                                                                     |
+| Sources not known in advance               | ID5 (an `euid` entry whose source comes from the response), intentIq, merkle                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| RTD providers (70 in 11.43)                | Only a1Media (global `user.ext.eids`, `a1MediaRtdProvider.js:70-92`) and 51Degrees (11.43 only; global `user.eids`, one `51d.es` entry per `mm`, `51DegreesRtdProvider.js:262`, `:422-470`) write EIDs. Their `user.eids` survives to the adapter (3.2 step 3). TS bundles cannot include RTD modules today: the CLI rejects `real_time_data` (`trusted-server-cli/src/prebid_bundle.rs:1541-1554`)                                                                                                                                               |
+| Filters that run before the adapter        | `tcfControl` (`enrichEids`, `transmitEids`, `eidsRequireP4Consent`), US-state GPP rules (11.43 `libraries/mspa/activityControls.ts:130-131`), `enrichmentLiftMeasurement` (blocks `enrichEids` for a control group, 11.43 `index.js:48-49`), `dataControllerModule` (`filterEIDwhenSDA` empties `user.ext.eids`, 11.43 `index.js:134-157`), the RTD write guard (11.43 `libraries/objectGuard/ortbGuard.js:15-17`), `rules` (11.43; can deny `fetchBids`, `rules/index.ts:3`). The collector inherits whichever of them the bundle contains (4.8) |
+| Prebid Server adapter                      | Sends every distinct EID object in `user.ext.eids`, repeated sources included (11.43 `prebidServerBidAdapter/bidderConfig.js:47-82`, `:98-153`). Evidence for 4.5                                                                                                                                                                                                                                                                                                                                                                                 |
+| Not bidder EIDs                            | Google encrypted signals (`registerSignalSources`, `getEncryptedEidsForSource`) go to GPT, not to bidders, and correctly stay out                                                                                                                                                                                                                                                                                                                                                                                                                 |
+
+Shapes the server rules (4.4) must accept: integer `mm` and `atype` (including
+PAIR's `571187`), EID-level `ext` objects of a few hundred bytes (LiveIntent
+segments, oneKey preferences), `undefined` provenance fields (openPair), and
+anything a publisher passes through pubProvidedId.
+
+### 3.6 Trusted Server integrations
+
+- **prebid** is the only integration that reads or writes EIDs.
+- **lockr**: TS proxies the Lockr API, and until #1406 lands the shim rewrites
+  the SDK's API host (`integrations/lockr/index.ts:51-70`). The Lockr SDK
+  writes its EID into Prebid `ortb2`, which the collector reads like any other.
+- **permutive** sends segments through a context provider in the auction
+  `config` (`integrations/permutive/index.ts:102-110`), not as EIDs.
+- **aps, gpt, google_tag_manager, gpt_diagnostics, creative, datadome,
+  testlight**: no EID reads or writes. Their `setConfig` calls configure tsjs
+  or `googletag`, not Prebid.
+- **didomi, osano, sourcepoint** (CMPs) affect EIDs only through Prebid's
+  consent modules and TS's server-side consent gates, which this design
+  inherits.
+
+### 3.7 TCF and the `trustedServer` adapter
+
+- The shim registers `trustedServer` without a `gvlid` (`index.ts:2349`).
+  Nothing in TS sets `gvlMapping`, `vendorExceptions` or
+  `softVendorExceptions`.
+- Generated bundles include `tcfControl` (`build-prebid-external.mjs:536`).
+  TCF enforcement is active when the publisher configures
+  `consentManagement.gdpr`, or when the shim enables it on finding a TCF CMP
+  for managed User IDs (`index.ts:849-855`).
+- With no rules configured, Prebid's defaults require vendor consent for
+  Purposes 1 and 2 (`modules/tcfControl.ts:50-99`). A module without a GVL ID
+  never has vendor consent (`validateRules`, `:232-243`). So where enforcement
+  is active and GDPR applies, `fetchBidsRule` (`:287`) removes `trustedServer`
+  from the auction and `transmitEidsRule` (`:291-316`) redacts its EIDs,
+  unless the publisher lists `trustedServer` as an exception.
+- Today such traffic gets no `trustedServer` bid requests at all, but the
+  `ts-eids` cookie, written from `getUserIdsAsEids()`, still carries EIDs to
+  body-less routes and KV. The documented IdentityLink flow relies on that
+  (`docs/guide/integrations/prebid.md:845-856`).
+- **A publisher rule replaces Prebid's default rule for that purpose
+  wholesale** (`ACTIVE_RULES[...] = rules[name] ?? opts.default`, `:398`;
+  11.43 `:468`), and `validateRules` reads `enforcePurpose` and
+  `enforceVendor` from it directly (`:239-242`). A rule written as
+  `{purpose: 'basicAds', softVendorExceptions: ['trustedServer']}` therefore
+  switches off both checks for every bidder. The only safe form is the full
+  rule:
+
+  ```js
+  {
+    purpose: 'basicAds',
+    enforcePurpose: true,
+    enforceVendor: true,
+    softVendorExceptions: ['trustedServer'],
+  }
+  ```
+
+  With it, `trustedServer` still needs Purpose 2 consent and skips only the
+  vendor check. For EIDs, Purpose 2 is then the only purpose that qualifies
+  `trustedServer`, because the soft exception sits on that purpose's rule
+  alone (`:295-307`, `:301`). `vendorExceptions` skips the purpose check too
+  and is not recommended.
+
+- A publisher that sets `eidsRequireP4Consent` makes the EID check use the
+  `personalizedAds` rule alone (`:310-314`). That rule needs the same full
+  form, with `enforcePurpose: true`, `enforceVendor: true` and
+  `softVendorExceptions: ['trustedServer']`. Without it `trustedServer` gets
+  bid requests with no EIDs, and the listener (4.3) clears `ts-eids` after
+  every auction.
+
+- After each auction Prebid reports what it blocked in the `tcf2Enforcement`
+  event (`biddersBlocked`, `eidsBlocked`, `:319-336`). The event fires on
+  `AUCTION_END`, which Prebid emits before it calls `bidsBackHandler`
+  (`src/auction.ts:257-264`).
+
+## 4. Architecture
+
+### 4.1 Overview
+
+```mermaid
+flowchart LR
+  subgraph Browser["Browser: tsjs-prebid shim"]
+    P["Prebid bidderRequest.ortb2<br/>for trustedServer"]
+    C["eids.ts collectBidderEids<br/>plain-data copy, 64 KiB UTF-8 budget"]
+    W["eids.ts cookie writer<br/>no EID ext, 3 KB, UTF-8 base64"]
+    T["tcf2Enforcement listener:<br/>clear on block"]
+    P --> C --> W
+  end
+  C -- "POST /auction body.eids" --> R
+  W -- "ts-eids cookie" --> K
+  subgraph Edge["trusted-server-core"]
+    R["AdRequest.eids<br/>raw JSON"]
+    K["ts-eids decode"]
+    N["ec::client_eids<br/>parse_client_eids, per entry"]
+    SEL["/auction: body, else cookie<br/>other routes: cookie"]
+    KV[("KV identity graph")]
+    M["merge_auction_eids<br/>browser entries as sent,<br/>KV fills absent sources"]
+    G["consent gate"]
+    O["providers: user.ext.eids<br/>and x-ts-eids header"]
+    I["collect_eid_updates<br/>/auction: its client set only;<br/>other routes: cookie; then sharedId"]
+    R --> N
+    K --> N
+    N --> SEL --> M --> G --> O
+    KV --> M
+    SEL --> I --> KV
+  end
+```
+
+| Component                                                | Owns                                                                                                   | Does not own                                        |
+| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | --------------------------------------------------- |
+| Browser collector, new `integrations/prebid/eids.ts`     | Reading `bidderRequest.ortb2`, the plain-data copy, the size budget, cookie fitting and encoding       | Scoping and redaction (Prebid's), validation, merge |
+| Adapter glue, `integrations/prebid/index.ts`             | Calling the collector and the cookie writer in `buildRequests`, the TCF listener; no `userSync` writes |                                                     |
+| Server parser, new `ec/client_eids.rs`                   | Isolating and validating each body or cookie entry into `Eid`                                          | Merging, consent                                    |
+| Merge, `merge_auction_eids`                              | Browser entries as sent, plus KV entries for absent registered sources                                 | Parsing                                             |
+| KV ingestion, `collect_eid_updates` and `ec/finalize.rs` | Choosing the input set, matching partners                                                              | KV write policy (`ec/kv.rs`, unchanged)             |
+| Bidstream, `openrtb::Eid`                                | Serializing the new fields for every provider and for `x-ts-eids`                                      |                                                     |
+
+### 4.2 Browser: collection
+
+`integrations/prebid/eids.ts` holds pure functions, testable without mocking
+`pbjs`:
+
+```ts
+export function collectBidderEids(bidderRequest: unknown): unknown[] | undefined
+```
+
+1. It reads `bidderRequest.ortb2.user.ext.eids`, then
+   `bidderRequest.ortb2.user.eids`. Any shape other than an array contributes
+   nothing. Reading `user.eids` is required, not defensive: RTD modules write
+   after normalization, and 51Degrees writes there (3.5). Prebid redacts both
+   paths for the bidder (3.2 step 4), so reading both does not widen what
+   `trustedServer` receives.
+2. It copies each entry through a JSON round trip, so the body holds plain data
+   and `undefined` fields (openPair) disappear. An entry whose serialization
+   throws, such as a circular object or a `BigInt`, is dropped. Without this a
+   single such entry would make the whole body's `JSON.stringify` throw.
+3. It keeps entries in order while the total size of their serializations,
+   measured in UTF-8 bytes with `TextEncoder`, stays within
+   `MAX_AUCTION_EIDS_BYTES = 65,536`, and drops the rest. JavaScript string
+   length is not used: one UTF-16 code unit can be three UTF-8 bytes. The body
+   limit is 256 KiB (`auction/endpoints.rs:46`); realistic EID sets are a few
+   KB. This budget is what keeps EIDs from failing the request through size
+   (G5).
+4. It returns `undefined` when nothing is left.
+
+It does no other validation. The server validates every entry, from the body
+and the cookie alike (4.4), and a browser-side copy of the rules would only
+drift. Lone surrogates are forwarded as `JSON.stringify` writes them; the
+server drops that entry.
+
+The collector never reads `getUserIdsAsEids()`, the `ortb2` config or bidder
+config, and entries are not merged in the browser. Everything `trustedServer`
+may receive is already in its bidder request, scoped and redacted by Prebid.
+
+`buildRequests(validBidRequests, bidderRequest)`:
+
+1. If `bidderRequest` is not an object, it sends no `eids` and leaves the
+   cookie alone, with a debug log. Prebid 10 and 11 always pass it.
+2. `eids = collectBidderEids(bidderRequest)`.
+3. If `eids` is `undefined`, it clears `ts-eids`. Otherwise it writes `ts-eids`
+   from `eids` (4.3). Both happen synchronously, before Prebid sends the
+   request, so the server never falls back to a stale cookie for this request.
+4. It passes `eids` to `buildAdRequest`, as today.
+5. It logs counts at debug level: entries forwarded, dropped as
+   unserializable, dropped for the budget, and the cookie decision. Never
+   values.
+
+Nothing reads `bidderRequest.auctionId`. Deleted from the shim:
+`collectAuctionEids` (`index.ts:1891-1914`), `sanitizeAuctionUid`
+(`:1076-1101`), the userId-module condition on the clear (`:2362-2364`),
+`syncPrebidEidsCookie` (`:2982-3009`) and its call in the chained
+`bidsBackHandler` (`:2537-2541`). `AuctionEid` in `src/core/auction.ts:30-33`
+becomes `unknown`, since the server defines the contract.
+
+### 4.3 Browser: the `ts-eids` cookie
+
+- **When.** Written or cleared in every `buildRequests`, before the request
+  (4.2). Auctions whose ad units do not include `trustedServer` never call it,
+  so they leave the cookie as it is.
+- **Content.** The collected entries, each without its EID-level `ext`. Entries
+  that become identical after the removal are dropped, compared by a
+  serialization with sorted keys.
+- **Size.** Fitted to 3,072 encoded bytes with today's tail trim
+  (`index.ts:2925-2954`): drop UIDs from the last entry, then the entry
+  itself, and repeat. The collector does not validate, so the last entry may
+  be `null`, a string, or an object without a `uids` array; such an entry is
+  removed whole.
+- **Encoding.** Base64 (standard alphabet, padded) of the UTF-8 bytes of the
+  JSON array, via `TextEncoder`. For ASCII payloads this matches today's
+  `btoa` output, and it no longer throws on characters above U+00FF.
+- **Failure.** If nothing fits or encoding throws, the cookie is cleared
+  rather than left stale.
+- **Attributes** are unchanged: `Path=/; Secure; SameSite=Lax; Max-Age=86400`.
+- **Overlapping auctions.** The last `buildRequests` wins. Every value is one
+  complete `trustedServer` request's set.
+- **TCF block (O9).** A `pbjs.onEvent('tcf2Enforcement')` listener, registered
+  at install, clears `ts-eids` when `biddersBlocked` or `eidsBlocked` contains
+  `trustedServer`. A blocked bidder never reaches `buildRequests`, so without
+  the listener a cookie written before consent changed would live for a day.
+- **Storage consent.** Where the bidder request's `gdprConsent` says GDPR
+  applies, `buildRequests` writes the cookie only with TCF Purpose 1 and
+  Purpose 4 consent in `vendorData.purpose.consents`. That is the server's
+  rule for using or storing these EIDs (`allows_eid_persistence`,
+  `gate_eids_by_consent`), so the cookie never holds IDs no server path would
+  read. Otherwise, including GDPR data without a purpose record, it clears
+  the cookie and still forwards the EIDs in the body. Forwarding follows
+  Prebid's `transmitEids` decision, which any purpose from 2 to 10 satisfies,
+  so it establishes neither purpose. The check applies only when
+  `gdprApplies` is `true`: many CMPs answer outside the EU with
+  `gdprApplies: false` and an empty purpose record, and the server keeps
+  using browser EIDs for that traffic.
+- **Why no EID-level `ext`.** It carries vendor data such as LiveIntent
+  `segments` and oneKey `preferences`, which should not persist for a day in a
+  script-readable cookie or reach body-less routes. A few hundred bytes of it
+  would also push whole sources out of 3,072 bytes and reduce KV ingestion.
+  Today's cookie has no EID-level `ext` either. The `/auction` body keeps it.
+
+### 4.4 Server: one parser for body and cookie
+
+`crates/trusted-server-core/src/ec/client_eids.rs`, new:
+
+```rust
+/// Parses and validates browser-supplied EID entries from an `/auction` body
+/// or a `ts-eids` cookie.
+pub(crate) fn parse_client_eids(raw: &RawValue) -> Vec<Eid>
+```
+
+1. It parses `raw` as `Vec<Box<RawValue>>`. Anything other than an array
+   yields no entries.
+2. It parses each element into a `serde_json::Value` on its own. An element
+   that fails, such as one holding a lone surrogate, is dropped.
+3. It applies the rules below to each entry.
+4. It drops entries equal to an earlier kept entry, comparing the validated
+   `Eid` values (`ext` compared as serde_json values).
+5. It keeps the first 64 remaining entries, so a duplicate never takes a
+   place.
+
+Callers:
+
+- **Body.** `AdRequest.eids` becomes `Option<Box<RawValue>>`
+  (`auction/formats.rs:46`), which needs serde_json's `raw_value` feature
+  (`Cargo.toml:105`). serde_json does not validate escapes while capturing a
+  raw value (`src/read.rs:1025-1040`), so a lone surrogate inside `eids` no
+  longer fails the body parse. `AdRequest` has no `flatten` or untagged enum,
+  which would break raw capture. `/auction` still treats an empty result as
+  absent.
+- **Cookie.** The legacy flattened branch is still tried first
+  (`ec/prebid_eids.rs:90-92`). It now drops an entry whose `id` is blank or
+  longer than `MAX_UID_LENGTH`, or whose `source` is blank, the parser's UID
+  and blank-source rules, because the merge (4.5) lets any browser entry
+  displace KV's entry for its source. The structured branch base64-decodes the value,
+  captures it with `serde_json::from_slice::<Box<RawValue>>`, and calls
+  `parse_client_eids`. A mistyped field or a bad entry now costs only itself;
+  previously it rejected the whole cookie. The body's caps now apply to the
+  cookie too.
+- **Admin diagnostics** keep reporting raw sources and raw UID strings from the
+  decoded JSON, so `/_ts/admin/eids` can still say "no valid UID" for a
+  configured source (`ec/admin.rs:577-660`).
+
+| Field                 | Rule                                                        | On violation                  | Status                                               |
+| --------------------- | ----------------------------------------------------------- | ----------------------------- | ---------------------------------------------------- |
+| entry                 | parses on its own, JSON object                              | entry dropped                 | parse isolation new                                  |
+| `source`              | string, not blank, at most 255 UTF-8 bytes                  | entry dropped                 | existing (body); new for cookie                      |
+| `uids`                | array with at least one valid UID; first 32 valid UIDs kept | entry dropped when none valid | existing (body); new for cookie                      |
+| `uids[].id`           | string, not blank, at most 512 bytes                        | UID dropped                   | existing (body); new for cookie                      |
+| `uids[].atype`        | integer from 0 to 2,147,483,647                             | field dropped                 | existing; integral floats such as `1.0` now accepted |
+| `uids[].ext`          | JSON object, at most 2,048 bytes as compact JSON            | field dropped                 | cap new                                              |
+| `inserter`, `matcher` | string, not blank, at most 255 bytes                        | field dropped                 | new                                                  |
+| `mm`                  | integer from 0 to 2,147,483,647                             | field dropped                 | new                                                  |
+| `ext` (EID level)     | JSON object, at most 2,048 bytes as compact JSON            | field dropped                 | new                                                  |
+| duplicates            | equal to an earlier kept entry                              | dropped, before the cap below | new                                                  |
+| array                 | first 64 remaining entries kept                             | rest dropped                  | existing (body); new for cookie                      |
+| unknown keys          | ignored                                                     |                               | existing                                             |
+| order                 | preserved; a source may repeat                              |                               | existing                                             |
+
+- **Blank** means empty or only whitespace by `str::trim`, as the body parser
+  checks today (`auction/endpoints.rs:510`). Text is kept as supplied.
+- **Integer** means a JSON number with no fractional part, so `4`, `4.0` and
+  `4e0` are the same value, as they are in the browser.
+- A blank `matcher` is dropped. OpenRTB 2.6 treats an absent `matcher` as equal
+  to `source`, so nothing is lost.
+- `mm` is not checked against AdCOM's list. Vendor values from 500 up are
+  valid, and other integers are passed through.
+- The limits move here from `auction/endpoints.rs:38-40`, with
+  `MAX_CLIENT_EID_EXT_BYTES = 2048` added.
+- Each dropped entry or field logs at debug level with the field name and
+  source, never the value.
+- `ec_context.set_client_eids` (`auction/endpoints.rs:304-306`) still carries
+  the `/auction` client set to finalization.
+- The `raw_value` feature has one workspace-wide effect: a JSON object whose
+  first key is `"$serde_json::private::RawValue"` is read back as raw JSON
+  (`src/value/de.rs:131-135`). No real payload uses that key.
+- The new module is added to the Fastly-SDK guard list in
+  `migration_guards.rs`.
+
+`Eid` (`openrtb.rs:67-75`) gains `inserter: Option<String>`,
+`matcher: Option<String>`, `mm: Option<i32>` and `ext: Option<Value>`, each with
+`#[serde(default, skip_serializing_if = "Option::is_none")]`.
+`deny_unknown_fields` stays. A constructor that leaves the new fields empty
+replaces the 26 existing struct literals in 9 files, all of which build EIDs
+that never carry these fields.
+
+### 4.5 Merge
+
+The client set is the body, else the cookie, on `/auction`, and the cookie on
+the navigation auction and `/_ts/page-bids`.
+
+| Concern                        | Rule                                                                                                                                                                                                                  | Status                     |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
+| Precondition for client EIDs   | EC present and allowed (`ec_id.is_some()`)                                                                                                                                                                            | Unchanged                  |
+| Browser entries                | Forwarded as parsed (4.4), in wire order, never altered or combined                                                                                                                                                   | New; were folded by source |
+| KV-resolved EIDs               | Appended after the browser entries, one per registered source that no browser entry carries. Sources are compared as the partner registry normalizes them: lowercase, trailing dot removed (`ec/registry.rs:219-221`) | New; were listed first     |
+| KV values for a browser source | Not used. The browser's UIDs, `atype` and `ext` go out unchanged                                                                                                                                                      | New; KV used to win (D9)   |
+| KV entry fields                | No EID-level fields                                                                                                                                                                                                   | Unchanged                  |
+| Entry with no UIDs             | Dropped                                                                                                                                                                                                               | Unchanged                  |
+| Consent                        | `gate_eids_by_consent` on the merged set (TCF Purposes 1 and 4)                                                                                                                                                       | Unchanged                  |
+
+Examples, where `S` is `ids.example.com`, `T` is `other.example.com`, and `F1`
+and `F2` are different sets of EID-level fields:
+
+| Case | Inputs                                                         | Output entries                |
+| ---- | -------------------------------------------------------------- | ----------------------------- |
+| 1    | Browser `S F1 [u1]`                                            | `S F1 [u1]`                   |
+| 2    | KV `S [u1]` with `atype` 3; browser `S F1 [u1]` with `atype` 1 | `S F1 [u1]` with `atype` 1    |
+| 3    | KV `S [u0]`; browser `S F1 [u1]`                               | `S F1 [u1]`                   |
+| 4    | KV `T [t1]`; browser `S [u1]`                                  | `S [u1]`, then `T [t1]`       |
+| 5    | Browser `S F1 [u1]`, then `S F2 [u1]`                          | `S F1 [u1]`, then `S F2 [u1]` |
+| 6    | KV `S [u0]`; browser `IDS.Example.com [u1]`                    | `IDS.Example.com [u1]`        |
+| 7    | KV `S [u0]`, `T [t1]`; no browser EIDs                         | `S [u0]`, then `T [t1]`       |
+
+Why:
+
+- The browser entries are exactly what Prebid sends every client adapter.
+  Prebid does not group `ortb2` entries, and its Prebid Server adapter sends
+  repeated sources (3.5). Current Prebid Server does not require unique
+  sources: `validateEIDs` only removes entries with an empty source and UIDs
+  with an empty id
+  ([source](https://raw.githubusercontent.com/prebid/prebid-server/master/endpoints/openrtb2/auction.go)). <!-- allow-domain: raw.githubusercontent.com -->
+- KV is the staler copy for a source the browser sends (D9). Keeping the two
+  kinds of data in separate entries means fields are never mixed.
+- Section 8.3 adds a staging check that each deployed provider accepts
+  repeated sources and the new fields.
+
+### 4.6 KV ingestion
+
+- **Input.** Both finalization branches, for a returning EC
+  (`ec/finalize.rs:84-94`) and a newly generated one (`:132-150`), choose the
+  browser input by `ec_context.eid_sync_source()`. The Fastly adapter sets it
+  to `EidSyncSource::Auction` before `handle_auction`
+  (`trusted-server-adapter-fastly/src/app.rs:673`).
+  - `Auction`: only the request's client set (`ec_context.client_eids()`: the
+    body, else the cookie). When `/auction` sets none, as on the
+    auction-disabled early return (`auction/endpoints.rs:184-215`), nothing
+    from `ts-eids` is ingested.
+  - Any other source, or none: the `ts-eids` cookie. That covers navigation,
+    `/_ts/page-bids`, and new ECs generated on integration-proxy navigations,
+    which set no source (`integrations/registry.rs:1047-1050`).
+  - On every route: the `sharedId` cookie last, as today.
+  - Without usable consent, finalization returns before any ingestion
+    (`ec/finalize.rs:63-77`, `:446-457`), as today.
+- **Why.** Today a cookie from an earlier page, possibly written by older TSJS
+  with restricted IDs, is ingested next to a scoped body, though the auction
+  itself ignores the cookie when the body is present. After the change KV on
+  `/auction` sees exactly what the auction forwarded.
+- **Unchanged.** One UID per partner (the first valid UID; with repeated
+  sources the later entry wins, as `dedupe_partner_updates` does today), only
+  sources registered as `[[ec.partners]] source_domain`, the consent gate
+  (`gate_eid_updates_by_consent`), the fill-absent write rule
+  (`ec/kv.rs:145-155`, `:560-600`), and nothing new stored. Ingestion reads the
+  client set directly, not the merged output.
+- **Write frequency.** A browser-sourced write happens only when KV holds no
+  UID for that partner; a different existing value is deferred, never
+  overwritten. So each registered partner is written about once per EC, on the
+  first response that carries it.
+- **Where it runs.** Only adapters that call `ec_finalize_response` ingest.
+  That is the Fastly adapter today (`trusted-server-adapter-fastly/src/main.rs:606`).
+- **#1246.** Lockr's `id5-sync.com` entry reaches the body and the cookie
+  (4.2, 4.3). With a matching `[[ec.partners]]` entry and EC consent,
+  finalization writes it to KV when KV holds no ID5 UID for that EC. Where TCF
+  enforcement is active and GDPR applies, this needs the publisher exception
+  in 3.7.
+
+### 4.7 Bidstream output and `x-ts-eids`
+
+- `Eid` serialization adds the new fields when present. All three outbound
+  paths (3.4) share the type and need no further change.
+- Serializing a given EID set without the new fields is byte-identical to
+  today. The golden requests in `integrations/prebid.rs:9994`, `:10033` and
+  `integrations/aps.rs:2400` must not change. The merge itself does change
+  output when browser and KV EIDs mix (4.5, 8.2).
+- A source can now appear in more than one entry (4.5).
+- Whether Prebid Server and APS act on `inserter`, `matcher` and `mm` under
+  `user.ext.eids` is unknown. The keys are additive. A reader that does not
+  know them ignores them, unless it rejects unknown fields; the staging check
+  (8.3) covers that.
+- **`x-ts-eids` stays (G7).** The `/auction` response carries the
+  consent-gated outbound set as base64 JSON (`auction/formats.rs:536-548`),
+  now including EID-level fields, so it shows exactly what each provider
+  received. It reaches its 4,096-byte cap (`ec/eids.rs:17`, `:104-140`) sooner
+  and sets `x-ts-eids-truncated` as today. TS lists it among internal headers
+  (`constants.rs:67-71`). The live check reads it (7.6).
+
+### 4.8 Privacy model
+
+By construction:
+
+- The browser's only input is `bidderRequest.ortb2` for `trustedServer`. Prebid
+  built it from global data, `trustedServer`'s own fragment and the module EIDs
+  `trustedServer` may receive, then applied whichever filters in 3.5 the bundle
+  contains. Generated bundles contain the consent modules and `tcfControl` but
+  no US-state activity controls (`docs/guide/integrations/prebid.md:820-823`),
+  so US-state opt-outs stay enforced by the server gate below, as today.
+- Where TCF enforcement is active and GDPR applies, `trustedServer` gets no bid
+  request and no EIDs without a publisher exception (3.7), and the cookie is
+  cleared (4.3). Nothing falls back to `getUserIdsAsEids()`.
+- The cookie holds only the latest `trustedServer` request's set, minus
+  EID-level `ext`.
+- KV ingestion on `/auction` uses only the auction's own client set (4.6).
+- Server-side bidders folded into `trustedServer` (`index.ts:2392-2480`): IDs a
+  publisher restricts to such a bidder, through `userIds[].bidders` or
+  `setBidderConfig`, land in that bidder's fragment, which `trustedServer`
+  never sees. They are no longer forwarded at all. Today `getUserIdsAsEids()`
+  forwards them to every provider. Per-bidder forwarding through Prebid Server
+  `eidpermissions` is a follow-up (8.5).
+
+Never forwarded or persisted **from the browser**:
+
+- EIDs from `userIds[]` entries restricted to other bidders.
+- Other bidders' `setBidderConfig` data.
+- EIDs Prebid redacted for `trustedServer`.
+- UID values in logs or metrics. Logs carry source names and counts only.
+
+Server gates, unchanged:
+
+- Client EIDs are used only with an allowed EC (US opt-out and GPC included).
+- `gate_eids_by_consent` strips bidstream EIDs without TCF Purposes 1 and 4.
+- KV writes go through `gate_eid_updates_by_consent`.
+
+Residual exposure:
+
+1. **The cookie outlives the page.** It is a script-readable, one-day copy of
+   the latest `trustedServer` set. Body-less routes on later pages forward it
+   before Prebid runs there. The server re-checks only the EC and TCF purposes,
+   so a later change in Prebid's other decisions (bidder restrictions,
+   per-vendor consent, browser US-state rules) applies only once the next
+   `trustedServer` request rewrites or clears it. Accepted to keep browser IDs
+   on body-less routes (O1).
+2. **The cookie now holds `ortb2` EIDs, gated on Purposes 1 and 4 but not
+   on a vendor.** IDs any vendor or the publisher put into Prebid's `ortb2` for
+   `trustedServer`, and their provenance fields, now persist in it. Today it
+   holds only User ID module output, which passed Prebid's Purpose 1
+   `enrichEids` rule (`modules/tcfControl.ts:285`). An `ortb2` EID needs only
+   what `transmitEids` requires for `trustedServer`: under TCF, a purpose from
+   2 to 10 with vendor consent or a soft exception. The shim therefore checks
+   Purposes 1 and 4 itself before storing, as the server does before using
+   the cookie (4.3). It cannot check vendor consent,
+   because `trustedServer` has no GVL ID; that waits for TS's TCF identity
+   (8.5).
+3. **`x-ts-eids` is visible to the page.** The `/auction` response shows the
+   consent-gated outbound set, including KV-only partner IDs. Any page script
+   that wraps `fetch` can read it. Kept for troubleshooting (G7).
+4. **KV fills sources Prebid withheld.** KV adds every registered source the
+   browser did not send, including sources Prebid withheld from
+   `trustedServer` (restricted, redacted by `transmitEids`, vendor-denied). The
+   server gate checks purposes only. Unchanged from today, where KV EIDs are
+   always added.
+5. A cookie written by older TSJS may hold restricted IDs until the next
+   `trustedServer` request rewrites or clears it.
+6. IDs that older TSJS already ingested into KV stay there. KV forwarding of a
+   registered partner follows operator config (`bidstream_enabled`).
+7. `sharedId` cookie ingestion ignores Prebid restrictions, as today (O10).
+
+Validation only ever drops data, so it cannot widen what is forwarded.
+
+### 4.9 Timing model
+
+| Where the ID comes from                                                      | Present in `bidderRequest.ortb2`                | In the first auction?                                                                                      |
+| ---------------------------------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| User ID module with a stored value (sharedId, stored TDID)                   | At module initialization                        | Yes                                                                                                        |
+| User ID module that calls its vendor (criteo, LiveIntent, ID5, identityLink) | When its callback resolves                      | Only if calls started at init (`auctionDelay > 0`) and resolved within `auctionDelay`                      |
+| `setConfig` / `mergeConfig({ortb2})`, `setBidderConfig`                      | From the next `requestBids` after the call      | Only if called before the first `requestBids`                                                              |
+| `requestBids({ortb2})`                                                       | That auction only                               | Yes, for that auction                                                                                      |
+| RTD module                                                                   | Each auction, within the RTD module's own delay | Per RTD config                                                                                             |
+| Vendor writing `ortb2` after its own network call (Lockr)                    | From the next auction after the write           | Usually not. After its first `/auction`, a registered partner reaches later requests via the cookie and KV |
+
+**Change: delete `installUserIdModules()`** (`index.ts:2881-2898`) and its
+load hook (`index.ts:3020-3033`). TS then writes no `userSync` values other
+than managed `userIds` and, on a late seed, `autoRefresh`. Managed seeding
+still builds its config from the effective `userSync` (`index.ts:2238-2256`)
+and adds its entries, which carries the publisher's values or Prebid's
+defaults through unchanged. The late seed's `autoRefresh: true`
+(`index.ts:2248-2256`) stays: it is what initializes managed modules added
+after Prebid's first pass. Because `userSync` settings accumulate, it remains
+`true` for the rest of the page even though the code means to restore the
+publisher's policy. That is unchanged by this work and listed in 8.2 and 8.5.
+
+Effects:
+
+- The userId module runs with the publisher's `auctionDelay`, or Prebid's
+  500 ms default (`src/userSync.ts:59-70`), whenever it initializes, including
+  after `window.load`. Vendor calls start at initialization, and each auction
+  waits up to that delay, but only while IDs are pending. Once all modules
+  settle, later auctions do not wait. A module that never settles makes every
+  auction wait the full delay; that is Prebid's behavior for any publisher.
+- Auctions after `window.load`, such as refreshes and lazy-loaded units, wait
+  for pending IDs again instead of running with `0`.
+- TS no longer overwrites the publisher's `syncEnabled`, `filterSettings`,
+  `syncsPerBidder` or `syncDelay`. It no longer force-enables iframe user syncs
+  for every bidder; Prebid's default allows image syncs only.
+- No new configuration. Publishers tune `auctionDelay` and syncs in their own
+  Prebid config, where every other Prebid setting lives.
+
+D4's cause on the live page is likely, not proven. The timing arm in 7.5
+proves the mechanism: it must fail against `main` and pass with the change,
+next to a control arm that passes on both. The live check (7.6, steps 1 and 2)
+decides whether it was the live cause. If `main`'s first auction there already
+ran with a delay above 0 when the module initialized, the report says that D4
+on that page had another cause, instead of claiming a fix.
+
+### 4.10 Configuration
+
+None added, changed or removed. `MAX_AUCTION_EIDS_BYTES` (TSJS) and the server
+limits (4.4) are constants, not operator settings. `openrtb_atype` now applies
+only where KV supplies a source the browser did not send (4.5).
+
+### 4.11 Failure modes
+
+| Condition                                                   | Behavior                                                                                                                                                              |
+| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `bidderRequest` missing or not an object                    | No `eids` in the body, cookie unchanged, debug log                                                                                                                    |
+| `ortb2.user.ext.eids` and `user.eids` absent or not arrays  | No `eids` in the body; cookie cleared before the request                                                                                                              |
+| An entry that cannot be serialized in the browser           | Entry dropped in TSJS                                                                                                                                                 |
+| EIDs over 64 KiB as UTF-8                                   | Later entries dropped in TSJS                                                                                                                                         |
+| Cookie payload does not fit or cannot be encoded            | Cookie cleared                                                                                                                                                        |
+| An entry that does not parse on the server (lone surrogate) | Entry dropped, in body or cookie; the request proceeds                                                                                                                |
+| `eids` or the cookie JSON not an array                      | No client EIDs from it; the request proceeds                                                                                                                          |
+| Malformed entry or field, in body or cookie                 | Entry or field dropped, others kept                                                                                                                                   |
+| More than 64 entries or 32 UIDs                             | First 64 entries and first 32 UIDs kept                                                                                                                               |
+| `ts-eids` undecodable or over 8 KiB                         | Ignored, as today                                                                                                                                                     |
+| Lone surrogate outside `eids`                               | Request rejected, as today (non-goal)                                                                                                                                 |
+| `/auction` body over 256 KiB                                | Rejected, as today. EIDs alone cannot cause it                                                                                                                        |
+| userId module not bundled                                   | No effect on collection; `ortb2` EIDs still flow and are written to the cookie                                                                                        |
+| External bundle failed to load                              | `installPrebidNpm` bails out as today (`index.ts:1994-2000`); no adapter, no EIDs, cookie unchanged                                                                   |
+| External bundle with a baked-in old shim                    | The old shim runs: it sends `{source, uids}` from `getUserIdsAsEids()` and writes the cookie from it, both parsed by the new parser. Fixed by regenerating the bundle |
+| Prebid's TCF rules block `trustedServer` bids               | No `/auction` from the adapter; the listener clears the cookie; body-less routes get KV EIDs only                                                                     |
+| Prebid's TCF rules block only `trustedServer`'s EIDs        | `/auction` is sent without EIDs; the cookie is cleared before it and by the listener                                                                                  |
+| KV unavailable                                              | Client EIDs still reach the auction; KV EIDs and ingestion skipped, as today                                                                                          |
+| Consent denied                                              | Client EIDs unused without an allowed EC; bidstream EIDs stripped without TCF Purposes 1 and 4; KV writes gated                                                       |
+| A User ID module never settles                              | Each auction waits the full `auctionDelay`, as in Prebid without TS                                                                                                   |
+| A provider rejects repeated sources or the new fields       | That provider's request fails. Caught by the staging check before rollout (8.3)                                                                                       |
+
+### 4.12 Observability
+
+- TSJS, debug level, in `buildRequests`: entries forwarded, dropped as
+  unserializable, dropped for the budget, and the cookie decision (written,
+  trimmed, cleared). Never values. The existing trim log stays.
+- TSJS, debug level: the cookie cleared for a TCF block.
+- Rust, debug level: each dropped entry or field, with field name and source.
+- `x-ts-eids` on the `/auction` response shows the consent-gated outbound set,
+  EID-level fields included (4.7).
+- `/_ts/admin/eids` serializes `Eid`, so the cookie's new fields appear in its
+  output without code changes, alongside the raw diagnostics.
+- Auction telemetry is unchanged.
+
+### 4.13 Adapters
+
+All four adapters (Fastly, Cloudflare, Spin, Axum) route `/auction`,
+`/_ts/page-bids`, publisher auctions and `/_ts/admin/eids` into
+`trusted-server-core`, where parsing, merging and output live. The Fastly
+adapter keeps reading the raw `ts-eids` cookie before routing (`app.rs:420`,
+`:740`) and passing it as a string to `ec_finalize_response` (`main.rs:606`).
+No adapter code changes. Doc comments that describe the old writer or the old
+ingestion order, such as `collect_eid_updates`'s (`ec/prebid_eids.rs:130-137`),
+are updated. Nothing new reads the clock, so the Wasm clock lint is
+unaffected. The parity test proves routing on all four adapters; EID handling
+is covered by core and Fastly adapter tests (7.4).
+
+## 5. Alternatives considered
+
+1. **Keep `getUserIdsAsEids()` and filter by `userIds[].bidders` in TSJS.**
+   Rejected. It reimplements Prebid's scoping, misses `setBidderConfig`,
+   per-call `ortb2`, RTD output and every activity filter in 3.5, and breaks
+   when Prebid changes `idPriority` or restriction logic.
+2. **Merge the `ortb2` config with `getUserIdsAsEids()` (the staged
+   `fix/1246` attempt).** Rejected. It keeps D1, bypasses redaction and bidder
+   data, and duplicates what `bidderRequest.ortb2` already holds.
+3. **Read EIDs from Prebid events such as `bidRequested`.** Rejected. Events
+   fire after the request is built, so they cannot feed it.
+4. **A TS Prebid hook or module reading `ortb2Fragments`.** Rejected. That data
+   is pre-redaction, so TS would have to reimplement activity controls.
+5. **Delete `ts-eids` (the design pass's recommendation).** Rejected by the
+   author. The product needs IDs in a first-party cookie as well as KV, with
+   the cookie read first for speed, and browser IDs on body-less routes.
+6. **A server-written, `HttpOnly`, short-lived cookie set from `/auction`.**
+   Deferred. It would remove the script exposure and shorten the stale window
+   (4.8, residual 1). It fits server-side ID provider work, which would also
+   write the cookie from the server.
+7. **Write the cookie in `bidsBackHandler`, keyed by auction (an earlier
+   draft).** Rejected. Prebid hides `auctionId` from adapters by default
+   (D5), so the copy would never be written.
+8. **A per-EC KV snapshot of the last client set.** Rejected. A write per
+   auction contends with ingestion and pull-sync writes on the same row or
+   costs another read, is eventually consistent across POPs, and stores
+   unregistered sources server-side.
+9. **Validate in both TSJS and Rust under a shared fixture (an earlier
+   draft).** Rejected. The server validates both transports anyway, and two
+   implementations disagree on numbers, whitespace and equality.
+10. **A TSJS-only lone-surrogate rule (an earlier draft).** Rejected. It does
+    not protect against old TSJS, baked-in shims or other clients. Isolating
+    entries on the server does.
+11. **Group by source and EID-level fields, union KV UIDs and let KV's `atype`
+    win (an earlier draft).** Rejected. KV is the staler copy (D9), and the
+    union mixes two kinds of data in one entry.
+12. **One entry per source.** Rejected. It drops or misattributes provenance:
+    51Degrees splits `51d.es` by `mm`, and several sources come from more than
+    one module (3.5).
+13. **An operator `user_id_auction_delay_ms` applied through `setConfig` and
+    `mergeConfig` wrappers (an earlier draft).** Rejected. TS's own override
+    is the likely cause of D4, and deleting it is simpler than managing it.
+14. **Register `trustedServer` as `VENDORLESS_GVLID` in this work.** Deferred
+    to its own spec. It moves the vendor check for TS-routed vendors out of
+    Prebid, so it needs a server-side per-provider vendor check and legal
+    review first. Prebid's EID check also never passes for a vendorless module
+    without a soft exception (`modules/tcfControl.ts:295-307`), which needs an
+    upstream fix.
+15. **When TCF blocks `trustedServer`, write the cookie from
+    `getUserIdsAsEids()` as today.** Rejected. It forwards exactly the EIDs
+    Prebid's consent rules withheld.
+16. **When TCF blocks `trustedServer`, leave the cookie unchanged.** Rejected.
+    A cookie written before consent changed would live for its full day.
+17. **Bump to Prebid 11 in this work.** Rejected. 11.43 is a pre-release, and
+    the EID pipeline, `auctionDelay` handling and `getUserIdsAsEids()` are the
+    same (3.5).
+18. **A `tsjs.addEids` API and server-side vendor cookie reads.** Deferred.
+    They have their own contracts and are not needed for #1246.
+
+## 6. Decisions
+
+| #   | Decision                                                                                                                                                                                     | Reason                                                                                                                                                             |
+| --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| O1  | Keep `ts-eids` as a browser-written copy of the `/auction` body set, minus EID-level `ext`, written or cleared in `buildRequests` (4.3)                                                      | Product requirement: IDs in a first-party cookie and KV, cookie read first. Writing in `buildRequests` needs no auction key and copies exactly what was sent       |
+| O2  | Validate on the server only, with one parser that isolates each entry of the body or the cookie (4.4). TSJS forwards Prebid's arrays as plain-data copies within a 64 KiB UTF-8 budget (4.2) | One implementation. A bad entry costs only itself, whichever client or transport sent it                                                                           |
+| O3  | Forward browser entries as sent; KV adds entries only for registered sources the browser did not send (4.5)                                                                                  | Fidelity to what Prebid sends; KV is the staler copy (D9); no mixed fields. Guarded by the staging check (8.3)                                                     |
+| O4  | The staged `fix/1246` work in the main checkout is superseded and not committed                                                                                                              | It reads `getUserIdsAsEids()` and the `ortb2` config, so it keeps D1                                                                                               |
+| O5  | Fix D4 by deleting `installUserIdModules()`; no new config (4.9)                                                                                                                             | TS's own `auctionDelay: 0` is the likely cause. Prebid's and the publisher's settings already cover the need                                                       |
+| O6  | Delete `resolvePrebidUserIdModulesFromEids` and the `eidSources` registry field (D6)                                                                                                         | Only tests read them, and the data cannot be made correct                                                                                                          |
+| O7  | KV ingestion on `/auction` reads only the auction's own client set; other routes read the cookie; `sharedId` as today (4.6)                                                                  | KV must not ingest IDs the auction did not use                                                                                                                     |
+| O8  | Prove D1, D3, D4 and the TCF behavior with real Prebid in the CI suites that load the generated bundle and the shim in JSDOM (7.5). The local Viceroy harness is not landed                  | Those suites already run in CI, so a regression fails every later pull request. Round 2 found a bug only real Prebid shows                                         |
+| O9  | Under TCF, fail closed: clear the cookie on a `tcf2Enforcement` block, never fall back to `getUserIdsAsEids()`, and document the full exception rule (3.7)                                   | TS receives only what Prebid gives `trustedServer`. Granting an exception is the publisher's call, and a partial rule would switch off TCF checks for every bidder |
+| O10 | `sharedId` cookie ingestion stays as is; a follow-up issue covers it (8.5)                                                                                                                   | Author's decision, to keep this change focused. Recorded as residual exposure 7 (4.8)                                                                              |
+
+## 7. Testing strategy
+
+### 7.1 Guarding against false passes
+
+A test that cannot fail proves nothing. Every test this work adds or changes
+follows these rules, and the implementation plan checks each one.
+
+1. **Red first.** Each new test is run against the unchanged code and must
+   fail for the expected reason. A regression net that passes before the change
+   is proven by temporarily reverting the line it guards. The plan records the
+   failing output for every test.
+2. **Absence is paired with presence.** Every assertion that something is
+   missing (a restricted ID, a cookie-only KV source, a canary) sits next to an
+   assertion in the same request, cookie or output that a control value is
+   there. An empty body cannot pass an absence check.
