diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 157a3582d3..e3f2b33343 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -155,7 +155,13 @@ jobs:
   browser-tests:
     name: browser integration tests
     needs: prepare-artifacts
-    runs-on: ubuntu-latest
+    # Pinned rather than floating on ubuntu-latest, which moved to 26.04 and
+    # fails at `playwright install` with "Playwright does not support chromium
+    # on ubuntu26.04-x64". Every browser test then fails in milliseconds because
+    # no browser was installed. Other jobs are unaffected: the Axum job obtains
+    # Chrome through browser-actions/setup-chrome, which works on 26.04. Unpin
+    # once the pinned Playwright version supports the newer image.
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f691c6a005..1a13150356 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,6 +41,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - TSJS-generated envelopes now send `trustedServer.params.storedRequest: false`, preventing accidental PBS stored lookups without suppressing eligible non-PBS demand. PBS filters unusable impressions after overrides; explicit `true` and omission in valid envelopes retain inline-first stored fallback. A malformed envelope disables stored fallback for the entire slot, including independent direct demand left unusable after overrides. Publisher intent survives repeated and refresh auctions. Deploy compatible server admission everywhere before serving the new JS, and retain it during rollback while cached clients remain. See the Prebid deployment guide.
 - Protocol-relative creative URLs now honor `rewrite.exclude_domains`, so excluded creative assets stay direct and excluded absolute or protocol-relative URLs submitted to `/first-party/sign` are rejected.
 - Server-side ad template bids now always carry `hb_adid` in `window.tsjs.bids`. Bidders that return neither a Prebid Cache UUID nor an `adid` previously produced no `hb_adid` at all, so no `hb_adid` GPT targeting key was set and the Universal Creative render bridge had nothing to match — the winning creative never rendered. The OpenRTB bid `id`, which is mandatory per spec, is now the last-resort source; `cache_id` and `adid` still take priority where present. Blank `cacheId`/`adid` values no longer win that precedence and emit an unusable empty `hb_adid`, and `hb_cache_host`/`hb_cache_path` are now emitted only alongside a real Prebid Cache UUID — without one they pointed the Universal Creative at a guaranteed cache miss instead of letting it fall through to the inline creative.
+- The origin's address in a CSS, JavaScript, JSON or other text response that core rewrites without parsing it is now replaced in one pass. A request host that contains the origin host was matched again inside its own replacement, so `https://example.com/` served on `www.example.com` came out as `https://www.www.example.com/`, and `https://publisher.example/` served on `publisher.example.localhost` over `http` as `http://publisher.example.localhost.localhost.localhost.localhost/`.
 
 ### Added
 
diff --git a/crates/edgecookie/README.md b/crates/edgecookie/README.md
new file mode 100644
index 0000000000..f322c431f0
--- /dev/null
+++ b/crates/edgecookie/README.md
@@ -0,0 +1,18 @@
+# Edge Cookie modules
+
+Vendor Edge Cookie module crates live here, one per vendor, for example
+`crates/edgecookie/<vendor>`. Each implements the `EdgeCookieModule` trait
+from `trusted-server-core` and is wired in by an adapter.
+
+The built-in HMAC module (HMAC over the client IP) ships in
+`trusted-server-core` (`ec::module`), so no crate is needed for it. There is
+no default module, and a deployment selects one explicitly with
+`[ec] module`.
+
+A module's own settings live in the `[ec.<name>]` table the selector names.
+The name is the module's implementation id, the same string its
+`EdgeCookieModule::id` returns, unless the table names one with
+`implementation = "<id>"`, which lets an operator configure a module under a
+name of their own choosing. A module with no settings needs no table.
+
+This directory is a placeholder until a vendor module is added.
diff --git a/crates/trusted-server-adapter-axum/src/app.rs b/crates/trusted-server-adapter-axum/src/app.rs
index caba714d68..7b50568a09 100644
--- a/crates/trusted-server-adapter-axum/src/app.rs
+++ b/crates/trusted-server-adapter-axum/src/app.rs
@@ -18,6 +18,7 @@ use trusted_server_core::ec::EcContext;
 use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported, deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::module::ensure_module_available;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -77,8 +78,9 @@ fn build_state() -> Result<Arc<AppState>, Report<TrustedServerError>> {
 ///
 /// # Errors
 ///
-/// Returns an error when the auction orchestrator or the integration
-/// registry fail to initialise.
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 fn build_state_with_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -89,6 +91,26 @@ fn build_state_with_services(
     settings: Settings,
     services: Option<RuntimeServices>,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    // Composition root: reject a module selection this adapter can never
+    // supply, once, before any request is served. A caller supplying its own
+    // `RuntimeServices` may already have resolved a module, so the check is
+    // given whatever those services carry, which is what `EcContext` sees per
+    // request.
+    //
+    // This adapter checks rather than keeps what the check resolved, unlike the
+    // Fastly, Cloudflare and Spin adapters, because it is a long-lived process
+    // whose application state is built once at start-up while theirs is rebuilt
+    // for every request. With no services supplied it threads no module, so
+    // `EcContext` resolves the selection itself on every request, building a
+    // fresh built-in module that reads no request data; this dev server
+    // accepts that per-request construction rather than caching a resolved
+    // module.
+    ensure_module_available(
+        &settings.ec,
+        services
+            .as_ref()
+            .and_then(RuntimeServices::resolved_ec_module),
+    )?;
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Axum)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -179,13 +201,26 @@ where
 /// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
 /// `/_ts/page-bids`, and the publisher fallback).
 ///
-/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
-/// Unknown, which fails the auction consent gate closed even for consented
-/// users. Geo comes from the platform (a no-op on the local Axum dev server, so
-/// jurisdiction stays Unknown there unless the request carries TCF consent). A
-/// malformed consent string is logged and falls back to the default
-/// (fail-closed) context rather than being silently swallowed.
-fn build_ec_context(state: &AppState, services: &RuntimeServices, req: &Request) -> EcContext {
+/// Geo comes from the platform (a no-op on the local Axum dev server, so
+/// jurisdiction stays Unknown there unless the request carries TCF consent), and
+/// a geo lookup failure is logged and treated as no location.
+///
+/// Mirrors the Fastly entry point, which keeps the report and answers with an
+/// error response: when the Edge Cookie context cannot be read the request
+/// fails rather than continuing with `EcContext::default()`, which would serve
+/// every request with no identity. A malformed cookie value, a bad consent
+/// string and a failed geo lookup do not reach this error path at all, so
+/// failing here does not fail requests for ordinary parse problems.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this request, or when the request's `Cookie` header is not valid UTF-8.
+fn build_ec_context(
+    state: &AppState,
+    services: &RuntimeServices,
+    req: &Request,
+) -> Result<EcContext, Report<TrustedServerError>> {
     let geo_info = services
         .geo()
         .lookup(services.client_info().client_ip)
@@ -194,10 +229,6 @@ fn build_ec_context(state: &AppState, services: &RuntimeServices, req: &Request)
             None
         });
     EcContext::read_from_request_with_geo(&state.settings, req, services, geo_info.as_ref())
-        .unwrap_or_else(|e| {
-            log::warn!("EC context read failed: {e:?}");
-            EcContext::default()
-        })
 }
 
 // ---------------------------------------------------------------------------
@@ -244,7 +275,7 @@ async fn dispatch_fallback(
 
     // Run the server-side auction with the configured creative-opportunity
     // slots; `handle_publisher_request` matches them against the request path.
-    let mut ec_context = build_ec_context(state, services, &req);
+    let mut ec_context = build_ec_context(state, services, &req)?;
     let auction = AuctionDispatch {
         orchestrator: &state.orchestrator,
         slots: state.settings.creative_opportunity_slots(),
@@ -505,7 +536,7 @@ fn named_route_handler(
                         // Build the geo-aware EC context so the auction consent
                         // gate sees the caller's jurisdiction — `EcContext::default()`
                         // fails it closed for consented users.
-                        let mut ec_context = build_ec_context(&state, &services, &req);
+                        let mut ec_context = build_ec_context(&state, &services, &req)?;
                         handle_auction(
                             &state.settings,
                             &state.orchestrator,
@@ -524,7 +555,7 @@ fn named_route_handler(
                         if req.method() == Method::OPTIONS {
                             Ok(page_bids_preflight_denied())
                         } else {
-                            let mut ec_context = build_ec_context(&state, &services, &req);
+                            let mut ec_context = build_ec_context(&state, &services, &req)?;
                             let auction = AuctionDispatch {
                                 orchestrator: &state.orchestrator,
                                 slots: state.settings.creative_opportunity_slots(),
@@ -715,3 +746,81 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
     router.build()
 }
+
+#[cfg(test)]
+mod tests {
+    use edgezero_core::http::request_builder;
+    use edgezero_core::params::PathParams;
+
+    use super::*;
+
+    /// Settings selecting a vendor Edge Cookie module this adapter does not
+    /// inject, with the `[ec.acme]` block that module's settings live in.
+    /// `acme` is a fictional vendor key.
+    const UNINJECTED_MODULE_TOML: &str = r#"
+        [[handlers]]
+        path = "^/_ts/admin"
+        username = "admin"
+        password = "admin-pass"
+
+        [publisher]
+        domain = "test-publisher.example.com"
+        cookie_domain = ".test-publisher.example.com"
+        origin_url = "https://origin.test-publisher.example.com"
+        proxy_secret = "unit-test-proxy-secret"
+
+        [ec]
+        module = "acme"
+
+        [ec.acme]
+        endpoint = "https://ec.acme.example.com"
+    "#;
+
+    /// Builds application state directly, bypassing the composition root's
+    /// startup check, so the per-request behavior can be exercised with a
+    /// selection the adapter cannot supply.
+    fn state_with_uninjected_module() -> AppState {
+        let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+            .expect("should parse settings selecting an uninjected module");
+        let plan = Arc::new(compile_auction_plan(&settings).expect("should compile auction plan"));
+        let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)
+            .expect("should build orchestrator");
+        let registry =
+            IntegrationRegistry::with_plan(&settings, plan).expect("should build registry");
+        AppState {
+            settings: Arc::new(settings),
+            orchestrator: Arc::new(orchestrator),
+            registry: Arc::new(registry),
+            // This test drives the per-request path, which builds its services
+            // from the request context.
+            services: None,
+        }
+    }
+
+    /// The per-request Edge Cookie read must return its error rather than a
+    /// default context.
+    ///
+    /// Continuing with `EcContext::default()` would serve every request with
+    /// no identity when the selected module cannot be built. The call sites
+    /// propagate the error to `http_error`, matching the Fastly adapter.
+    #[test]
+    fn build_ec_context_fails_when_the_selected_module_is_unavailable() {
+        let state = state_with_uninjected_module();
+        let req = request_builder()
+            .method("POST")
+            .uri("https://test-publisher.example.com/auction")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build test request");
+        let ctx = RequestContext::new(req, PathParams::default());
+        let services = build_runtime_services(&ctx);
+        let req = ctx.into_request();
+
+        let error = build_ec_context(&state, &services, &req)
+            .expect_err("an unavailable Edge Cookie module must fail the request");
+
+        assert!(
+            error.to_string().contains("acme"),
+            "the error should name the selected module, got: {error}"
+        );
+    }
+}
diff --git a/crates/trusted-server-adapter-axum/src/middleware.rs b/crates/trusted-server-adapter-axum/src/middleware.rs
index f099bc15b2..7597ca4208 100644
--- a/crates/trusted-server-adapter-axum/src/middleware.rs
+++ b/crates/trusted-server-adapter-axum/src/middleware.rs
@@ -197,6 +197,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-axum/tests/routes.rs b/crates/trusted-server-adapter-axum/tests/routes.rs
index bcb31b7e44..b3eaca5558 100644
--- a/crates/trusted-server-adapter-axum/tests/routes.rs
+++ b/crates/trusted-server-adapter-axum/tests/routes.rs
@@ -33,6 +33,9 @@ fn test_settings() -> trusted_server_core::settings::Settings {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -868,6 +871,57 @@ async fn first_party_proxy_rebuild_is_routed() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// Edge Cookie module availability
+// ---------------------------------------------------------------------------
+
+/// Test settings selecting a vendor Edge Cookie module this adapter does not
+/// inject, with the `[ec.acme]` block that module's settings live in.
+/// `acme` is a fictional vendor key.
+const UNINJECTED_MODULE_TOML: &str = r#"
+    [[handlers]]
+    path = "^/_ts/admin"
+    username = "admin"
+    password = "admin-pass"
+
+    [publisher]
+    domain = "test-publisher.example.com"
+    cookie_domain = ".test-publisher.example.com"
+    origin_url = "https://origin.test-publisher.example.com"
+    proxy_secret = "integration-test-proxy-secret"
+
+    [ec]
+    module = "acme"
+
+    [ec.acme]
+    endpoint = "https://ec.acme.example.com"
+"#;
+
+/// A module selection this adapter can never supply must fail while the
+/// application state is built, before any request is served.
+///
+/// Configuration validation accepts this selection, because only the adapter
+/// that injects a module knows what that module needs, and the Axum dev
+/// server injects no vendor Edge Cookie module, so only the composition root
+/// can catch it. Without the startup check the deployment would come up and
+/// answer every request.
+#[test]
+fn selecting_a_module_this_adapter_cannot_supply_fails_at_startup() {
+    let settings = trusted_server_core::settings::Settings::from_toml(UNINJECTED_MODULE_TOML)
+        .expect("should parse settings selecting an uninjected module");
+
+    // `RouterService` is not `Debug`, so take the error side directly rather
+    // than through `expect_err`.
+    let error = trusted_server_adapter_axum::app::TrustedServerApp::routes_with_settings(settings)
+        .err()
+        .expect("building state with an uninjected module should fail");
+
+    assert!(
+        error.to_string().contains("acme"),
+        "the startup error should name the selected module, got: {error}"
+    );
+}
+
 /// Regression test: a Next.js navigation with a pending auction must buffer to
 /// the structural body close. The Flight payload carries a literal `</body>`, so
 /// a parser-blind seam would inject bids early and split the RSC data.
diff --git a/crates/trusted-server-adapter-cloudflare/src/app.rs b/crates/trusted-server-adapter-cloudflare/src/app.rs
index 87b9567e7f..5c1613597c 100644
--- a/crates/trusted-server-adapter-cloudflare/src/app.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/app.rs
@@ -22,6 +22,7 @@ use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported as core_admin_ec_lookup_not_supported,
     deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::module::{EdgeCookieModule, build_shared_module};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -74,6 +75,17 @@ pub struct AppState {
     settings: Arc<Settings>,
     orchestrator: Arc<AuctionOrchestrator>,
     registry: Arc<IntegrationRegistry>,
+    /// The Edge Cookie module `[ec] module` selects, resolved once here.
+    ///
+    /// This adapter runs a fresh instance per request and resolving reads no
+    /// request data, so the selection is resolved when the state is built
+    /// and handed to every request through
+    /// [`RuntimeServices::resolved_ec_module`](trusted_server_core::platform::RuntimeServices::resolved_ec_module),
+    /// rather than resolved again on the request path.
+    /// `None` for a deployment that selects no module.
+    ec_module: Option<Arc<dyn EdgeCookieModule>>,
+    /// Services a caller supplied for every request, rather than services built
+    /// from the request context. `None` in a deployment.
     services: Option<RuntimeServices>,
 }
 
@@ -191,8 +203,9 @@ fn cloudflare_config_envelope(
 ///
 /// # Errors
 ///
-/// Returns an error when the auction orchestrator or the integration
-/// registry fail to initialise.
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 fn build_state_with_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -203,6 +216,18 @@ fn build_state_with_services(
     settings: Settings,
     services: Option<RuntimeServices>,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    // Composition root: resolve the module selection once, before any request
+    // is served, so a selection this adapter can never supply fails here rather
+    // than on the first request. Keeping what the resolution produced is what
+    // stops the request path resolving the same settings again. This adapter
+    // injects no vendor Edge Cookie module of its own, so the only injected
+    // module is one a caller put into the services it supplied.
+    let ec_module = build_shared_module(
+        &settings.ec,
+        services
+            .as_ref()
+            .and_then(RuntimeServices::resolved_ec_module),
+    )?;
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Cloudflare)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -212,15 +237,20 @@ fn build_state_with_services(
         settings: Arc::new(settings),
         orchestrator: Arc::new(orchestrator),
         registry: Arc::new(registry),
+        ec_module,
         services,
     }))
 }
 
 impl AppState {
+    /// Builds the per-request services, carrying the Edge Cookie module the
+    /// composition root already resolved so the request path does not resolve
+    /// `[ec] module` a second time.
     fn services_for_request(&self, ctx: &RequestContext) -> RuntimeServices {
         self.services
             .clone()
             .unwrap_or_else(|| build_runtime_services(ctx))
+            .with_resolved_ec_module(self.ec_module.clone())
     }
 }
 
@@ -231,12 +261,25 @@ impl AppState {
 /// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
 /// `/_ts/page-bids`, and the publisher fallback).
 ///
-/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
-/// Unknown, which fails the auction consent gate closed even for consented
-/// users. Geo comes from the Workers `cf` object when deployed. A malformed
-/// consent string is logged and falls back to the default (fail-closed) context
-/// rather than being silently swallowed.
-fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Request) -> EcContext {
+/// Geo comes from the Workers `cf` object when deployed, and a geo lookup
+/// failure is logged and treated as no location.
+///
+/// Mirrors the Fastly entry point, which keeps the report and answers with an
+/// error response: when the Edge Cookie context cannot be read the request
+/// fails rather than continuing with `EcContext::default()`, which would serve
+/// every request with no identity. A malformed cookie value, a bad consent
+/// string and a failed geo lookup do not reach this error path at all, so
+/// failing here does not fail requests for ordinary parse problems.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this request, or when the request's `Cookie` header is not valid UTF-8.
+fn build_ec_context(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request,
+) -> Result<EcContext, Report<TrustedServerError>> {
     let geo_info = services
         .geo()
         .lookup(services.client_info().client_ip)
@@ -245,10 +288,6 @@ fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Reque
             None
         });
     EcContext::read_from_request_with_geo(settings, req, services, geo_info.as_ref())
-        .unwrap_or_else(|e| {
-            log::warn!("EC context read failed: {e:?}");
-            EcContext::default()
-        })
 }
 
 // ---------------------------------------------------------------------------
@@ -553,7 +592,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         }))
                     })
             } else {
-                let mut ec_context = build_ec_context(&state.settings, &services, &req);
+                // Identity could not be established (for example the selected
+                // Edge Cookie module is unavailable). Answer with an error
+                // rather than serving the page with no identity.
+                let mut ec_context = match build_ec_context(&state.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 let auction = AuctionDispatch {
                     orchestrator: &state.orchestrator,
                     slots: state.settings.creative_opportunity_slots(),
@@ -658,7 +703,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                     // Build the geo-aware EC context so the auction consent gate
                     // sees the caller's jurisdiction — `EcContext::default()`
                     // fails it closed for consented users.
-                    let mut ec_context = build_ec_context(&s.settings, &services, &req);
+                    let mut ec_context = build_ec_context(&s.settings, &services, &req)?;
                     handle_auction(
                         &s.settings,
                         &s.orchestrator,
@@ -722,7 +767,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
         // preflight fall through to a permissive origin would reopen exactly
         // the cross-site hole the canonical path closes.
         let page_bids = make_handler(Arc::clone(&state), |s, services, req| async move {
-            let mut ec_context = build_ec_context(&s.settings, &services, &req);
+            let mut ec_context = build_ec_context(&s.settings, &services, &req)?;
             let auction = AuctionDispatch {
                 orchestrator: &s.orchestrator,
                 slots: s.settings.creative_opportunity_slots(),
@@ -775,8 +820,67 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
 #[cfg(test)]
 mod tests {
+    use edgezero_core::http::request_builder;
+    use edgezero_core::params::PathParams;
+
     use super::*;
 
+    /// Settings selecting a vendor Edge Cookie module this adapter does not
+    /// inject, with the `[ec.acme]` block that module's settings live in.
+    /// `acme` is a fictional vendor key.
+    const UNINJECTED_MODULE_TOML: &str = r#"
+        [[handlers]]
+        path = "^/_ts/admin"
+        username = "admin"
+        password = "admin-pass"
+
+        [publisher]
+        domain = "test-publisher.example.com"
+        cookie_domain = ".test-publisher.example.com"
+        origin_url = "https://origin.test-publisher.example.com"
+        proxy_secret = "unit-test-proxy-secret"
+
+        [ec]
+        module = "acme"
+
+        [ec.acme]
+        endpoint = "https://ec.acme.example.com"
+    "#;
+
+    /// The per-request Edge Cookie read must return its error rather than a
+    /// default context.
+    ///
+    /// Continuing with `EcContext::default()` would serve every request with
+    /// no identity when the selected module cannot be built. The call sites
+    /// propagate the error to `http_error`, matching the Fastly adapter. The
+    /// settings are parsed directly, bypassing the composition root's startup
+    /// check, so the per-request behavior can be exercised with a selection
+    /// the adapter cannot supply.
+    #[test]
+    fn build_ec_context_fails_when_the_selected_module_is_unavailable() {
+        let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+            .expect("should parse settings selecting an uninjected module");
+        let req = request_builder()
+            .method("POST")
+            .uri("https://test-publisher.example.com/auction")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build test request");
+        let ctx = RequestContext::new(req, PathParams::default());
+        // No resolved module is threaded here, so the request path resolves
+        // the selection itself, which is what an embedder driving core
+        // directly does and where the loud failure has to stay.
+        let services = build_runtime_services(&ctx);
+        let req = ctx.into_request();
+
+        let error = build_ec_context(&settings, &services, &req)
+            .expect_err("an unavailable Edge Cookie module must fail the request");
+
+        assert!(
+            error.to_string().contains("acme"),
+            "the error should name the selected module, got: {error}"
+        );
+    }
+
     fn aps_profile_settings() -> Settings {
         let mut settings = Settings::from_toml(
             r#"
diff --git a/crates/trusted-server-adapter-cloudflare/src/middleware.rs b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
index a22b51982e..df99052afa 100644
--- a/crates/trusted-server-adapter-cloudflare/src/middleware.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
@@ -211,6 +211,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-cloudflare/tests/routes.rs b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
index f385bf5295..422ed654e5 100644
--- a/crates/trusted-server-adapter-cloudflare/tests/routes.rs
+++ b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
@@ -36,6 +36,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -85,6 +88,9 @@ fn make_router() -> RouterService {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -676,6 +682,57 @@ async fn tsjs_route_prefix_is_handled_not_5xx() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// Edge Cookie module availability
+// ---------------------------------------------------------------------------
+
+/// Test settings selecting a vendor Edge Cookie module this adapter does not
+/// inject, with the `[ec.acme]` block that module's settings live in.
+/// `acme` is a fictional vendor key.
+const UNINJECTED_MODULE_TOML: &str = r#"
+    [[handlers]]
+    path = "^/_ts/admin"
+    username = "admin"
+    password = "admin-pass"
+
+    [publisher]
+    domain = "test-publisher.example.com"
+    cookie_domain = ".test-publisher.example.com"
+    origin_url = "https://origin.test-publisher.example.com"
+    proxy_secret = "route-test-proxy-secret"
+
+    [ec]
+    module = "acme"
+
+    [ec.acme]
+    endpoint = "https://ec.acme.example.com"
+"#;
+
+/// A module selection this adapter can never supply must fail while the
+/// application state is built, before any request is served.
+///
+/// Configuration validation accepts this selection, because only the adapter
+/// that injects a module knows what that module needs, and this adapter
+/// injects no vendor Edge Cookie module, so only the composition root can
+/// catch it. Without the startup check the deployment would come up and answer
+/// every request.
+#[test]
+fn selecting_a_module_this_adapter_cannot_supply_fails_at_startup() {
+    let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+        .expect("should parse settings selecting an uninjected module");
+
+    // `RouterService` is not `Debug`, so take the error side directly rather
+    // than through `expect_err`.
+    let error = TrustedServerApp::routes_with_settings(settings)
+        .err()
+        .expect("building state with an uninjected module should fail");
+
+    assert!(
+        error.to_string().contains("acme"),
+        "the startup error should name the selected module, got: {error}"
+    );
+}
+
 /// Regression test: a Next.js navigation with a pending auction must buffer to
 /// the structural body close. The Flight payload carries a literal `</body>`, so
 /// a parser-blind seam would inject bids early and split the RSC data.
diff --git a/crates/trusted-server-adapter-fastly/src/app.rs b/crates/trusted-server-adapter-fastly/src/app.rs
index 1d58c229e4..69f5083089 100644
--- a/crates/trusted-server-adapter-fastly/src/app.rs
+++ b/crates/trusted-server-adapter-fastly/src/app.rs
@@ -114,6 +114,8 @@ use trusted_server_core::ec::consent::ec_consent_withdrawn;
 use trusted_server_core::ec::device::DeviceSignals;
 use trusted_server_core::ec::identify::{cors_preflight_identify, handle_identify};
 use trusted_server_core::ec::kv::KvIdentityGraph;
+use trusted_server_core::ec::module::request_module;
+use trusted_server_core::ec::module::{EdgeCookieModule, build_shared_module};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::ec::{EcContext, EidSyncSource};
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
@@ -189,6 +191,15 @@ pub(crate) struct AppState {
     pub(crate) registry: Arc<IntegrationRegistry>,
     pub(crate) default_kv_store: Arc<dyn PlatformKvStore>,
     pub(crate) auction_telemetry_sink: Arc<dyn AuctionTelemetrySink>,
+    /// The Edge Cookie module `[ec] module` selects, resolved once here.
+    ///
+    /// This adapter runs a fresh instance per request and resolving reads no
+    /// request data, so the selection is resolved when the state is built
+    /// and handed to every request through
+    /// [`RuntimeServices::resolved_ec_module`](trusted_server_core::platform::RuntimeServices::resolved_ec_module),
+    /// rather than resolved again on the request path.
+    /// `None` for a deployment that selects no module.
+    pub(crate) ec_module: Option<Arc<dyn EdgeCookieModule>>,
 }
 
 /// Build the application state, loading settings and constructing all per-application components.
@@ -215,11 +226,26 @@ pub(crate) fn load_settings_from_config_store(
     )
 }
 
+/// Build the application state from explicit settings.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 pub(crate) fn build_state_from_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
     warn_if_certificate_check_disabled(&settings);
 
+    // Composition root: resolve the module selection once, before any request
+    // is served, so a selection this adapter can never supply fails here rather
+    // than on the first request. Keeping what the resolution produced is what
+    // stops the request path resolving the same settings again. This adapter
+    // injects no vendor Edge Cookie module, so `None` is the injected
+    // argument, and one is passed here once this adapter supplies it.
+    let ec_module = build_shared_module(&settings.ec, None)?;
+
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Fastly)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -234,6 +260,7 @@ pub(crate) fn build_state_from_settings(
         registry: Arc::new(registry),
         default_kv_store,
         auction_telemetry_sink,
+        ec_module,
     }))
 }
 
@@ -271,7 +298,7 @@ fn build_per_request_services(state: &AppState, ctx: &RequestContext) -> Runtime
             ..ClientInfo::default()
         });
 
-    RuntimeServices::builder()
+    let builder = RuntimeServices::builder()
         .config_store(Arc::new(FastlyPlatformConfigStore))
         .secret_store(Arc::new(FastlyPlatformSecretStore))
         .kv_store(Arc::clone(&state.default_kv_store))
@@ -284,8 +311,16 @@ fn build_per_request_services(state: &AppState, ctx: &RequestContext) -> Runtime
         .http_client(Arc::new(FastlyPlatformHttpClient))
         .geo(Arc::new(FastlyPlatformGeo))
         .auction_telemetry_sink(Arc::clone(&state.auction_telemetry_sink))
-        .client_info(client_info)
-        .build()
+        .client_info(client_info);
+
+    // Hand every request the module resolved at the composition root, so the
+    // request path reuses that instance instead of resolving `[ec] module`
+    // again. Nothing is set for a deployment that selects no module, which
+    // resolves to nothing either way.
+    match state.ec_module.clone() {
+        Some(module) => builder.resolved_ec_module(module).build(),
+        None => builder.build(),
+    }
 }
 
 fn publisher_fallback_methods() -> [Method; 7] {
@@ -583,7 +618,12 @@ async fn execute_named(
                     // copy is bot-gated, while operators use curl for this
                     // authenticated diagnostic.
                     let kv = crate::maybe_identity_graph(&state.settings);
-                    handle_admin_ec_lookup(kv.as_ref(), &registry, &req)
+                    // The selected module decides which identifiers this
+                    // deployment recognizes, so build it here rather than
+                    // assuming the built-in HMAC shape. The read-only
+                    // diagnostic builds no EC request state to borrow it from.
+                    let module = request_module(&state.settings.ec, &services)?;
+                    handle_admin_ec_lookup(kv.as_ref(), &registry, module.as_deref(), &req)
                 }
                 NamedRouteHandler::AdminEidsLookup => handle_admin_eids_lookup(&registry, &req),
                 _ => unreachable!("admin diagnostics should use early dispatch"),
@@ -743,7 +783,11 @@ fn run_batch_sync(state: &AppState, services: &RuntimeServices, req: Request) ->
     let result = crate::require_identity_graph(&state.settings).and_then(|kv| {
         let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
         let limiter = FastlyRateLimiter::new(RATE_COUNTER_NAME);
-        handle_batch_sync(&kv, &partner_registry, &limiter, req)
+        // A partner echoes back an identifier the deployment's own module
+        // created, so validation and KV normalization are dispatched through
+        // that module rather than the built-in HMAC grammar.
+        let module = request_module(&state.settings.ec, services)?;
+        handle_batch_sync(&kv, &partner_registry, &limiter, module.as_deref(), req)
     });
 
     let mut response = result.unwrap_or_else(|e| http_error(&e));
@@ -853,7 +897,7 @@ async fn dispatch_fallback(
                 .ec_context
                 .generate_if_needed(&state.settings, ec.kv_graph.as_ref())
         {
-            log::warn!("EC generation failed for publisher proxy: {err:?}");
+            log::error!("EC generation failed for publisher proxy: {err:?}");
         }
 
         // Run the server-side auction with the configured creative-
@@ -1501,6 +1545,9 @@ mod tests {
             allowed_domains = ["*.example", "*.example.com"]
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -1576,6 +1623,10 @@ mod tests {
         let registry = IntegrationRegistry::from_request_filters(filters);
         let default_kv_store =
             Arc::new(crate::platform::UnavailableKvStore) as Arc<dyn super::PlatformKvStore>;
+        // Resolved the same way the composition root resolves it, so this
+        // router behaves like a served one.
+        let ec_module = trusted_server_core::ec::module::build_shared_module(&settings.ec, None)
+            .expect("should resolve the Edge Cookie module selection");
         let state = Arc::new(super::AppState {
             auction_telemetry_sink: Arc::new(
                 trusted_server_core::auction::NoopAuctionTelemetrySink,
@@ -1584,6 +1635,7 @@ mod tests {
             orchestrator: Arc::new(orchestrator),
             registry: Arc::new(registry),
             default_kv_store,
+            ec_module,
         });
         TrustedServerApp::routes_for_state(&state)
     }
@@ -2002,6 +2054,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -2676,6 +2731,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -3103,6 +3161,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index b8f814a01c..5832c33cb3 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -866,6 +866,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-fastly/src/middleware.rs b/crates/trusted-server-adapter-fastly/src/middleware.rs
index 9bbc25d7ba..0924f083a8 100644
--- a/crates/trusted-server-adapter-fastly/src/middleware.rs
+++ b/crates/trusted-server-adapter-fastly/src/middleware.rs
@@ -343,6 +343,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-spin/src/app.rs b/crates/trusted-server-adapter-spin/src/app.rs
index 804a23b620..d5cc7a881e 100644
--- a/crates/trusted-server-adapter-spin/src/app.rs
+++ b/crates/trusted-server-adapter-spin/src/app.rs
@@ -24,6 +24,7 @@ use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported as core_admin_ec_lookup_not_supported,
     deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::module::{EdgeCookieModule, build_shared_module};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::http_util::sanitize_forwarded_headers;
@@ -67,15 +68,31 @@ pub struct AppState {
     settings: Arc<Settings>,
     orchestrator: Arc<AuctionOrchestrator>,
     registry: Arc<IntegrationRegistry>,
+    /// The Edge Cookie module `[ec] module` selects, resolved once here.
+    ///
+    /// This adapter runs a fresh instance per request and resolving reads no
+    /// request data, so the selection is resolved when the state is built
+    /// and handed to every request through
+    /// [`RuntimeServices::resolved_ec_module`](trusted_server_core::platform::RuntimeServices::resolved_ec_module),
+    /// rather than resolved again on the request path.
+    /// `None` for a deployment that selects no module.
+    ec_module: Option<Arc<dyn EdgeCookieModule>>,
+    /// Services a caller supplied for every request, rather than services built
+    /// from the request context. `None` in a deployment.
     services: Option<RuntimeServices>,
 }
 
 /// Build the application state, loading settings and constructing all per-application components.
 ///
+/// Settings are read from the platform config store at run time, the same way
+/// the Fastly and Axum adapters read them, so an operator publishes one with
+/// `ts config push` and the deployed component picks it up.
+///
 /// # Errors
 ///
-/// Returns an error when settings, the auction orchestrator, or the integration
-/// registry fail to initialise.
+/// Returns an error when the config store holds no readable app config, or when
+/// settings, the auction orchestrator, or the integration registry fail to
+/// initialize.
 fn build_state() -> Result<Arc<AppState>, Report<TrustedServerError>> {
     let settings = load_startup_settings()?;
     build_state_with_settings(settings)
@@ -119,8 +136,9 @@ fn load_startup_settings() -> Result<Settings, Report<TrustedServerError>> {
 ///
 /// # Errors
 ///
-/// Returns an error when the auction orchestrator or the integration
-/// registry fail to initialise.
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 fn build_state_with_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -131,6 +149,18 @@ fn build_state_with_services(
     settings: Settings,
     services: Option<RuntimeServices>,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    // Composition root: resolve the module selection once, before any request
+    // is served, so a selection this adapter can never supply fails here rather
+    // than on the first request. Keeping what the resolution produced is what
+    // stops the request path resolving the same settings again. This adapter
+    // injects no vendor Edge Cookie module of its own, so the only injected
+    // module is one a caller put into the services it supplied.
+    let ec_module = build_shared_module(
+        &settings.ec,
+        services
+            .as_ref()
+            .and_then(RuntimeServices::resolved_ec_module),
+    )?;
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Spin)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -140,15 +170,20 @@ fn build_state_with_services(
         settings: Arc::new(settings),
         orchestrator: Arc::new(orchestrator),
         registry: Arc::new(registry),
+        ec_module,
         services,
     }))
 }
 
 impl AppState {
+    /// Builds the per-request services, carrying the Edge Cookie module the
+    /// composition root already resolved so the request path does not resolve
+    /// `[ec] module` a second time.
     fn services_for_request(&self, ctx: &RequestContext) -> RuntimeServices {
         self.services
             .clone()
             .unwrap_or_else(|| build_runtime_services(ctx))
+            .with_resolved_ec_module(self.ec_module.clone())
     }
 }
 
@@ -409,13 +444,26 @@ fn health_response() -> Response {
 /// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
 /// `/_ts/page-bids`, and the publisher fallback).
 ///
-/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
-/// Unknown, which fails the auction consent gate closed even for consented
-/// users. Spin's platform geo is a no-op, so jurisdiction stays Unknown unless
-/// the request carries TCF consent. A malformed consent string is logged and
-/// falls back to the default (fail-closed) context rather than being silently
-/// swallowed.
-fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Request) -> EcContext {
+/// Spin's platform geo is a no-op, so jurisdiction stays Unknown unless the
+/// request carries TCF consent, and a geo lookup failure is logged and treated
+/// as no location.
+///
+/// Mirrors the Fastly entry point, which keeps the report and answers with an
+/// error response: when the Edge Cookie context cannot be read the request
+/// fails rather than continuing with `EcContext::default()`, which would serve
+/// every request with no identity. A malformed cookie value, a bad consent
+/// string and a failed geo lookup do not reach this error path at all, so
+/// failing here does not fail requests for ordinary parse problems.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this request, or when the request's `Cookie` header is not valid UTF-8.
+fn build_ec_context(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request,
+) -> Result<EcContext, Report<TrustedServerError>> {
     let geo_info = services
         .geo()
         .lookup(services.client_info().client_ip)
@@ -424,10 +472,6 @@ fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Reque
             None
         });
     EcContext::read_from_request_with_geo(settings, req, services, geo_info.as_ref())
-        .unwrap_or_else(|e| {
-            log::warn!("EC context read failed: {e:?}");
-            EcContext::default()
-        })
 }
 
 fn cache_purge_not_supported() -> Response {
@@ -680,8 +724,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                 }
                 // Build the geo-aware EC context so the auction consent gate sees
                 // the caller's jurisdiction — `EcContext::default()` fails it
-                // closed for consented users.
-                let mut ec_context = build_ec_context(&s.settings, &services, &req);
+                // closed for consented users. When identity cannot be
+                // established at all, answer with an error rather than running
+                // the auction with no identity.
+                let mut ec_context = match build_ec_context(&s.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 Ok(handle_auction(
                     &s.settings,
                     &s.orchestrator,
@@ -711,7 +760,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                 {
                     return Ok(http_error(&error));
                 }
-                let mut ec_context = build_ec_context(&s.settings, &services, &req);
+                // Identity could not be established (for example the selected
+                // Edge Cookie module is unavailable). Answer with an error
+                // rather than re-running the auction with no identity.
+                let mut ec_context = match build_ec_context(&s.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 let auction = AuctionDispatch {
                     orchestrator: &s.orchestrator,
                     slots: s.settings.creative_opportunity_slots(),
@@ -834,7 +889,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         }))
                     })
             } else {
-                let mut ec_context = build_ec_context(&state.settings, &services, &req);
+                // Identity could not be established (for example the selected
+                // Edge Cookie module is unavailable). Answer with an error
+                // rather than serving the page with no identity.
+                let mut ec_context = match build_ec_context(&state.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 let auction = AuctionDispatch {
                     orchestrator: &state.orchestrator,
                     slots: state.settings.creative_opportunity_slots(),
@@ -975,6 +1036,9 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
 #[cfg(test)]
 mod tests {
+    use edgezero_core::http::request_builder;
+    use edgezero_core::params::PathParams;
+
     use super::*;
 
     fn multi_provider_settings() -> Settings {
@@ -1071,6 +1135,85 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_state_takes_its_settings_from_the_platform_config_store() {
+        // Every other test enters through the `routes_with_settings` parity
+        // seam, so this is the one that calls `build_state` itself. There is
+        // no Spin runtime under `cargo test`, so there are no component
+        // variables to read and this cannot return `Ok` here. Its settings
+        // come from the config store alone, so the failure has to be the
+        // absence of a config store, and never a configuration compiled into
+        // the binary, such as a template's placeholder password.
+        let Err(error) = build_state() else {
+            return;
+        };
+        let message = format!("{error:?}");
+        assert!(
+            message.contains("config store"),
+            "build_state should fail only for want of a config store, got: {message}"
+        );
+        assert!(
+            !message.to_lowercase().contains("password"),
+            "build_state must not fail on a configuration compiled into the binary, got: {message}"
+        );
+    }
+
+    /// Settings selecting a vendor Edge Cookie module this adapter does not
+    /// inject, with the `[ec.acme]` block that module's settings live in.
+    /// `acme` is a fictional vendor key.
+    const UNINJECTED_MODULE_TOML: &str = r#"
+        [[handlers]]
+        path = "^/_ts/admin"
+        username = "admin"
+        password = "admin-pass"
+
+        [publisher]
+        domain = "test-publisher.example.com"
+        cookie_domain = ".test-publisher.example.com"
+        origin_url = "https://origin.test-publisher.example.com"
+        proxy_secret = "unit-test-proxy-secret"
+
+        [ec]
+        module = "acme"
+
+        [ec.acme]
+        endpoint = "https://ec.acme.example.com"
+    "#;
+
+    /// The per-request Edge Cookie read must return its error rather than a
+    /// default context.
+    ///
+    /// Continuing with `EcContext::default()` would serve every request with
+    /// no identity when the selected module cannot be built. The call sites
+    /// propagate the error to `http_error`, matching the Fastly adapter. The
+    /// settings are parsed directly, bypassing the composition root's startup
+    /// check, so the per-request behavior can be exercised with a selection
+    /// the adapter cannot supply.
+    #[test]
+    fn build_ec_context_fails_when_the_selected_module_is_unavailable() {
+        let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+            .expect("should parse settings selecting an uninjected module");
+        let req = request_builder()
+            .method("POST")
+            .uri("https://test-publisher.example.com/auction")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build test request");
+        let ctx = RequestContext::new(req, PathParams::default());
+        // No resolved module is threaded here, so the request path resolves
+        // the selection itself, which is what an embedder driving core
+        // directly does and where the loud failure has to stay.
+        let services = build_runtime_services(&ctx);
+        let req = ctx.into_request();
+
+        let error = build_ec_context(&settings, &services, &req)
+            .expect_err("an unavailable Edge Cookie module must fail the request");
+
+        assert!(
+            error.to_string().contains("acme"),
+            "the error should name the selected module, got: {error}"
+        );
+    }
+
     #[test]
     fn scheme_host_from_spin_url_extracts_localhost_with_port() {
         assert_eq!(
diff --git a/crates/trusted-server-adapter-spin/src/middleware.rs b/crates/trusted-server-adapter-spin/src/middleware.rs
index fc1b939bd5..fd57a42a4f 100644
--- a/crates/trusted-server-adapter-spin/src/middleware.rs
+++ b/crates/trusted-server-adapter-spin/src/middleware.rs
@@ -238,6 +238,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-spin/tests/routes.rs b/crates/trusted-server-adapter-spin/tests/routes.rs
index 613832b059..ab33bc16b0 100644
--- a/crates/trusted-server-adapter-spin/tests/routes.rs
+++ b/crates/trusted-server-adapter-spin/tests/routes.rs
@@ -35,6 +35,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -974,6 +977,57 @@ async fn admin_deactivate_key_auth_fail_returns_401() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// Edge Cookie module availability
+// ---------------------------------------------------------------------------
+
+/// Test settings selecting a vendor Edge Cookie module this adapter does not
+/// inject, with the `[ec.acme]` block that module's settings live in.
+/// `acme` is a fictional vendor key.
+const UNINJECTED_MODULE_TOML: &str = r#"
+    [[handlers]]
+    path = "^/_ts/admin"
+    username = "admin"
+    password = "admin-pass"
+
+    [publisher]
+    domain = "test-publisher.example.com"
+    cookie_domain = ".test-publisher.example.com"
+    origin_url = "https://origin.test-publisher.example.com"
+    proxy_secret = "route-test-proxy-secret"
+
+    [ec]
+    module = "acme"
+
+    [ec.acme]
+    endpoint = "https://ec.acme.example.com"
+"#;
+
+/// A module selection this adapter can never supply must fail while the
+/// application state is built, before any request is served.
+///
+/// Configuration validation accepts this selection, because only the adapter
+/// that injects a module knows what that module needs, and this adapter
+/// injects no vendor Edge Cookie module, so only the composition root can
+/// catch it. Without the startup check the deployment would come up and answer
+/// every request.
+#[test]
+fn selecting_a_module_this_adapter_cannot_supply_fails_at_startup() {
+    let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+        .expect("should parse settings selecting an uninjected module");
+
+    // `RouterService` is not `Debug`, so take the error side directly rather
+    // than through `expect_err`.
+    let error = TrustedServerApp::routes_with_settings(settings)
+        .err()
+        .expect("building state with an uninjected module should fail");
+
+    assert!(
+        error.to_string().contains("acme"),
+        "the startup error should name the selected module, got: {error}"
+    );
+}
+
 /// Regression test: a Next.js navigation with a pending auction must buffer to
 /// the structural body close. The Flight payload carries a literal `</body>`, so
 /// a parser-blind seam would inject bids early and split the RSC data.
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index f364464561..134411a912 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -309,8 +309,13 @@ pub async fn handle_auction(
     // EC and both KV and partner stores are available. Gate the read on a
     // present registry: without one, `resolve_auction_eids` yields no
     // server-side EIDs, so the snapshot would be an unused billable KV read.
+    // The row is read under the owning module's canonical form of the
+    // identifier, the key it is stored under, rather than under the identifier
+    // as issued.
     let auction_kv_snapshot = match (kv, ec_id.as_deref(), registry) {
-        (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
+        (Some(graph), Some(_), Some(_)) => ec_context
+            .ec_kv_key()
+            .map_or(EcKvSnapshot::NotRead, |kv_key| graph.load_snapshot(&kv_key)),
         _ => EcKvSnapshot::NotRead,
     };
     // Hand the loaded row to the request context so response finalization —
@@ -457,7 +462,13 @@ pub(crate) fn resolve_auction_eids(
 
     let ec_id = ec_context.ec_value()?;
 
-    let Some(entry) = snapshot.entry_for(ec_id) else {
+    // Callers read the snapshot under the identity-graph key, the owning
+    // module's canonical form of the identifier, so the entry is looked up
+    // under that key rather than under the identifier as issued.
+    let Some(entry) = ec_context
+        .kv_key_for(ec_id)
+        .and_then(|kv_key| snapshot.entry_for(&kv_key))
+    else {
         return Some(Vec::new());
     };
 
@@ -630,6 +641,7 @@ mod tests {
     use crate::auction::types::{AuctionRequest, AuctionResponse};
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::ConsentContext;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule};
     use crate::error::IntoHttpResponse as _;
     use crate::openrtb::Uid;
     use crate::platform::test_support::{
@@ -803,6 +815,85 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn auction_endpoint_loads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning module's
+        // canonical form of the identifier. Loaded and resolved under the
+        // identifier as issued, a module whose canonical form differs from
+        // the cookie value found no row, so the auction carried no server-side
+        // EIDs and the context kept a snapshot bound to the wrong key.
+        let settings = create_test_settings();
+        let had_eids = Arc::new(std::sync::Mutex::new(None));
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::clone(&had_eids),
+        }));
+        let registry = PartnerRegistry::from_config(&[counting_test_partner("ssp.example.com")])
+            .expect("should build partner registry");
+        let graph = KvIdentityGraph::in_memory("canonical-auction-store");
+        graph
+            .create(
+                CANONICAL_KV_KEY,
+                &crate::ec::kv_types::KvEntry::minimal(
+                    "ssp.example.com",
+                    "partner-uid-123",
+                    1_741_824_000,
+                ),
+            )
+            .expect("should seed the row under the canonical key");
+        let mut ec_context =
+            make_ec_context(Jurisdiction::NonRegulated, Some(CANONICAL_COOKIE_VALUE))
+                .with_module_for_test(Arc::new(CanonicalizingModule));
+        let req = Request::builder()
+            .method("POST")
+            .uri("https://test-publisher.com/auction")
+            .body(EdgeBody::from(
+                serde_json::to_vec(&json!({
+                    "adUnits": [
+                        {
+                            "code": "div-gpt-ad-1",
+                            "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+                        }
+                    ]
+                }))
+                .expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        // The capturing provider records whether the request carried EIDs and
+        // then fails its launch, which is all this test needs. The request
+        // carries no client EIDs, so any EID it records came from the graph.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        assert!(
+            ec_context
+                .kv_snapshot()
+                .entry_for(CANONICAL_KV_KEY)
+                .is_some(),
+            "the endpoint should load the row stored under the canonical key"
+        );
+        assert_eq!(
+            *had_eids.lock().expect("should lock captured eids"),
+            Some(true),
+            "the auction should carry the canonical row's partner ID as an EID"
+        );
+    }
+
     #[tokio::test]
     async fn auction_body_eids_reach_kv_even_when_the_ts_eids_cookie_is_absent() {
         // Regression test for #1184: `/auction` sends every EID it has in the
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index e48f5c2f03..7137bca9f6 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -11,8 +11,9 @@ use std::borrow::Cow;
 use edgezero_core::app_config::{SecretField, SecretKind, SecretPathSegment};
 use error_stack::Report;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
-use validator::{Validate, ValidationError, ValidationErrors};
+use validator::{Validate, ValidationError, ValidationErrors, ValidationErrorsKind};
 
+use crate::ec::module::HMAC_MODULE_KEY;
 use crate::ec::registry::PartnerRegistry;
 use crate::error::TrustedServerError;
 use crate::integrations::{
@@ -32,7 +33,9 @@ use crate::integrations::{
     sourcepoint::SourcepointConfig,
     testlight::TestlightConfig,
 };
-use crate::settings::{AssetOriginAuth, IntegrationConfig, Settings};
+use crate::settings::{
+    AssetOriginAuth, Ec, IntegrationConfig, MODULE_IMPLEMENTATION_KEY, Settings,
+};
 
 const DEPLOY_VALIDATION_FIELD: &str = "trusted_server";
 #[cfg(test)]
@@ -119,6 +122,7 @@ impl<'de> Deserialize<'de> for TrustedServerAppConfig {
 impl Validate for TrustedServerAppConfig {
     fn validate(&self) -> Result<(), ValidationErrors> {
         let mut errors = self.settings.validate().err().unwrap_or_default();
+        remove_labeled_module_secret_errors(&mut errors, &self.settings.ec);
         if let Err(report) = validate_settings_for_deploy(&self.settings) {
             errors.add(
                 DEPLOY_VALIDATION_FIELD,
@@ -133,6 +137,90 @@ impl Validate for TrustedServerAppConfig {
     }
 }
 