+3. **A canary for D1 in every adapter test.** The hoisted `getUserIdsAsEids`
+   mock (`test/integrations/prebid/index.test.ts:260`) returns a canary entry
+   (`canary.example.com`) for the whole file instead of `[]`. The four
+   describe-level `beforeEach` blocks that reset it to `[]` (`:580-581`,
+   `:3363-3364`, `:4465-4466`, `:7552-7553`) restore the canary instead. The
+   tests that set other values (among them `:2421`-`:2565` and
+   `:3164`-`:3346`) encode the old collector and are deleted or rewritten.
+   - **Capture point.** Tests call `buildRequests` only through a helper that
+     records each returned request body, and the file's `fetch` mock records
+     every body sent to `/auction`.
+   - **Checks.** A shared `afterEach` first asserts that the mock still returns
+     the canary, so a test that switched it off fails. It then fails if the
+     canary appears in any recorded body or in `ts-eids`.
+   - **Non-vacuous.** An `afterAll` asserts that at least one body was
+     recorded, and a positive control asserts once that the mock is the
+     function the shim's `pbjs` exposes.
+4. **Exact equality.** EID payloads are compared whole: `toEqual` in Vitest and
+   full `serde_json::Value` equality in Rust. No `objectContaining`,
+   `toMatchObject`, `.contains()` or length-only checks, which let extra or
+   leaked entries through.
+5. **The cookie environment is checked, not assumed.** jsdom silently drops a
+   `Secure` cookie on a non-HTTPS URL other than `localhost` (verified with the
+   repo's jsdom: kept at `http://localhost:3000/` and `https://example.com/`,
+   dropped at `http://example.com/`). A "cleared" or "unchanged" assertion
+   would then pass without testing anything. Each suite that checks the cookie
+   asserts in `beforeAll` that a cookie written with the shim's attributes
+   reads back, and "cleared" and "unchanged" tests preset the cookie and read
+   it back before acting.
+6. **Prebid's real call shapes.** Unit tests call
+   `buildRequests(validBidRequests, bidderRequest)` with a frozen
+   `bidderRequest.ortb2` and `auctionId: null`, as Prebid's proxy passes it by
+   default (3.2 step 5). No code path or test relies on `auctionId`.
+7. **Inputs whose JSON spelling matters are raw text.** Rust parser tests use
+   raw JSON for `4.0`, `4e0`, `-0`, values just above 2,147,483,647 and above
+   2^53, multibyte text at exactly 255 and 256 bytes, an `ext` at exactly 2,048
+   and 2,049 bytes, 65 entries of which one is a duplicate, and lone surrogate
+   escapes in `source`, `id`, `inserter`, `matcher`, and in the keys and values
+   of EID-level and UID-level `ext`. `json!` cannot express a number's spelling
+   or a lone surrogate, so this is an intended exception to the `AGENTS.md`
+   preference for `json!`.
+8. **Two cross-language fixtures, tested end to end.** In
+   `crates/trusted-server-js/lib/test/fixtures/`:
+   - `auction-body-eids.txt` holds the exact body TSJS produces for a fixed
+     input: one entry with a lone surrogate in a UID `id` between two good
+     entries, one of which has non-Latin-1 text in `inserter` and a UID
+     `ext`. The surrogate sits in a UID `id` because the cookie writer keeps
+     it there; in an EID-level `ext` it would be stripped from the cookie.
+   - `ts-eids-cookie.txt` holds the exact cookie value TSJS writes for the same
+     input.
+
+   The Vitest tests assert that TSJS output equals each file. Rust tests read
+   them with `include_str!` and send each through `handle_auction` with an
+   allowed EC: the body as the request body, the cookie as a `Cookie` header
+   with no body EIDs. Both assert that the good entries reach
+   `auction_request.user.eids` unchanged, the bad entry is dropped, and the
+   request is not rejected. Calling `parse_client_eids` alone would pass even
+   if `AdRequest.eids` stayed a `Value` and the full parse still failed. The
+   `.txt` extension keeps Prettier from rewriting the files (`package.json:15`
+   checks `ts`, `tsx`, `js`, `json`, `css` and `md`). A core test already reads
+   a sibling crate's file this way (`settings.rs:8475`).
+
+9. **Rust literals list every field.** Tests that assert EID-level fields build
+   `Eid` with all fields written out, never `..Default::default()`, so a future
+   field breaks them at compile time instead of defaulting silently.
+10. **Logs are proven, then checked.** Logging tests set debug level, assert the
+    expected log was emitted, then assert no argument contains a UID value.
+11. **KV ingestion is tested in two layers**, because the Fastly adapter's test
+    router cannot observe a KV write: finalization builds a real Fastly store
+    with no injection point, and the test settings have no EC store.
+    - **Adapter layer.** A Fastly adapter test sends a real `Cookie` header and
+      asserts what the response's `EcFinalizeState` carries: the raw
+      `ts-eids` value and the sync source, as `eid_sync_source_of` does
+      (`app.rs:2291-2298`). This proves the adapter's cookie extraction. The
+      client set is left to the core layer, since setting it needs an allowed
+      EC, which no adapter test arranges.
+    - **Core layer.** Core tests drive `ec_finalize_response` with an
+      in-memory KV, as
+      `auction_body_eids_reach_kv_even_when_the_ts_eids_cookie_is_absent`
+      does (`auction/endpoints.rs:807`):
+      - `/auction` with a `ts-eids` cookie holding registered source A and a
+        body holding registered source B ingests B and not A.
+      - `/auction` on the auction-disabled early return, with an allowed EC
+        and the same cookie, ingests nothing from it, while a `sharedId`
+        cookie in the same request is ingested.
+      - A new EC generated with no sync source ingests the cookie's
+        registered source.
+      - A navigation response with that cookie ingests A, which proves the
+        registry matches A.
+12. **Real Prebid backs the mocks.** Vitest unit tests can only check what a
+    mocked `pbjs` receives. The arms in 7.5 run in the JSDOM suites that load
+    the real generated bundle and the real shim and capture `/auction` bodies
+    (`test/prebid-artifact-integration.test.mjs:236-280`,
+    `test/prebid-consent-enforcement.test.mjs`). They run in CI.
+
+### 7.2 TSJS unit (Vitest), `test/integrations/prebid/eids.test.ts`, new
+
+- `collectBidderEids`: `user.ext.eids` only, `user.eids` only, both in that
+  order, neither, non-array shapes, a frozen input, a `bidderRequest` that is
+  not an object.
+- The plain-data copy: `undefined` provenance fields removed; a circular `ext`
+  and a `BigInt` value each drop their entry and keep the others.
+- The budget: a set that fits exactly is kept whole; one byte over drops the
+  last entry; a multibyte set whose JavaScript length fits but whose UTF-8
+  size does not is cut; order and repeated sources are preserved.
+- Lone surrogates are forwarded unchanged (rule 8 fixtures).
+- Shapes from 3.5: a 51Degrees-style `user.eids` set with one `51d.es` entry
+  per `mm`, openPair with `undefined` `inserter`, LiveIntent with
+  `ext.segments`, oneKey with `ext.preferences`, PAIR's `atype: 571187`.
+- Cookie writer: EID-level `ext` removed and the duplicates it creates dropped;
+  today's trim cases unchanged; a last entry that is `null`, a string, or an
+  object without a `uids` array removed whole; UTF-8 encoding of non-Latin-1 text that round-trips through `atob` and
+  `TextDecoder`; clearing when nothing fits.
+
+### 7.3 TSJS adapter (Vitest), `test/integrations/prebid/index.test.ts`
+
+- `buildRequests` forwards `bidderRequest.ortb2` EIDs with EID-level fields,
+  and never calls `getUserIdsAsEids` or `getConfig('ortb2')`. The canary
+  (rule 3) covers every test.
+- After each `buildRequests`, the cookie equals that request's body set without
+  EID-level `ext`, after trimming. It is cleared before the request when the
+  set is empty. It is unchanged when an auction built no `trustedServer`
+  request. With two overlapping auctions, the later `buildRequests` wins.
+- TCF (O9): a `tcf2Enforcement` event that lists `trustedServer` in
+  `biddersBlocked`, and one that lists it in `eidsBlocked`, each clear a preset
+  cookie. An event that lists only another bidder leaves it unchanged. A
+  positive control proves the shim registered the listener.
+- Without the userId module, `ortb2` EIDs still flow and are written to the
+  cookie.
+- `installUserIdModules` is gone: after `window.load`, and with
+  `document.readyState === 'complete'` at install, TS writes no `userSync`
+  values other than managed `userIds` and, on a late seed, `autoRefresh`. The
+  seeded config's `auctionDelay`, `syncDelay` and `filterSettings` equal the
+  effective config's.
+- `tsjs.requestAds` sends no `eids`, as today.
+
+### 7.4 Rust unit
+
+- `ec/client_eids.rs`: every row of the 4.4 table, valid and invalid, with the
+  raw inputs of rule 7; input that is not an array; one unparsable entry among
+  good ones; duplicates removed before the 64-entry cap; dropped entries and
+  fields logged without values.
+- `ec/prebid_eids.rs`: legacy cookies; structured cookies with and without the
+  new fields; a mistyped field, now dropped instead of rejecting the cookie; a
+  bad entry, now isolated; the caps; diagnostics that still report raw UIDs.
+- `auction/endpoints.rs`: the rule 8 fixtures through `handle_auction`; body
+  fields reach `auction_request.user.eids`; body wins over cookie; cookie used
+  when the body has no EIDs.
+- Merge: every example in 4.5, each asserted on the full output. The three
+  existing merge tests (`auction/endpoints.rs:1656-1745`) get the new
+  expectations.
+- `publisher.rs`: navigation and page-bids auctions merge the cookie's entries
+  first and KV-only sources after (4.5, cases 3 and 4).
+- Fastly adapter and `ec/finalize.rs`: the two layers of rule 11.
+- `auction/formats.rs`: `x-ts-eids` carries the new fields and a repeated
+  source, decoded and compared in full.
+- Serialization: the new fields appear in all three outbound paths when
+  present, and a repeated source serializes as two entries; existing golden
+  JSON stays byte-identical.
+- `migration_guards.rs` includes `ec/client_eids.rs`.
+
+### 7.5 Real Prebid in CI (O8)
+
+These arms run in the JSDOM suites named in rule 12, which build the real
+external bundle and evaluate it with the shim in a page window. Every arm must
+fail against `main` (rule 1). The suites need this harness work, which the plan
+does first:
+
+- One harness with both the consent suite's `__tcfapi` stub and the artifact
+  suite's `/auction` body capture, by extending one suite or sharing helpers.
+- Bundles that add `unifiedIdSystem` and `identityLinkIdSystem`, next to a
+  client bidder with a GVL ID such as `appnexus`.
+- A `tcData` fixture that can grant Purpose 2 and per-vendor consents.
+- `TextEncoder` and `TextDecoder` on the page window if jsdom lacks them, as
+  the harness already copies `Request`, `Headers`, `Response` and
+  `AbortController`.
+- Control of `window.load`. The page's load is held by a sub-resource the
+  suite's request interceptor leaves pending, and the test releases it. Each
+  arm asserts `document.readyState` at every step, so an arm cannot silently
+  run in the wrong order.
+- Delayed vendor responses inside the `fetch` spy installed before the bundle
+  is evaluated. Prebid's `ajax` uses `fetch` and binds `window.fetch` at
+  evaluation (`src/ajax.ts:8-9`), so a spy installed later is never called.
+
+- **Restriction (D1).** A sharedId entry restricted to another bidder, with a
+  preset storage cookie, next to an unrestricted `ortb2` control. The arm first
+  asserts that `pbjs.getUserIdsAsEids()` contains the restricted source, which
+  proves the module produced it. Then the control is present and the
+  restricted source is absent in the `/auction` body and `ts-eids`.
+- **Fields (D3).** An `ortb2` entry with `inserter` and `mm`, plus a second
+  entry for the same source with different fields: both reach the body as
+  separate entries with their own fields, and the cookie holds both without
+  EID-level `ext`.
+- **Timing (D4).** No CMP, so TCF plays no part. A fixed order of events:
+  1. The page loads with no User ID config, and the test releases
+     `window.load` (`readyState` is `complete`).
+  2. The publisher calls `setConfig({userSync: {userIds: [unifiedId]}})`.
+     unifiedId's `params.url` points at the `fetch` spy, which answers after
+     200 ms, and it has no `storage` param.
+  3. The test asserts `pbjs.getConfig('userSync').auctionDelay` and calls
+     `requestBids` while the unifiedId response is still pending.
+
+  With the change, the delay is Prebid's 500 ms and the first `/auction` body
+  carries `adserver.org`. Against `main`, the delay is `0`, the module defers
+  its vendor call until after the first auction, and the body does not carry
+  it.
+
+  A control arm sets the same config and runs the first auction before
+  releasing `window.load`. It must carry `adserver.org` on both builds, which
+  proves the spy and the module work.
+
+- **TCF (O9).** A `__tcfapi` stub reports `gdprApplies: true` with Purposes 1
+  to 4 consented. Vendor consent is granted to identityLink (GVL 97) only, not
+  to the control bidder. The page has:
+  - identityLink with a preset stored envelope, so it produces a
+    `liveramp.com` EID at once;
+  - an `ortb2` control EID;
+  - a client bidder with a GVL ID as the control bidder;
+  - a preset `ts-eids`.
+
+  Arms:
+  - **Without an exception,** `pbjs.getEvents()` holds a `tcf2Enforcement`
+    event listing `trustedServer` (the positive control), no `/auction`
+    request is sent at all, and the cookie is cleared. Against `main` this arm fails: identityLink's
+    vendor consent lets `getUserIdsAsEids()` return `liveramp.com`, and
+    `main`'s `bidsBackHandler` rewrites the cookie with it.
+  - **With the full rule from 3.7** in the page's
+    `consentManagement.gdpr.rules`, `/auction` carries the control `ortb2` EID,
+    and the control bidder is still listed in `biddersBlocked`, which proves
+    the rule did not switch off enforcement for other bidders. Against `main`
+    this arm fails because `main` never reads `ortb2`.
+
+### 7.6 Manual live check
+
+Through `ts dev proxy` on a page with Lockr and the default User ID preset. The
+user runs the snippets in DevTools. Report only what was observed.
+
+1. On a `main` build, record `pbjs.getConfig('userSync').auctionDelay` before
+   the first `requestBids` and after `window.load`, when the CMP answered, and
+   the sources of the first `/auction` body.
+2. On the branch, record the same. Expect the publisher's or Prebid's delay
+   throughout, and asynchronous User ID sources (criteo, LiveIntent) in the
+   first body when they resolve within it. Lockr's ID5 may still be missing
+   from the first auction (4.9).
+3. Decode an `/auction` response's `x-ts-eids` and the cookie with
+   `JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(value), (c) => c.charCodeAt(0))))`.
+   The header's browser entries should equal the request body's, with their
+   own `inserter`, `matcher` and `mm`, followed by KV-only sources. The cookie
+   should equal the body without EID-level `ext`, subject to the trim.
+4. `/_ts/admin/eids` (authenticated) lists the cookie's `adserver.org` entries
+   with their own fields.
+5. Compare `pbjs.getEvents()` `bidRequested` events for `trustedServer` with
+   the `/auction` bodies: the entries should match.
+
+### 7.7 CI gates
+
+This change touches JS and core, so all ten gates in `AGENTS.md` apply:
+`cargo fmt`, all clippy aliases, `cargo test-fastly`,
+`cargo test-fastly-reuse`, `cargo test-axum`, `cargo test-cloudflare`,
+`cargo test-spin`, the parity test, Vitest, JS format, docs format, Markdown
+format outside `docs/`, the native build-digest test and lint, and the Wasm
+clock lint. CLI tests run too, because the CLI reads `user_id_modules.json`.
+
+## 8. Rollout
+
+### 8.1 Ordering
+
+TSJS is compiled into the server binary, so JS and Rust ship together.
+Compatibility with older TSJS, servers and cookies was not a constraint. The
+change ships as one pull request, in this commit order so each step is
+reviewable:
+
+1. Rust: `Eid` fields and constructor, `raw_value`, `ec/client_eids.rs` for
+   body and cookie.
+2. Rust: the merge.
+3. Rust: KV input selection.
+4. TSJS: the collector, the cookie writer in `buildRequests`, the TCF listener,
+   removal of the old collector and `bidsBackHandler` cookie sync.
+5. TSJS: deletion of `installUserIdModules()`.
+6. Registry: deletion of the resolver and `eidSources` (O6).
+7. Docs.
+
+### 8.2 What breaks
+
+| Who                                              | Change                                                                                                                                                                                                                                                                                                                                      |
+| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Bidders, when browser and KV EIDs mix            | Browser entries come first, KV-only sources after. For a source the browser sends, KV's value and `atype` are no longer sent. Repeated sources are no longer folded into one entry                                                                                                                                                          |
+| Publishers                                       | TS stops overwriting `syncEnabled`, `filterSettings`, `syncsPerBidder`, `syncDelay` and `auctionDelay`. Iframe syncs are no longer force-enabled. Auctions wait up to `auctionDelay` (500 ms by default) while IDs are pending, including after `window.load`. Unchanged: a late managed seed still leaves `autoRefresh: true` for the page |
+| Server-side bidders folded into `trustedServer`  | IDs restricted to them are no longer forwarded (4.8)                                                                                                                                                                                                                                                                                        |
+| GDPR traffic without a `trustedServer` exception | Already no `trustedServer` demand. The cookie is now cleared instead of written from `getUserIdsAsEids()`, so body-less routes and KV ingestion lose browser EIDs for that traffic, including the IdentityLink flow                                                                                                                         |
+| Cookie contents                                  | Holds `ortb2` EIDs and provenance fields, written only with TCF Purpose 1 and 4 consent where GDPR applies (4.8); never EID-level `ext`. Written at request time, not at auction end                                                                                                                                                        |
+| KV ingestion on `/auction`                       | No longer reads the cookie next to the body                                                                                                                                                                                                                                                                                                 |
+| Providers                                        | Additive fields and possibly repeated sources                                                                                                                                                                                                                                                                                               |
+| `/_ts/admin/eids` consumers                      | New fields in the cookie entries. A mistyped field is dropped instead of failing the whole cookie                                                                                                                                                                                                                                           |
+| Old TSJS, baked-in shims, rolled-back servers    | Old TSJS's body and cookie are parsed by the new parser. A rolled-back server reads only `source` and `uids` from new bodies and cookies                                                                                                                                                                                                    |
+
+### 8.3 Operator actions
+
+- Before production, send one request with repeated sources and all four
+  fields to each configured provider in staging and confirm it is accepted.
+- Regenerate external bundles that carry a baked-in shim (`ts prebid client`).
+- Tell publishers about the `userSync` change: set `auctionDelay` and
+  `filterSettings` in their own Prebid config if Prebid's defaults do not suit
+  them.
+- For sites with GDPR traffic, decide with the publisher whether their Prebid
+  config grants `trustedServer` a soft exception, using only the full rule in
+  3.7. A rule without `enforcePurpose: true` and `enforceVendor: true`
+  switches off TCF checks for every bidder. Publishers that set
+  `eidsRequireP4Consent` need the full `personalizedAds` rule too. The release
+  notes say so.
+
+### 8.4 Overlap with draft PR #1382
+
+#1382 moves `ec/prebid_eids.rs` into `crates/auction/prebid/src/eids.rs` and
+feeds core through an `IdentifierModule`. The shared parser lives in core
+(`ec/client_eids.rs`). If #1382 lands first, `parse_client_eids` must become
+`pub` so the Prebid crate can call it. Whichever lands second rebases; the
+cookie decoder change is small.
+
+### 8.5 Follow-ups
+
+- Prebid.js upstream fix for D7: guard both `JSON.parse` calls in
+  `modules/identityLinkIdSystem.js` and fall back to the LiveRamp endpoint.
+- `sharedId` cookie ingestion ignores Prebid's restrictions (O10).
+- TS's TCF identity, as its own spec: a server-side per-provider vendor check
+  (`TcfConsent::has_vendor_consent`, `consent/types.rs:251`, has no production
+  callers), then registering `trustedServer` as `VENDORLESS_GVLID`, then an
+  upstream fix so Prebid's EID check accepts vendorless modules
+  (`modules/tcfControl.ts:295-307`).
+- `trustedServer` gets no client-side bid requests where GDPR applies unless
+  the publisher grants an exception (3.7). This predates this work and affects
+  demand, not only EIDs.
+- Per-bidder EID forwarding for server-side bidders folded into
+  `trustedServer`, through Prebid Server `eidpermissions` (4.8).
+- Refresh rules for browser-sourced partner IDs in KV, which today keeps the
+  first value forever (identity redesign).
+- Restore the publisher's `autoRefresh` after a late managed seed; today it
+  stays `true` for the page because `userSync` settings accumulate (4.9).
+- Add a vendor-level storage check to the `ts-eids` write (4.8, residual 2),
+  together with TS's TCF identity. The Purpose 1 and 4 check ships with this
+  work.
+- A server-written cookie (alternative 6), with server-side ID provider work.
+- A lenient parse of the rest of the `/auction` body.
+
+### 8.6 Documentation to update
+
+- `docs/guide/integrations/prebid.md`: User ID modules and timing (TS no longer
+  sets `userSync`), identity forwarding (which still names
+  `getUserIdsAsEids()`), the IdentityLink flow, merge rules (which promise UIDs
+  deduplicated by source and id), and a TCF section with the full exception
+  rule, its warning, and the `personalizedAds` rule for publishers that set
+  `eidsRequireP4Consent`.
+- `docs/guide/integrations/lockr.md`: it describes a `contribute_eids()` path
+  that does not exist and omits the `[[ec.partners]]` `id5-sync.com` setup and
+  the TCF exception.
+- `docs/guide/edge-cookies.md` and `docs/guide/ec-setup-guide.md`: the
+  `ts-eids` writer and contents, and KV ingestion inputs.
+- `docs/guide/api-reference.md`: the `/auction` body `eids` fields and
+  per-entry dropping, `x-ts-eids` contents, and the `/_ts/admin/eids` section
+  (`:902-936`).
+- `docs/guide/configuration.md`: `openrtb_atype` applies only where KV supplies
+  a source the browser did not send.
+
+## 9. Acceptance criteria
+
+- **A1.** With a `userIds` entry restricted to `bidders: ['otherBidder']`, its
+  EID appears in neither the `/auction` body nor `ts-eids`, while a control EID
+  in the same request does (7.3, 7.5). The canary never appears in any adapter
+  test (7.1, rule 3).
+- **A2.** An EID set with `setConfig({ortb2: {user: {ext: {eids}}}})` appears
+  in the `/auction` body, `ts-eids` and the provider request. With a matching
+  `[[ec.partners]]` entry and EC consent, finalization writes it to KV (7.4).
+- **A3.** Every case in 4.5 holds, asserted on the full output. Two browser
+  entries for one source with different EID-level fields reach the provider as
+  two entries with their own fields.
+- **A4.** The rule 8 fixtures pass through `handle_auction` as body and as
+  cookie: the good entries arrive, the bad entry is dropped, the request is
+  accepted. Every malformed field in 4.4 drops only itself, in body and cookie.
+- **A5.** Serializing an EID set without the new fields is byte-identical to
+  today (golden tests).
+- **A6.** TS writes no `userSync` values other than managed `userIds` and, on a
+  late seed, `autoRefresh`. In the timing arm, the first auction carries the delayed unifiedId with the change
+  and not against `main`, and the control arm carries it on both (7.5).
+- **A7.** After each `buildRequests`, `ts-eids` equals that body set without
+  EID-level `ext`, after trimming. It is cleared when the set is empty or
+  Prebid's TCF rules block `trustedServer`, and unchanged when an auction built
+  no `trustedServer` request (7.3, 7.5).
+- **A8.** On `/auction` with body EIDs, a registered source present only in
+  `ts-eids` is not written to KV, while the body's source is. An `/auction`
+  that sets no client set ingests nothing from the cookie. A navigation
+  response ingests the cookie's registered source (7.1, rule 11).
+- **A9.** EIDs over 64 KiB as UTF-8 are cut from the tail in TSJS, including a
+  multibyte set that fits by JavaScript length (7.2).
+- **A10.** Where TCF enforcement is active, GDPR applies and `trustedServer`
+  has no exception, no client EIDs reach TS and the cookie is cleared, where
+  `main` rewrites it from a vendor-consented module. With the full rule from
+  3.7 the control `ortb2` EID reaches `/auction`, and a control bidder with a
+  GVL ID stays blocked (7.5).
+- **A11.** `x-ts-eids` carries the consent-gated outbound set with its
+  EID-level fields (7.4).
+- **A12.** Every new test was seen failing first (7.1, rule 1), and the plan
+  records the output.
+- **A13.** All gates in 7.7 pass, and the staging provider check in 8.3 passes
+  before production rollout.
+
+## Review log
+
+- Round 1 (Claude Code, Opus 5.5, fresh session): two blocking findings.
+  `trustedServer` has no GVL ID, so under TCF Prebid blocks it and the cookie
+  would never be refreshed for that traffic; added 3.7 and O9. The D1
+  real-Prebid case could pass without the restricted module running; it now
+  first proves the source exists in `pbjs.getUserIdsAsEids()`. Should-fix items
+  addressed: merge wording, precise validation rules, Prettier-safe fixtures, a
+  lone-surrogate test that can fail, canary resets, test isolation, the GPT
+  refresh claim, the bundled-filter list, EID-level `ext` out of the cookie.
+- Round 2 (Claude Code, Sonnet 5.5, fresh session): one blocking finding. An
+  earlier draft keyed its cookie copy on `bidderRequest.auctionId`, which
+  Prebid hides from adapters by default, so the cookie would never be written,
+  and mock tests would have passed anyway. The cookie is now written in
+  `buildRequests` (O1), and rule 6 forbids relying on `auctionId`. Also
+  addressed: UID `ext` cap and the EID budget (G5), folded server-side bidders
+  (4.8, 8.2), a Rust test for a TSJS-written cookie (rule 8).
+- Design pass (Claude Code, Opus 5.5, fresh session, told that backwards
+  compatibility is not a constraint): recommended server-only validation with
+  per-entry isolation, a browser-wins merge, deleting `installUserIdModules()`,
+  deleting the dead resolver, moving TS's TCF identity out, and deleting
+  `ts-eids`. The author adopted all but two. `sharedId` ingestion stays a
+  follow-up (O10). `ts-eids` stays, because the product requires IDs in a
+  first-party cookie as well as KV, with the cookie read first (O1).
+  `x-ts-eids` stays for validation and troubleshooting (G7).
+- Round 3 (Claude Code, Opus 5.5, fresh session, reviewing the version without
+  the cookie): three blocking findings.
+  - Prebid's `userSync` settings accumulate, so `installUserIdModules()` sets
+    `auctionDelay: 0` for every later auction, and it never dropped `userIds`
+    or `ppid`. D4, 3.3, 4.9 and 8.2 were rewritten.
+  - The timing arm could not tell `main` from the branch. It now runs a fixed
+    order of events with a control arm.
+  - The recommended TCF exception, written as a partial rule, switches off TCF
+    checks for every bidder. 3.7, 7.5 and 8.3 now give the full rule and test
+    that other bidders stay blocked.
+
+  Should-fix items addressed:
+  - Real-Prebid arms moved into the CI JSDOM suites (O8).
+  - Budget measured in UTF-8 bytes.
+  - Privacy model qualified, with `x-ts-eids` and KV fill as residual exposures.
+  - Byte-identity limited to serialization.
+  - Vacuous-pass gaps closed: the canary capture point, ingestion arms through
+    the Fastly adapter, fixtures through `handle_auction`.
+  - Managed seeding expectations corrected.
+  - Missing docs added.
+
+  All nits fixed. Findings about deleting the cookie are moot now that the
+  cookie stays.
+
+- Round 4 (Claude Code, Sonnet 5.5, fresh session): two blocking findings.
+  - The TCF arm without an exception also passed against `main`, because with
+    no vendor consents `main` clears the cookie too. Vendor consent now goes to
+    identityLink, so `main` rewrites the cookie and the arm fails there.
+  - The KV ingestion arms could not be built in the Fastly adapter's test
+    router, which cannot observe a KV write. Rule 11 now splits them: the
+    adapter test checks what `EcFinalizeState` carries, and core tests drive
+    `ec_finalize_response` with an in-memory KV.
+
+  Should-fix items addressed:
+  - D4 and 3.3 corrected. A late managed seed refreshes at once, so its vendor
+    calls start but no auction waits. Only a publisher config after load
+    defers vendor calls, which is what the timing arm now uses.
+  - 7.5 lists the harness work: control of `window.load` with `readyState`
+    checks, a combined CMP and body-capture harness, the bundle modules,
+    Purpose 2 in `tcData`, `TextEncoder`, and delays inside the `fetch` spy.
+  - `/auction` without a client set ingests nothing from the cookie (4.6).
+  - The cookie write's missing Purpose 1 check is a residual exposure and a
+    follow-up.
+
+  Nits fixed: trim wording and the non-object case, the literal count, the
+  `from_value` limit for raw values.
+
+- Round 5 (Claude Code, Opus 5.5, fresh session): no blocking findings. Its
+  should-fix items are addressed:
+  - TS's late-seed `autoRefresh` write is an explicit exception in 4.9, 7.3,
+    A6 and 8.2, with a follow-up to restore the publisher's value.
+  - The adapter-layer ingestion test no longer asserts the client set, which
+    needs an allowed EC.
+  - The core ingestion test names the auction-disabled path. 4.6 now says
+    that without usable consent nothing is ingested, and that new ECs and
+    routes with no sync source keep the cookie as input.
+  - 3.7, 8.3 and 8.6 cover publishers that set `eidsRequireP4Consent`.
+  - D4 and 4.9 say that 7.5 proves the mechanism and 7.6 decides the live
+    cause.
+
+  Nits fixed:
+  - The `from_value` claim is removed.
+  - The no-exception TCF arm asserts that no `/auction` request is sent, with
+    the event as the positive control.
+  - The fixture puts its lone surrogate in a UID `id`.
+  - 4.11 splits bid blocking from EID blocking.
+  - Two line references are corrected.
+  - 8.4 notes that `parse_client_eids` must become `pub` if #1382 lands first.
+
+  This round meets the `CONTRIBUTING.md` bar: a round with nothing blocking.
diff --git a/docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md b/docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md
new file mode 100644
index 0000000000..c8edfaa214
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md
@@ -0,0 +1,4789 @@
+# Server-side identity providers
+
+Status: Draft, revision 15. Revised after review rounds 1 to 14. Revision 14
+made `ts-eids-s` a client-only cookie, at the spec author's request. Revision 15
+removes the `ts-eids-r` removal cookies, runs providers only on writer
+navigations, makes capture revoke-only and moves KV to schema version 2,
+accepting breaking changes. Section 16 lists the decisions.
+
+Issue: none filed yet. Related:
+[#1245](https://github.com/IABTechLab/trusted-server/issues/1245)
+(LiveRamp server-to-server),
+[#90](https://github.com/IABTechLab/trusted-server/issues/90)
+and [#353](https://github.com/IABTechLab/trusted-server/issues/353) (ID5),
+[#1246](https://github.com/IABTechLab/trusted-server/issues/1246) (Lockr IDs to
+KV), [#777](https://github.com/IABTechLab/trusted-server/issues/777)
+(pluggable modules).
+
+Designed against `spec/1246-prebid-eid-fidelity` at `c84a73da7`, which is
+`main` at `6ef07ae52` plus the
+[Prebid EID fidelity](2026-10-18-prebid-eid-fidelity-design.md) work. Every
+`file:line` reference below is to that commit. Core paths are written without
+the `crates/trusted-server-core/src/` prefix, and Fastly adapter paths start
+with `adapter-fastly/src/`. Prebid.js references are to version 10.26.0, read
+from `crates/trusted-server-js/lib/node_modules/prebid.js/modules/`. This spec
+depends on the EID fidelity branch for `merge_auction_eids`, the shared
+client EID parser and the `ts-eids` cookie carrying the same set the shim
+sends. It assumes that work forwards configured ORTB2 EIDs together with
+User ID module EIDs, deduplicated, with EID-level provenance preserved
+(EID fidelity spec D2, D3, §4.2, §4.4). Lockr writes its ID5 EID only into
+`pbjs.getConfig('ortb2').user.ext.eids`, which a collector that reads only
+`getUserIdsAsEids()` misses (#1246).
+
+This spec does not depend on PR #1260, and supersedes it: #1260 will not
+merge. Its `IdentityCapture` trait, `identity_owner` field and `ts-eids-s`
+cookie are not on `main`. Where this spec reuses a name from #1260, it
+defines the thing from scratch here, and it keeps `ts-eids` and `x-ts-eids`,
+which #1260 retires.
+
+Terms used throughout:
+
+- **EID / UID**: an OpenRTB extended identifier, `{source, uids[]}`, and one
+  entry of its `uids`, `{id, atype?, ext?}` (OpenRTB 2.6 §3.2.27, §3.2.28).
+- **EID-level fields**: an EID's `inserter`, `matcher`, `mm` and its own
+  `ext`, as opposed to a UID's `atype` and `ext`.
+- **Entry set**: every EID entry stored for one source, written by one writer
+  and replaced or removed whole (section 6.1). A provider may return several
+  entries per source, each with several UIDs.
+- **Identity provider**: a vendor that turns request signals into an EID,
+  such as ID5, LiveRamp ATS, Lockr AIM or UID2.
+- **Source**: the EID `source` domain a provider's IDs carry, such as
+  `id5-sync.com` or `liveramp.com`. It is also the key of the KV `ids` map. A
+  **registered** source has an `[[ec.partners]]` entry.
+- **EC / KV row**: the Edge Cookie ID (`ts-ec`) and the KV identity-graph
+  entry keyed by it (`ec/kv_types.rs:42`).
+- **HEM**: a hashed email, the SHA-256 of a normalized email address. LiveRamp
+  ATS, Lockr and UID2 resolve from it. It is personal data, not an anonymous
+  value.
+- **Page load**: one top-level document navigation and every request the page
+  makes because of it: `/auction` calls, SPA view changes reported to
+  `/_ts/page-bids`, and integration proxy calls.
+- **Writer request**: the one request in a page load allowed to write KV
+  (section 5.1).
+- **Stager**: every other request. It reads cookies and KV, runs no
+  resolving provider and persists no positive ID. Its only KV write is the
+  capture removal write, for a revocation a proxied call carries (section
+  5.3).
+- **Hold mode / after-send mode**: whether a provider is called before the
+  auction, with the auction waiting for it, or after the response has been
+  sent.
+- **Orphan recovery**: what TS does when a visitor's EC cookie has no KV row
+  (`ec/finalize.rs:282`).
+- **`ts-eids`**: the existing first-party cookie the Prebid shim writes with
+  the browser's EIDs. Unchanged by this spec, except that it holds only
+  registered sources, merged per source across auctions (section 5.3).
+- **`ts-eids-s`**: a new client-only cookie, named `__Host-ts-eids-s`, that
+  the shim writes from the servable server set TS returns in `/auction` and
+  `/_ts/page-bids` responses. It mirrors server IDs for page scripts. The
+  server never opens, parses or trusts it, and the shim never copies it
+  into `ts-eids` or the `/auction` body. Defined in section 6.2.
+
+## 1. Problem statement
+
+Trusted Server (TS) collects EIDs three ways today. Browser modules resolve
+IDs that the page forwards, partners push UIDs to batch sync, and pull sync
+calls partners from the server. Only pull sync calls a provider from the
+server, and it speaks one fixed protocol.
+
+### P1. Browser-only collection fails where browsers block vendors
+
+Each provider ships a browser module, and TS forwards what those modules
+produce. Safari's tracking protection blocks requests to some vendor hosts.
+#1245 reports Prebid's `identityLink` module failing this way on Safari,
+leaving no LiveRamp envelope in the auction. Calling providers from the edge
+avoids the browser request.
+
+This spec builds that server-side path. In v1 it helps:
+
+- providers that need no hashed email, such as ID5
+- providers whose traffic TS already proxies, such as Lockr, for removals
+  and opt-outs. A positive capture on a proxied API call is not persisted
+  (section 2.3)
+- generic pull partners
+- any owning provider that can refresh an ID a browser module obtained
+  earlier, so the ID survives when the module later fails in that browser
+
+It does not fix the #1245 Safari case by itself. LiveRamp's initial
+resolution needs a hashed email, and v1 has no way to obtain one (section
+2.2). A Safari visitor whose browser module never obtained an envelope has
+nothing to refresh.
+
+### P2. The only server-side path is one fixed protocol
+
+`ec/pull_sync.rs` calls partners after the response is sent. Its protocol is
+fixed: `GET <pull_sync_url>?ec_id=<id>` with a bearer token
+(`pull_sync.rs:255`, `:368-371`), response `{"uid":"..."}`
+(`pull_sync.rs:54-57`). It fills missing UIDs only and never refreshes
+(`pull_sync.rs:7-9`).
+
+None of the providers this spec targets speaks that protocol:
+
+- **ID5** takes a POST body with a partner number, device signals, the page
+  URL and consent. It returns up to three IDs (`id5-sync.com`, an EUID ID and
+  `true-link-id5-sync.com`) and a `signature` the caller sends back on its
+  next call (`id5IdSystem.js:40-41`, `:130-170`, `:454-487`).
+- **LiveRamp ATS** takes a placement ID, an identifier type and value,
+  consent parameters and the end user's IP. It returns one of several
+  envelope products, envelopes expire after 15 or 30 days, and refresh is a
+  different call that takes the old envelope (#1245 §9, §10).
+- **UID2** returns an advertising token for bidders and a refresh token that
+  must never reach them.
+- **Lockr**'s API traffic already passes through TS's proxy
+  (`integrations/lockr.rs:179-237`). Its IDs can be read from the responses,
+  with no outbound call.
+
+Each provider needs its own request building, response parsing, error
+handling and, for some, private state kept between calls. Without a shared
+contract, each integration would repeat consent revalidation, CAS handling,
+rate limits and timing. #1245 §6 rules out a private KV writer per vendor.
+
+### P3. A page load writes KV several times
+
+Today a page load can write the KV row once per step:
+
+| Step                                    | Request                                   | Write              | Code                                                        |
+| --------------------------------------- | ----------------------------------------- | ------------------ | ----------------------------------------------------------- |
+| New visitor gets an EC                  | publisher navigation, during routing      | `create_if_absent` | `adapter-fastly/src/app.rs:845-857`, `ec/mod.rs:424`        |
+| New visitor gets an EC                  | integration-proxy navigation              | `create_if_absent` | `integrations/registry.rs:1046-1050`                        |
+| Browser EIDs from `ts-eids` or sharedId | navigation, finalize                      | CAS update         | `ec/finalize.rs:83`, `:183`                                 |
+| Prebid body EIDs                        | each `/auction`                           | CAS update         | `auction/endpoints.rs:298-303`, `finalize.rs:183`           |
+| `ts-eids` on an SPA view                | each `/_ts/page-bids`                     | CAS update         | `publisher.rs:6925`, `finalize.rs:183`                      |
+| Pull sync results                       | after send, on requests with a loaded row | CAS update         | `adapter-fastly/src/main.rs:507-517`, `ec/pull_sync.rs:290` |
+| Cluster size                            | `/_ts/api/v1/identify`, once per EC       | CAS update         | `ec/identify.rs:107`, `ec/kv.rs:1484`, `:1524-1529`         |
+
+Ingest runs only on requests that set an EID sync source: navigation,
+`/auction`, `/_ts/page-bids` and new ECs (`ec/mod.rs:98-111`). Asset routes
+skip EC finalize entirely (`adapter-fastly/src/app.rs:834-835`). Pull sync
+runs after any response whose request loaded a consenting row
+(`pull_sync.rs:86`).
+
+Each of these skips the write when nothing changed, so most are no-ops, but
+each can write. A new visitor can cost three writes on the navigation alone,
+plus one for each `/auction` and each SPA view. Adding providers naively adds
+one more write each. KV writes cost money, Fastly limits how often one key
+can be written, and each extra write is another CAS race between tabs.
+
+## 2. Goals and non-goals
+
+### 2.1 Goals
+
+- **G1.** A trait any identity provider implements to be called from the
+  server. LiveRamp, Lockr, ID5, UID2 and generic pull partners all fit it,
+  including providers that keep private state between calls.
+- **G2.** Providers never do HTTP, KV or cookie work themselves. One
+  coordinator owns eligibility, consent, transport limits and write-back.
+- **G3.** Operators choose per provider between hold mode and after-send
+  mode.
+- **G4.** At most one browser-driven KV write per page load, and a write
+  that fails is not retried. This is strict. The only page-load exceptions
+  are a consent withdrawal's tombstone (section 5.1), which also covers a
+  capture provider's global revoke (section 8), and the two removal writes:
+  the capture removal write a proxied revocation makes (section 5.3), and the removal-only retry of a failed flush (section 5.2,
+  phase 4). All are rare and removal-only. Writers outside page loads keep
+  their own
+  writes: batch sync, the admin endpoints and the deferred deletion
+  framework (sections 2.2, 5.5).
+- **G5.** Provider-collected IDs are stored in KV and mirrored in a
+  first-party cookie (`ts-eids-s`) that page scripts read. KV is the only
+  server-side source of provider IDs: eligibility, the auction merge,
+  `/identify` and servability read KV, never `ts-eids-s`. Section 15 asks
+  whether this meets the product rule that the cookie is read first.
+- **G6.** Each source has at most one owning provider, configured by the
+  operator. A valid ID the owner wrote wins in the auction over the
+  browser's.
+- **G7.** For a source with an owning provider that declares its IDs as
+  expiring (LiveRamp envelopes), the IDs are refreshed and are never sent to
+  bidders or returned by `/_ts/api/v1/identify` after expiry. Unowned
+  sources are outside G7 (section 2.3).
+- **G8.** Today's pull sync becomes one implementation of the trait. Its
+  protocol and fill-missing contract are unchanged. It runs only on writer
+  navigations, so it holds for clients that make them (section 2.3). Section 10.4 lists the
+  behaviour that does change.
+- **G9.** The trait can model a provider that needs a HEM, even though v1
+  has no way to obtain one.
+- **G10.** For clients that make writer navigations (section 5.1), no
+  browser EID that reaches KV today is lost, within one bound.
+  Browser ingest runs only on the writer request, from `ts-eids`. The shim
+  writes only registered sources into `ts-eids` and merges them per source
+  (section 5.3), so the next writer request ingests every registered source
+  today's `/auction` ingest writes from the body. A body-only registered ID
+  is lost only when the registered sources alone exceed the 3,072-byte trim. What today's
+  `/_ts/page-bids` ingest writes comes from `ts-eids` too; only an SPA
+  session longer than that cookie's one-day lifetime can lose such an ID.
+- **G11.** Writing a provider is easy, and extending the trait does not
+  break one. A simple provider is one struct, one descriptor and two short
+  methods (section 4.2).
+- **G12.** Removals win. Every removal (opt-out, invalidation, withdrawal,
+  deletion) is written to KV on the request that carries it, and TS serves
+  only from KV, so the ID stops reaching bidders through TS at once. A
+  removed provider ID also stops reaching them as a browser value: the
+  removing provider's `ps.iv`, `ps.ov` and `ps.o` filter browser candidates
+  (section 7.1). The `ts-eids-s` mirror drops it at the next `/auction` or
+  `/_ts/page-bids` response. The one bound: a removal write that fails all
+  its attempts is lost (section 2.3).
+- **G13.** A provider can return complete EIDs, with the same fidelity the
+  browser's `/auction` body has: several EID entries per source, several
+  UIDs per entry, UID-level `atype` and `ext`, and the EID-level fields. TS
+  stores the entry set whole in KV, mirrors it whole in `ts-eids-s` when it
+  fits, and sends it to bidders whole (sections 4.5, 6.1, 6.2, 7.1). This is
+  additive in behaviour: G13 itself changes none of the paths that predate
+  this spec. Browser ingest, `ts-eids`, batch sync, generic pull and
+  `/identify` keep the behaviour the rest of this spec gives them (sections
+  5, 6.2, 7.2, 10.4), and every record they write is one entry with one
+  UID and no EID-level fields. The storage shape changes for every record
+  (schema version 2, section 6.1); what bidders receive for these records
+  does not.
+
+### 2.2 Non-goals
+
+- **HEM intake.** How a hashed email reaches TS (#1245 §4 options A to D)
+  needs its own spec. The trait has a typed slot for it. In v1 the slot is
+  always empty and providers that need it are skipped.
+- **Concrete vendor implementations.** ID5, LiveRamp and Lockr each get
+  their own implementation spec. Section 12 shows how each maps onto the
+  trait, to prove the trait fits.
+- **Other adapters.** KV identity runs only on Fastly
+  (`publisher.rs:6896-6899`). Axum, Cloudflare and Spin get this design when
+  EC identity is ported to them (#777 rows 52 to 54).
+- **Cross-browser linking.** An ID in one browser's EC row does not appear in
+  another browser's row (#1245 §12).
+- **LiveRamp ATS Direct segments** and GAM targeting.
+- **Batch sync and admin writes.** They keep their own writes. Section 7.2
+  changes only how batch sync treats an owned source.