+/// Removes the passphrase checks on Edge Cookie module blocks written under
+/// a label.
+///
+/// Push-time validation reads a configuration whose secret fields hold
+/// secret-store key names rather than the secrets themselves, so a value check
+/// such as the 32-byte passphrase minimum would be judging a key name.
+/// `EdgeZero`'s `validate_excluding_secrets` removes those checks for the
+/// leaves [`secret_fields`](edgezero_core::app_config::AppConfigMeta::secret_fields)
+/// lists, which covers the `[ec.hmac]` block. A block under a label of the
+/// operator's choosing has no fixed path that list can hold, so its check is
+/// removed here instead. The check itself is unchanged, and runs wherever
+/// settings are loaded with their secrets resolved.
+fn remove_labeled_module_secret_errors(errors: &mut ValidationErrors, ec: &Ec) {
+    let Some(ValidationErrorsKind::Struct(ec_errors)) = errors.errors_mut().get_mut("ec") else {
+        return;
+    };
+    for (name, _) in ec
+        .module_blocks
+        .hmac_blocks()
+        .filter(|(name, _)| *name != HMAC_MODULE_KEY)
+    {
+        let Some(ValidationErrorsKind::Struct(block_errors)) = ec_errors.errors_mut().get_mut(name)
+        else {
+            continue;
+        };
+        block_errors.errors_mut().remove("passphrase");
+        if block_errors.errors().is_empty() {
+            ec_errors.errors_mut().remove(name);
+        }
+    }
+    // An `ec` entry holding nothing would keep the whole result an error, the
+    // same reason `EdgeZero` prunes emptied containers after its own removals.
+    let ec_is_empty = ec_errors.errors().is_empty();
+    if ec_is_empty {
+        errors.errors_mut().remove("ec");
+    }
+}
+
+impl crate::secret_resolution::ConfiguredSecretFields for TrustedServerAppConfig {
+    /// The passphrase of every Edge Cookie module block that configures the
+    /// built-in HMAC module under a label.
+    ///
+    /// [`secret_fields`](edgezero_core::app_config::AppConfigMeta::secret_fields)
+    /// lists the passphrase of the `[ec.hmac]` block, the one path this
+    /// module's block has when its name is its implementation. The same
+    /// module under a label of the operator's choosing holds that secret at
+    /// `ec.<label>.passphrase`, which is only knowable from the configuration
+    /// itself.
+    fn configured_secret_fields(data: &serde_json::Value) -> Vec<SecretField> {
+        labeled_hmac_block_names(data)
+            .map(|name| SecretField {
+                kind: SecretKind::KeyInDefault,
+                optional: true,
+                path: vec![
+                    SecretPathSegment::Field(Cow::Borrowed("ec")),
+                    SecretPathSegment::Field(Cow::Owned(name)),
+                    SecretPathSegment::Field(Cow::Borrowed("passphrase")),
+                ],
+            })
+            .collect()
+    }
+}
+
+/// The names of the `[ec.<name>]` blocks in a serialized configuration that
+/// configure the built-in HMAC module under a label.
+///
+/// A block named `hmac` is the fixed path `secret_fields` already lists, and a
+/// block naming any other implementation holds that implementation's settings,
+/// which core does not read.
+fn labeled_hmac_block_names(data: &serde_json::Value) -> impl Iterator<Item = String> + '_ {
+    data.get("ec")
+        .and_then(serde_json::Value::as_object)
+        .into_iter()
+        .flatten()
+        .filter(|(name, block)| {
+            name.as_str() != HMAC_MODULE_KEY
+                && block
+                    .get(MODULE_IMPLEMENTATION_KEY)
+                    .and_then(serde_json::Value::as_str)
+                    == Some(HMAC_MODULE_KEY)
+        })
+        .map(|(name, _)| name.clone())
+}
+
 impl edgezero_core::app_config::AppConfigMeta for TrustedServerAppConfig {
     fn secret_fields() -> Vec<SecretField> {
         let field = |path: Vec<SecretPathSegment>, optional| SecretField {
@@ -146,7 +234,16 @@ impl edgezero_core::app_config::AppConfigMeta for TrustedServerAppConfig {
 
         vec![
             field(vec![object("publisher"), object("proxy_secret")], false),
-            field(vec![object("ec"), object("passphrase")], false),
+            field(vec![object("ec"), object("passphrase")], true),
+            // The `[ec.hmac]` block, the built-in HMAC module configured
+            // under its own name, is the one module block with a fixed path.
+            // The same module under a label of the operator's choosing is
+            // reached by `ConfiguredSecretFields`, which reads the names out of
+            // the configuration.
+            field(
+                vec![object("ec"), optional_object("hmac"), object("passphrase")],
+                true,
+            ),
             field(
                 vec![
                     object("ec"),
@@ -392,7 +489,12 @@ fn validate_secret_key_references(settings: &Settings) -> Result<(), Report<Trus
         "publisher.proxy_secret",
         settings.publisher.proxy_secret.expose(),
     )?;
-    validate_secret_key_reference("ec.passphrase", settings.ec.passphrase.expose())?;
+    if let Some(passphrase) = &settings.ec.passphrase {
+        validate_secret_key_reference("ec.passphrase", passphrase.expose())?;
+    }
+    for (name, hmac) in settings.ec.module_blocks.hmac_blocks() {
+        validate_secret_key_reference(&format!("ec.{name}.passphrase"), hmac.passphrase.expose())?;
+    }
 
     for (index, partner) in settings.ec.partners.iter().enumerate() {
         if let Some(token) = &partner.api_token {
@@ -520,7 +622,9 @@ mod tests {
     use crate::auction_config_types::{NotificationConfig, ProviderConfig, RoutingMode};
     use crate::redacted::Redacted;
     use crate::settings::{ProxyAssetRoute, S3SigV4AuthConfig, TrustedClientIpConfig};
-    use crate::test_support::tests::crate_test_settings_str;
+    use crate::test_support::tests::{
+        crate_test_settings_str, crate_test_settings_str_with_ec_section, select_hmac_module,
+    };
     use edgezero_core::app_config::AppConfigMeta;
     use edgezero_core::blob_envelope::BlobEnvelope;
 
@@ -875,7 +979,7 @@ formats = [{ width = 300, height = 250 }]
     fn push_validation_accepts_secret_key_names() {
         let mut settings = valid_settings();
         settings.publisher.proxy_secret = Redacted::new("publisher_proxy".to_owned());
-        settings.ec.passphrase = Redacted::new("ec_key".to_owned());
+        select_hmac_module(&mut settings.ec, HMAC_MODULE_KEY, "ec_key");
         settings.handlers[0].password = Redacted::new("handler_password".to_owned());
         settings.handlers[1].password = Redacted::new("admin_password".to_owned());
         let app_config = TrustedServerAppConfig::new(settings)
@@ -887,6 +991,117 @@ formats = [{ width = 300, height = 250 }]
         assert!(!serialized.contains("unit-test-proxy-secret"));
     }
 
+    /// The crate test configuration selecting the built-in HMAC module
+    /// under the label `primary`, with `passphrase` as the block's passphrase.
+    fn labeled_hmac_settings_str(passphrase: &str) -> String {
+        crate_test_settings_str_with_ec_section(&format!(
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"hmac\"\npassphrase = \"{passphrase}\"\n"
+        ))
+    }
+
+    #[test]
+    fn push_validation_accepts_a_key_name_in_a_labeled_hmac_block() {
+        // At push time a secret field holds the name of a secret-store key, so
+        // a value check such as the 32-byte passphrase minimum would be judging
+        // the key name. `ec_key` is far shorter than any passphrase.
+        let toml = labeled_hmac_settings_str("ec_key");
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize a labeled module block");
+        let mut settings = app_config.into_settings();
+        settings.proxy.allowed_domains = vec!["*.example".to_owned(), "*.example.com".to_owned()];
+
+        TrustedServerAppConfig::new(settings)
+            .expect("should validate the key name without judging it as a passphrase");
+
+        // The value check still exists. It runs where settings are loaded with
+        // their secrets resolved, which here reads `ec_key` as the passphrase.
+        let err = Settings::from_toml(&toml)
+            .expect_err("a short passphrase in a labeled block should be rejected on load");
+        assert!(
+            format!("{err:?}").contains("ec.primary.passphrase: short_passphrase"),
+            "should report the short passphrase at the labeled block's path: {err:?}"
+        );
+    }
+
+    #[test]
+    fn configured_secret_fields_names_only_labeled_hmac_blocks() {
+        use crate::secret_resolution::ConfiguredSecretFields as _;
+
+        let data = serde_json::json!({
+            "ec": {
+                "module": "primary",
+                "ec_store": "ec_identity_store",
+                "hmac": { "passphrase": "ec_key" },
+                "primary": { "implementation": "hmac", "passphrase": "labeled_ec_key" },
+                "acme": { "implementation": "acme", "endpoint": "https://ec.acme.example.com" },
+            }
+        });
+
+        let paths = TrustedServerAppConfig::configured_secret_fields(&data)
+            .iter()
+            .map(SecretField::dotted_path)
+            .collect::<Vec<_>>();
+
+        assert_eq!(
+            paths,
+            vec!["ec.primary.passphrase".to_owned()],
+            "only a block naming the hmac implementation under a label needs a path the \
+             fixed list cannot hold"
+        );
+    }
+
+    #[test]
+    fn push_validation_keeps_the_sections_other_errors_for_a_labeled_block() {
+        // A block under a label has no fixed secret path, so push validation
+        // strips the error that judged its key name as a passphrase, and only
+        // that one: another error in the Edge Cookie section is still reported.
+        let toml = labeled_hmac_settings_str("ec_key");
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize a labeled module block");
+        let mut settings = app_config.into_settings();
+        settings.proxy.allowed_domains = vec!["*.example".to_owned(), "*.example.com".to_owned()];
+        settings.ec.partners = vec![
+            serde_json::from_value(serde_json::json!({
+                "name": "Example partner",
+                "source_domain": "https://partner.example",
+            }))
+            .expect("should deserialize a partner"),
+        ];
+
+        // Read from the section's own errors, because deploy validation
+        // reports a bad partner as well.
+        let errors = TrustedServerAppConfig { settings }
+            .validate()
+            .expect_err("an error beside the passphrase should still be reported");
+        let Some(ValidationErrorsKind::Struct(ec)) = errors.errors().get("ec") else {
+            panic!("the Edge Cookie section should keep its error: {errors}");
+        };
+        assert!(
+            ec.errors().contains_key("partners"),
+            "the partner error should be reported: {errors}"
+        );
+        assert!(
+            !ec.errors().contains_key("primary"),
+            "the key name should not be judged as a passphrase: {errors}"
+        );
+    }
+
+    #[test]
+    fn push_validation_rejects_an_empty_key_name_in_a_labeled_hmac_block() {
+        let toml = labeled_hmac_settings_str("");
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize a labeled module block");
+        let mut settings = app_config.into_settings();
+        settings.proxy.allowed_domains = vec!["*.example".to_owned(), "*.example.com".to_owned()];
+
+        let err = TrustedServerAppConfig::new(settings)
+            .expect_err("should reject an empty secret key reference in a labeled block");
+        assert!(
+            err.to_string().contains("ec.primary.passphrase"),
+            "error should identify the labeled block's empty reference: {err:?}"
+        );
+    }
+
     #[test]
     fn secret_metadata_lists_all_secret_paths_and_optionality() {
         let fields = TrustedServerAppConfig::secret_fields();
@@ -899,7 +1114,8 @@ formats = [{ width = 300, height = 250 }]
             paths,
             vec![
                 ("publisher.proxy_secret".to_owned(), false),
-                ("ec.passphrase".to_owned(), false),
+                ("ec.passphrase".to_owned(), true),
+                ("ec.hmac.passphrase".to_owned(), true),
                 ("ec.partners[*].api_token".to_owned(), true),
                 ("ec.partners[*].ts_pull_token".to_owned(), true),
                 ("handlers[*].password".to_owned(), false),
@@ -1182,6 +1398,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "change-me-proxy-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "production-secret-key-32-bytes-min"
 
 [[handlers]]
diff --git a/crates/trusted-server-core/src/config_payload.rs b/crates/trusted-server-core/src/config_payload.rs
index c9690b01f5..977290193f 100644
--- a/crates/trusted-server-core/src/config_payload.rs
+++ b/crates/trusted-server-core/src/config_payload.rs
@@ -139,13 +139,16 @@ fn json_bool_or_string_is_true(value: Option<&serde_json::Value>) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::ec::module::HMAC_MODULE_KEY;
     use crate::integrations::didomi::DidomiIntegrationConfig;
     use crate::platform::{PlatformError, StoreId};
     use crate::redacted::Redacted;
     use crate::settings::{
         AssetOriginAuth, EcPartner, ProxyAssetRoute, S3SigV4AuthConfig, TrustedClientIpConfig,
     };
-    use crate::test_support::tests::crate_test_settings_str;
+    use crate::test_support::tests::{
+        crate_test_settings_str, hmac_passphrase, select_hmac_module,
+    };
 
     fn test_settings() -> Settings {
         let mut settings =
@@ -206,6 +209,7 @@ mod tests {
                 "partner-api-token-key" => "resolved-partner-api-token-32-bytes-ok",
                 "partner-pull-token-key" => "resolved-partner-pull-token-32-bytes-ok",
                 "trusted-client-ip-key" => "resolved-trusted-client-ip-secret-32-bytes",
+                "labeled-passphrase-key" => "resolved-labeled-passphrase-32-bytes",
                 _ => key,
             };
             Ok(value.as_bytes().to_vec())
@@ -502,6 +506,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_labeled_hmac_block_resolves_its_passphrase_from_the_secret_store() {
+        // `secret_fields` can only list fixed paths, so a block under a label
+        // of the operator's choosing is found by reading the configuration.
+        // Without that, the key name would reach settings as the passphrase.
+        let mut data =
+            serde_json::to_value(test_settings()).expect("should serialize settings to JSON");
+        data["ec"] = serde_json::json!({
+            "module": "primary",
+            "primary": {
+                "implementation": "hmac",
+                "passphrase": "labeled-passphrase-key",
+            },
+        });
+        let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_owned());
+        let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
+
+        let reconstructed = settings_from_config_blob(
+            &envelope_json,
+            &UnifiedSecretStore,
+            &StoreName::from("ts_secrets"),
+        )
+        .expect("should resolve the labeled block's passphrase");
+
+        let written =
+            serde_json::to_value(&reconstructed).expect("should serialize the loaded settings");
+        assert_eq!(
+            written["ec"]["primary"]["passphrase"], "resolved-labeled-passphrase-32-bytes",
+            "should replace the key name with the value from the secret store"
+        );
+    }
+
     #[test]
     fn omitted_s3_secret_references_resolve_default_store_keys() {
         let mut original = test_settings();
@@ -754,7 +790,11 @@ mod tests {
         let mut original = test_settings();
         original.publisher.proxy_secret =
             Redacted::new("12345678901234567890123456789012".to_string());
-        original.ec.passphrase = Redacted::new("12345678901234567890123456789012".to_string());
+        select_hmac_module(
+            &mut original.ec,
+            HMAC_MODULE_KEY,
+            "12345678901234567890123456789012",
+        );
         original.handlers[0].password = Redacted::new("true".to_string());
 
         let reconstructed =
@@ -766,8 +806,8 @@ mod tests {
             "numeric-looking proxy secret should remain a string"
         );
         assert_eq!(
-            reconstructed.ec.passphrase.expose(),
-            original.ec.passphrase.expose(),
+            hmac_passphrase(&reconstructed.ec, HMAC_MODULE_KEY),
+            hmac_passphrase(&original.ec, HMAC_MODULE_KEY),
             "numeric-looking passphrase should remain a string"
         );
         assert_eq!(
@@ -809,7 +849,7 @@ mod tests {
     #[test]
     fn runtime_validation_rejects_short_resolved_passphrase() {
         let mut settings = test_settings();
-        settings.ec.passphrase = Redacted::new("short_key".to_owned());
+        select_hmac_module(&mut settings.ec, HMAC_MODULE_KEY, "short_key");
 
         let err = load_settings(&envelope_json(&settings))
             .expect_err("should reject a short resolved passphrase");
diff --git a/crates/trusted-server-core/src/constants.rs b/crates/trusted-server-core/src/constants.rs
index 1fd3c2382c..7ef37dd955 100644
--- a/crates/trusted-server-core/src/constants.rs
+++ b/crates/trusted-server-core/src/constants.rs
@@ -56,19 +56,31 @@ pub const HEADER_ACCEPT_LANGUAGE: HeaderName = HeaderName::from_static("accept-l
 pub const HEADER_ACCEPT_ENCODING: HeaderName = HeaderName::from_static("accept-encoding");
 pub const HEADER_REFERER: HeaderName = HeaderName::from_static("referer");
 
-/// TS-internal header names that must NOT be forwarded to downstream third-party services.
+/// The fixed response headers that carry Edge Cookie identity output.
 ///
-/// These headers are used internally by Trusted Server for identification, geo-enrichment,
-/// debugging, and compression hints. Leaking them to external origins could expose
-/// data and internal implementation details.
+/// EC finalization strips these from a response the request was not permitted
+/// to carry an identity on (see `clear_ec_headers_on_response` in
+/// [`finalize`](crate::ec::finalize)), and they are also internal headers, so
+/// [`INTERNAL_HEADERS`] is built from this list rather than repeating it. That
+/// is the whole reason the list lives here alongside `INTERNAL_HEADERS` and not
+/// beside its only reader, because two hand-written copies of one list drift as
+/// soon as a header is added to one of them.
 ///
-/// Uses `&str` slices because `HeaderName` has interior mutability and cannot appear
-/// in `const` context.
-pub const INTERNAL_HEADERS: &[&str] = &[
+/// Uses `&str` slices for the same reason [`INTERNAL_HEADERS`] does.
+pub const EC_RESPONSE_HEADERS: &[&str] = &[
     "x-ts-ec",
     "x-ts-eids",
     "x-ts-ec-consent",
     "x-ts-eids-truncated",
+];
+
+/// The internal headers that are not part of the Edge Cookie output surface.
+///
+/// Kept apart from [`EC_RESPONSE_HEADERS`] only so [`INTERNAL_HEADERS`] can be
+/// assembled from the two without repeating either. Add a header here unless it
+/// is one EC finalization has to strip, in which case it belongs in
+/// [`EC_RESPONSE_HEADERS`] and reaches [`INTERNAL_HEADERS`] from there.
+const NON_EC_INTERNAL_HEADERS: &[&str] = &[
     "x-pub-user-id",
     "x-subject-id",
     "x-consent-advertising",
@@ -90,6 +102,43 @@ pub const INTERNAL_HEADERS: &[&str] = &[
     "x-ts-tls-cipher",
 ];
 
+/// How many names [`INTERNAL_HEADERS`] holds.
+const INTERNAL_HEADER_COUNT: usize = EC_RESPONSE_HEADERS.len() + NON_EC_INTERNAL_HEADERS.len();
+
+/// Joins the two source lists into the array [`INTERNAL_HEADERS`] borrows.
+///
+/// Written as a `const fn` because slice concatenation is not available in a
+/// `const` initializer, and the join has to happen while the crate is compiled
+/// so no caller pays for it.
+const fn join_internal_headers() -> [&'static str; INTERNAL_HEADER_COUNT] {
+    let mut joined = [""; INTERNAL_HEADER_COUNT];
+    let mut i = 0;
+    while i < EC_RESPONSE_HEADERS.len() {
+        joined[i] = EC_RESPONSE_HEADERS[i];
+        i += 1;
+    }
+    let mut j = 0;
+    while j < NON_EC_INTERNAL_HEADERS.len() {
+        joined[i + j] = NON_EC_INTERNAL_HEADERS[j];
+        j += 1;
+    }
+    joined
+}
+
+/// TS-internal header names that must NOT be forwarded to downstream third-party services.
+///
+/// These headers are used internally by Trusted Server for identification, geo-enrichment,
+/// debugging, and compression hints. Leaking them to external origins could expose
+/// data and internal implementation details.
+///
+/// Built at compile time from [`EC_RESPONSE_HEADERS`] followed by
+/// [`NON_EC_INTERNAL_HEADERS`], so an Edge Cookie response header cannot be
+/// added to one list and missed in the other.
+///
+/// Uses `&str` slices because `HeaderName` has interior mutability and cannot appear
+/// in `const` context.
+pub const INTERNAL_HEADERS: &[&str] = &join_internal_headers();
+
 // Consent-related cookie names
 pub const COOKIE_EUCONSENT_V2: &str = "euconsent-v2";
 pub const COOKIE_GPP: &str = "__gpp";
@@ -98,3 +147,36 @@ pub const COOKIE_US_PRIVACY: &str = "us_privacy";
 
 // Consent-related header names
 pub const HEADER_SEC_GPC: HeaderName = HeaderName::from_static("sec-gpc");
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_edge_cookie_response_header_is_an_internal_header() {
+        // `INTERNAL_HEADERS` is assembled from `EC_RESPONSE_HEADERS`. Two
+        // lists written out separately could drift, so that a new Edge Cookie
+        // response header was stripped by EC finalization and still
+        // forwarded to a third party, and this assertion fails if they are
+        // ever separated.
+        for header in EC_RESPONSE_HEADERS {
+            assert!(
+                INTERNAL_HEADERS.contains(header),
+                "`{header}` carries Edge Cookie output, so it must never be forwarded"
+            );
+        }
+
+        assert_eq!(
+            INTERNAL_HEADERS.len(),
+            EC_RESPONSE_HEADERS.len() + NON_EC_INTERNAL_HEADERS.len(),
+            "every internal header should come from exactly one of the two source lists"
+        );
+
+        for (index, header) in INTERNAL_HEADERS.iter().enumerate() {
+            assert!(
+                !INTERNAL_HEADERS[index + 1..].contains(header),
+                "`{header}` is listed twice, so the two source lists overlap"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/admin.rs b/crates/trusted-server-core/src/ec/admin.rs
index e21fab702c..ea6729c713 100644
--- a/crates/trusted-server-core/src/ec/admin.rs
+++ b/crates/trusted-server-core/src/ec/admin.rs
@@ -32,11 +32,11 @@ use crate::error::TrustedServerError;
 use crate::openrtb::Eid;
 
 use super::eids::{resolve_partner_ids, to_eids};
-use super::generation::is_valid_ec_id;
 use super::kv::KvIdentityGraph;
 use super::kv_backend::EcKvLookup;
 use super::kv_types::{KvEntry, KvMetadata};
 use super::log_id;
+use super::module::{AcceptedModules, EdgeCookieModule};
 use super::prebid_eids::{
     analyze_prebid_eids_cookie, collect_sharedid_update, dedupe_partner_updates, is_valid_eid_uid,
 };
@@ -197,8 +197,11 @@ pub fn deny_admin_diagnostic_fallback(req: &Request<EdgeBody>) -> Option<Respons
 /// Successful admin EC lookup payload.
 #[derive(Debug, Serialize)]
 struct AdminEcLookupResponse {
-    /// The EC ID that was looked up.
+    /// The EC ID as requested, from the path or the `ts-ec` cookie.
     ec_id: String,
+    /// The identity-graph key the entry was read from, being the canonical form
+    /// of `ec_id` that [`AcceptedModules::canonical_kv_key`] returns.
+    kv_key: String,
     /// Platform KV store name the entry was read from.
     store: String,
     /// Store generation marker for the entry.
@@ -276,19 +279,28 @@ struct SkippedPartnerId {
 pub fn handle_admin_ec_lookup(
     kv: Option<&KvIdentityGraph>,
     registry: &PartnerRegistry,
+    module: Option<&dyn EdgeCookieModule>,
     req: &Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let Some(kv) = kv else {
         return Ok(admin_ec_lookup_not_supported());
     };
 
-    let ec_id = match requested_ec_id(req) {
-        Ok(ec_id) => ec_id,
+    let requested = match requested_ec_id(req, &AcceptedModules::active(module)) {
+        Ok(requested) => requested,
         Err(response) => return Ok(*response),
     };
 
-    let Some(lookup) = kv.lookup_raw(&ec_id)? else {
-        log::info!("Admin EC lookup: no entry for '{}'", log_id(&ec_id));
+    // Read the row under the owning module's canonical form of the
+    // identifier, the key the row is stored under, rather than under the
+    // identifier as requested. The two differ whenever the canonical form is
+    // not the requested string itself, for example for a built-in HMAC
+    // identifier requested with its hash in uppercase.
+    let Some(lookup) = kv.lookup_raw(&requested.kv_key)? else {
+        log::info!(
+            "Admin EC lookup: no entry for '{}'",
+            log_id(&requested.ec_id)
+        );
         return Ok(json_error(
             StatusCode::NOT_FOUND,
             "EC entry not found (KV reads are eventually consistent; a very \
@@ -296,8 +308,11 @@ pub fn handle_admin_ec_lookup(
         ));
     };
 
-    log::info!("Admin EC lookup: returning entry for '{}'", log_id(&ec_id));
-    let payload = build_lookup_response(registry, kv.store_name(), ec_id, &lookup);
+    log::info!(
+        "Admin EC lookup: returning entry for '{}'",
+        log_id(&requested.ec_id)
+    );
+    let payload = build_lookup_response(registry, kv.store_name(), requested, &lookup);
     let body =
         serde_json::to_string(&payload).change_context(TrustedServerError::Configuration {
             message: "failed to serialize admin EC lookup response".to_owned(),
@@ -340,11 +355,34 @@ fn cookie_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeBody
     })
 }
 
-/// Resolves the EC ID to look up from the path or the `ts-ec` cookie.
+/// An EC ID resolved for lookup, with the identity-graph key its row is stored
+/// under.
+#[derive(Debug)]
+struct RequestedEcId {
+    /// The EC ID as requested, from the path or the `ts-ec` cookie.
+    ec_id: String,
+    /// The canonical form of `ec_id` that
+    /// [`AcceptedModules::canonical_kv_key`] returns, which the row is stored
+    /// under.
+    kv_key: String,
+}
+
+/// Resolves the EC ID to look up from the path or the `ts-ec` cookie, with the
+/// identity-graph key its row is stored under.
+///
+/// The identifier is validated in two parts: the global cookie bounds, then
+/// the module that owns its `{code}~` prefix, so an operator can look up an
+/// identifier created by whichever module this deployment reads rather than
+/// only a built-in HMAC one. The same check supplies the key, the canonical
+/// form of the identifier that [`AcceptedModules::canonical_kv_key`]
+/// returns.
 ///
 /// Returns the (boxed) error response to send directly when no valid ID is
 /// available.
-fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeBody>>> {
+fn requested_ec_id(
+    req: &Request<EdgeBody>,
+    accepted_modules: &AcceptedModules<'_>,
+) -> Result<RequestedEcId, Box<Response<EdgeBody>>> {
     let remainder = req
         .uri()
         .path()
@@ -358,14 +396,16 @@ fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeB
         remainder.to_owned()
     };
 
-    if !is_valid_ec_id(&ec_id) {
+    let Some(kv_key) = accepted_modules.canonical_kv_key(&ec_id) else {
         return Err(Box::new(json_error(
             StatusCode::BAD_REQUEST,
-            "invalid EC ID format (expected {64hex}.{6alnum})",
+            "invalid EC ID: not an identifier any module this deployment reads \
+             issued (the built-in HMAC module issues hmac~{64hex}.{6alnum} and \
+             still reads the bare legacy form)",
         )));
-    }
+    };
 
-    Ok(ec_id)
+    Ok(RequestedEcId { ec_id, kv_key })
 }
 
 /// Builds the success payload from a raw KV lookup.
@@ -375,11 +415,12 @@ fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeB
 fn build_lookup_response(
     registry: &PartnerRegistry,
     store_name: &str,
-    ec_id: String,
+    requested: RequestedEcId,
     lookup: &EcKvLookup,
 ) -> AdminEcLookupResponse {
     let mut payload = AdminEcLookupResponse {
-        ec_id,
+        ec_id: requested.ec_id,
+        kv_key: requested.kv_key,
         store: store_name.to_owned(),
         generation: lookup.generation,
         tombstone: None,
@@ -685,6 +726,9 @@ mod tests {
     use crate::ec::kv_backend::test_support::InMemoryEcKv;
     use crate::ec::kv_backend::{EcKvStore as _, EcKvWrite, EcKvWriteMode};
     use crate::ec::kv_types::KvPartnerId;
+    use crate::ec::tests::{
+        CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule, OpaqueModule,
+    };
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
 
@@ -977,7 +1021,7 @@ mod tests {
         let kv = kv_with_entry(&ec_id, &sample_entry());
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1073,7 +1117,7 @@ mod tests {
         let kv = kv_with_raw_body_and_metadata(&ec_id, &body, &metadata);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
         let json = response_json(response);
 
@@ -1100,7 +1144,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, &body);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
         let json = response_json(response);
 
@@ -1132,7 +1176,7 @@ mod tests {
         );
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1152,7 +1196,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_FOUND);
@@ -1163,7 +1207,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request("/_ts/admin/ec/not-a-valid-id");
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
@@ -1175,7 +1219,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, "not json at all");
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(
@@ -1216,7 +1260,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, &body);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1241,7 +1285,7 @@ mod tests {
         let kv = kv_with_entry(&ec_id, &sample_entry());
         let req = get_request_with_cookie("/_ts/admin/ec", &format!("other=1; ts-ec={ec_id}; x=2"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1266,7 +1310,7 @@ mod tests {
             &format!("ts-ec={stale_ec_id}; ts-ec={live_ec_id}"),
         );
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1283,7 +1327,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request("/_ts/admin/ec");
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_FOUND);
@@ -1301,8 +1345,8 @@ mod tests {
     fn missing_identity_graph_returns_501() {
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let response =
-            handle_admin_ec_lookup(None, &test_registry(), &req).expect("should handle lookup");
+        let response = handle_admin_ec_lookup(None, &test_registry(), None, &req)
+            .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_IMPLEMENTED);
     }
@@ -1336,7 +1380,7 @@ mod tests {
         let kv = KvIdentityGraph::failing("broken-store");
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let result = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req);
+        let result = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req);
 
         assert!(result.is_err(), "should propagate KV read failures");
     }
@@ -1533,4 +1577,124 @@ mod tests {
         assert_eq!(matched[0]["source_domain"], "sharedid.org");
         assert_eq!(matched[0]["uid"], "shared-uid-123");
     }
+
+    #[test]
+    fn requested_ec_id_accepts_the_hmac_envelope() {
+        let coded = format!("hmac~{}", test_ec_id());
+        let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{coded}"));
+
+        let requested = requested_ec_id(&request, &AcceptedModules::active(None))
+            .unwrap_or_else(|_| panic!("should accept a coded HMAC identifier in the path"));
+
+        assert_eq!(
+            requested.ec_id, coded,
+            "should report the identifier as given"
+        );
+        assert_eq!(
+            requested.kv_key, coded,
+            "a lowercase HMAC identifier should be its own identity-graph key"
+        );
+    }
+
+    #[test]
+    fn requested_ec_id_accepts_the_active_non_hmac_module_and_rejects_others() {
+        // The diagnostic must be usable on a deployment whose module is not
+        // the built-in HMAC one. Before the dispatch every non-`hmac` code was
+        // a 400, so an operator could not look up the identifier in the very
+        // cookie the browser was carrying.
+        let accepted = AcceptedModules::active(Some(&OpaqueModule));
+
+        let opaque = "t0op~Opaque_Value_MixedCase";
+        let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{opaque}"));
+        let requested = requested_ec_id(&request, &accepted)
+            .unwrap_or_else(|_| panic!("should accept the active module's identifier"));
+        assert_eq!(
+            requested.ec_id, opaque,
+            "should report the identifier as given"
+        );
+
+        // A code no configured module reads stays a 400, even in the built-in
+        // HMAC shape, so one deployment cannot inspect another's identifiers.
+        let foreign = format!("t0zz~{}", test_ec_id());
+        let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{foreign}"));
+        let response = requested_ec_id(&request, &accepted)
+            .expect_err("an unread module code should be rejected");
+        assert_eq!(
+            response.status(),
+            StatusCode::BAD_REQUEST,
+            "an unread module code should be a 400"
+        );
+    }
+
+    #[test]
+    fn ec_lookup_reads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning module's
+        // canonical form of the identifier. Read under the identifier as
+        // requested, the lookup answered 404 for a row that exists whenever a
+        // module's canonical form differs from the cookie value.
+        let kv = kv_with_entry(CANONICAL_KV_KEY, &sample_entry());
+        let req =
+            get_request_with_cookie("/_ts/admin/ec", &format!("ts-ec={CANONICAL_COOKIE_VALUE}"));
+
+        let response = handle_admin_ec_lookup(
+            Some(&kv),
+            &test_registry(),
+            Some(&CanonicalizingModule),
+            &req,
+        )
+        .expect("should handle lookup");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "the cookie value should find the row stored under the canonical key"
+        );
+        let json = response_json(response);
+        assert_eq!(
+            json["ec_id"], CANONICAL_COOKIE_VALUE,
+            "should report the identifier as requested"
+        );
+        assert_eq!(
+            json["kv_key"], CANONICAL_KV_KEY,
+            "should report the key the entry was read from"
+        );
+        assert_eq!(
+            json["entry"]["ids"]["bidstream.example"]["uid"], "uid-live",
+            "should return the entry stored under the canonical key"
+        );
+    }
+
+    #[test]
+    fn ec_lookup_given_an_uppercase_hmac_hash_reads_the_lowercase_row() {
+        // The built-in HMAC module issues lowercase hex, and its canonical
+        // form lowercases the hash, so its row key is the identifier it issued.
+        // An operator who pastes that identifier with the hash in uppercase is
+        // still asking for the same row.
+        let ec_id = format!("hmac~{}", test_ec_id());
+        let kv = kv_with_entry(&ec_id, &sample_entry());
+        let uppercase = format!("hmac~{}.abc123", "A".repeat(64));
+        let module = crate::ec::tests::hmac_module();
+        let req = get_request(&format!("/_ts/admin/ec/{uppercase}"));
+
+        let response =
+            handle_admin_ec_lookup(Some(&kv), &test_registry(), Some(module.as_ref()), &req)
+                .expect("should handle lookup");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "an uppercase hash should find the row stored under the lowercase key"
+        );
+        let json = response_json(response);
+        assert_eq!(
+            json["ec_id"],
+            uppercase.as_str(),
+            "should report the identifier as requested"
+        );
+        assert_eq!(
+            json["kv_key"],
+            ec_id.as_str(),
+            "should report the lowercase key the entry was read from"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/batch_sync.rs b/crates/trusted-server-core/src/ec/batch_sync.rs
index 4903589b29..97fbe630e5 100644
--- a/crates/trusted-server-core/src/ec/batch_sync.rs
+++ b/crates/trusted-server-core/src/ec/batch_sync.rs
@@ -23,9 +23,9 @@ use serde::{Deserialize, Serialize};
 use crate::error::TrustedServerError;
 
 use super::auth::authenticate_bearer;
-use super::generation::{is_valid_ec_id, normalize_ec_id_for_kv};
 use super::kv::{KvIdentityGraph, UpsertResult};
 use super::log_id;
+use super::module::{AcceptedModules, EdgeCookieModule};
 use super::rate_limiter::RateLimiter;
 use super::registry::PartnerRegistry;
 
@@ -115,15 +115,17 @@ pub fn handle_batch_sync(
     kv: &KvIdentityGraph,
     registry: &PartnerRegistry,
     rate_limiter: &dyn RateLimiter,
+    module: Option<&dyn EdgeCookieModule>,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    handle_batch_sync_with_writer(kv, registry, rate_limiter, req)
+    handle_batch_sync_with_writer(kv, registry, rate_limiter, module, req)
 }
 
 fn handle_batch_sync_with_writer(
     writer: &dyn BatchSyncWriter,
     registry: &PartnerRegistry,
     rate_limiter: &dyn RateLimiter,
+    module: Option<&dyn EdgeCookieModule>,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     // 1. Authenticate
@@ -167,7 +169,12 @@ fn handle_batch_sync_with_writer(
     }
 
     // 4. Process mappings with per-item validation and rejection reasons.
-    let (accepted, errors) = process_mappings(writer, &partner.source_domain, &body.mappings);
+    let (accepted, errors) = process_mappings(
+        writer,
+        &partner.source_domain,
+        &body.mappings,
+        &AcceptedModules::active(module),
+    );
 
     let rejected = errors.len();
     let status = if rejected > 0 {
@@ -203,6 +210,7 @@ fn process_mappings(
     writer: &dyn BatchSyncWriter,
     partner_id: &str,
     mappings: &[SyncMapping],
+    accepted_modules: &AcceptedModules<'_>,
 ) -> (usize, Vec<MappingError>) {
     let mut errors = Vec::new();
     let mut groups: Vec<MappingGroup> = Vec::new();
@@ -211,14 +219,18 @@ fn process_mappings(
     // Validate all inputs before beginning KV work. The vector preserves group
     // order; the map only locates an existing group in constant time.
     for (index, mapping) in mappings.iter().enumerate() {
-        let ec_id = normalize_ec_id_for_kv(&mapping.ec_id);
-        if !is_valid_ec_id(&ec_id) {
+        // The global cookie bounds, then the module that owns the
+        // identifier's code, which canonicalizes its own value part and decides
+        // whether the canonical form is one of its own. A partner echoing back
+        // an identifier a non-HMAC module created is accepted here; an
+        // identifier under a code this deployment does not read is not.
+        let Some(ec_id) = accepted_modules.canonical_kv_key(&mapping.ec_id) else {
             errors.push(MappingError {
                 index,
                 reason: REASON_INVALID_EC_ID,
             });
             continue;
-        }
+        };
 
         if mapping.partner_uid.trim().is_empty() || mapping.partner_uid.len() > MAX_UID_LENGTH {
             errors.push(MappingError {
@@ -308,17 +320,15 @@ mod tests {
     use super::*;
     use std::collections::VecDeque;
 
+    use crate::ec::module::HmacModule;
+    use crate::ec::tests::OpaqueModule;
     use crate::error::TrustedServerError;
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
 
-    // EC ID validation tests are in generation.rs (is_valid_ec_id).
-    // Verify the import works here with a basic smoke test.
-    #[test]
-    fn is_valid_ec_id_smoke_test() {
-        let valid = format!("{}.ABC123", "a".repeat(64));
-        assert!(is_valid_ec_id(&valid));
-        assert!(!is_valid_ec_id(&"a".repeat(64)));
+    /// The built-in module, standing in for a deployment that selected it.
+    fn hmac_module() -> HmacModule {
+        HmacModule::new(Redacted::new("test-secret-key-32-bytes-minimum".to_owned()))
     }
 
     struct MockRateLimiter {
@@ -489,7 +499,7 @@ mod tests {
             .body(EdgeBody::from("not-json"))
             .expect("should build test request");
 
-        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, req)
+        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, None, req)
             .expect("should return oversized response");
 
         assert_eq!(
@@ -515,7 +525,7 @@ mod tests {
             .body(EdgeBody::from(oversized_body))
             .expect("should build test request");
 
-        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, req)
+        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, None, req)
             .expect("should return oversized response");
 
         assert_eq!(
@@ -534,7 +544,13 @@ mod tests {
             mapping(&format!("{}.ABC123", "a".repeat(64)), "u3", 1),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 1, "should count successful writes as accepted");
         assert_eq!(errors.len(), 2, "should reject invalid mappings only");
@@ -560,7 +576,13 @@ mod tests {
             mapping(&format!("{}.ABC123", "c".repeat(64)), "u3", 1),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 1, "should keep accepted count before failure");
         assert_eq!(
@@ -593,7 +615,7 @@ mod tests {
             .expect("should build test request");
 
         let response =
-            handle_batch_sync(&kv, &registry, &limiter, req).expect("should return response");
+            handle_batch_sync(&kv, &registry, &limiter, None, req).expect("should return response");
         assert_eq!(
             response.status(),
             StatusCode::UNAUTHORIZED,
@@ -657,7 +679,13 @@ mod tests {
             mapping(&withdrawn_ec_id, "uid-2", 101),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 0, "should not accept ineligible mappings");
         assert_eq!(errors.len(), 2, "should report both errors");
@@ -668,13 +696,111 @@ mod tests {
         assert_eq!(writer.calls().len(), 2, "should exercise both outcomes");
     }
 
+    #[test]
+    fn process_mappings_accepts_an_identifier_from_the_active_non_hmac_module() {
+        // An identifier the active non-HMAC module owns is accepted, so a
+        // partner can sync a mapping against an identifier the HMAC grammar
+        // would reject.
+        let writer = MockWriter::new(vec![Ok(UpsertResult::Written)]);
+        let mappings = vec![mapping("t0op~Opaque_Value_MixedCase", "uid-1", 100)];
+
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&OpaqueModule)),
+        );
+
+        assert_eq!(accepted, 1, "the active module's identifier is accepted");
+        assert!(
+            errors.is_empty(),
+            "should report no errors, got: {errors:?}"
+        );
+    }
+
+    #[test]
+    fn process_mappings_rejects_a_code_no_configured_module_reads() {
+        // The other side of the dispatch: a code belonging to a module this
+        // deployment neither runs nor reads is not an identifier here, whatever
+        // its shape.
+        let writer = MockWriter::new(vec![]);
+        let hmac_shaped = format!("t0zz~{}.ABC123", "a".repeat(64));
+        let mappings = vec![
+            mapping("t0zz~Opaque_Value", "uid-1", 100),
+            mapping(&hmac_shaped, "uid-2", 100),
+        ];
+
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&OpaqueModule)),
+        );
+
+        assert_eq!(accepted, 0, "an unknown module code is not accepted");
+        assert_eq!(errors.len(), 2, "both mappings should be rejected");
+        assert!(
+            errors
+                .iter()
+                .all(|error| error.reason == REASON_INVALID_EC_ID),
+            "should reject as an invalid EC ID, got: {errors:?}"
+        );
+    }
+
+    #[test]
+    fn process_mappings_canonicalizes_through_the_owning_module() {
+        // KV normalization is dispatched the same way as validation. The
+        // built-in module lowercases its hash segment, so a partner echoing
+        // uppercase hex still writes the row created at generation time, while
+        // the opaque module's own normalization leaves its value untouched.
+        let writer = MockWriter::new(vec![Ok(UpsertResult::Written)]);
+        let uppercase = format!("hmac~{}.ABC123", "A".repeat(64));
+        let module = hmac_module();
+        let accepted_modules = AcceptedModules::active(Some(&module));
+
+        assert_eq!(
+            accepted_modules.canonical_kv_key(&uppercase),
+            Some(format!("hmac~{}.ABC123", "a".repeat(64))),
+            "the built-in module should lowercase only its hash segment"
+        );
+        assert_eq!(
+            AcceptedModules::active(Some(&OpaqueModule))
+                .canonical_kv_key("t0op~Opaque_Value_MixedCase"),
+            Some("t0op~Opaque_Value_MixedCase".to_owned()),
+            "an opaque module's identifier should be keyed verbatim"
+        );
+
+        let mappings = vec![mapping(&uppercase, "uid-1", 100)];
+        let (accepted, errors) = process_mappings(&writer, "partner", &mappings, &accepted_modules);
+        assert_eq!(accepted, 1, "uppercase hex should still be accepted");
+        assert!(
+            errors.is_empty(),
+            "should report no errors, got: {errors:?}"
+        );
+        assert_eq!(
+            writer
+                .calls()
+                .into_iter()
+                .map(|call| call.ec_id)
+                .collect::<Vec<_>>(),
+            vec![format!("hmac~{}.ABC123", "a".repeat(64))],
+            "the write should go to the row under the lowercase canonical key"
+        );
+    }
+
     #[test]
     fn process_mappings_fans_out_unchanged_to_group_members() {
         let writer = MockWriter::new(vec![Ok(UpsertResult::Unchanged)]);
         let ec_id = format!("{}.ABC123", "a".repeat(64));
         let mappings = vec![mapping(&ec_id, "uid-1", 100), mapping(&ec_id, "uid-1", 101)];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 2, "should accept every unchanged group member");
         assert!(
@@ -693,7 +819,13 @@ mod tests {
             mapping(&ec_id, "uid-old", 100),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(
             accepted, 2,
@@ -723,7 +855,12 @@ mod tests {
             mapping(&ec_id_a_upper, "a-last", 3),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 3, "should accept every valid group member");
         assert!(errors.is_empty(), "should report no errors");
@@ -753,7 +890,12 @@ mod tests {
             .map(|index| mapping(&ec_id, &format!("uid-{index}"), index as u64))
             .collect::<Vec<_>>();
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(
             accepted, MAX_BATCH_SIZE,
@@ -781,7 +923,12 @@ mod tests {
             mapping(&mixed_suffix, "mixed", 2),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 2, "should accept both distinct EC IDs");
         assert!(errors.is_empty(), "should report no errors");
@@ -813,7 +960,12 @@ mod tests {
             mapping(&ec_id, "   ", 3),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 2, "should accept valid group members");
         assert_eq!(errors.len(), 1, "should retain the invalid UID error");
@@ -841,7 +993,12 @@ mod tests {
             mapping(&ec_id_b, "b-2", 4),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 0, "should reject all ineligible group members");
         assert_eq!(
@@ -882,7 +1039,12 @@ mod tests {
             mapping(&ec_id_c, "", 6),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(
             accepted, 2,
@@ -929,6 +1091,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return success response");
@@ -959,6 +1122,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return multi-status response");
@@ -997,6 +1161,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return validation response");
@@ -1042,6 +1207,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return infrastructure failure response");
@@ -1074,4 +1240,27 @@ mod tests {
             "should stop after the failing group and accept A's later duplicate"
         );
     }
+
+    #[test]
+    fn process_mappings_accepts_a_created_coded_ec_id() {
+        let writer = MockWriter::new(vec![Ok(UpsertResult::Written)]);
+        // Partners echo the identifier identify gave them, which carries the
+        // module-code envelope since the creation path applies it.
+        let ec_id = format!("hmac~{}.ABC123", "a".repeat(64));
+        let mappings = vec![mapping(&ec_id, "uid-1", 1)];
+
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
+
+        assert_eq!(accepted, 1, "should accept a coded HMAC identifier");
+        assert!(
+            errors.is_empty(),
+            "should report no format error for a coded HMAC identifier"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/cookies.rs b/crates/trusted-server-core/src/ec/cookies.rs
index ac0e0c05ba..409124a739 100644
--- a/crates/trusted-server-core/src/ec/cookies.rs
+++ b/crates/trusted-server-core/src/ec/cookies.rs
@@ -13,8 +13,6 @@
 //!   endpoint (`/_ts/api/v1/identify`) exposes the EC ID in its response
 //!   body for legitimate JS use cases.
 