+- **Removing `ts-eids` or `x-ts-eids`.** Both stay.
+- **Storing the browser's complete EID set.** Browser ingest keeps today's
+  rules: registered sources only, one UID per source picked as
+  `collect_eid_updates` picks it today (`ec/prebid_eids.rs:146-151`: for a
+  repeated source, the first valid UID of its last entry, with the sharedId
+  cookie applied last), no EID-level fields, fill-missing
+  (`ec/kv.rs:145-155`).
+  The browser's complete set still reaches bidders from the `/auction` body,
+  as the EID fidelity work defines. G13 applies only to IDs a provider
+  writes.
+
+- **Unregistered sources for providers.** A provider still claims only
+  sources with an `[[ec.partners]]` entry (section 10.2). Full fidelity
+  changes what a provider may return for a source, not which sources.
+
+### 2.3 Accepted tradeoffs
+
+Revisions 14 and 15 make `ts-eids-s` client-only, keep every positive ID
+off stagers and drop every server-owned identity cookie. The design accepts
+these costs for it:
+
+- **Providers run only on writer navigations.** `/auction` and
+  `/_ts/page-bids` call no provider; they serve what KV holds. On a site
+  whose auctions all go through `/auction`, hold-mode providers run after
+  send on the navigation, and their answers reach the next auction from KV
+  (section 4.7, step 7).
+- **Positive captures are not used in v1.** Capture is revoke-only: a
+  proxied call can remove IDs, opt a provider out and clear that opt-out,
+  and nothing else. The browser path (Prebid `ortb2` into `ts-eids`) still
+  carries to KV the one UID browser ingest picks for each registered source
+  (section 2.2). Full-fidelity sets from capture wait for open question 4
+  (sections 4.7,
+  12.2, 15).
+- **A failed removal write waits in the pending key.** A capture removal
+  write is tried before send with the withdrawal path's CAS attempts and
+  once more after send (section 5.3). A writer whose flush fails retries its
+  removals alone with the same CAS attempts (section 5.2, phase 4). When
+  every attempt fails, the removal is appended to the EC ID's pending key
+  and counted in `removal_deferred`, and the next writer merges it (section
+  5.3, The pending key). Only when that append fails too is it logged at
+  error and counted in `removal_lost`.
+- **A failed flush has no backup.** Browser ingest is re-derived from
+  `ts-eids`, and provider results are resolved again by a later writer
+  (section 5.2, phase 4).
+- **Every returning writer navigation reads KV twice.** It reads the row
+  and the pending key. No navigation is answered from a cookie with zero
+  reads (section 5.2).
+- **Server-only IDs are readable by page scripts.** UID2 advertising tokens
+  and LiveRamp envelopes are in `ts-eids-s`, which is not `HttpOnly`.
+  `x-ts-eids` already exposes them (section 9.3).
+- **A new visitor's first navigation runs only hold-mode providers that do
+  not read the EC ID, and only when it runs an auction.** After-send
+  providers and generic pull wait for the second page load, and a
+  first-navigation create waits up to `hold_budget_ms` for its providers
+  (section 4.7, new visitors).
+- **Clients without Fetch Metadata never write.** A writer navigation
+  needs `Sec-Fetch-Dest: document` (section 5.1). Safari before 16.4, older
+  embedded web views and any client that strips the header are stagers
+  forever. For them this is a regression: today's `/auction` ingest writes
+  their body EIDs to KV, and under this design nothing does. Pull sync
+  never runs for them, and orphan recovery, which moves into the writer's
+  phase 1, never runs either. Their consent withdrawals and capture
+  removals still apply (sections 5.1, 5.3). A fallback writer built from
+  `Accept: text/html` and `Upgrade-Insecure-Requests` was rejected because
+  `fetch()` can send both.
+- **Rollback below rollout step 0 is unsupported.** Step 1 writes KV
+  schema version 2, which builds older than step 0 reject. Step 0 ships
+  first as the floor: it reads version 2 rows and never rewrites them
+  except to tombstone, so step 1 can roll back to it (sections 6.1, 14).
+- **Unowned IDs keep no lifetime.** Expiry is declared by the writing
+  provider (`is_expiring`), and browser ingest, batch sync and a provider
+  that gives no expiry carry no `exp`. So an unowned `liveramp.com`
+  envelope or `uidapi.com` token from one of them is served from KV until
+  it is replaced or removed, as it is today, and a browser value equal to
+  an owner record TS knows has expired is still forwarded. G7 covers owned
+  sources only. A per-source lifetime on `[[ec.partners]]` would close
+  this for every writer; it changes what today's writers store, so it is
+  left for a later spec.
+
+## 3. Background
+
+### 3.1 Where EIDs come from today
+
+1. **Browser modules.** Prebid's userId modules resolve IDs in the browser.
+   The `trustedServer` bid adapter sends them in the `/auction` body and the
+   shim copies the same set into `ts-eids` (EID fidelity spec §4.2, §4.3).
+2. **Pull sync.** After the response is sent, TS calls each pull-enabled
+   `[[ec.partners]]` entry whose UID is missing (`ec/pull_sync.rs:116`).
+3. **Batch sync.** Partners push UIDs to `/_ts/api/v1/batch-sync`
+   (`ec/batch_sync.rs`).
+
+### 3.2 How the auction builds `user.eids`
+
+`handle_auction` takes the client set from the body, else from `ts-eids`
+(`auction/endpoints.rs:290-296`). It keeps the full body set for finalize
+because the cookie is size-capped (`endpoints.rs:298-303`). It reads the KV
+row once when a partner registry exists (`endpoints.rs:307-311`), resolves
+KV IDs for registered sources (`endpoints.rs:444`), and merges the two with
+`merge_auction_eids` (`endpoints.rs:505`). The navigation and
+`/_ts/page-bids` merge in `publisher.rs:5547-5568`. The merge forwards
+browser EIDs as sent and adds a KV EID only for a source the browser did not
+send. The result is consent-gated and reported in `x-ts-eids`
+(`ec/eids.rs:17`, 4 KB cap).
+
+Browser ingest is fill-missing: a different stored value is never replaced,
+because a browser value carries no freshness signal (`ec/kv.rs:146-154`).
+A KV record holds one UID per source and no EID-level fields
+(`ec/kv_types.rs:102`), and a KV value goes out as one entry with the
+partner's `openrtb_atype` (`ec/eids.rs:64-76`).
+
+### 3.3 The existing provider pattern
+
+`AuctionProvider` (`auction/provider.rs:84`) is the house pattern for a
+pluggable vendor. The provider builds its request and parses the response,
+and the orchestrator owns dispatch, timeouts and response handling. This spec
+follows the same split.
+
+### 3.4 Platform and timing facts this design depends on
+
+- **KV identity is Fastly-only.** Axum, Cloudflare and Spin pass no KV graph
+  (`publisher.rs:6896-6899`) and run no EC finalize or EC generation.
+- **New ECs are created before the cookie goes out.** Generation activates an
+  ID only after an Add-confirmed create and re-mints on a collision
+  (`ec/mod.rs:407-455`). Finalize refuses a generated cookie without a
+  backing row (`ec/finalize.rs:145-149`). This spec keeps that.
+- **After-send work starts after the last byte.** `send_edgezero_response`
+  streams the whole body before returning
+  (`adapter-fastly/src/main.rs:699-702`),
+  and pull sync runs after that (`main.rs:510-517`). The response has been
+  moved into the send by then, so after-send code cannot see its status
+  unless it is captured first (`main.rs:512-517`).
+- **State crosses into finalize only through `EcFinalizeState`**
+  (`adapter-fastly/src/app.rs:318-332`, inserted at `:535`). Response
+  extensions require `Clone + Send + Sync`, which a pending platform request
+  is not (`platform/http.rs:178-183`), so an in-flight provider call cannot
+  outlive the router.
+- **The origin fetch can start before the navigation auction.** When the
+  EC preload runs, the request has no template-cache key and the platform
+  supports concurrent fan-out and pending streaming responses, the origin
+  request is sent with `send_async` (`publisher.rs:4825-4852`), then the
+  preload runs (`:4859`) and then `dispatch_auction` (`:4947`). That is
+  Fastly's default path for a returning EC in Inline mode. In the other
+  modes (a template-cache key, ESI, or no preload) the auction is
+  dispatched first and the origin fetch waits for it.
+- **Outbound deadlines are soft on Fastly.** The Fastly adapter does not
+  offer an enforceable total request deadline
+  (`has_enforceable_total_request_deadline()` is false,
+  `platform/http.rs:375-383`): first-byte and between-byte timers still let
+  connection setup or a byte-trickling response overrun. Dynamic backends
+  use a fixed 1-second connect timeout (`adapter-fastly/src/backend.rs:240`)
+  today. This spec adds `PlatformBackendSpec::connect_timeout`, `None` by
+  default, so only hold-mode identity calls set a shorter one (section
+  4.7).
+- **Navigation detection.** `is_navigation_request` checks
+  `Sec-Fetch-Dest: document`, which excludes iframes, and falls back to
+  `Accept: text/html`, which a `fetch()` can also send (`http_util.rs:93-118`).
+  `is_prefetch_request` detects prefetch and prerender and is `pub(crate)`
+  in core (`publisher.rs:3200`). EC classification must wait until
+  pre-route filters allow dispatch (`ec/mod.rs:91-96`).
+- **Orphan recovery rotates.** When a cookie's row is proven absent
+  (`finalize.rs:371-400`), recovery mints a new EC ID and sets a new cookie
+  (`finalize.rs:304`, `:333`), before the response is sent. Only the
+  publisher fallback may rotate (`adapter-fastly/src/app.rs:885-890`).
+- **Today's navigation preload finds orphans.** Every returning GET
+  navigation preloads the row unless a valid pull-complete marker lets it
+  skip (`publisher.rs:3110-3117`, `:4819-4831`). This spec removes the
+  marker (section 10.4), so every returning navigation preloads.
+- **Withdrawal tombstones existing rows only,** with a CAS write of up to five
+  attempts and then a completion-marker write, per withdrawn ID
+  (`ec/kv.rs:1349-1430`, `:1115-1124`; `finalize.rs:490`, `:509-525`).
+- **Cookies make responses private.** Any response with `Set-Cookie` gets
+  `Cache-Control: private, max-age=0` and loses its edge-cache headers
+  (`response_privacy.rs:122-145`). Returning-visitor navigations set no EC
+  cookie today (`finalize.rs:124`), though they can set or expire the
+  pull-complete marker (`pull_sync_marker.rs:132-155`).
+- **The rate limiter counts in 60-second windows** and increments on every
+  check that is under the limit. Any hourly limit below 60 becomes one call
+  per minute (`ec/rate_limiter.rs:19-27`,
+  `adapter-fastly/src/rate_limiter.rs:41-74`). Pull sync keys it on `ec_hash`
+  (`pull_sync.rs:373`), the HMAC of the client IP (`generation.rs:83-93`), so
+  everyone behind one address shares one budget.
+- **The shim's `ts-eids` is small.** It is trimmed to 3,072 encoded bytes,
+  lives one day and has no EID-level `ext` (EID fidelity spec §4.3). The
+  server accepts up to 8 KB (`ec/prebid_eids.rs:24`). This spec changes
+  only the trim order: registered sources are kept first (section 5.3).
+- **Prebid Server receives the browser's cookies.** The Prebid transport
+  copies the inbound `Cookie` header into every Prebid Server call and strips
+  only consent cookies, only in `OpenrtbOnly` mode
+  (`integrations/prebid.rs:2091-2108`,
+  `consent_config.rs:137-150`). The publisher proxy forwards the `Cookie`
+  header to the origin unchanged (`publisher.rs:3124-3147`).
+
+## 4. Architecture
+
+### 4.1 Overview
+
+```mermaid
+flowchart TD
+    subgraph Writer["Writer request: a top-level navigation"]
+        A[Read ts-ec, consent, ts-eids] --> C[Returning EC:<br/>KV snapshot read]
+        C --> D[Pick eligible providers]
+        D --> E[Hold-mode providers, if the<br/>navigation runs an auction]
+        E --> F[Finalize: queue changes]
+        F --> G[Send response]
+        G --> H[After-send provider due:<br/>re-read live row]
+        H --> I[After-send providers]
+        I --> J[Apply IdentityMutation:<br/>one conditional write]
+    end
+    subgraph Stagers["Stagers: /auction, /_ts/page-bids, integration proxy"]
+        K[Read KV where the<br/>route reads it today] --> L[No providers;<br/>revoke-only capture]
+        L --> M[Mirror payload in the JSON response;<br/>a captured revocation writes KV]
+    end
+```
+
+The design has four parts:
+
+1. **`IdentityProvider` trait** (sections 4.2 to 4.6). One per vendor.
+2. **`IdentityCoordinator`** (section 4.7). Shared. Chooses providers,
+   dispatches them, turns results into changes.
+3. **`IdentityMutation`** (section 5.4). A request-scoped accumulator. Every
+   KV change in the writer request is added to it, and it is applied with one
+   write.
+4. **The mirror** (section 6.2). `ts-eids-s` is a client-only cookie the
+   shim writes from the servable server set, for page scripts. The server
+   sets no identity cookie of its own beyond `ts-ec`.
+
+New code lives in `crates/trusted-server-core/src/ec/identity/`:
+
+| File              | Contents                                                                        |
+| ----------------- | ------------------------------------------------------------------------------- |
+| `mod.rs`          | Module docs, re-exports                                                         |
+| `ids.rs`          | `IdentityProviderId`, `SourceDomain`, `UnixTime`                                |
+| `provider.rs`     | The `IdentityProvider` and `IdentityProviderConfig` traits                      |
+| `descriptor.rs`   | `ProviderDescriptor`, `Resolves`, `Captures`, `Input`, `ConsentPolicy`          |
+| `input.rs`        | `ResolveInput`, `CaptureInput`, `StoredId`, `HashedEmail`                       |
+| `exchange.rs`     | `ProviderRequest`, `ProviderResponse`                                           |
+| `resolution.rs`   | `Resolution`, `ResolvedEid`, `ResolvedUid`, `IdentityProviderError`, entry sets |
+| `policy.rs`       | Consent policy evaluation and the consent fingerprint                           |
+| `revision.rs`     | Revisions and the UID hashes of `ps.iv` and `ps.ov`                             |
+| `catalog.rs`      | The configured providers, their narrowed sources and source ownership           |
+| `servable.rs`     | The servability check of section 7.1                                            |
+| `coordinator.rs`  | Eligibility, dispatch, circuit breaker, result-to-change map                    |
+| `mutation.rs`     | `IdentityMutation` and its merge into a live `KvEntry`                          |
+| `mirror.rs`       | The `ts-eids-s` mirror payload and its size cap                                 |
+| `request.rs`      | The writer decision and the request's identity state                            |
+| `removal.rs`      | The capture removal write of section 5.3                                        |
+| `runtime.rs`      | `IdentityRuntime`: the catalog and keys an adapter builds once                  |
+| `flush.rs`        | Phase 4, the single write after send                                            |
+| `generic_pull.rs` | `GenericPullProvider`, today's pull sync on the trait                           |
+| `config.rs`       | `[ec.identity]` settings and ownership validation                               |
+| `test_support.rs` | `ProviderHarness`, a fake HTTP client and a write-counting KV store             |
+
+### 4.2 The trait
+
+The trait follows five rules:
+
+- **One required method.** A provider implements `descriptor`. It adds a
+  capability by declaring it in the descriptor and overriding the matching
+  methods. Every other method has a default body.
+- **Declarative.** What a provider is, may write, needs and must respect
+  lives in one `ProviderDescriptor`. It is built from config with no
+  secrets, so `ts config validate` and the running coordinator read the same
+  data.
+- **No I/O.** The coordinator sends requests, buffers, decodes and caps
+  responses, and does all KV and cookie work. Providers only build requests
+  and read buffered bytes, so the trait is synchronous and needs no
+  `async_trait`. `AuctionProvider` parses asynchronously so that it can drain
+  streaming bodies. The coordinator buffers instead, because it has to cap
+  response bytes anyway.
+- **Pure.** `request`, `response` and `capture` have no side effects and no
+  hidden inputs. Randomness comes only from `ResolveInput::random_bytes`,
+  and anything `response` needs from `request` travels in the call context
+  (section 4.5). The coordinator calls `request` at most once per
+  dispatch.
+- **Safe defaults.** The default consent policy is the strictest one, a
+  provider can read only what it declared, and a capability declared but not
+  implemented fails loudly in tests (section 13).
+
+```rust
+/// A vendor that turns server-side request signals into EIDs.
+///
+/// Only [`descriptor`](Self::descriptor) is required. A provider adds a
+/// capability by declaring it in its descriptor and overriding the matching
+/// methods:
+///
+/// - active resolution: [`Resolves`], plus [`request`](Self::request) and
+///   [`response`](Self::response)
+/// - passive capture: [`Captures`], plus [`capture`](Self::capture)
+///
+/// Methods added to this trait later get default bodies, so existing
+/// providers keep compiling. No method takes generic parameters, so the
+/// trait stays object-safe. Every default body returns the
+/// [`IdentityProviderError::not_implemented`] marker, so a capability that is
+/// declared but not implemented is caught by the harness.
+pub trait IdentityProvider: Send + Sync {
+    /// What this provider is, what it may write, what it needs and which
+    /// consent it requires.
+    fn descriptor(&self) -> &ProviderDescriptor;
+
+    /// Builds the call for this request, or `None` to skip it this time.
+    ///
+    /// Skipping is not a failure: the coordinator waits `refresh_after_sec`
+    /// before asking again (section 8).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::UndeclaredInput`] when it reads
+    /// something its descriptor did not declare, or another
+    /// [`IdentityProviderError`] when the request cannot be built.
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let _ = input;
+        Err(IdentityProviderError::not_implemented("request"))
+    }
+
+    /// Turns the buffered response to [`request`](Self::request) into a
+    /// resolution.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Rejected`] for a refusal and
+    /// [`IdentityProviderError::Malformed`] for a body it cannot parse.
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let _ = (response, input);
+        Err(IdentityProviderError::not_implemented("response"))
+    }
+
+    /// Reads IDs from a response TS proxied for this provider, with no
+    /// outbound call. [`Resolution::no_match`] means the response held
+    /// nothing to capture, and costs nothing: capture never backs off.
+    ///
+    /// # Errors
+    ///
+    /// Returns an [`IdentityProviderError`] only for a provider bug. A body
+    /// it does not recognise is `Ok(Resolution::no_match())`, not an error.
+    fn capture(
+        &self,
+        input: &CaptureInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let _ = input;
+        Err(IdentityProviderError::not_implemented("capture"))
+    }
+}
+
+/// Implemented by each identity integration's config type.
+///
+/// Builds the provider's descriptor from config alone, with no secrets, so
+/// `ts config validate` checks ownership against the same descriptor the
+/// running provider uses.
+pub trait IdentityProviderConfig: IntegrationConfig {
+    /// Describes the provider this config enables.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the config cannot
+    /// describe a valid provider.
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>>;
+}
+```
+
+A provider's constructor calls its config's `build_descriptor()` and stores
+the result, so the validated descriptor and the running one are the same
+value. The two methods have different names so that a type implementing both
+traits never hits an ambiguous call. `IntegrationConfig` is the existing
+config trait (`settings.rs:235`), so identity configs load like every other
+integration config.
+
+**How each change stays additive.** Vendor providers live in
+`trusted-server-core` today, and `#[non_exhaustive]` has no effect inside its
+defining crate. So additivity rests on construction rules, with
+`#[non_exhaustive]` as extra protection for providers that move into their
+own crates under #777:
+
+| Change                  | Why existing providers keep compiling                                                                      |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------- |
+| A new capability        | A new trait method with a default body, and a new descriptor builder method                                |
+| A new input             | A new `Input` variant and a new accessor. Providers list inputs; they never match on `Input`               |
+| A new field on any type | Every public struct has private fields and is built through constructors or builders                       |
+| A new outcome           | A new `Resolution` constructor. Providers build resolutions, never match on them                           |
+| A new consent signal    | Providers keep compiling. By design they fail closed: `strict()` blocks the signal until a vendor opts out |
+| A new resolve kind      | Kinds are opt-in: a provider is dispatched only for the kinds it lists (default `Initial`, `Refresh`)      |
+| A new error             | Errors are built through constructors such as `IdentityProviderError::rejected(status)`                    |
+
+Providers compare kinds with predicates (`input.is_refresh(&source)`) rather
+than `match`. Operator settings (`[ec.identity.providers.<id>]`: mode,
+timeouts, source narrowing, caps) are applied by the coordinator on top of
+the descriptor. Providers never read them.
+
+**Conventions for the listings below.** Every builder method and getter is
+`#[must_use]`. `Resolves`, `Captures` and `EidProvenance` implement
+`Default`. `Input`, `Access`, `ResolveKind` and `UsOptOut` derive
+`Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord,
+derive_more::Display`.
+`When` derives `Debug, Clone, Copy, PartialEq, Eq` only, because `Duration`
+has no `Display`. `ProviderRequest` derives `Debug, Clone`. `StoredId` and
+`HashedEmail` derive `Clone` and have redacting `Debug` implementations
+(section 9.3).
+`StateChange` derives `Debug, PartialEq, Eq`. `ProviderDescriptor`,
+`Resolves`, `Captures`, `ConsentPolicy` and `EidProvenance` derive
+`Debug, Clone, PartialEq, Eq`, so tests can compare descriptors. `UnixTime`
+derives
+`Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord`. `ResolvedEid` and
+`ResolvedUid` derive `Clone` and have redacting `Debug` implementations
+(section 9.3). `IdentityProviderId`
+and `SourceDomain` derive `Debug, Clone, PartialEq, Eq, Hash, PartialOrd,
+Ord, derive_more::Display` and implement `FromStr` (with
+`type Err = Report<IdentityProviderError>`), `Serialize` and `Deserialize`.
+Every fallible function documents `# Errors`, and every public item has a
+doc comment. The listings abbreviate these.
+
+### 4.3 The descriptor
+
+```rust
+let descriptor = ProviderDescriptor::builder("exampleid".parse()?)
+    .with_source("exampleid.example.com".parse()?)
+    .with_resolves(
+        Resolves::new()
+            .with_endpoint("https://api.exampleid.example.com/v1/fetch")
+            .with_needs([Input::ClientIp, Input::UserAgent])
+            .with_wants([Input::PageUrl]),
+    )
+    .with_consent_policy(
+        ConsentPolicy::strict()
+            .with_tcf_purposes([4])
+            .with_tcf_vendor(9999),
+    )
+    .build()?;
+```
+
+```rust
+impl ProviderDescriptor {
+    pub fn builder(id: IdentityProviderId) -> ProviderDescriptorBuilder;
+    pub fn id(&self) -> &IdentityProviderId;
+    pub fn sources(&self) -> &[SourceDomain];
+    /// The first source added. Every built descriptor has one.
+    pub fn primary_source(&self) -> &SourceDomain;
+    /// Finds a declared source by a vendor's spelling of it, normalized.
+    pub fn source_named(&self, name: &str) -> Option<&SourceDomain>;
+    pub fn resolves(&self) -> Option<&Resolves>;
+    /// The endpoint declared with `Resolves::with_endpoint`, if any.
+    pub fn endpoint(&self) -> Option<&Url>;
+    pub fn captures(&self) -> Option<&Captures>;
+    pub fn consent_policy(&self) -> &ConsentPolicy;
+    pub fn provenance(&self, source: &SourceDomain) -> Option<&EidProvenance>;
+    /// Whether IDs of `source` are declared as expiring.
+    pub fn is_expiring(&self, source: &SourceDomain) -> bool;
+}
+
+impl ProviderDescriptorBuilder {
+    /// Adds a source this provider may write. Repeatable.
+    pub fn with_source(self, source: SourceDomain) -> Self;
+    /// Declares active resolution.
+    pub fn with_resolves(self, resolves: Resolves) -> Self;
+    /// Declares passive capture.
+    pub fn with_captures(self, captures: Captures) -> Self;
+    /// Replaces the default policy, [`ConsentPolicy::strict`].
+    pub fn with_consent_policy(self, policy: ConsentPolicy) -> Self;
+    /// Marks the IDs of every declared source as expiring (section 6.1).
+    pub fn with_expiring_ids(self) -> Self;
+    /// Marks the IDs of one declared source as expiring, for a provider
+    /// whose sources differ.
+    pub fn with_expiring_source(self, source: &SourceDomain) -> Self;
+    /// Default EID-level fields for a declared source. At output, the
+    /// coordinator applies them to a stored entry of that source, written
+    /// by this provider, only when the entry sets none of `inserter`,
+    /// `matcher` and `mm`. An entry that sets any of them is the vendor's
+    /// complete statement, so vendor and config provenance never mix in one
+    /// entry. The defaults are not stored, so a config change applies at
+    /// once.
+    pub fn with_provenance(self, source: &SourceDomain, provenance: EidProvenance) -> Self;
+    /// # Errors
+    ///
+    /// Returns `Config` when the descriptor has no source, no capability, a
+    /// resolver with no endpoint or host, an endpoint that is not an `https`
+    /// URL, a host that is not a bare hostname, provenance or an expiring
+    /// mark for a source it does not declare, or a provenance `inserter` or
+    /// `matcher` that is blank or over 255 bytes, or an `mm` below 0.
+    pub fn build(self) -> Result<ProviderDescriptor, Report<IdentityProviderError>>;
+}
+
+impl Resolves {
+    pub fn new() -> Self;
+    /// The endpoint the provider calls, as config spells it. `build()`
+    /// parses it and requires `https`. Its host becomes an allowed host.
+    pub fn with_endpoint(self, endpoint: &str) -> Self;
+    /// Adds another host the provider may call. Repeatable.
+    pub fn with_host(self, host: &str) -> Self;
+    /// Inputs required for every kind. Without them the provider is skipped.
+    pub fn with_needs(self, inputs: impl IntoIterator<Item = Input>) -> Self;
+    /// Inputs required for one kind only.
+    pub fn with_needs_for(self, kind: ResolveKind, inputs: impl IntoIterator<Item = Input>) -> Self;
+    /// Inputs passed when available, never required.
+    pub fn with_wants(self, inputs: impl IntoIterator<Item = Input>) -> Self;
+    /// The kinds this provider handles. Default: `Initial` and `Refresh`.
+    pub fn with_kinds(self, kinds: impl IntoIterator<Item = ResolveKind>) -> Self;
+    /// This provider keeps private state in KV (`ps.st`, section 6.1). It
+    /// can then read [`ResolveInput::state`] and return a state change.
+    pub fn with_private_state(self) -> Self;
+    /// Keeps an expired record this provider wrote for a source it owns as
+    /// a refresh anchor until `exp` plus `grace` (section 5.4, step 4), for
+    /// a provider without private state whose refresh accepts an expired
+    /// ID. `build()` rejects it without the `Refresh` kind or with a zero
+    /// grace.
+    pub fn with_refresh_grace(self, grace: Duration) -> Self;
+}
+
+impl Captures {
+    pub fn new() -> Self;
+    /// Offers proxied responses to exactly this method and path. Repeatable.
+    pub fn with_path(self, method: Method, path: &str) -> Self;
+    /// Offers proxied responses whose path starts with `prefix`. Repeatable.
+    pub fn with_path_prefix(self, prefix: &str) -> Self;
+}
+
+/// Default EID-level fields (OpenRTB 2.6 §3.2.27) that bidders read, such as
+/// who inserted an ID and how it was matched. A provider whose vendor
+/// returns these per response sets them on each `ResolvedEid` instead
+/// (section 4.5). An unset field stays unset: OpenRTB 2.6 reads a missing
+/// `matcher` as `source`, so a default never needs a blank value.
+impl EidProvenance {
+    pub fn new() -> Self;
+    pub fn with_inserter(self, inserter: &str) -> Self;
+    pub fn with_matcher(self, matcher: &str) -> Self;
+    pub fn with_mm(self, mm: i32) -> Self;
+
+    pub fn inserter(&self) -> Option<&str>;
+    pub fn matcher(&self) -> Option<&str>;
+    pub fn mm(&self) -> Option<i32>;
+}
+
+/// An input a provider can ask for. Consent strings, the provider's stored
+/// IDs, the publisher domain, the time and the declared endpoint are always
+/// available. Private state is available to providers declared
+/// `with_private_state()`.
+#[non_exhaustive]
+pub enum Input {
+    ClientIp,
+    UserAgent,
+    /// The top-level page URL without query string or fragment.
+    PageUrl,
+    /// Country and subdivision only.
+    Region,
+    HashedEmail,
+}
+
+/// Something a provider read without declaring it.
+#[non_exhaustive]
+pub enum Access {
+    Input(Input),
+    Endpoint,
+    PrivateState,
+}
+
+impl ConsentPolicy {
+    /// The default. Blocked when any consent signal present cannot be
+    /// decoded. Where TCF applies, requires Purpose 1 and the purposes and
+    /// vendor the provider declares. Blocked by every US opt-out TS decodes
+    /// (sale, sharing, targeted advertising, and the GPC and known-child
+    /// fields of GPP sections), by `Sec-GPC: 1` and by `DNT: 1`.
+    pub fn strict() -> Self;
+    /// Declares the TCF purposes the provider processes under consent, as
+    /// its GVL entry lists them. Each is required where TCF applies, beside
+    /// Purpose 1, which is always required.
+    pub fn with_tcf_purposes(self, purposes: impl IntoIterator<Item = u8>) -> Self;
+    /// Requires vendor consent for this IAB Global Vendor List ID.
+    pub fn with_tcf_vendor(self, vendor_id: u16) -> Self;
+    /// Declares that the provider has no GVL ID, so purpose consent alone
+    /// lets it run where TCF applies. Needs a documented legal basis.
+    pub fn without_tcf_vendor(self) -> Self;
+    /// Relaxations. Each needs a documented legal basis in the vendor spec.
+    pub fn allowing_dnt(self) -> Self;
+    pub fn allowing_gpc(self) -> Self;
+    pub fn allowing_us_opt_out(self, opt_out: UsOptOut) -> Self;
+}
+
+#[non_exhaustive]
+pub enum UsOptOut {
+    Sale,
+    Sharing,
+    TargetedAdvertising,
+}
+
+impl SourceDomain {
+    pub fn as_str(&self) -> &str;
+    /// Whether a vendor's spelling of a source names this one, after
+    /// normalization.
+    pub fn matches(&self, name: &str) -> bool;
+}
+```
+
+**Declared purposes and vendor.** Decided after the round 14 review. A
+fixed purpose set fits no vendor: one GVL entry lists purposes another does
+not. So `strict()` requires only Purpose 1, and `build()` returns `Config`
+for a descriptor with `resolves` whose policy never calls
+`with_tcf_purposes`, or names no vendor with `with_tcf_vendor` and does not
+call `without_tcf_vendor`. TCF Policies, Chapter III, Policy 14(3) needs a
+legal basis for each vendor's processing, so purpose consent alone is
+never the default. A capture-only provider needs neither, because it sends
+nothing. Generic pull keeps its parity policy (`eid_persistence_only`,
+section 10.4), which checks no TCF purpose or vendor, as pull sync does
+today.
+
+The full EC ID is not an `Input`. A public variant would let any provider
+declare it, and only generic pull may receive it. `Resolves` has a
+`pub(in crate::ec::identity)` method, `with_ec_id()`, and `ResolveInput` an
+accessor with the same visibility. Only `generic_pull.rs` uses them.
+
+Every capture path and prefix must lie under the registering integration's
+own proxy routes (`IntegrationProxy::routes`, `integrations/registry.rs:316`).
+`IntegrationRegistration::build()` cannot fail
+(`integrations/registry.rs:720-722`),
+so the check runs in `IntegrationRegistry::with_plan`
+(`integrations/registry.rs:842-865`), which already returns an error and
+merges every registration. The error names the integration.
+
+`IdentityProviderId` is separate from `crate::auction::ProviderId`
+(`auction/plan.rs:24-77`) but follows the same pattern. `FromStr` accepts
+`^[a-z][a-z0-9_-]{0,62}$`, so an ID can be a bare TOML key and can equal an
+integration ID that uses `_`. `SourceDomain::from_str` goes through
+`normalize_partner_source_domain` (`ec/partner.rs:20`), mapping its `String`
+error to `Config`, so `"…".parse()?` composes inside `build_descriptor`.
+
+```rust
+impl ProviderConsent {
+    pub fn gdpr_applies(&self) -> bool;
+    pub fn raw_tc_string(&self) -> Option<&str>;
+    pub fn raw_gpp_string(&self) -> Option<&str>;
+    pub fn gpp_section_ids(&self) -> Option<&[u16]>;
+    pub fn raw_us_privacy(&self) -> Option<&str>;
+}
+```
+
+### 4.4 Inputs
+
+The coordinator gives a provider only what its descriptor declared. When the
+sources in one request have different kinds, the inputs of every kind
+present are available, and the provider uses `is_initial` or `is_refresh` to
+decide per source. A required input is read with `?` and a wanted one with
+`.ok()`:
+
+```rust
+let ip = input.client_ip()?;
+let page = input.page_url().ok();
+```
+
+Accessors fail in two ways:
+
+- **`UndeclaredInput { access }`**: the descriptor never declared the input,
+  the endpoint or private state. That is a provider bug. `.ok()` would hide
+  it, so every accessor also records an undeclared read on the
+  `ResolveInput`. After `request` or `response` returns, the coordinator
+  logs any recorded
+  read as `Config`, and the harness fails the test (section 13), whatever
+  the provider did with the error.
+- **`InputUnavailable { input }`**: the input was declared but is missing
+  this time, for example a wanted input or one declared only for another
+  kind. That is a normal skip, handled like `request` returning `None`.
+
+```rust
+impl ResolveInput<'_> {
+    /// The sources to resolve this time, each with its own kind.
+    pub fn sources(&self) -> impl Iterator<Item = (&SourceDomain, ResolveKind)> + '_;
+    pub fn is_initial(&self, source: &SourceDomain) -> bool;
+    pub fn is_refresh(&self, source: &SourceDomain) -> bool;
+    /// The descriptor's primary source, for single-source providers.
+    pub fn primary_source(&self) -> &SourceDomain;
+    /// The stored record for one of this provider's sources, valid or
+    /// expired.
+    pub fn stored(&self, source: &SourceDomain) -> Option<&StoredId>;
+    /// This provider's private state. The raw JSON is loaded once per
+    /// request and decoded on each call. `Ok(None)` when there is none.
+    ///
+    /// # Errors
+    ///
+    /// `InvalidState` when the stored state does not decode as `T`, for
+    /// example after a schema change. The failed decode is recorded on the
+    /// `ResolveInput`, like an undeclared read, and the coordinator clears
+    /// the stored state whatever the provider returns, so the next call
+    /// starts fresh (section 8). Without `with_private_state()` it is
+    /// `UndeclaredInput`.
+    pub fn state<T: DeserializeOwned>(&self) -> Result<Option<T>, Report<IdentityProviderError>>;
+    /// The endpoint declared with `Resolves::with_endpoint`.
+    pub fn endpoint(&self) -> Result<&Url, Report<IdentityProviderError>>;
+    pub fn consent(&self) -> &ProviderConsent;
+    pub fn publisher_domain(&self) -> &str;
+    pub fn now(&self) -> UnixTime;
+    /// Random bytes from the platform's generator, the one EC generation
+    /// already uses (`ec/generation.rs:52-56`). Fixed by the harness, so
+    /// tests are deterministic.
+    pub fn random_bytes<const N: usize>(&self) -> [u8; N];
+
+    pub fn client_ip(&self) -> Result<IpAddr, Report<IdentityProviderError>>;
+    pub fn user_agent(&self) -> Result<&str, Report<IdentityProviderError>>;
+    pub fn page_url(&self) -> Result<&Url, Report<IdentityProviderError>>;
+    pub fn region(&self) -> Result<&Region, Report<IdentityProviderError>>;
+    pub fn hashed_email(&self) -> Result<&HashedEmail, Report<IdentityProviderError>>;
+}
+
+impl CaptureInput<'_> {
+    /// The proxied request path, without query string.
+    pub fn path(&self) -> &str;
+    pub fn response(&self) -> &ProviderResponse;
+    pub fn primary_source(&self) -> &SourceDomain;
+    pub fn source_named(&self, name: &str) -> Option<&SourceDomain>;
+    pub fn stored(&self, source: &SourceDomain) -> Option<&StoredId>;
+    /// The request's consent, from its cookies and headers.
+    pub fn consent(&self) -> &ProviderConsent;
+    pub fn publisher_domain(&self) -> &str;
+    pub fn now(&self) -> UnixTime;
+}
+
+#[non_exhaustive]
+pub enum ResolveKind {
+    /// No stored record for the source.
+    Initial,
+    /// A stored record exists, valid or expired, and is due (section 4.7,
+    /// step 4). The provider decides whether it can refresh an expired one;
+    /// if not, it returns `None` for that source.
+    Refresh,
+}
+
+/// A source's stored record: its entry set and the record's metadata.
+impl StoredId {
+    /// Every stored entry for the source, in stored order, with its UIDs and
+    /// EID-level fields. A record that browser ingest, generic pull, batch
+    /// sync or a schema version 1 row wrote is one entry with one UID.
+    pub fn eids(&self) -> &[Eid];
+    /// The first UID of the first entry. What a single-UID refresh, such as
+    /// LiveRamp's, sends back.
+    pub fn uid(&self) -> &str;
+    /// The `atype` of that first UID.
+    pub fn atype(&self) -> Option<i32>;
+    /// The UID-level ext of that first UID, as bidders read it in
+    /// `uids[].ext`.
+    pub fn ext(&self) -> Option<&serde_json::Value>;
+    /// The provider that wrote it. `None` for browser ingest and version 1
+    /// records.
+    pub fn writer(&self) -> Option<&IdentityProviderId>;
+    pub fn acquired_at(&self) -> Option<UnixTime>;
+    pub fn expires_at(&self) -> Option<UnixTime>;
+    pub fn refresh_at(&self) -> Option<UnixTime>;
+    pub fn is_expired(&self, now: UnixTime) -> bool;
+}
+
+impl Region {
+    /// ISO 3166-1 alpha-2, upper case, for example `"US"`.
+    pub fn country(&self) -> &str;
+    /// The ISO 3166-2 subdivision without the country prefix, upper case,
+    /// for example `"CA"`. `None` when the platform does not know it.
+    pub fn subdivision(&self) -> Option<&str>;
+    /// Whether this is `country` and `subdivision`.
+    pub fn is(&self, country: &str, subdivision: &str) -> bool;
+}
+
+impl HashedEmail {
+    pub fn as_bytes(&self) -> &[u8; 32];
+    /// Lowercase hex, as LiveRamp takes it.
+    pub fn to_hex(&self) -> String;
+    /// Standard base64, as UID2 takes it.
+    pub fn to_base64(&self) -> String;
+}
+
+impl UnixTime {
+    pub fn from_secs(secs: u64) -> Self;
+    /// For vendors such as Lockr and UID2 that send milliseconds.
+    pub fn from_millis(millis: u64) -> Self;
+    pub fn as_secs(self) -> u64;
+}
+
+impl Add<Duration> for UnixTime {
+    type Output = UnixTime;
+}
+```
+
+`ProviderConsent` is a view of the request's `ConsentContext`
+(`consent/types.rs:109-148`) with the raw strings providers forward and
+`gdpr_applies`. It leaves out the decoded detail and `jurisdiction`.
+Providers never decide consent: the coordinator has already applied the
+descriptor's policy. The raw GPP string and its section IDs still show which
+US state section applies, so withholding `jurisdiction` hides only TS's
+decoded reading of it.
+
+Where each input comes from. Phase 1 captures the user agent, DNT and the
+page URL into `EcContext`, because after-send code no longer has the request
+(section 3.4):
+
+- **`ClientIp`**: `services.client_info().client_ip`, the platform's address
+  (as `publisher.rs:5574-5578` does), never a request header and never the
+  normalized EC IP.
+- **`PageUrl`**: the navigation URL, the only request providers run on
+  (section 4.7, step 7). Always without query string or fragment. A path
+  can still carry identifiers on some sites, so `PageUrl` is a wanted input
+  for most providers, never needed.
+- **`Region`**: from the request's `GeoInfo`
+  (`adapter-fastly/src/app.rs:423-432`).
+  `GeoInfo.region` is a free-form `Option<String>` (`platform/types.rs:32`),
+  so the coordinator normalizes it to the ISO 3166-2 subdivision and upper
+  case. City, coordinates, metro and ASN are never passed.
+
+`HashedEmail` holds the 32 raw bytes of a SHA-256 digest. Its `Debug` output
+is redacted. No code in v1 constructs one.
+
+The coordinator supplies `now` from `checked_current_timestamp()`
+(`ec/mod.rs:736-748`) and skips identity work for the request when the clock
+fails, because a zero time would make every expiry check pass.
+
+### 4.5 Requests, responses and results
+
+```rust
+impl ProviderRequest {
+    pub fn get(url: &Url) -> Self;
+    pub fn post_json(url: &Url, body: &impl Serialize) -> Result<Self, Report<IdentityProviderError>>;
+    /// A POST with a `text/plain` body, for APIs that send base64 text.
+    pub fn post_text(url: &Url, body: &str) -> Self;
+    /// Any method, for APIs the helpers above do not fit. `get`, `post_json`
+    /// and `post_text` are shorthands for this.
+    pub fn new(method: Method, url: &Url) -> Self;
+    /// Sets the body and its `Content-Type`.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Config` when `content_type` is not a valid header value.
+    pub fn with_body(self, content_type: &str, body: Vec<u8>) -> Result<Self, Report<IdentityProviderError>>;
+    pub fn with_query(self, name: &str, value: &str) -> Self;
+    /// Both header helpers accept any header. A `Cookie` header, from
+    /// either, makes the coordinator refuse to send the request, and the
+    /// harness's conformance check fails it (section 13).
+    pub fn with_header(self, name: HeaderName, value: HeaderValue) -> Self;
+    /// For dynamic values. Rejects an invalid name or value.
+    pub fn try_with_header(self, name: &str, value: &str) -> Result<Self, Report<IdentityProviderError>>;
+    /// Adds `Authorization: Bearer <token>`.
+    pub fn with_bearer(self, token: &Redacted<String>) -> Self;
+    /// Data `response` needs from this call, such as a nonce or which
+    /// endpoint was used. Kept in memory with the call, never sent.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Config` when it does not serialize, or is over 1,024 bytes
+    /// of JSON.
+    pub fn try_with_call_context(self, context: &impl Serialize) -> Result<Self, Report<IdentityProviderError>>;
+    pub fn method(&self) -> &Method;
+    pub fn url(&self) -> &Url;
+    pub fn headers(&self) -> &HeaderMap;
+    pub fn body(&self) -> &[u8];
+}
+
+impl ProviderResponse {
+    pub fn status(&self) -> StatusCode;
+    pub fn header(&self, name: &str) -> Option<&str>;
+    /// The decoded body. The coordinator undoes `Content-Encoding` first.
+    pub fn body(&self) -> &[u8];
+    /// Parses the body as JSON, whatever the status. A parse failure is
+    /// `Malformed`.
+    pub fn json<T: DeserializeOwned>(&self) -> Result<T, Report<IdentityProviderError>>;
+    /// Requires a 2xx status, else `Rejected`, then parses the body as JSON.
+    pub fn success_json<T: DeserializeOwned>(&self) -> Result<T, Report<IdentityProviderError>>;
+    /// Requires a 2xx status, else `Rejected`, and a UTF-8 body, else
+    /// `Malformed`.
+    pub fn success_text(&self) -> Result<&str, Report<IdentityProviderError>>;
+    /// The context the request carried, decoded. `Ok(None)` when there was
+    /// none; a context that does not decode as `T` is `Config`.
+    pub fn call_context<T: DeserializeOwned>(&self) -> Result<Option<T>, Report<IdentityProviderError>>;
+}
+
+impl Resolution {
+    /// One or more EID entries. A source may appear in several entries, in
+    /// the order bidders should see them. The entries of one source form its
+    /// new entry set. For an owned source it replaces the stored set whole
+    /// (section 6.1); for an unowned source it only fills an absent or
+    /// expired record (`FillMissing`, section 7.2) and is never replaced by
+    /// its writer. A source the result does not name is left as it is. An
+    /// empty result becomes `no_match`, and `is_no_match()` then returns
+    /// true.
+    pub fn found(eids: impl IntoIterator<Item = ResolvedEid>) -> Self;
+    /// The provider recognized no one, or a capture held nothing.
+    pub fn no_match() -> Self;
+    /// The stored ID for `source` is no longer valid.
+    pub fn invalidate(source: &SourceDomain) -> Self;
+    /// The provider reports the user opted out.
+    pub fn opted_out() -> Self;
+    /// Also invalidates `source`. Chainable after `found`, so one response
+    /// can return some sources and drop others.
+    pub fn also_invalidate(self, source: &SourceDomain) -> Self;
+    /// The earliest the coordinator may call again. Default: 24 hours after
+    /// `no_match`, none otherwise.