-use std::borrow::Cow;
-
 use edgezero_core::body::Body as EdgeBody;
 use http::{HeaderValue, Response, header};
 
@@ -24,64 +22,27 @@ use crate::settings::Settings;
 /// Maximum age for the EC cookie (1 year in seconds).
 const COOKIE_MAX_AGE: i32 = 365 * 24 * 60 * 60;
 
+/// Maximum length in bytes of an Edge Cookie identifier.
+///
+/// A global bound enforced wherever an identifier enters the system (creation,
+/// cookie read-back, cookie write), so no module can emit a value the cookie
+/// layer, logs, or the KV key space cannot carry.
+pub(crate) const MAX_EC_ID_LEN: usize = 256;
+
 fn is_allowed_ec_id_char(c: char) -> bool {
-    c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_')
+    c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_' | '~')
 }
 
-// Outbound allowlist for cookie sanitization: permits [a-zA-Z0-9._-] as a
-// defense-in-depth backstop when setting the Set-Cookie header. This is
-// intentionally broader than the inbound format validator
-// (`generation::is_valid_ec_id`), which enforces the exact
-// `<64-hex>.<6-alphanumeric>` structure and is used to reject untrusted
-// request values before they enter the system.
+// Identifier allowlist: [A-Za-z0-9._~-], the cookie-safe alphabet every
+// Edge Cookie identifier must fit regardless of which module created it.
+// This is intentionally broader than the built-in format validator
+// (`generation::is_valid_ec_id`), which enforces the HMAC module's
+// `<64-hex>.<6-alphanumeric>` structure, either bare or under the `hmac~`
+// envelope; an opaque vendor identifier only has to fit the alphabet and the
+// length bound.
 #[must_use]
 pub(crate) fn ec_id_has_only_allowed_chars(ec_id: &str) -> bool {
-    ec_id.chars().all(is_allowed_ec_id_char)
-}
-
-fn sanitize_ec_id_for_cookie(ec_id: &str) -> Cow<'_, str> {
-    if ec_id_has_only_allowed_chars(ec_id) {
-        return Cow::Borrowed(ec_id);
-    }
-
-    let safe_id = ec_id
-        .chars()
-        .filter(|c| is_allowed_ec_id_char(*c))
-        .collect::<String>();
-
-    log::warn!(
-        "Stripped disallowed characters from EC ID before setting cookie (len {} -> {}); \
-         callers should reject invalid request IDs before cookie creation",
-        ec_id.len(),
-        safe_id.len(),
-    );
-
-    Cow::Owned(safe_id)
-}
-
-/// Returns `true` if every byte in `value` is a valid RFC 6265 `cookie-octet`.
-/// An empty string is always rejected.
-///
-/// RFC 6265 restricts cookie values to printable US-ASCII excluding whitespace,
-/// double-quote, comma, semicolon, and backslash. Rejecting these characters
-/// prevents header-injection attacks where a crafted value could append
-/// spurious cookie attributes (e.g. `evil; Domain=.attacker.com`).
-///
-/// Non-ASCII characters (multi-byte UTF-8) are always rejected because their
-/// byte values exceed `0x7E`.
-#[must_use]
-fn is_safe_cookie_value(value: &str) -> bool {
-    // RFC 6265 §4.1.1 cookie-octet:
-    //   0x21        — '!'
-    //   0x23–0x2B  — '#' through '+'   (excludes 0x22 DQUOTE)
-    //   0x2D–0x3A  — '-' through ':'   (excludes 0x2C comma)
-    //   0x3C–0x5B  — '<' through '['   (excludes 0x3B semicolon)
-    //   0x5D–0x7E  — ']' through '~'   (excludes 0x5C backslash, 0x7F DEL)
-    // All control characters (0x00–0x20) and non-ASCII (0x80+) are also excluded.
-    !value.is_empty()
-        && value
-            .bytes()
-            .all(|b| matches!(b, 0x21 | 0x23..=0x2B | 0x2D..=0x3A | 0x3C..=0x5B | 0x5D..=0x7E))
+    !ec_id.is_empty() && ec_id.len() <= MAX_EC_ID_LEN && ec_id.chars().all(is_allowed_ec_id_char)
 }
 
 /// Formats a `Set-Cookie` header value for the EC cookie.
@@ -98,56 +59,48 @@ fn format_set_cookie(domain: &str, value: &str, max_age: i32) -> String {
 ///
 /// Per spec §5.2, the EC cookie domain is computed from
 /// `settings.publisher.domain` (not `cookie_domain`) to ensure the EC
-/// cookie is always scoped to the publisher's apex domain. The EC ID is
-/// sanitized through a narrow outbound allowlist as a defense-in-depth
-/// backstop against header injection.
+/// cookie is always scoped to the publisher's apex domain. Callers validate
+/// the identifier with [`ec_id_has_only_allowed_chars`] before this point;
+/// an identifier is rejected outright rather than rewritten, so the cookie
+/// value and the identity-graph key can never silently diverge.
 #[must_use]
 pub(crate) fn create_ec_cookie(settings: &Settings, ec_id: &str) -> String {
-    let safe_id = sanitize_ec_id_for_cookie(ec_id);
-
     format_set_cookie(
         &settings.publisher.ec_cookie_domain(),
-        safe_id.as_ref(),
+        ec_id,
         COOKIE_MAX_AGE,
     )
 }
 
 /// Sets the EC ID cookie on the given response.
 ///
-/// Validates `ec_id` against RFC 6265 `cookie-octet` rules before
-/// interpolation. If the value contains unsafe characters (e.g. semicolons),
-/// the cookie is not set and a warning is logged. This prevents an attacker
-/// from injecting spurious cookie attributes via a controlled ID value.
+/// Validates `ec_id` against the identifier alphabet and length bound before
+/// interpolation. An identifier that fails validation is rejected and the
+/// cookie is not set, with an error logged; the value is never rewritten, so
+/// a module identifier survives byte for byte or not at all. This also
+/// prevents an attacker from injecting spurious cookie attributes via a
+/// controlled ID value.
 ///
 /// `cookie_domain` comes from operator configuration and is considered trusted.
-///
-/// # Panics (debug only)
-///
-/// Debug-asserts that `ec_id` passes [`super::generation::is_valid_ec_id`]
-/// as a defense-in-depth check against cookie injection.
 pub fn set_ec_cookie(settings: &Settings, response: &mut Response<EdgeBody>, ec_id: &str) {
-    if !is_safe_cookie_value(ec_id) {
-        log::warn!(
-            "Rejecting EC ID for Set-Cookie: value of {} bytes contains characters illegal in a cookie value",
-            ec_id.len()
+    if !ec_id_has_only_allowed_chars(ec_id) {
+        log::error!(
+            "Rejecting EC ID for Set-Cookie: value of {} bytes is empty, over {} bytes, or \
+             contains characters outside the identifier alphabet",
+            ec_id.len(),
+            MAX_EC_ID_LEN,
         );
         return;
     }
 
-    debug_assert!(
-        super::generation::is_valid_ec_id(ec_id),
-        "EC ID must be validated before cookie creation: got '{ec_id}'"
-    );
-
     match HeaderValue::from_str(&create_ec_cookie(settings, ec_id)) {
         Ok(val) => {
             response.headers_mut().append(header::SET_COOKIE, val);
         }
         Err(e) => {
-            // Unreachable in practice — is_safe_cookie_value and the debug
-            // assertion above gate the value, and format_set_cookie emits
-            // only controlled bytes. Logged for defense-in-depth symmetry
-            // with the rejection logging above.
+            // Unreachable in practice: the identifier allowlist above gates
+            // the value, and format_set_cookie emits only controlled bytes.
+            // Logged for defense-in-depth symmetry with the rejection above.
             log::warn!("Skipping EC Set-Cookie: invalid header value: {e}");
         }
     }
@@ -177,6 +130,41 @@ pub fn expire_ec_cookie(settings: &Settings, response: &mut Response<EdgeBody>)
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn the_ec_cookie_lifetime_is_one_year() {
+        // The legacy bare-identifier reader's retirement condition (see
+        // `module_owns_id`) is written in terms of this lifetime and the
+        // identity-graph `ENTRY_TTL`, which `kv::tests::constants_have_expected_values`
+        // pins to the same figure. Changing either moves the earliest safe
+        // retirement, so neither may drift unnoticed.
+        assert_eq!(
+            COOKIE_MAX_AGE, 31_536_000,
+            "the EC cookie should live one year"
+        );
+    }
+
+    #[test]
+    fn identifier_bounds_reject_oversize_and_accept_tilde() {
+        assert!(
+            ec_id_has_only_allowed_chars("a.~-_Z9"),
+            "the cookie-safe alphabet includes the tilde"
+        );
+        assert!(
+            !ec_id_has_only_allowed_chars(""),
+            "an empty identifier is rejected"
+        );
+        let oversize = "a".repeat(MAX_EC_ID_LEN + 1);
+        assert!(
+            !ec_id_has_only_allowed_chars(&oversize),
+            "an identifier over the length cap is rejected"
+        );
+        let at_cap = "a".repeat(MAX_EC_ID_LEN);
+        assert!(
+            ec_id_has_only_allowed_chars(&at_cap),
+            "an identifier at the length cap is accepted"
+        );
+    }
     use crate::test_support::tests::create_test_settings;
     use http::header;
 
@@ -226,17 +214,21 @@ mod tests {
     }
 
     #[test]
-    fn create_ec_cookie_sanitizes_disallowed_chars_in_id() {
+    fn set_ec_cookie_rejects_disallowed_chars_outright() {
+        // Rejection, never rewriting: an identifier outside the alphabet must
+        // not produce a cookie at all, so the cookie value and the identity
+        // graph key can never silently diverge.
         let settings = create_test_settings();
-        let result = create_ec_cookie(&settings, "evil;injected\r\nfoo=bar\0baz");
-        let value = result
-            .strip_prefix(&format!("{COOKIE_TS_EC}="))
-            .and_then(|s| s.split_once(';').map(|(v, _)| v))
-            .expect("should have cookie value portion");
-
-        assert_eq!(
-            value, "evilinjectedfoobarbaz",
-            "should strip disallowed characters and preserve safe chars"
+        let mut response = Response::new(EdgeBody::empty());
+        set_ec_cookie(
+            &settings,
+            &mut response,
+            "evil;injected
+foo=bar",
+        );
+        assert!(
+            response.headers().get(header::SET_COOKIE).is_none(),
+            "an identifier outside the alphabet should set no cookie"
         );
     }
 
@@ -289,47 +281,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn is_safe_cookie_value_rejects_empty_string() {
-        assert!(!is_safe_cookie_value(""), "should reject empty string");
-    }
-
-    #[test]
-    fn is_safe_cookie_value_accepts_valid_ec_id_characters() {
-        assert!(
-            is_safe_cookie_value("abcdef0123456789.ABCDEFabcdef"),
-            "should accept hex digits, dots, and alphanumeric characters"
-        );
-    }
-
-    #[test]
-    fn is_safe_cookie_value_rejects_non_ascii() {
-        assert!(
-            !is_safe_cookie_value("val\u{fc}e"),
-            "should reject non-ASCII UTF-8 characters"
-        );
-    }
-
-    #[test]
-    fn is_safe_cookie_value_rejects_illegal_characters() {
-        assert!(!is_safe_cookie_value("val;ue"), "should reject semicolon");
-        assert!(!is_safe_cookie_value("val,ue"), "should reject comma");
-        assert!(
-            !is_safe_cookie_value("val\"ue"),
-            "should reject double-quote"
-        );
-        assert!(!is_safe_cookie_value("val\\ue"), "should reject backslash");
-        assert!(!is_safe_cookie_value("val ue"), "should reject space");
-        assert!(
-            !is_safe_cookie_value("val\x00ue"),
-            "should reject null byte"
-        );
-        assert!(
-            !is_safe_cookie_value("val\x7fue"),
-            "should reject DEL character"
-        );
-    }
-
     #[test]
     fn expire_ec_cookie_sets_max_age_zero() {
         let settings = create_test_settings();
diff --git a/crates/trusted-server-core/src/ec/finalize.rs b/crates/trusted-server-core/src/ec/finalize.rs
index 019ef2aa40..0fe56dfcad 100644
--- a/crates/trusted-server-core/src/ec/finalize.rs
+++ b/crates/trusted-server-core/src/ec/finalize.rs
@@ -8,39 +8,36 @@ use std::collections::HashSet;
 use edgezero_core::body::Body as EdgeBody;
 use http::Response;
 
-use super::consent::{ec_consent_granted, ec_consent_withdrawn};
 use crate::consent::{ConsentContext, allows_eid_persistence};
+use crate::constants::EC_RESPONSE_HEADERS;
 use crate::settings::Settings;
 
 use super::EcContext;
+use super::consent::ec_consent_withdrawn;
 use super::cookies::{expire_ec_cookie, set_ec_cookie};
-use super::generation::{generate_ec_id, is_valid_ec_id};
 use super::kv::{
     CreateIfAbsentOutcome, EidCookieSyncOutcome, KvIdentityGraph, PartnerIdUpdate,
     apply_partner_id_updates,
 };
 use super::kv_types::KvEntry;
+use super::module::{apply_module_response_headers, module_kv_key};
 use super::prebid_eids::collect_eid_updates;
 use super::pull_sync_marker::{expire_marker, reconcile_marker};
 use super::registry::PartnerRegistry;
 use super::{EcKvSnapshot, EidSyncSource, current_timestamp, log_id};
 
-/// TS-managed response headers tied to EC identity output.
-const EC_RESPONSE_HEADERS: &[&str] = &[
-    "x-ts-ec",
-    "x-ts-eids",
-    "x-ts-ec-consent",
-    "x-ts-eids-truncated",
-];
-
 /// Finalizes EC response behavior for all routes.
 ///
-/// Applies withdrawal handling, last-seen updates, cookie reconciliation,
-/// Prebid EID ingestion, and cookie writes for new EC generation.
+/// Applies the resolved consent gate, cookie reconciliation, Prebid EID
+/// ingestion, and cookie writes for new EC generation.
 ///
-/// On consent withdrawal, the browser response clears the EC cookie
-/// immediately and the EC identity-graph KV tombstone is the authoritative
-/// revocation marker. There is no separate consent KV store to clean up.
+/// When the request carries an explicit withdrawal signal (a storage opt-out or
+/// a TCF record refusing storage) and the client presented a cookie, the browser
+/// response clears the EC cookie immediately and the EC identity-graph KV
+/// tombstone is the authoritative revocation marker. A request that is merely
+/// not permitted (pre-consent or fail-closed) strips EC response headers but
+/// leaves an already-issued cookie intact. There is no separate consent KV
+/// store to clean up.
 ///
 /// `eids_cookie` should be the raw value of the `ts-eids` cookie extracted
 /// from the request *before* routing consumes it.
@@ -53,11 +50,25 @@ pub fn ec_finalize_response(
     sharedid_cookie: Option<&str>,
     response: &mut Response<EdgeBody>,
 ) {
+    // Apply any response headers the active module asked for during
+    // generation (for example to request more client evidence). This is empty
+    // unless a module produced headers, so it is safe on every path. Each
+    // one was checked against core's reserved response surface at capture
+    // time in `EcContext::candidate_id`, so nothing here can set a
+    // managed `ts-` cookie, an `x-ts-` header, or a framing or hop-by-hop
+    // header. They accumulate with whatever the origin returned rather than
+    // replacing it, for the reasons on
+    // `module::apply_module_response_headers`.
+    apply_module_response_headers(
+        response.headers_mut(),
+        ec_context.response_headers().iter().cloned(),
+    );
+
     ec_context.validate_pull_sync_marker(settings, registry);
-    let consent_allows_ec = ec_consent_granted(ec_context.consent());
+    let ec_permitted = ec_context.ec_allowed();
     let consent_withdrawn = ec_consent_withdrawn(ec_context.consent());
 
-    if !consent_allows_ec {
+    if !ec_permitted {
         // Expire the request-local marker independently of the EC cookie: a
         // withdrawal must stop any pending pull-sync disclosure window.
         if consent_withdrawn && ec_context.pull_sync_marker().was_present() {
@@ -75,9 +86,13 @@ pub fn ec_finalize_response(
         return;
     }
 
-    // Returning user: consent is granted and EC came from request.
-    if ec_context.ec_was_present() && !ec_context.ec_generated() && consent_allows_ec {
-        if let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) {
+    // Returning user: EC is permitted and came from the request.
+    if ec_context.ec_was_present() && !ec_context.ec_generated() && ec_permitted {
+        // Key the snapshot, EID ingestion and orphan recovery by the module's
+        // canonical form of the identifier, the key the identity-graph row is
+        // stored under, so an ingested EID lands on the live row rather than on
+        // a second row keyed by the value the browser carries.
+        if let (Some(graph), Some(kv_key)) = (kv, ec_context.ec_kv_key()) {
             let source = ec_context.eid_sync_source();
             let collected = source
                 .map(|_| {
@@ -107,16 +122,16 @@ pub fn ec_finalize_response(
                 && ec_context.recovery_eligible()
                 && matches!(ec_context.kv_snapshot(), EcKvSnapshot::NotRead)
             {
-                let snapshot = graph.load_snapshot(&ec_id);
+                let snapshot = graph.load_snapshot(&kv_key);
                 ec_context.set_kv_snapshot(snapshot);
             } else if let Some(source) = source {
-                sync_eid_cookie_updates(graph, ec_context, &ec_id, &updates, source);
+                sync_eid_cookie_updates(graph, ec_context, &kv_key, &updates, source);
             }
             if matches!(ec_context.kv_snapshot(), EcKvSnapshot::Missing { .. })
                 && ec_context.recovery_eligible()
             {
                 confirm_then_recover_orphaned_ec(
-                    settings, ec_context, graph, &ec_id, &updates, response,
+                    settings, ec_context, graph, &kv_key, &updates, response,
                 );
             }
         }
@@ -132,8 +147,11 @@ pub fn ec_finalize_response(
     // there is no KV graph: that would mint a browser cookie with no backing
     // identity-graph row, producing a phantom ID on later requests.
     if ec_context.ec_generated() {
-        let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) else {
-            log::info!("Skipping generated EC response write because KV graph is unavailable");
+        let (Some(graph), Some(kv_key)) = (kv, ec_context.ec_kv_key()) else {
+            log::info!(
+                "Skipping generated EC response write because the KV graph or the \
+                 identity-graph key is unavailable"
+            );
             reconcile_pull_sync_marker(settings, registry, ec_context, response);
             return;
         };
@@ -147,8 +165,8 @@ pub fn ec_finalize_response(
             ),
             ec_context.consent(),
         );
-        sync_eid_cookie_updates(graph, ec_context, &ec_id, &updates, EidSyncSource::NewEc);
-        if ec_context.kv_snapshot().entry_for(&ec_id).is_some() {
+        sync_eid_cookie_updates(graph, ec_context, &kv_key, &updates, EidSyncSource::NewEc);
+        if ec_context.kv_snapshot().entry_for(&kv_key).is_some() {
             set_ec_cookie_on_response(settings, ec_context, response);
         } else {
             log::warn!("Skipping generated EC cookie because backing row is not authoritative");
@@ -268,38 +286,49 @@ fn gate_eid_updates_by_consent(
     Vec::new()
 }
 
+/// Rotates an orphaned identifier to a new one created by the selected module.
+///
+/// Called only once [`confirm_then_recover_orphaned_ec`] has proved the
+/// orphan's row absent. The replacement goes through the same checks as a new
+/// identifier, and its row is created only when no row already holds its key.
+/// Every exit that does not rotate leaves a failed snapshot bound to the
+/// orphan's key.
 fn recover_orphaned_ec(
     settings: &Settings,
     ec_context: &mut EcContext,
     graph: &KvIdentityGraph,
+    orphan_kv_key: &str,
     updates: &[super::kv::PartnerIdUpdate],
     response: &mut Response<EdgeBody>,
 ) {
-    // Snapshot the orphaned ID once so every fail-closed exit binds the failed
-    // snapshot to the same key.
-    let Some(orphan_id) = ec_context.ec_value().map(str::to_owned) else {
-        return;
-    };
-    let Some(client_ip) = ec_context.client_ip().map(str::to_owned) else {
-        log::warn!("Orphan EC recovery skipped because client IP is unavailable");
-        ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-            ec_id: orphan_id.clone(),
-        });
+    // A deployment with no module selected has nothing to rotate to.
+    let Some(module) = ec_context.selected_module() else {
         return;
     };
 
+    // Ask the selected module rather than the built-in generator, so a
+    // vendor deployment never rotates an orphaned cookie into a built-in
+    // identifier. Whether the client IP is needed is that module's decision.
     const MAX_RECOVERY_ATTEMPTS: usize = 5;
     for _attempt in 0..MAX_RECOVERY_ATTEMPTS {
-        let ec_id = match generate_ec_id(settings, &client_ip) {
-            Ok(ec_id) => ec_id,
+        let ec_id = match ec_context.candidate_id(module.as_ref()) {
+            Ok(Some(ec_id)) => ec_id,
+            Ok(None) => {
+                log::info!("Orphan EC recovery skipped because the module produced no identifier");
+                ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
+                    ec_id: orphan_kv_key.to_owned(),
+                });
+                return;
+            }
             Err(err) => {
                 log::warn!("Orphan EC recovery ID generation failed: {err:?}");
                 ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-                    ec_id: orphan_id.clone(),
+                    ec_id: orphan_kv_key.to_owned(),
                 });
                 return;
             }
         };
+        let kv_key = module_kv_key(module.as_ref(), &ec_id);
         let mut entry = KvEntry::new(
             ec_context.consent(),
             ec_context.geo_info(),
@@ -311,14 +340,21 @@ fn recover_orphaned_ec(
             .map(super::device::DeviceSignals::to_kv_device);
         apply_partner_id_updates(&mut entry, updates);
 
-        match graph.create_if_absent(&ec_id, &entry) {
+        match graph.create_if_absent(&kv_key, &entry) {
             Ok(CreateIfAbsentOutcome::Written) => {
                 let snapshot = EcKvSnapshot::Present {
-                    ec_id: ec_id.clone(),
+                    ec_id: kv_key,
                     entry: Box::new(entry),
                     generation: None,
                 };
                 ec_context.replace_with_generated(ec_id, snapshot);
+                // A returning visitor runs no generation earlier in the
+                // request, so these are only the headers the module asked
+                // for while creating the replacement.
+                apply_module_response_headers(
+                    response.headers_mut(),
+                    ec_context.response_headers().iter().cloned(),
+                );
                 set_ec_cookie_on_response(settings, ec_context, response);
                 return;
             }
@@ -326,7 +362,7 @@ fn recover_orphaned_ec(
             Err(err) => {
                 log::warn!("Orphan EC recovery failed: {err:?}");
                 ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-                    ec_id: orphan_id.clone(),
+                    ec_id: orphan_kv_key.to_owned(),
                 });
                 return;
             }
@@ -335,7 +371,7 @@ fn recover_orphaned_ec(
 
     log::warn!("Orphan EC recovery exhausted collision retries");
     ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-        ec_id: orphan_id.clone(),
+        ec_id: orphan_kv_key.to_owned(),
     });
 }
 
@@ -361,20 +397,28 @@ fn confirm_then_recover_orphaned_ec(
     settings: &Settings,
     ec_context: &mut EcContext,
     graph: &KvIdentityGraph,
-    ec_id: &str,
+    kv_key: &str,
     updates: &[super::kv::PartnerIdUpdate],
     response: &mut Response<EdgeBody>,
 ) {
-    let confirmed = graph.load_snapshot(ec_id);
+    let confirmed = graph.load_snapshot(kv_key);
     match confirmed {
         EcKvSnapshot::Present { .. } => {
             // The row became visible after the origin round trip: adopt it and
             // merge any pending updates rather than rotating a valid identity.
             ec_context.set_kv_snapshot(confirmed);
-            sync_eid_cookie_updates(graph, ec_context, ec_id, updates, EidSyncSource::Navigation);
+            sync_eid_cookie_updates(
+                graph,
+                ec_context,
+                kv_key,
+                updates,
+                EidSyncSource::Navigation,
+            );
         }
-        EcKvSnapshot::Missing { .. } => match graph.key_exists_confirmed(ec_id) {
-            Ok(false) => recover_orphaned_ec(settings, ec_context, graph, updates, response),
+        EcKvSnapshot::Missing { .. } => match graph.key_exists_confirmed(kv_key) {
+            Ok(false) => {
+                recover_orphaned_ec(settings, ec_context, graph, kv_key, updates, response)
+            }
             Ok(true) => {
                 log::warn!(
                     "Orphan EC recovery skipped: both point reads missed a row the store still \
@@ -459,66 +503,75 @@ fn finalize_unusable_consent(
 
     expire_ec_cookie(settings, response);
 
-    // Compute once for the authoritative identity-graph tombstones.
-    let ids_to_withdraw = withdrawal_ec_ids(ec_context);
+    // Compute once for the authoritative identity-graph tombstones, keyed by
+    // the canonical form each row is stored under.
+    let keys_to_withdraw = withdrawal_kv_keys(ec_context);
+    let active_kv_key = ec_context.ec_kv_key();
 
     // The identity-graph tombstone is the authoritative withdrawal marker
     // for subsequent EC behavior.
     if let Some(graph) = kv {
-        apply_withdrawal_tombstones(&ids_to_withdraw, |ec_id| {
+        apply_withdrawal_tombstones(&keys_to_withdraw, |kv_key| {
             // The graph hands back the post-withdrawal snapshot rather than
             // leaving the caller to rebuild it, so post-send work that reads
-            // the context — pull sync discloses the raw EC ID to partners —
-            // sees the tombstone that was just written. Only the active ID has
-            // a snapshot in the context to correct.
-            let initial = if ec_context.kv_snapshot().belongs_to(ec_id) {
+            // the context, such as pull sync, which discloses the raw EC ID to
+            // partners, sees the tombstone that was just written. Only the
+            // active identifier has a snapshot in the context to correct.
+            let initial = if ec_context.kv_snapshot().belongs_to(kv_key) {
                 ec_context.kv_snapshot().clone()
             } else {
                 EcKvSnapshot::NotRead
             };
-            let outcome = graph.tombstone_existing_from_snapshot(ec_id, initial);
+            let outcome = graph.tombstone_existing_from_snapshot(kv_key, initial);
             // The browser cookie is already cleared, so a failed tombstone
             // leaves a live row that server-side consumers still read as
             // consented. Report every failure, including the non-active cookie
-            // ID whose outcome is not retained on the request context.
+            // key whose outcome is not retained on the request context.
             if matches!(outcome, EcKvSnapshot::Failed { .. }) {
                 log::warn!(
                     "EC withdrawal tombstone failed for '{}': the identity-graph row may \
                      still be live with consent granted",
-                    log_id(ec_id)
+                    log_id(kv_key)
                 );
             }
-            if ec_context.ec_value() == Some(ec_id) {
+            if active_kv_key.as_deref() == Some(kv_key) {
                 ec_context.set_kv_snapshot(outcome);
             }
         });
     }
 }
 
-fn withdrawal_ec_ids(ec_context: &EcContext) -> HashSet<String> {
-    let mut hashes = HashSet::new();
+/// The identity-graph keys a withdrawal must tombstone.
+///
+/// Both the `ts-ec` cookie the request carried and the active identifier are
+/// turned into keys by the module that owns them, so the tombstone lands on
+/// the row the live identifier is stored under rather than on the raw cookie
+/// value. An identifier no module this deployment reads owns produces no key
+/// and is dropped, and with no module selected the built-in HMAC grammar
+/// decides, as
+/// [`AcceptedModules::canonical_kv_key`](super::module::AcceptedModules::canonical_kv_key)
+/// does. The two collapse to one key when they are the same identity written
+/// two ways.
+fn withdrawal_kv_keys(ec_context: &EcContext) -> HashSet<String> {
+    let mut keys = HashSet::new();
 
-    if let Some(cookie_ec_id) = ec_context.existing_cookie_ec_id()
-        && is_valid_ec_id(cookie_ec_id)
-    {
-        hashes.insert(cookie_ec_id.to_owned());
+    if let Some(cookie_kv_key) = ec_context.cookie_ec_kv_key() {
+        keys.insert(cookie_kv_key);
     }
 
-    if let Some(active_ec_id) = ec_context.ec_value()
-        && is_valid_ec_id(active_ec_id)
-    {
-        hashes.insert(active_ec_id.to_owned());
+    if let Some(active_kv_key) = ec_context.ec_kv_key() {
+        keys.insert(active_kv_key);
     }
 
-    hashes
+    keys
 }
 
-fn apply_withdrawal_tombstones<F>(ec_ids: &HashSet<String>, mut write_tombstone: F)
+fn apply_withdrawal_tombstones<F>(kv_keys: &HashSet<String>, mut write_tombstone: F)
 where
     F: FnMut(&str),
 {
-    for ec_id in ec_ids {
-        write_tombstone(ec_id);
+    for kv_key in kv_keys {
+        write_tombstone(kv_key);
     }
 }
 
@@ -531,6 +584,7 @@ mod tests {
     use super::*;
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY};
     use crate::openrtb::{Eid, Uid};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
@@ -565,6 +619,7 @@ mod tests {
         ec_was_present: bool,
         ec_generated: bool,
         jurisdiction: Jurisdiction,
+        ec_allowed: bool,
     ) -> EcContext {
         let consent = ConsentContext {
             jurisdiction,
@@ -578,6 +633,7 @@ mod tests {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
         )
     }
 
@@ -587,6 +643,7 @@ mod tests {
         ec_was_present: bool,
         ec_generated: bool,
         consent: ConsentContext,
+        ec_allowed: bool,
     ) -> EcContext {
         EcContext::new_for_test_with_cookie(
             ec_value.map(str::to_owned),
@@ -594,7 +651,40 @@ mod tests {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
+        )
+    }
+
+    fn canonicalizing_context(
+        ec_was_present: bool,
+        ec_generated: bool,
+        consent: ConsentContext,
+        ec_allowed: bool,
+    ) -> EcContext {
+        make_context_with_consent(
+            Some(CANONICAL_COOKIE_VALUE),
+            Some(CANONICAL_COOKIE_VALUE),
+            ec_was_present,
+            ec_generated,
+            consent,
+            ec_allowed,
         )
+        .with_module_for_test(std::sync::Arc::new(crate::ec::tests::CanonicalizingModule))
+    }
+
+    fn graph_with_live_canonical_row() -> KvIdentityGraph {
+        let graph = KvIdentityGraph::in_memory("finalize-canonical-store");
+        graph
+            .create(
+                CANONICAL_KV_KEY,
+                &crate::ec::kv_types::KvEntry::minimal(
+                    "ssp.example.com",
+                    "partner-uid-123",
+                    1_741_824_000,
+                ),
+            )
+            .expect("should write the row generation keys by the canonical form");
+        graph
     }
 
     fn sample_ec_id(suffix: &str) -> String {
@@ -621,70 +711,48 @@ mod tests {
     }
 
     #[test]
-    fn withdrawal_ec_ids_returns_cookie_ec_only_when_active_missing() {
-        let cookie_ec = sample_ec_id("cook1e");
-        let ec_context = make_context(None, Some(&cookie_ec), true, false, Jurisdiction::Unknown);
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 1, "should include exactly one EC ID");
-        assert!(
-            ids.contains(&cookie_ec),
-            "should include the cookie EC value"
-        );
-    }
-
-    #[test]
-    fn withdrawal_ec_ids_deduplicates_matching_cookie_and_active_ec() {
-        let ec_id = sample_ec_id("same01");
-        let ec_context = make_context(
-            Some(&ec_id),
-            Some(&ec_id),
-            true,
-            false,
-            Jurisdiction::Unknown,
-        );
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 1, "should deduplicate identical EC IDs");
-        assert!(ids.contains(&ec_id), "should retain the shared EC ID");
-    }
-
-    #[test]
-    fn withdrawal_ec_ids_includes_both_cookie_and_active_when_different() {
-        let active_ec = sample_ec_id("activ1");
-        let cookie_ec = sample_ec_id("cook1e");
-        let ec_context = make_context(
-            Some(&active_ec),
-            Some(&cookie_ec),
-            true,
-            false,
-            Jurisdiction::Unknown,
-        );
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 2, "should include both distinct EC IDs");
-        assert!(ids.contains(&active_ec), "should include active EC ID");
-        assert!(ids.contains(&cookie_ec), "should include cookie EC ID");
-    }
-
-    #[test]
-    fn withdrawal_ec_ids_filters_invalid_values() {
-        let valid_ec = sample_ec_id("valid1");
-        let ec_context = make_context(
-            Some(&valid_ec),
-            Some("not-an-ec-id"),
-            true,
-            false,
-            Jurisdiction::Unknown,
-        );
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 1, "should ignore malformed EC values");
-        assert!(ids.contains(&valid_ec), "should keep the valid EC ID");
+    fn withdrawal_kv_keys_covers_the_cookie_and_the_active_identifier() {
+        let active = sample_ec_id("activ1");
+        let cookie = sample_ec_id("cook1e");
+        let same = sample_ec_id("same01");
+        let valid = sample_ec_id("valid1");
+        for (case, active_ec, cookie_ec, expected) in [
+            (
+                "the cookie alone when no identifier is active",
+                None,
+                Some(cookie.as_str()),
+                vec![cookie.as_str()],
+            ),
+            (
+                "one key when the cookie and the active identifier match",
+                Some(same.as_str()),
+                Some(same.as_str()),
+                vec![same.as_str()],
+            ),
+            (
+                "both keys when the cookie and the active identifier differ",
+                Some(active.as_str()),
+                Some(cookie.as_str()),
+                vec![active.as_str(), cookie.as_str()],
+            ),
+            (
+                "no key for a malformed value",
+                Some(valid.as_str()),
+                Some("not-an-ec-id"),
+                vec![valid.as_str()],
+            ),
+        ] {
+            let ec_context = make_context(
+                active_ec,
+                cookie_ec,
+                true,
+                false,
+                Jurisdiction::Unknown,
+                false,
+            );
+            let expected: HashSet<String> = expected.into_iter().map(str::to_owned).collect();
+            assert_eq!(withdrawal_kv_keys(&ec_context), expected, "{case}");
+        }
     }
 
     #[test]
@@ -753,7 +821,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let kv = KvIdentityGraph::in_memory("test-store");
         let mut response = empty_response();
         let registry = PartnerRegistry::from_config(&[]).expect("should build registry");
@@ -794,7 +862,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let kv = KvIdentityGraph::stale_lookup("test-store", 1);
         kv.create(
             &ec_id,
@@ -850,7 +918,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         ec_context.set_kv_snapshot(EcKvSnapshot::Present {
             ec_id: ec_id.clone(),
             entry: Box::new(live_entry()),
@@ -897,7 +965,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let mut response = empty_response();
         set_header(&mut response, "x-ts-ec", "stale");
         set_header(&mut response, "x-ts-eids", "[]");
@@ -954,6 +1022,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -988,6 +1057,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -1022,6 +1092,7 @@ mod tests {
             false,
             true,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -1059,7 +1130,8 @@ mod tests {
             Some(orphaned_ec.clone()),
             consent,
             Some("192.0.2.10".to_owned()),
-        );
+        )
+        .with_module_for_test(crate::ec::tests::hmac_module());
         ec_context.set_recovery_eligible(true);
         ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
             ec_id: orphaned_ec.clone(),
@@ -1112,7 +1184,8 @@ mod tests {
             Some(orphaned_ec.clone()),
             purpose1_only_consent,
             Some("192.0.2.11".to_owned()),
-        );
+        )
+        .with_module_for_test(crate::ec::tests::hmac_module());
         ec_context.set_recovery_eligible(true);
         ec_context.set_eid_sync_source(EidSyncSource::Navigation);
         ec_context.set_client_eids(vec![Eid {
@@ -1307,8 +1380,14 @@ mod tests {
         graph
             .create(&ec_id, &live)
             .expect("should seed generated row");
-        let mut ec_context =
-            make_context(Some(&ec_id), None, false, true, Jurisdiction::NonRegulated);
+        let mut ec_context = make_context(
+            Some(&ec_id),
+            None,
+            false,
+            true,
+            Jurisdiction::NonRegulated,
+            true,
+        );
         ec_context.set_kv_snapshot(graph.load_snapshot(&ec_id));
         let partners = vec![make_partner("sharedid.org")];
         let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
@@ -1489,7 +1568,7 @@ mod tests {
         // `EcContext::set_client_eids`. That full set must land in KV even
         // when the cookie alone would have dropped a configured partner.
         let settings = create_test_settings();
-        let ec_id = sample_ec_id("cleids1");
+        let ec_id = sample_ec_id("cleid1");
         let graph = KvIdentityGraph::in_memory("test_store");
         let live = KvEntry::new(
             &granting_consent(),
@@ -1590,6 +1669,7 @@ mod tests {
             true,
             false,
             purpose1_only_consent,
+            true,
         );
         ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
             ec_id: ec_id.clone(),
@@ -1826,6 +1906,217 @@ mod tests {
         );
     }
 
+    /// A returning visitor's context on a recovery-eligible navigation whose
+    /// row is missing, with `module` selected.
+    fn orphan_context(
+        orphan: &str,
+        client_ip: Option<&str>,
+        module: std::sync::Arc<dyn crate::ec::module::EdgeCookieModule>,
+    ) -> EcContext {
+        let mut ec = EcContext::new_for_test_with_ip(
+            Some(orphan.to_owned()),
+            granting_consent(),
+            client_ip.map(str::to_owned),
+        )
+        .with_module_for_test(module);
+        ec.set_recovery_eligible(true);
+        ec.set_kv_snapshot(EcKvSnapshot::Missing {
+            ec_id: orphan.to_owned(),
+        });
+        ec
+    }
+
+    /// A store that holds no row and refuses every write, so a proven-absent
+    /// orphan reaches the replacement write and that write fails.
+    struct EmptyUnwritableEcKv;
+
+    impl crate::ec::kv_backend::EcKvStore for EmptyUnwritableEcKv {
+        fn store_name(&self) -> &str {
+            "empty-unwritable-store"
+        }
+
+        fn lookup(
+            &self,
+            _key: &str,
+        ) -> Result<
+            Option<crate::ec::kv_backend::EcKvLookup>,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Ok(None)
+        }
+
+        fn key_exists(
+            &self,
+            _key: &str,
+        ) -> Result<bool, error_stack::Report<crate::error::TrustedServerError>> {
+            Ok(false)
+        }
+
+        fn insert(
+            &self,
+            _key: &str,
+            _write: crate::ec::kv_backend::EcKvWrite<'_>,
+        ) -> Result<
+            crate::ec::kv_backend::EcKvWriteOutcome,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Err(error_stack::Report::new(
+                crate::error::TrustedServerError::KvStore {
+                    store_name: "empty-unwritable-store".to_owned(),
+                    message: "the test store refuses every write".to_owned(),
+                },
+            ))
+        }
+
+        fn list_keys_with_prefix(
+            &self,
+            _prefix: &str,
+            _limit: u32,
+        ) -> Result<Vec<String>, error_stack::Report<crate::error::TrustedServerError>> {
+            Ok(Vec::new())
+        }
+
+        fn delete(
+            &self,
+            _key: &str,
+        ) -> Result<(), error_stack::Report<crate::error::TrustedServerError>> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn an_orphan_recovery_that_cannot_rotate_leaves_a_failed_snapshot() {
+        // Recovery runs only once the orphan's row is proven absent. Each of
+        // these exits gives up without a replacement, and each must leave the
+        // orphan in place, write no cookie and record a failed snapshot for
+        // the orphan's key, so nothing later treats the miss as authoritative.
+        let settings = create_test_settings();
+        let hmac_orphan = sample_ec_id("orphn2");
+        let cases: [(&str, EcContext, KvIdentityGraph); 3] = [
+            (
+                "the HMAC module with no client IP",
+                orphan_context(&hmac_orphan, None, crate::ec::tests::hmac_module()),
+                KvIdentityGraph::in_memory("test_store"),
+            ),
+            (
+                "a store whose replacement write fails",
+                orphan_context(
+                    &hmac_orphan,
+                    Some("192.0.2.10"),
+                    crate::ec::tests::hmac_module(),
+                ),
+                KvIdentityGraph::new(EmptyUnwritableEcKv),
+            ),
+            (
+                "a replacement that always collides",
+                orphan_context(
+                    &hmac_orphan,
+                    Some("192.0.2.10"),
+                    crate::ec::tests::hmac_module(),
+                ),
+                KvIdentityGraph::new(crate::ec::tests::AddCollidingEcKv::new(u32::MAX)),
+            ),
+        ];
+        for (case, mut ec_context, graph) in cases {
+            let orphan = ec_context
+                .ec_value()
+                .expect("the context should carry the orphan")
+                .to_owned();
+            let orphan_kv_key = ec_context
+                .ec_kv_key()
+                .expect("the selected module should own the orphan");
+            let mut response = empty_response();
+
+            ec_finalize_response(
+                &settings,
+                &mut ec_context,
+                Some(&graph),
+                &PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+
+            assert_eq!(
+                ec_context.ec_value(),
+                Some(orphan.as_str()),
+                "{case}: the orphan must not rotate"
+            );
+            assert!(
+                !ec_context.ec_generated(),
+                "{case}: nothing should be marked as generated"
+            );
+            assert!(
+                get_header(&response, "set-cookie").is_none(),
+                "{case}: no replacement cookie should be written"
+            );
+            assert_eq!(
+                ec_context.kv_snapshot(),
+                &EcKvSnapshot::Failed {
+                    ec_id: orphan_kv_key,
+                },
+                "{case}: the orphan's key should carry a failed snapshot"
+            );
+        }
+    }
+
+    #[test]
+    fn an_orphan_rotation_applies_the_replacement_modules_response_headers() {
+        // A returning visitor runs no generation earlier in the request, so the
+        // headers the module asks for while creating the replacement reach
+        // the response through the rotation alone.
+        let settings = create_test_settings();
+        let mut ec_context = orphan_context(
+            "t0eh~orphaned-value",
+            Some("192.0.2.10"),
+            std::sync::Arc::new(EvidenceHeaderModule),
+        );
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        assert_eq!(
+            ec_context.ec_value(),
+            Some("t0eh~evidence-id"),
+            "the orphan should rotate to the module's replacement"
+        );
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should render set-cookie as utf-8"))
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("vendor-ev=abc")),
+            "the module's cookie should reach the response, got {cookies:?}"
+        );
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("ts-ec=t0eh~evidence-id")),
+            "the replacement Edge Cookie should be written, got {cookies:?}"
+        );
+        assert!(
+            response
+                .headers()
+                .get_all(http::header::VARY)
+                .iter()
+                .any(|value| value == "sec-ch-ua"),
+            "the module's Vary should reach the response"
+        );
+    }
+
     #[test]
     fn finalize_does_not_rotate_when_the_existence_check_fails() {
         // Absence is unprovable when the list itself errors. Rotation abandons a
@@ -1865,6 +2156,7 @@ mod tests {
             false,
             true,
             Jurisdiction::NonRegulated,
+            true,
         );
         ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
             ec_id: generated_ec,
@@ -1891,7 +2183,7 @@ mod tests {
     #[test]
     fn finalize_denied_without_cookie_is_noop() {
         let settings = create_test_settings();
-        let mut ec_context = make_context(None, None, false, false, Jurisdiction::Unknown);
+        let mut ec_context = make_context(None, None, false, false, Jurisdiction::Unknown, false);
         let mut response = empty_response();
 
         let test_registry = PartnerRegistry::empty();
@@ -1916,7 +2208,12 @@ mod tests {
     }
 
     #[test]
-    fn finalize_unknown_jurisdiction_strips_headers_without_expiring_cookie() {
+    fn finalize_not_permitted_without_withdrawal_keeps_cookie() {
+        // When EC is not permitted (here a fail-closed unknown jurisdiction with
+        // no geo) but the request carries no explicit withdrawal signal, the
+        // response strips EC headers yet must leave an already-issued cookie
+        // intact. A pre-consent or transient fail-closed request must not
+        // permanently withdraw a returning user before they get to consent.
         let settings = create_test_settings();
         let ec_id = sample_ec_id("unk001");
         let mut ec_context = make_context(
@@ -1925,6 +2222,7 @@ mod tests {
             true,
             false,
             Jurisdiction::Unknown,
+            false,
         );
         let mut response = empty_response();
         set_header(&mut response, "x-ts-ec", &ec_id);
@@ -1943,15 +2241,424 @@ mod tests {
 
         assert!(
             get_header(&response, "x-ts-ec").is_none(),
-            "should strip EC header when consent cannot be verified"
+            "should strip EC header when EC is not permitted"
         );
         assert!(
             get_header(&response, "x-ts-eids").is_none(),
-            "should strip EID header when consent cannot be verified"
+            "should strip EID header when EC is not permitted"
         );
         assert!(
             get_header(&response, "set-cookie").is_none(),
-            "should not expire the cookie without an explicit withdrawal signal"
+            "a not-permitted request without a withdrawal signal should keep the cookie"
+        );
+    }
+
+    #[test]
+    fn set_ec_cookie_on_response_writes_the_ts_ec_cookie() {
+        // The positive case: when an EC value is present, the finalize path
+        // writes the ts-ec cookie to the browser, carrying the EC id.
+        let settings = create_test_settings();
+        let ec_id = sample_ec_id("setck1");
+        let ec_context = make_context(
+            Some(&ec_id),
+            None,
+            false,
+            true,
+            Jurisdiction::NonRegulated,
+            true,
+        );
+        let mut response = empty_response();
+
+        set_ec_cookie_on_response(&settings, &ec_context, &mut response);
+
+        let set_cookie =
+            get_header_str(&response, "set-cookie").expect("an EC value should write a Set-Cookie");
+        assert!(
+            set_cookie.contains("ts-ec=") && set_cookie.contains(&ec_id),
+            "should write the ts-ec cookie carrying the EC id, got: {set_cookie}"
+        );
+    }
+
+    #[test]
+    fn the_consent_gate_decides_whether_a_generated_ec_cookie_is_written() {
+        // The generated identifier has a backing row and a snapshot bound to
+        // it, so the backing-row guard would let the cookie through and the
+        // consent gate is the only thing that can withhold it.
+        let settings = create_test_settings();
+        for (case, gate_open) in [("an open gate", true), ("a closed gate", false)] {
+            let ec_id = sample_ec_id("gated1");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &live_entry())
+                .expect("should seed the generated identifier's row");
+            let mut ec_context = make_context(
+                Some(&ec_id),
+                None,
+                false,
+                true,
+                Jurisdiction::NonRegulated,
+                gate_open,
+            );
+            ec_context.set_kv_snapshot(EcKvSnapshot::Present {
+                ec_id: ec_id.clone(),
+                entry: Box::new(live_entry()),
+                generation: None,
+            });
+            let mut response = empty_response();
+
+            ec_finalize_response(
+                &settings,
+                &mut ec_context,
+                Some(&graph),
+                &PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+
+            let wrote_ec_cookie = response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .any(|cookie| cookie.starts_with("ts-ec=") && cookie.contains(&ec_id));
+            assert_eq!(
+                wrote_ec_cookie, gate_open,
+                "{case}: the ts-ec cookie should be written only when the consent gate is open"
+            );
+        }
+    }
+
+    #[test]
+    fn withdrawal_tombstones_the_canonical_row_not_the_cookie_value() {
+        // The tombstone is the authoritative revocation marker, so it has to
+        // land on the key the live row uses. Written under the raw cookie
+        // value it creates a second row nothing reads, and the revocation
+        // never takes effect for a module whose canonical form differs.
+        let settings = create_test_settings();
+        let graph = graph_with_live_canonical_row();
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+            gpc: true,
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        let mut ec_context = canonicalizing_context(true, false, consent, false);
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let (live_row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the canonical row")
+            .expect("the canonical row should still exist");
+        assert!(
+            !live_row.consent.ok,
+            "withdrawal should tombstone the row the live identifier is keyed by"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_COOKIE_VALUE)
+                .expect("should read the graph")
+                .is_none(),
+            "withdrawal should not write a tombstone under the raw cookie value"
+        );
+    }
+
+    #[test]
+    fn eid_ingestion_keys_by_the_modules_canonical_form() {
+        // An ingested EID must join the row the identifier already has. Keyed
+        // by the raw cookie value the upsert finds no row and the partner ID
+        // is dropped.
+        let settings = create_test_settings();
+        let graph = graph_with_live_canonical_row();
+        let partners = vec![make_partner("sharedid.org")];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::NonRegulated,
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        let mut ec_context = canonicalizing_context(true, false, consent, true);
+        ec_context.set_eid_sync_source(EidSyncSource::Navigation);
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            None,
+            Some("shared-cookie-id"),
+            &mut response,
+        );
+
+        let (row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the canonical row")
+            .expect("the canonical row should still exist");
+        assert_eq!(
+            row.ids.get("sharedid.org").map(|id| id.uid.as_str()),
+            Some("shared-cookie-id"),
+            "the ingested EID should land on the row keyed by the canonical form"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_COOKIE_VALUE)
+                .expect("should read the graph")
+                .is_none(),
+            "EID ingestion should not create a row under the raw cookie value"
+        );
+    }
+
+    /// A module that sets one cookie of its own and one `Vary` entry, the
+    /// two response effects a module realistically asks for, so a test can
+    /// watch both land on a response the origin already wrote headers to.
+    #[derive(Debug)]
+    struct EvidenceHeaderModule;
+
+    impl crate::ec::module::EdgeCookieModule for EvidenceHeaderModule {
+        fn id(&self) -> &'static str {
+            "evidence-header"
+        }
+
+        fn code(&self) -> crate::ec::module::ModuleCode {
+            crate::module_code!("t0eh")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn crate::evidence::RequestInfo,
+            _input: &crate::ec::module::IdentityInput<'_>,
+        ) -> Result<
+            crate::ec::module::GeneratedEdgeCookie,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Ok(crate::ec::module::GeneratedEdgeCookie {
+                id: Some("evidence-id".to_owned()),
+                response_headers: vec![
+                    (
+                        http::header::SET_COOKIE,
+                        HeaderValue::from_static("vendor-ev=abc; Path=/"),
+                    ),
+                    (http::header::VARY, HeaderValue::from_static("sec-ch-ua")),
+                ],
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    #[test]
+    fn module_response_headers_reach_the_response_without_dropping_the_origins() {
+        // The response finalization runs on is the finished one, so it already
+        // carries the publisher origin's own headers. A module effect must
+        // add to those, never replace them: replacing `Set-Cookie` would drop
+        // the publisher's session and sign-in cookies, and replacing `Vary`
+        // would break the caching the origin asked for.
+        let settings = create_test_settings();
+        let graph = KvIdentityGraph::in_memory("finalize-module-headers-store");
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::NonRegulated,
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        let mut ec_context = make_context_with_consent(None, None, false, false, consent, true)
+            .with_module_for_test(std::sync::Arc::new(EvidenceHeaderModule));
+        ec_context
+            .generate_if_needed(&settings, Some(&graph))
+            .expect("should create the identifier through the module");
+
+        // What the publisher's origin returned, before EC finalization runs.
+        let mut response = empty_response();
+        response.headers_mut().append(
+            http::header::SET_COOKIE,
+            HeaderValue::from_static("publisher_session=origin-value; Path=/; HttpOnly"),
+        );
+        response.headers_mut().append(
+            http::header::VARY,
+            HeaderValue::from_static("accept-encoding"),
+        );
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should render set-cookie as utf-8"))
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("publisher_session=origin-value")),
+            "the origin's own cookie must survive a module effect, got {cookies:?}"
+        );
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("vendor-ev=abc")),
+            "the module's cookie must reach the response, got {cookies:?}"
+        );
+        assert!(
+            cookies.iter().any(|cookie| cookie.starts_with("ts-ec=")),
+            "core's own managed cookie must still be written, got {cookies:?}"
+        );
+
+        let vary: Vec<&str> = response
+            .headers()
+            .get_all(http::header::VARY)
+            .iter()
+            .map(|value| value.to_str().expect("should render vary as utf-8"))
+            .collect();
+        assert!(
+            vary.contains(&"accept-encoding"),
+            "the origin's Vary must survive a module effect, got {vary:?}"
+        );
+        assert!(
+            vary.contains(&"sec-ch-ua"),
+            "the module's Vary must reach the response, got {vary:?}"
+        );
+    }
+
+    /// A module standing in for the one a deployment switched *to*, with a
+    /// different registered code from the module that created the live row.
+    #[derive(Debug)]
+    struct SwitchedModule;
+
+    impl crate::ec::module::EdgeCookieModule for SwitchedModule {
+        fn id(&self) -> &'static str {
+            "switched"
+        }
+
+        fn code(&self) -> crate::ec::module::ModuleCode {
+            crate::module_code!("t0sw")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn crate::evidence::RequestInfo,
+            _input: &crate::ec::module::IdentityInput<'_>,
+        ) -> Result<
+            crate::ec::module::GeneratedEdgeCookie,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Ok(crate::ec::module::GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_ascii_lowercase()
+        }
+    }
+
+    #[test]
+    fn switching_module_leaves_the_previous_modules_row_beyond_withdrawal() {
+        // A retired module's identifier is owned by nobody this deployment
+        // reads, so a later withdrawal expires the browser cookie but cannot
+        // tombstone the row, and the identifier is never adopted either.
+        let settings = create_test_settings();
+        let graph = graph_with_live_canonical_row();
+        // A TCF record consenting to nothing, under GDPR, so the request
+        // carries an explicit refusal of storage. That is the narrow,
+        // destructive kind of withdrawal, the one that tombstones rather than
+        // merely suppressing, which is the behavior under test.
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::Gdpr,
+            tcf: Some(crate::consent::TcfConsent {
+                version: 2,
+                cmp_id: 0,
+                cmp_version: 0,
+                consent_screen: 0,
+                consent_language: "EN".to_owned(),
+                vendor_list_version: 0,
+                tcf_policy_version: 2,
+                created_ds: 0,
+                last_updated_ds: 0,
+                purpose_consents: vec![false; 24],
+                purpose_legitimate_interests: vec![false; 24],
+                vendor_consents: Vec::new(),
+                vendor_legitimate_interests: Vec::new(),
+                special_feature_opt_ins: vec![false; 12],
+            }),
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        // The browser still carries the identifier the previous module
+        // created, but the deployment now runs a module with a different
+        // code, so read-back treats the cookie as absent and the active
+        // identifier is empty.
+        let mut ec_context = make_context_with_consent(
+            None,
+            Some(CANONICAL_COOKIE_VALUE),
+            false,
+            false,
+            consent,
+            false,
+        )
+        .with_module_for_test(std::sync::Arc::new(SwitchedModule));
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        assert!(
+            ec_context.ec_value().is_none(),
+            "the retired module's identifier must never be adopted by the new one"
+        );
+
+        let (row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the previous module's row")
+            .expect("the previous module's row should still exist");
+        assert!(
+            row.consent.ok,
+            "withdrawal cannot reach a retired module's row without the module that owns the code"
+        );
+
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should render set-cookie as utf-8"))
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("ts-ec=") && cookie.contains("Max-Age=0")),
+            "withdrawal should still expire the browser cookie after a switch, got {cookies:?}"
         );
     }
 
@@ -1976,7 +2683,8 @@ mod tests {
             Some(orphan.to_owned()),
             granting_consent(),
             Some("192.0.2.10".to_owned()),
-        );
+        )
+        .with_module_for_test(crate::ec::tests::hmac_module());
         ec.set_recovery_eligible(recovery_eligible);
         ec.set_kv_snapshot(snapshot);
         ec
@@ -2112,8 +2820,14 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context =
-            make_context_with_consent(Some(&active_ec), Some(&cookie_ec), true, false, consent);
+        let mut ec_context = make_context_with_consent(
+            Some(&active_ec),
+            Some(&cookie_ec),
+            true,
+            false,
+            consent,
+            false,
+        );
         // Carry a snapshot only for the active ID; the other ID must be looked up
         // independently and never created if absent.
         let graph = KvIdentityGraph::in_memory("test_store");
@@ -2158,8 +2872,14 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context =
-            make_context_with_consent(Some(&active_ec), Some(&cookie_ec), true, false, consent);
+        let mut ec_context = make_context_with_consent(
+            Some(&active_ec),
+            Some(&cookie_ec),
+            true,
+            false,
+            consent,
+            false,
+        );
         let graph = KvIdentityGraph::in_memory("test_store");
         graph
             .create(
@@ -2253,7 +2973,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         ec_context.set_pull_sync_marker_for_test(
             crate::ec::pull_sync_marker::PullSyncMarkerState::Invalid,
         );
@@ -2311,6 +3031,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut entry = live_entry();
         entry.ids.insert(
@@ -2359,7 +3080,7 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context = make_context_with_consent(None, None, false, false, consent);
+        let mut ec_context = make_context_with_consent(None, None, false, false, consent, false);
         let mut response = empty_response();
 
         ec_finalize_response(
@@ -2387,7 +3108,7 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context = make_context_with_consent(None, None, false, false, consent);
+        let mut ec_context = make_context_with_consent(None, None, false, false, consent, false);
         ec_context.set_pull_sync_marker_for_test(
             crate::ec::pull_sync_marker::PullSyncMarkerState::Invalid,
         );
diff --git a/crates/trusted-server-core/src/ec/generation.rs b/crates/trusted-server-core/src/ec/generation.rs
index 6b9ed27166..7fb583b305 100644
--- a/crates/trusted-server-core/src/ec/generation.rs
+++ b/crates/trusted-server-core/src/ec/generation.rs
@@ -1,7 +1,8 @@
 //! Edge Cookie (EC) ID generation using HMAC.
 //!
-//! This module generates EC IDs from the client IP address and a configured
-//! secret key.
+//! This module creates EC IDs as an HMAC, keyed by a configured secret, over
+//! one or more request parts such as the client IP, and holds the format
+//! helpers for the built-in HMAC identifier.
 
 use std::net::IpAddr;
 
@@ -10,8 +11,8 @@ use hmac::{Hmac, KeyInit as _, Mac};
 use rand::Rng;
 use sha2::Sha256;
 
+use crate::ec::module::{HMAC_MODULE_CODE, MODULE_CODE_SEPARATOR, split_module_code};
 use crate::error::TrustedServerError;
-use crate::settings::Settings;
 
 type HmacSha256 = Hmac<Sha256>;
 
@@ -73,7 +74,7 @@ fn generate_random_suffix(length: usize) -> String {
 /// the client IP address, then appends a random suffix for additional
 /// uniqueness. The resulting format is `{64hex}.{6alnum}`.
 ///
-/// **Important:** `client_ip` must be pre-normalized via [`extract_client_ip`].
+/// **Important:** `client_ip` must be pre-normalized with `normalize_ip`.
 /// Raw IPv6 addresses produce different hashes than their normalized /64
 /// form, which would create duplicate identity graph entries.
 ///
@@ -81,19 +82,40 @@ fn generate_random_suffix(length: usize) -> String {
 ///
 /// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
 pub fn generate_ec_id(
-    settings: &Settings,
+    passphrase: &str,
     client_ip: &str,
 ) -> Result<String, Report<TrustedServerError>> {
-    let mut mac = HmacSha256::new_from_slice(settings.ec.passphrase.expose().as_bytes())
-        .change_context(TrustedServerError::EdgeCookie {
+    generate_hmac_ec_id(passphrase, &[client_ip])
+}
+
+/// Creates an Edge Cookie identifier as HMAC-SHA256 over the given parts plus a
+/// random suffix, in the `{64hex}.{6alnum}` format.
+///
+/// The parts are joined with a unit separator (`\u{1f}`), which cannot appear in
+/// a client IP, User-Agent, or TLS and HTTP/2 signal, so distinct part lists
+/// cannot collide. A module that derives identity from multiple request
+/// signals, for example a TLS fingerprint, HTTP/2 settings and the client IP,
+/// passes them as separate parts. Each part must be pre-normalized by the
+/// caller.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
+pub fn generate_hmac_ec_id(
+    passphrase: &str,
+    parts: &[&str],
+) -> Result<String, Report<TrustedServerError>> {
+    let mut mac = HmacSha256::new_from_slice(passphrase.as_bytes()).change_context(
+        TrustedServerError::EdgeCookie {
             message: "Failed to create HMAC instance".to_string(),
-        })?;
-    mac.update(client_ip.as_bytes());
+        },
+    )?;
+    // A unit separator cannot occur in any part, so distinct lists never collide.
+    mac.update(parts.join("\u{1f}").as_bytes());
     let hmac_hash = hex::encode(mac.finalize().into_bytes());
 
-    // Append random 6-character alphanumeric suffix for additional uniqueness.
-    let random_suffix = generate_random_suffix(6);
-    let ec_id = format!("{hmac_hash}.{random_suffix}");
+    // Append a random 6-character alphanumeric suffix for additional uniqueness.
+    let ec_id = format!("{hmac_hash}.{}", generate_random_suffix(6));
 
     log::trace!("Generated fresh EC ID: {}", super::log_id(&ec_id));
 
@@ -120,12 +142,33 @@ pub fn ec_hash(ec_id: &str) -> &str {
 /// so internal EC IDs are already lowercase. This normalization is a
 /// defense-in-depth measure for EC IDs submitted by external partners
 /// (via batch sync) that may use uppercase hex.
+///
+/// A created identifier carries the built-in module's code envelope
+/// (`hmac~` before the value, see
+/// [`MODULE_CODE_SEPARATOR`](super::module::MODULE_CODE_SEPARATOR)),
+/// and partners echo that form back, so the envelope is kept and only the
+/// value inside it is lowercased. That keeps the key identical to the one
+/// written at creation. An identifier under any other module's code is not
+/// HMAC-shaped and is returned unchanged, because only that module knows
+/// how to normalize it.
 #[must_use]
 pub fn normalize_ec_id_for_kv(ec_id: &str) -> String {
-    let mut parts = ec_id.splitn(2, '.');
+    let (code, bare) = match split_module_code(ec_id) {
+        (Some(code), bare) if code == HMAC_MODULE_CODE.as_str() => (Some(code), bare),
+        (Some(_), _) => return ec_id.to_owned(),
+        (None, bare) => (None, bare),
+    };
+    let mut parts = bare.splitn(2, '.');
     let hash = parts.next().unwrap_or_default();
     let suffix = parts.next().unwrap_or_default();
-    format!("{}.{}", hash.to_ascii_lowercase(), suffix)
+    match code {
+        Some(code) => format!(
+            "{code}{MODULE_CODE_SEPARATOR}{}.{}",
+            hash.to_ascii_lowercase(),
+            suffix
+        ),
+        None => format!("{}.{}", hash.to_ascii_lowercase(), suffix),
+    }
 }
 
 /// Checks whether a string is a valid 64-character hex EC hash prefix.
@@ -139,17 +182,35 @@ pub fn is_valid_ec_hash(value: &str) -> bool {
     value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit())
 }
 
-/// Checks whether a string matches the expected EC ID format.
+/// Checks whether a string is a built-in HMAC identifier, bare or enveloped.
 ///
-/// The format is `{64hex}.{6alnum}` where the first part is a 64-character
-/// **lowercase** hex string and the second part is a 6-character alphanumeric
-/// string. Only lowercase hex is accepted; callers must normalize before
-/// validation to prevent duplicate KV keys from case-variant EC IDs. The HMAC
-/// prefix is lowercase because it comes from `hex::encode`; the random suffix
-/// allows mixed-case alphanumeric characters by construction.
+/// The bare format is `{64hex}.{6alnum}` where the first part is a
+/// 64-character **lowercase** hex string and the second part is a 6-character
+/// alphanumeric string. Only lowercase hex is accepted; callers must
+/// normalize before validation to prevent duplicate KV keys from case-variant
+/// EC IDs. The HMAC prefix is lowercase because it comes from `hex::encode`;
+/// the random suffix allows mixed-case alphanumeric characters by
+/// construction.
+///
+/// An identifier this module creates carries the module-code envelope,
+/// `hmac~` before the bare value, so both the enveloped and the legacy bare
+/// form are accepted here. An identifier under any other module's code is
+/// not an HMAC identifier and is rejected.
+///
+/// This is the built-in module's grammar, not the deployment's. The
+/// partner-facing paths (pull sync, batch sync, the admin lookup) dispatch by
+/// module code through
+/// [`AcceptedModules`](super::module::AcceptedModules), which reaches
+/// this only for an identifier the built-in module owns, or as the fallback
+/// for a stateless deployment that has selected no module at all.
 #[must_use]
 pub fn is_valid_ec_id(value: &str) -> bool {
-    let mut parts = value.split('.');
+    let bare = match split_module_code(value) {
+        (Some(code), bare) if code == HMAC_MODULE_CODE.as_str() => bare,
+        (Some(_), _) => return false,
+        (None, bare) => bare,
+    };
+    let mut parts = bare.split('.');
     let Some(hmac_part) = parts.next() else {
         return false;
     };
@@ -175,7 +236,39 @@ mod tests {
     use super::*;
     use std::net::{Ipv4Addr, Ipv6Addr};
 
-    use crate::test_support::tests::create_test_settings;
+    const TEST_PASSPHRASE: &str = "test-secret-key-32-bytes-minimum";
+
+    #[test]
+    fn generate_hmac_ec_id_is_stable_per_parts_and_collision_resistant() {
+        // The 64-char hex prefix is HMAC over the parts and is stable for the
+        // same parts; the random suffix varies, so compare prefixes only.
+        let prefix = |parts: &[&str]| {
+            generate_hmac_ec_id(TEST_PASSPHRASE, parts)
+                .expect("should generate")
+                .split('.')
+                .next()
+                .expect("should have a prefix")
+                .to_owned()
+        };
+
+        assert_eq!(
+            prefix(&["a", "b"]),
+            prefix(&["a", "b"]),
+            "the same parts should yield the same stable prefix"
+        );
+        assert_ne!(
+            prefix(&["a", "b"]),
+            prefix(&["a", "c"]),
+            "different parts should yield a different prefix"
+        );
+        // The unit separator prevents a join collision: ["a", "b"] must not hash
+        // the same as ["ab"].
+        assert_ne!(
+            prefix(&["a", "b"]),
+            prefix(&["ab"]),
+            "the separator should prevent ['a','b'] colliding with ['ab']"
+        );
+    }
 
     #[test]
     fn normalize_ipv4_unchanged() {
@@ -215,8 +308,7 @@ mod tests {
 
     #[test]
     fn generate_produces_valid_format() {
-        let settings = create_test_settings();
-        let ec_id = generate_ec_id(&settings, "192.168.1.1").expect("should generate EC ID");
+        let ec_id = generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate EC ID");
         assert!(
             is_valid_ec_id(&ec_id),
             "should match EC ID format: {{64hex}}.{{6alnum}}, got: {ec_id}"
@@ -225,10 +317,10 @@ mod tests {
 
     #[test]
     fn generate_same_ip_produces_consistent_hash_prefix() {
-        let settings = create_test_settings();
-        let first = generate_ec_id(&settings, "192.168.1.1").expect("should generate first EC ID");
+        let first =
+            generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate first EC ID");
         let second =
-            generate_ec_id(&settings, "192.168.1.1").expect("should generate second EC ID");
+            generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate second EC ID");
 
         assert_eq!(
             ec_hash(&first),
@@ -281,44 +373,50 @@ mod tests {
     }
 
     #[test]
-    fn is_valid_ec_id_accepts_valid() {
-        let value = format!("{}.Ab12z9", "a".repeat(64));
-        assert!(is_valid_ec_id(&value), "should accept a valid EC ID format");
-    }
-
-    #[test]
-    fn is_valid_ec_id_rejects_missing_suffix() {
-        let missing_suffix = "a".repeat(64);
-        assert!(
-            !is_valid_ec_id(&missing_suffix),
-            "should reject missing suffix"
-        );
-    }
-
-    #[test]
-    fn is_valid_ec_id_rejects_invalid_hex() {
-        let invalid_hex = format!("{}.Ab12z9", "a".repeat(63) + "g");
-        assert!(
-            !is_valid_ec_id(&invalid_hex),
-            "should reject non-hex HMAC content"
-        );
+    fn is_valid_ec_id_accepts_only_the_hmac_grammar() {
+        let hash = "a".repeat(64);
+        for (input, expected, reason) in [
+            (format!("{hash}.Ab12z9"), true, "a valid EC ID format"),
+            (hash.clone(), false, "a missing suffix"),
+            (
+                format!("{}.Ab12z9", "a".repeat(63) + "g"),
+                false,
+                "non-hex HMAC content",
+            ),
+            (format!("{hash}.ab-129"), false, "a non-alphanumeric suffix"),
+            (format!("{hash}.Ab12z9.zz"), false, "an extra segment"),
+            (
+                format!("hmac~{hash}.ABC123"),
+                true,
+                "a created identifier carrying the hmac code",
+            ),
+            (
+                format!("t0op~{hash}.ABC123"),
+                false,
+                "an identifier carrying another module's code",
+            ),
+        ] {
+            assert_eq!(
+                is_valid_ec_id(&input),
+                expected,
+                "{reason} should be {}: {input}",
+                if expected { "accepted" } else { "rejected" }
+            );
+        }
     }
 
     #[test]
-    fn is_valid_ec_id_rejects_invalid_suffix() {
-        let invalid_suffix = format!("{}.ab-129", "a".repeat(64));
-        assert!(
-            !is_valid_ec_id(&invalid_suffix),
-            "should reject non-alphanumeric suffix"
+    fn normalize_ec_id_for_kv_keeps_the_hmac_envelope() {
+        let coded = format!("hmac~{}.ABC123", "A".repeat(64));
+        assert_eq!(
+            normalize_ec_id_for_kv(&coded),
+            format!("hmac~{}.ABC123", "a".repeat(64)),
+            "should lowercase the hash and keep the code prefix"
         );
-    }
-
-    #[test]
-    fn is_valid_ec_id_rejects_extra_segments() {
-        let extra_segment = format!("{}.Ab12z9.zz", "a".repeat(64));
-        assert!(
-            !is_valid_ec_id(&extra_segment),
-            "should reject extra segments"
+        assert_eq!(
+            normalize_ec_id_for_kv("t0op~MixedCase"),
+            "t0op~MixedCase",
+            "should leave another module's identifier unchanged"
         );
     }
 }
diff --git a/crates/trusted-server-core/src/ec/identify.rs b/crates/trusted-server-core/src/ec/identify.rs
index 94464d1a57..cf017a04a5 100644
--- a/crates/trusted-server-core/src/ec/identify.rs
+++ b/crates/trusted-server-core/src/ec/identify.rs
@@ -10,7 +10,6 @@ use http::{Request, Response, StatusCode};
 use url::Url;
 
 use super::auth::authenticate_bearer;
-use super::consent::ec_consent_granted;
 use crate::error::TrustedServerError;
 use crate::openrtb::{Eid, Uid};
 use crate::settings::Settings;
@@ -62,7 +61,7 @@ pub fn handle_identify(
         );
     };
 
-    if !ec_consent_granted(ec_context.consent()) {
+    if !ec_context.ec_allowed() {
         return json_response_with_origin(
             StatusCode::FORBIDDEN,
             &serde_json::json!({ "consent": "denied" }),
@@ -87,40 +86,53 @@ pub fn handle_identify(
     let mut uid: Option<String> = None;
     let mut cluster_size: Option<u32> = None;
 
-    match kv.get(ec_id) {
-        Ok(Some((entry, generation))) => {
-            if !entry.consent.ok {
-                // Tombstone entries preserve the withdrawal signal for 24 hours.
-                // Do not extract IDs or evaluate cluster size because that would
-                // write back with the live-entry TTL.
-                log::trace!("Identify found tombstone for '{}'", log_id(ec_id));
-            } else {
-                // Extract only this partner's UID.
-                if let Some(partner_uid) = entry.ids.get(&partner.source_domain)
-                    && !partner_uid.uid.is_empty()
-                {
-                    uid = Some(partner_uid.uid.clone());
-                }
-
-                // Evaluate cluster size lazily for identify responses. Existing
-                // stored cluster_size values are reused without a prefix-list call.
-                match kv.evaluate_cluster(ec_id, &entry, generation) {
-                    Ok(size) => {
-                        cluster_size = size;
+    // Read the identity-graph row under the module's canonical form of the
+    // identifier, the same key generation wrote, rather than under the value the
+    // browser carries. The two are the same string for the built-in HMAC
+    // module and differ for any module whose canonical form is not the
+    // cookie value. `None` means no module this deployment reads owns the
+    // identifier, so there is no row to look for and the response is not
+    // degraded.
+    if let Some(kv_key) = ec_context.ec_kv_key() {
+        match kv.get(&kv_key) {
+            Ok(Some((entry, generation))) => {
+                if !entry.consent.ok {
+                    // Tombstone entries preserve the withdrawal signal for 24
+                    // hours. Do not extract IDs or evaluate cluster size because
+                    // that would write back with the live-entry TTL.
+                    log::trace!("Identify found tombstone for '{}'", log_id(&kv_key));
+                } else {
+                    // Extract only this partner's UID.
+                    if let Some(partner_uid) = entry.ids.get(&partner.source_domain)
+                        && !partner_uid.uid.is_empty()
+                    {
+                        uid = Some(partner_uid.uid.clone());
                     }
-                    Err(err) => {
-                        log::warn!("Cluster evaluation failed for '{}': {err:?}", log_id(ec_id));
+
+                    // Evaluate cluster size lazily for identify responses.
+                    // Existing stored cluster_size values are reused without a
+                    // prefix-list call.
+                    match kv.evaluate_cluster(&kv_key, &entry, generation) {
+                        Ok(size) => {
+                            cluster_size = size;
+                        }
+                        Err(err) => {
+                            log::warn!(
+                                "Cluster evaluation failed for '{}': {err:?}",
+                                log_id(&kv_key)
+                            );
+                        }
                     }
                 }
             }
-        }
-        Ok(None) => {}
-        Err(err) => {
-            log::warn!(
-                "Identify KV read failed for EC ID '{}': {err:?}",
-                log_id(ec_id)
-            );
-            degraded = true;
+            Ok(None) => {}
+            Err(err) => {
+                log::warn!(
+                    "Identify KV read failed for EC ID '{}': {err:?}",
+                    log_id(&kv_key)
+                );
+                degraded = true;
+            }
         }
     }
 
@@ -332,9 +344,9 @@ fn apply_cors_headers(response: &mut Response<EdgeBody>, origin: &str) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
     use crate::ec::registry::PartnerRegistry;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
     use crate::test_support::tests::create_test_settings;
@@ -352,13 +364,12 @@ mod tests {
         );
     }
 
-    fn make_ec_context(jurisdiction: Jurisdiction, ec_value: Option<&str>) -> EcContext {
+    fn make_ec_context(ec_allowed: bool, ec_value: Option<&str>) -> EcContext {
         let consent = ConsentContext {
-            jurisdiction,
             source: ConsentSource::Cookie,
             ..ConsentContext::default()
         };
-        EcContext::new_for_test(ec_value.map(str::to_owned), consent)
+        EcContext::new_for_test_gated(ec_value.map(str::to_owned), consent, ec_allowed)
     }
 
     fn make_test_partner(source_domain: &str, api_token: &str) -> EcPartner {
@@ -472,7 +483,7 @@ mod tests {
             .uri("https://edge.test-publisher.com/identify")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct unauthorized response");
@@ -514,7 +525,7 @@ mod tests {
             .header("authorization", "Bearer wrong-token")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct unauthorized response");
@@ -539,7 +550,7 @@ mod tests {
             .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::Unknown, None);
+        let ec_context = make_ec_context(false, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct denied response");
@@ -573,7 +584,7 @@ mod tests {
             .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct no-content response");
@@ -599,7 +610,7 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build test request");
         let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let ec_context = make_ec_context(true, Some(&ec_id));
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct degraded identify response");
@@ -652,7 +663,7 @@ mod tests {
             .header("origin", "https://evil.example")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct forbidden response");
@@ -678,7 +689,7 @@ mod tests {
             .header("origin", "https://www.test-publisher.com")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct no-content response with CORS headers");
@@ -756,4 +767,55 @@ mod tests {
             "should vary on identity request inputs for preflight"
         );
     }
+
+    #[test]
+    fn handle_identify_reads_the_row_under_the_modules_canonical_key() {
+        // A module whose canonical form is not the cookie value keys its row
+        // under the canonical form at generation. Identify has to look there,
+        // or every such deployment reads a miss for every request and reports
+        // no partner UID at all.
+        let settings = create_test_settings();
+        let kv = KvIdentityGraph::in_memory("identify-canonical-store");
+        kv.create(
+            CANONICAL_KV_KEY,
+            &crate::ec::kv_types::KvEntry::minimal(
+                "ssp.example.com",
+                "partner-uid-123",
+                1_741_824_000,
+            ),
+        )
+        .expect("should write the row generation keys by the canonical form");
+        let partners = vec![make_test_partner("ssp.example.com", VALID_API_TOKEN)];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let req = Request::builder()
+            .method("GET")
+            .uri("https://edge.test-publisher.com/identify")
+            .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        let ec_context = make_ec_context(true, Some(CANONICAL_COOKIE_VALUE))
+            .with_module_for_test(std::sync::Arc::new(crate::ec::tests::CanonicalizingModule));
+
+        let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
+            .expect("should build identify response");
+
+        assert_eq!(response.status(), StatusCode::OK, "should return 200");
+        let body = serde_json::from_slice::<serde_json::Value>(
+            &response.into_body().into_bytes().unwrap_or_default(),
+        )
+        .expect("should decode identify response JSON");
+        assert_eq!(
+            body["ec"], CANONICAL_COOKIE_VALUE,
+            "should echo the identifier the browser carries, not the graph key"
+        );
+        assert_eq!(
+            body["uid"], "partner-uid-123",
+            "should find the row generation keyed by the module's canonical form"
+        );
+        assert_eq!(
+            body["degraded"],
+            serde_json::Value::Bool(false),
+            "a hit under the canonical key is not a degraded read"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/kv.rs b/crates/trusted-server-core/src/ec/kv.rs
index b0eb83d3fa..071ea29d6a 100644
--- a/crates/trusted-server-core/src/ec/kv.rs
+++ b/crates/trusted-server-core/src/ec/kv.rs
@@ -1502,6 +1502,13 @@ impl KvIdentityGraph {
         }
 
         // Compute cluster size via prefix list.
+        //
+        // `ec_hash` takes everything before the first `.`, so a coded
+        // identifier yields `hmac~<hash>` and a bare one yields `<hash>`.
+        // Prefix matching is anchored at the start of the key, so bare and
+        // `hmac~` rows for one client IP are counted separately and
+        // `cluster_size` can under-report. The count is reported in identify
+        // responses and gates nothing, and it must not gate a decision.
         let hash_prefix = ec_hash(ec_id);
         let cluster_size = self.count_hash_prefix_keys(hash_prefix)?;
 
diff --git a/crates/trusted-server-core/src/ec/kv_types.rs b/crates/trusted-server-core/src/ec/kv_types.rs
index 589f280c11..8eb1bcc2d8 100644
--- a/crates/trusted-server-core/src/ec/kv_types.rs
+++ b/crates/trusted-server-core/src/ec/kv_types.rs
@@ -58,7 +58,9 @@ pub struct KvEntry {
     /// Network cluster disambiguation data.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub network: Option<KvNetwork>,
-    /// Map of partner ID namespace → UID record.
+    /// Map of partner ID namespace to that partner's identifier for the same
+    /// browser on the same device, never an identifier for a person.
+    ///
     /// Populated by pixel sync, batch sync, and pull sync operations.
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub ids: BTreeMap<String, KvPartnerId>,
@@ -181,7 +183,12 @@ pub struct KvDevice {
 ///
 /// Tracks how many distinct EC entries share the same hash prefix. A high
 /// count indicates a shared network (corporate VPN, campus); a low count
-/// indicates an individual or household.
+/// indicates a small one, such as a home connection.
+///
+/// The count is a fact about a network and identifies no person. An Edge
+/// Cookie identifies a browser on a device, and the partner identifiers in
+/// [`KvEntry::ids`] are other parties' identifiers for that same browser and
+/// device.
 ///
 /// Written only by the `/_ts/api/v1/identify` endpoint when `cluster_size` is
 /// missing. Once stored, the value is reused because the EC entry no longer
diff --git a/crates/trusted-server-core/src/ec/mod.rs b/crates/trusted-server-core/src/ec/mod.rs
index f24c489edd..94fbaa1a0b 100644
--- a/crates/trusted-server-core/src/ec/mod.rs
+++ b/crates/trusted-server-core/src/ec/mod.rs
@@ -14,14 +14,19 @@
 //! # Module structure
 //!
 //! - auth (private) — shared Bearer-token authentication helpers
+//! - [`admin`]: operator endpoints that show the stored identity state
+//!   (`GET /_ts/admin/ec`)
 //! - [`generation`] — HMAC-based ID generation, IP normalization, format helpers
 //! - [`consent`] — EC-specific consent gating wrapper
 //! - [`cookies`] — `Set-Cookie` header creation and expiration helpers
+//! - [`finalize`]: the cookie and identity-graph writes made on the response
+//!   after routing
 //! - [`kv`] — KV Store identity graph operations (CAS, tombstones, debounce)
 //! - [`kv_backend`] — Platform-neutral KV primitives implemented by adapters
 //! - [`kv_types`] — Schema types for KV identity graph entries
 //! - [`device`]: Device signal derivation (UA, JA4, H2 SETTINGS)
 //! - [`partner`] — Partner validation helpers (ID format, pull sync config)
+//! - [`module`]: Edge Cookie modules and their selection
 //! - [`registry`] — In-memory partner registry built from config
 //! - [`rate_limiter`] — Rate limiting abstraction (implemented by adapters)
 //! - [`identify`] — Identity read endpoint (`GET /_ts/api/v1/identify`)
@@ -43,6 +48,7 @@ pub mod identify;
 pub mod kv;
 pub mod kv_backend;
 pub mod kv_types;
+pub mod module;
 pub mod partner;
 pub mod prebid_eids;
 pub mod pull_sync;
@@ -67,6 +73,8 @@ pub fn log_id(ec_id: &str) -> String {
     format!("{prefix}\u{2026}")
 }
 
+use std::sync::Arc;
+
 use cookie::CookieJar;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
@@ -77,11 +85,13 @@ use crate::constants::{COOKIE_TS_EC, COOKIE_TS_EC_PULL_COMPLETE};
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 use crate::error::TrustedServerError;
+use crate::evidence::BorrowedRequestInfo;
 use crate::geo::GeoInfo;
 use crate::openrtb::Eid;
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 use device::DeviceSignals;
+use module::{EdgeCookieModule, GeneratedEdgeCookie, IdentityInput};
 
 use self::kv::{CreateIfAbsentOutcome, KvIdentityGraph};
 use self::kv_types::KvEntry;
@@ -222,24 +232,6 @@ fn request_ec_id_if_allowed(value: &str, source: &str) -> Option<String> {
     None
 }
 
-/// Gets an existing EC ID from the request.
-///
-/// Attempts to retrieve an existing EC ID from the `ts-ec` cookie.
-///
-/// Returns `None` if the cookie does not contain a valid EC ID.
-///
-/// # Errors
-///
-/// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
-pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<TrustedServerError>> {
-    let parsed = parse_ec_from_request(req)?;
-    let ec_id = parsed.cookie_ec.filter(|v| is_valid_ec_id(v));
-    if let Some(ref id) = ec_id {
-        log::trace!("Existing EC ID found: {}", log_id(id));
-    }
-    Ok(ec_id)
-}
-
 /// Captures the EC state for a single request lifecycle.
 ///
 /// Created via [`read_from_request`](Self::read_from_request) during
@@ -259,6 +251,10 @@ pub struct EcContext {
     ec_generated: bool,
     /// The consent context for this request.
     consent: ConsentContext,
+    /// Whether Edge Cookie creation is allowed for this request. Resolved once
+    /// at construction: closed when no module is selected, otherwise from the
+    /// request's consent context. Read via [`ec_allowed`](Self::ec_allowed).
+    ec_allowed: bool,
     /// The normalized client IP, captured early before the request body
     /// is consumed. `None` when the platform cannot determine client IP.
     client_ip: Option<String>,
@@ -268,6 +264,30 @@ pub struct EcContext {
     /// Set via [`EcContext::set_device_signals`] before
     /// [`EcContext::generate_if_needed`] is called.
     device_signals: Option<DeviceSignals>,
+    /// The selected Edge Cookie module (built-in or injected), built once at
+    /// construction. Core asks it whether an identifier is well formed
+    /// ([`accepts_id`](crate::ec::module::EdgeCookieModule::accepts_id)) so
+    /// an opaque vendor identifier round-trips through read-back and withdrawal
+    /// instead of being dropped by the built-in shape check. `None` when no
+    /// module is configured.
+    selected_module: Option<Arc<dyn crate::ec::module::EdgeCookieModule>>,
+    /// A snapshot of the request evidence a module reads when it creates an
+    /// identifier, at generation or in orphan recovery: the request headers (so
+    /// a module can read cookies and client hints), and the URL path and query
+    /// string (so it can read request parameters). Captured once at
+    /// construction, when a module is configured and the request either
+    /// carries no usable identifier or is a document navigation, the only
+    /// request that can recover an orphaned one. So a no-module deployment
+    /// and a returning visitor's subresource requests clone nothing. A module
+    /// reads these through [`RequestInfo`](crate::evidence::RequestInfo).
+    request_headers: http::HeaderMap,
+    request_path: String,
+    request_query: String,
+    /// Response headers a module asked to set, captured when it creates an
+    /// identifier (in [`EcContext::generate_if_needed`], or during orphan
+    /// recovery in EC finalization) and applied to the response by EC
+    /// finalization. Empty for modules that set no headers.
+    response_headers: Vec<(http::HeaderName, http::HeaderValue)>,
     /// Request-scoped persisted identity-graph state for the active EC ID.
     kv_snapshot: EcKvSnapshot,
     /// Whether this request may rotate an orphaned EC identity.
@@ -321,13 +341,53 @@ impl EcContext {
     ) -> Result<Self, Report<TrustedServerError>> {
         let parsed = parse_ec_from_request(req)?;
 
-        let ec_value = parsed.cookie_ec.clone().filter(|v| is_valid_ec_id(v));
+        // Take the selected module once. It is used here to decide whether
+        // the incoming cookie value is a usable identifier, and again by
+        // generation, which reuses this one rather than asking for another.
+        // Resolving needs no request data, so an adapter that resolved the
+        // selection while it built application state hands the same instance
+        // back here and nothing is built a second time on this request.
+        let selected_module: Option<Arc<dyn crate::ec::module::EdgeCookieModule>> =
+            module::request_module(&settings.ec, services)?;
+
+        // Read back an existing identifier only when the selected module
+        // accepts its shape, so an opaque vendor identifier (for example a signed
+        // envelope) round-trips instead of being silently dropped by the built-in
+        // shape check. With no module configured, Trusted Server is stateless:
+        // an existing identifier is treated as absent so it is never used or
+        // egressed, while the raw cookie value stays available to withdrawal
+        // handling below.
+        let ec_value = parsed.cookie_ec.clone().filter(|v| {
+            selected_module
+                .as_ref()
+                .is_some_and(|selected| module::module_owns_id(selected.as_ref(), v))
+        });
         let ec_was_present = ec_value.is_some();
 
         if let Some(ref id) = ec_value {
             log::trace!("Existing EC ID found: {}", log_id(id));
         }
 
+        // Snapshot the request evidence a module reads when it creates an
+        // identifier (the headers, so it can read cookies and client hints, and
+        // the URL path and query, so it can read request parameters). Capture
+        // only when a module is configured and either no identifier exists or
+        // the request is a document navigation, which orphan recovery may need,
+        // so a no-module deployment and a returning visitor's subresource
+        // requests clone nothing. Creation runs after the request body may be
+        // consumed, so the snapshot is owned.
+        let (request_headers, request_path, request_query) = if selected_module.is_some()
+            && (ec_value.is_none() || crate::http_util::is_navigation_request(req))
+        {
+            (
+                req.headers().clone(),
+                req.uri().path().to_owned(),
+                req.uri().query().unwrap_or_default().to_owned(),
+            )
+        } else {
+            (http::HeaderMap::new(), String::new(), String::new())
+        };
+
         // Capture the client IP from platform services (normalized).
         let client_ip = services
             .client_info()
@@ -342,11 +402,20 @@ impl EcContext {
             geo: geo_info,
         });
 
+        // Gate Edge Cookie creation and use on the request's consent context
+        // (jurisdiction and consent signals). With no module selected nothing
+        // may create or use an identifier, so the gate is closed rather than
+        // open by default. Downstream consumers read the stored result via
+        // [`EcContext::ec_allowed`] rather than re-deriving it.
+        let ec_allowed = selected_module
+            .as_ref()
+            .is_some_and(|_| consent::ec_consent_granted(&consent));
+
         log::info!(
-            "EC context: present={}, cookie_present={}, consent_allowed={}, jurisdiction={}",
+            "EC context: present={}, cookie_present={}, ec_allowed={}, jurisdiction={}",
             ec_was_present,
             parsed.cookie_ec.is_some(),
-            consent::ec_consent_granted(&consent),
+            ec_allowed,
             consent.jurisdiction,
         );
 
@@ -356,9 +425,15 @@ impl EcContext {
             ec_was_present,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip,
             geo_info: geo_info.cloned(),
             device_signals: None,
+            selected_module,
+            request_headers,
+            request_path,
+            request_query,
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             client_eids: None,
@@ -378,8 +453,14 @@ impl EcContext {
     ///
     /// # Errors
     ///
-    /// Returns an error if the client IP is unavailable and generation is
-    /// needed, or if HMAC generation fails.
+    /// Forwards every error from `generate_with_module`: the selected module
+    /// failing to derive an identifier (which includes a module that needs the
+    /// client IP being run on a host that cannot supply one), the module
+    /// producing an identifier outside the cookie-safe alphabet or over the
+    /// length cap, the module asking for a response header inside core's
+    /// reserved surface, persisting the identifier to the KV identity graph
+    /// failing, or every attempt within the retry limit producing an identifier
+    /// the graph already holds.
     pub fn generate_if_needed(
         &mut self,
         settings: &Settings,
@@ -389,24 +470,175 @@ impl EcContext {
             return Ok(());
         }
 
-        if !consent::ec_consent_granted(&self.consent) {
+        // A deployment with no module selected is stateless: nothing to
+        // generate, and not an error. Reuse the module built at read time
+        // rather than building it again.
+        let Some(ec_module) = self.selected_module.clone() else {
+            log::trace!("EC generation skipped: no Edge Cookie module configured");
+            return Ok(());
+        };
+
+        if !self.ec_allowed {
             log::info!(
-                "EC generation skipped: consent not granted (jurisdiction={})",
+                "EC generation skipped: EC creation not permitted (jurisdiction={})",
                 self.consent.jurisdiction,
             );
             return Ok(());
         }
 
-        let client_ip = self.client_ip.as_deref().ok_or_else(|| {
-            Report::new(TrustedServerError::EdgeCookie {
-                message: "Client IP required for EC generation but unavailable".to_owned(),
-            })
-        })?;
+        // Whether the client IP is needed is the selected module's decision,
+        // not core's. A module that derives identity from headers, cookies,
+        // query parameters, or the client reads no IP and must still run on a
+        // host that cannot supply one. The IP is passed as the documented
+        // unavailable value, the empty string (see
+        // [`RequestInfo::client_ip`](crate::evidence::RequestInfo::client_ip)),
+        // and a module that needs it refuses there, returning the error to
+        // the caller. The publisher proxy and integration proxy log it and
+        // serve the response without an Edge Cookie.
+        self.generate_with_module(ec_module.as_ref(), settings, kv)
+    }
 
+    /// Asks the selected module for one new identifier, without persisting
+    /// it.
+    ///
+    /// Runs the checks every new identifier has to pass before it is kept. The
+    /// module's response headers are checked against core's reserved surface
+    /// and captured for EC finalization, even when the module produces no
+    /// identifier, and the finished identifier, with its module code applied,
+    /// is checked against the global bounds. Generation and orphan recovery both
+    /// use this, so a rotated identifier comes from the same module
+    /// and passes the same checks as a new one. The request evidence captured at
+    /// read time (client IP, headers, and the URL path and query) is passed
+    /// borrowed through [`RequestInfo`](crate::evidence::RequestInfo), and the
+    /// built-in HMAC module reads only the client IP.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::EdgeCookie`] when the module fails to
+    /// derive an identifier (which for [`HmacModule`] includes an
+    /// unavailable client IP), asks for a response header inside core's
+    /// reserved surface (see
+    /// [`reserved_response_effect`](crate::ec::module::reserved_response_effect)),
+    /// or produces an identifier that is empty, over the length cap, or outside
+    /// the cookie-safe alphabet.
+    pub(crate) fn candidate_id(
+        &mut self,
+        ec_module: &dyn EdgeCookieModule,
+    ) -> Result<Option<String>, Report<TrustedServerError>> {
+        let input = IdentityInput {
+            consent: Some(&self.consent),
+        };
+        let request_info = BorrowedRequestInfo::new(
+            self.client_ip.as_deref().unwrap_or_default(),
+            Some(&self.request_headers),
+        )
+        .with_request_target(&self.request_path, &self.request_query);
+        let generated: GeneratedEdgeCookie = ec_module.generate(&request_info, &input)?;
+        // Check every response header the module asked for against core's
+        // reserved surface before any of them are kept. A module may set its
+        // own cookies and headers, but not a managed `ts-` cookie, a header in
+        // the `x-ts-` namespace, or a framing or hop-by-hop header. Without the
+        // check a module could write `ts-ec` itself and bypass the identifier
+        // validation and identity-graph row generation enforces. A rejection
+        // returns an error, as the identifier-bounds rejection below does.
+        // Because the check runs before the headers are captured, nothing from
+        // a rejected module response is kept, and the response is served
+        // without a new Edge Cookie. Checked before the identifier is read,
+        // because a module can return headers with no identifier at all.
+        for (name, value) in &generated.response_headers {
+            if let Some(effect) = module::reserved_response_effect(name, value) {
+                return Err(Report::new(TrustedServerError::EdgeCookie {
+                    message: format!(
+                        "Module `{}` returned a response header `{name}` that {effect}",
+                        ec_module.id(),
+                    ),
+                }));
+            }
+        }
+        let generated_id = generated
+            .id
+            .map(|value| crate::ec::module::apply_module_code(ec_module, &value));
+        let Some(ec_id) = generated_id else {
+            // Keep the response headers the module asked for even though it
+            // produced no identifier (for example while it still needs more
+            // client evidence). EC finalization applies them to the response.
+            self.response_headers = generated.response_headers;
+            log::info!(
+                "EC generation produced no identifier (module={}); proceeding without an EC",
+                ec_module.id(),
+            );
+            return Ok(None);
+        };
+        // Enforce the global identifier bounds at creation. The cookie-safe
+        // alphabet and the length cap apply to every module, so no
+        // implementation can emit a value the cookie layer or the identity
+        // graph cannot carry. Rejection is loud and total; the identifier is
+        // never rewritten.
+        if !ec_id_has_only_allowed_chars(&ec_id) {
+            return Err(Report::new(TrustedServerError::EdgeCookie {
+                message: format!(
+                    "Module `{}` produced an identifier that is empty, over {} bytes, or \
+                     outside the cookie-safe alphabet",
+                    ec_module.id(),
+                    cookies::MAX_EC_ID_LEN,
+                ),
+            }));
+        }
+        // Keep the module's response headers only now that its identifier
+        // has passed the bounds check, so a module response whose identifier
+        // is rejected keeps none of them. EC finalization applies them to the
+        // response.
+        self.response_headers = generated.response_headers;
+        log::info!(
+            "Generated new EC ID (module={}): {}",
+            ec_module.id(),
+            log_id(&ec_id),
+        );
+        Ok(Some(ec_id))
+    }
+
+    /// Derives and commits an EC identifier using a specific module.
+    ///
+    /// Split out of [`generate_if_needed`](Self::generate_if_needed) so the
+    /// module is supplied explicitly, resolved once at read time and threaded
+    /// here rather than rebuilt. Each attempt asks the module for a candidate
+    /// through [`candidate_id`](Self::candidate_id) and creates its
+    /// identity-graph row only when no row already holds that key, so a
+    /// colliding identifier never overwrites another identity's row and the
+    /// next attempt asks the module again. The row is keyed by the module's
+    /// canonical form of the identifier, and the request snapshot is bound to
+    /// that key. The skip guards (existing EC, consent gate) stay in
+    /// [`generate_if_needed`](Self::generate_if_needed).
+    ///
+    /// The response headers a module response asks for stay on the context
+    /// only when its identifier is committed or it produced no identifier at
+    /// all. A colliding candidate's headers are dropped before the next attempt
+    /// and nothing is kept when persisting fails, so EC finalization never
+    /// applies a header from a candidate this request discarded.
+    ///
+    /// # Errors
+    ///
+    /// Forwards every error from [`candidate_id`](Self::candidate_id), and
+    /// returns [`TrustedServerError::EdgeCookie`] when persisting a generated
+    /// identifier to the KV identity graph fails or every attempt within the
+    /// retry limit produces an identifier the graph already holds.
+    fn generate_with_module(
+        &mut self,
+        ec_module: &dyn EdgeCookieModule,
+        settings: &Settings,
+        kv: Option<&KvIdentityGraph>,
+    ) -> Result<(), Report<TrustedServerError>> {
         const MAX_CREATE_ATTEMPTS: usize = 5;
         for attempt in 0..MAX_CREATE_ATTEMPTS {
-            let ec_id = generation::generate_ec_id(settings, client_ip)?;
-            log::info!("Generated new EC ID: {}", log_id(&ec_id));
+            let Some(ec_id) = self.candidate_id(ec_module)? else {
+                return Ok(());
+            };
+            // Key the identity graph by the module's canonical form of the
+            // identifier, so equivalent representations of one identity share
+            // one row. The built-in normalization lowercases only the HMAC
+            // hash segment; an opaque vendor module overrides it to the
+            // identity function.
+            let kv_key = crate::ec::module::module_kv_key(ec_module, &ec_id);
             let now = current_timestamp();
             let mut entry = KvEntry::new(
                 &self.consent,
@@ -420,15 +652,19 @@ impl EcContext {
                 .map(DeviceSignals::to_kv_device);
 
             if let Some(graph) = kv {
-                match graph.create_if_absent(&ec_id, &entry) {
+                match graph.create_if_absent(&kv_key, &entry) {
                     Ok(CreateIfAbsentOutcome::Written) => {
                         self.kv_snapshot = EcKvSnapshot::Present {
-                            ec_id: ec_id.clone(),
+                            ec_id: kv_key,
                             entry: Box::new(entry),
                             generation: None,
                         };
                     }
                     Ok(CreateIfAbsentOutcome::AlreadyExists) => {
+                        // The colliding candidate is discarded, and the
+                        // response headers its module response asked for
+                        // are discarded with it.
+                        self.response_headers.clear();
                         log::warn!(
                             "Generated EC ID collision on attempt {}/{MAX_CREATE_ATTEMPTS}",
                             attempt + 1
@@ -436,6 +672,9 @@ impl EcContext {
                         continue;
                     }
                     Err(err) => {
+                        // Nothing is committed, so none of the module's
+                        // response headers are kept either.
+                        self.response_headers.clear();
                         log::error!(
                             "Failed to create EC entry for id '{}' after generation: {err:?}",
                             log_id(&ec_id),
@@ -467,6 +706,69 @@ impl EcContext {
         self.ec_value.as_deref()
     }
 