+    pub fn with_retry_in(self, delay: Duration) -> Self;
+    /// Replaces the provider's private state.
+    ///
+    /// The state is stored as embedded JSON of at most 1,024 bytes. A larger
+    /// value rejects the result's positive part whole (section 5.4): no ID,
+    /// state or scheduling change is stored, the old state stays, and the
+    /// call is handled as `Malformed`. The result's removals still apply.
+    /// From a provider not declared
+    /// `with_private_state()`, the whole resolution is a `Config` error.
+    /// `capture` never changes state: a state change in a capture result is
+    /// ignored with a warning, and the harness fails the test.
+    pub fn replacing_state(self, state: &impl Serialize) -> Self;
+    pub fn clearing_state(self) -> Self;
+
+    pub fn eids(&self) -> &[ResolvedEid];
+    pub fn invalidated(&self) -> &[SourceDomain];
+    pub fn is_no_match(&self) -> bool;
+    pub fn is_opted_out(&self) -> bool;
+    pub fn retry_in(&self) -> Option<Duration>;
+    pub fn state_change(&self) -> StateChange<'_>;
+}
+
+pub enum StateChange<'a> {
+    Keep,
+    /// The new state as JSON.
+    Replace(&'a str),
+    Clear,
+}
+
+/// One OpenRTB EID entry a provider returns: a source, its UIDs and its
+/// EID-level fields.
+impl ResolvedEid {
+    /// An entry with one UID, the common case.
+    pub fn new(source: &SourceDomain, uid: ResolvedUid) -> Self;
+    /// Adds another UID to this entry. Repeatable.
+    pub fn with_uid(self, uid: ResolvedUid) -> Self;
+    /// EID-level fields. An entry that sets any of `inserter`, `matcher`
+    /// and `mm` takes no `with_provenance` default (section 4.3).
+    pub fn with_inserter(self, inserter: &str) -> Self;
+    pub fn with_matcher(self, matcher: &str) -> Self;
+    pub fn with_mm(self, mm: i32) -> Self;
+    /// EID-level ext. Over 2,048 bytes as compact JSON it is dropped and
+    /// the entry kept.
+    pub fn with_ext(self, ext: serde_json::Value) -> Self;
+    /// Timing applies to the source's whole entry set. When several entries
+    /// of one source set it, the earliest time wins (below).
+    pub fn with_expires_in(self, delay: Duration) -> Self;
+    pub fn with_expires_at(self, at: UnixTime) -> Self;
+    pub fn with_refresh_in(self, delay: Duration) -> Self;
+    pub fn with_refresh_at(self, at: UnixTime) -> Self;
+    /// When this ID stops being refreshable, such as a refresh token's
+    /// expiry. Only for a provider declared `with_private_state()`; from any
+    /// other it is ignored with a warning. Until then an expired record is
+    /// kept as a refresh anchor (section 5.4).
+    pub fn with_refresh_until(self, at: UnixTime) -> Self;
+
+    pub fn source(&self) -> &SourceDomain;
+    pub fn uids(&self) -> &[ResolvedUid];
+    pub fn inserter(&self) -> Option<&str>;
+    pub fn matcher(&self) -> Option<&str>;
+    pub fn mm(&self) -> Option<i32>;
+    pub fn ext(&self) -> Option<&serde_json::Value>;
+    pub fn expiry(&self) -> Option<When>;
+    pub fn refresh(&self) -> Option<When>;
+    pub fn refresh_until(&self) -> Option<UnixTime>;
+}
+
+/// One UID within a [`ResolvedEid`].
+impl ResolvedUid {
+    pub fn new(id: impl Into<String>) -> Self;
+    pub fn with_atype(self, atype: i32) -> Self;
+    /// UID-level ext. Over 2,048 bytes as compact JSON it is dropped and the
+    /// UID kept.
+    pub fn with_ext(self, ext: serde_json::Value) -> Self;
+
+    pub fn id(&self) -> &str;
+    pub fn atype(&self) -> Option<i32>;
+    pub fn ext(&self) -> Option<&serde_json::Value>;
+}
+
+/// A time as a provider gave it: relative to `now`, or absolute.
+pub enum When {
+    In(Duration),
+    At(UnixTime),
+}
+
+/// A provider failure. Built through the constructors below.
+#[derive(Debug, derive_more::Display)]
+#[non_exhaustive]
+pub enum IdentityProviderError {
+    /// Configuration or provider code makes the call impossible.
+    #[display("identity provider configuration error: {message}")]
+    Config { message: String },
+    /// The provider read something its descriptor did not declare.
+    #[display("`{access}` was read but not declared")]
+    UndeclaredInput { access: Access },
+    /// A declared input is not available for this request.
+    #[display("input `{input}` is unavailable for this request")]
+    InputUnavailable { input: Input },
+    /// The provider refused the request.
+    #[display("provider rejected the request with status {status}")]
+    Rejected { status: StatusCode },
+    /// The provider's response could not be parsed.
+    #[display("provider response could not be parsed")]
+    Malformed,
+    /// The stored private state does not decode as the provider's type.
+    #[display("stored provider state could not be decoded")]
+    InvalidState,
+    /// Set by the coordinator only. Providers never see transport failures.
+    #[display("provider request failed in transport")]
+    Transport,
+}
+
+impl IdentityProviderError {
+    pub fn config(message: impl Into<String>) -> Report<Self>;
+    pub fn rejected(status: StatusCode) -> Report<Self>;
+    pub fn malformed() -> Report<Self>;
+    /// The default body of a capability method: a `Config` error with a
+    /// fixed marker message, so the harness can tell a missing override from
+    /// a real failure.
+    pub fn not_implemented(method: &'static str) -> Report<Self>;
+}
+
+impl core::error::Error for IdentityProviderError {}
+```
+
+Relative times (`with_expires_in`, `with_refresh_in`, `with_retry_in`) are
+resolved against the request's `now` by the coordinator, so providers rarely
+need the clock.
+
+**From entries to an entry set.** The coordinator groups a result's entries
+by source, keeping their order, and checks each group with the browser
+parser's field rules (EID fidelity spec §4.4), then with per-source caps
+the browser parser does not have: 8 entries, 32 UIDs across them, and
+`MAX_ENTRY_SET_BYTES`. The limits are counted before the result joins the
+mutation, so a stateful result whose set is discarded is handled like an
+oversized state: its positive part is rejected whole (section 5.4) and its
+removals still apply:
+
+- An entry whose source the provider does not claim (or that the operator
+  narrowed away) is discarded.
+- A UID whose `id` is empty, blank or over `MAX_UID_LENGTH`
+  (`ec/kv_types.rs:35`) is dropped. An entry left with no UID is discarded.
+- An `inserter` or `matcher` that is blank or over 255 bytes, a UID-level or
+  EID-level `ext` that is not an object or is over 2,048 bytes as compact
+  JSON, and an `mm` or `atype` below 0 are dropped as fields, and the entry
+  is kept. OpenRTB 2.6 reads a missing `matcher` as `source`, so dropping a
+  blank one keeps its meaning, unless the entry is left with no EID-level
+  field and a provenance default then applies (section 4.3).
+- An entry equal to an earlier kept entry of the same source is dropped.
+- A source keeps its first 8 entries and its first 32 UIDs across them.
+- A source's entry set over `MAX_ENTRY_SET_BYTES` (4,096 bytes) is
+  discarded whole, never trimmed, because a trimmed set is not what the
+  vendor returned. The field caps do not guarantee the set cap: a set whose
+  legal fields exceed 4,096 bytes is discarded whole. The harness fails a
+  fixture that hits this.
+
+`MAX_ENTRY_SET_BYTES` is measured on the stored `eids` array of section 6.1:
+entries without `source`, after the field rules above, without provenance
+defaults, serialized by `serde_json::to_vec`. The coordinator and
+`KvEntry::validate` call the same function, so a set one accepts the other
+accepts.
+
+A discarded set leaves the stored set as it is, as if the result did not
+name the source. A result all of whose sets are discarded is handled as
+`Malformed` (section 8): `f` grows with its backoff, and its removals still
+apply.
+
+Each discard and drop is logged with the provider ID, source and field
+only. The set's `exp`, `ra` and `ru` are the earliest values its kept
+entries set, so a set is never served or refreshed past any of its entries'
+times. A dropped entry's times do not count.
+A set of an expiring source that carries no expiry keeps the stored `exp`
+when its entries are unchanged, and is discarded otherwise, because an
+owned expiring ID without `exp` is never served (section 6.1). That
+fallback is for a vendor that omits an expiry at runtime; the harness fails
+a fixture that does.
+
+`replacing_state` with a value that does not serialize is handled like an
+oversized one: the positive part of the result is rejected whole, so a new ID
+is never stored beside refresh state that does not belong to it.
+
+### 4.6 A complete provider
+
+A fictional provider, `exampleid`, shows the whole surface: a descriptor
+built from config, a required and a wanted input, consent strings, a
+provider state round trip, a UID-level `ext` and a refresh hint.
+
+```rust
+#[derive(Debug, Clone, Deserialize, Validate)]
+pub struct ExampleIdConfig {
+    pub enabled: bool,
+    #[validate(url)]
+    pub endpoint: String,
+    pub partner_id: u32,
+    pub gvl_id: u16,
+}
+
+impl IntegrationConfig for ExampleIdConfig {
+    fn is_enabled(&self) -> bool {
+        self.enabled
+    }
+}
+
+impl IdentityProviderConfig for ExampleIdConfig {
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        ProviderDescriptor::builder(EXAMPLEID_INTEGRATION_ID.parse()?)
+            .with_source("exampleid.example.com".parse()?)
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint(&self.endpoint)
+                    .with_needs([Input::ClientIp, Input::UserAgent])
+                    .with_wants([Input::PageUrl])
+                    .with_private_state(),
+            )
+            .with_consent_policy(
+                ConsentPolicy::strict()
+                    .with_tcf_purposes([4])
+                    .with_tcf_vendor(self.gvl_id),
+            )
+            .build()
+    }
+}
+
+pub struct ExampleIdProvider {
+    descriptor: ProviderDescriptor,
+    partner_id: u32,
+}
+
+#[derive(Serialize, Deserialize)]
+struct ExampleIdState {
+    signature: String,
+}
+
+#[derive(Serialize)]
+struct FetchBody<'a> {
+    partner: u32,
+    ip: String,
+    ua: &'a str,
+    page: Option<&'a str>,
+    gdpr: bool,
+    consent: Option<&'a str>,
+    signature: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct FetchReply {
+    uid: Option<String>,
+    signature: Option<String>,
+    link_type: Option<u8>,
+    max_age_sec: Option<u64>,
+}
+
+impl ExampleIdProvider {
+    /// Builds the provider from its validated config.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`IdentityProviderError::Config`] when the config cannot
+    /// describe a valid provider.
+    pub fn new(config: &ExampleIdConfig) -> Result<Self, Report<IdentityProviderError>> {
+        Ok(Self {
+            descriptor: config.build_descriptor()?,
+            partner_id: config.partner_id,
+        })
+    }
+}
+
+impl IdentityProvider for ExampleIdProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let consent = input.consent();
+        let body = FetchBody {
+            partner: self.partner_id,
+            ip: input.client_ip()?.to_string(),
+            ua: input.user_agent()?,
+            page: input.page_url().ok().map(Url::as_str),
+            gdpr: consent.gdpr_applies(),
+            consent: consent.raw_tc_string(),
+            signature: input.state::<ExampleIdState>()?.map(|state| state.signature),
+        };
+        ProviderRequest::post_json(input.endpoint()?, &body).map(Some)
+    }
+
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let reply: FetchReply = response.success_json()?;
+        let Some(uid) = reply.uid else {
+            return Ok(Resolution::no_match());
+        };
+
+        let mut uid = ResolvedUid::new(uid).with_atype(1);
+        if let Some(link_type) = reply.link_type {
+            uid = uid.with_ext(json!({ "linkType": link_type }));
+        }
+        let mut eid = ResolvedEid::new(input.primary_source(), uid);
+        if let Some(max_age) = reply.max_age_sec {
+            eid = eid.with_refresh_in(Duration::from_secs(max_age));
+        }
+
+        let resolution = Resolution::found([eid]);
+        Ok(match reply.signature {
+            Some(signature) => resolution.replacing_state(&ExampleIdState { signature }),
+            None => resolution,
+        })
+    }
+}
+```
+
+Registration uses the existing builder (`integrations/registry.rs:636`) from
+an integration's `register` function, which returns
+`Report<TrustedServerError>` (`integrations/lockr.rs:321-323`). error-stack
+converts only `C` into `Report<C>` (`error-stack-0.6.0/src/context.rs:101`),
+so the builder does that conversion once for every vendor:
+
+```rust
+impl IntegrationRegistrationBuilder {
+    /// Registers a provider built by a fallible constructor. A failure
+    /// becomes `TrustedServerError::Integration`, naming the integration the
+    /// builder already holds.
+    pub fn try_with_identity_provider<P: IdentityProvider + 'static>(
+        self,
+        provider: Result<P, Report<IdentityProviderError>>,
+    ) -> Result<Self, Report<TrustedServerError>>;
+}
+
+Ok(Some(
+    IntegrationRegistration::builder(EXAMPLEID_INTEGRATION_ID)
+        .try_with_identity_provider(ExampleIdProvider::new(&config))?
+        .build(),
+))
+```
+
+A capture-only provider overrides one method. This fictional one reads
+tokens from the API it proxies, and returns `no_match` for any response it
+does not recognise:
+
+```rust
+impl IdentityProvider for ExampleCaptureProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn capture(
+        &self,
+        input: &CaptureInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let Ok(reply) = input.response().json::<TokenReply>() else {
+            return Ok(Resolution::no_match());
+        };
+        Ok(Resolution::found(reply.tokens.into_iter().filter_map(|token| {
+            let source = input.source_named(&token.source)?;
+            Some(
+                ResolvedEid::new(source, ResolvedUid::new(token.value))
+                    .with_expires_at(UnixTime::from_secs(token.expires)),
+            )
+        })))
+    }
+}
+```
+
+Its descriptor declares
+`.with_captures(Captures::new().with_path(Method::POST,
+"/integrations/examplecapture/api/token"))`
+and no `resolves`, so it is never dispatched. In v1 the coordinator uses a
+capture's removals and opt-out, and uses its positive IDs only as the sign
+that the vendor issued again (section 4.7). The IDs themselves are not
+stored. The trait returns them anyway, so a later durable path needs no
+trait change (section 15).
+
+### 4.7 The coordinator
+
+`IdentityCoordinator` is built per request from the registered providers and
+`[ec.identity]` settings. Its dependencies (settings, registry, KV graph,
+rate limiter, runtime services) travel in one `IdentityDeps` struct, because
+`handle_auction` and `handle_publisher_request` already take the maximum of
+seven arguments (`auction/endpoints.rs:114-122`, `publisher.rs:4433-4441`).
+
+**The eligibility view.** Eligibility reads the KV row the writer read in
+phase 1, and nothing else. It never reads `ts-eids-s`. Every removal is
+already in KV (section 5.3), so no cookie has to be applied on top.
+
+**Eligibility.** A provider that declares `resolves` is eligible for this
+request when all of these hold:
+
+1. The request is a real browser (`device_signals.looks_like_browser()`,
+   `adapter-fastly/src/app.rs:410`), the same gate pull sync uses.
+2. Global EC consent allows EC and EID persistence (`allows_eid_persistence`,
+   as `pull_sync.rs:72-77` does).
+3. The descriptor's consent policy is met (section 9.1).
+4. At least one claimed source has a kind the provider lists, computed per
+   source:
+   - **Owned by this provider.** `Initial` when there is no stored record.
+     `Refresh` when there is one, valid or expired, and it is due. A stored
+     record is due when it is expired, when this provider did not write it,
+     when its `refresh_at` has passed, or, if it has none, when
+     `acquired_at + refresh_after_sec` has passed or `acquired_at` is
+     missing. A browser-seeded value whose UID matches `ps.iv` is never due
+     (section 7.2). An expired record is never served (section 7.1), so the
+     provider either refreshes it or returns `None`. An expired record kept
+     as a refresh anchor (section 5.4) is a stored record, so the kind stays
+     `Refresh` while the provider's refresh credentials last.
+   - **Unowned.** `Initial` only, and only when KV has no unexpired ID for the
+     source. An expired record, or one whose writer is disabled or no longer
+     configured, counts as absent. Unowned sources are never refreshed
+     (section 7.2).
+   - Sources whose kind's needs are missing are left out. If none remain,
+     the provider is skipped and the skip is logged at debug.
+5. `ps.n` (next eligible time) has passed, and no sticky `ps.o` opt-out is
+   set (section 8).
+6. The provider's circuit breaker is closed (below).
+7. The request is the writer request for a returning EC, or a new
+   visitor's writer navigation that runs an auction (below). Stagers run no
+   resolving provider, in either mode. Within the writer:
+   - Hold-mode providers run before the auction when the navigation runs
+     one (matched slots). When it runs none, they run after send instead,
+     so a site whose auctions all go through `/auction` still stores their
+     answers, and its next `/auction` serves them from KV. Moved after send,
+     a hold-mode provider waits `after_send_timeout_ms`, not the hold
+     budget, and a miss is an ordinary timeout (section 8).
+   - After-send providers run after send, with `after_send_timeout_ms`.
+8. The request's backend budget has room. Fastly allows 32 backend
+   requests per execution (10 on trial accounts), and after-send calls run
+   in the same execution as the origin and the auction. `[ec.identity]
+max_backend_requests` (default 32) bounds them together: the adapter's
+   HTTP client counts every request it starts
+   (`PlatformHttpClient::requests_started`), and a provider call is sent
+   only while that count, plus a reserve, stays below the budget. A hold
+   call reserves one request for the origin and one per auction provider,
+   because both may still be ahead of it; an after-send call reserves
+   nothing. A call over budget is not dispatched, changes no `ps` field and
+   is never a failure, so it neither backs off the provider nor feeds the
+   breaker. An adapter that does not count its requests is not budgeted.
+   Pull sync today has no such bound (`ec/pull_sync.rs:184-284`).
+9. The per-visitor burst cap is not exceeded. This check comes last, just
+   before dispatch, because the Fastly limiter increments on every check under
+   the limit (`adapter-fastly/src/rate_limiter.rs:54-66`). The cap is
+   `max_calls_per_minute` on the key `identity:<provider>:<visitor>`, where
+   `visitor` is an HMAC of the full EC ID with a key derived from
+   `ec.passphrase`. It is not `ec_hash`, which everyone behind one IP shares
+   (section 3.4). Next to it, a per-IP ceiling,
+   `max_calls_per_ip_per_minute` (default 10, `0` off), counts one
+   provider's calls from one client address across every visitor behind
+   it, on `identity-ip:<provider>:<address>`, where `address` is an HMAC of
+   the request's client IP with the same derived key. Minting ECs has no
+   limiter, so without it a script that alternates a cookieless and a
+   cookied navigation would fire every eligible provider once per minted
+   EC. The ceiling is generous because carrier NAT puts many visitors
+   behind one address, and a request without a client IP skips it. A due
+   provider either cap stops is not dispatched and gets
+   `n = max(n, now + 60 s)`, one limiter window, and never a failure
+   (section 8).
+
+Pacing per visitor comes from `ps.n` and the refresh rules in step 4, not
+from the limiter. The limiter only caps bursts, because its windows are 60
+seconds long. It also keeps two overlapping writer navigations from both
+dispatching one provider. Every call runs on a writer, so every outcome,
+`no_match` and failure backoff included, is stored in `ps` (section 8).
+
+**Pre-disclosure revalidation.** Before any byte goes to a provider for a
+returning EC, the writer must have read the live KV row and found it live
+and consenting, and computed eligibility steps 4 and 5 from it. That read
+is the phase 1 read for a provider dispatched before send, and the phase 4
+re-read for one dispatched after send (section 5.2). A new visitor's first
+navigation calls only providers that never see the EC ID, before its row
+exists (below).
+
+**New visitors.** Decided after the round 14 review (section 15, question
+6). When a hold-mode provider that does not read the EC ID
+(`Resolves::gets_ec_id`) is configured, a publisher navigation from a new
+visitor mints the EC without writing (`EcContext::mint_deferred`). If the
+navigation runs an auction, the hold dispatch runs on the row the create
+will write, skipping every provider that reads the EC ID, and its answers,
+`ps.n` and `ps.f` go into that row. The create then runs, before the
+phase 1 preload and the auction, so the create stays the page load's one
+write and no ID reaches a bidder before its row exists. A collision fails
+the create rather than re-minting, because the auction is about to send the
+minted ID. A navigation that never reaches that point (no auction, an
+origin error) is created by finalize, before `ts-ec` is set. Without such a
+provider the create runs before routing, as before. Only the Fastly adapter
+defers; the others create before routing.
+
+**Dispatch.** For each eligible provider, the coordinator builds a
+`ResolveInput` holding only the declared inputs and calls `request`. It then
+checks the request before sending it:
+
+- The scheme is `https`.
+- The host is one of the descriptor's `resolves` hosts.
+- No `Cookie` header is present, and every header name and value is valid.
+
+A request that fails a check is dropped and logged as `Config`. The
+coordinator sends it through `RuntimeServices::http_client().send_async`, up
+to `max_concurrency` at once, with a backend first-byte timeout of the
+provider's timeout (`after_send_timeout_ms` after send; before the auction,
+`min(timeout_ms, remaining budget)`,
+rounded to buckets as `auction/orchestrator.rs:453-473` does). It does not
+follow redirects. The dispatch is async. Before the auction it is awaited
+inside the request handler, which already runs on an executor, so it never
+blocks on a nested executor there; after send, outside any executor, phase 4
+blocks on it once. It reads at most `max_response_bytes`, checked against
+`Content-Length` first (`pull_sync.rs:412`) and against the buffered body
+(`pull_sync.rs:472-474`). It undoes `Content-Encoding` with the same cap
+applied to the decoded size, then passes the `ProviderResponse` to
+`response`.
+
+**Hold-mode timing.** Hold-mode providers share one wall-clock budget,
+`hold_budget_ms` (default 100 ms), measured from the first dispatch. Each
+waits for `min(timeout_ms, remaining budget)`. The auction starts when all
+have answered or the budget is spent.
+
+Why 100 ms:
+
+- It is a fifth of the navigation auction's recommended 500 ms timeout
+  (`auction_timeout_ms`, `trusted-server.example.toml:336-340`). A 300 ms
+  budget would take 60% of it.
+- Browser-side guidance runs higher, from 100 to 500 ms. Prebid's
+  `auctionDelay` defaults to 500 ms (EID fidelity spec D4), and data vendors
+  recommend at least 100 or 250 ms (`adlooxRtdProvider.md:86`,
+  `51DegreesRtdProvider.md:101`). Those figures include the visitor's device
+  connecting to the vendor. An edge call skips that: it goes from the POP,
+  often over a connection Fastly already holds open.
+- Missing the budget costs that one auction the ID. A call cut off by the
+  budget is not a failure: it does not count toward `ps.f` or the breaker.
+  It sets `ps.n = now + hold_retry_sec` (default 300 seconds), so the next
+  navigation does not wait on the same slow provider straight away.
+
+The coordinator logs each provider's response time. An operator raises the
+budget only when a provider's measured p95 latency at the edge exceeds it.
+
+On the navigation, holding has a latency cost, and it depends on the
+order of section 3.4:
+
+- **Origin first** (Fastly's default for a returning EC in Inline mode).
+  The origin request is already in flight, so the first byte slips by
+  `max(0, preload + hold + dispatch - origin TTFB)`. A fast origin pays up
+  to the whole hold; a slow one pays nothing.
+- **Auction first** (a template-cache key, ESI, or no preload). The origin
+  fetch waits for dispatch, so the first byte slips by the whole hold.
+
+`hold_budget_ms` is a soft bound. The Fastly adapter cannot enforce a total
+deadline (section 3.4). Each hold-mode call gets a first-byte timeout of
+`min(hold_timeout_ms, remaining budget)`, and the coordinator waits for
+every dispatched call until the platform settles it
+(`ec/identity/coordinator.rs:1140-1162`). The first-byte timer starts only
+once the connection is up, so a hold-mode call also sets its connect
+timeout to the same call timeout, capped at the adapters' 1-second
+default (`PlatformBackendSpec::connect_timeout`). On Fastly a call stalled
+in connection setup then holds the navigation for at most twice its call
+timeout: the worst case is about `2 × hold_budget_ms`, plus a response that
+trickles bytes inside the between-bytes timer. A spec that sets no connect
+timeout keeps today's 1 second and today's backend name, so origin,
+auction and after-send calls are unchanged. The other adapters have no
+per-backend connect timer and ignore the field.
+
+How often a provider is due depends on its refresh interval (step 4). The
+default `refresh_after_sec` of one day is a product decision that departs
+from vendor guidance: UID2 recommends refreshing hourly, LiveRamp every
+30 minutes of active navigation, and ID5 every 2 hours. Following that
+guidance means one KV write per active visitor every 30 to 120 minutes for
+each owned expiring source, more navigations that hold, and more HTML
+responses made private by `Set-Cookie`. Operators who follow a vendor's
+guidance set `refresh_after_sec` or the provider's refresh hint to it and
+accept those costs.
+
+**Results.** A hold-mode call either answers within its budget or is cut
+off; no call outlives the router (section 3.4). An answer feeds that
+navigation's auction and joins the writer's mutation. No answer goes into
+a cookie. After-send results exist only in phase 4, after headers are
+sent, and are dispatched and committed in the same phase 4 flush (section
+5.2).
+
+**Circuit breaker.** The rate-limiter trait (`ec/rate_limiter.rs:16-47`)
+gains `record(key)` and `count(key)`, backed by Fastly's counter `increment`
+and `lookup_count`. Only transport failures, timeouts, 5xx and 429 responses
+are recorded, under `identity-fail:<provider>`. While `count` is at or above
+`breaker_failures_per_minute`, the provider is skipped for every visitor.
+Input-caused 4xx responses and `Malformed` back off only that visitor, so no
+visitor can open the breaker for everyone by seeding bad values. Fastly
+counters are kept per POP, so the breaker is too.
+
+**Passive capture.** `IntegrationRegistry::handle_proxy`
+(`integrations/registry.rs:1031-1060`) holds the `EcContext`.
+`IntegrationProxy::handle` itself has no EC context
+(`integrations/registry.rs:319-324`).
+
+Capture is revoke-only in v1. Every proxied API call is a stager (section
+5.1), and a stager persists no positive ID, so a capture result does three
+things only:
+
+- Its removals (`invalidate`, `also_invalidate`) and opt-out (`opted_out`)
+  are written to KV.
+- A positive result clears the provider's opt-out, under the rules below.
+- Its positive IDs are counted in `capture_unpersisted`, by provider ID and
+  source, with no value, so the operator can measure what a durable path
+  would add (section 15). They are not stored.
+
+For each provider with a capture rule (`with_path` or `with_path_prefix`)
+matching the request:
+
+- **After `handle`,** on 2xx responses only, `handle_proxy` buffers the
+  response body up to `max_response_bytes` (a larger body is passed through
+  uncaptured), decodes a copy under the same cap, builds a `CaptureInput`
+  and calls `capture`. It re-wraps the original bytes with
+  `EdgeBody::from(bytes)`, so the browser receives the response unchanged.
+  The request body is never read.
+- **Removals and opt-outs apply whatever the consent,** because a
+  revocation arrives after consent is denied. The capture removal write
+  stores them on this request (section 5.3).
+- **A clear** needs a positive result under the request's consent:
+  eligibility steps 1 to 3 pass, and the provider has a sticky `ps.o` that
+  only a capture can clear (a capture-only provider without a GVL ID,
+  section 8). The same capture removal write stores it as `ps.oc`, set to
+  the `at` of the opt-out this request read (its watermark, section 8).
+- **The real-browser gate applies to clears only.** Removals, opt-outs and
+  global revokes apply whatever the client, as consent withdrawals do: the
+  bot gate keeps the write path for revocations so tombstones stay
+  authoritative for privacy-extension-heavy clients
+  (`adapter-fastly/src/app.rs:595-605`), and `looks_like_browser()` fails
+  whenever the JA4 class or the UA platform is missing
+  (`ec/device.rs:84-86`), for example under a UA-spoofing extension.
+  Dropping their revocations would leave their IDs in KV, served again on
+  their next request that passes the check (G12). A script replaying a
+  copied `ts-ec` cookie can make TS forget IDs this way, but it can already
+  tombstone the row through the withdrawal path with a denying consent
+  cookie, and it never discloses or re-enables an ID (section 9.5). A clear
+  re-enables IDs, so a client that fails `looks_like_browser()` makes no
+  clear. The adapter gives integration proxy dispatch the identity graph
+  for every client for this; EC generation on that route still requires a
+  real browser.
+
+Capture never touches `ps.n`, `ps.f` or the breaker: a proxied call that
+held nothing is not a provider failure. Capture never changes provider
+state: a state change in its result is ignored with a warning, and the
+harness's conformance check fails a `capture` that returns one (section
+13). This holds whether or not the provider declares
+`with_private_state()`.
+
+Lockr's API responses are already buffered on Fastly: a non-streaming send
+reads the body whole, up to 10 MiB (`adapter-fastly/src/platform.rs:413-429`).
+The Lockr proxy forwards the browser's `Accept-Encoding`
+(`integrations/lockr.rs:259-265`), so its responses can be compressed. The
+coordinator decodes them, as above.
+
+## 5. One KV write per page load
+
+### 5.1 Writer requests and stagers
+
+A request is the **writer request** when all of these hold. The decision is
+made once pre-route filters have allowed dispatch, because a challenged or
+blocked request must not persist anything (`ec/mod.rs:91-96`). It sits where
+routing already decides EC generation (`adapter-fastly/src/app.rs:846-851`,
+`integrations/registry.rs:1048`) and is stored on `EcContext`:
+
+- It is an organic route: the publisher fallback, or an integration proxy
+  route.
+- `Sec-Fetch-Dest` is `document`. The `Accept: text/html` fallback of
+  `is_navigation_request` does not count, because `fetch()` can send it
+  (`http_util.rs:105-117`).
+- It is not a prefetch or prerender. `is_prefetch_request` moves to
+  `http_util` as a public function so the adapter can call it.
+- The request is a real browser (`adapter-fastly/src/app.rs:410`).
+  Integration-proxy EC generation gains the same explicit check: today it
+  is gated only by a missing KV graph (`integrations/registry.rs:1048-1049`,
+  `adapter-fastly/src/app.rs:458`).
+
+An integration-proxy writer never rotates an EC, as today
+(`adapter-fastly/src/app.rs:885-890`).
+
+The adapter captures the response status before `send_edgezero_response`
+consumes the response, and passes it to phase 4 (`main.rs:512-517`, `:618`).
+A returning EC's writer flushes its whole mutation only when that status is
+2xx or 304. For any other status it dispatches no after-send provider and
+flushes everything in its mutation except the positive part of the hold-mode
+calls it already made before the origin status was known
+(`publisher.rs:4887-4894`, `:5151-5175`): their removals and opt-outs, and
+the `ps.n` and `ps.f` of every outcome other than `found`, so a `no_match`,
+a failure or a cut-off call still backs off. Their positive answers, with
+their state and scheduling, are resolved again by a later writer. Browser
+ingest is dropped and re-derived at the next navigation. A redirect is
+followed by another
+navigation, which recomputes everything from KV and the same cookies.
+
+A new visitor's create (section 5.2, phase 1, before routing) is written
+whatever the status, as today, because the response sets the EC cookie.
+
+Every other request is a **stager**: `/auction`, `/_ts/page-bids` (except
+the SPA writer below), integration proxy calls that are not navigations (including Lockr's API
+proxy), prefetches, iframes, clients that send no `Sec-Fetch-Dest`, and every
+other route. Stagers read cookies and KV, run no resolving provider, and
+write KV only for a captured revocation (section 5.3).
+
+`/_ts/api/v1/identify` stops writing too. The once-per-EC `cluster_size`
+evaluation (`ec/identify.rs:107`, `ec/kv.rs:1484`) moves into the writer's
+mutation. `/identify` uses a stored `cluster_size` when present and computes
+one without writing when not.
+
+**SPA views.** A single-page app changes views with JavaScript, and TS's
+script reports each change to `/_ts/page-bids` (`publisher.rs:6890-6894`).
+An SPA view is part of the page load that loaded the document, so
+`/_ts/page-bids` is a stager. Today it ingests `ts-eids` into KV
+(`publisher.rs:6925`).
+
+**The SPA writer.** Decided after the round 14 review (section 15,
+question 1). A visitor who stays in an SPA would otherwise wait for their
+next full navigation for browser ingest and provider refreshes. So a
+`/_ts/page-bids` call is the writer when it comes from a real browser, sends
+`Sec-Fetch-Site: same-origin` (the `X-TSJS-Page-Bids` fallback is not
+enough), and `ec.identity.spa_writer_interval_sec` (default 300, 0 turns it
+off) is above zero. Its phase 4 then:
+
+- writes only when its auction read the row in phase 1, so it adds no row
+  read, and only when the row's `wa` is older than the interval. `wa` is
+  the time of the row's last writer flush, set by every writer write
+- runs browser ingest and after-send providers, never a hold-mode provider,
+  and never holds the response
+- reads the pending key and writes once, as any writer
+
+So an SPA session writes at most once per interval, and a row whose last
+write predates `wa` (none recorded) is due at once.
+
+**Exception: consent withdrawal.** A withdrawal writes its tombstone on
+whichever request carries it, before the response is sent, as today. That
+includes stagers and clients the bot gate does not treat as real browsers
+(`adapter-fastly/src/app.rs:446-452`). Revocation cannot wait for a
+navigation that may never come. The exception covers the whole of today's
+withdrawal path: a CAS tombstone with up to five attempts, then its
+completion-marker write, for each withdrawn EC ID (one or two;
+`ec/kv.rs:1349-1430`, `:1115-1124`; `finalize.rs:509-525`). New in this
+spec: when those attempts fail before send, the path runs once more after
+send, by which time Fastly's per-key limit has usually passed. The same
+exception covers a captured opt-out from a provider with
+`revoke_scope = "global"` (section 8), from any client: it runs this
+path on the request that carries it. It and the two removal writes (sections
+5.2, phase 4, and 5.3) are the only page-load exceptions to G4. The
+tombstone is not
+part of any `IdentityMutation`. A writer whose phase 4 re-read finds the
+tombstone drops its mutation (section 5.4, step 1).
+
+### 5.2 Phases of the writer request
+
+**Phase 1, at the routing decision. No KV write.**
+
+- Read `ts-ec`, consent, `ts-eids` and sharedId. `ts-eids-s` is never read.
+- Decide whether this is the writer request (section 5.1).
+- Capture the user agent, DNT and page URL into `EcContext` (section 4.4).
+- For a returning EC, read the KV snapshot. Every returning writer
+  navigation reads it once (section 6.3). A missing row starts today's
+  orphan recovery: confirm the absence, then rotate before send
+  (`ec/finalize.rs:371-400`). The rotated EC's create carries this
+  request's browser ingest, as today (`ec/finalize.rs:323`). It is the page
+  load's one write (section 5.5): a request that rotates drops the rest of
+  its mutation and skips phase 4. If the confirm read finds the row after
+  all, no rotation happens and that read is the phase 1 snapshot (today's
+  code writes at once there, `ec/finalize.rs:383-386`; here the change joins
+  the mutation).
+- For a new visitor, `generate_if_needed` creates the row before routing, as
+  today (`ec/mod.rs:407-455`), so no unconfirmed ID is ever used. Today that
+  create is an empty row and browser ingest is a second write in finalize
+  (`ec/mod.rs:412`, `ec/finalize.rs:144`). Here the create also carries
+  browser ingest from `ts-eids` and sharedId, which are read before routing,
+  so it is the page load's one write.
+
+**Phase 2, routing.**
+
+- The coordinator computes eligible providers from the phase 1 snapshot
+  (section 4.7).
+- If the navigation runs an auction, due hold-mode providers are dispatched
+  before it and awaited within the hold budget. Their answers feed the
+  auction. If it runs none, due hold-mode providers join the after-send
+  providers (section 4.7, step 7).
+- A provider due on the phase 1 snapshot in after-send mode is due for
+  dispatch in phase 4, which rebuilds its request from the live row. There
+  is no dry run: phase 4 calls `request` once. A `None` then sets `ps.n`
+  (section 8).
+
+**Phase 3, finalize, before send.**
+
+- **New visitor.** Nothing to write: the row was created before routing
+  (phase 1), or after the hold dispatch (section 4.7, new visitors), or here
+  when the navigation never reached that create. `ts-ec` is set because the
+  create was `Written`, as today (`ec/finalize.rs:145-149`). Phase 4 does
+  nothing for a new visitor.
+- **Returning EC.**
+  - Browser ingest from `ts-eids` and sharedId adds `FillMissing` changes to
+    the mutation, instead of calling `sync_eid_cookie_updates`
+    (`ec/finalize.rs:183`). It covers owned sources too, which seeds them
+    for their owner (section 7.2).
+  - Hold-mode answers join the mutation. A capture on an integration-proxy
+    writer navigation goes through the capture removal write, as on a stager
+    (section 4.7), and never joins the mutation.
+- **Consent withdrawal** runs today's synchronous path (section 5.1).
+- **Cookies.** This spec sets no cookie on the writer's response. A
+  returning visitor's HTML gets no new `Set-Cookie` from it and stays
+  cacheable.
+
+**Phase 4, after send. Returning ECs only. The only write.**
+
+1. If the mutation is empty and no after-send provider is due, stop. No
+   read, no write.
+2. If phase 1 read the row successfully and no after-send provider is due,
+   do not read again (a failed phase 1 read counts as no read, and phase 4
+   re-reads): apply the mutation to the phase 1 snapshot and, if anything
+   changes, write with that generation. A concurrent change since then,
+   such as a capture removal write by another request of the page load
+   (section 5.3), fails the CAS, as any conflict does. Otherwise re-read
+   the live row. Either way, the snapshot or the live row decides:
+   - A tombstone, or `consent.ok = false`: drop the mutation and stop.
+   - Missing: drop the mutation and stop. The next writer navigation's
+     phase 1 read finds the orphan (section 6.3). This covers an
+     integration-proxy writer, which never rotates.
+   - Failed: drop the mutation and stop.
+3. Recompute eligibility steps 4 and 5 from the live row, build each due
+   provider's request, dispatch the after-send providers and turn their
+   results into changes. This happens after the re-read, so no EC ID is
+   disclosed before consent is confirmed (`ec/pull_sync.rs:100-110` does the
+   same today).
+4. Apply the mutation to the live entry (section 5.4). If anything changed,
+   write it once with `IfGenerationMatch`. The after-send results commit in
+   this write; nothing marks them as pending in between.
+5. If the write fails, on a precondition failure, Fastly's per-key rate
+   limit or any other error, log. The flush is not retried as a whole.
+   Fastly limits writes to one key to about one per second, and the limit
+   can be stricter, so an immediate retry after a conflict would usually
+   fail too. When the mutation holds removals, opt-outs or clears, they are
+   then written alone, with the CAS loop of the capture removal write
+   (section 5.3): a re-read, the removal rules of section 5.4 and up to five
+   attempts. Phase 4 runs after send, so this write first waits one per-key
+   window (1 second), because the usual cause of the failed flush is
+   another tab's write within the last second. A per-key limit on one of its
+   attempts waits another window and counts as an attempt, like a
+   generation mismatch. When those fail too, the request's own removals go
+   to the pending key (section 5.3), and only when that append fails are
+   they lost and counted in `removal_lost`. Nothing else backs the flush,
+   so:
+   - browser ingest is re-derived from `ts-eids` by the next navigation
+   - every positive provider result is lost: hold-mode answers and
+     after-send results, with their state changes and `ps.n`/`ps.f`. Each
+     provider is still due, and the next writer calls it again, paced by the
+     burst cap. Their removals survive through the retry above, unless it
+     fails too
+   - a stateful provider is called again with the state KV still holds. If
+     the vendor has rotated that state (a used UID2 refresh token, for
+     example), the call fails, the stored ID ages out, and the browser or a
+     later initial call re-seeds it
+
+**Cost per page load.** Writes are at most one, plus the removal-only retry
+when a flush that holds removals fails, and a pending-key append when that
+fails too. Reads, compared with today, for a writer navigation; each also
+reads the pending key once in phase 4 (section 5.3, The pending key), which
+the table leaves out:
+
+| Navigation                        | Today                  | This design                                                         |
+| --------------------------------- | ---------------------- | ------------------------------------------------------------------- |
+| Runs an auction                   | 1 (preload)            | 1 (phase 1). Phase 4 reuses it unless an after-send provider is due |
+| No auction, no provider due       | 0 or 1                 | 1 (phase 1). Phase 4 reuses it                                      |
+| An after-send provider dispatches | 2 (preload, pull sync) | 2: phase 1 and the phase 4 re-read                                  |
+
+Every returning writer navigation reads the row once in phase 1, and the
+pending key once in phase 4. The row read finds
+orphans, answers eligibility and filters browser candidates, so no cookie
+copy of the row is needed. Each `/auction` and `/_ts/page-bids` keeps its
+one existing read. Orphan recovery adds the reads it adds today, in the rare
+case it runs.
+
+### 5.3 Stagers
+
+A stager runs no resolving provider and never persists a positive ID. It
+reads KV only where its route already does: `/auction` reads the row it
+reads today (`auction/endpoints.rs:307-311`), and `/_ts/page-bids` reads it
+only when its auction runs (`publisher.rs:7077-7090`). Its auction serves
+the server set from that read (section 7.1). It no longer runs today's
+ingest write in the returning-visitor branch of `ec_finalize_response`
+(`ec/finalize.rs:110-112`).
+
+Earlier revisions let stagers run stateless hold-mode providers in memory.
+With no `ps.n` or `ps.f` stored on a stager, a provider that answered
+`no_match` or a 4xx was called again once a minute on every `/auction`, for
+the whole of an SPA session. Revision 15 removes that.
+
+**The capture removal write.** A captured revocation, from any client
+(section 4.7), is written to KV on the proxied request that carries it. It is one of the page-load exceptions to G4 (section 5.1). The write:
+
+- reads the row and applies only the capture's removals (with the `ps.iv` or `ps.ov` hashes they derive), its opt-out and its clear, under the rules of
+  section 5.4
+- writes with a CAS and the withdrawal path's five attempts, re-reading and
+  trying again when the generation no longer matches. Before send, any
+  other failure, Fastly's per-key limit included, ends the attempt at once
+- runs before the proxied response is sent and, when that attempt fails,
+  once more after send. A small proxied JSON response is sent within
+  milliseconds, still inside the per-key window, so the after-send attempt
+  first waits one window (1 second), and a per-key limit on any of its
+  attempts waits another window and is retried as a generation mismatch
+  is. Latency is not at stake after send. The adapter reports the limit
+  apart from other store errors (`EcKvRateLimited`, from Fastly's
+  `TooManyRequests`), and any other error still ends the attempt
+- writes nothing when the read shows a tombstone, a missing row or the
+  removal already applied
+- when both attempts fail, appends the removal to the pending key below and
+  increments `removal_deferred`. Only when that append fails too does it log
+  at error with the provider ID and source only, and increment
+  `removal_lost` (section 2.3)
+
+It runs whatever the request's consent, including when consent is unusable
+but not withdrawn, because a revocation can arrive then. A writer
+navigation of the same page load that flushes with its phase 1 generation
+after this write fails its CAS and is not retried (section 5.2, phase 4);
+its browser ingest is re-derived at the next navigation.
+
+**The pending key.** Decided after the round 14 review (section 15,
+questions 2 and 4). `pending:<ec_id>` holds what a request could not write
+to the row, for the next writer to merge:
+
+- **What goes in.** A removal, opt-out or clear whose row write and
+  after-send retry both failed, from a capture or from a writer's flush.
+  And a capture's positive change from a request that is not the writer,
+  when it passes the consent steps (`passes_consent_steps`), the provider
+  is not opted out, and its entry set differs from what the capture's view
+  read. A positive change keeps the revision the capture read as its
+  `expected`, so a merge never overwrites a record that changed since. When
+  the capturing request is itself the writer, its positive changes join its
+  own mutation and skip the pending key.
+- **The append.** Read the key, drop items older than its one-day TTL,
+  append one item `{g, at, ch, ps}` and write with a CAS (`Add` when the key
+  is absent), up to five attempts. `g` is the item's generation:
+  `max(last g + 1, now * 1000)`, so a key that expired and comes back never
+  reuses a generation. A key holds at most 16 items; an append to a full
+  key fails. Positive capture changes are appended after send; a failed
+  append drops them with a warning, as before this decision.
+- **The merge.** Every returning writer reads the pending key in phase 4,
+  before deciding it has nothing to do. Items with `g` above the row's `pg`
+  merge before the request's own mutation, under the rules of section 5.4:
+  a removal applies as in the removal write, and a positive change is
+  skipped when its UIDs hash into `ps.iv` or `ps.ov` or its owner is opted
+  out. The write stores the newest merged `g` as `pg`. When the write
+  fails, the items stay, and only the request's own removals are appended.