+    /// The modules whose identifiers this request's paths accept, being the
+    /// selected module alone (see
+    /// [`AcceptedModules`](module::AcceptedModules)).
+    #[must_use]
+    pub(crate) fn accepted_modules(&self) -> module::AcceptedModules<'_> {
+        module::AcceptedModules::active(self.selected_module.as_deref())
+    }
+
+    /// The identity-graph key for `value` under the modules this deployment
+    /// reads.
+    ///
+    /// The canonical route from a request's identifier to a row key, so a
+    /// module whose canonical form differs from the cookie value still finds
+    /// the row it created. The owning module is picked by the identifier's
+    /// `{code}~` prefix and supplies the canonical form of its own value part,
+    /// matching the key [`generate_if_needed`](Self::generate_if_needed) wrote
+    /// at creation.
+    ///
+    /// Identify, EC finalization and pull sync read and write this
+    /// identifier's row under this key. The publisher navigation, `/auction`
+    /// and `/_ts/page-bids` paths load their request snapshot under this key,
+    /// and EID resolution looks the entry up in that snapshot under this key.
+    /// Each of these reaches the key through this function or through
+    /// [`ec_kv_key`](Self::ec_kv_key), which wraps this function. Batch sync
+    /// and the admin lookup have no EC context, so they call
+    /// [`AcceptedModules::canonical_kv_key`](module::AcceptedModules::canonical_kv_key),
+    /// the function this one wraps, directly.
+    ///
+    /// `None` when no module this deployment reads owns `value`, in which
+    /// case there is no row to read or write.
+    #[must_use]
+    pub(crate) fn kv_key_for(&self, value: &str) -> Option<String> {
+        self.accepted_modules().canonical_kv_key(value)
+    }
+
+    /// The identity-graph key for this request's active identifier.
+    #[must_use]
+    pub(crate) fn ec_kv_key(&self) -> Option<String> {
+        self.ec_value().and_then(|value| self.kv_key_for(value))
+    }
+
+    /// The identity-graph key for the `ts-ec` cookie the request carried.
+    ///
+    /// Withdrawal tombstones the cookie's row as well as the active one,
+    /// because a stateless deployment leaves [`ec_kv_key`](Self::ec_kv_key)
+    /// empty while a live row still exists, and the cookie is the only way
+    /// back to it.
+    ///
+    /// This does not reach across a module switch. An identifier created
+    /// under a retired module's `{code}~` prefix is owned by no module
+    /// this deployment reads, so [`kv_key_for`](Self::kv_key_for) yields
+    /// `None` and its row is never tombstoned. Core cannot derive that key,
+    /// because the canonical form is the owning module's own normalization.
+    /// So after a module switch a withdrawal expires only the browser
+    /// cookie, because that path keys off the raw cookie rather than off
+    /// ownership, and the retired module's row stays until its time to live
+    /// runs out.
+    #[must_use]
+    pub(crate) fn cookie_ec_kv_key(&self) -> Option<String> {
+        self.existing_cookie_ec_id()
+            .and_then(|value| self.kv_key_for(value))
+    }
+
     /// Returns whether the `ts-ec` cookie was present on the incoming request.
     #[must_use]
     pub fn cookie_was_present(&self) -> bool {
@@ -496,7 +798,8 @@ impl EcContext {
     ///
     /// Allows handlers to apply query-param fallback consent for the current
     /// request only when pre-routing consent extraction produced an empty
-    /// context.
+    /// context. Mutations do not re-derive [`ec_allowed`](Self::ec_allowed),
+    /// which is resolved once at construction.
     pub fn consent_mut(&mut self) -> &mut ConsentContext {
         &mut self.consent
     }
@@ -513,6 +816,14 @@ impl EcContext {
         self.device_signals = Some(signals);
     }
 
+    /// Returns the response headers a module asked to set during
+    /// [`generate_if_needed`](Self::generate_if_needed). Empty unless a module
+    /// produced any.
+    #[must_use]
+    pub fn response_headers(&self) -> &[(http::HeaderName, http::HeaderValue)] {
+        &self.response_headers
+    }
+
     /// Returns the device signals, if set.
     #[must_use]
     pub fn device_signals(&self) -> Option<&DeviceSignals> {
@@ -615,10 +926,23 @@ impl EcContext {
         self.pull_sync_marker.invalidate_for_replaced_ec();
     }
 
-    /// Returns whether EC creation is permitted by consent for this request.
+    /// The Edge Cookie module this request resolved at read time, if any.
+    ///
+    /// Orphan recovery creates a replacement identifier through this module,
+    /// so a rotated identifier comes from the same module as a new one.
+    #[must_use]
+    pub(crate) fn selected_module(&self) -> Option<Arc<dyn crate::ec::module::EdgeCookieModule>> {
+        self.selected_module.clone()
+    }
+
+    /// Returns whether Edge Cookie creation is allowed for this request.
+    ///
+    /// Resolved once at construction: closed when no module is selected,
+    /// otherwise from the request's consent context (see
+    /// [`consent::ec_consent_granted`]).
     #[must_use]
     pub fn ec_allowed(&self) -> bool {
-        consent::ec_consent_granted(&self.consent)
+        self.ec_allowed
     }
 
     /// Returns the existing EC cookie value for revocation handling.
@@ -631,35 +955,67 @@ impl EcContext {
         self.cookie_ec_value.as_deref()
     }
 
-    /// Returns `true` when the request carried a cookie EC and the selected
-    /// active EC differs from that cookie value.
-    #[must_use]
-    pub fn cookie_differs_from_active_ec(&self) -> bool {
-        matches!(
-            (self.cookie_ec_value.as_deref(), self.ec_value.as_deref()),
-            (Some(cookie), Some(active)) if cookie != active
-        )
-    }
-
     /// Returns the stable EC hash prefix from the active EC value.
     #[must_use]
     pub fn ec_hash(&self) -> Option<&str> {
         self.ec_value.as_deref().map(generation::ec_hash)
     }
 
-    /// Creates a test-only `EcContext` with explicit field values.
+    /// Attaches a selected module to a test-only [`EcContext`].
+    ///
+    /// The production constructor builds the module from settings and
+    /// injected services. A test that only needs the module's identifier
+    /// semantics (which identifiers it owns, and their canonical key form)
+    /// takes this shortcut instead.
+    #[cfg(test)]
+    #[must_use]
+    pub fn with_module_for_test(
+        mut self,
+        module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+    ) -> Self {
+        self.selected_module = Some(module);
+        self
+    }
+
+    /// Creates a test-only `EcContext` whose creation gate is derived from the
+    /// consent context, matching the production construction path.
+    ///
+    /// Use [`new_for_test_gated`](Self::new_for_test_gated) when a test needs
+    /// an explicit gate.
     #[cfg(test)]
     #[must_use]
     pub fn new_for_test(ec_value: Option<String>, consent: ConsentContext) -> Self {
+        let ec_allowed = consent::ec_consent_granted(&consent);
+        Self::new_for_test_gated(ec_value, consent, ec_allowed)
+    }
+
+    /// Creates a test-only `EcContext` with an explicit creation gate.
+    ///
+    /// `ec_allowed` stands in for the gating decision the production path
+    /// resolves at construction, so a test can exercise the gate-open and
+    /// gate-closed branches directly.
+    #[cfg(test)]
+    #[must_use]
+    pub fn new_for_test_gated(
+        ec_value: Option<String>,
+        consent: ConsentContext,
+        ec_allowed: bool,
+    ) -> Self {
         Self {
             ec_was_present: ec_value.is_some(),
             cookie_ec_value: ec_value.clone(),
             ec_value,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip: None,
             geo_info: None,
             device_signals: None,
+            selected_module: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             client_eids: None,
@@ -676,15 +1032,22 @@ impl EcContext {
         consent: ConsentContext,
         client_ip: Option<String>,
     ) -> Self {
+        let ec_allowed = consent::ec_consent_granted(&consent);
         Self {
             ec_was_present: ec_value.is_some(),
             cookie_ec_value: ec_value.clone(),
             ec_value,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip,
             geo_info: None,
             device_signals: None,
+            selected_module: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             client_eids: None,
@@ -703,6 +1066,7 @@ impl EcContext {
         ec_was_present: bool,
         ec_generated: bool,
         consent: ConsentContext,
+        ec_allowed: bool,
     ) -> Self {
         Self {
             ec_value,
@@ -710,9 +1074,15 @@ impl EcContext {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
             client_ip: None,
             geo_info: None,
             device_signals: None,
+            selected_module: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             client_eids: None,
@@ -762,7 +1132,7 @@ pub(crate) fn std_system_time_now() -> std::time::SystemTime {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use super::*;
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
@@ -770,18 +1140,23 @@ mod tests {
     use crate::ec::kv_backend::{
         EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome,
     };
+    use crate::ec::module::{EcModuleSelection, ModuleCode};
+    use crate::evidence::RequestInfo;
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
 
     /// [`EcKvStore`] wrapper whose first `collisions` `Add` writes report a
     /// precondition failure, forcing generation to retry with a fresh suffix.
-    struct AddCollidingEcKv {
+    ///
+    /// Shared with the finalization tests, whose orphan recovery creates its
+    /// replacement through the same `Add` write.
+    pub(crate) struct AddCollidingEcKv {
         inner: InMemoryEcKv,
         collisions_remaining: std::sync::Mutex<u32>,
     }
 
     impl AddCollidingEcKv {
-        fn new(collisions: u32) -> Self {
+        pub(crate) fn new(collisions: u32) -> Self {
             Self {
                 inner: InMemoryEcKv::new("add-colliding-store"),
                 collisions_remaining: std::sync::Mutex::new(collisions),
@@ -841,7 +1216,8 @@ mod tests {
     fn generate_if_needed_retries_id_collision_then_persists() {
         let settings = create_test_settings();
         let mut ec =
-            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()));
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()))
+                .with_module_for_test(hmac_module());
         let graph = KvIdentityGraph::new(AddCollidingEcKv::new(2));
 
         ec.generate_if_needed(&settings, Some(&graph))
@@ -859,7 +1235,8 @@ mod tests {
     fn generate_if_needed_errors_after_collision_exhaustion() {
         let settings = create_test_settings();
         let mut ec =
-            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.6".to_owned()));
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.6".to_owned()))
+                .with_module_for_test(hmac_module());
         // Collide on every attempt so the bounded retry is exhausted.
         let graph = KvIdentityGraph::new(AddCollidingEcKv::new(u32::MAX));
 
@@ -923,6 +1300,983 @@ mod tests {
         format!("{}.{suffix}", prefix_char.repeat(64))
     }
 