+- **What it never does.** The key is never deleted; its TTL ends it.
+  Auctions and `/identify` never read it, so a deferred positive ID is not
+  served until a writer has merged it.
+
+`/auction` and `/_ts/page-bids` return the mirror payload of section 6.2 in
+their JSON response, from the KV row they read. The shim writes
+`ts-eids-s` from it. These responses are already private, so the mirror
+costs no HTML cacheability.
+
+**`ts-eids` holds only registered sources, merged per source.** Today
+`/auction` ingests registered sources from its body, which carries more than
+the 3,072-byte `ts-eids` cookie. Under this design only the writer ingests,
+and only from `ts-eids`. So the shim writes only registered sources into
+`ts-eids`; it learns their domains from the configuration TS injects with
+its script, and writes no cookie when none is injected. Each `trustedServer`
+request's registered entries replace the cookie's entries for the same
+source, and the cookie keeps the sources the request lacks, so an auction
+that misses an ID module does not remove its ID. A request with no EIDs
+leaves the cookie as it is; a TCF block still clears it. The EID fidelity
+trim (§4.3) then runs on the merged set. Every registered source today's
+`/auction` ingest writes then reaches the next writer's ingest, unless the
+registered sources alone exceed the trim (G10).
+
+**Concurrent stagers.** Stagers set no server cookie, so concurrent
+responses cannot overwrite each other's state. Each can return a mirror
+payload; the last one the shim writes wins, and all of them come from KV.
+
+### 5.4 `IdentityMutation`
+
+```rust
+pub(crate) struct IdentityMutation {
+    partner_ids: Vec<PartnerIdChange>,
+    provider_results: Vec<ProviderResult>,
+    provider_state: BTreeMap<IdentityProviderId, ProviderStateChange>,
+    cluster_size: Option<u32>,
+}
+
+/// The positive part of one stateful provider's result, applied whole or not
+/// at all. Its removals and opt-out are not part of it: they go into
+/// `partner_ids` and `provider_state` and apply on their own.
+pub(crate) struct ProviderResult {
+    provider: IdentityProviderId,
+    /// `OwnerWrite` and `FillMissing` changes for the sources it returned.
+    ids: Vec<PartnerIdChange>,
+    /// The state replacement or clear, and the new `n` and `f`.
+    state: ProviderStateChange,
+    /// Hash of the `ps.st` the call read. `None`: it read no state.
+    expected_state: Option<StateRevision>,
+}
+
+pub(crate) enum PartnerIdChange {
+    /// From browser ingest or an unowned provider.
+    /// Applies only if the source is absent or its record is expired.
+    FillMissing { source: SourceDomain, record: StoredRecord },
+    /// From the owning provider. Applies if the live record's revision equals
+    /// `expected`, or if `expected` is `None` and the source has no valid ID
+    /// that this provider wrote. A browser-seeded value never blocks the
+    /// owner.
+    OwnerWrite { source: SourceDomain, record: StoredRecord, expected: Option<Revision> },
+    /// From `Resolution::invalidate` or `also_invalidate`. Applies only if
+    /// the revision matches. Applying it appends the hash of every UID of the
+    /// record it removes to `provider`'s `ps.iv` (section 7.2). `provider` is
+    /// the provider that invalidated, which for an unowned source is not an
+    /// owner: its `ps.iv` still filters the browser's candidates (section 7.1).
+    OwnerRemove { source: SourceDomain, provider: IdentityProviderId, expected: Revision },
+    /// From `Resolution::opted_out`. Removes the source's record if this
+    /// provider wrote it, at any revision. For a capture-only provider it
+    /// also removes a record no provider wrote (browser ingest, schema
+    /// version 1 rows), because such a provider never writes one itself
+    /// (section 8).
+    WriterRemove { source: SourceDomain, writer: IdentityProviderId },
+}
+
+/// A `StoredRecord` is a source's whole record: its entry set (section 6.1),
+/// `w`, the timing fields and `rv`. Every change below writes or removes a
+/// source's set whole. No change edits one entry or one UID, so one `rv`
+/// per source covers every entry in it.
+///
+/// A record's opaque revision: its KV `rv`, 64 random bits from the
+/// platform generator, drawn fresh on every write of the record, including a
+/// refresh that keeps the UID. Neither the UID nor `acquired_at` can serve:
+/// two refreshes of an unchanged UID in one second share both. A record
+/// without `rv`, which only a schema version 1 row holds, has the revision
+/// `Unset` until its next write gives it one.
+pub(crate) enum Revision {
+    Unset,
+    Set(RecordRevision),
+}
+```
+
+A new visitor's create is not a mutation: `generate_if_needed` builds the
+seed row before routing (section 5.2).
+
+Applying the mutation to a live entry, in order:
+
+1. If the live entry is a tombstone, drop everything.
+2. Apply removals first: every `OwnerRemove` and `WriterRemove`. Applying a
+   new `ps.o` for a provider also removes every live record that provider
+   wrote, owned or unowned, at any revision, and for a capture-only
+   provider every record of its sources that no provider wrote. Removals
+   are never skipped. Every invalidation that applies appends to the invalidating
+   provider's `ps.iv`, and every opt-out removal appends to the provider's `ps.ov`, the
+   hash of every UID of the live record it removes, so the hashes always
+   come from the record KV held. One that no longer
+   applies adds none: the record it named is gone or was replaced.
+   A clear carries a watermark: the `at` of the opt-out the clearing
+   request read (section 8). Apply clears first: a clear applies when the
+   live `ps.o.at` is at or before its watermark and the live `ps.oc` is
+   before it, and stores the watermark as `ps.oc`, so the next step sees the
+   provider as not opted out. A provider is opted out while `ps.oc` is
+   absent or before `ps.o.at`. Then apply opt-outs: one applies when its
+   `at` is after the live `ps.o.at` and after the live `ps.oc`. An opt-out
+   the clearing request never saw is newer than the watermark, so it stays,
+   and an opt-out in the same mutation as a clear still wins. A clear that
+   applies also empties the provider's `ps.ov`, so the IDs its opt-out
+   removed can come back through the browser path. `ps.iv` is never
+   emptied: an invalidation is about the ID, not about consent. A clear
+   whose watermark is before the live opt-out, or with no live opt-out to
+   clear, is dropped and writes nothing.
+3. Apply the positive changes by their own rules. Every change written by
+   a provider the live `ps.o` marks opted out is skipped, `OwnerWrite` and
+   `FillMissing` alike. A `FillMissing` any of whose UIDs matches the live
+   `ps.iv` or `ps.ov` of a provider that claims the source is skipped, owned
+   or
+   unowned. A browser-ingest `FillMissing` for a source of an opted-out
+   capture-only provider is skipped too. For an owned source, every
+   positive change is skipped while the owner is opted out, whoever wrote
+   it, and an `OwnerWrite` or `FillMissing` any of whose UIDs matches the
+   owner's `ps.iv` is skipped, the owner's own write included. These read
+   the entry after step 2, so an invalidation or opt-out in the same
+   mutation already counts: a browser refill of a UID the same writer just
+   invalidated, or of a source whose owner just opted out, never lands.
+   Changes that no longer apply are dropped silently: a newer write won.
+   Each `ProviderResult` applies atomically. Its IDs, its state change and
+   its `n` and `f` apply together, and only when every ID change in it
+   would apply on its own and the live `ps.st` still hashes to
+   `expected_state`. Otherwise the whole group is dropped. A writer whose
+   phase 4 re-read finds that another writer committed a newer ID or state
+   since its call read the row therefore stores neither its ID nor its
+   state, and no row pairs one call's ID with another call's state.
+4. Apply `provider_state` changes (`n`, `f`, `o`, `iv`, `ov`, `st`) and
+   `cluster_size`. Truncate each `ps.iv` and `ps.ov` from the front to
+   `MAX_INVALIDATED_UIDS` (section 6.1), so step 5 never fails on them. For
+   a provider no longer configured, drop every `ps` field except `o`, `oc`
+   and `ov`, so a rollback and a roll-forward never forget an opt-out
+   (section
+   14). Such an entry still counts toward the 32-provider cap, and is the
+   first dropped when the cap is exceeded.
+   Drop expired records, except **refresh anchors**, an expired record of an
+   owned source whose owner is configured and either:
+   - still holds `ps.st`, and the record's `ru` has not passed (a stateful
+     owner, such as UID2), or
+   - wrote the record and declares `with_refresh_grace`, and `exp` plus the
+     grace has not passed (a stateless owner, such as LiveRamp, whose
+     refresh accepts an expired envelope).
+
+   An anchor is never served (section 7.1), but it keeps the owner's kind
+   `Refresh` (section 4.7), so an unrelated mutation, a backoff or an open
+   breaker cannot strand refresh credentials that are still valid. A
+   stateful anchor is dropped when its `ru` passes or the owner's state is
+   cleared (an `InvalidState` included) or missing; a stateless one when its
+   grace passes. Either is dropped when the owner is no longer configured. A
+   record with neither is dropped at expiry, as before. After a drop the
+   owner sees no record and selects `Initial`.
+
+5. Validate the result with `KvEntry::validate`. If it fails, keep only the
+   removals and opt-outs and validate again, so a full row can always
+   shrink. If that also fails, drop the mutation and log. An invalid row is
+   never written.
+6. If nothing changed, skip the write.
+
+The capture removal write (section 5.3) applies a mutation that holds only
+removals, an opt-out and a clear, through steps 1, 2, 4 (the `o`, `oc`, `iv` and `ov` fields only), 5 and 6.
+
+Because the rules are checked against the live entry, a later writer can
+re-apply re-derived changes without losing a concurrent tab's newer data.
+
+### 5.5 Orphans, collisions and deletion
+
+Creating a new visitor's row before its cookie goes out keeps today's three
+safety properties, which a deferred create would lose:
+
+- **Withdrawals stick.** A withdrawal can only arrive with a cookie, and the
+  cookie is set only after the row exists, so the tombstone always has a row
+  to land on.
+- **Collisions are caught.** An `AlreadyExists` on the first create re-mints
+  the ID before any cookie is set, so no browser adopts another visitor's
+  row.
+- **Orphans are found.** A row that goes missing later is found by the next
+  writer navigation's phase 1 read, which every returning writer navigation
+  makes, and recovered by today's rotation, before send (section 5.2,
+  phase 1). A stager that sees the row missing stores nothing and tells the
+  shim to clear `ts-eids-s`.
+
+**Deletion.** The IAB data-deletion framework, deferred today, would
+hard-delete rows (`ec/kv.rs:1551-1563`). When that framework lands, it writes
+a tombstone with `TOMBSTONE_TTL` (24 hours, `ec/kv.rs:38-39`) instead, using
+its own unconditional writer and today's completion marker. That replaces
+one delete with one write, the TTL removes the tombstone with no further
+write, and every TS request that reads the row in those 24 hours treats the
+identity as withdrawn. A browser that visits within those 24 hours reads
+the tombstone at its next writer navigation or `/auction`, and the latter
+tells the shim to clear `ts-eids-s`. One that returns later finds the row
+missing and rotates. The rotation carries no positive ID, because the
+server keeps none outside KV, so a deletion is never undone through a
+cookie.
+
+### 5.6 Rules that keep removals winning
+
+- **Removals reach KV on the request that carries them.** A provider's
+  removals, opt-outs and clears are written by the writer's own flush, or
+  by the capture removal write for a proxied call (section 5.3). They
+  apply whatever the consent and whether or not their provider is still
+  enabled, and no cookie or config change can strand one. No client gate
+  applies to them (section 4.7).
+- **A missing row carries no positive ID.** Any KV read that finds the row
+  missing (outside a recovery in the same request) treats it like a
+  tombstone for the server set: an `/auction` or `/_ts/page-bids` response
+  tells the shim to clear `ts-eids-s`. Nothing carries `ps` across an
+  orphan rotation, so after one a UID a provider rejected can be re-seeded
+  once, and an opted-out provider can be called again until it reports the
+  opt-out again.
+- **Withdrawn consent never refills the mirror.** A stager whose decoded
+  consent denies EID persistence returns a clear for `ts-eids-s`, never a
+  value, so a concurrent `/auction` that started before a withdrawal cannot
+  bring IDs back.
+- **Cluster size rides on a write.** `/_ts/api/v1/identify` authenticates
+  the partner with a bearer token and reads the EC from the `ts-ec` cookie,
+  with credentialed CORS for the publisher's host and its subdomains
+  (`ec/identify.rs:32-75`, `:226-263`). It stops writing (section 5.1).
+  When it reads a row without `cluster_size`, it computes the value for its
+  response and does not store it. A writer whose phase 1 or phase 4 read
+  finds a live row without `cluster_size` adds the evaluation to its
+  mutation, run in phase 4 after send, so its KV prefix list
+  (`ec/kv.rs:1460-1469`) never delays a page. That is at most one write per
+  EC, once (`ec/kv.rs:1497-1529`), and the write is the page load's one
+  write. The list cost is new: today the prefix list runs only when a
+  partner calls `/identify` for an EC, and under this design it runs once
+  for every EC that reaches a writer navigation, including ECs no partner
+  ever looks up.
+- **EC minting on non-writer navigations.** Today a real browser gets an EC
+  on any navigation `is_navigation_request` accepts, including prefetch and
+  the `Accept: text/html` fallback (`adapter-fastly/src/app.rs:846-857`).
+  That stays: such a request creates the row before routing, as a new
+  visitor's writer does, and that create is its page load's one write. It
+  runs no providers and writes nothing else.
+- **Proxy capture plumbing.** `ProxyDispatchInput` gains `is_real_browser`,
+  the writer decision and `IdentityDeps`. Section 4.7 covers how
+  `handle_proxy` buffers and decodes a response for `capture`.
+
+## 6. Storage
+
+### 6.1 KV record
+
+`SCHEMA_VERSION` becomes 2 (`ec/kv_types.rs:17`). `KvPartnerId`
+(`ec/kv_types.rs:102`) is replaced by one record shape, and `KvEntry`
+gains `ps`. KV item metadata, which Fastly caps at 2,000 bytes, holds no IDs
+(`ec/kv_types.rs:199-219`) and is unaffected.
+
+**One record shape.** Every record stores its source's entry set in `eids`:
+an array of OpenRTB EID entries without `source` (the map key holds it),
+each `{uids: [{id, atype?, ext?}], inserter?, matcher?, mm?, ext?}`. A
+record that browser ingest, generic pull or batch sync writes is one entry
+with one UID and no EID-level fields; only a provider result writes more.
+The stored entry types are dedicated (`KvEid`, `KvUid`), carry no `source`
+and ignore unknown fields. They are never `openrtb::Eid`, which denies
+unknown fields and requires `source` (`openrtb.rs:72`), so a field a later
+build adds never makes an older build fail to read the row.
+
+**Reading schema version 1.** Every row on `main` is version 1, whose
+records hold one `uid`. The reader accepts both versions. It reads a
+version 1 record as one entry holding that `uid`, with no `w`, no `rv` and
+no timing beyond `at`, and the next write of the row stores it as version 2.
+Today's reader rejects any version but its own (`ec/kv_types.rs:376-381`),
+so a build older than rollout step 1 cannot read a row step 1 has written
+(section 14).
+
+`KvEntry::validate` rejects, when a row is written, a record whose `eids` is
+empty or whose set breaks the limits of section 4.5. It runs on every read
+too (`ec/kv.rs:366`), so on read a bad record is dropped from the row and
+the violation is logged with the source only. One bad record never makes
+the row unreadable. Only `serialize_entry` rejects.
+
+`KvPartnerId` and `KvEntry` are public structs without `Default`, and about
+30 `KvPartnerId { .. }` literals in 8 files would stop compiling (for example
+`ec/kv.rs:160`, `:208`), as would the constructors at `ec/kv_types.rs:282`,
+`:312` and `:344`. So both derive `Default` and gain constructors, and the
+literals move to them. `PartnerIdUpdate` (`ec/kv.rs:75-90`) gains
+`acquired_at`, so browser ingest records `at`.
+
+```json
+{
+  "v": 2,
+  "ids": {
+    "id5-sync.com": {
+      "w": "id5",
+      "rv": "9c1d04b7e6a83f2a",
+      "at": 1760000000,
+      "exp": 1767776000,
+      "ra": 1760086400,
+      "eids": [
+        {
+          "uids": [
+            { "id": "ID5*example", "atype": 1, "ext": { "linkType": 2 } }
+          ]
+        }
+      ]
+    },
+    "example-ids.example.com": {
+      "w": "exampleid",
+      "rv": "4be71f0c2d9a6e35",
+      "at": 1760000000,
+      "eids": [
+        {
+          "uids": [
+            { "id": "example-a", "atype": 1 },
+            { "id": "example-b", "atype": 3, "ext": { "stype": "ppuid" } }
+          ],
+          "inserter": "example.com",
+          "mm": 3
+        },
+        {
+          "uids": [{ "id": "example-c", "atype": 1 }],
+          "matcher": "partner.example.com"
+        }
+      ]
+    },
+    "sharedid.org": {
+      "rv": "07a3c9e15b2d48f6",
+      "at": 1759990000,
+      "eids": [{ "uids": [{ "id": "example-shared-id" }] }]
+    }
+  },
+  "ps": {
+    "id5": { "n": 1760003600, "f": 1, "st": "example-opaque-state" }
+  }
+}
+```
+
+| Field   | Meaning                                                                                                                                     |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `w`     | Writer: a provider ID. Absent for browser ingest and version 1 records                                                                      |
+| `rv`    | The record's revision: 16 hex digits, drawn at random on every write of the record (section 5.4)                                            |
+| `at`    | Unix seconds when the ID was acquired or last refreshed                                                                                     |
+| `exp`   | Unix seconds at or after which the ID must not be sent                                                                                      |
+| `ra`    | Unix seconds after which the ID is due for refresh                                                                                          |
+| `ru`    | Unix seconds after which the ID can no longer be refreshed. Keeps an expired record as a refresh anchor until then                          |
+| `eids`  | The source's entry set, in order, with UID-level and EID-level fields (section 4.5). A missing `atype` uses `[[ec.partners]].openrtb_atype` |
+| `ps.n`  | Unix seconds before which the provider must not be called                                                                                   |
+| `ps.f`  | Consecutive failures, for backoff                                                                                                           |
+| `ps.o`  | Sticky opt-out: `{at, fp}`, when it was reported and the consent bits the provider's policy read then (section 8)                           |
+| `ps.oc` | The watermark of the last clear: the `at` of the newest opt-out it lifted. An opt-out at or before it is cleared and never re-applied       |
+| `ps.iv` | Hashes of UIDs the owner invalidated, oldest first, at most 128, so they are not re-seeded (section 7.2)                                    |
+| `ps.ov` | Hashes of UIDs the provider's opt-out removed, oldest first, at most 128. Emptied when the opt-out clears (section 8)                       |
+| `ps.st` | The provider's private state, as embedded JSON (a raw value, not an escaped string) of at most 1,024 bytes. KV only                         |
+| `wa`    | Unix seconds of the row's last writer flush, which paces the SPA writer (section 5.1)                                                       |
+| `pg`    | The newest pending-key generation merged into the row (section 5.3, The pending key). Items at or below it are never merged again           |
+
+`KvEntry` validation (`ec/kv_types.rs:375`) adds: the entry-set limits of
+section 4.5 (UID-level and EID-level `ext` at most 2,048 bytes, 8 entries
+and 32 UIDs per source, a set at most 4,096 bytes), `st` at most 1,024
+bytes of embedded JSON, `ps` at most 32 providers and `ps.iv` and `ps.ov` each at most `MAX_INVALIDATED_UIDS` (128) hashes. Mutations prune the `ps` entries
+of providers no longer configured to their opt-out (section 5.4), and more
+than 32 enabled providers is a config error (section 10.2), so the cap is
+never reached in practice.
+
+`ps.iv` and `ps.ov` are ordered lists, oldest first, with the same rules.
+Each hash is the first 16 hex
+digits of the unkeyed SHA-256 of the UID. A new hash is appended, and a
+hash already present moves to the end. Mutations truncate it from the front
+before validation (section 5.4). 128 hashes hold four whole 32-UID sets, so
+one removal never evicts the previous one, and an `also_invalidate` of
+several sources keeps all their UIDs. The hash is unkeyed because the same
+row stores every live UID in plain text, so a key would protect nothing,
+and an unkeyed hash survives an `ec.passphrase` rotation (section 9.3).
+
+Size. A one-UID record is about 120 bytes: today's `uid`, the `eids`
+wrapper and the metadata. A record at every cap is at most
+`MAX_ENTRY_SET_BYTES` (4,096 bytes) plus its metadata, about 4.2 KB. With
+every cap reached, eight owned sources come to about 34 KB, plus 1 KB for
+each provider with state, and `ps.iv` and `ps.ov` add up to 2.4 KB each per
+provider. A row
+that carries two full sets and two stateful providers at every cap is about
+15 KB, and typical sets are far smaller. That is above the ~5 KB estimate
+in `ec/kv_types.rs:40`, which is a documented estimate rather than an
+enforced limit, and the estimate is updated. Fastly's value limit is far
+larger. A row that only browser ingest and pull sync write grows by about
+60 bytes per source.
+
+The admin EC lookup returns the stored JSON verbatim (`ec/admin.rs:394-397`).
+It redacts `ps.st`.
+
+**Serving owned expiring sources.** For an owned source whose provider
+marks it as expiring, only records with `w` set to the owner and an
+unexpired `exp` are sent to bidders from the server. Any other record for
+that source, such as a browser-seeded one, is used only as the input to the
+owner's refresh. This fails closed: an ID is re-fetched, never sent past
+its real expiry.
+
+### 6.2 The `ts-eids-s` mirror
+
+`ts-eids-s` (`__Host-ts-eids-s`) is client-only. The shim writes it from
+the mirror payload TS returns, and page scripts read it. The server never
+sets, opens, parses or trusts it. Earlier revisions also had a family of
+sealed, server-owned removal cookies, `ts-eids-r`; revision 15 removes them,
+because every removal now reaches KV on the request that carries it
+(section 5.3).
+
+**Readers.** The mirror is for page scripts that need the server IDs. This
+spec names no consumer yet, so the mirror ships off: `/auction` and
+`/_ts/page-bids` return no mirror member unless the operator sets
+`[ec.identity] mirror_enabled = true` (default `false`). Off, the responses
+look as they did before this spec, and the shim neither writes nor clears
+the cookie. Section 15 asks for a consumer before the default changes.
+
+**Attributes.** `__Host-ts-eids-s`, with `Path=/; Secure; SameSite=Lax`,
+and no `Domain`. It is not `HttpOnly`, because the shim writes it with
+`document.cookie` and page scripts read it. Its `Max-Age` comes from the
+mirror payload.
+
+**The mirror payload.** `/auction` returns it as `ext.ts_eids_s` in its
+response (`ResponseExt`, `openrtb.rs:232`), and `/_ts/page-bids` as a
+`ts_eids_s` member of its JSON body. It takes one of two shapes, or is
+absent:
+
+```json
+{
+  "value": "eyJ2IjoxLCJlaWRzIjpbeyJzb3VyY2UiOiJleGFtcGxlLmNvbSIsInVpZHMiOlt7ImlkIjoiZXhhbXBsZS1hIiwiYXR5cGUiOjF9XX1dfQ",
+  "max_age": 86400
+}
+```
+
+```json
+{ "clear": true }
+```
+
+- **`value`** when the request read a live, consenting row and the servable
+  server set is not empty. `max_age` is the smaller of 86,400 seconds, the
+  lifetime of `ts-eids`, and the time until the earliest `exp` in the
+  mirrored set, so the mirror never outlives an ID.
+- **`clear`** when the request's consent denies EID persistence, when its
+  KV read finds a tombstone, `consent.ok = false` or a missing row, and
+  when the servable server set is empty.
+- **Absent** when the request read no KV, such as a `/_ts/page-bids` call
+  whose auction does not run. The shim leaves the cookie as it is.
+
+The shim writes `value` as the cookie value with the given `Max-Age`, and
+expires the cookie on `clear`. It skips the write when the value is
+unchanged.
+
+`value` is the base64url encoding, without padding, of compact JSON:
+`{"v": 1, "eids": [...]}`. The example above encodes one entry,
+`{"source": "example.com", "uids": [{"id": "example-a", "atype": 1}]}`.
+`eids` holds the server-side entries the auction merge would send for this
+request (section 7.1), before browser precedence: every KV record that
+passes the servability check, for sources with `bidstream_enabled = true`,
+after `gate_eids_by_consent`. Each entry is an OpenRTB EID with its
+`source`, its UIDs with `atype` and `ext`, and its EID-level fields,
+provenance defaults included, exactly as bidders receive it. It never holds
+`ps`, `ps.st`, refresh tokens or any other provider state, and no revision,
+writer or timing field.
+
+**Size cap.** At most 2,048 bytes for the cookie value, so at most about
+1,536 bytes of payload JSON. When the set does not fit, whole sources are
+left out, in ascending `cookie_priority` (section 10.1) and then largest
+first, and each omission is logged with the provider and source. A source's
+entry set is mirrored whole or not at all, never trimmed. A left-out source
+still reaches bidders through TS from KV.
+
+**Who writes it.** Only the shim. TS never sets `ts-eids-s`, not even on a
+JSON response, so writer HTML responses stay cacheable. A withdrawal or
+tombstone met on a writer navigation is cleared from the mirror at the
+page's next `/auction` or `/_ts/page-bids`, whose consent check or KV read
+returns `clear`. Until then the mirror can hold IDs TS no longer serves.
+TS's own bidstream is unaffected, because the server never reads the
+mirror.
+
+**No feedback.** The shim never copies mirror IDs into `ts-eids` or the
+`/auction` body. A page script that does so anyway, for example by writing
+them into Prebid's `ortb2` config, turns them into ordinary browser
+candidates. Browser ingest stores them with `FillMissing`, one entry with
+one UID, under today's rules (section 2.2), and the provider denials of
+section 7.1 filter them before the auction, for owned and unowned sources
+alike. So a stale copy of an ID a provider removed is not sent. A mirror ID
+never becomes an owner write and never carries its writer, timing or
+EID-level fields back into KV.
+
+**Template cache.** `ts-eids-s` joins `ts-ec`, `ts-eids` and sharedId in
+the list of identity cookies the template cache refuses as cache keys
+(`cookies/template_cache_policy.rs:35`), so no operator can split the
+shared template cache per visitor with it.
+
+**Outbound requests.** TS's identity cookies never reach third parties. One
+list, `TS_IDENTITY_COOKIE_NAMES` (`ts-ec`, `ts-eids`, `__Host-ts-eids-s`),
+is stripped from Prebid Server requests and never added to proxy or
+provider requests. The publisher origin is not a third party, but it gets
+only the small one:
+
+- **Publisher origin. The mirror stripped.** The publisher proxy removes
+  `__Host-ts-eids-s` (`TS_ORIGIN_STRIPPED_COOKIE_NAMES`) from the `Cookie`
+  header it forwards (`publisher.rs:3124-3147`), and drops the header when
+  nothing is left. `ts-ec` and `ts-eids` still reach the origin, as today,
+  because publishers' servers may read them, and nothing else gives an
+  origin the browser's IDs: `x-ts-eids` is set only on `/auction`
+  responses and never forwarded downstream (`constants.rs:59-69`). So the
+  origin's `Cookie` header stays at today's size; only the mirror would add
+  to it, up to about 2 KB. An operator whose origin rejects large headers
+  (common servers answer 400 or 431 above about 8 KB per header line) sets
+  `[ec] strip_eids_cookie_from_origin = true`, which strips `ts-eids` too
+  (`TS_ORIGIN_STRIPPED_COOKIE_NAMES_WITH_EIDS`). A metric still reports the
+  inbound `Cookie` header size (section 14).
+- **Prebid Server.** Stripped in the Prebid transport before the
+  consent-forwarding mode is checked (`integrations/prebid.rs:2091-2108`), so
+  it applies in every mode, including the early return that forwards the raw
+  header. A `Cookie` header that is not valid UTF-8 is dropped, not
+  forwarded. The call site passes every `Cookie` value, not one.
+- **Integration proxies.** They already use header allowlists without
+  `Cookie` (`integrations/lockr.rs:245`, `didomi.rs:258`, `permutive.rs:259`).
+- **Identity providers.** The coordinator rejects any request with a `Cookie`
+  header (section 4.7).
+
+The strip iterates every `Cookie` field, as `gpt_diagnostics.rs:394-416` does,
+and drops the header when nothing is left. It matches cookie names only; no
+route opens `ts-eids-s`. The configured source list is computed once per
+settings load, not per request.
+
+### 6.3 Read order
+
+The server-side view of provider IDs is the KV row, and nothing else. For a
+request with a valid EC that uses identity (the writer request, `/auction`,
+`/_ts/page-bids`, or a capture removal write):
+
+1. **The writer's phase 1** reads the KV snapshot on every returning-EC
+   navigation. The read finds orphans (section 5.5), feeds eligibility
+   (section 4.7), filters browser candidates (section 7.1) and serves the
+   withdrawal path when consent is withdrawn.
+2. `/_ts/api/v1/identify` reads the row with `kv.get` and never writes it
+   (section 5.1). It reads KV only, never a cookie copy, and applies the
+   servability check and the browser-context rule of section 7.1.
+3. `/auction` and `/_ts/page-bids` keep their existing reads and gain no new
+   triggers. A stager navigation that runs an auction, such as a prefetch,
+   preloads as today, without the pull-complete marker's skip (section
+   10.4).
+4. **Any request that read KV** uses the row as the base:
+   - A tombstone, or `consent.ok = false`, empties the server set. An
+     `/auction` or `/_ts/page-bids` response returns `clear` for the
+     mirror.
+   - A missing row, unless this request is about to recover it, empties the
+     server set and stores nothing (section 5.6).
+
+A request that read no KV, such as a proxied Lockr API call with no
+revocation, has no server set. It needs none, because it persists no
+positive ID (section 5.3).
+
+## 7. Auction merge and ownership
+
+### 7.1 Merge
+
+`merge_auction_eids` (`auction/endpoints.rs:505`), and the navigation and
+page-bids merge (`publisher.rs:5547-5568`), take a third input: the server
+set. It holds the KV records the request read, with expired records left
+out. It never holds anything from `ts-eids-s`. The server set requires
+what today's KV path requires: `ec_allowed()`, and a live consenting row
+whenever the request read KV (`endpoints.rs:446-460`). Each server-side ID
+must also pass, for this request, the consent policy of the provider that
+wrote it (`w`) and, for an owned source, the owner's policy as well. So for a
+provider under the strict policy, the sharing and targeted-advertising
+opt-outs and GPC stop it even when the generic gates pass. The generic pull
+provider keeps today's pull sync policy (section 10.4): `ec_allowed()` and
+`allows_eid_persistence`, which these opt-outs do not reach. Putting it
+under the strict policy would change behaviour that predates this spec, and
+is left to a later change. Also, an unowned source that a strict provider wrote is
+not disclosed once that provider's policy fails. A record whose writer is
+disabled or no longer configured has no policy left to check, so it is
+never served, and it counts as absent for `FillMissing` and for unowned
+`Initial`, so the browser or another provider can replace it. A record
+without `w` (browser ingest or version 1) needs the owner's policy for an owned
+source, and only the generic gates for an unowned one, as today.
+
+For each source, the value sent to bidders is:
+
+| Source kind | Browser sent the source                                                | Browser did not send it                                                       |
+| ----------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| Owned       | the owner's valid value, else the browser's unless the owner denies it | the owner's valid value, else a browser-seeded value if the IDs do not expire |
+| Unowned     | the browser's value (today's rule)                                     | the server value, if any (today's rule)                                       |
+
+"The owner's valid value" means a record with `w` set to the owner that is
+not past its `exp`. A browser-seeded record never beats the browser's
+current value. It may be stale, which is the problem the EID fidelity work
+fixed (D9). For a provider whose IDs expire, a browser-seeded record is never
+sent from the server at all (section 6.1).
+
+**How a server value goes out.** A server value is the source's whole entry
+set, one outbound EID per stored entry, in stored order, after the browser
+entries (EID fidelity spec §4.5). A one-UID record without EID-level
+fields is one entry, exactly as today (`ec/eids.rs:64-76`). For each entry:
+
+- Each UID uses its stored `atype`, else `[[ec.partners]].openrtb_atype`,
+  and its stored UID-level `ext`.
+- The entry keeps its stored EID-level fields. For a value a provider
+  wrote, an entry that sets none of `inserter`, `matcher` and `mm` gets
+  that provider's `with_provenance` default for the source (section 4.3).
+- An owner's valid value replaces every browser entry for the source, all
+  of them when the browser repeated the source. Its set is never mixed
+  with browser entries.
+
+A browser value keeps the browser's own entries and EID-level fields, as the
+EID fidelity work requires. A browser-seeded or version 1 record is one
+entry with one UID, so everything that predates this spec goes out
+unchanged.
+
+This needs the output path to carry a set. Today `resolve_partner_ids`
+returns `ResolvedPartnerId { uid, openrtb_atype }` and `to_eids` builds one
+EID from each (`ec/eids.rs:21-28`, `:64-78`), for the auction
+(`auction/endpoints.rs:465-466`) and the admin view
+(`ec/admin.rs:485-486`). `ResolvedPartnerId` gains the record's servable
+entry set and its writer, and `to_eids` emits one `Eid` per stored entry
+under the rules above. `build_eids_header` and both callers use it
+otherwise unchanged. For a one-UID record without `w`, the output is
+byte-identical to today's.
+
+**Provider denials apply to browser candidates.** Before the precedence
+above, the browser's candidates pass the denials of the providers that
+claim their source, read from KV:
+
+- A browser UID whose hash is in the `ps.iv` or `ps.ov` of a provider that
+  claims the
+  source is dropped, for owned and unowned sources alike. Once a provider
+  invalidates UID A, or removes it with an opt-out, an A still in the
+  `/auction` body or in `ts-eids` is not sent.
+- While the owner of a source has a sticky `ps.o`, the browser's value for
+  that source is dropped, until the opt-out clears (section 8). The same
+  holds for every source of a capture-only provider with a sticky `ps.o`,
+  owned or not, because its IDs reach TS only through the browser.
+
+These run before `gate_eids_by_consent`, which knows nothing of
+provider-specific rejections. `ps.iv` and `ps.ov` each keep the 128 most recent hashes, so an older rejected UID can be sent again once evicted. A removed set adds a
+hash for each of its UIDs (section 7.2), so a browser entry is filtered UID
+by UID, and an entry left with no UID is dropped. Every writer navigation,
+`/auction` and `/_ts/page-bids` auction reads KV and filters fully.
+Unowned sources otherwise keep today's browser-first rule: a provider can
+veto only the UIDs it removed itself, never the source.
+
+The browser's candidates include any `ts-eids-s` mirror ID a page script
+fed back through Prebid (section 6.2). It is filtered like any other
+browser value, so a stale mirror copy of an ID a provider has since removed
+is not sent.
+
+Sources with `bidstream_enabled = false` are
+left out, as `resolve_partner_ids` does today (`ec/eids.rs:36`).
+
+The merged set is consent-gated (`gate_eids_by_consent`) and reported in
+`x-ts-eids` exactly as today, with the same 4 KB cap. A full entry set can
+reach that cap sooner, and `x-ts-eids-truncated` is set as today. The
+header's truncation stays per entry, as today (`encode_eids_header`,
+`ec/eids.rs:106`), because the header also carries the browser's entries,
+whose truncation must not change. So the header can hold part of a set;
+`user.eids` always holds it whole. `x-ts-eids` therefore shows server-only
+IDs, EID-level fields included. The calling script can read it, and so can
+any page script that wraps `fetch`. The `ts-eids-s` mirror shows the same
+server-side entries to every page script (section 6.2). The header stays
+for validation and troubleshooting, and both exposures are accepted
+(section 9.3).
+
+One shared servability check covers expiry, the rollback rule, the writer's
+and owner's consent policies, and opt-outs: a record whose writer has `ps.o`
+set is never served, and neither is any record of a source whose owner has
+`ps.o` set, whoever wrote it: an owner's opt-out removes only what the owner
+wrote, so a browser-seeded record can remain. No stored record matches an
+owner's `ps.iv`, because every invalidation removes its record and step 3
+of section 5.4 blocks a refill. `resolve_partner_ids` (`ec/eids.rs:36`), the admin view
+(`ec/admin.rs:485`) and `/_ts/api/v1/identify` all use it. `/identify` reads
+`entry.ids` directly today (`ec/identify.rs:99-103`), so it switches to the
+check. Its response shape does not change: `uid` is the first UID of the
+first entry of the source's record, when that record passes the
+servability check, and `eid` is built from that UID with the partner's
+`openrtb_atype`, as today (`ec/identify.rs:127-135`). A partner calling
+`/identify` gets the one UID it gets today, never a provider's full set. The
+stale module comment at `ec/eids.rs:1-5` is corrected. So expired IDs are
+never returned by any of them (G7).
+
+**Consent for `/identify`.** The policies are checked against the visitor's
+consent on this request, never against the row's stored `consent.tcf` and
+`consent.gpp`, which are snapshots from creation and authorize nothing.
+`/identify` takes its EC only from the `ts-ec` cookie, never from a
+header (`ec/mod.rs:325`), and builds its consent from the same request's
+cookies, `Sec-GPC` and geolocation (`ec/mod.rs:338-345`). That does not
+prove the visitor's browser sent the call: the EC ID is a bearer value
+(section 9.5), and a server that holds it can send `Cookie: ts-ec=<id>`
+with its own consent cookies. So `/identify` returns a provider-written ID
+(a record with `w`) only with browser context: an `Origin` the CORS check
+allows and a `Sec-Fetch-Site` of `same-origin` or `same-site`. A call
+without either, including one with no `Sec-Fetch-Site` at all, gets the
+response it would get if that record were absent. A browser-seeded record
+keeps today's behaviour. Within a request:
+
+- An absent consent string is treated as the auction treats it. Where TCF
+  applies, a strict policy finds no vendor consent and blocks. Elsewhere
+  only the signals present (GPC, GPP, US Privacy) apply.
+- The geolocation is the requester's, which for a browser call is the
+  visitor's.
+- A later vendor denial blocks that provider's IDs even while global EC
+  consent still passes, because each ID needs its writer's and owner's
+  policy, not only `ec_consent_granted`.
+
+No persisted visitor authorization is added, so `IdentityMutation` carries
+no consent update.
+
+### 7.2 Ownership semantics
+
+- **Owned source.** The owner is authoritative. It refreshes when due
+  (section 4.7, step 4), and its valid value wins in the auction. Browser
+  ingest may only fill the source when it is absent or its record is
+  expired. That includes a `ts-eids-s` mirror ID the page fed back
+  (section 6.2).
+  That seeds it: the owner treats a value it did not write as due, and
+  refreshes it at once. No other provider may claim the source (section
+  10.2).
+- **Removed values are not re-seeded.** When a provider's invalidation or
+  opt-out removes a record, the hash of each UID in the removed set goes
+  into that provider's `ps.iv` or, for an opt-out, its `ps.ov` (section
+  5.4). Browser ingest skips a UID in the `ps.iv` or `ps.ov` of any provider
+  that claims the source, so the browser cannot
+  re-seed a value a provider just rejected, and no
+  invalidate-reseed-refresh loop starts.
+- **A provider replaces its own set whole.** For an owned source, a result
+  that names it replaces every stored entry for it, so the owner drops one
+  entry by returning the set without it. For an unowned source a result
+  only fills an absent or expired record (`FillMissing`) and never
+  replaces one, so an unowned provider cannot drop an entry. Browser ingest
+  never adds an entry to a
+  provider's set: it fills a source only when it is absent or expired, as
+  today.
+- **Unowned source.** Any provider claiming it, and the browser, write with
+  `FillMissing` only. Unowned sources are never refreshed. This is exactly
+  today's pull-sync contract. The auction is browser-first.
+- **Batch sync.** A batch-sync update to an owned source applies only when
+  the source is absent (`ec/batch_sync.rs:247`). It never replaces the
+  owner's value. Unowned sources keep today's batch-sync behaviour.
+
+## 8. Errors and outcomes
+
+Every resolving provider runs on the writer, so every effect below goes
+into the writer's mutation. A capture, the only provider result on a
+stager, stores its removals, opt-out and clear through the capture removal
+write (section 5.3), and nothing else.
+
+| Result or error                                                                | Stored IDs                                                                                                                                             | `ps`                                                                                   | Log   |
+| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | ----- |
+| `Resolution::found`                                                            | `OwnerWrite` or `FillMissing` per source                                                                                                               | `f = 0`; `st` replaced or cleared when the resolution says so                          | debug |
+| A stateful result whose IDs or state lost to a newer write (section 5.4)       | unchanged; the result's removals still apply                                                                                                           | unchanged                                                                              | debug |
+| `replacing_state` oversized or unserializable                                  | no IDs stored; the result's removals still apply                                                                                                       | `st` unchanged; `f` and `n` as for `Malformed`                                         | warn  |
+| `Resolution::no_match`                                                         | unchanged                                                                                                                                              | `n = now + retry_in` (default 24 h, max 7 d)                                           | debug |
+| `Resolution::invalidate`, `also_invalidate`                                    | `OwnerRemove` of the whole set, with the revision the request read                                                                                     | on apply, a hash per UID of the removed set added to `iv`; `n = now`                   | info  |
+| `Resolution::opted_out`                                                        | `WriterRemove` for every record this provider wrote, owned or unowned; for a capture-only provider, also every record of its sources no provider wrote | `o = {at: now, fp}`, `st` cleared; a hash per UID of each removed record added to `ov` | info  |
+| `with_retry_in` on any resolution                                              | as above                                                                                                                                               | `n` is at least `now + retry_in`                                                       | debug |
+| `request` returns `None`, or `InputUnavailable`                                | unchanged                                                                                                                                              | `n = now + refresh_after_sec`                                                          | debug |
+| A recorded `InvalidState`, whatever the provider returned                      | as the result says                                                                                                                                     | `st` cleared, `f` unchanged, `n = now + refresh_after_sec` unless the result sets `n`  | warn  |
+| Hold-mode budget spent before the answer                                       | unchanged                                                                                                                                              | `n = now + hold_retry_sec`                                                             | debug |
+| `Rejected` with a 4xx other than 429, `Config`, `UndeclaredInput`, `Malformed` | unchanged                                                                                                                                              | `f += 1`, `n = now + min(1 h × 2^(f-1), 24 h)`                                         | warn  |
+| `Rejected` with 429 or 5xx, `Transport`, timeout                               | unchanged                                                                                                                                              | `f += 1`, `n = now + min(5 min × 2^(f-1), 1 h)`; breaker `record`                      | info  |
+| Breaker open                                                                   | not dispatched                                                                                                                                         | unchanged                                                                              | debug |
+| Burst cap exceeded (section 4.7 step 9)                                        | not dispatched                                                                                                                                         | `n = max(n, now + 60 s)`; never a failure                                              | debug |
+| Backend budget spent (section 4.7 step 8)                                      | not dispatched                                                                                                                                         | unchanged; never a failure                                                             | debug |
+| Capture: any result or error                                                   | removals as above; positive IDs counted in `capture_unpersisted`, never stored                                                                         | only `o`, `oc`, `iv` and `ov`; never `n`, `f` or the breaker                           | debug |
+| Captured `opted_out`, `revoke_scope = "global"`, any client                    | the withdrawal tombstone removes the row (section 5.1)                                                                                                 | removed with the row                                                                   | info  |
+
+**Sticky opt-outs.** `ps.o = {at, fp}` records a provider-reported opt-out
+and the consent fingerprint at that time. Server-side calls do not carry the
+vendor's own opt-out cookie, so `o` is TS's only record of it. Applying it
+removes every record the provider wrote, and for a capture-only provider
+every record of its sources that no provider wrote (section 5.4). While it
+is set no record that provider wrote is served, and the browser's values it
+denies are dropped (section 7.1). It is cleared only by an affirmative
+re-grant for this provider, and clearing it empties `ps.ov` (section 5.4):
+
+- **A provider with a GVL ID:** `fp` at `at` records a decoded TC string
+  that denied the provider's vendor or a purpose its policy requires, and
+  the current TC string grants the vendor and every required purpose. Only
+  that denied-to-granted transition clears. TCF `Created` and `LastUpdated`
+  are day-level and set by the client, so neither is compared with `at`: a
+  same-day re-grant clears, and a later CMP re-save under signals that
+  already granted the vendor does not. A vendor-reported opt-out recorded
+  under full TCF consent is cleared only by the vendor issuing again, for a
+  capture-only provider, or by an operator.
+- **Any provider, under GPP:** the applicable US section showing no sale,
+  sharing or targeted-advertising opt-out for the signals the provider's
+  policy reads, where `fp` at `at` recorded one. GPP carries no creation
+  time, so the clear is by section values: the opt-out clears when `fp`
+  records at least one US opt-out bit (sale, sharing, targeted
+  advertising, GPC) and the current consent shows none of the opt-outs
+  `fp` records.