+    /// A module other than the built-in HMAC one, whose identifiers the HMAC
+    /// grammar rejects (no dot, mixed case), modeling a vendor identifier such
+    /// as a signed envelope. It accepts any of its own non-empty identifiers
+    /// and keys the identity graph by the value unchanged.
+    ///
+    /// Shared with the admin lookup, batch sync and pull sync tests.
+    #[derive(Debug)]
+    pub(crate) struct OpaqueModule;
+
+    impl EdgeCookieModule for OpaqueModule {
+        fn id(&self) -> &'static str {
+            "opaque"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0op")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    /// A geo that resolves to the non-regulated jurisdiction (US, no region),
+    /// so the consent gate is open and generation runs in module tests.
+    fn non_regulated_geo() -> GeoInfo {
+        GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        }
+    }
+
+    #[test]
+    fn read_from_request_reuses_the_module_the_composition_root_resolved() {
+        // The context reuses the module the composition root resolved and
+        // threaded through `RuntimeServices`, so the request builds none.
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("opaque"));
+
+        let ec_config = settings.ec.clone();
+        let resolved =
+            crate::ec::module::build_shared_module(&ec_config, Some(Arc::new(OpaqueModule)))
+                .expect("the composition root should resolve the selection")
+                .expect("the selection should yield a module");
+
+        let services =
+            crate::platform::test_support::noop_services_with_ec_module(Arc::clone(&resolved));
+        let req = create_test_request(&[]);
+        let ec = EcContext::read_from_request(&settings, &req, &services)
+            .expect("should read EC context");
+
+        let used = ec
+            .selected_module
+            .as_ref()
+            .expect("the context should hold the selected module");
+        assert!(
+            Arc::ptr_eq(used, &resolved),
+            "reading EC state should reuse the module resolved at startup rather \
+             than building a second one for this request"
+        );
+    }
+
+    #[test]
+    fn read_from_request_round_trips_an_opaque_module_identifier() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        // A vendor identifier that is deliberately not the built-in HMAC shape
+        // (no dot, mixed case), the exact value the built-in check would drop.
+        const OPAQUE_ID: &str = "AbC123opaqueEnvelopeValueXYZ";
+        const CODED_ID: &str = "t0op~AbC123opaqueEnvelopeValueXYZ";
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("opaque"));
+        let cookie = format!("ts-ec={CODED_ID}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+
+        // With the opaque module injected, its `accepts_id` governs read-back,
+        // so the identifier survives verbatim.
+        let services = noop_services_with_ec_module(Arc::new(OpaqueModule));
+        let ec = EcContext::read_from_request(&settings, &req, &services)
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            Some(CODED_ID),
+            "an opaque module identifier should round-trip through read-back verbatim"
+        );
+        let _ = OPAQUE_ID;
+
+        // Control: with the module selected but not injected by the adapter,
+        // the request fails loudly instead of silently running stateless with
+        // the identifier dropped.
+        let err = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect_err("a selected but uninjected module should fail the request");
+        assert!(
+            err.to_string().contains("opaque"),
+            "the error should name the selected module, got: {err}"
+        );
+
+        // Control: with no module selected at all, the identifier is treated
+        // as absent, so a stateless deployment never uses or egresses it.
+        let mut stateless = create_test_settings();
+        stateless.ec.module = None;
+        stateless.ec.module_blocks.clear();
+        let ec_without = EcContext::read_from_request(&stateless, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec_without.ec_value(),
+            None,
+            "with no module selected, an existing identifier is treated as absent"
+        );
+        assert!(
+            !ec_without.ec_allowed(),
+            "with no module selected, the gate stays closed"
+        );
+    }
+
+    /// A module that records the request query parameter `id` and the `Cookie`
+    /// header it is given at generate time, proving request evidence (parameters
+    /// and cookies) reaches a module through the organic generate path.
+    #[derive(Debug, Default)]
+    struct EvidenceCapturingModule {
+        seen: std::sync::Mutex<Option<(String, String)>>,
+    }
+
+    impl EdgeCookieModule for EvidenceCapturingModule {
+        fn id(&self) -> &'static str {
+            "evidence"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0ev")
+        }
+
+        fn generate(
+            &self,
+            request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            let query_id = request_info.query_param("id").unwrap_or_default();
+            let cookie = request_info.header("cookie").unwrap_or_default().to_owned();
+            *self.seen.lock().expect("should lock seen evidence") = Some((query_id, cookie));
+            Ok(GeneratedEdgeCookie {
+                id: Some("evidence-ec".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+    }
+
+    #[test]
+    fn generate_passes_request_parameters_and_cookies_to_the_module() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let module = Arc::new(EvidenceCapturingModule::default());
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("evidence"));
+
+        // A request carrying a query parameter and a (non-EC) cookie, with no
+        // existing `ts-ec` cookie so the generate path runs.
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123&debug=1")
+            .header("cookie", "client-id=xyz789")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_module(module.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, None)
+            .expect("should run generation");
+
+        let seen = module
+            .seen
+            .lock()
+            .expect("should lock seen evidence")
+            .clone();
+        assert_eq!(
+            seen,
+            Some(("abc123".to_owned(), "client-id=xyz789".to_owned())),
+            "the module should read the request query parameter and cookies at generate time"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            Some("t0ev~evidence-ec"),
+            "the identifier the module created should be committed under its code"
+        );
+    }
+
+    #[test]
+    fn recovery_on_a_navigation_passes_request_parameters_and_cookies_to_the_module() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let module = Arc::new(EvidenceCapturingModule::default());
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("evidence"));
+
+        // A returning visitor's document navigation, carrying an identifier
+        // the module owns, which is the request orphan recovery runs on.
+        let cookie = "ts-ec=t0ev~orphaned; client-id=xyz789";
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123")
+            .header("cookie", cookie)
+            .header("sec-fetch-dest", "document")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_module(module.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        assert!(ec.ec_was_present(), "the identifier should be read back");
+        let selected = ec.selected_module().expect("a module is selected");
+        ec.candidate_id(selected.as_ref())
+            .expect("should create a replacement");
+
+        let seen = module
+            .seen
+            .lock()
+            .expect("should lock seen evidence")
+            .clone();
+        assert_eq!(
+            seen,
+            Some(("abc123".to_owned(), cookie.to_owned())),
+            "recovery should give the module the request's parameters and cookies"
+        );
+    }
+
+    /// A module that creates an opaque, mixed-case, non-HMAC identifier at
+    /// the edge, so a test can prove such an identifier persists to the KV identity
+    /// graph under its own value as the key.
+    #[derive(Debug)]
+    struct ServerOpaqueModule;
+
+    impl EdgeCookieModule for ServerOpaqueModule {
+        fn id(&self) -> &'static str {
+            "server_opaque"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0so")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("Opaque_EC_Value_MixedCase_123".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    #[test]
+    fn generate_persists_an_opaque_identifier_to_kv_under_its_own_key() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        const OPAQUE: &str = "t0so~Opaque_EC_Value_MixedCase_123";
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("server_opaque"));
+        let services = noop_services_with_ec_module(Arc::new(ServerOpaqueModule));
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+
+        // No existing cookie, so the edge creates one and persists it.
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, Some(&graph))
+            .expect("should generate and persist");
+
+        assert_eq!(
+            ec.ec_value(),
+            Some(OPAQUE),
+            "the opaque identifier should be created"
+        );
+
+        // The entry is stored under the full identifier verbatim.
+        assert!(
+            graph.get(OPAQUE).expect("kv get should succeed").is_some(),
+            "the entry should exist under the opaque identifier key"
+        );
+
+        // A lowercased key must miss, proving the key preserves case rather than
+        // being lowercased like the built-in HMAC form (the clash this guards).
+        assert!(
+            graph
+                .get(&OPAQUE.to_lowercase())
+                .expect("kv get should succeed")
+                .is_none(),
+            "the KV key must be case-sensitive and verbatim, not lowercased"
+        );
+    }
+
+    #[test]
+    fn a_module_that_reads_no_client_ip_creates_when_the_host_has_none() {
+        use crate::platform::test_support::noop_services_with_ec_module_without_client_ip;
+
+        // The requirement for a client IP belongs to the module that uses
+        // one, not to core. A module deriving identity from the request
+        // query and cookies runs on a host that cannot determine a client IP,
+        // and receives the documented unavailable value, the empty string.
+        let module = Arc::new(EvidenceCapturingModule::default());
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("evidence"));
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123")
+            .header("cookie", "client-id=xyz789")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_module_without_client_ip(module.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        assert_eq!(
+            ec.client_ip(),
+            None,
+            "the host should supply no client IP in this test"
+        );
+
+        ec.generate_if_needed(&settings, None)
+            .expect("a module that reads no client IP should still create an identifier");
+        assert_eq!(
+            ec.ec_value(),
+            Some("t0ev~evidence-ec"),
+            "the identifier should be committed with no client IP available"
+        );
+    }
+
+    #[test]
+    fn the_hmac_module_refuses_when_the_host_has_no_client_ip() {
+        // The other half: the built-in module's only input is the client IP,
+        // so with none it fails rather than hashing the empty string into an
+        // identifier every visitor on that host would share. Identity cannot be
+        // established, so generate_if_needed returns the error, which the
+        // publisher and integration proxies log before serving the response
+        // without an Edge Cookie.
+        let settings = create_test_settings();
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec =
+            EcContext::read_from_request_with_geo(&settings, &req, &noop_services(), Some(&geo))
+                .expect("should read EC context");
+        assert_eq!(
+            ec.client_ip(),
+            None,
+            "the host should supply no client IP in this test"
+        );
+
+        let err = ec
+            .generate_if_needed(&settings, None)
+            .expect_err("the HMAC module should refuse without a client IP");
+        assert!(
+            err.to_string().contains("client IP"),
+            "the error should name the missing client IP, got: {err}"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            None,
+            "no identifier should be committed when the module refuses"
+        );
+    }
+
+    /// A module that creates an identifier outside the cookie-safe alphabet,
+    /// to prove core rejects it at creation rather than rewriting it.
+    #[derive(Debug)]
+    struct IllegalIdModule;
+
+    impl EdgeCookieModule for IllegalIdModule {
+        fn id(&self) -> &'static str {
+            "illegal"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0il")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("bad;value with spaces".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, _value: &str) -> bool {
+            true
+        }
+    }
+
+    #[test]
+    fn generate_rejects_an_identifier_outside_the_cookie_safe_alphabet() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("illegal"));
+        let services = noop_services_with_ec_module(Arc::new(IllegalIdModule));
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+
+        let err = ec
+            .generate_if_needed(&settings, None)
+            .expect_err("an identifier outside the alphabet should be rejected at creation");
+        assert!(
+            err.to_string().contains("illegal"),
+            "the error should name the module, got: {err}"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            None,
+            "no identifier should be committed after a creation rejection"
+        );
+    }
+
+    /// A module that returns a caller-chosen response header, and `id` as its
+    /// identifier when one is given, so a test can drive one module response
+    /// effect at a time through the organic generate path.
+    #[derive(Debug)]
+    struct HeaderSettingModule {
+        name: &'static str,
+        value: &'static str,
+        id: Option<&'static str>,
+    }
+
+    impl EdgeCookieModule for HeaderSettingModule {
+        fn id(&self) -> &'static str {
+            "header_setting"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0hs")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: self.id.map(str::to_owned),
+                response_headers: vec![(
+                    http::HeaderName::from_bytes(self.name.as_bytes())
+                        .expect("should parse header name"),
+                    http::HeaderValue::from_static(self.value),
+                )],
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    /// Runs generation through `module` and hands back the context whether or
+    /// not generation succeeded, so a test can finalize a response on a context
+    /// whose generation returned an error.
+    fn generate_with_header_setting_module(
+        module: HeaderSettingModule,
+        graph: Option<&KvIdentityGraph>,
+    ) -> (Settings, EcContext, Result<(), Report<TrustedServerError>>) {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("header_setting"));
+        let services = noop_services_with_ec_module(Arc::new(module));
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        let outcome = ec.generate_if_needed(&settings, graph);
+        (settings, ec, outcome)
+    }
+
+    #[test]
+    fn a_rejected_module_effect_never_reaches_the_finalized_response() {
+        // A module that sets the managed `ts-ec` cookie, a header in the
+        // `x-ts-` namespace or a framing header would bypass core's identifier
+        // validation and its identity-graph row, so generation returns an
+        // error rather than quietly dropping the effect. The publisher and
+        // integration proxies log the error and still serve the response, and
+        // EC finalization applies the response headers this same context
+        // holds, so a rejected header kept among them would reach the browser
+        // anyway. Each header is tried with no identifier, the case a cookie
+        // write would otherwise slip through, and with one, to show that
+        // nothing from the rejected module response is kept.
+        for (name, value, id) in [
+            ("set-cookie", "ts-ec=forged-value; Path=/", None),
+            ("x-ts-ec", "forged", None),
+            ("transfer-encoding", "chunked", None),
+            (
+                "set-cookie",
+                "ts-ec=forged-value; Path=/",
+                Some("module-value"),
+            ),
+            ("x-ts-ec", "forged", Some("module-value")),
+            ("transfer-encoding", "chunked", Some("module-value")),
+        ] {
+            let case = format!("`{name}` with identifier {id:?}");
+            let graph = KvIdentityGraph::in_memory("test-ec-store");
+            let (settings, mut ec, outcome) = generate_with_header_setting_module(
+                HeaderSettingModule { name, value, id },
+                Some(&graph),
+            );
+            let Err(err) = outcome else {
+                panic!("{case}: the header is reserved, so generation should return an error");
+            };
+            assert!(
+                err.to_string().contains("header_setting"),
+                "{case}: the error should name the module, got: {err}"
+            );
+            assert_eq!(
+                ec.ec_value(),
+                None,
+                "{case}: no identifier should be committed after the rejection"
+            );
+
+            let mut response = http::Response::builder()
+                .status(200)
+                .body(EdgeBody::empty())
+                .expect("should build test response");
+            finalize::ec_finalize_response(
+                &settings,
+                &mut ec,
+                Some(&graph),
+                &registry::PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+
+            let cookies: Vec<&str> = response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|cookie| cookie.to_str().ok())
+                .collect();
+            assert!(
+                !cookies.iter().any(|cookie| cookie.contains("ts-ec=forged")),
+                "{case}: the rejected effect should not set `ts-ec`, got: {cookies:?}"
+            );
+            assert!(
+                response.headers().get("x-ts-ec").is_none(),
+                "{case}: the rejected effect should not set `x-ts-ec`"
+            );
+            assert!(
+                response
+                    .headers()
+                    .get(http::header::TRANSFER_ENCODING)
+                    .is_none(),
+                "{case}: the rejected effect should not set `transfer-encoding`"
+            );
+        }
+    }
+
+    #[test]
+    fn generate_applies_a_module_owned_cookie_to_the_response() {
+        // The other half of the rule: a module's own cookie is not core's, so
+        // it survives generation and reaches the browser response unchanged,
+        // alongside the managed `ts-ec` cookie core writes itself.
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+        let (settings, mut ec, outcome) = generate_with_header_setting_module(
+            HeaderSettingModule {
+                name: "set-cookie",
+                value: "acme-evidence=abc123; Path=/; Secure",
+                id: Some("module-value"),
+            },
+            Some(&graph),
+        );
+        outcome.expect("generation should accept a module-owned cookie");
+        assert_eq!(
+            ec.ec_value(),
+            Some("t0hs~module-value"),
+            "the identifier should still be committed"
+        );
+
+        let mut response = http::Response::builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build test response");
+        finalize::ec_finalize_response(
+            &settings,
+            &mut ec,
+            Some(&graph),
+            &registry::PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("acme-evidence=abc123")),
+            "the module's own cookie should reach the response, got: {cookies:?}"
+        );
+        assert!(
+            cookies.iter().any(|cookie| cookie.starts_with("ts-ec=")),
+            "core's own managed cookie should still be written, got: {cookies:?}"
+        );
+    }
+
+    /// A cookie a module may set for itself, used to check which module
+    /// responses keep their headers.
+    const MODULE_EVIDENCE_COOKIE: &str = "acme-evidence=abc123; Path=/; Secure";
+
+    /// Runs EC finalization on `ec` for an empty response and returns the
+    /// `Set-Cookie` values the response carries.
+    fn finalized_set_cookies(
+        settings: &Settings,
+        ec: &mut EcContext,
+        graph: &KvIdentityGraph,
+    ) -> Vec<String> {
+        let mut response = http::Response::builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build test response");
+        finalize::ec_finalize_response(
+            settings,
+            ec,
+            Some(graph),
+            &registry::PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+        response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .filter_map(|cookie| cookie.to_str().ok())
+            .map(str::to_owned)
+            .collect()
+    }
+
+    #[test]
+    fn a_discarded_candidate_keeps_none_of_its_module_response_headers() {
+        // The module's own cookie is permitted, but each of these candidates
+        // is discarded, so generation returns an error and the cookie its
+        // module response asked for must not reach the browser.
+        for (case, graph, id) in [
+            // The identifier is outside the cookie-safe alphabet.
+            (
+                "a rejected identifier",
+                KvIdentityGraph::in_memory("test-ec-store"),
+                "bad;value with spaces",
+            ),
+            // Every candidate collides with a row the graph already holds, so
+            // each one is discarded until the retries run out.
+            (
+                "a colliding candidate",
+                KvIdentityGraph::new(AddCollidingEcKv::new(u32::MAX)),
+                "module-value",
+            ),
+            // The identity graph cannot store the candidate's row.
+            (
+                "an unpersisted candidate",
+                KvIdentityGraph::new(crate::ec::kv_backend::test_support::FailingEcKv::new(
+                    "failing-ec-store",
+                )),
+                "module-value",
+            ),
+        ] {
+            let (settings, mut ec, outcome) = generate_with_header_setting_module(
+                HeaderSettingModule {
+                    name: "set-cookie",
+                    value: MODULE_EVIDENCE_COOKIE,
+                    id: Some(id),
+                },
+                Some(&graph),
+            );
+
+            assert!(
+                outcome.is_err(),
+                "{case}: generation should return an error"
+            );
+            let cookies = finalized_set_cookies(&settings, &mut ec, &graph);
+            assert!(
+                !cookies
+                    .iter()
+                    .any(|cookie| cookie.starts_with("acme-evidence=")),
+                "{case}: the module response's cookie should not reach the response, got: \
+                 {cookies:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_module_that_creates_nothing_still_has_its_headers_applied() {
+        // A module may ask for more client evidence before it can create an
+        // identifier, for example with `Accept-CH`, so its headers reach the
+        // response even though no Edge Cookie is set.
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+        let (settings, mut ec, outcome) = generate_with_header_setting_module(
+            HeaderSettingModule {
+                name: "accept-ch",
+                value: "Sec-CH-UA",
+                id: None,
+            },
+            Some(&graph),
+        );
+        outcome.expect("a module that creates nothing should not fail the request");
+        assert_eq!(ec.ec_value(), None, "the module created no identifier");
+
+        let mut response = http::Response::builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build test response");
+        finalize::ec_finalize_response(
+            &settings,
+            &mut ec,
+            Some(&graph),
+            &registry::PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        assert_eq!(
+            response
+                .headers()
+                .get("accept-ch")
+                .and_then(|value| value.to_str().ok()),
+            Some("Sec-CH-UA"),
+            "the module's header should reach the response"
+        );
+        assert!(
+            !response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .any(|cookie| cookie.starts_with("ts-ec=")),
+            "no Edge Cookie should be set when the module created nothing"
+        );
+    }
+
+    /// A module whose identifier normalizes to a distinct canonical form, to
+    /// prove the identity graph is keyed by the canonical form.
+    ///
+    /// Shared with the identify, finalization, pull sync, admin lookup, auction
+    /// and publisher tests, which need a module whose canonical key is not the
+    /// value the browser carries.
+    #[derive(Debug)]
+    pub(crate) struct CanonicalizingModule;
+
+    impl EdgeCookieModule for CanonicalizingModule {
+        fn id(&self) -> &'static str {
+            "canonical"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0ca")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("MiXeD.CaseId".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, _value: &str) -> bool {
+            true
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_ascii_lowercase()
+        }
+    }
+
+    /// The identifier [`CanonicalizingModule`] creates, as the browser
+    /// carries it in the `ts-ec` cookie.
+    pub(crate) const CANONICAL_COOKIE_VALUE: &str = "t0ca~MiXeD.CaseId";
+
+    /// The identity-graph key generation writes that identifier's row under.
+    /// Pinned to the creation path by
+    /// `generate_keys_the_identity_graph_by_the_normalized_identifier`, which
+    /// asserts both the key generation writes and the key
+    /// [`EcContext::ec_kv_key`] derives.
+    pub(crate) const CANONICAL_KV_KEY: &str = "t0ca~mixed.caseid";
+
+    /// The built-in HMAC module, as an HMAC deployment selects it.
+    ///
+    /// Creating or rotating an identifier needs a selected module, so the
+    /// generation and orphan-recovery tests attach this one. Shared with the
+    /// finalization tests.
+    pub(crate) fn hmac_module() -> Arc<dyn EdgeCookieModule> {
+        Arc::new(crate::ec::module::HmacModule::new(
+            crate::redacted::Redacted::new("test-secret-key-32-bytes-minimum".to_owned()),
+        ))
+    }
+
+    #[test]
+    fn generate_keys_the_identity_graph_by_the_normalized_identifier() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("canonical"));
+        let services = noop_services_with_ec_module(Arc::new(CanonicalizingModule));
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, Some(&graph))
+            .expect("should generate and persist");
+
+        assert_eq!(
+            ec.ec_value(),
+            Some(CANONICAL_COOKIE_VALUE),
+            "the cookie value keeps the module's exact identifier under its code"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_KV_KEY)
+                .expect("should read the graph")
+                .is_some(),
+            "the graph row should be keyed by the code plus the canonical form"
+        );
+        // Pin the read-side derivation to the key generation actually wrote.
+        // Identify, the withdrawal tombstones, and EID ingestion all read the
+        // row through `ec_kv_key`, so the two must never drift apart.
+        assert_eq!(
+            ec.ec_kv_key().as_deref(),
+            Some(CANONICAL_KV_KEY),
+            "the read-side key should be the key generation wrote"
+        );
+    }
+
+    #[test]
+    fn hmac_creates_a_coded_identifier_and_reads_the_legacy_bare_form() {
+        let settings = create_test_settings();
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let services = crate::platform::test_support::noop_services_with_client_ip(
+            std::net::IpAddr::V4(std::net::Ipv4Addr::new(203, 0, 113, 7)),
+        );
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, None)
+            .expect("should generate");
+        let created = ec.ec_value().expect("should create an identifier");
+        assert!(
+            created.starts_with("hmac~"),
+            "a fresh HMAC identifier should carry the hmac code, got {created}"
+        );
+
+        // A bare identifier with no module code still reads back under the
+        // hmac module.
+        let legacy = format!("{}.ABC123", "a".repeat(64));
+        let cookie = format!("ts-ec={legacy}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+        let ec = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            Some(legacy.as_str()),
+            "the legacy bare form should dual-read under the hmac module"
+        );
+    }
+
+    #[test]
+    fn the_request_path_hashes_an_ipv6_client_ip_by_its_64_prefix() {
+        // A device rotates the lower 64 bits of its IPv6 address, so the
+        // context keeps only the /64 prefix and the HMAC module hashes that.
+        // Two addresses in one /64 share an identity hash, and it is the hash
+        // of the prefix.
+        let settings = create_test_settings();
+        let geo = non_regulated_geo();
+        let req = create_test_request(&[]);
+        let prefix = "20010db885a30000";
+        let passphrase = crate::test_support::tests::hmac_passphrase(
+            &settings.ec,
+            crate::ec::module::HMAC_MODULE_KEY,
+        );
+        let expected = generation::generate_ec_id(passphrase, prefix)
+            .expect("should generate from the prefix");
+        for interface in [0x1234, 0xabcd] {
+            let ip = std::net::IpAddr::V6(std::net::Ipv6Addr::new(
+                0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, interface,
+            ));
+            let services = crate::platform::test_support::noop_services_with_client_ip(ip);
+            let mut ec =
+                EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+                    .expect("should read EC context");
+            assert_eq!(
+                ec.client_ip(),
+                Some(prefix),
+                "{ip}: the context should keep the /64 prefix alone"
+            );
+            ec.generate_if_needed(&settings, None)
+                .expect("should generate");
+            let created = ec
+                .ec_value()
+                .and_then(|value| value.strip_prefix("hmac~"))
+                .expect("should create an identifier under the hmac code");
+            assert_eq!(
+                generation::ec_hash(created),
+                generation::ec_hash(&expected),
+                "{ip}: the identity hash should be the hash of the /64 prefix"
+            );
+        }
+    }
+
+    #[test]
+    fn a_foreign_module_code_is_treated_as_absent() {
+        // An identifier carrying another module's code must never be adopted
+        // by the selected module, so switching modules cannot silently mix
+        // identity populations.
+        let settings = create_test_settings();
+        let foreign = format!("zz00~{}.ABC123", "a".repeat(64));
+        let cookie = format!("ts-ec={foreign}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+        let ec = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            None,
+            "an identifier with a foreign module code is not this module's"
+        );
+    }
+
     #[test]
     fn kv_snapshot_distinguishes_non_present_states() {
         assert!(EcKvSnapshot::NotRead.entry_for("ec-1").is_none());
diff --git a/crates/trusted-server-core/src/ec/module.rs b/crates/trusted-server-core/src/ec/module.rs
new file mode 100644
index 0000000000..acff56fc73
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/module.rs
@@ -0,0 +1,1690 @@
+//! Edge Cookie identity modules.
+//!
+//! An [`EdgeCookieModule`] derives an Edge Cookie identifier. The module is
+//! selected by configuration, with no default, and [`build_module`] is the
+//! composition root that builds the selected one. A built-in module is
+//! constructed from its `[ec.<name>]` block, and a vendor module is taken
+//! from the adapter that injected it. Construction reads no request data,
+//! so a selection this deployment cannot satisfy fails at startup rather than
+//! leaving it running without an identity. Fastly, Cloudflare and Spin resolve
+//! the module once per application state and thread the result. Axum and
+//! embedders resolve per request.
+//!
+//! Request evidence reaches a module at call time rather than at
+//! construction. [`EdgeCookieModule::generate`] borrows a [`RequestInfo`],
+//! which carries the normalized client IP, the User-Agent and the request
+//! headers, for the life of the call, alongside an [`IdentityInput`] holding
+//! the request's gating context. A module reads what it needs and retains
+//! nothing. Core snapshots the headers, path and query it lends to the module
+//! at generate time, and the module itself keeps none of it.
+//!
+//! [`HmacModule`] is the built-in server-side implementation. It derives the
+//! identifier from the client IP using HMAC over the configured passphrase.
+
+use std::sync::Arc;
+
+use error_stack::Report;
+use serde::{Deserialize, Serialize};
+
+use crate::consent::ConsentContext;
+use crate::error::TrustedServerError;
+use crate::evidence::RequestInfo;
+use crate::redacted::Redacted;
+use crate::settings::{Ec, EcModuleBlock};
+
+use super::cookies::ec_id_has_only_allowed_chars;
+use super::generation;
+
+/// The Edge Cookie identity module a deployment has selected.
+///
+/// Deserialized from the `[ec] module` string and serialized back to the
+/// same string. Module names are open-ended (a vendor crate names its own),
+/// so every name other than the explicit `"none"` becomes
+/// [`Named`](Self::Named) rather than a parse failure, and whether the
+/// deployment can actually supply that module is decided by
+/// [`build_module`].
+///
+/// No module has a variant of its own, so every module is selected the
+/// same way, by name, and no caller can be written around one module being
+/// different.
+///
+/// This is the one place the selector is spelled. Everything that needs to ask
+/// which module is selected matches on this rather than comparing string
+/// literals.
+#[derive(Debug, Clone, Eq, Hash, PartialEq, Deserialize, Serialize)]
+#[serde(from = "String", into = "String")]
+pub enum EcModuleSelection {
+    /// Explicit statelessness, spelled `"none"`. The same meaning as omitting
+    /// the selector: no Edge Cookie is created and no module block may be
+    /// configured.
+    None,
+
+    /// A module selected by name, configured by the matching `[ec.<name>]`
+    /// block when it has settings. The name is the implementation unless that
+    /// block names one, and [`build_module`] resolves the implementation,
+    /// whether it is built into core or injected by the adapter.
+    Named(String),
+}
+
+impl EcModuleSelection {
+    /// The configuration spelling of explicit statelessness.
+    pub const NONE_KEY: &'static str = "none";
+
+    /// The configuration key this selection is written as.
+    #[must_use]
+    pub fn key(&self) -> &str {
+        match self {
+            Self::None => Self::NONE_KEY,
+            Self::Named(key) => key,
+        }
+    }
+}
+
+impl From<&str> for EcModuleSelection {
+    fn from(key: &str) -> Self {
+        match key {
+            EcModuleSelection::NONE_KEY => Self::None,
+            other => Self::Named(other.to_owned()),
+        }
+    }
+}
+
+impl From<String> for EcModuleSelection {
+    fn from(key: String) -> Self {
+        match key.as_str() {
+            EcModuleSelection::NONE_KEY => Self::None,
+            _ => Self::Named(key),
+        }
+    }
+}
+
+impl From<EcModuleSelection> for String {
+    fn from(selection: EcModuleSelection) -> Self {
+        match selection {
+            EcModuleSelection::None => EcModuleSelection::NONE_KEY.to_owned(),
+            EcModuleSelection::Named(key) => key,
+        }
+    }
+}
+
+/// The implementation id of the HMAC module built into core.
+///
+/// It is also [`HmacModule::id`]'s return value and the text of
+/// [`HMAC_MODULE_CODE`].
+pub const HMAC_MODULE_KEY: &str = "hmac";
+
+/// The type folder of every Edge Cookie crate, which a name written in
+/// `[ec] module` or an `implementation` line may leave off.
+pub const MODULE_TYPE: &str = "edgecookie";
+
+/// The implementation ids core supplies itself, one per resolution arm in
+/// [`resolve_named_module`].
+///
+/// [`build_module`] refuses an injected module under one of these ids
+/// rather than picking one of the two.
+const BUILTIN_MODULE_KEYS: &[&str] = &[HMAC_MODULE_KEY];
+
+/// The registry code of the built-in HMAC module.
+///
+/// The same text as [`HMAC_MODULE_KEY`], but a different role: this is the
+/// `{code}~` namespace stamped on every identifier the built-in module
+/// creates, and it is what [`generation`] matches when it decides whether an
+/// enveloped identifier is one of its own.
+pub const HMAC_MODULE_CODE: ModuleCode = crate::module_code!(HMAC_MODULE_KEY);
+
+/// The request-scoped gating context passed to [`EdgeCookieModule::generate`].
+///
+/// Request data reaches a module through the `request_info` parameter of
+/// [`EdgeCookieModule::generate`], not through this struct and not through
+/// anything injected into the module's constructor. This struct carries only
+/// the per-request gating context a module may read for behavior beyond
+/// gating. On the organic request path the gate has confirmed Edge Cookie
+/// storage is allowed before `generate` is called. A test calling
+/// `edge_cookie::generate_ec_id` reaches `generate` without that gate.
+#[derive(Default)]
+pub struct IdentityInput<'a> {
+    /// The request's consent context, when available, for module-specific
+    /// logic. The core gates generation before calling the module, so a
+    /// module reads this only to forward or record consent. [`HmacModule`]
+    /// ignores it.
+    pub consent: Option<&'a ConsentContext>,
+}
+
+/// The outcome of [`EdgeCookieModule::generate`].
+///
+/// Carries the derived identifier, if any, and any response headers the module
+/// needs set on the outbound response.
+#[derive(Debug, Default)]
+pub struct GeneratedEdgeCookie {
+    /// The derived Edge Cookie identifier, or `None` when the module produced
+    /// none for this request.
+    pub id: Option<String>,
+
+    /// Response headers the module needs set on the outbound response, for
+    /// example to request additional client evidence on later requests. Empty
+    /// for modules that set no headers, such as [`HmacModule`].
+    ///
+    /// Core checks every header here against its own reserved response surface
+    /// (see [`reserved_response_effect`]) before it is applied, so a module
+    /// may set its own cookies and headers but cannot reach into the surface
+    /// core manages.
+    pub response_headers: Vec<(http::HeaderName, http::HeaderValue)>,
+}
+
+/// The cookie-name namespace Trusted Server manages.
+///
+/// Every cookie core writes or reads as part of its own behavior is named
+/// `ts-<something>` (`ts-ec` in [`COOKIE_TS_EC`](crate::constants::COOKIE_TS_EC),
+/// `ts-eids` in [`COOKIE_TS_EIDS`](crate::constants::COOKIE_TS_EIDS), and
+/// `ts-tester` in [`COOKIE_TS_TESTER`](crate::constants::COOKIE_TS_TESTER)), so
+/// core defends the whole prefix rather than a list that a new managed cookie
+/// would silently outgrow. `sharedId` is deliberately not reserved: core only
+/// reads it, and it belongs to the page's own identity stack.
+const MANAGED_COOKIE_NAME_PREFIX: &[u8] = b"ts-";
+
+/// The response-header namespace Trusted Server reserves for itself.
+///
+/// Covers the fixed EC output headers and the per-partner
+/// `x-ts-<source_domain>` headers, which is why the prefix is reserved rather
+/// than the four names in
+/// [`INTERNAL_HEADERS`](crate::constants::INTERNAL_HEADERS).
+const RESERVED_RESPONSE_HEADER_PREFIX: &str = "x-ts-";
+
+/// Response headers that frame an HTTP message, are hop-by-hop, or govern
+/// caching.
+///
+/// The hop-by-hop set is RFC 7230 §6.1, plus `content-length`, which frames the
+/// body the adapter is about to write, and `cache-control`, which governs
+/// whether the response may be cached. A module that set any of these would
+/// be rewriting the response envelope rather than adding evidence to it, and a
+/// module setting `cache-control` could make an identity-bearing response
+/// publicly cacheable, so it is reserved with the rest.
+const FRAMING_OR_HOP_BY_HOP_HEADERS: &[&str] = &[
+    "cache-control",
+    "connection",
+    "content-length",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+];
+
+/// Why one module response header falls inside core's reserved surface.
+#[derive(Debug, Copy, Clone, Eq, PartialEq, derive_more::Display)]
+pub enum ReservedResponseEffect {
+    /// A `Set-Cookie` naming a cookie in the `ts-` namespace core manages.
+    #[display("sets a cookie in the `ts-` namespace Trusted Server manages")]
+    ManagedCookie,
+
+    /// A header in the `x-ts-` namespace core emits and strips.
+    #[display("sets a header in the reserved `x-ts-` namespace")]
+    ReservedHeader,
+
+    /// A framing, hop-by-hop, or caching header core manages.
+    #[display("sets a framing, hop-by-hop, or caching header core manages")]
+    FramingHeader,
+}
+
+/// The cookie name in a `Set-Cookie` value, as raw bytes.
+///
+/// Reads the bytes rather than a `&str` so a value that is not valid UTF-8
+/// cannot smuggle a managed cookie name past the check.
+fn set_cookie_name(value: &[u8]) -> &[u8] {
+    let pair_end = value.iter().position(|b| *b == b';').unwrap_or(value.len());
+    let pair = &value[..pair_end];
+    let name_end = pair.iter().position(|b| *b == b'=').unwrap_or(pair.len());
+    pair[..name_end].trim_ascii()
+}
+
+/// Classifies one module response header against core's reserved surface.
+///
+/// Returns `Some` when the header would reach into what core manages, and
+/// `None` for everything else, including a module's own cookie. Modules
+/// legitimately need to set cookies of their own (an evidence cookie for a
+/// later request, for example), so the rule reserves core's namespace rather
+/// than banning `Set-Cookie` outright.
+///
+/// A rejected effect is not simply dropped while the rest of the module
+/// response goes ahead. Generation returns an error instead, as it does for a
+/// module creating an identifier outside the cookie-safe alphabet, because a
+/// module reaching into the reserved surface has broken its contract in the
+/// same way. The check runs before anything from that module response is
+/// kept, so neither its identifier nor any of its headers is kept. The
+/// publisher proxy and integration proxy log the error and serve the response
+/// without an Edge Cookie, and orphan recovery in EC finalization leaves the
+/// visitor's existing cookie in place. Applying the header instead would let a
+/// module set `ts-ec` directly, bypassing core's identifier validation and
+/// its requirement that a created identifier have an identity-graph row.
+#[must_use]
+pub fn reserved_response_effect(
+    name: &http::HeaderName,
+    value: &http::HeaderValue,
+) -> Option<ReservedResponseEffect> {
+    let lower = name.as_str();
+    if lower == http::header::SET_COOKIE.as_str() {
+        let cookie_name = set_cookie_name(value.as_bytes());
+        if cookie_name.len() >= MANAGED_COOKIE_NAME_PREFIX.len()
+            && cookie_name[..MANAGED_COOKIE_NAME_PREFIX.len()]
+                .eq_ignore_ascii_case(MANAGED_COOKIE_NAME_PREFIX)
+        {
+            return Some(ReservedResponseEffect::ManagedCookie);
+        }
+        return None;
+    }
+    if lower.starts_with(RESERVED_RESPONSE_HEADER_PREFIX) {
+        return Some(ReservedResponseEffect::ReservedHeader);
+    }
+    if FRAMING_OR_HOP_BY_HOP_HEADERS.contains(&lower) {
+        return Some(ReservedResponseEffect::FramingHeader);
+    }
+    None
+}
+
+/// Appends a module's response headers to a response that already carries
+/// the publisher origin's own.
+///
+/// Appending keeps the origin's `Set-Cookie` and `Vary` lines, and lets a
+/// module set more than one cookie of its own.
+/// [`reserved_response_effect`] has already refused the single-valued headers
+/// core owns, so nothing a module may set here needs to replace a value.
+pub(crate) fn apply_module_response_headers<I>(headers: &mut http::HeaderMap, module_headers: I)
+where
+    I: IntoIterator<Item = (http::HeaderName, http::HeaderValue)>,
+{
+    for (name, value) in module_headers {
+        headers.append(name, value);
+    }
+}
+
+/// The registered short code that namespaces one Edge Cookie module's
+/// identifiers.
+///
+/// Exactly four characters from `[a-z0-9]`, allocated append-only in the
+/// module-code registry and never reused. The code appears as the
+/// `{code}~` prefix of every identifier the module creates, so identifiers
+/// from different modules can never collide in the cookie, the identity
+/// graph, or a withdrawal, and each identifier records which module
+/// created it.
+#[derive(Debug, Copy, Clone, Eq, Hash, PartialEq, derive_more::Display)]
+pub struct ModuleCode(&'static str);
+
+impl ModuleCode {
+    /// Creates a module code when `code` matches the registry format.
+    ///
+    /// Returns `None` when `code` is not exactly four characters of `[a-z0-9]`,
+    /// so a caller that assembles a code from anything other than a literal is
+    /// handed an answer it has to deal with rather than a panic. Nothing in
+    /// this function can panic, whatever it is called with and wherever it is
+    /// called from.
+    ///
+    /// Use [`module_code!`](crate::module_code) for a literal. That macro
+    /// runs this check while the crate is compiled, so a malformed code is a
+    /// build failure and the resulting value needs no unwrapping.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use trusted_server_core::ec::module::ModuleCode;
+    ///
+    /// assert_eq!(ModuleCode::new("t0ac").map(ModuleCode::as_str), Some("t0ac"));
+    /// assert_eq!(ModuleCode::new("nope!"), None);
+    /// ```
+    #[must_use]
+    pub const fn new(code: &'static str) -> Option<Self> {
+        let bytes = code.as_bytes();
+        if bytes.len() != 4 {
+            return None;
+        }
+        let mut i = 0;
+        while i < bytes.len() {
+            let b = bytes[i];
+            if !b.is_ascii_lowercase() && !b.is_ascii_digit() {
+                return None;
+            }
+            i += 1;
+        }
+        Some(Self(code))
+    }
+
+    /// The code as a string slice.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        self.0
+    }
+}
+
+/// Builds a [`ModuleCode`] from a constant, checked while the crate is
+/// compiled.
+///
+/// The check runs inside a `const` block, so a code that is not exactly four
+/// characters of `[a-z0-9]` fails the build instead of panicking at run time,
+/// and the value the macro produces needs no unwrapping. Every module code in
+/// this workspace is written through this macro, which is what makes
+/// [`ModuleCode::new`]'s fallible form safe to hand to anyone else.
+///
+/// # Examples
+///
+/// ```
+/// use trusted_server_core::module_code;
+///
+/// assert_eq!(module_code!("t0ac").as_str(), "t0ac");
+/// ```
+#[macro_export]
+macro_rules! module_code {
+    ($code:expr) => {
+        const {
+            match $crate::ec::module::ModuleCode::new($code) {
+                Some(code) => code,
+                None => panic!("module code must be exactly four characters of [a-z0-9]"),
+            }
+        }
+    };
+}
+
+/// The separator between a module code and the module's identifier value.
+///
+/// The tilde is inside the cookie-safe identifier alphabet and outside the
+/// built-in HMAC identifier's own characters, so a legacy bare identifier can
+/// never be misread as a coded one.
+pub const MODULE_CODE_SEPARATOR: char = '~';
+
+/// Splits a full identifier into its module-code prefix and value.
+///
+/// Returns `(Some(code), value)` when the identifier starts with a well-formed
+/// `{code}~` prefix, and `(None, full)` for a legacy bare identifier. The code
+/// here is the raw string, not a validated [`ModuleCode`]: an unknown code
+/// simply fails the ownership check against the selected module.
+#[must_use]
+pub fn split_module_code(full: &str) -> (Option<&str>, &str) {
+    if let Some((code, value)) = full.split_once(MODULE_CODE_SEPARATOR)
+        && code.len() == 4
+        && code
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit())
+    {
+        return (Some(code), value);
+    }
+    (None, full)
+}
+
+/// Whether the selected module owns `full` as one of its identifiers.
+///
+/// A coded identifier belongs to the module whose registered code it
+/// carries, with the value part accepted by that module's
+/// [`accepts_id`](EdgeCookieModule::accepts_id). An identifier with no code
+/// prefix is the built-in HMAC module's older form, still held in browsers,
+/// so the HMAC module alone owns it.
+#[must_use]
+pub fn module_owns_id(module: &dyn EdgeCookieModule, full: &str) -> bool {
+    match split_module_code(full) {
+        (Some(code), value) => code == module.code().as_str() && module.accepts_id(value),
+        (None, value) => module.id() == HMAC_MODULE_KEY && module.accepts_id(value),
+    }
+}
+
+/// The full created identifier for `value` under `module`'s code.
+#[must_use]
+pub fn apply_module_code(module: &dyn EdgeCookieModule, value: &str) -> String {
+    format!("{}{MODULE_CODE_SEPARATOR}{value}", module.code())
+}
+
+/// The KV-key form of a full identifier under `module`.
+///
+/// The code prefix is preserved verbatim and the module normalizes only its
+/// own value part, so distinct modules' rows can never share a key and a
+/// module never sees another module's syntax.
+#[must_use]
+pub fn module_kv_key(module: &dyn EdgeCookieModule, full: &str) -> String {
+    match split_module_code(full) {
+        (Some(code), value) => format!(
+            "{code}{MODULE_CODE_SEPARATOR}{}",
+            module.normalize_id_for_kv(value)
+        ),
+        (None, value) => module.normalize_id_for_kv(value),
+    }
+}
+
+/// The modules whose identifiers a partner or diagnostic path accepts.
+///
+/// Pull sync, batch sync, and the admin lookup each take an identifier from
+/// outside the organic request path and have to decide whether Trusted Server
+/// issued it. The answer is in two parts. The **global cookie bounds** (the
+/// length cap and the cookie-safe alphabet, see `ec_id_has_only_allowed_chars`)
+/// apply to every identifier whichever module created it. The rest is
+/// **dispatched by the `{code}~` prefix** to the module that owns that code,
+/// which canonicalizes its own value part and decides whether the canonical
+/// form is one of its own. A code no module in the set owns is rejected, so a
+/// second module's identifiers can never be adopted or written under this
+/// deployment's keys.
+///
+/// All three look rows up under the key
+/// [`canonical_kv_key`](Self::canonical_kv_key) returns rather than under the
+/// identifier as given, and pull sync and batch sync also write under that
+/// key, so a module whose canonical form differs from the cookie value still
+/// reaches the row it created. Batch sync and the admin lookup call
+/// `canonical_kv_key` directly. Pull sync calls `canonical_kv_key` through
+/// `EcContext::kv_key_for` and still sends partners the identifier as issued.
+///
+/// The set holds the deployment's active module, so an identifier another
+/// module created is rejected, one created under an earlier selection
+/// included. A stateless deployment, with no module in the set, falls back
+/// to the built-in HMAC grammar (see
+/// [`canonical_kv_key`](Self::canonical_kv_key)).
+pub struct AcceptedModules<'a> {
+    readers: Vec<&'a dyn EdgeCookieModule>,
+}
+
+impl<'a> AcceptedModules<'a> {
+    /// The set holding only the deployment's active module.
+    ///
+    /// `None` means no module is selected, so the deployment is stateless.
+    #[must_use]
+    pub fn active(module: Option<&'a dyn EdgeCookieModule>) -> Self {
+        Self {
+            readers: module.into_iter().collect(),
+        }
+    }
+
+    /// The module in the set that owns `full`'s code.
+    ///
+    /// Dispatch is on the code alone, before any module looks at a value, so
+    /// an identifier a partner echoed back in a different case still reaches
+    /// its own module to be canonicalized rather than being rejected first.
+    /// A legacy bare identifier predates the envelope and belongs to the
+    /// built-in HMAC module alone.
+    fn owner(&self, full: &str) -> Option<&'a dyn EdgeCookieModule> {
+        let (code, _) = split_module_code(full);
+        self.readers.iter().copied().find(|module| match code {
+            Some(code) => module.code().as_str() == code,
+            None => module.id() == HMAC_MODULE_KEY,
+        })
+    }
+
+    /// Whether `full` is an identifier this deployment accepts.
+    #[must_use]
+    pub fn accepts(&self, full: &str) -> bool {
+        self.canonical_kv_key(full).is_some()
+    }
+
+    /// The identity-graph key for `full`, or `None` when nothing in the set
+    /// accepts it.
+    ///
+    /// The owning module supplies the canonical form of its own value part
+    /// and the code prefix is preserved verbatim, so two modules' rows can
+    /// never share a key.
+    #[must_use]
+    pub fn canonical_kv_key(&self, full: &str) -> Option<String> {
+        if !ec_id_has_only_allowed_chars(full) {
+            return None;
+        }
+        match self.owner(full) {
+            Some(owner) => {
+                let key = module_kv_key(owner, full);
+                module_owns_id(owner, &key).then_some(key)
+            }
+            // No module is selected, so there is no code to dispatch on and
+            // the built-in HMAC grammar is the fallback for a stateless
+            // deployment.
+            None if self.readers.is_empty() => {
+                let key = generation::normalize_ec_id_for_kv(full);
+                generation::is_valid_ec_id(&key).then_some(key)
+            }
+            // A code that belongs to some other deployment's module.
+            None => None,
+        }
+    }
+}
+
+/// A strategy for deriving an Edge Cookie identifier.
+///
+/// Implementations are selected by configuration. A module derives the
+/// identifier at the edge in [`generate`](Self::generate), and the page
+/// response sets the `ts-ec` cookie.
+///
+/// A module that cannot derive an identifier at the edge returns a
+/// [`GeneratedEdgeCookie`] whose [`id`](GeneratedEdgeCookie::id) is `None`, so
+/// the request proceeds without an Edge Cookie rather than failing.
+pub trait EdgeCookieModule: Send + Sync + core::fmt::Debug {
+    /// Returns the stable implementation id for this module, used in
+    /// configuration and logs.
+    ///
+    /// This is what `[ec] module` selects the module by, or what an
+    /// `[ec.<name>] implementation` names when the module is configured
+    /// under a label of the operator's choosing.
+    fn id(&self) -> &'static str;
+
+    /// The module's registered code, the `{code}~` namespace of every
+    /// identifier it creates.
+    ///
+    /// Mandatory, with no default: a module must allocate a unique code in
+    /// the module-code registry before it can exist, so no two modules
+    /// can ever create colliding identifiers. Core applies the code at
+    /// creation and checks it at read-back, and the module itself only ever
+    /// sees its own value part.
+    fn code(&self) -> ModuleCode;
+
+    /// Derives an Edge Cookie identifier from the request evidence in
+    /// `request_info` and the gating context in `input`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::EdgeCookie`] when derivation fails.
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>>;
+
+    /// Returns whether `value` is a well-formed identifier this module issues.
+    ///
+    /// Core calls this to decide whether an incoming `ts-ec` cookie value is a
+    /// usable Edge Cookie identifier before reading it back, keying the KV
+    /// identity graph, or withdrawing it. Core strips the module's `{code}~`
+    /// prefix first, so this receives only the module's own value part.
+    /// This keeps the identifier opaque to
+    /// core: a module whose identifiers are not the built-in shape (for
+    /// example an opaque signed envelope) accepts its own format here, so its
+    /// identifier round-trips instead of being silently dropped on read-back.
+    /// Core also asks about the string
+    /// [`normalize_id_for_kv`](Self::normalize_id_for_kv) returns.
+    ///
+    /// The default accepts the built-in HMAC identifier shape
+    /// (`<64 hex>.<6 alphanumeric>`), which is correct for [`HmacModule`], the
+    /// one module core builds in.
+    fn accepts_id(&self, value: &str) -> bool {
+        generation::is_valid_ec_id(value)
+    }
+
+    /// Returns the identity two visits must share to be treated as the same
+    /// visitor, which is what core keys the identity graph by.
+    ///
+    /// Core builds the key from the module's code and the returned string, so
+    /// two identifiers that return the same string share one row and two that
+    /// differ never meet. A module whose identifier carries a signature, a
+    /// nonce, a timestamp or any other part that changes each time the
+    /// identifier is issued must return the stable part and not the value as
+    /// transported, or the identity does not survive a reissue. A module whose
+    /// whole identifier is stable returns it unchanged, keeping its case where
+    /// case matters, so distinct identifiers are not collapsed into one key.
+    ///
+    /// Core asks [`accepts_id`](Self::accepts_id) about the returned string as
+    /// well as about the identifier as issued, so a module must accept its own
+    /// canonical form, or no row is read or written for it.
+    ///
+    /// The default lowercases the leading HMAC hash segment and preserves the
+    /// suffix, matching the built-in identifier shape.
+    fn normalize_id_for_kv(&self, value: &str) -> String {
+        generation::normalize_ec_id_for_kv(value)
+    }
+}
+
+/// The built-in HMAC Edge Cookie module.
+///
+/// Derives the identifier from the client IP (read from the [`RequestInfo`]
+/// passed at call time) and the configured passphrase via
+/// [`generation::generate_ec_id`].
+///
+/// The client IP is this module's only input, so it is this module that
+/// requires one. On a host that cannot supply one, [`RequestInfo::client_ip`]
+/// is the empty string and [`generate`](Self::generate) fails rather than
+/// hashing the empty string into an identifier every visitor on that host
+/// would share. The failure is returned to the caller. The publisher proxy and
+/// integration proxy log it and serve the response without an Edge Cookie. A
+/// module that reads other evidence makes its own decision and is unaffected.
+#[derive(Debug, Clone)]
+pub struct HmacModule {
+    passphrase: Redacted<String>,
+}
+
+impl HmacModule {
+    /// Creates an HMAC module with the given passphrase.
+    #[must_use]
+    pub fn new(passphrase: Redacted<String>) -> Self {
+        Self { passphrase }
+    }
+}
+
+impl EdgeCookieModule for HmacModule {
+    fn id(&self) -> &'static str {
+        HMAC_MODULE_KEY
+    }
+
+    fn code(&self) -> ModuleCode {
+        HMAC_MODULE_CODE
+    }
+
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        _input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+        let client_ip = request_info.client_ip();
+        if client_ip.is_empty() {
+            return Err(Report::new(TrustedServerError::EdgeCookie {
+                message: "Edge Cookie module `hmac` requires the client IP, and this host \
+                          could not supply one"
+                    .to_owned(),
+            }));
+        }
+        let id = generation::generate_ec_id(self.passphrase.expose(), client_ip)?;
+        Ok(GeneratedEdgeCookie {
+            id: Some(id),
+            response_headers: Vec::new(),
+        })
+    }
+}
+
+/// Refuses an injected module that claims an implementation core supplies
+/// itself.
+///
+/// An adapter may inject a module whose id is also a built-in id, and the
+/// resolution order alone would silently prefer the built-in one and drop the
+/// injected module, so the pair is refused and the error names both
+/// claimants. The check runs before the selection is read, so the clash is
+/// reported at startup whatever the selector says, and selecting something
+/// else cannot hide it.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the injected module's id
+/// is one of [`BUILTIN_MODULE_KEYS`].
+fn ensure_no_name_collision(
+    injected: Option<&dyn EdgeCookieModule>,
+) -> Result<(), Report<TrustedServerError>> {
+    let Some(injected) = injected else {
+        return Ok(());
+    };
+    let Some(claimed) = BUILTIN_MODULE_KEYS
+        .iter()
+        .find(|key| **key == injected.id())
+    else {
+        return Ok(());
+    };
+    Err(Report::new(TrustedServerError::EdgeCookie {
+        message: format!(
+            "Edge Cookie module implementation `{claimed}` is claimed twice, by the \
+             module built into Trusted Server core and by the module this \
+             deployment's adapter injects. Give the injected module an implementation \
+             of its own and select it under that, because `{claimed}` cannot mean both \
+             of them."
+        ),
+    }))
+}
+
+/// Builds the Edge Cookie module named by the `[ec] module` selector.
+///
+/// This is the composition root for the Edge Cookie module. It reads the
+/// `[ec]` configuration and takes the adapter's optional injected module,
+/// resolving the selector to the built-in module or the injected one. The
+/// per-request [`RequestInfo`] is passed borrowed to
+/// [`generate`](EdgeCookieModule::generate) at call time rather than stored,
+/// so no request snapshot is cloned here. Returns `Ok(None)` when no module
+/// is selected, so the caller stays stateless.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the named module cannot be
+/// built, which is a built-in implementation whose configuration block is
+/// missing, or an implementation this deployment's adapter does not inject.
+/// Both fail loudly rather than leaving the deployment running stateless under
+/// a selector that says otherwise.
+pub fn build_module(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<Option<Box<dyn EdgeCookieModule>>, Report<TrustedServerError>> {
+    ensure_no_name_collision(injected.as_deref())?;
+    let Some(selection) = ec.module.as_ref() else {
+        return Ok(None);
+    };
+    let module: Option<Box<dyn EdgeCookieModule>> = match selection {
+        // Explicit statelessness: the same meaning as omitting the selector.
+        EcModuleSelection::None => None,
+        EcModuleSelection::Named(name) => Some(resolve_named_module(name, ec, injected)?),
+    };
+    Ok(module)
+}
+
+/// Resolves one module name to its implementation.
+///
+/// The implementation is the one the name's `[ec.<name>]` block names, or the
+/// name itself. It is looked for among the modules built into core first,
+/// and is otherwise the module the adapter injects through
+/// [`RuntimeServices`](crate::platform::RuntimeServices) when the
+/// implementation names that module's id, written in full or with the
+/// `edgecookie` type folder left off, so resolving an injected module
+/// needs no vendor name in core. The adapter reads the injected module's
+/// block when it builds it. Looking at core first cannot shadow an injected
+/// module, because [`ensure_no_name_collision`] has already refused one that
+/// claims a built-in implementation.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the implementation matches
+/// no module this deployment can build, naming the implementations it has,
+/// or when a built-in implementation has no configuration block.
+fn resolve_named_module(
+    name: &str,
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<Box<dyn EdgeCookieModule>, Report<TrustedServerError>> {
+    let implementation = ec.module_blocks.implementation(name);
+
+    // Settings validation rejects a built-in implementation with no block
+    // before this runs, so reaching the error means the two checks have
+    // drifted apart. Stopping is the only safe answer, because returning no
+    // module would run the deployment stateless under a selector that says
+    // it has an identity module.
+    if implementation == HMAC_MODULE_KEY {
+        let config = ec
+            .module_blocks
+            .get(name)
+            .and_then(EcModuleBlock::hmac_settings)
+            .ok_or_else(|| {
+                Report::new(TrustedServerError::EdgeCookie {
+                    message: format!(
+                        "Edge Cookie module `{name}` uses the `hmac` implementation but \
+                         has no `[ec.{name}]` configuration"
+                    ),
+                })
+            })?;
+        return Ok(Box::new(HmacModule::new(config.passphrase.clone())));
+    }
+
+    let known = known_implementations(injected.as_deref());
+    injected
+        .filter(|module| {
+            crate::module_name::resolve(MODULE_TYPE, implementation, &[module.id()]).is_some()
+        })
+        .map(|module| Box::new(SharedModule(module)) as Box<dyn EdgeCookieModule>)
+        .ok_or_else(|| {
+            Report::new(TrustedServerError::EdgeCookie {
+                message: format!(
+                    "Edge Cookie module `{name}` is selected, but its implementation \
+                     `{implementation}` is not one this deployment has. Known \
+                     implementations: {known}"
+                ),
+            })
+        })
+}
+
+/// The implementations this deployment could build, for an error that has just
+/// refused one it could not.
+///
+/// The modules built into core, plus the one the adapter injects when there
+/// is one, which is the whole set [`resolve_named_module`] chooses from.
+fn known_implementations(injected: Option<&dyn EdgeCookieModule>) -> String {
+    BUILTIN_MODULE_KEYS
+        .iter()
+        .copied()
+        .chain(injected.map(EdgeCookieModule::id))
+        .map(|implementation| format!("`{implementation}`"))
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+/// Checks once, at startup, that this deployment can build the module named
+/// by the `[ec] module` selector.
+///
+/// The composition root calls this while it builds application state, passing
+/// the same injected module it will put into
+/// [`RuntimeServices`](crate::platform::RuntimeServices) on every request.
+/// [`build_module`] reads no request data, so the answer is the same for
+/// every request and a selection the adapter can never supply fails at startup
+/// rather than on the first request. A stateless deployment (no selector, or
+/// `"none"`) passes.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the selected module cannot
+/// be built from the services this deployment injects.
+pub fn ensure_module_available(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<(), Report<TrustedServerError>> {
+    build_shared_module(ec, injected)?;
+    Ok(())
+}
+
+/// Resolves the selected module into a shared handle the composition root can
+/// keep and the request path can reuse.
+///
+/// The same resolution as [`build_module`], returned as an `Arc` rather than
+/// a `Box` so one instance can be threaded into
+/// [`RuntimeServices`](crate::platform::RuntimeServices) and read by every
+/// request without being built again. An adapter that calls this while it
+/// builds application state gets the startup check
+/// [`ensure_module_available`] performs and the module itself for one piece
+/// of work rather than two.
+///
+/// # Errors
+///
+/// The same errors as [`build_module`].
+pub fn build_shared_module(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<Option<Arc<dyn EdgeCookieModule>>, Report<TrustedServerError>> {
+    Ok(build_module(ec, injected)?.map(Arc::from))
+}
+
+/// The Edge Cookie module to use for this request.
+///
+/// A module reaches the request path through one seam only. An adapter
+/// resolves `[ec] module` once while it builds application state and threads
+/// the answer into
+/// [`RuntimeServices::resolved_ec_module`](crate::platform::RuntimeServices::resolved_ec_module),
+/// and that same instance comes back here with nothing resolved or constructed
+/// again on the request path. When nothing was threaded, this builds from
+/// `[ec]` settings alone, which is what a deployment selecting only a built-in
+/// module does.
+///
+/// # Errors
+///
+/// The same errors as [`build_module`], and only when the adapter threaded
+/// nothing, because a threaded module has already been resolved successfully.
+pub fn request_module(
+    ec: &Ec,
+    services: &crate::platform::RuntimeServices,
+) -> Result<Option<Arc<dyn EdgeCookieModule>>, Report<TrustedServerError>> {
+    if let Some(resolved) = services.resolved_ec_module() {
+        return Ok(Some(resolved));
+    }
+    build_shared_module(ec, None)
+}
+
+/// Adapts an injected, shared [`EdgeCookieModule`] to the owned `Box` that
+/// [`build_module`] returns.
+///
+/// A vendor or host module is injected as an `Arc` so it can live in
+/// [`RuntimeServices`](crate::platform::RuntimeServices) and be cloned per
+/// request. Every method delegates to the inner module, so its behavior is
+/// unchanged.
+#[derive(Debug)]
+struct SharedModule(Arc<dyn EdgeCookieModule>);
+
+impl EdgeCookieModule for SharedModule {
+    fn code(&self) -> ModuleCode {
+        self.0.code()
+    }
+
+    fn id(&self) -> &'static str {
+        self.0.id()
+    }
+
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+        self.0.generate(request_info, input)
+    }
+
+    fn accepts_id(&self, value: &str) -> bool {
+        self.0.accepts_id(value)
+    }
+
+    fn normalize_id_for_kv(&self, value: &str) -> String {
+        self.0.normalize_id_for_kv(value)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_support::tests::select_hmac_module;
+
+    /// Settings selecting the built-in HMAC module under `name`, which is a
+    /// label whenever it is not the implementation's own name.
+    fn selected_hmac(name: &str) -> Ec {
+        let mut ec = Ec::default();
+        select_hmac_module(&mut ec, name, test_passphrase().expose());
+        ec
+    }
+
+    #[test]
+    fn a_malformed_module_code_is_refused_rather_than_panicking() {
+        // `ModuleCode::new` is public, so a vendor crate can reach it with a
+        // value it assembled rather than a literal. Every rejected shape has to
+        // come back as `None`, because a panic here would take down whatever
+        // request the caller was serving.
+        for malformed in ["", "abc", "abcde", "AB12", "t0a_", "t0a-", "t0a ", "t.ac"] {
+            assert_eq!(
+                ModuleCode::new(malformed),
+                None,
+                "`{malformed}` is outside the registry format and should be refused"
+            );
+        }
+
+        assert_eq!(
+            ModuleCode::new("t0ac").map(ModuleCode::as_str),
+            Some("t0ac"),
+            "a well-formed code should still be accepted"
+        );
+    }
+
+    #[test]
+    fn the_module_code_macro_keeps_the_compile_time_guarantee() {
+        // The macro checks a literal while the crate is compiled and yields the
+        // code itself, so the codes written across this workspace stay as
+        // strong as the old panicking constructor made them, with none of the
+        // run-time risk.
+        assert_eq!(
+            crate::module_code!("t0ac").as_str(),
+            "t0ac",
+            "the macro should yield the code it was given"
+        );
+        assert_eq!(
+            HMAC_MODULE_CODE.as_str(),
+            HMAC_MODULE_KEY,
+            "the built-in code should still be the built-in key"
+        );
+    }
+
+    #[test]
+    fn split_module_code_separates_coded_and_legacy_forms() {
+        assert_eq!(
+            split_module_code("hmac~abc.DEF123"),
+            (Some("hmac"), "abc.DEF123"),
+            "a four-character code before the first tilde splits off"
+        );
+        assert_eq!(
+            split_module_code("51dd~value~with~tildes"),
+            (Some("51dd"), "value~with~tildes"),
+            "only the first tilde splits, so a value may contain tildes"
+        );
+        assert_eq!(
+            split_module_code("abcdef.XYZ"),
+            (None, "abcdef.XYZ"),
+            "no tilde means the legacy bare form"
+        );
+        assert_eq!(
+            split_module_code("toolong~x"),
+            (None, "toolong~x"),
+            "a prefix that is not exactly four characters is not a code"
+        );
+        assert_eq!(
+            split_module_code("AB12~x"),
+            (None, "AB12~x"),
+            "uppercase is outside the code alphabet"
+        );
+    }
+
+    fn header(name: &str, value: &str) -> (http::HeaderName, http::HeaderValue) {
+        (
+            http::HeaderName::from_bytes(name.as_bytes()).expect("should parse header name"),
+            http::HeaderValue::from_str(value).expect("should parse header value"),
+        )
+    }
+
+    #[test]
+    fn reserved_response_effect_rejects_the_namespace_core_manages() {
+        for (name, value, expected) in [
+            (
+                "set-cookie",
+                "ts-ec=hmac~deadbeef.abc123; Path=/",
+                ReservedResponseEffect::ManagedCookie,
+            ),
+            (
+                "Set-Cookie",
+                "  TS-EIDS=x; Path=/",
+                ReservedResponseEffect::ManagedCookie,
+            ),
+            ("x-ts-ec", "spoofed", ReservedResponseEffect::ReservedHeader),
+            (
+                "X-TS-partner.example.com",
+                "uid",
+                ReservedResponseEffect::ReservedHeader,
+            ),
+            ("content-length", "0", ReservedResponseEffect::FramingHeader),
+            (
+                "Transfer-Encoding",
+                "chunked",
+                ReservedResponseEffect::FramingHeader,
+            ),
+            ("connection", "close", ReservedResponseEffect::FramingHeader),
+            (
+                "cache-control",
+                "public, max-age=31536000",
+                ReservedResponseEffect::FramingHeader,
+            ),
+            (
+                "Cache-Control",
+                "public",
+                ReservedResponseEffect::FramingHeader,
+            ),
+        ] {
+            let (name, value) = header(name, value);
+            assert_eq!(
+                reserved_response_effect(&name, &value),
+                Some(expected),
+                "`{name}` should be reserved"
+            );
+        }
+    }
+
+    #[test]
+    fn reserved_response_effect_allows_module_owned_effects() {
+        for (name, value) in [
+            ("set-cookie", "acme-evidence=abc; Path=/; Secure"),
+            ("set-cookie", "sharedId=abc"),
+            ("accept-ch", "Sec-CH-UA-Full-Version-List"),
+            ("x-acme-probe", "1"),
+            ("vary", "Sec-CH-UA"),
+        ] {
+            let (name, value) = header(name, value);
+            assert_eq!(
+                reserved_response_effect(&name, &value),
+                None,
+                "`{name}` is the module's own and should be allowed"
+            );
+        }
+    }
+
+    #[test]
+    fn reserved_response_effect_reads_a_non_utf8_set_cookie_as_bytes() {
+        // A `Set-Cookie` carrying a byte above 127 cannot be read as a string,
+        // so the cookie name is matched on raw bytes. Reading it as UTF-8 and
+        // giving up on failure would let this value through.
+        let name = http::header::SET_COOKIE;
+        let mut bytes = b"ts-ec=value".to_vec();
+        bytes.push(0xff);
+        bytes.extend_from_slice(b"; Path=/");
+        let value =
+            http::HeaderValue::from_bytes(&bytes).expect("should build a non-utf8 header value");
+        assert!(
+            value.to_str().is_err(),
+            "the test value should not be readable as UTF-8"
+        );
+        assert_eq!(
+            reserved_response_effect(&name, &value),
+            Some(ReservedResponseEffect::ManagedCookie),
+            "a non-UTF-8 Set-Cookie should still be matched on its cookie name"
+        );
+    }
+
+    /// A stand-in for a vendor module an adapter injects.
+    #[derive(Debug)]
+    struct VendorModule;
+
+    impl EdgeCookieModule for VendorModule {
+        fn id(&self) -> &'static str {
+            "acme"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0ac")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+    }
+
+    #[test]
+    fn accepted_modules_splits_global_bounds_from_module_dispatch() {
+        let hmac = HmacModule::new(Redacted::new("test-secret-key-32-bytes-minimum".to_owned()));
+        let hmac_value = format!("{}.ABC123", "a".repeat(64));
+        let active = AcceptedModules::active(Some(&hmac));
+
+        // The global bounds come first and apply whoever created the value. A
+        // character outside the cookie-safe alphabet, or a value over the
+        // length cap, never reaches a module.
+        assert!(
+            !active.accepts(&format!("hmac~{hmac_value} with spaces")),
+            "the cookie-safe alphabet is a global bound"
+        );
+        assert!(
+            !active.accepts(&format!("hmac~{}", "a".repeat(300))),
+            "the length cap is a global bound"
+        );
+
+        // Then dispatch by code to the module that owns it.
+        assert!(
+            active.accepts(&format!("hmac~{hmac_value}")),
+            "the active module's own code is accepted"
+        );
+        assert!(
+            active.accepts(&hmac_value),
+            "the legacy bare form belongs to the built-in module"
+        );
+        assert!(
+            !active.accepts(&format!("t0ac~{hmac_value}")),
+            "a code no configured module reads is rejected even in the HMAC shape"
+        );
+
+        // A vendor module's own identifiers are accepted when it is the
+        // active one, and the built-in bare form then belongs to nobody.
+        let vendor = AcceptedModules::active(Some(&VendorModule));
+        assert!(
+            vendor.accepts(&format!("t0ac~{hmac_value}")),
+            "the vendor module's code is accepted when it is active"
+        );
+        assert!(
+            !vendor.accepts(&hmac_value),
+            "the legacy bare form is the built-in module's alone"
+        );
+
+        // With no module selected the deployment is stateless, so the
+        // built-in grammar is the fallback, as it has always been.
+        let stateless = AcceptedModules::active(None);
+        assert!(
+            stateless.accepts(&hmac_value),
+            "a stateless deployment falls back to the built-in grammar"
+        );
+        assert!(
+            !stateless.accepts("not-an-identifier"),
+            "the fallback is still the built-in grammar, not anything goes"
+        );
+    }
+
+    #[test]
+    fn the_selector_round_trips_through_serialization() {
+        // The typed selector must not change the configuration surface. The
+        // same TOML has to parse to the same choice, and serializing has to
+        // write the same key back, so an existing operator configuration keeps
+        // working and a config push does not rewrite the selector.
+        for (key, expected) in [
+            (EcModuleSelection::NONE_KEY, EcModuleSelection::None),
+            (
+                HMAC_MODULE_KEY,
+                EcModuleSelection::Named(HMAC_MODULE_KEY.to_owned()),
+            ),
+            ("acme", EcModuleSelection::Named("acme".to_owned())),
+        ] {
+            let ec: Ec = toml::from_str(&format!("module = \"{key}\""))
+                .expect("should parse the [ec] section");
+            assert_eq!(
+                ec.module.as_ref(),
+                Some(&expected),
+                "`{key}` should select the module it names"
+            );
+            assert_eq!(
+                expected.key(),
+                key,
+                "`{key}` should report itself under the key it was written as"
+            );
+
+            // The serialized form is the string itself, byte for byte, so an
+            // operator configuration written before the selector was typed
+            // parses and is written back identically.
+            let value =
+                toml::Value::try_from(expected.clone()).expect("should serialize the selection");
+            assert_eq!(
+                value,
+                toml::Value::String(key.to_owned()),
+                "`{key}` should serialize to exactly its own string"
+            );
+
+            let written = toml::to_string(&ec).expect("should serialize the [ec] section");
+            assert!(
+                written.contains(&format!("module = \"{key}\"")),
+                "`{key}` should be written back unchanged, got: {written}"
+            );
+
+            // A full round trip through the document leaves the same choice.
+            let reparsed: Ec = toml::from_str(&written).expect("should reparse the [ec] section");
+            assert_eq!(
+                reparsed.module.as_ref(),
+                Some(&expected),
+                "`{key}` should survive a serialize and parse round trip"
+            );
+        }
+    }
+
+    #[test]
+    fn each_selection_builds_what_its_string_key_built_before() {
+        // `none` is stateless, exactly as omitting the selector is.
+        let none = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        assert!(
+            build_module(&none, None)
+                .expect("explicit statelessness should build")
+                .is_none(),
+            "`none` should select no module"
+        );
+
+        // `hmac` with its block builds the built-in module.
+        let hmac = selected_hmac(HMAC_MODULE_KEY);
+        let built = build_module(&hmac, None)
+            .expect("the hmac selection should build")
+            .expect("the hmac selection should yield a module");
+        assert_eq!(
+            built.id(),
+            HMAC_MODULE_KEY,
+            "`hmac` should select the built-in module"
+        );
+        assert_eq!(
+            built.code(),
+            HMAC_MODULE_CODE,
+            "the built-in module should carry the built-in code"
+        );
+
+        // An arbitrary vendor name selects the module the adapter injected
+        // under that same implementation.
+        let vendor = Ec {
+            module: Some(EcModuleSelection::Named("acme".to_owned())),
+            ..Ec::default()
+        };
+        let built = build_module(&vendor, Some(Arc::new(VendorModule)))
+            .expect("the vendor selection should build")
+            .expect("the vendor selection should yield a module");
+        assert_eq!(
+            built.id(),
+            "acme",
+            "a vendor name should select the injected module of that id"
+        );
+    }
+
+    #[test]
+    fn a_label_builds_the_implementation_its_block_names() {
+        // The selector names a block, and the block names the implementation,
+        // so everything that resolves the selection has to read the
+        // implementation rather than the label the operator chose.
+        let labeled_hmac = selected_hmac("primary");
+        let built = build_module(&labeled_hmac, None)
+            .expect("a labeled hmac block should build")
+            .expect("a labeled hmac block should yield a module");
+        assert_eq!(
+            built.id(),
+            HMAC_MODULE_KEY,
+            "the label should build the implementation its block names"
+        );
+        assert_eq!(
+            built.code(),
+            HMAC_MODULE_CODE,
+            "the identifiers it creates carry the implementation's own code"
+        );
+
+        // The same for a module the adapter injects, which is matched on the
+        // implementation its block names and not on the label.
+        let labeled_vendor: Ec = toml::from_str(
+            "module = \"main\"\n\n[main]\nimplementation = \"acme\"\nendpoint = \"https://ec.acme.example.com\"\n",
+        )
+        .expect("should parse a labeled vendor block");
+        let built = build_module(&labeled_vendor, Some(Arc::new(VendorModule)))
+            .expect("a labeled vendor block should build")
+            .expect("a labeled vendor block should yield a module");
+        assert_eq!(
+            built.id(),
+            "acme",
+            "the label should build the injected module its block names"
+        );
+    }
+
+    #[test]
+    fn module_ownership_follows_the_code() {
+        let module = HmacModule::new(test_passphrase());
+        let legacy = format!("{}.ABC123", "a".repeat(64));
+        let coded = format!("hmac~{legacy}");
+        let foreign = format!("zz00~{legacy}");
+        assert!(
+            module_owns_id(&module, &coded),
+            "the module owns identifiers carrying its own code"
+        );
+        assert!(
+            module_owns_id(&module, &legacy),
+            "the built-in hmac module dual-reads the legacy bare form"
+        );
+        assert!(
+            !module_owns_id(&module, &foreign),
+            "an identifier with another module's code is never owned"
+        );
+    }
+    use crate::redacted::Redacted;
+
+    fn test_passphrase() -> Redacted<String> {
+        Redacted::from("a-test-passphrase-32-bytes-minimum".to_owned())
+    }
+
+    #[test]
+    fn default_id_semantics_match_the_builtin_shape() {
+        let module = HmacModule::new(test_passphrase());
+
+        // The default `accepts_id` accepts the built-in HMAC shape and rejects
+        // anything else, so a built-in module's identifiers round-trip while an
+        // opaque value is left to a module that overrides the check.
+        let valid = format!("{}.{}", "a".repeat(64), "abc123");
+        assert!(module.accepts_id(&valid), "should accept the HMAC shape");
+        assert!(
+            !module.accepts_id("not-hmac-shaped"),
+            "should reject a non-HMAC identifier by default"
+        );
+
+        // The default `normalize_id_for_kv` lowercases the hash segment. This is
+        // exactly the transform that would corrupt an opaque case-sensitive
+        // identifier, which is why such a module overrides it.
+        let mixed = format!("{}.{}", "A".repeat(64), "abc123");
+        assert_eq!(
+            module.normalize_id_for_kv(&mixed),
+            format!("{}.{}", "a".repeat(64), "abc123"),
+            "the default should lowercase the hash segment"
+        );
+    }
+
+    #[test]
+    fn shared_module_delegates_id_semantics_to_the_inner_module() {
+        // `SharedModule` wraps an adapter-injected module. It must forward
+        // every trait method to the inner module, including `accepts_id` and
+        // `normalize_id_for_kv`; a wrapper that silently used the defaults would
+        // drop an opaque vendor identifier on read-back. This guards that
+        // delegation directly.
+        #[derive(Debug)]
+        struct Inner;
+
+        impl EdgeCookieModule for Inner {
+            fn id(&self) -> &'static str {
+                "inner"
+            }
+
+            fn code(&self) -> ModuleCode {
+                crate::module_code!("t0in")
+            }
+
+            fn generate(
+                &self,
+                _request_info: &dyn RequestInfo,
+                _input: &IdentityInput<'_>,
+            ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+                Ok(GeneratedEdgeCookie::default())
+            }
+
+            fn accepts_id(&self, value: &str) -> bool {
+                value == "opaque-ok"
+            }
+
+            fn normalize_id_for_kv(&self, value: &str) -> String {
+                format!("kv:{value}")
+            }
+        }
+
+        let shared = SharedModule(Arc::new(Inner));
+
+        assert_eq!(shared.id(), "inner", "should delegate id");
+        assert!(
+            shared.accepts_id("opaque-ok"),
+            "should delegate accepts_id acceptance to the inner module"
+        );
+        assert!(
+            !shared.accepts_id("something-else"),
+            "should delegate accepts_id rejection to the inner module"
+        );
+        assert_eq!(
+            shared.normalize_id_for_kv("x"),
+            "kv:x",
+            "should delegate normalize_id_for_kv to the inner module"
+        );
+    }
+
+    /// A module whose identifier is a stable part followed by a part that
+    /// changes each time the identifier is issued, as a signed envelope does.
+    #[derive(Debug)]
+    struct ReissuedEnvelopeModule;
+
+    impl ReissuedEnvelopeModule {
+        fn stable_part(value: &str) -> &str {
+            value.split_once('.').map_or(value, |(stable, _)| stable)
+        }
+    }
+
+    impl EdgeCookieModule for ReissuedEnvelopeModule {
+        fn id(&self) -> &'static str {
+            "reissued_envelope"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0re")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            // The identifier as issued, and its canonical form on its own.
+            Self::stable_part(value).starts_with("device-")
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            Self::stable_part(value).to_owned()
+        }
+    }
+
+    #[test]
+    fn two_issues_of_one_identity_share_one_identity_graph_key() {
+        // The key is the identity two visits must share. Two identifiers that
+        // differ only in the part reissued each time are one visitor and must
+        // reach one row, where a module returning the value unchanged would
+        // give each issue a row of its own.
+        let module = ReissuedEnvelopeModule;
+        let accepted = AcceptedModules::active(Some(&module));
+
+        let first = accepted
+            .canonical_kv_key("t0re~device-1.issued-monday")
+            .expect("should key the first issue");
+        let second = accepted
+            .canonical_kv_key("t0re~device-1.issued-tuesday")
+            .expect("should key the second issue");
+        assert_eq!(
+            first, second,
+            "two issues of one identity should share one identity-graph key"
+        );
+        assert_eq!(
+            first, "t0re~device-1",
+            "the key should be the module's code and the stable part"
+        );
+
+        let other = accepted
+            .canonical_kv_key("t0re~device-2.issued-monday")
+            .expect("should key another identity");
+        assert_ne!(
+            first, other,
+            "a different stable part should be a different visitor"
+        );
+    }
+
+    /// A vendor module that claims the name core already uses for its
+    /// built-in HMAC module.
+    #[derive(Debug)]
+    struct VendorNamedHmacModule;
+
+    impl EdgeCookieModule for VendorNamedHmacModule {
+        fn id(&self) -> &'static str {
+            HMAC_MODULE_KEY
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0vh")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+    }
+
+    #[test]
+    fn two_modules_claiming_one_name_are_refused_and_both_are_named() {
+        // An adapter may inject a module called `hmac` while core supplies
+        // one of its own. Resolution order alone would prefer the built-in one
+        // and drop the injected one with nothing said, which is the fault this
+        // guards.
+        let hmac = selected_hmac(HMAC_MODULE_KEY);
+
+        let err = build_module(&hmac, Some(Arc::new(VendorNamedHmacModule)))
+            .expect_err("two modules claiming `hmac` should be refused");
+        let message = err.to_string();
+        assert!(
+            message.contains(HMAC_MODULE_KEY),
+            "the error should name the contested name, got: {message}"
+        );
+        assert!(
+            message.contains("core") && message.contains("adapter"),
+            "the error should name both claimants, got: {message}"
+        );
+
+        // The clash is a wiring fault, not a property of the selection, so
+        // selecting something else does not hide it and the operator still
+        // learns at startup.
+        let selected_elsewhere = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        let err =
+            ensure_module_available(&selected_elsewhere, Some(Arc::new(VendorNamedHmacModule)))
+                .expect_err("the clash should be refused whatever the selector says");
+        assert!(
+            err.to_string().contains(HMAC_MODULE_KEY),
+            "the startup check should name the contested name too, got: {err}"
+        );
+
+        // A vendor name of its own is unaffected.
+        let vendor = Ec {
+            module: Some(EcModuleSelection::Named("acme".to_owned())),
+            ..Ec::default()
+        };
+        build_module(&vendor, Some(Arc::new(VendorModule)))
+            .expect("a vendor module under its own name should still build");
+    }
+
+    #[test]
+    fn an_unknown_implementation_fails_naming_the_known_ones() {
+        // A label hands the choice of implementation to its block, so a
+        // mistyped implementation has to be refused by name, alongside the
+        // implementations this deployment could have used instead.
+        let ec: Ec =
+            toml::from_str("module = \"primary\"\n\n[primary]\nimplementation = \"hmca\"\n")
+                .expect("should parse a labeled module block");
+
+        let err = build_module(&ec, None)
+            .expect_err("an implementation this deployment lacks should be refused");
+        let message = err.to_string();
+        assert!(
+            message.contains("`hmca`"),
+            "the error should name the unknown implementation, got: {message}"
+        );
+        assert!(
+            message.contains("`hmac`"),
+            "the error should name the built-in implementation, got: {message}"
+        );
+
+        let err = build_module(&ec, Some(Arc::new(VendorModule)))
+            .expect_err("an injected module of another implementation should not stand in");
+        let message = err.to_string();
+        assert!(
+            message.contains("`hmac`") && message.contains("`acme`"),
+            "the error should name every implementation this deployment has, got: {message}"
+        );
+    }
+
+    #[test]
+    fn selecting_hmac_without_its_block_fails_loudly() {
+        // `Ec::validate_module_selection` rejects this pair before settings
+        // reach the composition root, so the state is built directly here to
+        // reach the seam. If the two checks ever drift apart, `build_module`
+        // must still stop rather than hand back a stateless deployment.
+        let ec = Ec {
+            module: Some(EcModuleSelection::from(HMAC_MODULE_KEY)),
+            ..Ec::default()
+        };
+
+        let err = build_module(&ec, None)
+            .expect_err("selecting hmac with no [ec.hmac] block should error");
+        assert!(
+            err.to_string().contains("[ec.hmac]"),
+            "the error should name the missing block, got: {err}"
+        );
+    }
+
+    #[test]
+    fn the_request_path_reuses_the_module_the_composition_root_resolved() {
+        // A composition root resolves the selection once while it builds
+        // application state, which is the same work `build_module` does on a
+        // request, so doing both means doing it twice for every request. The
+        // resolved module is threaded into `RuntimeServices`, and this is the
+        // assertion that the request path takes it rather than resolving again:
+        // the same allocation, not merely an equal one.
+        let ec = Ec {
+            module: Some(EcModuleSelection::Named("acme".to_owned())),
+            ..Ec::default()
+        };
+        let resolved = build_shared_module(&ec, Some(Arc::new(VendorModule)))
+            .expect("the composition root should resolve the selection")
+            .expect("the selection should yield a module");
+
+        let services =
+            crate::platform::test_support::noop_services_with_ec_module(Arc::clone(&resolved));
+        let for_request = request_module(&ec, &services)
+            .expect("the request path should take the resolved module")
+            .expect("the resolved module should be there");
+
+        assert!(
+            Arc::ptr_eq(&resolved, &for_request),
+            "the request path should reuse the resolved module, not build a second one"
+        );
+
+        // With nothing threaded the request path builds the selection from the
+        // settings. No module is injected on that path, so only a built-in
+        // selection can be built there.
+        let hmac = selected_hmac(HMAC_MODULE_KEY);
+        let built = request_module(&hmac, &crate::platform::test_support::noop_services())
+            .expect("an unthreaded request path should build a built-in selection")
+            .expect("the selection should yield a module");
+        assert_eq!(
+            built.id(),
+            HMAC_MODULE_KEY,
+            "the request path should build the built-in module the settings select"
+        );
+    }
+
+    #[test]
+    fn an_uninjected_module_is_refused_and_statelessness_is_allowed() {
+        // A selection the adapter cannot supply is knowable without a request,
+        // so the composition root rejects it while application state is built.
+        // The startup check wraps `build_module`, so both refuse it.
+        let selected = Ec {
+            module: Some(EcModuleSelection::from("acme")),
+            ..Ec::default()
+        };
+        for (case, outcome) in [
+            ("build_module", build_module(&selected, None).map(|_| ())),
+            (
+                "the startup check",
+                ensure_module_available(&selected, None),
+            ),
+        ] {
+            let Err(err) = outcome else {
+                panic!("{case} should refuse a module the adapter does not inject");
+            };
+            assert!(
+                err.to_string().contains("acme"),
+                "{case}: the error should name the selected module, got: {err}"
+            );
+        }
+
+        // Statelessness is a supported deployment, spelled either way, and must
+        // never be turned into a startup error.
+        ensure_module_available(&Ec::default(), None)
+            .expect("should allow a deployment that selects no module");
+        let explicit_none = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        ensure_module_available(&explicit_none, None)
+            .expect("should allow the explicit `none` selection");
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/pull_sync.rs b/crates/trusted-server-core/src/ec/pull_sync.rs
index 191e6c6d24..a8cdc774a5 100644
--- a/crates/trusted-server-core/src/ec/pull_sync.rs
+++ b/crates/trusted-server-core/src/ec/pull_sync.rs
@@ -20,7 +20,7 @@ use crate::platform::{
 };
 use crate::settings::Settings;
 
-use super::generation::{ec_hash, is_valid_ec_id};
+use super::generation::ec_hash;
 use super::kv::{KvIdentityGraph, PartnerIdUpdate};
 use super::kv_types::KvEntry;
 use super::rate_limiter::RateLimiter;
@@ -34,7 +34,11 @@ use super::current_timestamp;
 /// Inputs needed to dispatch pull sync after response flush.
 #[derive(Debug, Clone)]
 pub struct PullSyncContext {
+    /// The EC ID as issued, which partners receive.
     ec_id: String,
+    /// The identity-graph key for `ec_id`, the owning module's canonical form
+    /// of it, which every identity-graph read and write in pull sync uses.
+    kv_key: String,
     snapshot: EcKvSnapshot,
 }
 
@@ -59,8 +63,9 @@ struct PullSyncResponse {
 /// Builds post-send pull-sync context from the route EC context.
 ///
 /// Returns `None` when there are no pull-enabled partners, when consent denies
-/// EC, when there is no valid active EC ID, or when the request snapshot holds
-/// no consented row that is still missing at least one pull-partner UID.
+/// EC, when there is no active EC ID or no module this deployment reads owns
+/// it, or when the request snapshot holds no consented row that is still
+/// missing at least one pull-partner UID.
 #[must_use]
 pub fn build_pull_sync_context(
     ec_context: &EcContext,
@@ -77,26 +82,44 @@ pub fn build_pull_sync_context(
         return None;
     }
 
-    let ec_id_ref = ec_context.ec_value()?;
-    if !is_valid_ec_id(ec_id_ref) {
-        log::debug!("Pull sync: skipping dispatch because active EC ID is invalid format");
+    // Accept an identifier from whichever module this deployment reads,
+    // dispatched by the identifier's module code, rather than only the
+    // built-in HMAC shape. A host-signal or vendor module's identifiers are
+    // valid here for the same reason they are valid in the organic path. The
+    // owning module also supplies the identity-graph key, its canonical form
+    // of the identifier, and every identity-graph read and write in
+    // `dispatch_pull_sync` uses that key rather than the identifier as issued.
+    let ec_id = ec_context.ec_value()?;
+    let Some(kv_key) = ec_context.kv_key_for(ec_id) else {
+        log::debug!(
+            "Pull sync: skipping dispatch because the active EC ID is not one this \
+             deployment's modules accept"
+        );
         return None;
-    }
+    };
 