+- **A capture-only provider without a GVL ID, such as Lockr:** a later 2xx
+  capture that returns IDs, under the request's consent. That is the
+  vendor issuing again after the visitor re-consented through it. The
+  capture removal write stores the clear on that request, with the `at` of
+  the opt-out the request read as its watermark,
+  under the ordering of section 5.4 (section 5.3). The captured IDs
+  themselves are not stored; once the clear is in KV, the browser path
+  carries them through browser ingest.
+- **An operator,** through the admin endpoints.
+
+A change of jurisdiction, a newly present GPP string, or a privacy signal the
+provider relaxes never clears it. A clear is written to KV as `ps.oc`, its
+**watermark**: the `at` of the opt-out the clearing request read, not the
+time it ran. A slow request that left before a revoke, or a writer whose
+phase-1 read predates a revoke staged by another request, therefore names an
+older opt-out and cannot dismiss the newer one (section 5.4, step 3). The
+operator's clear uses the time it runs, so it lifts every opt-out up to
+then. A
+consent withdrawal's
+tombstone removes everything, provider opt-outs included: after it, the
+visitor starts again with a new EC.
+
+**Revoke scope.** A provider that declares `captures` has a `revoke_scope`
+(section 10.1), default `"provider"`. With `"provider"`, a captured
+`opted_out` is the provider opt-out above. With `"global"`, a captured
+`opted_out` runs today's consent-withdrawal tombstone path on that request
+instead (section 5.1): the row is tombstoned, the EC cookie is cleared, and
+everything is removed, provider opt-outs included. Because the CMP may still
+grant, the next navigation would mint a new EC and undo the revoke, so the
+response also sets `ts-ec-revoked` (`Path=/; Secure; SameSite=Lax;
+HttpOnly`, the EC cookie's domain and one-year `Max-Age`), holding the strict
+policy's consent fingerprint for the request (section 8, `fp`, without DNT).
+`generate_if_needed` mints no EC while the request carries that marker and
+its own fingerprint equals it. Once the consent changes, minting resumes and
+the response that sets the new `ts-ec` expires the marker. A CMP re-save with
+the same decisions keeps the fingerprint, so it does not lift the revoke. It uses the withdrawal's
+existing exception, so it adds no page-load exception to G4, and like a
+withdrawal it applies whatever the client (section 4.7). An opt-out from `resolves` is always
+provider-scoped.
+
+The **consent fingerprint** `fp` is a bitmask, written as hex, of the
+consent signals the provider's policy reads:
+
+- its TCF purpose bits and vendor bit, set when granted, and a TCF bit
+  (bit 16) set when TCF applied and a TC string was decoded, so an unset
+  purpose or vendor bit records a denial only when the TCF bit is set
+- the US sale, sharing and targeted-advertising opt-outs it does not relax
+- GPC and DNT, unless relaxed
+
+It is stored in plain form: the same row already holds the raw consent
+strings (`KvConsent`, `ec/kv_types.rs:69-80`), so a keyed hash would protect
+nothing, and a plain bitmask can be compared bit by bit. It is not the raw
+consent string, which changes whenever a CMP re-saves it.
+
+Rules:
+
+- No error ever deletes a still-valid ID. Only `Resolution::invalidate` and
+  `also_invalidate` (by revision) and `opted_out` (everything the provider
+  wrote) delete.
+- An expired ID is not permission to call. Eligibility still applies.
+- Errors are logged with provider ID, outcome and status only (section 9.3).
+- A provider whose IDs expire and whose refresh keeps failing loses its ID
+  at `exp`, not before.
+
+## 9. Security and privacy
+
+### 9.1 Consent
+
+- **Before dispatch:** global EC consent, EID-persistence consent, and the
+  descriptor's `ConsentPolicy` (section 4.3). "Where TCF applies" means
+  `gdpr_applies` or a jurisdiction of `Gdpr` or `Unknown`, matching
+  `consent_allows_server_side_auction` (`consent/mod.rs:298-308`). Each check
+  maps to a signal TS decodes:
+  - TCF purposes and vendor consents (`consent/tcf.rs:145`), read through
+    `effective_tcf` (`consent/mod.rs:283-289`), so a GPP EU TCF section
+    counts as a TC string does. Vendor consent uses the existing
+    `TcfConsent::has_vendor_consent` (`consent/types.rs:278`). Publisher
+    restrictions are not decoded (`consent/types.rs:176`), so a CMP's
+    per-vendor "not allowed" restriction is not applied.
+  - The US sale opt-out, from GPP US sections (`consent/gpp.rs:74`, `:125`)
+    or the US Privacy string (`consent/us_privacy.rs:50-63`).
+  - The US sharing and targeted-advertising opt-outs. This work extends the
+    GPP decoder to extract them next to `decode_us_sale_opt_out`
+    (`consent/gpp.rs:125`). The `iab_gpp` crate already exposes
+    `sharing_opt_out` in the US National and California sections, and
+    `targeted_advertising_opt_out` in the US National section and the state
+    sections that define it.
+  - GPP section 6, the US Privacy string inside GPP, which the decoder skips
+    today (`consent/gpp.rs:112`), and the US National section's GPC and
+    known-child fields. This work decodes them too. A known child without
+    consent blocks every provider, except generic pull's parity policy
+    (`eid_persistence_only`), which keeps only the global gates so pull sync
+    behaves as it does today. A US section or section 6 that is present but
+    fails to decode blocks every provider the same way (fail closed).
+  - `Sec-GPC` (`consent/extraction.rs:25-50`).
+  - DNT, captured in phase 1 (section 4.4). TS reads it today only for the
+    auction (`auction/routing.rs:336`).
+- **Fail closed.** `strict()` blocks when a raw TC, GPP or US Privacy string
+  is present but has no decoded form, for example in proxy mode or after a
+  decode failure (`consent/mod.rs:104-127`, `:197-210`). A GPP string that
+  decodes but has no applicable section, such as the header-only `DBAA` a
+  CMP sends when no section applies, has a decoded form and carries no
+  opt-out, so it does not block `strict()` by itself. Where TCF applies, the
+  policy still needs TCF consent from a TC string or a GPP TCF section.
+- **Before disclosure:** the live-row read and eligibility recomputation
+  described in section 4.7.
+- **At write:** the CAS on that read's generation.
+- **In the mirror payload:** the IDs returned for `ts-eids-s` pass the
+  servability check and the generic gate against the request's consent
+  (section 6.2). Removals and opt-outs never need consent to apply
+  (section 5.6).
+- **In the bidstream and `/identify`:** server-side IDs pass their
+  writer's policy and, for an owned source, the owner's, against the
+  request's visitor consent (section 7.1). Owner denials also filter the
+  browser's candidates.
+- **On withdrawal:** the tombstone is written synchronously on whichever
+  request carries it (section 5.1), and the next `/auction` or
+  `/_ts/page-bids` response tells the shim to clear `ts-eids-s` (section
+  6.2). A global revoke takes the same path (section 8).
+
+### 9.2 Outbound requests
+
+- HTTPS only. Redirects are not followed.
+- The host must be one of the descriptor's `resolves` hosts.
+- Providers build headers from scratch. The coordinator rejects any request
+  with a `Cookie` header, and TS's identity cookies are stripped from Prebid
+  Server requests. The publisher origin receives `ts-ec` and `ts-eids` but
+  never the mirror (section 6.2).
+- Providers get only the inputs their descriptor declares (section 4.4).
+  Only generic pull receives the EC ID. Location is coarse (country and
+  subdivision), page URLs carry no query string, and the consent view
+  carries no decoded jurisdiction, though the raw GPP string still shows the
+  applicable state section (section 4.4). A URL path can still carry
+  identifiers, so most providers should want `PageUrl` rather than need it.
+- The client IP comes only from the platform's client-IP API. A provider that
+  needs it in `X-Forwarded-For` sets it from `ResolveInput::client_ip`.
+  Client-supplied forwarding headers are never copied.
+- Response bytes are capped before and after decompression.
+
+### 9.3 Logging and data handling
+
+- Never log UIDs, envelopes, HEMs, provider state, consent strings, cookie
+  values, or provider URLs with a query string. EC IDs go through `log_id`
+  (`ec/mod.rs:63`).
+- Provider errors are logged with `current_context()` only, never with
+  `{:?}` of the report, whose attachments could carry a URL or body.
+- `ProviderRequest`, `ProviderResponse`, `ResolveInput`, `CaptureInput`,
+  `StoredId`, `ResolvedEid`, `ResolvedUid`, `ProviderConsent` and
+  `HashedEmail` have redacting `Debug` implementations. `ConsentContext`
+  gets one too, because it derives `Debug` over the raw consent strings today
+  (`consent/types.rs:109`).
+- The Lockr proxy logs only the path of the upstream URL, not its query
+  (`integrations/lockr.rs:204-205`).
+- The rate-limit visitor key is an HMAC of the full EC ID with a key
+  derived from `ec.passphrase`, because it leaves the row for the rate
+  limiter. Its windows last 60 seconds, so a passphrase rotation costs
+  nothing. Nothing stored in the row is keyed: `ps.iv` and `ps.ov` hold unkeyed UID hashes (section 6.1) and the consent fingerprint is a plain bitmask
+  (section 8), because the same row already holds the raw UIDs and consent
+  strings. So a passphrase rotation breaks nothing stored.
+- `CaptureInput` never exposes request bodies or request headers. Proxied
+  requests can contain an email or HEM. TS forwards them, and never reads a
+  proxied request body for identity.
+- Provider state stays in KV. It is never sent to bidders, put in a cookie or
+  returned by the admin lookup.
+- A provider's EID-level `ext` and UID-level `ext` are vendor data, such as
+  segments or match metadata. They are stored in KV and never in `ts-eids`,
+  which keeps dropping EID-level `ext` (EID fidelity spec §4.3). They reach
+  bidders, `x-ts-eids` and the `ts-eids-s` mirror under the same consent
+  gates as the UIDs. A vendor spec that stores such data states what it
+  holds, as part of its privacy review.
+- **Server-only IDs are readable by page scripts.** `ts-eids-s` is not
+  `HttpOnly` and is not sealed, so every script on the page can read the
+  servable server set, including UID2 advertising tokens and LiveRamp
+  envelopes. `x-ts-eids` already exposes the same IDs to the calling script
+  and to any script that wraps `fetch` (section 7.1), so the mirror adds no
+  new class of reader. The mirror holds only what bidders receive: never
+  `ps.st`, refresh tokens or other provider state (section 6.2). It is
+  stripped from origin and Prebid Server requests like the other ID
+  cookies. A vendor spec whose IDs must not reach page scripts says so, and
+  the operator gives its source `bidstream_enabled = false` or keeps the
+  provider off.
+
+### 9.4 Caching
+
+This spec adds no `Set-Cookie` to any response. TS never sets `ts-eids-s`:
+the shim writes it from JSON responses that are already private (section
+6.2). Returning-visitor HTML keeps today's cacheability, and removing the
+pull-complete marker (section 10.4) takes away the one `Set-Cookie` a
+returning-visitor navigation could carry today (section 3.4).
+
+### 9.5 The EC ID is a bearer value
+
+The EC ID is the value of the `ts-ec` cookie (`ec/mod.rs:197-203`, `:325`),
+and any server can send that cookie. Partners and the origin already hold
+raw EC IDs: every `/identify` 200 returns `ec` (`ec/identify.rs:139`), pull
+sync appends `ec_id` to the partner URL (`ec/pull_sync.rs:368-371`), and the
+origin receives `ts-ec`. A call with no `Origin` header is accepted
+(`CorsDecision::NoOrigin`, `ec/identify.rs:52`). Consent comes from the
+caller's own cookies and IP geolocation (`ec/mod.rs:338-345`).
+
+So a holder of an EC ID can present its own consent, which skips the
+visitor's vendor denials, US opt-outs and GPC. Sealing and CAS prove that
+TS wrote a value, never that the visitor's browser carried the request.
+This spec designs against that:
+
+- Removals, opt-outs and invalidations only remove, so a replayed EC can
+  make TS forget an ID but never disclose one.
+- A capture clear (section 8) re-enables a capture-only provider. A holder
+  that replays the EC through the vendor's proxied API and gets a 2xx with
+  IDs can clear that provider's opt-out. Accepted: the vendor issued again
+  for that request, and the IDs reach KV only through the browser path.
+- `/identify` fails closed for provider-written IDs without browser
+  context (section 7.1). Both headers can be forged by a server, so this
+  stops a partner that replays an EC with a plain HTTP client, not one that
+  imitates a browser; it costs nothing, and the IDs at stake did not reach
+  `/identify` before this spec.
+- `x-ts-eids` on `/auction` is accepted as a troubleshooting header
+  (section 16): a replayed EC with granting consent reads the server set
+  through it, as it reads the browser's own IDs today.
+
+## 10. Configuration
+
+### 10.1 Layers
+
+```toml
+# Coordinator policy: vendor-neutral, one place for every timing choice.
+[ec.identity]
+# Replaces ec.pull_sync_concurrency, which is removed (section 10.2).
+max_concurrency = 4
+# Shared wall-clock budget for all hold-mode providers, in milliseconds.
+# Default 100 (section 4.7 explains why).
+hold_budget_ms = 100
+# After a call is cut off by the hold budget, wait this long before the
+# next. Default 300.
+hold_retry_sec = 300
+# Per provider response, before and after decoding.
+max_response_bytes = 65536
+# Backend requests one execution may start: origin, auction and provider
+# calls together. Default 32, Fastly's limit; 10 on trial accounts.
+max_backend_requests = 32
+
+[ec.identity.providers.id5]
+# "hold" or "after_send". Default "after_send". Providers run only on
+# writer navigations. Hold mode runs before the navigation's auction, and
+# after send when the navigation runs none (section 4.7, step 7).
+mode = "hold"
+# Hold dispatch before the auction: min(timeout_ms, remaining hold budget).
+# Default: hold_budget_ms.
+timeout_ms = 80
+# Any dispatch after send, including a hold-mode provider on a navigation
+# that runs no auction. Default 1000.
+after_send_timeout_ms = 1000
+# Narrows the sources this provider may write. Default: every source its
+# descriptor declares. Narrowed here to the one source registered below.
+sources = ["id5-sync.com"]
+# Refresh interval when the provider gives no refresh hint, and the wait
+# after a skipped call. Default 86400.
+refresh_after_sec = 86400
+# Burst cap per visitor, enforced in 60-second windows. Default 1.
+max_calls_per_minute = 1
+# Ceiling per client address across visitors, in 60-second windows.
+# Default 10; 0 turns it off.
+max_calls_per_ip_per_minute = 10
+# Skip the provider for every visitor once this many transport failures,
+# timeouts, 429s or 5xx responses happen within one 60-second window.
+# Default 50.
+breaker_failures_per_minute = 50
+# Lower is left out of the ts-eids-s mirror first when it exceeds its cap.
+# Default 0.
+cookie_priority = 10
+
+[ec.identity.providers.lockr]
+# Required for a capture-only provider: its opt-out removes browser-ingested
+# records of every source listed here (section 5.4).
+sources = ["id5-sync.com"]
+# Only for providers that declare `captures`. "provider" or "global".
+# Default "provider": a captured opt-out removes this provider's records.
+# "global" runs the consent-withdrawal tombstone instead (section 8).
+revoke_scope = "provider"
+
+# Source policy: the existing table, with one new field.
+[[ec.partners]]
+name = "ID5"
+source_domain = "id5-sync.com"
+openrtb_atype = 1
+bidstream_enabled = true
+# New. A provider ID that owns this source. Absent: unowned.
+owner = "id5"
+
+# Vendor protocol: the integration's own table, defined by its own spec.
+[integrations.id5]
+enabled = true
+partner_id = 1234
+```
+
+`[ec.identity]` and each `[ec.identity.providers.<id>]` table are optional.
+A provider with no table uses the defaults.
+
+### 10.2 Validation
+
+Deploy-time validation (`validate_settings_for_deploy`, `config.rs:249-262`)
+parses integration configs but never builds providers. Each identity
+integration gets a line in a new `validate_identity_integration::<T>` list
+next to today's per-type list (`config.rs:303-332`). That function parses the
+config as `T: IdentityProviderConfig` and calls `build_descriptor`, which
+needs no secrets and returns the same descriptor the running provider
+stores. A separate pass builds the descriptors of `[[ec.partners]]` pull
+providers. The identity check runs next to
+`PartnerRegistry::validate_config_for_deploy` (`config.rs:260`) in
+`ts config validate` and `ts config push`, and in
+`validate_settings_for_runtime` at startup (`config.rs:270-280`). It applies
+each provider's `sources` narrowing before checking ownership.
+
+Each of these is an error:
+
+- `owner` names a provider that is not enabled.
+- `owner` names a provider whose descriptor does not include that source,
+  or a capture-only provider, which never writes a record in v1 (section
+  4.7).
+- A descriptor fails to build (section 4.3).
+- An enabled provider claims a source with no `[[ec.partners]]` entry.
+- An enabled provider claims a source owned by a different provider. Use
+  `sources` to narrow one of them. For example, when native ID5 owns
+  `id5-sync.com`, Lockr is narrowed to the sources no native provider owns.
+- `sources` names a source the provider's descriptor does not declare, or
+  narrows the provider to no source at all.
+- A capture-only provider has no `sources` setting. Its opt-out removes
+  browser-ingested records of every source it keeps, including IDs other
+  vendors' own modules produced (section 5.4), so the operator must list the
+  sources it is the delivery path for; the default of every declared source
+  is not allowed.
+- Two providers have the same ID (section 10.4).
+- A capture rule lies outside the registering integration's proxy routes.
+  `IntegrationRegistry::with_plan` reports it at startup (section 4.3).
+- `[ec.identity.providers.<id>]` names an unknown provider.
+- `mode` is not `hold` or `after_send`.
+- More than 32 providers are enabled, generic pull partners included. A KV
+  row holds `ps` for at most 32 (section 6.1).
+- `timeout_ms` is greater than `hold_budget_ms` for a hold-mode provider.
+- `hold_budget_ms` is over 1,000, `max_concurrency` is 0,
+  `refresh_after_sec` is 0, or `after_send_timeout_ms` is 0 or over 10,000.
+- `revoke_scope` is set for a provider whose descriptor declares no
+  `captures`, or is not `provider` or `global`.
+- A removed key is set: `ec.pull_sync_concurrency`, or
+  `pull_sync_ttl_sec` or `pull_sync_rate_limit` on an `[[ec.partners]]`
+  entry. The error names the replacement (sections 10.1, 10.4).
+
+Validation never calls a provider. Live approvals, such as a LiveRamp
+placement or an approved origin, stay on the rollout checklist of each vendor
+spec.
+
+**Secrets.** A provider's secret fields, such as UID2's API key and client
+secret, are `Redacted<String>` config fields. At rest the config holds their
+secret-store key names, and they are resolved in memory before runtime
+settings are built (`secret_resolution.rs`). Each identity integration adds
+its secret paths to `TrustedServerAppConfig::secret_fields()`
+(`config.rs:136-175`). `build_descriptor` must never read a secret field,
+because deploy validation runs before resolution and would see key names.
+The harness's `check_descriptor_ignores_secrets` builds the descriptor from
+a config whose secrets are placeholder key names and from one with resolved
+secrets, so a descriptor that depends on a secret fails the test (section
+13).
+
+### 10.3 Registration
+
+`IntegrationRegistration::builder(ID)` gets
+`.with_identity_provider(Arc<dyn IdentityProvider>)`, next to `.with_proxy()`
+(`integrations/registry.rs:663`), and
+`.try_with_identity_provider(Result<P, Report<IdentityProviderError>>)`,
+which wraps a constructor's result for the common case (section 4.6). An
+integration can register more than one provider. The registry exposes
+`identity_providers()` to build the
+coordinator. `handle_proxy` offers a proxied response to every provider whose
+descriptor has a capture rule matching it (section 4.7). A compile-time guard,
+`const _: Option<&dyn IdentityProvider> = None;`, keeps the trait
+object-safe.
+
+### 10.4 Pull sync on the trait
+
+Each `[[ec.partners]]` entry with `pull_sync_enabled = true` registers a
+built-in `GenericPullProvider`. Its ID is `pull-` plus the source domain with
+dots replaced by `-` (for example `pull-ssp-example-com`). A domain that
+already contains `-` also gets `-` and the first 8 hex digits of the SHA-256
+of the full domain, so `a-b.example.com` and `a.b.example.com` get different
+IDs. An ID that would exceed 63 characters is cut and given the same hash
+suffix, so IDs stay unique and valid.
+No earlier build stored a generic pull provider ID: before this spec, pull
+sync kept no per-provider state and wrote no `w`, so the hash rule renames
+nothing that is persisted.
+
+Unchanged:
+
+- The protocol: `GET <pull_sync_url>?ec_id=<id>`, bearer `ts_pull_token`,
+  response `{"uid": "..."}`, the 64 KiB cap and the
+  `pull_sync_allowed_domains` allowlist.
+- Fill-missing only, unless the operator sets `owner`.
+- The hourly rotation of partner order, which keeps dispatch fair under
+  `max_concurrency` (`pull_sync.rs:143-156`).
+
+Its descriptor, built from the `[[ec.partners]]` entry:
+
+- One source, the entry's `source_domain`. Its IDs do not expire.
+- `resolves` with the `pull_sync_allowed_domains` as hosts and the
+  crate-private `with_ec_id()`, because the protocol is keyed by the EC ID.
+- A consent policy that blocks exactly what pull sync blocks today. The
+  migration parity tests (section 13) pin it.
+- Default `after_send`, and unowned.
+- Optional `owner = "pull-<domain>"` makes it authoritative.
+- Its pacing comes from `[ec.identity.providers.pull-<domain>]`, like any
+  provider's (section 10.1).
+
+What changes:
+
+- It is dispatched only on the writer request for a returning EC. Today it
+  runs after any response whose request loaded a consenting row
+  (`pull_sync.rs:86`, `:166-174`), including a new visitor's first
+  navigation. New visitors now reach pull partners from their second page
+  load.
+- Its results go into the single flush. Today it makes its own write.
+- Errors back off through `ps` (section 8). Today a failing partner is
+  retried on every eligible request, within the rate limit.
+- The rate-limit key moves from `pull:<domain>:<ec_hash>`
+  (`pull_sync.rs:373`) to the per-visitor key of section 4.7, next to the
+  per-IP ceiling of that step. Counters reset at deploy.
+- `pull_sync_ttl_sec` and `pull_sync_rate_limit` are removed from
+  `[[ec.partners]]` (`settings.rs:430-439`). Their roles move to
+  `refresh_after_sec` and `max_calls_per_minute`. Today's hourly limit
+  already rounds to a per-minute one (section 3.4), so an operator who set
+  `pull_sync_rate_limit = N` sets `max_calls_per_minute = ceil(N / 60)`.
+- The pull-complete marker (`pull_sync_marker.rs`) is removed. Every
+  returning writer navigation reads KV in phase 1 (section 6.3), so the
+  marker saves no read. TS stops setting and reading `ts-ec-pull-complete`;
+  a cookie a browser still holds expires within its one-hour `Max-Age`
+  (`pull_sync_marker.rs:22`).
+
+`dispatch_pull_sync` and `build_pull_sync_context` are removed.
+`run_edgezero_pull_sync_after_send` (`adapter-fastly/src/main.rs:618`)
+becomes the coordinator's phase 4 entry point.
+
+### 10.5 Overlap with #777
+
+The module stack in #777 replaces `[integrations.<id>]` with
+`[<type>.<id>]` (for example `[identity.lockr]`) and adds `ts config migrate`.
+Under that stack only the vendor protocol layer moves.
+`[ec.identity.providers.<id>]` is keyed by the same provider ID and is
+unaffected. Whichever lands second adapts its config paths. This spec is
+written against `main`.
+
+## 11. Adapters
+
+KV identity runs only on Fastly. Axum, Cloudflare and Spin build an
+`EcContext` for consent-gated routes, but have no `KvIdentityGraph`, no EC
+finalize and no EC generation (`publisher.rs:6896-6899`).
+
+This design changes nothing on them except the Prebid Server and origin
+cookie strips, which
+apply on every adapter. Providers are never dispatched there, and their
+`/auction` and `/_ts/page-bids` keep resolving client EIDs without KV. When
+EC identity is ported to them (#777 rows 52 to 54), phase 4 runs after send
+where the platform allows it (Cloudflare's `waitUntil`), and before the
+response otherwise.
+
+## 12. Vendor examples
+
+These examples were written against the API of sections 4.2 to 4.6 to test
+it. They are illustrations of the API, not the vendors' real code, and the
+framework does not depend on any detail in them. Endpoints, payloads,
+consent parameters, size limits and semantics such as what Lockr's
+revocation covers are decided in each vendor's implementation plan, which
+replaces any shape marked "assumed" below. `IntegrationConfig` impls are
+omitted; they match section 4.6. Endpoints come from operator config, shown
+with
+`example.com` hosts. Section 12.5 lists what writing them changed in the
+API.
+
+### 12.1 LiveRamp ATS (active resolution, expiring IDs)
+
+LiveRamp exercises refresh of an existing ID, expiring IDs, region-dependent
+lifetimes, initial resolution that needs a HEM, and headers built from
+inputs. The request parameters come from #1245 §9 and LiveRamp's envelope
+API documentation; the response shape is assumed. The vendor's own plan
+(#1461) is the source of truth for the real protocol.
+
+```rust
+#[derive(Debug, Clone, Deserialize, Validate)]
+pub struct LiveRampConfig {
+    pub enabled: bool,
+    /// For example `https://ats.example.com/api/identity/v2/envelope`.
+    /// Refreshes go to `<endpoint>/refresh`.
+    #[validate(url)]
+    pub endpoint: String,
+    /// LiveRamp placement ID. An operator identifier, not a secret.
+    pub placement_id: String,
+    /// Countries the placement is approved for, as ISO 3166-1 alpha-2.
+    pub approved_countries: Vec<String>,
+}
+
+impl IdentityProviderConfig for LiveRampConfig {
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        ProviderDescriptor::builder(LIVERAMP_INTEGRATION_ID.parse()?)
+            .with_source("liveramp.com".parse()?)
+            .with_expiring_ids()
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint(&self.endpoint)
+                    .with_needs([Input::ClientIp, Input::Region])
+                    .with_needs_for(ResolveKind::Initial, [Input::HashedEmail]),
+            )
+            .with_consent_policy(
+                ConsentPolicy::strict()
+                    .with_tcf_purposes(LIVERAMP_TCF_PURPOSES)
+                    .with_tcf_vendor(LIVERAMP_GVL_ID),
+            )
+            .build()
+    }
+}
+
+pub struct LiveRampProvider {
+    descriptor: ProviderDescriptor,
+    placement_id: String,
+    approved_countries: Vec<String>,
+}
+
+/// Whether the call was an initial lookup or a refresh. Carried from
+/// `request` to `response`.
+#[derive(Serialize, Deserialize)]
+enum LiveRampCall {
+    Initial,
+    Refresh,
+}
+
+/// Assumed shape: V2 returns several envelope products.
+#[derive(Deserialize)]
+struct EnvelopeReply {
+    envelopes: Vec<EnvelopeProduct>,
+}
+
+#[derive(Deserialize)]
+struct EnvelopeProduct {
+    #[serde(rename = "type")]
+    product_type: u32,
+    source: String,
+    value: String,
+}
+
+/// The regular ATS envelope (#1245 §9).
+const ATS_ENVELOPE_TYPE: u32 = 19;
+const ATS_ENVELOPE_SOURCE: &str = "envelopeLiveramp";
+/// Identifier types (#1245 §2): 4 is a hashed email, 19 an envelope refresh.
+const IT_HASHED_EMAIL: &str = "4";
+const IT_ENVELOPE: &str = "19";
+/// Consent type 4: `cv` carries a TCF v2 string.
+const CT_TCF: &str = "4";
+
+impl IdentityProvider for LiveRampProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let region = input.region()?;
+        if !self.approved_countries.iter().any(|country| country == region.country()) {
+            return Ok(None);
+        }
+
+        let source = input.primary_source();
+        let (call, identifier_type, identifier_value) = match input.stored(source) {
+            Some(stored) if input.is_refresh(source) => {
+                (LiveRampCall::Refresh, IT_ENVELOPE, stored.uid().to_owned())
+            }
+            _ => (LiveRampCall::Initial, IT_HASHED_EMAIL, input.hashed_email()?.to_hex()),
+        };
+
+        let consent = input.consent();
+        let endpoint = match call {
+            LiveRampCall::Refresh => join(input.endpoint()?, "refresh")?,
+            LiveRampCall::Initial => input.endpoint()?.clone(),
+        };
+        let mut request = ProviderRequest::get(&endpoint)
+            .with_query("pid", &self.placement_id)
+            .with_query("it", identifier_type)
+            .with_query("iv", &identifier_value)
+            .with_query("atype", "3")
+            .try_with_call_context(&call)?
+            .try_with_header("origin", &format!("https://{}", input.publisher_domain()))?
+            .try_with_header("x-forwarded-for", &input.client_ip()?.to_string())?;
+        if let Some(tc_string) = consent.raw_tc_string() {
+            request = request.with_query("ct", CT_TCF).with_query("cv", tc_string);
+        }
+        if let Some(gpp) = consent.raw_gpp_string() {
+            request = request.with_query("gpp", gpp);
+        }
+        if let Some(ids) = consent.gpp_section_ids() {
+            let ids: Vec<String> = ids.iter().map(u16::to_string).collect();
+            request = request.with_query("gpp_sid", &ids.join(","));
+        }
+        Ok(Some(request))
+    }
+
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let source = input.primary_source();
+        let call: LiveRampCall = response
+            .call_context()?
+            .ok_or_else(|| IdentityProviderError::config("missing call context"))?;
+
+        if response.status() == StatusCode::NO_CONTENT {
+            return Ok(match call {
+                LiveRampCall::Refresh => Resolution::invalidate(source),
+                // The user, or the browser through DNT or GPC, opted out.
+                LiveRampCall::Initial => Resolution::opted_out(),
+            });
+        }
+
+        let reply: EnvelopeReply = response.success_json()?;
+        let Some(envelope) = reply.envelopes.into_iter().find(|product| {
+            product.product_type == ATS_ENVELOPE_TYPE && product.source == ATS_ENVELOPE_SOURCE
+        }) else {
+            return Ok(Resolution::no_match());
+        };
+
+        let lifetime_days = if input.region()?.is("US", "CA") { 15 } else { 30 };
+        let eid = ResolvedEid::new(source, ResolvedUid::new(envelope.value).with_atype(3))
+            .with_expires_in(Duration::from_secs(lifetime_days * 86_400));
+        Ok(Resolution::found([eid]))
+    }
+}
+```
+
+What this shows:
+
+- `request` and `response` both need to know whether the call was an
+  initial lookup or a refresh, because a 204 means different things: on a
+  refresh LiveRamp no longer accepts the envelope, and on an initial lookup
+  the user, or the browser through DNT or GPC, is opted out. The call
+  context carries it (section 12.5).
+- A refresh goes to its own path, `<endpoint>/refresh`, with `it=19`.
+- The example sends the HEM as a query parameter for brevity. LiveRamp
+  takes it in a request body, which the vendor plan builds once HEM intake
+  exists.
+- A `Refresh` is attempted for an expired envelope too (section 4.4,
+  `ResolveKind`). LiveRamp answers 204 for one it no longer accepts, and the
+  record is invalidated.
+- LiveRamp keeps no private state, so it cannot set `refresh_until`. Its
+  descriptor declares `with_refresh_grace`, for as long as LiveRamp accepts
+  an expired envelope for refresh, so an envelope that expires while
+  LiveRamp is backed off or no navigation runs it stays a refresh anchor
+  rather than falling back to `Initial`, which needs a HEM v1 does not
+  have. The vendor plan (#1461) sets the length.
+- `Input::HashedEmail` is declared only for `Initial`, so in v1 an owned
+  `liveramp.com` source is resolved only by `Refresh`, of an envelope that
+  browser ingest seeded (section 7.2). For an `Initial`, eligibility step 4
+  leaves the source out because its needs are missing, so LiveRamp is not
+  called at all, and `input.hashed_email()?` is never reached.
+- A 451 or 4xx goes through `success_json` as `Rejected` and backs off that
+  visitor only (section 8).
+- The example sets no refresh hint, so the operator's `refresh_after_sec`
+  (default one day) paces refreshes. Each refresh costs a provider call and
+  a KV write, so a vendor hint belongs here only when LiveRamp documents
+  one.
+
+### 12.2 Lockr (passive capture)
+
+Lockr exercises capture from several exact paths, a revocation path that must
+work after consent is denied, an opt-out cleared by the vendor issuing
+again, vendor key names mapped to sources, expiry in milliseconds, and a
+complete
+EID: every UID and the EID-level fields as the vendor returned them, with a
+declared default for fields a response omits. The paths and payloads come from
+the earlier Lockr capture design (`spec/lockr-identity-capture`, its section
+2), measured on a live page.
+
+```rust
+const LOCKR_API: &str = "/integrations/lockr/api/publisher/app/v2/identityLockr";
+
+/// Lockr's token key names and the sources they carry. Only confirmed
+/// mappings are listed.
+const KEY_SOURCES: &[(&str, &str)] = &[
+    ("id5id", "id5-sync.com"),
+    ("_lr_env", "liveramp.com"),
+    ("__uid2_advertising_token", "uidapi.com"),
+];
+
+impl IdentityProviderConfig for LockrConfig {
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        let mut captures = Captures::new();
+        for endpoint in ["page-view", "generate-tokens", "refresh-tokens", "sync-no-hem-ids", "revoke-consent"] {
+            captures = captures.with_path(Method::POST, &format!("{LOCKR_API}/{endpoint}"));
+        }
+
+        let mut builder = ProviderDescriptor::builder(LOCKR_INTEGRATION_ID.parse()?)
+            .with_captures(captures);
+        for (_, domain) in KEY_SOURCES {
+            builder = builder.with_source(domain.parse()?);
+        }
+        builder
+            .with_provenance(
+                &"id5-sync.com".parse()?,
+                EidProvenance::new().with_inserter("Lockr-For-Publishers").with_mm(2),
+            )
+            .build()
+    }
+}
+
+#[derive(Deserialize)]
+struct TokenReply {
+    #[serde(rename = "aimTokens", default)]
+    aim_tokens: Vec<AimToken>,
+    #[serde(default)]
+    ids: BTreeMap<String, LockrId>,
+}
+
+#[derive(Deserialize)]
+struct AimToken {
+    key_name: String,
+    /// Milliseconds since the epoch.
+    identity_expires: Option<u64>,
+}
+
+#[derive(Deserialize)]
+struct LockrId {
+    eid: LockrEid,
+}
+
+/// Lockr's own EID shape. Not `openrtb::Eid`, which denies unknown fields
+/// (`openrtb.rs:72`, `:124`), so one new Lockr field would fail the whole
+/// reply.
+#[derive(Deserialize)]
+struct LockrEid {
+    source: String,
+    #[serde(default)]
+    uids: Vec<LockrUid>,
+    inserter: Option<String>,
+    matcher: Option<String>,
+    mm: Option<i32>,
+    ext: Option<serde_json::Value>,
+}
+
+#[derive(Deserialize)]
+struct LockrUid {
+    id: String,
+    atype: Option<i32>,
+    ext: Option<serde_json::Value>,
+}
+
+impl IdentityProvider for LockrProvider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn capture(
+        &self,
+        input: &CaptureInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        if input.path().ends_with("/revoke-consent") {
+            return Ok(Resolution::opted_out());
+        }
+
+        let Ok(reply) = input.response().json::<TokenReply>() else {
+            return Ok(Resolution::no_match());
+        };
+        Ok(Resolution::found(reply.ids.iter().filter_map(|(key, entry)| {
+            let (_, domain) = KEY_SOURCES.iter().find(|(name, _)| name == key)?;
+            let source = input.source_named(domain)?;
+            if !source.matches(&entry.eid.source) {
+                return None;
+            }
+            let expires = reply
+                .aim_tokens
+                .iter()
+                .find(|token| token.key_name == *key)
+                .and_then(|token| token.identity_expires)
+                .map(UnixTime::from_millis);
+            if expires.is_some_and(|at| at <= input.now()) {
+                return None;
+            }
+
+            let mut uids = entry.eid.uids.iter().map(resolved_uid);
+            let mut eid = ResolvedEid::new(source, uids.next()?);
+            for uid in uids {
+                eid = eid.with_uid(uid);
+            }
+            if let Some(inserter) = &entry.eid.inserter {
+                eid = eid.with_inserter(inserter);
+            }
+            if let Some(matcher) = &entry.eid.matcher {
+                eid = eid.with_matcher(matcher);
+            }
+            if let Some(mm) = entry.eid.mm {
+                eid = eid.with_mm(mm);
+            }
+            if let Some(ext) = &entry.eid.ext {
+                eid = eid.with_ext(ext.clone());
+            }
+            if let Some(at) = expires {
+                eid = eid.with_expires_at(at);
+            }
+            Some(eid)
+        })))
+    }
+}
+
+fn resolved_uid(uid: &LockrUid) -> ResolvedUid {
+    let mut resolved = ResolvedUid::new(uid.id.clone());
+    if let Some(atype) = uid.atype {
+        resolved = resolved.with_atype(atype);
+    }
+    if let Some(ext) = &uid.ext {
+        resolved = resolved.with_ext(ext.clone());
+    }
+    resolved
+}
+```
+
+What this shows:
+
+- **Exact paths.** A prefix would also capture `settings` and any future
+  endpoint. `Captures::with_path` matches one method and path.
+- **Revocation outlives consent.** `revoke-consent` arrives after the visitor
+  has denied consent, so the request's consent gate would block it. A
+  capture's removals must apply whatever the consent (section 12.5). It is
+  provider-scoped by default (`revoke_scope = "provider"`): it removes the
+  records of Lockr's sources that Lockr or browser ingest wrote, and blocks
+  the browser's values for them until Lockr issues again, never the EC.
+  Lockr never writes a record in v1, so without the browser-ingest part the
+  revoke would remove nothing (section 5.4). An operator who sets
+  `revoke_scope = "global"` makes it a full withdrawal that tombstones the
+  row, from any client (section 8). Lockr's plan settles which
+  scope Lockr's revocation means.
+- **Capture sees a token once, and v1 does not keep it.** Lockr returns a
+  token only when it first issues one. On a reload its SDK sends the saved
+  ID with `noGenerate`, and the response carries no new token (#1246).
+  Lockr's API calls are stagers, so the captured IDs are discarded and
+  counted in `capture_unpersisted` (section 5.3). The browser path carries
+  the UID browser ingest picks for each registered source (section 2.2) to
+  KV: Lockr writes the ID into
+  Prebid's `ortb2` config, which the EID fidelity work forwards in the
+  `/auction` body and `ts-eids`, and the next writer ingests it (section
+  2.3).
+- **Complete EIDs.** Lockr's ID5 EID carries `inserter`, `matcher` and `mm`,
+  which bidders read, and can carry more than one UID. The capture copies
+  every UID and every EID-level field the response holds, so a stored set
+  is what Lockr issued, under the limits of section 4.5. In v1 capture
+  stores no set; the full set matters once a durable path exists (section
+  15). The descriptor's
+  `with_provenance` stays as the default for a response entry that sets
+  none of `inserter`, `matcher` and `mm`; an entry that sets any of them
+  is Lockr's complete statement (section 4.3).
+- **Milliseconds.** `UnixTime::from_millis` converts Lockr's expiry, and a
+  token already expired at capture time is skipped.
+- **Optional expiry.** Lockr gives an expiry only for tokens listed in
+  `aimTokens`, so it marks no source as expiring. An expiry it does give is
+  still enforced: expired IDs are never sent (section 7.1). A provider whose
+  sources differ marks only the ones that always expire, with
+  `with_expiring_source`.
+- **Vendor types.** Lockr's payload is parsed into local, permissive types.
+  The repo's `openrtb::Eid` denies unknown fields, so it suits TS's own
+  output, not a vendor's input.
+- **The opt-out lasts until Lockr issues again.** Lockr has no GVL ID for a
+  TC string to re-grant, so its `ps.o` is cleared by a later successful
+  token capture under the request's consent, which the capture removal
+  write stores (section 8).
+- **Ownership and narrowing.** Lockr claims `liveramp.com` and `uidapi.com`
+  too. A capture-only provider must list its `sources` (section 10.2), so
+  the operator keeps only the sources Lockr delivers on that site. A Lockr
+  revoke then removes and blocks only those, not IDs the ID5 or LiveRamp
+  modules produced for a source Lockr is not narrowed to.
+
+### 12.3 UID2 (secrets, crypto, private state)
+
+UID2 exercises resolved secrets, encrypted request envelopes that need
+random nonces, a nonce that `response` must check against `request`, a large
+private state, and a provider-reported opt-out. The API names follow the
+UID2 server-side token endpoints. The envelope crypto is elided.
+
+```rust
+#[derive(Debug, Clone, Deserialize, Validate)]
+pub struct Uid2Config {
+    pub enabled: bool,
+    /// For example `https://uid2.example.com`.
+    #[validate(url)]
+    pub base_url: String,
+    /// Secret-store key names at rest, resolved values at runtime. Listed in
+    /// `secret_fields()` (section 10.2), so `build_descriptor` never reads them.
+    pub api_key: Redacted<String>,
+    /// The UID2 operator's IAB GVL ID, when it is a TCF vendor. UID2 itself
+    /// has none.
+    pub tcf_vendor_id: Option<u16>,
+    pub client_secret: Redacted<String>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct Uid2State {
+    refresh_token: String,
+    refresh_response_key: String,
+    /// Milliseconds since the epoch.
+    refresh_expires: u64,
+}
+
+#[derive(Serialize, Deserialize)]
+struct GenerateCall {
+    request_nonce: [u8; 8],
+}
+
+#[derive(Deserialize)]
+struct Uid2Reply {
+    status: String,
+    body: Option<Uid2Identity>,
+}
+
+#[derive(Deserialize)]
+struct Uid2Identity {
+    advertising_token: String,
+    refresh_token: String,
+    refresh_response_key: String,
+    /// Milliseconds since the epoch, like the two below.
+    identity_expires: u64,
+    refresh_from: u64,
+    refresh_expires: u64,
+}
+
+fn join(base: &Url, path: &str) -> Result<Url, Report<IdentityProviderError>> {
+    base.join(path)
+        .map_err(|_| IdentityProviderError::config("`base_url` cannot take a path"))
+}
+
+// Envelope crypto, elided: AES-256-GCM as UID2's API documentation describes.
+// fn encrypt_envelope(secret: &Redacted<String>, iv: &[u8; 12], now: UnixTime,
+//     nonce: &[u8; 8], payload: &serde_json::Value) -> Result<String, Report<IdentityProviderError>>;
+// fn decrypt_generate(secret: &Redacted<String>, body: &str, nonce: &[u8; 8])
+//     -> Result<Uid2Reply, Report<IdentityProviderError>>;
+// fn decrypt_refresh(key: &str, body: &str) -> Result<Uid2Reply, Report<IdentityProviderError>>;
+
+impl IdentityProviderConfig for Uid2Config {
+    fn build_descriptor(&self) -> Result<ProviderDescriptor, Report<IdentityProviderError>> {
+        ProviderDescriptor::builder(UID2_INTEGRATION_ID.parse()?)
+            .with_source("uidapi.com".parse()?)
+            .with_expiring_ids()
+            .with_resolves(
+                Resolves::new()
+                    .with_endpoint(&self.base_url)
+                    .with_needs_for(ResolveKind::Initial, [Input::HashedEmail])
+                    .with_private_state(),
+            )
+            // UID2 has no GVL ID. An operator whose UID2 operator is a TCF
+            // vendor names its ID in config.
+            .with_consent_policy({
+                let policy = ConsentPolicy::strict().with_tcf_purposes(UID2_TCF_PURPOSES);
+                match self.tcf_vendor_id {
+                    Some(vendor) => policy.with_tcf_vendor(vendor),
+                    None => policy.without_tcf_vendor(),
+                }
+            })
+            .build()
+    }
+}
+
+impl IdentityProvider for Uid2Provider {
+    fn descriptor(&self) -> &ProviderDescriptor {
+        &self.descriptor
+    }
+
+    fn request(
+        &self,
+        input: &ResolveInput<'_>,
+    ) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>> {
+        let base = input.endpoint()?;
+        if input.is_refresh(input.primary_source()) {
+            let Some(state) = input.state::<Uid2State>()? else {
+                return Ok(None);
+            };
+            if UnixTime::from_millis(state.refresh_expires) <= input.now() {
+                return Ok(None);
+            }
+            let url = join(base, "v2/token/refresh")?;
+            return Ok(Some(
+                // The refresh endpoint needs no API key.