-    let entry = ec_context.kv_snapshot().entry_for(ec_id_ref)?;
+    let entry = ec_context.kv_snapshot().entry_for(&kv_key)?;
     if !entry.consent.ok || entry_is_pull_complete(entry, registry) {
         return None;
     }
 
-    let ec_id = ec_id_ref.to_owned();
-    let snapshot = ec_context.kv_snapshot().clone();
-    Some(PullSyncContext { ec_id, snapshot })
+    Some(PullSyncContext {
+        ec_id: ec_id.to_owned(),
+        kv_key,
+        snapshot: ec_context.kv_snapshot().clone(),
+    })
 }
 
 /// Dispatches partner pull-sync requests in the background.
 ///
 /// This function is best-effort: all errors are logged and swallowed.
 ///
+/// The request snapshot lookup, the revalidation read and the write-back all
+/// use the context's identity-graph key, the owning module's canonical form
+/// of the EC ID, because that is the key the row is stored under. Partners
+/// still receive the EC ID as issued, and the per-partner rate limit key uses
+/// `ec_hash` of that EC ID.
+///
 /// # Consent revalidation
 ///
 /// Pull sync runs *after* the page response has been flushed to the browser and
@@ -128,7 +151,7 @@ pub fn dispatch_pull_sync(
         return;
     }
 
-    let Some(request_entry) = context.snapshot.entry_for(context.ec_id()) else {
+    let Some(request_entry) = context.snapshot.entry_for(&context.kv_key) else {
         log::debug!(
             "Pull sync: skipping dispatch for '{}' because the request captured no usable \
              identity snapshot",
@@ -163,8 +186,8 @@ pub fn dispatch_pull_sync(
         return;
     }
 
-    let live_snapshot = kv.load_snapshot(context.ec_id());
-    let Some(live_entry) = live_snapshot.entry_for(context.ec_id()) else {
+    let live_snapshot = kv.load_snapshot(&context.kv_key);
+    let Some(live_entry) = live_snapshot.entry_for(&context.kv_key) else {
         log::warn!(
             "Pull sync: skipping dispatch for '{}' because the live identity row could not be \
              confirmed",
@@ -287,7 +310,7 @@ pub fn dispatch_pull_sync(
         // generation is current, so the first CAS attempt is not spent losing a
         // conflict against the read that authorized this dispatch.
         let outcome =
-            kv.upsert_partner_ids_from_snapshot(context.ec_id(), &updates, live_snapshot.clone());
+            kv.upsert_partner_ids_from_snapshot(&context.kv_key, &updates, live_snapshot.clone());
         if matches!(outcome, EcKvSnapshot::Failed { .. }) {
             log::warn!(
                 "Pull sync: failed to persist partner updates for '{}'",
@@ -585,6 +608,65 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_pull_sync_context_accepts_the_active_non_hmac_module() {
+        // An identifier the active non-HMAC module owns is dispatched, under
+        // the key that module gives it, exactly as the organic path reads it.
+        const OPAQUE_ID: &str = "t0op~Opaque_Value_MixedCase";
+
+        let mut settings = crate::test_support::tests::create_test_settings();
+        settings.ec.module = Some(crate::ec::module::EcModuleSelection::from("opaque"));
+        let services = crate::platform::test_support::noop_services_with_ec_module(
+            std::sync::Arc::new(crate::ec::tests::OpaqueModule),
+        );
+        let req = http::Request::builder()
+            .method("GET")
+            .uri("http://example.com")
+            .header("cookie", format!("ts-ec={OPAQUE_ID}"))
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        let geo = crate::geo::GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        };
+
+        let mut ec_context =
+            EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+                .expect("should read EC context");
+        assert_eq!(
+            ec_context.ec_value(),
+            Some(OPAQUE_ID),
+            "the opaque identifier should read back before pull sync sees it"
+        );
+        // Pull sync dispatches for a consented row still missing a pull
+        // partner's UID, under the key the owning module derives.
+        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
+            .expect("should build registry");
+        let graph = KvIdentityGraph::in_memory("pull_store");
+        let kv_key = ec_context
+            .kv_key_for(OPAQUE_ID)
+            .expect("the opaque module should key its own identifier");
+        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, &kv_key));
+
+        let context = build_pull_sync_context(&ec_context, &registry)
+            .expect("should dispatch pull sync for the active module's identifier");
+        assert_eq!(
+            context.ec_id(),
+            OPAQUE_ID,
+            "should carry the identifier through unchanged"
+        );
+        assert_eq!(
+            context.kv_key, OPAQUE_ID,
+            "the opaque module's identifier should be its own identity-graph key"
+        );
+    }
+
     #[test]
     fn build_pull_sync_context_rejects_invalid_ec_id() {
         let consent = ConsentContext {
@@ -889,11 +971,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_pull_sync_context_accepts_a_created_coded_ec_id() {
+        let consent = ConsentContext {
+            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+            ..ConsentContext::default()
+        };
+        // The form the creation path produces, under the module code.
+        let ec_id = format!("hmac~{}.ABC123", "a".repeat(64));
+        let mut ec_context = EcContext::new_for_test(Some(ec_id.clone()), consent);
+        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
+            .expect("should build registry");
+        let graph = KvIdentityGraph::in_memory("pull_store");
+        let kv_key = ec_context
+            .kv_key_for(&ec_id)
+            .expect("the built-in grammar should key a coded identifier");
+        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, &kv_key));
+
+        let context = build_pull_sync_context(&ec_context, &registry)
+            .expect("should build pull sync context for a coded HMAC identifier");
+        assert_eq!(
+            context.ec_id(),
+            ec_id,
+            "should dispatch the coded identifier as created"
+        );
+    }
+
     // -----------------------------------------------------------------------
     // Snapshot-driven eligibility and request-wide aggregation
     // -----------------------------------------------------------------------
 
     use crate::ec::kv::TombstoneOutcome;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule};
     use crate::error::TrustedServerError;
     use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
     use crate::settings::EcPartner;
@@ -966,6 +1075,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1020,6 +1130,7 @@ mod tests {
         let services = build_services_with_http_client(stub.clone());
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
 
@@ -1083,6 +1194,7 @@ mod tests {
         ] {
             let context = PullSyncContext {
                 ec_id: ec_id.clone(),
+                kv_key: ec_id.clone(),
                 snapshot,
             };
             dispatch_pull_sync(
@@ -1124,6 +1236,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1171,6 +1284,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1231,6 +1345,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1247,4 +1362,72 @@ mod tests {
             "a fully synced entry must not dispatch pull sync"
         );
     }
+
+    #[test]
+    fn dispatch_pull_sync_reads_and_writes_the_canonical_row() {
+        // The row lives under the owning module's canonical form of the
+        // identifier, and the request snapshot is bound to that key, so pull
+        // sync reads and writes that key even when the canonical form differs
+        // from the cookie value.
+        let mut settings = create_test_settings();
+        settings.ec.pull_sync_concurrency = 4;
+        let registry =
+            PartnerRegistry::from_config(&[pull_enabled_ec_partner("alpha.example.com")])
+                .expect("should build registry");
+        let graph = KvIdentityGraph::in_memory("pull_store");
+        let consent = ConsentContext {
+            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+            ..ConsentContext::default()
+        };
+        let mut ec_context =
+            EcContext::new_for_test(Some(CANONICAL_COOKIE_VALUE.to_owned()), consent)
+                .with_module_for_test(Arc::new(CanonicalizingModule));
+        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, CANONICAL_KV_KEY));
+
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response(200, br#"{"uid":"synced-uid"}"#.to_vec());
+        let services = build_services_with_http_client(stub.clone());
+
+        let context = build_pull_sync_context(&ec_context, &registry)
+            .expect("should build pull sync context for the canonicalizing module");
+        dispatch_pull_sync(
+            &settings,
+            &graph,
+            &registry,
+            &AllowAllRateLimiter,
+            &context,
+            &services,
+        );
+
+        let (row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the canonical row")
+            .expect("the canonical row should still exist");
+        assert_eq!(
+            row.ids.get("alpha.example.com").map(|id| id.uid.as_str()),
+            Some("synced-uid"),
+            "the partner UID should be written to the row under the canonical key"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_COOKIE_VALUE)
+                .expect("should read the graph")
+                .is_none(),
+            "pull sync should not create a row under the identifier as issued"
+        );
+        let sent_ec_id = stub
+            .recorded_request_uris()
+            .first()
+            .and_then(|uri| Url::parse(uri).ok())
+            .and_then(|url| {
+                url.query_pairs()
+                    .find(|(name, _)| name == "ec_id")
+                    .map(|(_, value)| value.into_owned())
+            });
+        assert_eq!(
+            sent_ec_id.as_deref(),
+            Some(CANONICAL_COOKIE_VALUE),
+            "partners should receive the identifier as issued"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/pull_sync_marker.rs b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
index 11df47296f..3eface4290 100644
--- a/crates/trusted-server-core/src/ec/pull_sync_marker.rs
+++ b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
@@ -9,7 +9,7 @@ use sha2::{Digest as _, Sha256};
 
 use crate::constants::COOKIE_TS_EC_PULL_COMPLETE;
 use crate::redacted::Redacted;
-use crate::settings::Settings;
+use crate::settings::{EcModuleBlock, Settings};
 
 use super::pull_sync::entry_is_pull_complete;
 use super::registry::PartnerRegistry;
@@ -290,12 +290,31 @@ fn validate_marker(
 }
 
 fn marker_key(settings: &Settings) -> [u8; 32] {
-    let mut mac = HmacSha256::new_from_slice(settings.ec.passphrase.expose().as_bytes())
+    let mut mac = HmacSha256::new_from_slice(marker_secret(settings).as_bytes())
         .expect("should create marker key HMAC");
     mac.update(MARKER_KEY_LABEL);
     mac.finalize().into_bytes().into()
 }
 
+/// The secret the marker key derives from.
+///
+/// A marker covers identifiers the selected module created, so when that
+/// module is the built-in HMAC one the marker is bound to its passphrase
+/// and a rotation retires the markers with the identifiers. A selected
+/// module with no passphrase binds the marker to the proxy secret.
+fn marker_secret(settings: &Settings) -> &str {
+    settings
+        .ec
+        .module
+        .as_ref()
+        .and_then(|selection| settings.ec.module_blocks.get(selection.key()))
+        .and_then(EcModuleBlock::hmac_settings)
+        .map_or_else(
+            || settings.publisher.proxy_secret.expose(),
+            |hmac| hmac.passphrase.expose(),
+        )
+}
+
 fn marker_payload(ec_id: &str, expires_at: u64, fingerprint: &str) -> String {
     format!("{MARKER_VERSION}\0{ec_id}\0{expires_at}\0{fingerprint}")
 }
@@ -329,9 +348,10 @@ fn sorted_pull_partner_domains(registry: &PartnerRegistry) -> Vec<String> {
 mod tests {
     use super::*;
     use crate::ec::kv_types::KvEntry;
+    use crate::ec::module::HMAC_MODULE_KEY;
     use crate::redacted::Redacted;
     use crate::settings::{EcPartner, Settings};
-    use crate::test_support::tests::create_test_settings;
+    use crate::test_support::tests::{create_test_settings, select_hmac_module};
 
     const EC_ID: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.ABC123";
 
@@ -667,8 +687,11 @@ mod tests {
         let marker =
             create_marker(&settings, &registry, EC_ID, 4_600).expect("should create marker");
         let mut changed_settings = settings.clone();
-        changed_settings.ec.passphrase =
-            Redacted::new("different-secret-key-32-bytes-minimum".to_owned());
+        select_hmac_module(
+            &mut changed_settings.ec,
+            HMAC_MODULE_KEY,
+            "different-secret-key-32-bytes-minimum",
+        );
         let empty = PartnerRegistry::empty();
 
         assert!(
diff --git a/crates/trusted-server-core/src/edge_cookie.rs b/crates/trusted-server-core/src/edge_cookie.rs
index a4cdb47304..32b458b72a 100644
--- a/crates/trusted-server-core/src/edge_cookie.rs
+++ b/crates/trusted-server-core/src/edge_cookie.rs
@@ -1,7 +1,10 @@
-//! Edge Cookie (EC) ID generation using HMAC.
+//! Reading an inbound Edge Cookie (EC) identifier.
 //!
-//! This module provides functionality for generating privacy-preserving EC IDs
-//! based on the client IP address and a secret key.
+//! [`recognized_ec_id`] reads the identifier a request carries and recognizes
+//! it through the selected module, so only an identifier this deployment
+//! issued is handed on. The generation helpers here are compiled for tests
+//! only, and the production lifecycle creates identifiers through
+//! [`EcContext`](crate::ec::EcContext).
 
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
@@ -11,57 +14,91 @@ use crate::constants::{COOKIE_TS_EC, HEADER_X_TS_EC};
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 #[cfg(test)]
-use crate::ec::generation::{generate_ec_id as generate_canonical_ec_id, normalize_ip};
+use crate::ec::generation::normalize_ip;
+#[cfg(test)]
+use crate::ec::module::IdentityInput;
+use crate::ec::module::{module_owns_id, request_module};
 use crate::error::TrustedServerError;
 #[cfg(test)]
+use crate::evidence::BorrowedRequestInfo;
 use crate::platform::RuntimeServices;
-#[cfg(test)]
 use crate::settings::Settings;
 
-/// Generates a fresh EC ID based on client IP address.
+/// Test helper that generates a fresh EC ID with the configured Edge Cookie
+/// module.
 ///
-/// Delegates to the canonical generator in [`crate::ec::generation`] so a
-/// single normalization + HMAC path produces EC IDs. The canonical
-/// `normalize_ip` format is a stable contract — EC hashes stored in KV
-/// depend on it, and a divergent normalization would mint non-correlating
-/// identities for the same client.
+/// The `[ec] module` selection decides the outcome. Returns `Ok(None)` when
+/// no module is configured, so no Edge Cookie is created. `request_headers`
+/// lets a module that derives identity from request evidence read it. The
+/// built-in HMAC module ignores it and uses only the normalized client IP.
+/// The production lifecycle creates identifiers through
+/// [`EcContext`](crate::ec::EcContext) instead.
 ///
 /// # Errors
 ///
-/// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
-///
-/// Currently exercised only by tests: the production EC lifecycle generates IDs
-/// through [`crate::ec`]/`EcContext` rather than this edge-cookie helper.
+/// - [`TrustedServerError::EdgeCookie`] if module generation fails
 #[cfg(test)]
 pub fn generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
-) -> Result<String, Report<TrustedServerError>> {
-    // Fallback to "unknown" when client IP is unavailable (e.g., local testing).
-    // All such requests share the same HMAC base; the random suffix provides uniqueness.
+    request_headers: Option<&http::HeaderMap>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    // Fall back to "unknown" when the client IP is unavailable (for example in
+    // local testing). All such requests share the same HMAC base; the random
+    // suffix provides uniqueness.
     let client_ip = services
-        .client_info
+        .client_info()
         .client_ip
         .map(normalize_ip)
         .unwrap_or_else(|| "unknown".to_string());
 
     log::trace!("Generating fresh EC ID from normalized client context");
 
-    generate_canonical_ec_id(settings, &client_ip)
+    let Some(module) = request_module(&settings.ec, services)? else {
+        log::info!("No Edge Cookie module configured; running statelessly");
+        return Ok(None);
+    };
+
+    // The module reads request data (for example the client IP) borrowed at
+    // call time, so nothing is cloned.
+    let request_info = BorrowedRequestInfo::new(&client_ip, request_headers);
+    // This helper skips the consent gate, and the built-in module does not
+    // read the consent context, so it is not threaded here.
+    let generated = module.generate(&request_info, &IdentityInput::default())?;
+    let generated = crate::ec::module::GeneratedEdgeCookie {
+        id: generated
+            .id
+            .map(|value| crate::ec::module::apply_module_code(module.as_ref(), &value)),
+        response_headers: generated.response_headers,
+    };
+    Ok(generated.id)
 }
 
-/// Gets an existing EC ID from the request.
+/// Reads whatever the request offers as an Edge Cookie identifier, before any
+/// check that this deployment could have issued it.
 ///
-/// Attempts to retrieve an existing EC ID from:
-/// 1. The `x-ts-ec` header
-/// 2. The `ts-ec` cookie
+/// Reads the `x-ts-ec` header first and then the `ts-ec` cookie. Both are
+/// client-controlled. `x-ts-ec` is stripped from responses but is not stripped
+/// from inbound requests, so a caller must treat the result as an attacker's
+/// choice of string.
+///
+/// The only checks applied here are the global cookie bounds, the length cap
+/// and the cookie-safe alphabet in
+/// [`ec_id_has_only_allowed_chars`](crate::ec::cookies::ec_id_has_only_allowed_chars),
+/// which every identifier must satisfy whichever module created it. Those
+/// bounds are a backstop on what may travel in a cookie, not a test of
+/// authenticity, and on their own they accept any run of `[A-Za-z0-9._~-]`.
 ///
-/// Returns `None` if neither source contains an EC ID.
+/// Deciding whether this deployment issued the value needs the selected
+/// module, which this function does not have, so it is deliberately not
+/// public. Use [`recognized_ec_id`], which applies module ownership on top.
 ///
 /// # Errors
 ///
 /// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
-pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<TrustedServerError>> {
+pub(crate) fn unvalidated_ec_id_from_request(
+    req: &Request<EdgeBody>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
     if let Some(ec_id) = req
         .headers()
         .get(HEADER_X_TS_EC)
@@ -93,13 +130,77 @@ pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<Trust
     Ok(None)
 }
 
+/// Gets an existing EC ID from the request, but only one the deployment's
+/// selected module recognizes.
+///
+/// [`unvalidated_ec_id_from_request`] applies the global cookie bounds alone,
+/// the length cap and the cookie-safe alphabet, which any value a browser can
+/// be persuaded to carry will pass. This adds module ownership on top, so the
+/// identifier's `{code}~` prefix is dispatched to the module that owns it,
+/// which decides whether the value is one of its own. That is the same test the
+/// EC lifecycle applies when it reads the cookie back, so both agree on what
+/// this deployment issued.
+///
+/// This is the validated way to read an inbound identifier from outside this
+/// module, because the bounds alone cannot tell an identifier this deployment
+/// issued from one an attacker typed. The module also exposes
+/// [`get_or_generate_ec_id`], which is `pub` and returns the raw cookie value
+/// without this ownership check, so prefer this function wherever the identifier
+/// will be trusted or egressed. A vendor identifier is not required to match the
+/// built-in HMAC shape, so the right test is the selected module's own
+/// [`accepts_id`](crate::ec::module::EdgeCookieModule::accepts_id) rather
+/// than the built-in strict format check.
+///
+/// Returns `None` for a value carrying another deployment's module code, for a
+/// value the selected module does not recognize, and for every value at all
+/// when no module is selected, because a stateless deployment issues no
+/// identifier and so has none to hand on.
+///
+/// Use this wherever the identifier leaves the edge (an outbound origin URL, a
+/// click target, a proxied request body), so nothing is egressed that this
+/// deployment did not issue.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
+/// - [`TrustedServerError::EdgeCookie`] if the selected module cannot be built
+pub fn recognized_ec_id(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request<EdgeBody>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    let Some(ec_id) = unvalidated_ec_id_from_request(req)? else {
+        return Ok(None);
+    };
+
+    let Some(module) = request_module(&settings.ec, services)? else {
+        log::debug!(
+            "No Edge Cookie module configured; withholding the request's EC ID from egress"
+        );
+        return Ok(None);
+    };
+
+    if module_owns_id(module.as_ref(), &ec_id) {
+        return Ok(Some(ec_id));
+    }
+
+    log::debug!(
+        "Withholding an EC ID module `{}` does not recognize from egress",
+        module.id(),
+    );
+    Ok(None)
+}
+
 /// Gets or creates an EC ID from the request.
 ///
 /// Attempts to retrieve an existing EC ID from:
 /// 1. The `x-ts-ec` header
 /// 2. The `ts-ec` cookie
 ///
-/// If neither exists, generates a new EC ID.
+/// If neither exists, generates a new EC ID via the configured module.
+///
+/// Returns `Ok(None)` when no existing EC ID is present and no Edge Cookie
+/// module is configured, so the caller proceeds statelessly.
 ///
 /// # Errors
 ///
@@ -109,14 +210,16 @@ pub(crate) fn get_or_generate_ec_id_from_http_request(
     settings: &Settings,
     services: &RuntimeServices,
     req: &Request<EdgeBody>,
-) -> Result<String, Report<TrustedServerError>> {
-    if let Some(id) = get_ec_id(req)? {
-        return Ok(id);
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    if let Some(id) = unvalidated_ec_id_from_request(req)? {
+        return Ok(Some(id));
     }
 
-    // If no existing EC ID found, generate a fresh one
-    let ec_id = generate_ec_id(settings, services)?;
-    log::trace!("No existing EC ID found; generated a fresh EC ID");
+    // If no existing EC ID found, generate a fresh one through the module.
+    let ec_id = generate_ec_id(settings, services, Some(req.headers()))?;
+    if ec_id.is_some() {
+        log::trace!("No existing EC ID found; generated a fresh EC ID");
+    }
     Ok(ec_id)
 }
 
@@ -130,7 +233,7 @@ pub fn get_or_generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
     req: &Request<EdgeBody>,
-) -> Result<String, Report<TrustedServerError>> {
+) -> Result<Option<String>, Report<TrustedServerError>> {
     get_or_generate_ec_id_from_http_request(settings, services, req)
 }
 
@@ -139,34 +242,11 @@ mod tests {
     use super::*;
     use edgezero_core::body::Body as EdgeBody;
     use http::{HeaderName, header};
-    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+    use std::net::{IpAddr, Ipv4Addr};
 
     use crate::platform::test_support::{noop_services, noop_services_with_client_ip};
     use crate::test_support::tests::create_test_settings;
 
-    #[test]
-    fn test_generate_ec_id_matches_canonical_generator_for_ipv6() {
-        // Regression guard: this module must hash the same normalized IP as
-        // the canonical generator in ec::generation. A divergent IPv6 /64
-        // normalization would mint non-correlating identity prefixes for the
-        // same client depending on which path generated the ID.
-        let settings = create_test_settings();
-        let ip = IpAddr::V6(Ipv6Addr::new(
-            0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, 0x1234,
-        ));
-
-        let id_here = generate_ec_id(&settings, &noop_services_with_client_ip(ip))
-            .expect("should generate EC ID via edge_cookie");
-        let id_canonical = generate_canonical_ec_id(&settings, &normalize_ip(ip))
-            .expect("should generate EC ID via canonical generator");
-
-        assert_eq!(
-            crate::ec::ec_hash(&id_here),
-            crate::ec::ec_hash(&id_canonical),
-            "should produce the same identity hash prefix as the canonical generator"
-        );
-    }
-
     fn create_test_request(headers: &[(HeaderName, &str)]) -> Request<EdgeBody> {
         let mut builder = Request::builder().method("GET").uri("http://example.com");
         for (key, value) in headers {
@@ -178,6 +258,10 @@ mod tests {
     }
 
     fn is_ec_id_format(value: &str) -> bool {
+        // The coded envelope: hmac~<64hex>.<6alnum>.
+        let Some(value) = value.strip_prefix("hmac~") else {
+            return false;
+        };
         let mut parts = value.split('.');
         let hmac_part = match parts.next() {
             Some(part) => part,
@@ -202,15 +286,38 @@ mod tests {
         true
     }
 
+    // `generate_ec_id`, `get_or_generate_ec_id` and
+    // `get_or_generate_ec_id_from_http_request` are test helpers compiled for
+    // tests only, so the tests that call them test those helpers and not the
+    // production path. The production path, including how the client IP is
+    // normalized before it is hashed, is tested through `EcContext` in
+    // `crate::ec`.
+
     #[test]
     fn test_generate_ec_id() {
         let settings: Settings = create_test_settings();
 
-        let ec_id = generate_ec_id(&settings, &noop_services()).expect("should generate EC ID");
+        let ec_id = generate_ec_id(&settings, &noop_services(), None)
+            .expect("should generate EC ID")
+            .expect("should configure the hmac module in test settings");
         log::debug!("Generated EC ID: {}", ec_id);
         assert!(
             is_ec_id_format(&ec_id),
-            "should match EC ID format: {{64hex}}.{{6alnum}}"
+            "should match the coded EC ID format: hmac~{{64hex}}.{{6alnum}}"
+        );
+    }
+
+    #[test]
+    fn generate_ec_id_returns_none_when_no_module_is_configured() {
+        let mut settings = create_test_settings();
+        // No module selected: Trusted Server runs statelessly.
+        settings.ec.module = None;
+
+        let id = generate_ec_id(&settings, &noop_services(), None)
+            .expect("generation should not error when no module is configured");
+        assert!(
+            id.is_none(),
+            "no Edge Cookie module should mean no Edge Cookie is created"
         );
     }
 
@@ -219,10 +326,12 @@ mod tests {
         let settings = create_test_settings();
         let ip = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1));
 
-        let id_with_ip = generate_ec_id(&settings, &noop_services_with_client_ip(ip))
-            .expect("should generate EC ID with client IP");
-        let id_without_ip = generate_ec_id(&settings, &noop_services())
-            .expect("should generate EC ID without client IP");
+        let id_with_ip = generate_ec_id(&settings, &noop_services_with_client_ip(ip), None)
+            .expect("should generate EC ID with client IP")
+            .expect("should configure the hmac module in test settings");
+        let id_without_ip = generate_ec_id(&settings, &noop_services(), None)
+            .expect("should generate EC ID without client IP")
+            .expect("should configure the hmac module in test settings");
 
         let hmac_with_ip = id_with_ip.split_once('.').expect("should contain dot").0;
         let hmac_without_ip = id_without_ip.split_once('.').expect("should contain dot").0;
@@ -235,50 +344,109 @@ mod tests {
 
     #[test]
     fn test_is_ec_id_format_accepts_valid_value() {
-        let value = format!("{}.{}", "a".repeat(64), "Ab12z9");
+        let value = format!("hmac~{}.{}", "a".repeat(64), "Ab12z9");
         assert!(
             is_ec_id_format(&value),
-            "should accept a valid EC ID format"
+            "should accept a valid coded EC ID format"
         );
     }
 
     #[test]
     fn test_is_ec_id_format_rejects_invalid_values() {
-        let missing_suffix = "a".repeat(64);
+        let bare_legacy_shape = format!("{}.{}", "a".repeat(64), "Ab12z9");
+        assert!(
+            !is_ec_id_format(&bare_legacy_shape),
+            "a freshly created identifier always carries the module code"
+        );
+
+        let missing_suffix = format!("hmac~{}", "a".repeat(64));
         assert!(
             !is_ec_id_format(&missing_suffix),
             "should reject missing suffix"
         );
 
-        let invalid_hex = format!("{}.{}", "a".repeat(63) + "g", "Ab12z9");
+        let invalid_hex = format!("hmac~{}.{}", "a".repeat(63) + "g", "Ab12z9");
         assert!(
             !is_ec_id_format(&invalid_hex),
             "should reject non-hex HMAC content"
         );
 
-        let invalid_suffix = format!("{}.{}", "a".repeat(64), "ab-129");
+        let invalid_suffix = format!("hmac~{}.{}", "a".repeat(64), "ab-129");
         assert!(
             !is_ec_id_format(&invalid_suffix),
             "should reject non-alphanumeric suffix"
         );
 
-        let extra_segment = format!("{}.{}.{}", "a".repeat(64), "Ab12z9", "zz");
+        let extra_segment = format!("hmac~{}.{}.{}", "a".repeat(64), "Ab12z9", "zz");
         assert!(
             !is_ec_id_format(&extra_segment),
             "should reject extra segments"
         );
     }
 
+    #[test]
+    fn an_identifier_this_deployment_never_issued_is_not_recognized() {
+        // `x-ts-ec` is stripped from responses but not from inbound requests,
+        // so a client can put whatever it likes in it, and the raw reader
+        // prefers the header over the cookie. The global cookie bounds accept
+        // any run of `[A-Za-z0-9._~-]`, so they cannot tell an identifier this
+        // deployment created from one an attacker typed. Module ownership is
+        // what draws that line.
+        let settings = create_test_settings();
+        let services = noop_services();
+
+        for forged in [
+            // Passes the alphabet and the length cap, owned by nobody.
+            "not-an-identifier",
+            // The built-in shape under another deployment's module code.
+            "zz00~aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.Ab1234",
+            // This deployment's code carrying a value its module never creates.
+            "hmac~not-the-hmac-shape",
+        ] {
+            let req = create_test_request(&[(HEADER_X_TS_EC, forged)]);
+
+            // The raw reader hands it straight back, which is exactly why it is
+            // not the check anything may rely on.
+            assert_eq!(
+                unvalidated_ec_id_from_request(&req)
+                    .expect("should read the header")
+                    .as_deref(),
+                Some(forged),
+                "the global bounds alone should accept `{forged}`"
+            );
+
+            assert_eq!(
+                recognized_ec_id(&settings, &services, &req)
+                    .expect("should decide without erroring"),
+                None,
+                "`{forged}` was never issued here and must not be recognized"
+            );
+        }
+
+        // A value the selected module does own is still recognized, so the
+        // check rejects forgeries rather than everything.
+        let issued = format!("hmac~{}.Ab1234", "a".repeat(64));
+        let req = create_test_request(&[(HEADER_X_TS_EC, issued.as_str())]);
+        assert_eq!(
+            recognized_ec_id(&settings, &services, &req)
+                .expect("should decide without erroring")
+                .as_deref(),
+            Some(issued.as_str()),
+            "an identifier the selected module owns should still be recognized"
+        );
+    }
+
     #[test]
     fn test_get_ec_id_with_header() {
         let settings = create_test_settings();
         let req = create_test_request(&[(HEADER_X_TS_EC, "existing_ec_id")]);
 
-        let ec_id = get_ec_id(&req).expect("should get EC ID");
+        let ec_id = unvalidated_ec_id_from_request(&req).expect("should get EC ID");
         assert_eq!(ec_id, Some("existing_ec_id".to_string()));
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should reuse header EC ID");
+            .expect("should reuse header EC ID")
+            .expect("an existing EC should be present");
         assert_eq!(ec_id, "existing_ec_id");
     }
 
@@ -290,11 +458,12 @@ mod tests {
             &format!("{}=existing_cookie_id", COOKIE_TS_EC),
         )]);
 
-        let ec_id = get_ec_id(&req).expect("should get EC ID");
+        let ec_id = unvalidated_ec_id_from_request(&req).expect("should get EC ID");
         assert_eq!(ec_id, Some("existing_cookie_id".to_string()));
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should reuse cookie EC ID");
+            .expect("should reuse cookie EC ID")
+            .expect("an existing EC should be present");
         assert_eq!(ec_id, "existing_cookie_id");
     }
 
@@ -307,7 +476,8 @@ mod tests {
             .body(edgezero_core::body::Body::empty())
             .expect("should build test request");
 
-        let ec_id = get_ec_id(&req).expect("should get EC ID from http request");
+        let ec_id =
+            unvalidated_ec_id_from_request(&req).expect("should get EC ID from http request");
 
         assert_eq!(ec_id, Some("existing_http_ec_id".to_string()));
     }
@@ -326,7 +496,8 @@ mod tests {
             .expect("should build test request");
 
         let ec_id = get_or_generate_ec_id_from_http_request(&settings, &noop_services(), &req)
-            .expect("should reuse cookie EC ID from http request");
+            .expect("should reuse cookie EC ID from http request")
+            .expect("an existing EC should be present");
 
         assert_eq!(ec_id, "existing_http_cookie_id");
     }
@@ -334,7 +505,7 @@ mod tests {
     #[test]
     fn test_get_ec_id_none() {
         let req = create_test_request(&[]);
-        let ec_id = get_ec_id(&req).expect("should handle missing ID");
+        let ec_id = unvalidated_ec_id_from_request(&req).expect("should handle missing ID");
         assert!(ec_id.is_none());
     }
 
@@ -344,7 +515,8 @@ mod tests {
         let req = create_test_request(&[]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should get or generate EC ID");
+            .expect("should get or generate EC ID")
+            .expect("should configure the hmac module in test settings");
         assert!(!ec_id.is_empty());
     }
 
@@ -355,7 +527,8 @@ mod tests {
             (header::COOKIE, &format!("{}=valid_cookie_id", COOKIE_TS_EC)),
         ]);
 
-        let ec_id = get_ec_id(&req).expect("should handle invalid header gracefully");
+        let ec_id =
+            unvalidated_ec_id_from_request(&req).expect("should handle invalid header gracefully");
         assert_eq!(
             ec_id,
             Some("valid_cookie_id".to_string()),
@@ -369,7 +542,8 @@ mod tests {
         let req = create_test_request(&[(HEADER_X_TS_EC, "evil;injected")]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should generate fresh ID on invalid header");
+            .expect("should generate fresh ID on invalid header")
+            .expect("should configure the hmac module in test settings");
         assert_ne!(
             ec_id, "evil;injected",
             "should not use tampered header value"
@@ -387,7 +561,8 @@ mod tests {
             &format!("{}=bad<script>value", COOKIE_TS_EC),
         )]);
 
-        let ec_id = get_ec_id(&req).expect("should handle invalid cookie gracefully");
+        let ec_id =
+            unvalidated_ec_id_from_request(&req).expect("should handle invalid cookie gracefully");
         assert!(
             ec_id.is_none(),
             "should reject cookie with disallowed characters"
diff --git a/crates/trusted-server-core/src/evidence.rs b/crates/trusted-server-core/src/evidence.rs
new file mode 100644
index 0000000000..967223099e
--- /dev/null
+++ b/crates/trusted-server-core/src/evidence.rs
@@ -0,0 +1,332 @@
+//! Request evidence passed to modules.
+//!
+//! A module is constructed once, from its own configuration block or by the
+//! adapter that injects it, and is handed the current request's evidence as a
+//! borrowed `&dyn` view on every call, for example the `request_info` argument
+//! of [`generate`](crate::ec::module::EdgeCookieModule::generate). Nothing
+//! per-request is stored on the module, so the same module serves every
+//! request.
+//!
+//! These traits are those views. Request-scoped data outlives the live request
+//! only when snapshotted, so an implementation owns its data where needed.
+//! [`BorrowedRequestInfo`] is the borrowed view core builds on the request
+//! path, and [`OwnedRequestInfo`] is the built-in owned snapshot.
+
+use http::HeaderMap;
+
+/// Read-only access to the current request's basic information.
+///
+/// The request data any host can supply: the normalized client IP, the
+/// User-Agent, and request headers. A module receives it by reference at call
+/// time (`generate`), reads what it needs, and does not retain it.
+pub trait RequestInfo: Send + Sync + core::fmt::Debug {
+    /// The normalized client IP, or `""` when the host cannot determine it.
+    fn client_ip(&self) -> &str;
+
+    /// The `User-Agent` header value, or `""` when absent.
+    fn user_agent(&self) -> &str;
+
+    /// An arbitrary request header by name (case-insensitive), or `None`.
+    ///
+    /// Request cookies are read through this, from the `Cookie` header (a
+    /// module that stores values in cookies parses them from it).
+    fn header(&self, name: &str) -> Option<&str>;
+
+    /// The names of all request headers present, for a module that enumerates
+    /// evidence (for example to forward client hints). The default is empty.
+    fn header_names(&self) -> Vec<&str> {
+        Vec::new()
+    }
+
+    /// The request path (the URL path, without the query string), or `""` when
+    /// request info was built without a URL.
+    ///
+    /// A module reads the request target through this together with
+    /// [`query`](Self::query); `RequestInfo` is the evidence abstraction, so more
+    /// request accessors can be added here (as defaulted methods) without
+    /// breaking existing implementations.
+    fn path(&self) -> &str {
+        ""
+    }
+
+    /// The raw request query string (the part after `?`, without the leading
+    /// `?`), or `""` when the request carried none.
+    ///
+    /// A module reads request parameters through this, or the
+    /// [`query_param`](Self::query_param) convenience. The default is empty, for
+    /// request info built without a URL.
+    fn query(&self) -> &str {
+        ""
+    }
+
+    /// The first value of query parameter `name`, percent-decoded, or `None`
+    /// when the parameter is absent.
+    ///
+    /// Parses [`query`](Self::query) with `application/x-www-form-urlencoded`
+    /// rules, matching how the browser encodes query parameters.
+    fn query_param(&self, name: &str) -> Option<String> {
+        url::form_urlencoded::parse(self.query().as_bytes())
+            .find_map(|(key, value)| (&*key == name).then(|| value.into_owned()))
+    }
+}
+
+/// An owned [`RequestInfo`] built from a request snapshot.
+///
+/// Owns the client IP and a header snapshot, for a context that cannot borrow
+/// the live request for the duration of the call. The request path uses
+/// [`BorrowedRequestInfo`]; this owned variant serves tests and any future
+/// host whose request data cannot be borrowed.
+#[derive(Debug, Default, Clone)]
+pub struct OwnedRequestInfo {
+    client_ip: String,
+    headers: HeaderMap,
+    path: String,
+    query: String,
+}
+
+impl OwnedRequestInfo {
+    /// Builds owned request info from the client IP and a header snapshot.
+    ///
+    /// The request target ([`path`](RequestInfo::path) and
+    /// [`query`](RequestInfo::query)) is empty; attach it with
+    /// [`with_request_target`](Self::with_request_target) when the caller has the
+    /// URL.
+    #[must_use]
+    pub fn new(client_ip: String, headers: HeaderMap) -> Self {
+        Self {
+            client_ip,
+            headers,
+            path: String::new(),
+            query: String::new(),
+        }
+    }
+
+    /// Attaches the request target (URL path and query string) to this snapshot,
+    /// so a module can read request parameters through
+    /// [`query_param`](RequestInfo::query_param).
+    #[must_use]
+    pub fn with_request_target(mut self, path: String, query: String) -> Self {
+        self.path = path;
+        self.query = query;
+        self
+    }
+}
+
+impl RequestInfo for OwnedRequestInfo {
+    fn client_ip(&self) -> &str {
+        &self.client_ip
+    }
+
+    fn user_agent(&self) -> &str {
+        self.headers
+            .get(http::header::USER_AGENT)
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default()
+    }
+
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).and_then(|value| value.to_str().ok())
+    }
+
+    fn header_names(&self) -> Vec<&str> {
+        self.headers.keys().map(http::HeaderName::as_str).collect()
+    }
+
+    fn path(&self) -> &str {
+        &self.path
+    }
+
+    fn query(&self) -> &str {
+        &self.query
+    }
+}
+
+/// A borrowed [`RequestInfo`] over the live request, with no allocation.
+///
+/// Built at generate time from the normalized client IP and an optional borrow
+/// of the request-header snapshot core captured at read time, then passed to a
+/// module by shared reference at call time (`generate`). It borrows rather
+/// than owns, so it must not outlive the request. A module reads it during the
+/// call and does not retain it. `BorrowedRequestInfo` itself allocates nothing;
+/// the one header clone is the snapshot core takes at read time, and only when a
+/// module is configured and the request carries no usable identifier.
+#[derive(Debug)]
+pub struct BorrowedRequestInfo<'a> {
+    client_ip: &'a str,
+    headers: Option<&'a HeaderMap>,
+    path: &'a str,
+    query: &'a str,
+}
+
+impl<'a> BorrowedRequestInfo<'a> {
+    /// Borrows request info from the client IP and optional request headers.
+    ///
+    /// Pass `None` for headers on a path that only needs the client IP. The
+    /// request target ([`path`](RequestInfo::path) and
+    /// [`query`](RequestInfo::query)) is empty; attach it with
+    /// [`with_request_target`](Self::with_request_target) when the caller has the
+    /// URL.
+    #[must_use]
+    pub fn new(client_ip: &'a str, headers: Option<&'a HeaderMap>) -> Self {
+        Self {
+            client_ip,
+            headers,
+            path: "",
+            query: "",
+        }
+    }
+
+    /// Attaches the borrowed request target (URL path and query string), so a
+    /// module can read request parameters through
+    /// [`query_param`](RequestInfo::query_param).
+    #[must_use]
+    pub fn with_request_target(mut self, path: &'a str, query: &'a str) -> Self {
+        self.path = path;
+        self.query = query;
+        self
+    }
+}
+
+impl RequestInfo for BorrowedRequestInfo<'_> {
+    fn client_ip(&self) -> &str {
+        self.client_ip
+    }
+
+    fn user_agent(&self) -> &str {
+        self.headers
+            .and_then(|headers| headers.get(http::header::USER_AGENT))
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default()
+    }
+
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .and_then(|headers| headers.get(name))
+            .and_then(|value| value.to_str().ok())
+    }
+
+    fn header_names(&self) -> Vec<&str> {
+        self.headers
+            .map(|headers| headers.keys().map(http::HeaderName::as_str).collect())
+            .unwrap_or_default()
+    }
+
+    fn path(&self) -> &str {
+        self.path
+    }
+
+    fn query(&self) -> &str {
+        self.query
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn request_info_lists_every_attached_header_name() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            http::header::USER_AGENT,
+            "ExampleAgent/1.0"
+                .parse()
+                .expect("should parse a User-Agent value"),
+        );
+        headers.insert(
+            http::header::ACCEPT_LANGUAGE,
+            "en".parse().expect("should parse an Accept-Language value"),
+        );
+        let owned = OwnedRequestInfo::new(String::new(), headers.clone());
+        let borrowed = BorrowedRequestInfo::new("", Some(&headers));
+
+        for (case, mut names) in [
+            ("the owned snapshot", owned.header_names()),
+            ("the borrowed view", borrowed.header_names()),
+        ] {
+            names.sort_unstable();
+            assert_eq!(
+                names,
+                vec!["accept-language", "user-agent"],
+                "{case} should list every attached header name"
+            );
+        }
+        assert!(
+            BorrowedRequestInfo::new("203.0.113.5", None)
+                .header_names()
+                .is_empty(),
+            "a borrowed view built without headers should list none"
+        );
+    }
+
+    fn headers_with_cookie() -> HeaderMap {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            "cookie",
+            "client-id=abc123; ts-ec=xyz"
+                .parse()
+                .expect("should parse cookie header"),
+        );
+        headers
+    }
+
+    #[test]
+    fn query_param_decodes_and_selects_the_first_value() {
+        let info = OwnedRequestInfo::new(String::new(), HeaderMap::new())
+            .with_request_target("/page".to_owned(), "id=a%20b&id=second&flag=1".to_owned());
+
+        assert_eq!(
+            info.query_param("id").as_deref(),
+            Some("a b"),
+            "should percent-decode and return the first value for a repeated key"
+        );
+        assert_eq!(info.query_param("flag").as_deref(), Some("1"));
+        assert_eq!(
+            info.query_param("missing"),
+            None,
+            "an absent parameter should be None"
+        );
+    }
+
+    #[test]
+    fn path_and_query_accessors_return_the_request_target() {
+        let info = OwnedRequestInfo::new(String::new(), HeaderMap::new())
+            .with_request_target("/a/b".to_owned(), "x=1".to_owned());
+        assert_eq!(info.path(), "/a/b");
+        assert_eq!(info.query(), "x=1");
+    }
+
+    #[test]
+    fn request_info_defaults_to_an_empty_target() {
+        let info = OwnedRequestInfo::new("203.0.113.5".to_owned(), HeaderMap::new());
+        assert_eq!(info.path(), "", "path should default to empty");
+        assert_eq!(info.query(), "", "query should default to empty");
+        assert_eq!(
+            info.query_param("id"),
+            None,
+            "query_param over an empty query should be None"
+        );
+    }
+
+    #[test]
+    fn a_module_reads_cookies_from_the_header() {
+        let info = OwnedRequestInfo::new("203.0.113.5".to_owned(), headers_with_cookie());
+        assert_eq!(
+            info.header("cookie"),
+            Some("client-id=abc123; ts-ec=xyz"),
+            "cookies are read through the Cookie header"
+        );
+    }
+
+    #[test]
+    fn borrowed_request_info_exposes_the_same_target() {
+        let headers = headers_with_cookie();
+        let info = BorrowedRequestInfo::new("203.0.113.5", Some(&headers))
+            .with_request_target("/page", "id=abc123");
+
+        assert_eq!(info.path(), "/page");
+        assert_eq!(info.query(), "id=abc123");
+        assert_eq!(info.query_param("id").as_deref(), Some("abc123"));
+        assert_eq!(info.header("cookie"), Some("client-id=abc123; ts-ec=xyz"));
+    }
+}
diff --git a/crates/trusted-server-core/src/integrations/google_tag_manager.rs b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
index 3b1c051a37..8dec90335f 100644
--- a/crates/trusted-server-core/src/integrations/google_tag_manager.rs
+++ b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
@@ -3067,6 +3067,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [integrations.google_tag_manager]
@@ -3100,6 +3103,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [integrations.google_tag_manager]
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index f1d1d0b509..cab022ff43 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -3993,6 +3993,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 "#;
 
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index d3c09cd7d7..ba1876513f 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -1047,7 +1047,7 @@ impl IntegrationRegistry {
             // may lack consent signals such as the Sec-GPC header.
             if is_navigation_request(&req) {
                 if let Err(err) = ec_context.generate_if_needed(settings, kv) {
-                    log::warn!("EC generation failed for integration proxy: {err:?}");
+                    log::error!("EC generation failed for integration proxy: {err:?}");
                 }
             } else {
                 log::debug!(
diff --git a/crates/trusted-server-core/src/integrations/testlight.rs b/crates/trusted-server-core/src/integrations/testlight.rs
index 9e68492bd3..371a56cc0d 100644
--- a/crates/trusted-server-core/src/integrations/testlight.rs
+++ b/crates/trusted-server-core/src/integrations/testlight.rs
@@ -9,7 +9,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
 use validator::Validate;
 
-use crate::edge_cookie::get_ec_id;
+use crate::edge_cookie::recognized_ec_id;
 use crate::error::TrustedServerError;
 use crate::integrations::{
     AttributeRewriteAction, INTEGRATION_MAX_BODY_BYTES, IntegrationAttributeContext,
@@ -184,13 +184,17 @@ impl IntegrationProxy for TestlightIntegration {
                 .await?;
         let req = http::Request::from_parts(parts, EdgeBody::empty());
 
-        // Read EC ID from the ts-ec cookie forwarded by the client.
-        // The registry strips x-ts-ec before dispatching, so only the cookie is available here.
-        let ec_id = get_ec_id(&req)
+        // Read the EC ID from the ts-ec cookie forwarded by the client. The
+        // registry strips x-ts-ec before dispatching, so only the cookie is
+        // available here. The value goes into the proxied body as `user.id` and
+        // leaves the edge, so only one the selected module recognizes is
+        // accepted, and a stateless deployment supplies none.
+        let ec_id = recognized_ec_id(settings, services, &req)
             .change_context(Self::error("Failed to read EC ID"))?
             .ok_or_else(|| {
                 Report::new(Self::error(
-                    "EC ID not found in ts-ec cookie — the client must carry a valid EC cookie",
+                    "No EC ID this deployment's Edge Cookie module recognizes was found \
+                     in the ts-ec cookie",
                 ))
             })?;
 