+                ProviderRequest::post_text(&url, &state.refresh_token),
+            ));
+        }
+
+        let url = join(base, "v2/token/generate")?;
+        let request_nonce = input.random_bytes::<8>();
+        let envelope = encrypt_envelope(
+            &self.client_secret,
+            &input.random_bytes::<12>(),
+            input.now(),
+            &request_nonce,
+            &json!({ "email_hash": input.hashed_email()?.to_base64() }),
+        )?;
+        Ok(Some(
+            ProviderRequest::post_text(&url, &envelope)
+                .with_bearer(&self.api_key)
+                .try_with_call_context(&GenerateCall { request_nonce })?,
+        ))
+    }
+
+    fn response(
+        &self,
+        response: &ProviderResponse,
+        input: &ResolveInput<'_>,
+    ) -> Result<Resolution, Report<IdentityProviderError>> {
+        let body = response.success_text()?;
+        let reply: Uid2Reply = match response.call_context::<GenerateCall>()? {
+            Some(call) => decrypt_generate(&self.client_secret, body, &call.request_nonce)?,
+            None => {
+                let state = input
+                    .state::<Uid2State>()?
+                    .ok_or_else(|| IdentityProviderError::config("refresh without state"))?;
+                decrypt_refresh(&state.refresh_response_key, body)?
+            }
+        };
+
+        match reply.status.as_str() {
+            "optout" => Ok(Resolution::opted_out()),
+            // A dead refresh token clears the state instead of backing off
+            // until `refresh_expires`.
+            "expired_token" | "invalid_token" => Err(IdentityProviderError::InvalidState.into()),
+            "success" => {
+                let identity = reply.body.ok_or_else(IdentityProviderError::malformed)?;
+                let uid = ResolvedUid::new(identity.advertising_token).with_atype(3);
+                let eid = ResolvedEid::new(input.primary_source(), uid)
+                    .with_expires_at(UnixTime::from_millis(identity.identity_expires))
+                    .with_refresh_at(UnixTime::from_millis(identity.refresh_from))
+                    .with_refresh_until(UnixTime::from_millis(identity.refresh_expires));
+                Ok(Resolution::found([eid]).replacing_state(&Uid2State {
+                    refresh_token: identity.refresh_token,
+                    refresh_response_key: identity.refresh_response_key,
+                    refresh_expires: identity.refresh_expires,
+                }))
+            }
+            _ => Err(IdentityProviderError::malformed()),
+        }
+    }
+}
+```
+
+What this shows:
+
+- **Secrets.** `api_key` and `client_secret` are `Redacted<String>` fields
+  that hold secret-store key names at rest and resolved values at runtime.
+  Their paths must be added to `TrustedServerAppConfig::secret_fields()`
+  (`config.rs:136-175`), and `build_descriptor` must not read them, because
+  deploy validation runs before resolution (section 10.2).
+- **Expired tokens refresh.** A `Refresh` runs for an expired advertising
+  token too, so a visitor who misses the refresh window still recovers while
+  the refresh token lives. `with_refresh_until` keeps the expired record as
+  a refresh anchor until `refresh_expires` (section 5.4), and the provider
+  still checks `refresh_expires` itself.
+- **Randomness.** The envelope needs a random IV and nonce. A provider has no
+  safe source of its own in a pure method, so `ResolveInput::random_bytes`
+  supplies them, and the harness makes them deterministic.
+- **Call context.** `response` must check the nonce `request` generated. The
+  call context carries it, as it carries LiveRamp's call kind.
+- **Text bodies.** Both endpoints send and return base64 text, not JSON, so
+  `ProviderRequest::post_text` and `ProviderResponse::success_text` are
+  needed.
+- **State size.** A UID2 refresh token is several hundred bytes, so the state
+  cap rises from 512 to 1,024 bytes (sections 4.5, 6.1).
+- **Opt-out.** `"optout"` maps to `Resolution::opted_out()`, which is sticky
+  (section 8).
+- The crypto needs an AES-GCM implementation, a new dependency that the UID2
+  spec justifies.
+
+### 12.4 ID5, generic pull, and a provider not in v1
+
+- **ID5** has the shape of the section 4.6 example: `ClientIp` and
+  `UserAgent` needed, `PageUrl` wanted, the `signature` as private state, and
+  `ext.linkType` per UID. It declares three sources (`id5-sync.com`, the
+  EUID source its responses name, and `true-link-id5-sync.com`,
+  `id5IdSystem.js:40-41`, `:130-170`) and uses `also_invalidate` for a
+  declared source a response no longer returns. Each source's EID goes
+  through `ResolvedEid` with the UID-level `ext` and EID-level fields the
+  response gives, so a response that returns several UIDs or entries for a
+  source stores them all.
+- **Generic pull** is built in (section 10.4).
+- **A local provider**, one that needs no outbound call, does not fit v1. An
+  example is a publisher login ID read from a first-party cookie and
+  emitted as an EID. It would need a third capability, say `derive`, and an
+  input that reads a named first-party cookie. Both are additive under
+  section 4.2, which is the point of the check. This spec does not add them.
+
+### 12.5 What the examples changed
+
+Writing the examples found these gaps. Each is now in the API of sections 4
+to 6:
+
+| Gap                                                                     | Found by          | Change                                                                                                                                  |
+| ----------------------------------------------------------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `response` cannot know what `request` sent                              | LiveRamp, UID2    | `ProviderRequest::try_with_call_context`, `ProviderResponse::call_context` (4.5)                                                        |
+| No safe randomness in a pure method                                     | UID2              | `ResolveInput::random_bytes`, deterministic in the harness (4.2, 4.4, 13)                                                               |
+| Secrets have no stated path                                             | UID2              | Secret fields in `secret_fields()`; `build_descriptor` never reads them (10.2)                                                          |
+| Text bodies                                                             | UID2              | `post_text`, `success_text` (4.5)                                                                                                       |
+| State cap too small for refresh tokens                                  | UID2              | 1,024 bytes (4.5, 6.1)                                                                                                                  |
+| Expiry in milliseconds                                                  | Lockr, UID2       | `UnixTime::from_millis` (4.4)                                                                                                           |
+| Prefix capture is too broad                                             | Lockr             | `Captures::with_path(method, path)` (4.3)                                                                                               |
+| Revocation arrives after consent is denied                              | Lockr             | Capture removals bypass the consent gate (4.7)                                                                                          |
+| EID-level `inserter`, `matcher` and `mm` cannot be expressed            | Lockr             | `ProviderDescriptorBuilder::with_provenance`, applied on output (4.3, 7.1)                                                              |
+| A source string from a response must match a declared source            | Lockr             | `SourceDomain::matches` normalizes before comparing (4.3)                                                                               |
+| An oversized UID-level `ext` discarded the whole ID                     | Lockr (ID5 `pba`) | The `ext` is dropped and the ID kept (4.5)                                                                                              |
+| Region tests need country and subdivision                               | LiveRamp          | `Region::country`, `Region::is` (4.4)                                                                                                   |
+| A provider could return one UID per source, with fixed EID-level fields | Lockr, ID5        | `ResolvedEid` and `ResolvedUid`: several entries and UIDs per source, EID-level fields per entry, stored and sent whole (4.5, 6.1, 7.1) |
+| An expired record stranded refreshable providers                        | UID2, LiveRamp    | `Refresh` covers expired records; the provider decides (4.4, 4.7)                                                                       |
+| Every example parsed its endpoint twice                                 | all               | `Resolves::with_endpoint(&str)`, checked by `build()` (4.3)                                                                             |
+| Capture had two ways to say "nothing"                                   | Lockr             | `capture` returns `Resolution`; `no_match` means nothing (4.2)                                                                          |
+
+Revision 15 removed two earlier entries. Request-body consent for capture
+(`Captures::with_request_consent`) only gated positive captures, which v1
+no longer stores. The dry run, and with it `is_dry_run`, saved one KV
+re-read in the rare case a stateless provider skipped its call.
+
+## 13. Testing
+
+**Provider harness** (`ec/identity/test_support.rs`). `ProviderHarness`
+drives a provider the way the coordinator does, so vendor tests stay short:
+
+```rust
+let provider = ExampleIdProvider::new(&example_config()).expect("should build the provider");
+let mut harness = ProviderHarness::new(&provider)
+    .with_client_ip("192.0.2.10")
+    .with_user_agent("ExampleBrowser/1.0");
+
+let request = harness
+    .request()
+    .expect("should build a request")
+    .expect("should not skip the request");
+assert_eq!(
+    request.url().host_str(),
+    Some("api.exampleid.example.com"),
+    "should call the declared host"
+);
+
+let resolution = harness
+    .respond(StatusCode::OK, &json!({ "uid": "example-uid", "signature": "example-signature" }))
+    .expect("should parse the response");
+assert_eq!(
+    resolution.eids()[0].uids()[0].id(),
+    "example-uid",
+    "should return the uid"
+);
+```
+
+`harness.respond_raw(status, headers, bytes)` covers empty bodies such as a
+204, and headers. `harness.request_json::<T>()` decodes the built body.
+
+The harness runs the coordinator's steps around the provider, so a test
+sees what production would:
+
+- **Kind.** A source with a `with_stored` record is `Refresh` (valid or
+  expired), any other `Initial`.
+- **Eligibility.** It applies the consent policy (eligibility step 1) and
+  step 4: sources whose kind's needs are missing are left out, and with none
+  left `request()` returns `Ok(None)` without calling the provider.
+- **Provenance.** Applied only by `output_eids`, as the bidstream applies
+  it (section 7.1). The `Resolution` getters show what the provider set.
+
+The harness API, in the test-support module, gated by
+`#[cfg(any(test, feature = "test-utils"))]`, the crate's existing
+test-helper feature. A dependent crate never sees `cfg(test)`, so a
+provider in its own crate enables `test-utils` as a dev-dependency feature
+of `trusted-server-core`:
+
+```rust
+impl<'p> ProviderHarness<'p> {
+    pub fn new(provider: &'p dyn IdentityProvider) -> Self;
+    /// Replaces every input below at once, for conformance cases.
+    pub fn with_setup(self, setup: HarnessSetup) -> Self;
+    pub fn with_client_ip(self, ip: &str) -> Self;
+    pub fn with_user_agent(self, user_agent: &str) -> Self;
+    pub fn with_page_url(self, url: &str) -> Self;
+    pub fn with_region(self, country: &str, subdivision: Option<&str>) -> Self;
+    pub fn with_hashed_email(self, email: HashedEmail) -> Self;
+    /// Raw consent strings. Default: GDPR does not apply and no opt-outs.
+    pub fn with_consent(self, consent: TestConsent) -> Self;
+    pub fn with_stored(self, stored: StoredId) -> Self;
+    pub fn with_state(self, state: &impl Serialize) -> Self;
+    /// The fixed clock. Default: a constant test time.
+    pub fn with_now(self, now: UnixTime) -> Self;
+    pub fn with_random_seed(self, seed: u64) -> Self;
+
+    /// Calls `request` and keeps the built request and its call context.
+    pub fn request(&mut self) -> Result<Option<ProviderRequest>, Report<IdentityProviderError>>;
+    /// Decodes the last built request's JSON body.
+    ///
+    /// # Panics
+    ///
+    /// When no request was built or its body is not `T`.
+    pub fn request_json<T: DeserializeOwned>(&self) -> T;
+    /// Calls `response` with the kept call context.
+    pub fn respond(
+        &mut self,
+        status: StatusCode,
+        body: &serde_json::Value,
+    ) -> Result<Resolution, Report<IdentityProviderError>>;
+    pub fn respond_raw(
+        &mut self,
+        status: StatusCode,
+        headers: &[(&str, &str)],
+        body: &[u8],
+    ) -> Result<Resolution, Report<IdentityProviderError>>;
+    /// Runs a capture as the coordinator does, response decoding included.
+    pub fn capture(&self, fixture: &CaptureFixture) -> Result<Resolution, Report<IdentityProviderError>>;
+    /// Resolves an expiry or refresh against the fixed clock.
+    pub fn resolve(&self, when: When) -> UnixTime;
+    /// The replacement state in a result, decoded, for assertions.
+    pub fn state_of<T: DeserializeOwned>(&self, resolution: &Resolution) -> Option<T>;
+    /// The EIDs bidders would see for a result: the section 4.5 rules, then
+    /// the descriptor's provenance defaults (section 7.1).
+    pub fn output_eids(&self, resolution: &Resolution) -> Vec<Eid>;
+
+    /// Runs only the cases passed in, never the harness's own inputs. A
+    /// provider declared `with_private_state()` fails here with a pointer to
+    /// `check_conformance_with_state`.
+    pub fn check_conformance(&self, cases: &ConformanceCases);
+    pub fn check_conformance_with_state<S: Serialize + DeserializeOwned>(&self, cases: &ConformanceCases);
+    /// The same checks, returning the first failure instead of failing the
+    /// test. `check_conformance` wraps it. A panic aborts a `wasm32-wasip1`
+    /// test run, so the harness's own negative tests use this.
+    pub fn try_check_conformance(&self, cases: &ConformanceCases) -> Result<(), ConformanceFailure>;
+}
+
+/// Inputs for one harness run. The harness's own `with_*` methods delegate
+/// to an inner `HarnessSetup`.
+#[derive(Debug, Clone, Default)]
+pub struct HarnessSetup { /* private */ }
+
+impl HarnessSetup {
+    pub fn with_client_ip(self, ip: &str) -> Self;
+    pub fn with_user_agent(self, user_agent: &str) -> Self;
+    pub fn with_page_url(self, url: &str) -> Self;
+    pub fn with_region(self, country: &str, subdivision: Option<&str>) -> Self;
+    pub fn with_hashed_email(self, email: HashedEmail) -> Self;
+    pub fn with_consent(self, consent: TestConsent) -> Self;
+    pub fn with_stored(self, stored: StoredId) -> Self;
+    pub fn with_state(self, state: &impl Serialize) -> Self;
+    pub fn with_now(self, now: UnixTime) -> Self;
+    pub fn with_random_seed(self, seed: u64) -> Self;
+}
+
+/// Raw TCF, GPP and US Privacy strings, as a request would carry them.
+#[derive(Debug, Clone, Default)]
+pub struct TestConsent { /* private */ }
+
+impl TestConsent {
+    pub fn with_gdpr_applies(self, applies: bool) -> Self;
+    pub fn with_tc_string(self, tc: &str) -> Self;
+    pub fn with_gpp_string(self, gpp: &str, section_ids: &[u16]) -> Self;
+    pub fn with_us_privacy(self, us_privacy: &str) -> Self;
+    pub fn with_gpc(self) -> Self;
+    pub fn with_dnt(self) -> Self;
+}
+
+/// One proxied call: the request a capture rule matches, and its response.
+#[derive(Debug, Clone)]
+pub struct CaptureFixture { /* private */ }
+
+impl CaptureFixture {
+    pub fn new(method: Method, path: &str) -> Self;
+    pub fn with_response(self, status: StatusCode, body: &serde_json::Value) -> Self;
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct ConformanceCases { /* private */ }
+
+impl ConformanceCases {
+    /// A setup to run `request` under, and the response to answer it with.
+    pub fn with_resolve_case(
+        self,
+        setup: HarnessSetup,
+        status: StatusCode,
+        response: &serde_json::Value,
+    ) -> Self;
+    /// For text, binary or empty replies, such as UID2's base64 body or a
+    /// LiveRamp 204.
+    pub fn with_resolve_case_raw(
+        self,
+        setup: HarnessSetup,
+        status: StatusCode,
+        headers: &[(&str, &str)],
+        body: &[u8],
+    ) -> Self;
+    pub fn with_capture_case(self, fixture: CaptureFixture) -> Self;
+}
+
+/// Test-only constructors, behind the same gate.
+impl StoredId {
+    pub fn for_test(source: &SourceDomain, uid: &str) -> Self;
+    /// A stored full set. `uid()` becomes its first UID.
+    pub fn with_eids(self, eids: Vec<Eid>) -> Self;
+    pub fn written_by(self, writer: &IdentityProviderId) -> Self;
+    pub fn expiring_at(self, at: UnixTime) -> Self;
+}
+
+impl HashedEmail {
+    /// From the SHA-256 of a normalized address, as 64 hex digits.
+    pub fn for_test(sha256_hex: &str) -> Self;
+}
+
+pub fn check_descriptor_ignores_secrets<C: IdentityProviderConfig>(placeholder: &C, resolved: &C);
+```
+
+`harness.check_conformance(&cases)` runs the checks every provider must
+pass. `ConformanceCases` lists the setups to try (inputs, stored IDs, state
+and a test-only `HashedEmail`) and one vendor fixture per capture rule, so the
+harness never guesses which setup makes a provider call out:
+
+- The harness builds inputs that hold only what the descriptor declares, so
+  reading an undeclared input fails the test with `UndeclaredInput`.
+- A provider that declares `resolves` returns `Some` from `request` for at
+  least one listed setup, and its `response` on a vendor fixture does not
+  return the `not_implemented` marker.
+- A provider that declares `captures` returns a `Resolution` other than
+  `no_match` for at least one listed fixture, and never the
+  `not_implemented` marker.
+- No undeclared input or state read is recorded.
+- A provider without `with_private_state()` never returns state.
+- Requests go only to declared hosts, over HTTPS, with no `Cookie` header and
+  with valid header names and values.
+- Returned entries are only for declared sources, and no fixture's result
+  hits a limit of section 4.5: no dropped UID or field, no discarded entry
+  and no set over `MAX_ENTRY_SET_BYTES`. A vendor whose real responses can
+  exceed a limit says so in its spec; the fixture does not hide it.
+- `ResolvedEid::expiry()` and `refresh()` report what the provider set, and
+  a fixture set of a source marked expiring carries an expiry.
+- `capture` never returns a state change.
+- For every case with state, the harness also injects a stored state that
+  is a bare JSON string, which no struct decodes, and checks that the
+  provider neither panics nor treats it as valid state. A
+  `#[serde(default)]` state type that decodes anything fails here. That the
+  coordinator then clears it is a coordinator test.
+
+`harness.check_conformance_with_state::<S>(&cases)` also checks that the
+state type round-trips through `replacing_state` and `input.state()`.
+`check_descriptor_ignores_secrets::<C>(&placeholder, &resolved)` builds the
+descriptor from a config with placeholder secret names and from one with
+resolved secrets, and fails if the two differ (section 10.2). Vendor tests
+add a
+fixture response for each outcome the vendor can return, and assert it
+through the `Resolution` getters.
+
+The harness also:
+
+- fixes `random_bytes` with `with_random_seed`, so encrypted requests are
+  reproducible
+- carries the built request's call context into `respond`, as the
+  coordinator does
+- applies a provider's provenance in `output_eids`, so a test can assert the
+  EID-level fields bidders will see
+
+The examples in section 12 are the first harness cases: LiveRamp's initial
+and refresh 204s (opted out and invalidated), Lockr's page-view and
+revoke-consent, and UID2's success, refresh, opt-out and dead refresh
+token.
+
+**Coordinator.**
+
+- An eligibility matrix: consent × ownership × per-source kind × due state ×
+  inputs × mode × writer or stager × new or returning EC. No stager
+  dispatches a resolving provider in any cell.
+- The eligibility view is the phase 1 KV row alone: `ts-eids-s` never
+  changes eligibility, whatever it holds.
+- On a site whose auctions all go through `/auction`, a hold-mode provider
+  runs after send on the next writer navigation that runs no auction, its
+  answer reaches KV, and the following `/auction` serves it from KV without calling the provider. Moved after send, it waits `after_send_timeout_ms`, and a miss backs off as a timeout, not as a hold cut-off.
+- A `no_match` or 4xx on a writer stores `ps.n`, so a run of `/auction` and
+  `/_ts/page-bids` calls in the same SPA session never calls the provider
+  again before `ps.n`.
+- `sources` narrowing, owner takeover of a browser-seeded record, sticky
+  `ps.o` surviving a jurisdiction change and cleared only by a newer grant,
+  and `ps.iv` stopping a re-seed.
+- Hold budget: a fake HTTP client with controlled latency shows the auction
+  starts at the budget, an answer joins the writer's mutation, and a
+  cut-off call sets `hold_retry_sec` without counting a failure.
+- `request` is called once per dispatch. A `None` or `InputUnavailable`
+  waits `refresh_after_sec`.
+- After-send results commit in the same phase 4 write. Two overlapping
+  writer navigations for one EC do not both dispatch a provider within the
+  burst cap's window.
+- A navigation answered with a status other than 2xx or 304 dispatches no
+  after-send provider, stores no positive hold-mode answer, and flushes
+  those answers' removals, opt-outs and backoff, so a `no_match` or 4xx on a
+  404 page is not called again before its `ps.n`.
+- An `UndeclaredInput` is logged as `Config` and backs off.
+- Only transport failures, timeouts, 429 and 5xx feed the breaker. 4xx and
+  `Malformed` from many visitors never open it.
+- The burst cap is checked after every other eligibility step.
+- A provider call that would take the request past `max_backend_requests`
+  is not sent and counts as no failure; a hold call leaves room for the
+  origin and every auction provider.
+- Passive capture runs from `handle_proxy` only for providers with a capture
+  rule matching the request, decodes gzip and brotli bodies under the caps,
+  never reads the request body, and never touches `n`, `f` or the breaker.
+- A capture writes no positive ID itself and increments
+  `capture_unpersisted` without logging a value. A positive change that
+  passes the consent steps and differs from KV joins the writer's mutation,
+  or, on any other request, the pending key after send. Its removals,
+  opt-out and any clear are written by the capture removal write on that
+  request, before send.
+- The capture removal write retries only a CAS conflict, up to five
+  attempts, tries once more after send when those fail, and on a second
+  failure appends to the pending key and increments `removal_deferred`. It
+  increments `removal_lost`, without logging a value, only when that append
+  fails too. It
+  writes nothing for a tombstone, a missing row or an already applied
+  removal, and it runs on the unusable-consent path.
+- A writer navigation whose phase 1 snapshot predates a capture removal
+  write of the same page load fails its CAS and is not retried; the next
+  navigation re-derives its browser ingest.
+- A capture from a client that fails `looks_like_browser()` writes its
+  removals and opt-out, and its global revoke tombstones the row, as from a
+  real browser. Its positive result never clears an opt-out.
+- With `revoke_scope = "global"`, a captured opt-out tombstones the row and clears the EC cookie on that request, as a consent
+  withdrawal does. With `"provider"`, it removes only that provider's
+  records and, for a capture-only provider, the records of its sources no
+  provider wrote.
+- A Lockr-style `revoke-consent` captured on the proxy removes the
+  browser-ingested record of each of Lockr's narrowed sources, adds their
+  UIDs to `ps.ov`, and drops the browser's values for those sources. A later
+  token capture clears the opt-out and empties `ps.ov`, and the next writer
+  navigation ingests the same stable UID again. A source Lockr is not
+  narrowed to keeps its browser value throughout.
+- A due stateful provider is dispatched in phase 4 with its request built
+  from the live state, and a writer navigation without an auction runs it
+  after send.
+- A provider's `ResolveKind` is `Refresh` for a stored record whether it is
+  still valid or expired, and an expired record counts as absent for
+  `FillMissing`.
+- An expired UID2-style ID with valid refresh state survives an unrelated
+  writer's mutation as a refresh anchor, and the next eligibility pass
+  selects `Refresh`. Past `ru`, or once the state is cleared, missing or
+  fails to decode, the anchor is dropped and the kind is `Initial`.
+- A stateful result applies whole. When a phase 4 re-read finds another
+  writer's newer ID and state, the call's IDs, state, `n` and `f` are all
+  dropped and the row keeps the other writer's ID with that writer's state.
+  An oversized or unserializable replacement state stores no ID, and the
+  result's removals still apply.
+
+**Consent.**
+
+- The GPP sharing and targeted-advertising opt-outs, GPP section 6, and the
+  US National GPC and known-child fields decode from each section that
+  defines them. Each one blocks a strict policy.
+- A raw consent string that does not decode blocks a strict policy.
+- A decodable GPP string with no applicable section, the header-only
+  `DBAA` shape, does not block a strict policy where TCF does not apply.
+- A targeted-advertising opt-out without a sale opt-out produces no
+  server-side IDs in `user.eids` and none in the `ts-eids-s` mirror
+  payload.
+- The consent fingerprint is a plain bitmask: a GPP opt-out clears exactly
+  when `fp` records a US opt-out bit and the current consent shows none of
+  the opt-outs `fp` records, whatever else changed.
+
+**One-write invariant.** A new test store counts writes by mode (Add,
+`IfGenerationMatch`, Overwrite) and is shared through the `test-utils` feature
+so adapter tests can use it. `KvIdentityGraph::counting` counts reads only
+(`ec/kv.rs:1596-1605`, `ec/kv_backend.rs:205-221`).
+
+| Scenario                                                            | KV writes                                                                               |
+| ------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| New visitor, navigation                                             | 1 (create, before send)                                                                 |
+| New visitor whose first ID collides                                 | 1 (create with a re-minted ID)                                                          |
+| Returning visitor, changes pending                                  | 1                                                                                       |
+| Returning visitor, nothing changed                                  | 0                                                                                       |
+| 304 revalidation with changes pending                               | 1                                                                                       |
+| Returning EC, navigation answered with 3xx, 4xx or 5xx              | 0, or 1 when its hold-mode calls returned removals or backoff                           |
+| New visitor, prefetch or prerender navigation                       | 1 (create, before send)                                                                 |
+| Returning visitor, prefetch or prerender navigation                 | 0                                                                                       |
+| New visitor, client without `Sec-Fetch-Dest`                        | 1 (create, before send)                                                                 |
+| Returning visitor, iframe HTML or no `Sec-Fetch-Dest`               | 0                                                                                       |
+| Integration-proxy navigation that mints an EC                       | 1 (create)                                                                              |
+| `/auction`, `/_ts/page-bids`, `/identify`, assets                   | 0                                                                                       |
+| Lockr API proxy, no revocation                                      | 0                                                                                       |
+| Captured revocation, from any client                                | CAS removal write (up to 5 attempts), once more after send                              |
+| Consent withdrawal, on any request                                  | CAS tombstone (up to 5 attempts) plus marker, per ID; once more after send              |
+| Global revoke captured, from any client                             | as a consent withdrawal                                                                 |
+| Capture removal, opt-out or global revoke from a non-browser client | 0                                                                                       |
+| CAS conflict or per-key limit on the flush                          | 1 attempt; its removals, if any, then written alone after a 1 s wait (up to 5 attempts) |
+
+**Withdrawal and removal.**
+
+- A withdrawal on `/auction` after the navigation's send leaves a tombstone,
+  and the navigation's phase 4 drops its mutation and calls no provider.
+- A withdrawal tombstone whose attempts fail before send is tried once more
+  after send.
+- After `opted_out` or `invalidate`, the removed ID stops reaching bidders
+  through TS on the next request, and the next `/auction` or
+  `/_ts/page-bids` response leaves it out of the mirror payload.
+- An `/auction` or `/_ts/page-bids` response whose KV read finds a
+  tombstone, a missing row or `consent.ok = false`, or whose consent denies
+  EID persistence, returns `clear` for the mirror, and the shim expires
+  `ts-eids-s`.
+- A deletion tombstone is honoured at the visitor's next writer navigation
+  or `/auction`, whatever `ts-eids-s` holds.
+- No response sets a server identity cookie other than `ts-ec`.
+
+**Failed flush.** After a refused write, the mutation's removals, opt-outs and clears are written alone with up to five CAS attempts, and a mutation without them makes no second write. When those attempts fail too, the request's own removals go to the pending key, and `removal_lost` is incremented, without logging a value, only when that append fails. The next writer navigation merges the pending key, re-derives browser ingest from `ts-eids` and calls the still-due providers again within the burst cap.
+
+**Reads.** Every returning writer navigation pays one KV read of the row in
+phase 1 and one of the pending key in phase 4, plus the phase 4 re-read
+when an after-send provider dispatches.
+`/auction` and `/_ts/page-bids` pay their existing one read and no more. No
+request opens or parses `ts-eids-s`.
+
+**No lost EIDs (G10).**
+
+- The shim writes no unregistered source into `ts-eids`, and keeps a
+  registered source a later request lacks.
+- A registered source present in the `/auction` body but beyond today's
+  trim is kept in `ts-eids` and written by the next navigation.
+- When the registered sources alone exceed the trim, only those the trim
+  drops are lost, and the test pins which.
+- Every source today's `/auction` ingest would write reaches KV whenever
+  the registered sources fit the trim.
+- An EID present only in Prebid's `ortb2` config, as Lockr writes its ID5,
+  reaches `ts-eids` and KV.
+
+**Orphans and collisions (section 5.5).**
+
+- A row deleted out of band is found by the next writer navigation's phase
+  1 read and recovered by rotation before send.
+- A stager that sees the row missing stores nothing and returns `clear` for
+  the mirror, and the next writer recovers.
+- A collision on the first create re-mints before any cookie is set.
+
+**Storage.**
+
+- A schema version 1 row reads as version 2, each `uid` as one entry with
+  one UID, and its next write stores version 2. A version 2 row and `ps`
+  round-trip.
+- An owned expiring source's record is served from the server only when
+  its `w` is the owner and its `exp` has not passed.
+- Revision-checked `OwnerRemove` and `OwnerWrite` lose to a newer write.
+  Re-applying changes on a later writer keeps the other tab's change. An
+  `OwnerRemove` of a version 1 record matches `Revision::Unset` until the
+  record's next write.
+- Two refreshes of an unchanged UID in the same second get different `rv`,
+  so an invalidation read before the second refresh does not remove it.
+- An opt-out and a clear in the same second leave the provider opted out.
+  A clear with no opt-out to clear writes nothing, and a clear not later
+  than the opt-out is dropped.
+- `ps.iv` and `ps.ov` hold unkeyed hashes, and they still match after an
+  `ec.passphrase` rotation, as does the consent fingerprint.
+- `ts-eids-s`:
+  - the mirror payload holds only what bidders would receive from the
+    server set: no `ps`, `ps.st`, refresh token, revision, writer or timing
+    field, and nothing a consent gate or `bidstream_enabled = false`
+    excludes
+  - `value` is base64url JSON; `max_age` is at most 86,400 and never past
+    the earliest `exp`; an empty set returns `clear`; a request with no KV
+    read returns no payload
+  - the 2,048-byte cap leaves out whole sources in ascending
+    `cookie_priority`, never trims a set, and a left-out source still
+    reaches bidders
+  - the server never opens it: a forged, stale or malformed `ts-eids-s`
+    changes no eligibility, merge, `/identify` answer or KV write
+  - no response sets it with `Set-Cookie`
+  - the shim writes it as `__Host-ts-eids-s` with `Path=/`, `Secure` and
+    `SameSite=Lax`, without `HttpOnly`, skips an unchanged value, expires
+    it on `clear`, and never copies it into `ts-eids` or the `/auction`
+    body
+  - a mirror ID a page script feeds back through Prebid is ingested only as
+    a one-UID `FillMissing`, and the `ps.iv`, `ps.ov` and `ps.o` denials of
+    section
+    7.1 filter it for owned and unowned sources
+- The admin lookup redacts `ps.st`.
+
+**Outbound requests.** Requests to Prebid Server, in every
+consent-forwarding mode, carry none of the `TS_IDENTITY_COOKIE_NAMES`
+cookies, keep every other cookie, and drop the header when nothing is left.
+Requests to the publisher origin never carry `__Host-ts-eids-s`, keep
+`ts-ec`, `ts-eids` and every other cookie, and drop the header when nothing
+is left. With `strip_eids_cookie_from_origin`, they carry no `ts-eids`
+either.
+
+**Merge.**
+
+- Owned versus unowned precedence.
+- A browser-seeded record never beats the browser's current value.
+- Expired IDs are never sent.
+- `x-ts-eids` matches what was sent.
+- After a provider invalidates UID A, or reports an opt-out that removes
+  it, a stale A in the `/auction` body or in `ts-eids` is not sent, for an
+  owned or an unowned source.
+- An unowned source a strict provider wrote stops reaching bidders and
+  `/identify` once that provider's vendor consent is denied or a
+  targeted-advertising opt-out applies. A record whose writer is disabled
+  is not served, and the browser can refill it.
+- `/_ts/api/v1/identify` omits expired IDs and IDs the writer's or owner's
+  policy blocks under the request's consent. It never uses the stored
+  consent snapshot. A request from another jurisdiction, one with no
+  consent string, and a later vendor denial while global EC consent is
+  still granted each get that policy's answer for the request.
+
+**Batch sync.** An update to an owned source applies only when absent.
+
+**Complete provider EIDs (G13).**
+
+- A result with several entries for a source, several UIDs per entry and
+  every UID-level and EID-level field round-trips through the mutation, KV
+  and the merge, and reaches `user.ext.eids`, `x-ts-eids` and the
+  `ts-eids-s` mirror in the order the provider returned it.
+- Each limit of section 4.5 drops exactly what it names: a blank `inserter`,
+  an `ext` over 2,048 bytes, a ninth entry, a 33rd UID, a duplicate entry.
+  A set over 4,096 bytes, measured by the shared `MAX_ENTRY_SET_BYTES`
+  function, is discarded whole and leaves the stored set as it is; for a
+  stateful provider the positive part of the result is rejected with its
+  removals kept; a stateless result all of whose sets are discarded is
+  handled as `Malformed`.
+- For an owned source, a result that names it replaces its whole set; a
+  later result without one entry removes it. A source the result does not
+  name is left as it is. An unowned provider's set only fills an absent
+  record.
+- The set's `exp`, `ra` and `ru` are the earliest its kept entries set, and
+  an expired set is never served. Expired means `now >= exp`.
+- Descriptor provenance applies only to an entry with no EID-level field;
+  an entry with any keeps exactly what the provider set.
+- `build()` rejects a blank provenance `inserter` or `matcher` and an `mm`
+  below 0.
+- An owner's valid set replaces every browser entry for the source,
+  including repeated browser entries; an unowned set goes out only when the
+  browser did not send the source.
+- An invalidation of a 32-UID set appends 32 hashes to `ps.iv` from the
+  live record it removes, and the filter then holds through `ps.iv`. Two
+  such invalidations keep all 64 hashes.
+- A full set too large for the `ts-eids-s` mirror is left out of it whole,
+  never trimmed, and still reaches bidders from KV.
+- `KvEntry::validate` rejects, on write, a record with an empty `eids`. On
+  read, a record that breaks a limit is dropped from the row with its
+  source logged, and the rest of the row reads normally.
+- A stored entry with a field this build does not know reads normally.
+- `/identify` returns the same `uid` and `eid` shape for a full set as for
+  a one-UID record: the first UID, with the partner's `openrtb_atype`.
+- A mutation on a build that no longer configures a provider keeps that
+  provider's `ps.o`, `ps.oc` and `ps.ov` and drops its other `ps` fields.
+
+**Behaviour that predates this spec (G13).** Golden tests pin each path that
+G13 must not change:
+
+- browser ingest writes a one-UID record holding the UID
+  `collect_eid_updates` picks today (for a repeated source, the first valid
+  UID of its last entry; the sharedId cookie last), and nothing for an
+  unregistered source, whatever EID-level fields or extra UIDs the browser
+  sent. The expected values are captured from `main`, not written from
+  this sentence
+- the `x-ts-eids` header's per-entry truncation
+- the `ts-eids` cookie's EID-level `ext` removal and trim order, apart from
+  the registered-only merge G10 adds
+- `/auction` body forwarding and the merge of browser entries
+- a row read from `main`'s schema version 1 goes out to bidders exactly as
+  it does on `main`, and the golden requests of the EID fidelity spec
+  (§4.7) do not change
+
+**Migration parity.** Today's `ec/pull_sync.rs` tests are ported against
+`GenericPullProvider`. Each behaviour change in section 10.4 gets its own
+test.
+
+**Config.** Each validation error in section 10.2, `build_descriptor`
+running in `ts config validate` without secrets, and acceptance of a
+config with no `[ec.identity]` at all.
+
+**Adapters.** Phase 4 runs after send on Fastly. Axum, Cloudflare and Spin
+behave as before apart from the Prebid Server and origin cookie strips. The
+parity test crate passes
+(`cargo test --manifest-path
+crates/trusted-server-integration-tests/Cargo.toml --test parity`).
+
+## 14. Rollout
+
+Three steps, each shippable on its own and each able to roll back to the
+one before:
+
+0. **Reader first.** A release from `main`, before any of this spec, whose
+   only change is to the KV reader. It writes exactly what today's build
+   writes, schema version 1, and it ships so that step 1 has a floor to
+   roll back to, and so old and new instances can run side by side while
+   step 1 deploys. It:
+   - accepts a version 2 row (section 6.1) where today's
+     `KvEntry::validate` rejects it (`ec/kv_types.rs:376-381`). It reads the
+     row into today's in-memory shape: per source, the first UID of the
+     first entry, with `w`, `exp` and `at`, and nothing else.
+   - serves a version 2 record only when it is unexpired and its row holds
+     no provider opt-out (`ps.o` without a later `ps.oc`). It cannot tell
+     which sources an opt-out covers, so a row with one serves no stored
+     ID. Servability is otherwise today's.
+   - never rewrites a version 2 row with a positive change. Browser ingest,
+     `/auction` ingest and pull sync skip it and increment
+     `v2_row_write_skipped`, so a step 0 instance never downgrades a row
+     to version 1 and never drops `ps`, full entry sets or removal hashes.
+   - tombstones a version 2 row on a consent withdrawal as it does a
+     version 1 row. A tombstone holds no IDs, so its version does not
+     matter, and a withdrawal during a rollback is recorded.
+
+   Step 0 has no runtime switch and changes no response.
+
+1. **One write, no new vendors.** This step includes:
+   - the outbound cookie strips (origin and Prebid Server) and the
+     template cache's identity cookie list. Stripping `ts-ec` and `ts-eids`
+     from Prebid Server requests is a behaviour change: both reach it today
+     (`integrations/prebid.rs:2088-2108`). The origin keeps both unless the
+     operator sets `strip_eids_cookie_from_origin`
+   - the writer-request rule and the `IdentityMutation` single flush, with no retry except the removal-only one of section 5.2, phase 4; the new visitor's create stays before routing, as today
+   - `/auction`, `/_ts/page-bids` and `/identify` stopping their writes
+   - one after-send attempt for a withdrawal tombstone that failed before
+     send (section 5.1)
+   - the `ts-eids-s` mirror payload in `/auction` and `/_ts/page-bids`
+     responses, and the shim code that writes and clears the cookie, behind
+     `[ec.identity] mirror_enabled`, off by default until section 15 names
+     a consumer
+   - the shim's registered-only, per-source merge of `ts-eids`, with the
+     registered source list in the injected configuration (section 5.3)
+   - a metric for the inbound `Cookie` header size
+   - KV schema version 2 (section 6.1): the one record shape, `ps`, with
+     `Default` and constructors, and the read of version 1 rows. Full entry
+     sets are read, served and validated, though nothing in this step
+     writes one, so a rollback from step 2 to step 1 keeps every set a
+     provider wrote readable, and keeps each vendor's opt-out (below)
+   - `GenericPullProvider` replacing pull sync, which brings the trait, the
+     descriptor, the harness and the write-counting test store, and the
+     removal of the pull-complete marker and of the legacy pull sync keys
+     (section 10.4)
+   - the shared servability check for `/identify` and the bidstream
+
+   It changes behaviour on its own: fewer KV writes, `/auction`,
+   `/_ts/page-bids` and `/identify` stop writing, every returning writer
+   navigation reads the row and the pending key, and new visitors reach pull partners from
+   their second page load. Write and read counters per page load show the
+   effect. Operators move `pull_sync_ttl_sec`, `pull_sync_rate_limit` and
+   `ec.pull_sync_concurrency` to their replacements before deploying it,
+   because validation rejects them (section 10.2).
+
+2. **Providers.** `.with_identity_provider` and
+   `.try_with_identity_provider` for vendors, ownership and its
+   validation, hold mode, revoke-only passive capture with `revoke_scope`
+   defaulting to `"provider"`, the capture removal write with its
+   `capture_unpersisted` and `removal_lost` counters, the
+   real-browser gate on capture clears, provider state, the rate-limiter
+   `record` and `count` methods and the circuit breaker, the consent
+   decoder extensions of section 9.1, and the first full-set writes, from
+   provider results with more than one entry or UID or with EID-level
+   fields (G13). Vendor modules follow in their own specs.
+
+**Capture provider checklist.** Before enabling a capture provider on a
+live service:
+
+- Each source it declares has an `[[ec.partners]]` entry with
+  `bidstream_enabled = true` and the right `openrtb_atype`. Lockr's ID5 uses
+  `1` (#1246).
+- Its required `sources` list holds only the sources it is the delivery path
+  for, because its opt-out removes browser-ingested records of every source
+  it keeps, whoever produced them (sections 5.4, 10.2).
+- A source moving to an owner is moved off pull sync first. A
+  `pull_sync_enabled` entry registers a generic pull provider that claims
+  the source, and two providers cannot claim an owned source (section 10.2).
+- Live acceptance: after a revocation captured on a live page,
+  `/_ts/admin/ec` (`ec/admin.rs:276`) shows the provider's `ps.o` and no
+  record for its sources. After the vendor issues again, it shows `ps.oc`,
+  and the next writer navigation ingests the source again.
+
+**Rolling back from step 2 to step 1.** Step 1 configures no vendor
+providers, so:
+
+- Remove `owner` and the vendor `[ec.identity.providers.*]` tables from the
+  config first. Step 1's validation rejects an owner or a provider table it
+  does not know (section 10.2).
+- Full sets stay readable but are not served while their writer is not
+  configured, and browser ingest may replace them (section 7.1).
+- A mutation drops each vendor's `ps` fields except `o`, `oc` and `ov`
+  (section 5.4), so opt-outs and the IDs they removed survive, and `ps.iv`
+  and `ps.st` do not: invalidated values can be re-seeded once, and
+  stateful providers start over when rolled forward.
+
+**Rolling back from step 1 to step 0.** Step 0 reads every row step 1
+wrote and serves its IDs under the rules above, so a rollback, or a rolling
+deploy with both builds live, loses no stored ID and no withdrawal. What it
+costs:
+
+- Rows step 1 wrote stop changing until step 1 returns: their ingest and
+  pull sync writes are skipped (`v2_row_write_skipped`), and provider
+  backoff in `ps` stops advancing because no provider runs.
+- A row with a provider opt-out serves no stored ID during the rollback,
+  which is stricter than step 1.
+- Rows step 0 writes are version 1, and step 1 reads and upgrades them on
+  its next write, as for any version 1 row.
+
+Rolling back below step 0 is unsupported: an older build rejects every
+version 2 row (`ec/kv_types.rs:376-381`), so old instances serve no stored
+ID and fail closed on withdrawals for those rows. Going back that far needs
+a KV migration to version 1, which this spec does not provide.
+
+## 15. Open questions
+
+1. **How long single-page apps wait.** Some sites are single-page apps:
+   after the first page loads, they change pages with JavaScript instead of
+   loading a new document from TS. TS hears about those page changes only
+   through `/_ts/page-bids`, which never writes KV and calls no provider
+   (section 5.1). So on those sites, browser ingest and provider refreshes
+   wait until the visitor's next full page load. After launch, measure how
+   long they wait, and revisit if the wait is long. **Decided (round 14):**
+   a same-origin `/_ts/page-bids` call from a real browser is the writer
+   once `spa_writer_interval_sec` (300) has passed since the row's last
+   writer flush, with after-send providers only (section 5.1, The SPA
+   writer).
+2. **Lost removals.** A removal write that fails all its attempts is lost
+   (sections 5.2, 5.3). After launch, watch
+   `removal_lost`. If it is not close to zero, should a durable
+   fallback come back, and in what form? **Decided (round 14):** the
+   pending key (section 5.3) holds it for the next writer;
+   `removal_lost` now counts only a removal whose append failed too.
+3. **Global revoke and a granting CMP.** A global revoke clears the EC
+   cookie, as a withdrawal does, but the CMP's consent may still grant. The
+   next navigation then mints a new EC. Should a global revoke also stop
+   minting until consent changes? **Decided (round 14):** yes. The global
+   scope stays, and the `ts-ec-revoked` marker stops minting until the
+   consent fingerprint changes (section 8, Revoke scope).
+4. **Durable stager results.** Stagers persist no positive ID (section
+   5.3), so a positive Lockr capture, with its full entry set, reaches KV
+   only as the one UID browser ingest picks. Should a durable path
+   come back for it, for example a capture-driven write within G4, if
+   `capture_unpersisted` shows that captures carry IDs or fields the
+   browser path does not? **Decided (round 14):** yes, through the pending
+   key (section 5.3). A positive capture that differs from KV is merged by
+   the next writer within its one write, so G4 holds; auctions do not read
+   the key.
+5. **Who reads `ts-eids-s`, and does it meet the product rule?** The
+   product rule is that provider IDs go to a first-party cookie and to KV,
+   with the cookie read first. Since revision 14 the server never reads the
+   cookie, and no page script is named as its reader (section 6.2). Before
+   `mirror_enabled` defaults to on, name its consumer and confirm with the
+   product lead that a client-only mirror meets the rule. Without a
+   consumer, the mirror costs about 2 KB on every request to the host and
+   exposes server-only IDs to page scripts for nothing. **Decided (round
+   14):** hold the mirror. It ships gated off (`mirror_enabled = false`)
+   until a consumer is named.
+6. **Providers on a new visitor's first navigation.** No provider runs on
+   a first navigation (section 4.7, step 7), so a visitor who leaves after
+   one page never gets a provider ID. One option keeps one write and never
+   uses an unconfirmed ID: mint the EC, run hold-mode providers (which need
+   no EC ID; only generic pull does), create the row with their answers,
+   then run the auction. It moves the create from before routing into
+   routing, and adds the hold budget to every first navigation that runs
+   an auction. Is that worth it? **Decided (round 14):** yes, when such a
+   provider is configured (section 4.7, new visitors).
+
+## 16. Decisions log
+
+Decisions made while writing this spec, with the spec author (dhruv8sh):
+
+| Decision                         | Choice                                                                                                                                                                                                                                   |
+| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Scope                            | Framework and trait. Vendors get their own specs.                                                                                                                                                                                        |
+| HEM input                        | Typed slot, always empty in v1. Intake is a later spec.                                                                                                                                                                                  |
+| Browser vs server precedence     | Configured per source through `owner`. The owner's valid value wins.                                                                                                                                                                     |
+| Cookie for server IDs            | Separate `ts-eids-s`, a client-only mirror the shim writes and the server never reads. Revision 14 replaced the server-owned, sealed, HttpOnly cookie of revisions 1 to 13. Revision 15 removed the `ts-eids-r` removal cookies as well. |
+| Structure                        | Trait plus coordinator, with an optional passive-capture capability.                                                                                                                                                                     |
+| Trait shape                      | One required method, `descriptor`. Capabilities are default methods. Synchronous. Additive by construction.                                                                                                                              |
+| Inputs                           | Declared in the descriptor and enforced: a provider can read only what it declared.                                                                                                                                                      |
+| Page load for the one-write rule | A navigation plus every request it causes. Only the navigation writes and only the navigation calls providers. Strict.                                                                                                                   |
+| New-visitor write                | One create, carrying browser EIDs. Before routing, or, with a hold-mode provider that does not read the EC ID, after the hold dispatch of a navigation that runs an auction, carrying its answers. Changed in rounds 3, 4 and 14.        |
+| New-visitor recovery             | Today's rotation. The cookie-proof recreation of revision 3 is removed with the deferred create.                                                                                                                                         |
+| Failed write                     | Not retried. Changed from one merge-retry once Fastly's per-key limit was confirmed.                                                                                                                                                     |
+| Browser EIDs beyond the cookie   | The shim writes only registered sources into `ts-eids`, merged per source, and the next navigation ingests them. Revision 14 removed the KV gap that `/auction` saved in `ts-eids-s`.                                                    |
+| Delay on body-less routes        | Accepted: a browser ID first seen in an `/auction` body reaches KV one page view later.                                                                                                                                                  |
+| SPA views (`/_ts/page-bids`)     | Stagers. They never write KV and call no provider.                                                                                                                                                                                       |
+| Hold budget                      | `hold_budget_ms` defaults to 100 ms, reduced from 300 ms (section 4.7 gives the reasons).                                                                                                                                                |
+| Outbound cookies                 | TS's identity cookies are stripped from Prebid Server requests. The origin keeps `ts-ec` and `ts-eids` and loses only `ts-eids-s`; `strip_eids_cookie_from_origin` strips `ts-eids` too. Changed after the round 14 review.              |
+| Deletion                         | A tombstone with the 24-hour `TOMBSTONE_TTL` replaces the hard delete. No extra writes.                                                                                                                                                  |
+| GPP opt-outs                     | Sharing and targeted-advertising opt-outs are decoded, and the strict policy blocks them.                                                                                                                                                |
+| `x-ts-eids`                      | Kept as a full troubleshooting header. Its exposure of server-only IDs to page scripts is accepted.                                                                                                                                      |
+| Consent withdrawal               | Synchronous tombstone on any request, a G4 exception with the two removal writes. Revision 15 adds one after-send attempt when it fails. Confirmed by the spec author after the round 14 review.                                         |
+| Equal-second ties                | A removal or opt-out wins a tie with an acquisition or clear. An ID re-acquired in that second is resolved again later. Confirmed after round 10.                                                                                        |
+| Complete provider EIDs           | A provider can return several EID entries per source, several UIDs each, with UID-level and EID-level fields. The set is stored and sent whole. Added in revision 13.                                                                    |
+| Entry-set writer                 | One writer per source. A result replaces the source's set whole, and one `rv` covers it, so ownership, revisions and removals stay per source.                                                                                           |
+| Behaviour before this spec       | G13 changes none of it. Browser ingest, `ts-eids`, batch sync, generic pull and `/identify` keep the behaviour the rest of this spec gives them and write one entry with one UID; only provider results write more.                      |
+| Removal hashes                   | Derived when a removal applies, from the live record it removes. Unkeyed, ordered, at most 128 per list. Invalidations go to `ps.iv`, kept; opt-out removals go to `ps.ov`, emptied by the clear.                                        |
+| Provenance default               | Applied only to an entry that sets no EID-level field, so vendor and config provenance never mix in one entry. Added in round 13.                                                                                                        |
+| Mirror lifetime                  | `ts-eids-s` lives at most a day and never past the earliest `exp` it holds.                                                                                                                                                              |
+
+Revision 15 applies these decisions, made by the spec author (dhruv8sh) after the round 14
+review, which allowed breaking changes:
+
+| Decision                  | Choice                                                                                                                                                                                                                                                                             |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Stager providers          | None. Resolving providers run only on writer navigations, so every outcome, backoff included, is stored. Stagers serve KV                                                                                                                                                          |
+| Removals                  | Written to KV on the request that carries them. `ts-eids-r`, its keyring and secrets, the overflow write and the strips-only rollout step are removed                                                                                                                              |
+| Non-browser removals      | Applied, as consent withdrawals are; only clears need a real browser. Changed after the round 14 review from dropping them                                                                                                                                                         |
+| Expiry scope              | G7 covers owned expiring sources. A stateless owner keeps its expired record as a refresh anchor until `exp` plus its declared refresh grace. Unowned IDs keep no lifetime (section 2.3). Changed after the round 14 review                                                        |
+| Opt-out clears            | A TCF re-grant clears only a denial `fp` recorded (new TCF bit 16), with no `LastUpdated` comparison. A clear stores a watermark, the `at` of the opt-out it read, as `ps.oc`, and clears apply before opt-outs. Changed after the round 14 review                                 |
+| Backend budget            | `max_backend_requests` (default 32) bounds origin, auction and provider calls in one execution; a provider call past it is skipped, not a failure, and a hold call reserves the origin and the auction. Added after the round 14 review                                            |
+| Per-IP ceiling            | `max_calls_per_ip_per_minute` (default 10) caps one provider's calls per client address across visitors, keyed on an HMAC of the IP, next to the per-visitor cap. Breaker failures are not required to come from distinct visitors. Added after the round 14 review                |
+| Reader-first rollout      | Rollout step 0, from `main`, reads version 2 rows, never rewrites them except to tombstone, and serves no stored ID from a row with a provider opt-out, so step 1 can roll back and deploy alongside old instances. Added after the round 14 review                                |
+| Global revoke minting     | A global revoke also sets `ts-ec-revoked` with the consent fingerprint, and no EC is minted until the request's fingerprint differs. Decided after the round 14 review                                                                                                             |
+| Pending key               | Removals whose writes all failed, and positive captures from a request that is not the writer, go to `pending:<ec_id>` (one-day TTL, CAS append, 16 items). Every writer reads it and merges items above the row's `pg`. Auctions never read it. Decided after the round 14 review |
+| SPA writer                | A same-origin `/_ts/page-bids` call from a real browser is the writer once `spa_writer_interval_sec` (300, 0 = off) has passed since the row's `wa`; it writes only on a row its auction read and runs after-send providers only. Decided after the round 14 review                |
+| New-visitor providers     | A new visitor's navigation that runs an auction runs hold-mode providers that do not read the EC ID, and the create carries their answers; finalize creates a row its navigation did not. Decided after the round 14 review                                                        |
+| Provider consent purposes | `strict()` requires Purpose 1; a resolver declares its purposes and its vendor, or `without_tcf_vendor()`, or `build()` rejects it. The revoke marker fingerprints all ten purposes. Decided after the round 14 review                                                             |
+| Capture                   | Revoke-only: removals, opt-out and clear. Positive IDs are counted, never stored. `capture_enabled` and request-body consent are removed                                                                                                                                           |
+| Capture-only opt-out      | Also removes the records of its sources that no provider wrote, and blocks the browser's values for them. A capture-only provider cannot own a source and must list its `sources`                                                                                                  |
+| Provider denials          | A provider's `ps.iv` and `ps.ov` filter browser candidates for unowned sources too. An opt-out's removals go to `ps.ov`, which its clear empties                                                                                                                                   |
+| Mirror feedback           | The shim never copies `ts-eids-s` into `ts-eids` or the `/auction` body                                                                                                                                                                                                            |
+| Dry run                   | Removed, with `is_dry_run`                                                                                                                                                                                                                                                         |
+| KV schema                 | Version 2 with one record shape. Version 1 rows are read and upgraded on write. Rollout step 0 reads version 2 and never rewrites it, so step 1 can roll back to it                                                                                                                |
+| Stored hashes             | `ps.iv` hashes are unkeyed and the consent fingerprint is a plain bitmask, because the row already holds the raw values. No legacy revision hash                                                                                                                                   |
+| Pull sync                 | The pull-complete marker and the legacy pull sync config keys are removed                                                                                                                                                                                                          |
+| Withdrawal retry          | A tombstone that fails before send gets one more attempt after send                                                                                                                                                                                                                |
diff --git a/scripts/README.md b/scripts/README.md
index 21fee51f52..c86cad849a 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -8,6 +8,7 @@ their documented orchestration handles a probe deliberately.
 | `batch-sync.sh`                           | Endpoint, bearer token, EC ID, partner UID; `curl` and Python              | Sends one authenticated batch-sync request. Its temporary response file is removed on exit.                                                                                                                                                                                                        |
 | `benchmark.sh`                            | A running server; `curl`, `bc`, and optionally `hey`                       | May install `hey` through Homebrew. `--save` writes under `benchmark-results/`; it does not stop the server.                                                                                                                                                                                       |
 | `check-ci-node-pin.mjs`                   | Pinned Node; tests in `check-ci-node-pin.test.mjs`                         | Read-only. Fails when a CI job compiles Rust before an unconditional `actions/setup-node` step pinned to `.tool-versions`; `--root` checks another checkout.                                                                                                                                       |
+| `check-ci-concurrency.sh`                 | yq v4; tests in `check-ci-concurrency.test.mjs`                            | Read-only. Checks per-PR workflow cancellation, per-job author queues, matrix groups, and timeouts; `--root` checks another checkout and `--yq` selects yq.                                                                                                                                        |
 | `profile.sh`                              | Fastly CLI, Rust WASM target, `curl`; endpoint and request options         | Builds and starts the Fastly app, stops the owned process, and retains a profile under `benchmark-results/profiles/`. `--open` launches the local viewer.                                                                                                                                          |
 | `generate-integration-viceroy-configs.sh` | Rust toolchain; optional origin port and artifact directory                | Builds the native generator and writes Viceroy config under `target/integration-test-artifacts/`; generated files persist.                                                                                                                                                                         |
 | `integration-tests.sh`                    | Docker, Viceroy, Rust WASM target, pinned Node                             | Builds WASM/native artifacts and two Docker images, generates Viceroy config, and runs native integration tests serially. Build products and images persist.                                                                                                                                       |
diff --git a/scripts/check-ci-concurrency.sh b/scripts/check-ci-concurrency.sh
new file mode 100755
index 0000000000..fb39af8c6b
--- /dev/null
+++ b/scripts/check-ci-concurrency.sh
@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+repo_root=$(cd "$script_dir/.." && pwd)
+root=$repo_root
+yq_bin=${YQ_BIN:-yq}
+
+usage() {
+  printf 'usage: check-ci-concurrency.sh [--root ROOT] [--yq PATH]\n' >&2
+}
+
+while (($#)); do
+  case "$1" in
+    --root)
+      [[ $# -ge 2 ]] || { usage; exit 2; }
+      root=$2
+      shift 2
+      ;;
+    --yq)
+      [[ $# -ge 2 ]] || { usage; exit 2; }
+      yq_bin=$2
+      shift 2
+      ;;
+    *)
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+workflow_dir=$root/.github/workflows
+reference=$workflow_dir/test.yml
+if [[ ! -d "$workflow_dir" || ! -f "$reference" ]]; then
+  printf 'error: expected workflow directory and test.yml under %s\n' "$root" >&2
+  exit 1
+fi
+if ! command -v "$yq_bin" >/dev/null 2>&1; then
+  printf 'error: yq v4 is required to check workflow policies\n' >&2
+  exit 1
+fi
+
+workflow_prefix="\${{ github.workflow }}"
+expected_workflow_group="${workflow_prefix}-\${{ github.event.pull_request.number || github.run_id }}"
+expected_author_suffix="\${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}"
+matrix_prefix="\${{ matrix."
+matrix_suffix=' }}-'
+matrix_key_pattern='^[[:alnum:]_.-]+$'
+
+status=0
+
+report_error() {
+  printf '::error file=%s::%s\n' "$1" "$2"
+  status=1
+}
+
+has_pull_request_trigger() {
+  "$yq_bin" -r '
+    .on
+    | ((tag == "!!map" and has("pull_request"))
+       or (tag == "!!str" and . == "pull_request")
+       or (tag == "!!seq" and ([.[] | select(. == "pull_request")] | length > 0)))
+  ' "$1"
+}
+
+job_value() {
+  local file=$1
+  local job=$2
+  local expression=$3
+  YQ_JOB=$job "$yq_bin" -r ".jobs[strenv(YQ_JOB)].${expression}" "$file"
+}
+
+# Prints each matrix key used by the segment, one per line. Fails when the
+# segment is anything other than a run of `${{ matrix.<key> }}-` parts.
+matrix_segment_keys() {
+  local remaining=$1
+  local matrix_key
+
+  while [[ "$remaining" == "$matrix_prefix"* ]]; do
+    remaining=${remaining#"$matrix_prefix"}
+    [[ "$remaining" == *"$matrix_suffix"* ]] || return 1
+    matrix_key=${remaining%%"$matrix_suffix"*}
+    [[ "$matrix_key" =~ $matrix_key_pattern ]] || return 1
+    printf '%s\n' "$matrix_key"
+    remaining=${remaining#*"$matrix_suffix"}
+  done
+
+  [[ -z "$remaining" ]]
+}
+
+validate_job_group() {
+  local file=$1
+  local job=$2
+  local group=$3
+  local has_matrix=$4
+  local prefix="${workflow_prefix}-${job}-"
+  local remainder
+  local matrix_segment
+  local used_keys
+  local matrix_key
+
+  if [[ "$group" != "$prefix"* ]]; then
+    report_error "$file" "Job '$job' concurrency group must start with the workflow name and its own job ID."
+    return
+  fi
+  remainder=${group#"$prefix"}
+  if [[ "$remainder" != *"$expected_author_suffix" ]]; then
+    report_error "$file" "Job '$job' concurrency group must use the pull-request author for human PRs and the run ID otherwise."
+    return
+  fi
+  matrix_segment=${remainder%"$expected_author_suffix"}
+
+  if [[ "$has_matrix" == true ]]; then
+    if [[ -z "$matrix_segment" ]] || ! used_keys=$(matrix_segment_keys "$matrix_segment"); then
+      report_error "$file" "Matrix job '$job' concurrency group must include each matrix leg before the per-author suffix."
+      return
+    fi
+    # Every matrix dimension must key the group, or legs that share one value
+    # queue behind each other. Include-only matrices have no dimensions here.
+    while IFS= read -r matrix_key; do
+      [[ -n "$matrix_key" ]] || continue
+      if ! grep -qxF -- "$matrix_key" <<<"$used_keys"; then
+        report_error "$file" "Matrix job '$job' concurrency group must include matrix.$matrix_key before the per-author suffix."
+      fi
+    done < <(job_value "$file" "$job" 'strategy.matrix | select(tag == "!!map") | keys | .[] | select(. != "include" and . != "exclude")')
+  elif [[ -n "$matrix_segment" ]]; then
+    report_error "$file" "Non-matrix job '$job' concurrency group must not add a shared queue segment."
+  fi
+}
+
+check_workflow() {
+  local file=$1
+  local is_pr
+  local group
+  local cancel
+  local queue
+  local job
+  local timeout
+  local job_group
+  local job_queue
+  local has_matrix
+
+  is_pr=$(has_pull_request_trigger "$file")
+  [[ "$is_pr" == true ]] || return 0
+
+  group=$("$yq_bin" -r '.concurrency.group // ""' "$file")
+  cancel=$("$yq_bin" -r '.concurrency."cancel-in-progress" // false' "$file")
+  queue=$("$yq_bin" -r '.concurrency.queue // ""' "$file")
+  if [[ "$group" != "$expected_workflow_group" || "$cancel" != true || "$queue" == max ]]; then
+    report_error "$file" "PR workflow concurrency group must be per-PR cancellation from test.yml, without queue: max."
+  fi
+
+  while IFS= read -r job; do
+    [[ -n "$job" ]] || continue
+
+    timeout=$(job_value "$file" "$job" '"timeout-minutes" // 0')
+    if [[ ! "$timeout" =~ ^[1-9][0-9]*$ && "$timeout" != "\${{ "*" }}" ]]; then
+      report_error "$file" "Job '$job' must set a positive timeout-minutes value."
+    fi
+
+    job_group=$(job_value "$file" "$job" "concurrency.group")
+    job_queue=$(job_value "$file" "$job" "concurrency.queue")
+    if [[ "$job_queue" != max ]]; then
+      report_error "$file" "Job '$job' must set queue: max on its per-author concurrency group."
+    fi
+    has_matrix=$(job_value "$file" "$job" "strategy.matrix != null")
+    validate_job_group "$file" "$job" "$job_group" "$has_matrix"
+  done < <("$yq_bin" -r '.jobs | to_entries[] | select(.value.uses == null) | .key' "$file")
+}
+
+while IFS= read -r -d '' workflow_file; do
+  check_workflow "$workflow_file"
+done < <(find "$workflow_dir" -type f \( -name '*.yml' -o -name '*.yaml' \) -print0)
+
+exit "$status"
diff --git a/scripts/check-ci-concurrency.test.mjs b/scripts/check-ci-concurrency.test.mjs
new file mode 100644
index 0000000000..8bdfb55d05
--- /dev/null
+++ b/scripts/check-ci-concurrency.test.mjs
@@ -0,0 +1,356 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import test from 'node:test'
+
+const repositoryRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..'
+)
+const guardPath = path.join(repositoryRoot, 'scripts/check-ci-concurrency.sh')
+const workflowPrefix = '$' + '{{ github.workflow }}'
+const workflowGroup =
+  workflowPrefix +
+  '-' +
+  '$' +
+  '{{ github.event.pull_request.number || github.run_id }}'
+const authorGroupSuffix =
+  '$' +
+  "{{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}"
+
+function authorGroup(job, matrix = '') {
+  return [workflowPrefix, job, matrix, authorGroupSuffix]
+    .filter(Boolean)
+    .join('-')
+}
+
+function workflow(job, group, options = {}) {
+  const lines = [
+    'name: ' + job,
+    'on:',
+    '  pull_request:',
+    'concurrency:',
+    '  group: ' + workflowGroup,
+    '  cancel-in-progress: true',
+    'jobs:',
+    '  ' + job + ':',
+    '    runs-on: ubuntu-latest',
+  ]
+  if (options.timeout !== false) lines.push('    timeout-minutes: 5')
+  if (options.matrix) {
+    lines.push('    strategy:', '      matrix:', '        os: [ubuntu-latest]')
+  }
+  lines.push('    concurrency:', '      group: ' + group)
+  if (options.queue !== false) lines.push('      queue: max')
+  lines.push('    steps:', '      - run: echo test')
+  return lines.join('\n') + '\n'
+}
+
+function fixtureRoot() {
+  const root = mkdtempSync(path.join(os.tmpdir(), 'check-ci-concurrency-'))
+  const workflowsPath = path.join(root, '.github/workflows')
+  mkdirSync(workflowsPath, { recursive: true })
+  writeFileSync(
+    path.join(workflowsPath, 'test.yml'),
+    workflow('test-rust', authorGroup('test-rust'))
+  )
+  writeFileSync(
+    path.join(workflowsPath, 'format.yml'),
+    workflow('format-rust', authorGroup('format-rust'))
+  )
+  writeFileSync(
+    path.join(workflowsPath, 'push-only.yml'),
+    [
+      'name: Push only',
+      'on:',
+      '  push:',
+      'jobs:',
+      '  build:',
+      '    runs-on: ubuntu-latest',
+      '    steps:',
+      '      - run: echo test',
+      '',
+    ].join('\n')
+  )
+  writeFileSync(
+    path.join(workflowsPath, 'reusable.yml'),
+    [
+      'name: Reusable caller',
+      'on:',
+      '  pull_request:',
+      'concurrency:',
+      '  group: ' + workflowGroup,
+      '  cancel-in-progress: true',
+      'jobs:',
+      '  call:',
+      '    uses: example/reusable/.github/workflows/test.yml@main',
+      '',
+    ].join('\n')
+  )
+  return { root, workflowsPath }
+}
+
+function runGuard(root) {
+  return spawnSync('bash', [guardPath, '--root', root], { encoding: 'utf8' })
+}
+
+function withFixture(callback) {
+  const fixture = fixtureRoot()
+  try {
+    callback(fixture)
+  } finally {
+    rmSync(fixture.root, { recursive: true, force: true })
+  }
+}
+
+function assertRejected(root, expectedMessage) {
+  const result = runGuard(root)
+  assert.equal(
+    result.error,
+    undefined,
+    'should start the guard: ' + result.error
+  )
+  assert.notEqual(
+    result.status,
+    0,
+    'should reject the policy:\n' + result.stdout + '\n' + result.stderr
+  )
+  assert.match(result.stdout + result.stderr, expectedMessage)
+}
+
+test('accepts per-PR cancellation and distinct per-author job queues', () => {
+  withFixture(({ root }) => {
+    const result = runGuard(root)
+    assert.equal(
+      result.error,
+      undefined,
+      'should start the guard: ' + result.error
+    )
+    assert.equal(result.status, 0, result.stdout + '\n' + result.stderr)
+  })
+})
+
+test('rejects author groups that use the actor or queue bot PRs', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const source = workflow('format-rust', authorGroup('format-rust'))
+    writeFileSync(
+      formatPath,
+      source.replace('pull_request.user.login', 'github.actor')
+    )
+    assertRejected(root, /concurrency group/i)
+    writeFileSync(formatPath, source.replace("user.type != 'Bot' && ", ''))
+    assertRejected(root, /concurrency group/i)
+  })
+})
+
+test('rejects a per-author group without the non-PR run-ID fallback', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const group = authorGroup('format-rust').replace(' || github.run_id', '')
+    writeFileSync(formatPath, workflow('format-rust', group))
+    assertRejected(root, /concurrency group/i)
+  })
+})
+
+test('rejects copied job groups and groups without the workflow prefix', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    writeFileSync(formatPath, workflow('format-rust', authorGroup('test-rust')))
+    assertRejected(root, /concurrency group/i)
+    writeFileSync(
+      formatPath,
+      workflow(
+        'format-rust',
+        authorGroup('format-rust').replace(workflowPrefix + '-', '')
+      )
+    )
+    assertRejected(root, /concurrency group/i)
+  })
+})
+
+test('requires matrix jobs to separate their legs in the author queue', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    writeFileSync(
+      formatPath,
+      workflow(
+        'format-rust',
+        authorGroup('format-rust', '$' + '{{ matrix.os }}'),
+        {
+          matrix: true,
+        }
+      )
+    )
+    const passing = runGuard(root)
+    assert.equal(
+      passing.error,
+      undefined,
+      'should start the guard: ' + passing.error
+    )
+    assert.equal(passing.status, 0, passing.stdout + '\n' + passing.stderr)
+
+    writeFileSync(
+      formatPath,
+      workflow('format-rust', authorGroup('format-rust'), { matrix: true })
+    )
+    assertRejected(root, /matrix job/i)
+  })
+})
+
+test('requires every non-reusable PR job to set a timeout and queue max', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    writeFileSync(
+      formatPath,
+      workflow('format-rust', authorGroup('format-rust'), { timeout: false })
+    )
+    assertRejected(root, /timeout-minutes/)
+    writeFileSync(
+      formatPath,
+      workflow('format-rust', authorGroup('format-rust'), { queue: false })
+    )
+    assertRejected(root, /queue: max/)
+  })
+})
+
+test('requires the exact per-PR cancellation group on every PR workflow', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const wrongGroup = workflow(
+      'format-rust',
+      authorGroup('format-rust')
+    ).replace(
+      'github.event.pull_request.number || github.run_id',
+      'github.actor'
+    )
+    writeFileSync(formatPath, wrongGroup)
+    assertRejected(root, /workflow concurrency group/)
+  })
+})
+
+test('requires cancellation and rejects queue max on the workflow block', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const source = workflow('format-rust', authorGroup('format-rust'))
+    writeFileSync(
+      formatPath,
+      source.replace('cancel-in-progress: true', 'cancel-in-progress: false')
+    )
+    assertRejected(root, /workflow concurrency group/)
+    writeFileSync(
+      formatPath,
+      source.replace(
+        'cancel-in-progress: true',
+        'cancel-in-progress: true\n  queue: max'
+      )
+    )
+    assertRejected(root, /workflow concurrency group/)
+  })
+})
+
+test('checks workflows with string and list pull_request triggers', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const source = workflow('format-rust', authorGroup('format-rust'), {
+      timeout: false,
+    })
+    writeFileSync(
+      formatPath,
+      source.replace('on:\n  pull_request:', 'on: pull_request')
+    )
+    assertRejected(root, /timeout-minutes/)
+    writeFileSync(
+      formatPath,
+      source.replace('on:\n  pull_request:', 'on: [push, pull_request]')
+    )
+    assertRejected(root, /timeout-minutes/)
+  })
+})
+
+test('rejects an extra segment in a non-matrix job group', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    writeFileSync(
+      formatPath,
+      workflow('format-rust', authorGroup('format-rust', 'extra'))
+    )
+    assertRejected(root, /must not add a shared queue segment/)
+  })
+})
+
+test('rejects a matrix segment that is not a plain matrix value', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const segment = '$' + "{{ matrix.os || 'linux' }}"
+    writeFileSync(
+      formatPath,
+      workflow('format-rust', authorGroup('format-rust', segment), {
+        matrix: true,
+      })
+    )
+    assertRejected(root, /matrix job/i)
+  })
+})
+
+test('requires every matrix dimension in the job group', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const osSegment = '$' + '{{ matrix.os }}'
+    const nodeSegment = '$' + '{{ matrix.node }}'
+    const addNodeDimension = (source) =>
+      source.replace(
+        '        os: [ubuntu-latest]',
+        '        os: [ubuntu-latest]\n        node: [22, 24]'
+      )
+    writeFileSync(
+      formatPath,
+      addNodeDimension(
+        workflow('format-rust', authorGroup('format-rust', osSegment), {
+          matrix: true,
+        })
+      )
+    )
+    assertRejected(root, /matrix\.node/)
+
+    writeFileSync(
+      formatPath,
+      addNodeDimension(
+        workflow(
+          'format-rust',
+          authorGroup('format-rust', osSegment + '-' + nodeSegment),
+          { matrix: true }
+        )
+      )
+    )
+    const passing = runGuard(root)
+    assert.equal(passing.status, 0, passing.stdout + '\n' + passing.stderr)
+  })
+})
+
+test('accepts expression timeouts and rejects a zero timeout', () => {
+  withFixture(({ root, workflowsPath }) => {
+    const formatPath = path.join(workflowsPath, 'format.yml')
+    const source = workflow('format-rust', authorGroup('format-rust'))
+    writeFileSync(
+      formatPath,
+      source.replace(
+        'timeout-minutes: 5',
+        'timeout-minutes: ' +
+          '$' +
+          "{{ matrix.os == 'windows-latest' && 65 || 30 }}"
+      )
+    )
+    const passing = runGuard(root)
+    assert.equal(passing.status, 0, passing.stdout + '\n' + passing.stderr)
+
+    writeFileSync(
+      formatPath,
+      source.replace('timeout-minutes: 5', 'timeout-minutes: 0')
+    )
+    assertRejected(root, /timeout-minutes/)
+  })
+})
diff --git a/tinybird/README.md b/tinybird/README.md
index c0a0e976ce..6a305dcdec 100644
--- a/tinybird/README.md
+++ b/tinybird/README.md
@@ -1,7 +1,7 @@
 # Tinybird project
 
 This directory is the tracked Tinybird resource project for Trusted Server
-auction telemetry.
+auction and access telemetry.
 
 - `datasources/auction_events_raw.datasource` is the runtime ingest target.
 - The auction overview, provider, and bid-stat rollups are materialized
@@ -10,8 +10,10 @@ auction telemetry.
   yield endpoints or materialized views.
 - `fixtures/auction_events_raw.ndjson` is test data only.
 - `tests/` checks auction summary, provider health, and seat-yield results.
-- `datasources/access_logs_raw.datasource` is reserved; Trusted Server does
-  not currently emit access logs.
+- `datasources/access_logs_v2.datasource` is the sampled access-telemetry ingest
+  target, with 31 columns and a 30-day TTL. `fixtures/access_logs_v2.ndjson` is test data only.
+- `datasources/access_logs_raw.datasource` preserves the reserved legacy schema.
+  It is not the target for the new emitter and is not replaced or backfilled.
 
 Authenticate the Tinybird CLI against the intended workspace, change to this
 directory, run `tb test`, inspect `tb deploy --dry-run`, and deploy with
@@ -22,9 +24,18 @@ platform secret store, and put only its key name in
 `tinybird.auction_token_secret`. The runtime sends directly to the regional
 Events API host configured by `tinybird.api_host`.
 
-For runtime behavior, limits, privacy properties, and the Fastly-only emission
-boundary, see [Auction Telemetry](../docs/guide/telemetry.md). For exact
-configuration fields, see [Configuration](../docs/guide/configuration.md).
+For access telemetry, use the distinct `ts_access_v2_ingest` APPEND token scoped
+only to `access_logs_v2`. Store its value in the default app-config secret store
+under the key named by `tinybird.access_token_secret`. Set
+`tinybird.access_dataset = "access_logs_v2"` explicitly when updating a config
+that still carries the legacy dataset name. Keep access disabled until this
+schema and token are ready. With access enabled, validation rejects exactly the
+normalized legacy name `access_logs_raw`; custom dataset names remain allowed,
+and disabled legacy configurations remain accepted.
+
+For runtime behavior, sampling, privacy properties, and the Fastly-only emission
+boundary, see [Telemetry](../docs/guide/telemetry.md). For exact configuration
+fields, see [Configuration](../docs/guide/configuration.md).
 
 ## Deploy ordering
 
@@ -37,10 +48,60 @@ is an unconfigured placeholder returning `NULL`, not a working monitor. Connect
 workspace quarantine source before relying on its counts. A code-first deploy can lose
 rows silently until the schema catches up.
 
-Adding a field means changing three things together: the struct in
+Adding an auction field means changing three things together: the struct in
 `crates/trusted-server-core/src/auction/telemetry.rs`, the `SCHEMA` block in
 `datasources/auction_events_raw.datasource`, and every row in
-`fixtures/auction_events_raw.ndjson`.
+`fixtures/auction_events_raw.ndjson`. Access fields likewise must agree between
+`crates/trusted-server-core/src/access_telemetry.rs`,
+`datasources/access_logs_v2.datasource`, and `fixtures/access_logs_v2.ndjson`,
+including the JSONPaths and nullable types.
+
+The access v2 contract uses `auction_collected_ms` for collection return, not
+provider transport completion. `ts_version` identifies the TS build like the
+`x-ts-version` header, not a Fastly activation number. `delivery_result` reports
+local transport handoff as `complete`, `partial`, or `error`, not client receipt.
+Access ingestion is fire-and-forget; HTTP success and quarantined rows are not
+observed by the emitter. The core producer/schema/fixture test checks field and
+JSONPath agreement, but cannot establish live ingestion success.
+
+These are pre-rollout changes to the new v2 datasource. If a preview v2 schema
+has already been deployed, inspect and coordinate its migration before deploying
+this producer; do not assume the new name and column appear automatically.
+
+### Access datasource cutover
+
+The new emitter uses a versioned datasource rather than evolving
+`access_logs_raw`. The legacy datasource has nine columns, including raw
+`path` and `cache_state`, and no phase columns. `access_logs_v2` has no
+`FORWARD_QUERY` and does not copy historical raw paths into bounded route templates.
+
+1. Inspect the deployed workspace resources and retention requirements. Preserve
+   any existing `access_logs_raw` and its token; do not drop or recreate it.
+2. Run the Tinybird deployment check against that workspace and confirm the diff
+   creates `access_logs_v2` and `ts_access_v2_ingest` without changing the legacy
+   datasource. Deploy the new resources before the emitting binary.
+3. Provision the new APPEND token in the platform secret store. Deploy the new
+   binary with access telemetry still disabled, then push a config with
+   `enabled = true`, `access_enabled = true`, `access_dataset = "access_logs_v2"`,
+   the new token key, and a positive sample rate. Use separate
+   token keys for the access and auction sinks.
+4. Verify accepted rows, their stored `sample_rate`, ingestion freshness, and
+   workspace quarantine. Confirm the UUID join against `auction_events_raw` for
+   active auction observations. Disabled auctions have null access UUIDs.
+5. Switch dashboards and queries to `access_logs_v2`. Leave legacy resources in
+   place for retention and rollback; any later removal is a separate operator
+   decision.
+
+Rollback disables access emission before restoring an older binary. Re-push a
+compatible config with no non-default `[observability]` table; for access-only
+telemetry also set `tinybird.enabled = false`, since older binaries interpret it
+as auction enablement. Keep both datasets and tokens intact during rollback.
+Do not redeploy an older `tinybird/` project that omits `access_logs_v2`;
+its deployment may propose removing the new datasource. Inspect the dry-run
+rather than treating a binary rollback as a Tinybird project rollback.
+
+These steps are a rollout requirement, not evidence that a live workspace
+migration has already been tested.
 
 ## Reading `origin_cache_shareable`
 
diff --git a/tinybird/datasources/access_logs_v2.datasource b/tinybird/datasources/access_logs_v2.datasource
new file mode 100644
index 0000000000..951284c48d
--- /dev/null
+++ b/tinybird/datasources/access_logs_v2.datasource
@@ -0,0 +1,41 @@
+DESCRIPTION >
+  Per-request phase-timing telemetry rows, sampled and emitted post-send by the edge service.
+
+SCHEMA >
+  `event_ts` DateTime64(3) `json:$.event_ts`,
+  `method` LowCardinality(String) `json:$.method`,
+  `status` UInt16 `json:$.status`,
+  `time_elapsed_ms` Nullable(UInt32) `json:$.time_elapsed_ms`,
+  `sample_rate` Float64 `json:$.sample_rate`,
+  `service_id` LowCardinality(String) `json:$.service_id`,
+  `publisher_domain` LowCardinality(String) `json:$.publisher_domain`,
+  `env` LowCardinality(String) `json:$.env`,
+  `route_class` LowCardinality(String) `json:$.route_class`,
+  `route_template` String `json:$.route_template`,
+  `body_mode` LowCardinality(String) `json:$.body_mode`,
+  `delivery_result` LowCardinality(String) `json:$.delivery_result`,
+  `auction_wait_placement` LowCardinality(String) `json:$.auction_wait_placement`,
+  `appbuild_ms` Nullable(UInt32) `json:$.appbuild_ms`,
+  `filter_ms` Nullable(UInt32) `json:$.filter_ms`,
+  `geo_ms` Nullable(UInt32) `json:$.geo_ms`,
+  `kv_ms` Nullable(UInt32) `json:$.kv_ms`,
+  `origin_ms` Nullable(UInt32) `json:$.origin_ms`,
+  `template_cache_ms` Nullable(UInt32) `json:$.template_cache_ms`,
+  `auction_wait_ms` Nullable(UInt32) `json:$.auction_wait_ms`,
+  `stream_ms` Nullable(UInt32) `json:$.stream_ms`,
+  `request_elapsed_ms` Nullable(UInt32) `json:$.request_elapsed_ms`,
+  `resp_bytes` Nullable(UInt64) `json:$.resp_bytes`,
+  `template_cache_state` LowCardinality(String) `json:$.template_cache_state`,
+  `country` LowCardinality(String) `json:$.country`,
+  `ts_version` LowCardinality(String) `json:$.ts_version`,
+  `pop` LowCardinality(String) `json:$.pop`,
+  `auction_dispatched_ms` Nullable(UInt32) `json:$.auction_dispatched_ms`,
+  `auction_collected_ms` Nullable(UInt32) `json:$.auction_collected_ms`,
+  `auction_committed_ms` Nullable(UInt32) `json:$.auction_committed_ms`,
+  `auction_id` Nullable(UUID) `json:$.auction_id`
+
+ENGINE "MergeTree"
+ENGINE_SORTING_KEY "toDate(event_ts), service_id, publisher_domain, env, route_class, pop, status"
+TTL "toDate(event_ts) + INTERVAL 30 DAY"
+
+TOKEN ts_access_v2_ingest APPEND
diff --git a/tinybird/fixtures/access_logs_v2.ndjson b/tinybird/fixtures/access_logs_v2.ndjson
new file mode 100644
index 0000000000..a28bfeae68
--- /dev/null
+++ b/tinybird/fixtures/access_logs_v2.ndjson
@@ -0,0 +1,2 @@
+{"event_ts":"2026-06-23 12:00:00.000","method":"GET","status":200,"time_elapsed_ms":60,"sample_rate":0.1,"service_id":"abc123","publisher_domain":"publisher.example.com","env":"production","route_class":"publisher_html","route_template":"/news/*","body_mode":"streamed","delivery_result":"complete","auction_wait_placement":"in_stream","appbuild_ms":12,"filter_ms":5,"geo_ms":3,"kv_ms":8,"origin_ms":null,"template_cache_ms":10,"auction_wait_ms":22,"stream_ms":40,"request_elapsed_ms":100,"resp_bytes":8192,"template_cache_state":"hit","country":"US","ts_version":"v1.2.3","pop":"SFO","auction_dispatched_ms":30,"auction_collected_ms":92,"auction_committed_ms":94,"auction_id":"550e8400-e29b-41d4-a716-446655440000"}
+{"event_ts":"2026-06-23 12:00:01.000","method":"GET","status":200,"time_elapsed_ms":12,"sample_rate":0.1,"service_id":"abc123","publisher_domain":"publisher.example.com","env":"production","route_class":"asset","route_template":"/static/*","body_mode":"streamed","delivery_result":"partial","auction_wait_placement":"none","appbuild_ms":2,"filter_ms":1,"geo_ms":1,"kv_ms":null,"origin_ms":null,"template_cache_ms":null,"auction_wait_ms":null,"stream_ms":3,"request_elapsed_ms":15,"resp_bytes":2048,"template_cache_state":"unknown","country":"US","ts_version":"v1.2.3","pop":"SFO","auction_dispatched_ms":null,"auction_collected_ms":null,"auction_committed_ms":null,"auction_id":null}
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 99afa869dd..03435efa1c 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -84,11 +84,70 @@ passphrase = "ec_passphrase"
 # bound per adapter (e.g. `ec_identity_store` in fastly.toml); edgezero.toml's
 # logical KV id is `trusted_server_kv`.
 ec_store = "ec_identity_store"
-# Max concurrent partner pull-sync requests.
-pull_sync_concurrency = 3
 # Optional cluster-heuristic tuning (defaults shown):
 # cluster_trust_threshold = 10    # entries with cluster_size <= this are individual users
 # cluster_recheck_secs = 3600     # re-evaluate cluster_size after this many seconds
+# Also strip the ts-eids cookie from publisher-origin requests. The
+# __Host-ts-eids-s mirror is always stripped.
+# strip_eids_cookie_from_origin = false
+
+# Server-side identity provider policy. Every key is optional; the values
+# below are the defaults.
+# [ec.identity]
+# Max identity providers dispatched at once. Replaces the removed
+# ec.pull_sync_concurrency.
+# max_concurrency = 4
+# Total time a navigation may wait for hold-mode providers (at most 1000).
+# hold_budget_ms = 100
+# Seconds before a provider that timed out in hold mode is held again.
+# hold_retry_sec = 300
+# Largest provider response body accepted, in bytes.
+# max_response_bytes = 65536
+# Backend requests one execution may start: origin, auction and provider
+# calls together. Fastly allows 32 (10 on trial accounts).
+# max_backend_requests = 32
+# Return the __Host-ts-eids-s mirror payload from /auction and
+# /_ts/page-bids. Off until a page script that reads it is named.
+# mirror_enabled = false
+# Seconds a same-origin /_ts/page-bids call from a real browser waits after the
+# row's last write before writing itself, for single-page apps. 0 turns it off.
+# spa_writer_interval_sec = 300
+
+# Per-provider policy; the table name is the identity provider ID. A pull
+# partner (`pull_sync_enabled = true`) registers as `pull-` plus its source
+# domain with dots replaced by `-`, so `ssp.example.com` is
+# `pull-ssp-example-com`. These keys replace the removed per-partner
+# `pull_sync_ttl_sec` (now `refresh_after_sec`) and `pull_sync_rate_limit = N`
+# (now `max_calls_per_minute = ceil(N / 60)`).
+# [ec.identity.providers.pull-ssp-example-com]
+# mode = "after_send"             # or "hold"
+# timeout_ms = 100                # hold mode only; at most hold_budget_ms
+# after_send_timeout_ms = 1000    # 1..=10000
+# refresh_after_sec = 86400
+# max_calls_per_minute = 1
+# max_calls_per_ip_per_minute = 10  # 0 turns the per-IP ceiling off
+# breaker_failures_per_minute = 50
+# cookie_priority = 0
+
+# Capture provider (a vendor whose responses Trusted Server proxies; the
+# provider declares `captures`). A capture-only provider must list its
+# `sources`: its opt-out removes browser-ingested records of every source
+# listed here, so list only the sources it is the delivery path for. Each
+# source also needs an [[ec.partners]] entry with bidstream_enabled = true.
+# [ec.identity.providers.examplecapture]
+# sources = ["capture.example.com"]
+# `provider` (default) removes only this provider's records. `global` runs
+# the consent-withdrawal tombstone for a captured opt-out from a real browser.
+# revoke_scope = "provider"
+
+# A source can name the identity provider that owns it. The owner refreshes the
+# source and its result replaces the source's whole entry set. Absent: unowned.
+# [[ec.partners]]
+# name = "Example ID"
+# source_domain = "exampleid.example.com"
+# openrtb_atype = 1
+# bidstream_enabled = true
+# owner = "exampleid"
 
 # Example partner configuration. Provision referenced keys in
 # trusted_server_secrets before validating/pushing.
@@ -353,6 +412,17 @@ provider = "pbs-main"
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"
 
+[observability]
+# Keep this leaf present so the environment override can apply; the overlay
+# cannot create a missing configuration leaf. The Server-Timing header stays
+# off until enabled.
+server_timing_enabled = false
+# Keep selected first path segments in access-telemetry route templates.
+# Set this array in TOML; the environment overlay cannot set arrays.
+# Use ASCII names; "other" shares the fallback bucket. Matching uses the raw,
+# percent-encoded path, so literal non-ASCII names do not match encoded URLs.
+# route_sections = ["news"]
+
 # Server-side ad slot templates + creative-opportunity auction. Kept active.
 [creative_opportunities]
 # Set false to disable server-side ad templates while keeping slot definitions
@@ -466,13 +536,19 @@ auction_timeout_ms = 500
 #   "/news/x"    -> /123456789/example/news
 #   "/reviews/y" -> /123456789/example/reviews
 
-# Direct Tinybird auction telemetry (off by default). When enabled, `api_host`
+# Direct Tinybird auction/access telemetry (off by default). When enabled, `api_host`
 # is required and must be a bare host (no scheme or path).
 # [tinybird]
 # enabled = true
 # api_host = "api.us-east.tinybird.example"   # required when enabled; host only
-# auction_dataset = "auction_events"          # Events API datasource name
-# auction_token_secret = "tinybird_auction_append_token"  # Key in trusted_server_secrets
+# auction_dataset = "auction_events_raw"      # auction Events API datasource
+# auction_token_secret = "tinybird_auction_append_token"  # key in the default secret store
+# auction_enabled = true                       # emit auction telemetry
+# access_enabled = true                        # positive sample rate required
+# access_dataset = "access_logs_v2"           # deploy this schema before enabling access
+# access_token_secret = "tinybird_access_append_token"    # key in the default secret store
+# access_sample_rate = 0.05                    # sample 5%; sink defaults off
+# max_body_bytes = 1048576                     # maximum NDJSON body, at least 1024
 
 # Debug endpoints (all default false — never enable in production).
 # [debug]