@@ -469,4 +473,92 @@ mod tests {
             );
         });
     }
+
+    /// A well-formed identifier carrying a module code no deployment here
+    /// reads, the shape a partner or another deployment would hand back.
+    const FOREIGN_CODED_EC_ID: &str = "zz00~someone-elses-identifier";
+
+    fn testlight_auction_request(ec_id: &str) -> http::Request<EdgeBody> {
+        let mut req = http::Request::builder()
+            .method(Method::POST)
+            .uri("https://edge.example.com/integrations/testlight/auction")
+            .body(EdgeBody::from(br#"{"imp":[{"id":"slot-1"}]}"#.to_vec()))
+            .expect("should build request");
+        req.headers_mut().insert(
+            crate::constants::HEADER_X_TS_EC.clone(),
+            http::HeaderValue::from_str(ec_id).expect("should build EC header value"),
+        );
+        req
+    }
+
+    fn testlight_integration() -> Arc<TestlightIntegration> {
+        TestlightIntegration::new(TestlightConfig {
+            enabled: true,
+            endpoint: "https://example.com/openrtb".to_string(),
+            timeout_ms: 1000,
+            shim_src: tsjs::tsjs_unified_script_src(),
+            rewrite_scripts: true,
+        })
+    }
+
+    #[test]
+    fn handle_refuses_to_egress_an_ec_id_the_module_does_not_recognize() {
+        futures::executor::block_on(async {
+            // The identifier ends up in the proxied body as `user.id` and leaves
+            // the edge, so a value this deployment did not issue must stop here
+            // rather than be handed to the upstream endpoint.
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, br#"{"ok":true}"#.to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            let settings = create_test_settings();
+
+            let refused = testlight_integration()
+                .handle(
+                    &settings,
+                    &services,
+                    testlight_auction_request(FOREIGN_CODED_EC_ID),
+                )
+                .await
+                .expect_err("a foreign module code should not be proxied upstream");
+            drop(refused);
+
+            assert!(
+                stub.recorded_backend_names().is_empty(),
+                "no upstream call should be made with an unrecognized identifier"
+            );
+        });
+    }
+
+    #[test]
+    fn handle_refuses_to_egress_any_ec_id_in_a_stateless_deployment() {
+        futures::executor::block_on(async {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, br#"{"ok":true}"#.to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            // The value is one the built-in module would recognize, so only
+            // the absence of a selected module can withhold it.
+            let mut settings = create_test_settings();
+            settings.ec.module = None;
+            settings.ec.module_blocks.clear();
+
+            let refused = testlight_integration()
+                .handle(
+                    &settings,
+                    &services,
+                    testlight_auction_request(VALID_SYNTHETIC_ID),
+                )
+                .await
+                .expect_err("a deployment that creates no identifier should proxy none");
+            drop(refused);
+
+            assert!(
+                stub.recorded_backend_names().is_empty(),
+                "no upstream call should be made without a recognized identifier"
+            );
+        });
+    }
 }
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 357660ea0d..138493005f 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -48,6 +48,7 @@ pub mod creative_opportunities;
 pub mod ec;
 pub(crate) mod edge_cookie;
 pub mod error;
+pub mod evidence;
 pub mod geo;
 pub mod host_header;
 pub(crate) mod host_rewrite;
@@ -55,6 +56,7 @@ pub mod html_processor;
 pub mod http_util;
 pub mod integrations;
 pub mod models;
+pub mod module_name;
 pub mod openrtb;
 pub mod platform;
 pub mod price_bucket;
diff --git a/crates/trusted-server-core/src/module_name.rs b/crates/trusted-server-core/src/module_name.rs
new file mode 100644
index 0000000000..3e25831a82
--- /dev/null
+++ b/crates/trusted-server-core/src/module_name.rs
@@ -0,0 +1,247 @@
+//! The name a module is selected by, taken from the folder its crate lives in.
+//!
+//! A crate at `crates/geo/example` supplies the module `geo.example`: the path
+//! below the nearest `crates` directory, with `.` between the parts. A crate
+//! supplying several modules names each one after itself, as
+//! `middleware.example.hide`. A section may leave its own type folder off, so
+//! under `[geo]` the name `example` means `geo.example`. Core's own modules
+//! take bare names, such as `builtin`.
+
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+/// The name of the module the calling crate supplies, or, given an entry, the
+/// name of that entry, as `<crate path>.<entry>`.
+///
+/// Derived from Cargo's `CARGO_MANIFEST_DIR` when the calling crate is built,
+/// so a name cannot drift from its folder. A crate built from outside a
+/// `crates` directory, such as a published package, is named by its package
+/// name.
+#[macro_export]
+macro_rules! module_name {
+    () => {
+        $crate::module_name::from_manifest(env!("CARGO_MANIFEST_DIR"), env!("CARGO_PKG_NAME"), None)
+    };
+    ($entry:expr) => {
+        $crate::module_name::from_manifest(
+            env!("CARGO_MANIFEST_DIR"),
+            env!("CARGO_PKG_NAME"),
+            Some($entry),
+        )
+    };
+}
+
+/// The module name for a crate built at `manifest_dir`, with `entry` after it
+/// when the crate supplies several.
+///
+/// Each distinct name is made once and kept for the life of the process, so
+/// a module can hand out `&'static str` without its crate holding a copy.
+#[must_use]
+pub fn from_manifest(manifest_dir: &str, package: &str, entry: Option<&str>) -> &'static str {
+    static NAMES: OnceLock<Mutex<HashMap<String, &'static str>>> = OnceLock::new();
+    let mut name = crate_path(manifest_dir).unwrap_or_else(|| package.to_owned());
+    if let Some(entry) = entry {
+        name.push('.');
+        name.push_str(entry);
+    }
+    let mut names = NAMES
+        .get_or_init(Mutex::default)
+        .lock()
+        .unwrap_or_else(PoisonError::into_inner);
+    if let Some(existing) = names.get(&name) {
+        return existing;
+    }
+    let leaked: &'static str = Box::leak(name.clone().into_boxed_str());
+    names.insert(name, leaked);
+    leaked
+}
+
+/// The path below the nearest `crates` directory, joined by `.`, or `None`
+/// when the folder is not below one.
+fn crate_path(manifest_dir: &str) -> Option<String> {
+    let parts: Vec<&str> = manifest_dir
+        .split(['/', '\\'])
+        .filter(|part| !part.is_empty())
+        .collect();
+    let crates = parts.iter().rposition(|part| *part == "crates")?;
+    let below = &parts[crates + 1..];
+    (!below.is_empty()).then(|| below.join("."))
+}
+
+/// The longest module name, in bytes.
+const MAX_NAME_BYTES: usize = 255;
+
+/// Whether `name` can name a module: parts joined by `.`, each of lower case
+/// letters, digits, `_` or `-`.
+///
+/// The same rule serves a crate's derived name and a name written in a
+/// section, so anything a crate can be called can also be written.
+#[must_use]
+pub fn is_valid(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= MAX_NAME_BYTES
+        && name.split('.').all(|part| {
+            !part.is_empty()
+                && part.bytes().all(|byte| {
+                    byte.is_ascii_lowercase()
+                        || byte.is_ascii_digit()
+                        || matches!(byte, b'_' | b'-')
+                })
+        })
+}
+
+/// The offered name that `written`, selected in a section of type
+/// `type_folder`, means.
+///
+/// The name as written wins, which is how a bare name reaches one of core's
+/// own modules and a full path reaches a module under another type. Otherwise
+/// the type folder is put in front, because a section is named exactly as its
+/// folder.
+#[must_use]
+pub fn resolve<'a>(type_folder: &str, written: &str, offered: &[&'a str]) -> Option<&'a str> {
+    if let Some(exact) = offered.iter().find(|name| **name == written) {
+        return Some(exact);
+    }
+    offered.iter().copied().find(|name| {
+        name.split_once('.')
+            .is_some_and(|(folder, rest)| rest == written && folder == type_folder)
+    })
+}
+
+/// The short form of `name` within a section of type `type_folder`, being the
+/// name with the type folder taken off, or the name itself when it lives
+/// under another type or is one of core's own.
+#[must_use]
+pub fn short_form<'a>(type_folder: &str, name: &'a str) -> &'a str {
+    match name.split_once('.') {
+        Some((folder, rest)) if folder == type_folder => rest,
+        _ => name,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_crate_is_named_by_its_path_below_crates() {
+        for (dir, expected) in [
+            (
+                "/home/runner/work/trusted-server/crates/geo/example",
+                "geo.example",
+            ),
+            (
+                "D:\\Workspace\\trusted-server\\crates\\permission-signal\\example-scheme",
+                "permission-signal.example-scheme",
+            ),
+            (
+                "/repo/vendor/trusted-server/crates/middleware/example",
+                "middleware.example",
+            ),
+            ("/repo/crates/demo/example", "demo.example"),
+        ] {
+            assert_eq!(crate_path(dir).as_deref(), Some(expected), "{dir}");
+        }
+    }
+
+    #[test]
+    fn the_nearest_crates_directory_counts() {
+        assert_eq!(
+            crate_path("/work/crates/tools/checkout/crates/geo/example").as_deref(),
+            Some("geo.example")
+        );
+    }
+
+    #[test]
+    fn a_crate_outside_a_crates_directory_takes_its_package_name() {
+        assert_eq!(
+            from_manifest("/registry/src/example-geo-0.1.0", "example-geo", None),
+            "example-geo"
+        );
+        assert_eq!(crate_path("/work/crates"), None);
+    }
+
+    #[test]
+    fn an_entry_follows_the_crate_path_and_each_name_is_kept_once() {
+        let first = from_manifest("/repo/crates/middleware/example", "x", Some("hide"));
+        let second = from_manifest("/repo/crates/middleware/example", "x", Some("hide"));
+
+        assert_eq!(first, "middleware.example.hide");
+        assert!(
+            std::ptr::eq(first, second),
+            "the same name is not made twice"
+        );
+    }
+
+    #[test]
+    fn this_crate_names_itself() {
+        assert_eq!(crate::module_name!(), "trusted-server-core");
+    }
+
+    #[test]
+    fn a_name_resolves_as_written_then_within_its_type() {
+        let offered = [
+            "builtin",
+            "geo.example",
+            "permission-signal.us-privacy",
+            "testing.mock",
+        ];
+
+        assert_eq!(resolve("device", "builtin", &offered), Some("builtin"));
+        assert_eq!(resolve("geo", "example", &offered), Some("geo.example"));
+        assert_eq!(resolve("geo", "geo.example", &offered), Some("geo.example"));
+        assert_eq!(
+            resolve("permission-signal", "us-privacy", &offered),
+            Some("permission-signal.us-privacy")
+        );
+        assert_eq!(
+            resolve("permission_signal", "us-privacy", &offered),
+            None,
+            "a section is named exactly as its folder"
+        );
+        assert_eq!(
+            resolve("ad-server", "testing.mock", &offered),
+            Some("testing.mock")
+        );
+        assert_eq!(
+            resolve("device", "example", &offered),
+            None,
+            "another type's module"
+        );
+        assert_eq!(resolve("geo", "missing", &offered), None);
+    }
+
+    #[test]
+    fn a_name_is_lower_case_parts_joined_by_dots() {
+        for good in [
+            "4example",
+            "us-privacy",
+            "host_signals",
+            "middleware.example.hide",
+        ] {
+            assert!(is_valid(good), "{good}");
+        }
+        for bad in [
+            "",
+            "Geo",
+            "geo..example",
+            ".geo",
+            "geo.",
+            "a b",
+            "geo/example",
+        ] {
+            assert!(!is_valid(bad), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn a_short_form_drops_only_the_sections_own_type() {
+        assert_eq!(short_form("geo", "geo.example"), "example");
+        assert_eq!(
+            short_form("permission-signal", "permission-signal.example-scheme"),
+            "example-scheme"
+        );
+        assert_eq!(short_form("ad-server", "testing.mock"), "testing.mock");
+        assert_eq!(short_form("geo", "platform"), "platform");
+    }
+}
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index 17813c77dc..55ee5573be 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -941,6 +941,52 @@ pub(crate) fn noop_services() -> RuntimeServices {
     build_services_with_config(NoopConfigStore)
 }
 
+/// Build a [`RuntimeServices`] carrying an Edge Cookie module, threaded the
+/// way a composition root threads the module it resolved, so a test can
+/// exercise the seam a vendor module reaches core through and check that the
+/// request path reuses that instance.
+pub(crate) fn noop_services_with_ec_module(
+    ec_module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+) -> RuntimeServices {
+    // A fixed client IP, so a module that reads one (the built-in HMAC
+    // module does) can run.
+    noop_services_with_ec_module_and_ip(
+        ec_module,
+        Some("203.0.113.10".parse().expect("should parse test client IP")),
+    )
+}
+
+/// Build a [`RuntimeServices`] with an injected Edge Cookie module and no
+/// client IP, modeling a host that cannot determine one.
+///
+/// Whether that matters is the module's decision, so this exists to test both
+/// answers: a module reading other evidence still creates an identifier, and
+/// one that needs the IP refuses.
+pub(crate) fn noop_services_with_ec_module_without_client_ip(
+    ec_module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+) -> RuntimeServices {
+    noop_services_with_ec_module_and_ip(ec_module, None)
+}
+
+fn noop_services_with_ec_module_and_ip(
+    ec_module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+    client_ip: Option<IpAddr>,
+) -> RuntimeServices {
+    RuntimeServices::builder()
+        .config_store(Arc::new(NoopConfigStore))
+        .secret_store(Arc::new(NoopSecretStore))
+        .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+        .backend(Arc::new(NoopBackend))
+        .http_client(Arc::new(NoopHttpClient))
+        .geo(Arc::new(NoopGeo))
+        .client_info(ClientInfo {
+            client_ip,
+            ..ClientInfo::default()
+        })
+        .resolved_ec_module(ec_module)
+        .build()
+}
+
 /// Build a [`RuntimeServices`] whose auction telemetry sink is the supplied
 /// recording (or otherwise custom) sink, so tests can assert which terminal
 /// auction events were emitted.
diff --git a/crates/trusted-server-core/src/platform/types.rs b/crates/trusted-server-core/src/platform/types.rs
index 3570bdc102..bfad4e7762 100644
--- a/crates/trusted-server-core/src/platform/types.rs
+++ b/crates/trusted-server-core/src/platform/types.rs
@@ -9,6 +9,7 @@ use super::{
     PlatformBackend, PlatformConfigStore, PlatformGeo, PlatformHttpClient, PlatformKvStore,
     PlatformSecretStore,
 };
+use crate::ec::module::EdgeCookieModule;
 
 /// Geographic information extracted from a request.
 ///
@@ -18,7 +19,7 @@ use super::{
 pub struct GeoInfo {
     /// City name.
     pub city: String,
-    /// Two-letter country code.
+    /// ISO 3166-1 alpha-2 country code, for example `US` or `GB`.
     pub country: String,
     /// Continent name.
     pub continent: String,
@@ -28,7 +29,8 @@ pub struct GeoInfo {
     pub longitude: f64,
     /// DMA (Designated Market Area) / metro code.
     pub metro_code: i64,
-    /// Region code.
+    /// ISO 3166-2 subdivision code without the country prefix, for example `CA`
+    /// for California, or `None` when no region resolves.
     pub region: Option<String>,
     /// Autonomous System Number (e.g. `7922` = Comcast).
     /// Used to distinguish home ISP vs. corporate VPN.
@@ -188,6 +190,13 @@ pub struct RuntimeServices {
     pub(crate) auction_telemetry_sink: Arc<dyn AuctionTelemetrySink>,
     /// Per-request client metadata extracted at the entry point.
     pub(crate) client_info: ClientInfo,
+    /// The Edge Cookie module this deployment already resolved from
+    /// `[ec] module` while it built application state.
+    ///
+    /// `None` when the adapter resolved nothing here, in which case the request
+    /// path resolves the selection itself, which is what a deployment that
+    /// selects no module, the Axum adapter, and the core tests all do.
+    pub(crate) resolved_ec_module: Option<Arc<dyn EdgeCookieModule>>,
 }
 
 impl RuntimeServices {
@@ -275,6 +284,21 @@ impl RuntimeServices {
         &self.client_info
     }
 
+    /// Returns the Edge Cookie module the composition root already resolved,
+    /// when the adapter threaded one through.
+    ///
+    /// Resolving `[ec] module` reads no request data, so the answer is the
+    /// same for every request and an adapter that resolves it once while it
+    /// builds application state can hand the result here instead of the
+    /// request path resolving the same settings again. `None` means nothing was
+    /// threaded, so the request path resolves for itself. Read this through
+    /// [`request_module`](crate::ec::module::request_module) rather than
+    /// directly, so both answers are handled in one place.
+    #[must_use]
+    pub fn resolved_ec_module(&self) -> Option<Arc<dyn EdgeCookieModule>> {
+        self.resolved_ec_module.clone()
+    }
+
     /// Wrap the KV store in a [`super::KvHandle`] for ergonomic access to
     /// JSON helpers, pagination, and validation.
     #[must_use]
@@ -295,6 +319,25 @@ impl RuntimeServices {
         }
     }
 
+    /// Returns a clone of this instance with the resolved Edge Cookie module
+    /// replaced.
+    ///
+    /// Adapters that build their per-request services through a shared helper
+    /// with no application state in hand use this to thread the module the
+    /// composition root resolved. `None` leaves the request path to resolve
+    /// `[ec] module` for itself, which is what the Axum adapter and a
+    /// deployment selecting no module both do.
+    #[must_use]
+    pub fn with_resolved_ec_module(
+        self,
+        resolved_ec_module: Option<Arc<dyn EdgeCookieModule>>,
+    ) -> Self {
+        Self {
+            resolved_ec_module,
+            ..self
+        }
+    }
+
     /// Returns a clone of this instance with the template cache replaced.
     #[must_use]
     pub fn with_template_cache(self, cache: Arc<dyn super::PlatformTemplateCache>) -> Self {
@@ -340,6 +383,7 @@ pub struct RuntimeServicesBuilder {
     geo: Option<Arc<dyn PlatformGeo>>,
     auction_telemetry_sink: Option<Arc<dyn AuctionTelemetrySink>>,
     client_info: Option<ClientInfo>,
+    resolved_ec_module: Option<Arc<dyn EdgeCookieModule>>,
 }
 
 impl RuntimeServicesBuilder {
@@ -355,6 +399,7 @@ impl RuntimeServicesBuilder {
             geo: None,
             auction_telemetry_sink: None,
             client_info: None,
+            resolved_ec_module: None,
         }
     }
 
@@ -434,6 +479,18 @@ impl RuntimeServicesBuilder {
         self
     }
 
+    /// Set the Edge Cookie module the composition root already resolved.
+    ///
+    /// Optional. This is the module the selector actually chose, so setting
+    /// it keeps the request path from resolving the same settings a second
+    /// time. It is the single seam through which a vendor or host Edge Cookie
+    /// module reaches the request path.
+    #[must_use]
+    pub fn resolved_ec_module(mut self, module: Arc<dyn EdgeCookieModule>) -> Self {
+        self.resolved_ec_module = Some(module);
+        self
+    }
+
     /// Construct [`RuntimeServices`] from the accumulated configuration.
     ///
     /// # Panics
@@ -474,6 +531,7 @@ impl RuntimeServicesBuilder {
             client_info: self
                 .client_info
                 .expect("should set client_info before building RuntimeServices"),
+            resolved_ec_module: self.resolved_ec_module,
         }
     }
 }
diff --git a/crates/trusted-server-core/src/proxy.rs b/crates/trusted-server-core/src/proxy.rs
index 6a30645aba..5e4fcd1b00 100644
--- a/crates/trusted-server-core/src/proxy.rs
+++ b/crates/trusted-server-core/src/proxy.rs
@@ -21,7 +21,7 @@ use crate::constants::{
     HEADER_USER_AGENT, HEADER_X_FORWARDED_FOR,
 };
 use crate::creative::{CreativeCssProcessor, CreativeHtmlProcessor};
-use crate::edge_cookie::get_ec_id;
+use crate::edge_cookie::recognized_ec_id;
 use crate::error::TrustedServerError;
 use crate::platform::{
     DEFAULT_FIRST_BYTE_TIMEOUT, PlatformBackendSpec, PlatformHttpRequest, PlatformResponse,
@@ -818,7 +818,7 @@ pub async fn proxy_request(
     })?;
 
     if forward_ec_id {
-        append_ec_id(&req, &mut target_url_parsed);
+        append_ec_id(settings, services, &req, &mut target_url_parsed);
     }
 
     proxy_with_redirects(
@@ -1221,8 +1221,19 @@ fn upsert_ec_query_param(url: &mut url::Url, ec_id: &str) {
     url.set_query(Some(&serializer.finish()));
 }
 
-fn append_ec_id(req: &Request<EdgeBody>, target_url_parsed: &mut url::Url) {
-    let ec_id_param = match get_ec_id(req) {
+/// Forwards the request's Edge Cookie identifier to the outbound target URL.
+///
+/// Only an identifier the selected module recognizes is forwarded. A value
+/// carrying another deployment's module code, and any value at all in a
+/// stateless deployment, is withheld, so nothing this deployment did not issue
+/// reaches the origin.
+fn append_ec_id(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request<EdgeBody>,
+    target_url_parsed: &mut url::Url,
+) {
+    let ec_id_param = match recognized_ec_id(settings, services, req) {
         Ok(id) => id,
         Err(e) => {
             log::warn!("failed to extract EC ID for forwarding: {:?}", e);
@@ -1615,7 +1626,7 @@ pub async fn handle_first_party_proxy(
 /// Returns an error if the signed target cannot be reconstructed or validation fails.
 pub async fn handle_first_party_click(
     settings: &Settings,
-    _services: &RuntimeServices,
+    services: &RuntimeServices,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let SignedTarget {
@@ -1624,7 +1635,10 @@ pub async fn handle_first_party_click(
         had_params,
     } = reconstruct_and_validate_signed_target(settings, &req.uri().to_string())?;
 
-    let ec_id = match get_ec_id(&req) {
+    // The redirect target is a third party's URL, so only an identifier the
+    // selected module recognizes is added to it. A stateless deployment adds
+    // nothing.
+    let ec_id = match recognized_ec_id(settings, services, &req) {
         Ok(id) => id,
         Err(e) => {
             log::warn!("failed to extract EC ID for forwarding: {:?}", e);
@@ -2238,16 +2252,17 @@ mod tests {
 
     use super::{
         AssetProxyCachePolicy, IMAGE_FALLBACK_CONTENT_TYPE, ProxyRequestConfig,
-        SUPPORTED_ENCODINGS, asset_origin_host_header, asset_path_skips_image_optimizer,
-        build_asset_proxy_target_url, handle_asset_proxy_request, handle_first_party_click,
-        handle_first_party_proxy, handle_first_party_proxy_rebuild, handle_first_party_proxy_sign,
-        is_host_allowed, is_host_permitted, proxy_request, rebuild_response_with_body,
-        reconstruct_and_validate_signed_target, stream_asset_body,
+        SUPPORTED_ENCODINGS, append_ec_id, asset_origin_host_header,
+        asset_path_skips_image_optimizer, build_asset_proxy_target_url, handle_asset_proxy_request,
+        handle_first_party_click, handle_first_party_proxy, handle_first_party_proxy_rebuild,
+        handle_first_party_proxy_sign, is_host_allowed, is_host_permitted, proxy_request,
+        rebuild_response_with_body, reconstruct_and_validate_signed_target, stream_asset_body,
     };
     use crate::cache_policy::{CachePolicy, EdgeCacheHeader};
     use crate::constants::{HEADER_ACCEPT, HEADER_X_FORWARDED_FOR};
     use crate::creative;
     use crate::error::{IntoHttpResponse, TrustedServerError};
+    use crate::platform::RuntimeServices;
     use crate::platform::test_support::{
         HashMapSecretStore, StubHttpClient, build_services_with_http_client,
         build_services_with_secret_and_http_client, noop_services,
@@ -2267,6 +2282,7 @@ mod tests {
     use edgezero_core::body::Body as EdgeBody;
     use edgezero_core::http::response_builder as edge_response_builder;
     use error_stack::Report;
+    use http::Request;
     use http::{HeaderValue, Method, Request as HttpRequest, Response, StatusCode, header};
 
     #[test]
@@ -2989,7 +3005,8 @@ mod tests {
             );
             req.headers_mut().insert(
                 crate::constants::HEADER_X_TS_EC,
-                HeaderValue::from_static("ec-123"),
+                HeaderValue::from_str(&recognized_hmac_ec_id())
+                    .expect("should build EC header value"),
             );
 
             let resp = handle_first_party_click(&settings, &noop_services(), req)
@@ -3007,11 +3024,166 @@ mod tests {
                 .map(|(k, v)| (k.into_owned(), v.into_owned()))
                 .collect();
             assert_eq!(pairs.remove("foo").as_deref(), Some("1"));
-            assert_eq!(pairs.remove("ts-ec").as_deref(), Some("ec-123"));
+            assert_eq!(
+                pairs.remove("ts-ec").as_deref(),
+                Some(recognized_hmac_ec_id().as_str())
+            );
             assert!(pairs.is_empty());
         });
     }
 
+    /// An identifier the built-in HMAC module, the module
+    /// `create_test_settings` selects, recognizes as its own.
+    fn recognized_hmac_ec_id() -> String {
+        format!("hmac~{}", crate::test_support::tests::VALID_SYNTHETIC_ID)
+    }
+
+    /// A well-formed identifier carrying a module code no deployment here
+    /// reads, the shape a partner or another deployment would hand back.
+    const FOREIGN_CODED_EC_ID: &str = "zz00~someone-elses-identifier";
+
+    fn stateless_settings() -> Settings {
+        let mut settings = create_test_settings();
+        settings.ec.module = None;
+        settings.ec.module_blocks.clear();
+        settings
+    }
+
+    fn signed_click_request(settings: &Settings, ec_id: &str) -> Request<EdgeBody> {
+        let tsurl = "https://cdn.example/a.png";
+        let full = format!("{tsurl}?foo=1");
+        let sig = crate::http_util::compute_encrypted_sha256_token(settings, &full);
+        let mut req = build_http_request(
+            Method::GET,
+            format!(
+                "https://edge.example/first-party/click?tsurl={}&foo=1&tstoken={}",
+                url::form_urlencoded::byte_serialize(tsurl.as_bytes()).collect::<String>(),
+                sig
+            ),
+        );
+        req.headers_mut().insert(
+            crate::constants::HEADER_X_TS_EC,
+            HeaderValue::from_str(ec_id).expect("should build EC header value"),
+        );
+        req
+    }
+
+    fn click_ts_ec_param(
+        settings: &Settings,
+        services: &RuntimeServices,
+        req: Request<EdgeBody>,
+    ) -> Option<String> {
+        let resp = futures::executor::block_on(handle_first_party_click(settings, services, req))
+            .expect("should redirect");
+        let loc = resp
+            .headers()
+            .get(header::LOCATION)
+            .and_then(|h| h.to_str().ok())
+            .expect("Location header should be present and valid")
+            .to_owned();
+        url::Url::parse(&loc)
+            .expect("Location should be a valid URL")
+            .query_pairs()
+            .find(|(k, _)| k == "ts-ec")
+            .map(|(_, v)| v.into_owned())
+    }
+
+    #[test]
+    fn click_withholds_an_ec_id_the_module_does_not_recognize() {
+        let settings = create_test_settings();
+        let param = click_ts_ec_param(
+            &settings,
+            &noop_services(),
+            signed_click_request(&settings, FOREIGN_CODED_EC_ID),
+        );
+
+        assert_eq!(
+            param, None,
+            "a value carrying another deployment's module code should not reach the click target"
+        );
+    }
+
+    #[test]
+    fn click_withholds_every_ec_id_in_a_stateless_deployment() {
+        let settings = stateless_settings();
+        // The value is one the built-in module would recognize, so only the
+        // absence of a selected module can withhold it.
+        let param = click_ts_ec_param(
+            &settings,
+            &noop_services(),
+            signed_click_request(&settings, &recognized_hmac_ec_id()),
+        );
+
+        assert_eq!(
+            param, None,
+            "a deployment that creates no identifier should hand none to the click target"
+        );
+    }
+
+    #[test]
+    fn append_ec_id_forwards_only_what_the_module_recognizes() {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let recognized = recognized_hmac_ec_id();
+
+        let mut url =
+            url::Url::parse("https://origin.example/page?foo=1").expect("should parse origin URL");
+        append_ec_id(
+            &settings,
+            &services,
+            &request_with_ec_cookie(&recognized),
+            &mut url,
+        );
+        assert_eq!(
+            ts_ec_param(&url),
+            Some(recognized.clone()),
+            "the deployment's own identifier should still reach the origin"
+        );
+
+        let mut url =
+            url::Url::parse("https://origin.example/page?foo=1").expect("should parse origin URL");
+        append_ec_id(
+            &settings,
+            &services,
+            &request_with_ec_cookie(FOREIGN_CODED_EC_ID),
+            &mut url,
+        );
+        assert_eq!(
+            ts_ec_param(&url),
+            None,
+            "a foreign module code should not reach the origin"
+        );
+
+        let mut url =
+            url::Url::parse("https://origin.example/page?foo=1").expect("should parse origin URL");
+        append_ec_id(
+            &stateless_settings(),
+            &services,
+            &request_with_ec_cookie(&recognized),
+            &mut url,
+        );
+        assert_eq!(
+            ts_ec_param(&url),
+            None,
+            "a stateless deployment should forward nothing to the origin"
+        );
+    }
+
+    fn request_with_ec_cookie(ec_id: &str) -> Request<EdgeBody> {
+        let mut req = build_http_request(Method::GET, "https://edge.example/page");
+        req.headers_mut().insert(
+            http::header::COOKIE,
+            HeaderValue::from_str(&format!("ts-ec={ec_id}")).expect("should build cookie header"),
+        );
+        req
+    }
+
+    fn ts_ec_param(url: &url::Url) -> Option<String> {
+        url.query_pairs()
+            .find(|(k, _)| k == "ts-ec")
+            .map(|(_, v)| v.into_owned())
+    }
+
     #[test]
     fn proxy_rebuild_adds_and_removes_params() {
         futures::executor::block_on(async {
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 4dfe4e5a25..a4b150d475 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -4488,6 +4488,11 @@ pub async fn handle_publisher_request(
     // ID, keeping the withdrawal CAS off the post-origin latency path.
     let active_ec_id_owned = ec_context.ec_value().map(str::to_owned);
     let active_ec_id = active_ec_id_owned.as_deref();
+    // The identity-graph key for the active EC ID, the owning module's
+    // canonical form of it. The snapshot preload reads and compares the row
+    // under this key, the key the row was written under, rather than under the
+    // identifier as issued.
+    let active_kv_key = ec_context.ec_kv_key();
     let ec_id_owned = active_ec_id_owned.clone().filter(|_| ec_allowed);
     let ec_id = ec_id_owned.as_deref();
     let cookie_jar = handle_request_cookies(&req)?;
@@ -4869,16 +4874,17 @@ pub async fn handle_publisher_request(
                 })?,
         );
     }
-    if should_preload_ec && let (Some(graph), Some(active_ec_id)) = (kv, active_ec_id) {
-        let refreshed = graph.load_snapshot(active_ec_id);
+    if should_preload_ec && let (Some(graph), Some(active_kv_key)) = (kv, active_kv_key.as_deref())
+    {
+        let refreshed = graph.load_snapshot(active_kv_key);
         // Never downgrade an in-request Add-confirmed Present snapshot: a
         // freshly created row can read back Missing/Failed on an
         // eventually-consistent store, and rotating or suppressing that
         // just-generated identity would fragment it. Adopt the refresh only
         // when it keeps or upgrades to a Present row (the intended
         // generation-refresh) — otherwise retain the confirmed entry.
-        let keep_present = ec_context.kv_snapshot().entry_for(active_ec_id).is_some()
-            && refreshed.entry_for(active_ec_id).is_none();
+        let keep_present = ec_context.kv_snapshot().entry_for(active_kv_key).is_some()
+            && refreshed.entry_for(active_kv_key).is_none();
         if !keep_present {
             ec_context.set_kv_snapshot(refreshed);
         }
@@ -7083,9 +7089,16 @@ pub async fn handle_page_bids(
             // actually running (enabled, consent-granted, slots matched, not a
             // bot/prefetch) and a partner registry exists to consume server-side
             // EIDs. Kill-switch, no-slot, bot/prefetch, and no-registry requests
-            // never reach here, so they incur no billable KV read.
+            // never reach here, so they incur no billable KV read. The row is
+            // read under the owning module's canonical form of the
+            // identifier, the key it is stored under, rather than under the
+            // identifier as issued.
             let page_bids_kv_snapshot = match (kv, ec_id.as_deref(), auction.registry) {
-                (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
+                (Some(graph), Some(_), Some(_)) => ec_context
+                    .ec_kv_key()
+                    .map_or(crate::ec::EcKvSnapshot::NotRead, |kv_key| {
+                        graph.load_snapshot(&kv_key)
+                    }),
                 _ => crate::ec::EcKvSnapshot::NotRead,
             };
             // Hand the loaded row to the request context so response
@@ -24833,6 +24846,11 @@ mod tests {
     /// tests drive the real handlers with a divergent edge host and assert on
     /// the auction request the orchestrator dispatched and on the telemetry rows
     /// the handler emitted.
+    ///
+    /// The same capturing setup also covers how both paths key the identity
+    /// graph. A module whose canonical form differs from the cookie value has
+    /// its row read under the canonical key, so the partner ID stored there
+    /// reaches the dispatched auction request.
     mod navigation_publisher_domain_tests {
         use super::*;
         use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
@@ -24840,6 +24858,7 @@ mod tests {
         use crate::auction::types::AuctionRequest;
         use crate::auction::{AuctionContext, AuctionOrchestrator};
         use crate::creative_opportunities::{CreativeOpportunityFormat, CreativeOpportunitySlot};
+        use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule};
         use crate::platform::test_support::{
             NoopConfigStore, NoopGeo, NoopSecretStore, StubBackend,
         };
@@ -25242,5 +25261,271 @@ mod tests {
 
             assert_only_renderable_slot_was_auctioned(&captured);
         }
+
+        /// The bidstream partner whose stored ID the canonical row carries.
+        const CANONICAL_ROW_PARTNER: &str = "ssp.example.com";
+
+        /// The partner ID the canonical row stores for [`CANONICAL_ROW_PARTNER`].
+        const CANONICAL_ROW_UID: &str = "partner-uid-123";
+
+        /// An identity graph holding one live row under [`CANONICAL_KV_KEY`],
+        /// and a registry that forwards that row's partner ID as an EID.
+        fn canonical_row_graph_and_registry() -> (KvIdentityGraph, PartnerRegistry) {
+            let graph = KvIdentityGraph::in_memory("navigation-canonical-store");
+            graph
+                .create(
+                    CANONICAL_KV_KEY,
+                    &crate::ec::kv_types::KvEntry::minimal(
+                        CANONICAL_ROW_PARTNER,
+                        CANONICAL_ROW_UID,
+                        1_741_824_000,
+                    ),
+                )
+                .expect("should seed the row under the canonical key");
+            let registry = PartnerRegistry::from_config(&[crate::settings::EcPartner {
+                name: "Canonical row partner".to_owned(),
+                source_domain: CANONICAL_ROW_PARTNER.to_owned(),
+                openrtb_atype: crate::settings::EcPartner::default_openrtb_atype(),
+                bidstream_enabled: true,
+                api_token: Some(crate::redacted::Redacted::new(
+                    "canonical-row-partner-token-32-bytes".to_owned(),
+                )),
+                batch_rate_limit: crate::settings::EcPartner::default_batch_rate_limit(),
+                pull_sync_enabled: false,
+                pull_sync_url: None,
+                pull_sync_allowed_domains: vec![],
+                pull_sync_ttl_sec: crate::settings::EcPartner::default_pull_sync_ttl_sec(),
+                pull_sync_rate_limit: crate::settings::EcPartner::default_pull_sync_rate_limit(),
+                ts_pull_token: None,
+            }])
+            .expect("should build a registry with one bidstream partner");
+            (graph, registry)
+        }
+
+        /// A returning visitor carrying the identifier [`CanonicalizingModule`]
+        /// creates, with consent that permits the server-side auction.
+        fn canonicalizing_returning_visitor() -> EcContext {
+            let consent = crate::consent::ConsentContext {
+                jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                ..Default::default()
+            };
+            EcContext::new_for_test(Some(CANONICAL_COOKIE_VALUE.to_owned()), consent)
+                .with_module_for_test(Arc::new(CanonicalizingModule))
+        }
+
+        /// Asserts the dispatched auction request carried the partner ID the
+        /// canonical row stores, and the request snapshot is bound to the
+        /// canonical key.
+        fn assert_auction_used_the_canonical_row(
+            captured: &Arc<Mutex<Option<AuctionRequest>>>,
+            ec_context: &EcContext,
+        ) {
+            let request = captured
+                .lock()
+                .expect("should lock captured request")
+                .clone()
+                .expect("should dispatch an auction request");
+            let eids = request
+                .user
+                .eids
+                .expect("the auction should carry server-side EIDs from the identity graph");
+            assert!(
+                eids.iter().any(|eid| eid.source == CANONICAL_ROW_PARTNER
+                    && eid.uids.iter().any(|uid| uid.id == CANONICAL_ROW_UID)),
+                "the auction should carry the partner ID stored under the canonical key, got {eids:?}"
+            );
+            assert!(
+                ec_context
+                    .kv_snapshot()
+                    .entry_for(CANONICAL_KV_KEY)
+                    .is_some(),
+                "the request snapshot should be bound to the canonical key"
+            );
+        }
+
+        #[tokio::test]
+        async fn initial_navigation_reads_the_identity_row_under_the_canonical_key() {
+            // The identity graph stores a row under the owning module's
+            // canonical form of the identifier. Preloaded and resolved under
+            // the identifier as issued, a module whose canonical form differs
+            // from the cookie value found no row, so the auction carried no
+            // server-side EIDs.
+            let settings = settings_with_capturing_provider();
+            let captured = Arc::new(Mutex::new(None));
+            let orchestrator = orchestrator_capturing_request(&settings, &captured);
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"<html><head></head><body>ok</body></html>".to_vec());
+            let services = services_with(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>,
+                Arc::new(RecordingTelemetrySink::default()),
+            );
+            let (graph, registry) = canonical_row_graph_and_registry();
+            let mut ec_context = canonicalizing_returning_visitor();
+            let req = HttpRequest::builder()
+                .method(Method::GET)
+                .uri(format!("https://{EDGE_HOST}/2024/01/my-article/"))
+                .header(header::HOST, EDGE_HOST)
+                .header("sec-fetch-dest", "document")
+                .body(EdgeBody::empty())
+                .expect("should build test request");
+
+            let _ = handle_publisher_request(
+                &settings,
+                &services,
+                Some(&graph),
+                &mut ec_context,
+                AuctionDispatch {
+                    orchestrator: &orchestrator,
+                    slots: &article_slot(),
+                    registry: Some(&registry),
+                },
+                req,
+                EdgeCacheHeader::SMaxageFallback,
+            )
+            .await
+            .expect("should proxy publisher request");
+
+            assert_auction_used_the_canonical_row(&captured, &ec_context);
+        }
+
+        #[tokio::test]
+        async fn initial_navigation_keeps_a_new_identifiers_cookie() {
+            // Generation binds the request snapshot to the canonical key. The
+            // navigation preload that follows read under the identifier as
+            // issued, found nothing there, and replaced that snapshot with a
+            // miss, so EC finalization skipped the cookie for the identifier
+            // this request had just created. The second store's first point
+            // read misses the row generation just wrote, as an eventually
+            // consistent store can right after a write. The preload keeps
+            // generation's snapshot in that case only when it compares both
+            // snapshots under the canonical key.
+            let stores = [
+                (
+                    "a consistent store",
+                    KvIdentityGraph::in_memory("navigation-new-identifier-store"),
+                ),
+                (
+                    "a store whose first point read misses",
+                    KvIdentityGraph::stale_lookup("navigation-stale-read-store", 1),
+                ),
+            ];
+            for (store, graph) in stores {
+                let settings = settings_with_capturing_provider();
+                let captured = Arc::new(Mutex::new(None));
+                let orchestrator = orchestrator_capturing_request(&settings, &captured);
+                let stub = Arc::new(StubHttpClient::new());
+                stub.push_response(200, b"<html><head></head><body>ok</body></html>".to_vec());
+                let services = services_with(
+                    Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>,
+                    Arc::new(RecordingTelemetrySink::default()),
+                );
+                let consent = crate::consent::ConsentContext {
+                    jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                    ..Default::default()
+                };
+                let mut ec_context = EcContext::new_for_test(None, consent)
+                    .with_module_for_test(Arc::new(CanonicalizingModule));
+                ec_context
+                    .generate_if_needed(&settings, Some(&graph))
+                    .expect("should create the identifier through the module");
+                assert_eq!(
+                    ec_context.ec_value(),
+                    Some(CANONICAL_COOKIE_VALUE),
+                    "test precondition: the module should create its identifier"
+                );
+                let req = HttpRequest::builder()
+                    .method(Method::GET)
+                    .uri(format!("https://{EDGE_HOST}/2024/01/my-article/"))
+                    .header(header::HOST, EDGE_HOST)
+                    .header("sec-fetch-dest", "document")
+                    .body(EdgeBody::empty())
+                    .expect("should build test request");
+
+                let _ = handle_publisher_request(
+                    &settings,
+                    &services,
+                    Some(&graph),
+                    &mut ec_context,
+                    AuctionDispatch {
+                        orchestrator: &orchestrator,
+                        slots: &[],
+                        registry: None,
+                    },
+                    req,
+                    EdgeCacheHeader::SMaxageFallback,
+                )
+                .await
+                .expect("should proxy publisher request");
+
+                let mut response = Response::new(EdgeBody::empty());
+                crate::ec::finalize::ec_finalize_response(
+                    &settings,
+                    &mut ec_context,
+                    Some(&graph),
+                    &PartnerRegistry::empty(),
+                    None,
+                    None,
+                    &mut response,
+                );
+
+                let cookies: Vec<&str> = response
+                    .headers()
+                    .get_all(header::SET_COOKIE)
+                    .iter()
+                    .filter_map(|value| value.to_str().ok())
+                    .collect();
+                assert!(
+                    cookies
+                        .iter()
+                        .any(|cookie| cookie.starts_with("ts-ec=") && !cookie.contains("Max-Age=0")),
+                    "the identifier this request created should reach the browser with {store}, \
+                     got {cookies:?}"
+                );
+            }
+        }
+
+        #[tokio::test]
+        async fn page_bids_reads_the_identity_row_under_the_canonical_key() {
+            // The same keying for the SPA re-auction endpoint, which loads the
+            // row itself only once a live auction will run.
+            let settings = settings_with_capturing_provider();
+            let captured = Arc::new(Mutex::new(None));
+            let orchestrator = orchestrator_capturing_request(&settings, &captured);
+            let services = services_with(
+                Arc::new(crate::platform::test_support::NoopHttpClient),
+                Arc::new(RecordingTelemetrySink::default()),
+            );
+            let (graph, registry) = canonical_row_graph_and_registry();
+            let mut ec_context = canonicalizing_returning_visitor();
+            let mut req = HttpRequest::builder()
+                .method(Method::GET)
+                .uri(format!(
+                    "https://{EDGE_HOST}/_ts/page-bids?path=/2024/01/my-article/"
+                ))
+                .header(header::HOST, EDGE_HOST)
+                .body(EdgeBody::empty())
+                .expect("should build test request");
+            req.headers_mut().insert(
+                header::HeaderName::from_static("sec-fetch-site"),
+                HeaderValue::from_static("same-origin"),
+            );
+
+            let _ = handle_page_bids(
+                &settings,
+                &services,
+                Some(&graph),
+                AuctionDispatch {
+                    orchestrator: &orchestrator,
+                    slots: &article_slot(),
+                    registry: Some(&registry),
+                },
+                &mut ec_context,
+                req,
+            )
+            .await
+            .expect("should return ok response");
+
+            assert_auction_used_the_canonical_row(&captured, &ec_context);
+        }
     }
 }
diff --git a/crates/trusted-server-core/src/response_privacy.rs b/crates/trusted-server-core/src/response_privacy.rs
index 46ff4bf5b4..65e53c7c71 100644
--- a/crates/trusted-server-core/src/response_privacy.rs
+++ b/crates/trusted-server-core/src/response_privacy.rs
@@ -220,6 +220,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-core/src/secret_resolution.rs b/crates/trusted-server-core/src/secret_resolution.rs
index f362a0b7b2..721bfaca05 100644
--- a/crates/trusted-server-core/src/secret_resolution.rs
+++ b/crates/trusted-server-core/src/secret_resolution.rs
@@ -1,8 +1,10 @@
 //! Runtime resolution of `EdgeZero` app-config secret references.
 //!
 //! Config blobs carry secret-store key names at rest. This module walks the
-//! public `EdgeZero` metadata contract and replaces those names only in the
-//! in-memory value used to build runtime [`crate::settings::Settings`].
+//! public `EdgeZero` metadata contract, together with the leaves
+//! [`ConfiguredSecretFields`] reads out of the configuration itself, and
+//! replaces those names only in the in-memory value used to build runtime
+//! [`crate::settings::Settings`].
 
 use edgezero_core::app_config::{AppConfigMeta, SecretField, SecretKind, SecretPathSegment};
 use error_stack::Report;
@@ -11,8 +13,27 @@ use serde_json::Value;
 use crate::error::TrustedServerError;
 use crate::platform::{PlatformSecretStore, StoreName};
 
+/// Secret leaves whose paths come from the configuration rather than the type.
+///
+/// [`AppConfigMeta::secret_fields`] is an associated function of the type, so
+/// every path it can return is fixed, and `EdgeZero`'s path segments have no
+/// way to say "whatever name the operator chose". A configuration can hold
+/// secrets under such a name, as an Edge Cookie module block under a label
+/// does, and an implementation of this trait finds those by reading the
+/// configuration being loaded.
+pub trait ConfiguredSecretFields: AppConfigMeta {
+    /// The secret leaves `data` holds under names the operator chose, each
+    /// with its full path from the configuration root.
+    fn configured_secret_fields(data: &Value) -> Vec<SecretField>;
+}
+
 /// Resolve all secret references in a serialized Trusted Server app config.
 ///
+/// Both the fixed leaves [`AppConfigMeta::secret_fields`] lists and the ones
+/// [`ConfiguredSecretFields::configured_secret_fields`] reads out of `data`
+/// are resolved in one pass, so a failure in either leaves the configuration
+/// as it was.
+///
 /// The input is mutated in memory; the verified envelope is never rewritten.
 /// Secret values are not included in structural or platform errors.
 ///
@@ -21,13 +42,17 @@ use crate::platform::{PlatformSecretStore, StoreName};
 /// Returns [`TrustedServerError::Configuration`] when a required path or key
 /// is malformed, a secret is unavailable, is not valid UTF-8, or resolves to an
 /// empty value.
-pub fn resolve_secret_references<C: AppConfigMeta>(
+pub fn resolve_secret_references<C: ConfiguredSecretFields>(
     data: &mut Value,
     secret_store: &dyn PlatformSecretStore,
     default_store_name: &StoreName,
 ) -> Result<(), Report<TrustedServerError>> {
+    let fields = C::secret_fields()
+        .into_iter()
+        .chain(C::configured_secret_fields(data))
+        .collect::<Vec<_>>();
     let mut resolved_data = data.clone();
-    for field in C::secret_fields() {
+    for field in fields {
         if matches!(field.kind, SecretKind::StoreRef) {
             continue;
         }
@@ -238,6 +263,28 @@ mod tests {
 
     struct Fixture;
 
+    impl ConfiguredSecretFields for Fixture {
+        /// Every key under `labeled` holds its secret at
+        /// `labeled.<name>.secret`, which is the shape a fixed path cannot
+        /// name.
+        fn configured_secret_fields(data: &Value) -> Vec<SecretField> {
+            data.get("labeled")
+                .and_then(Value::as_object)
+                .into_iter()
+                .flatten()
+                .map(|(name, _)| SecretField {
+                    kind: SecretKind::KeyInDefault,
+                    optional: false,
+                    path: vec![
+                        SecretPathSegment::Field("labeled".into()),
+                        SecretPathSegment::Field(name.clone().into()),
+                        SecretPathSegment::Field("secret".into()),
+                    ],
+                })
+                .collect()
+        }
+    }
+
     impl AppConfigMeta for Fixture {
         fn secret_fields() -> Vec<SecretField> {
             vec![
@@ -316,6 +363,38 @@ mod tests {
         assert_eq!(present["feature"]["credential"], "resolved-feature");
     }
 
+    #[test]
+    fn resolves_a_secret_under_a_name_only_the_configuration_holds() {
+        let mut data = serde_json::json!({
+            "outer": [{"token": "token-a"}],
+            "labeled": {"chosen": {"secret": "feature-key"}},
+        });
+
+        resolve_secret_references::<Fixture>(&mut data, &store(), &StoreName::from("secrets"))
+            .expect("should resolve a secret the fixed paths cannot name");
+
+        assert_eq!(data["outer"][0]["token"], "resolved-a");
+        assert_eq!(data["labeled"]["chosen"]["secret"], "resolved-feature");
+    }
+
+    #[test]
+    fn a_failed_configured_field_leaves_the_fixed_ones_unresolved() {
+        // Fixed and configured leaves resolve in one pass, so a failure in
+        // either hands back the configuration exactly as it arrived.
+        let mut data = serde_json::json!({
+            "outer": [{"token": "token-a"}],
+            "labeled": {"chosen": {"secret": "missing"}},
+        });
+        let original = data.clone();
+
+        let err =
+            resolve_secret_references::<Fixture>(&mut data, &store(), &StoreName::from("secrets"))
+                .expect_err("should reject a missing configured secret");
+
+        assert!(err.to_string().contains("labeled.chosen.secret"));
+        assert_eq!(data, original, "should preserve unresolved data on failure");
+    }
+
     #[test]
     fn rejects_missing_required_path_without_secret_values() {
         for mut data in [
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 2f44734592..14439c1111 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -6,20 +6,22 @@ use regex::Regex;
 use serde::{Deserialize, Deserializer, Serialize, de::DeserializeOwned};
 use serde_json::Value as JsonValue;
 use sha2::{Digest as _, Sha256};
-use std::collections::{HashMap, HashSet};
+use std::borrow::Cow;
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::ops::{Deref, DerefMut};
 use std::str::FromStr;
 use std::sync::OnceLock;
 use std::time::Duration;
 use subtle::ConstantTimeEq as _;
 use url::Url;
-use validator::{Validate, ValidationError};
+use validator::{Validate, ValidationError, ValidationErrors, ValidationErrorsKind};
 
 use crate::auction_config_types::AuctionConfig;
 use crate::cache_policy::{CachePolicy, CacheVisibility};
 use crate::consent_config::ConsentConfig;
 use crate::constants::INTERNAL_HEADERS;
 use crate::creative_opportunities::CreativeOpportunitiesConfig;
+use crate::ec::module::{EcModuleSelection, HMAC_MODULE_KEY};
 use crate::error::TrustedServerError;
 use crate::host_header::validate_host_header_override_value;
 use crate::platform::PlatformImageOptimizerRegion;
@@ -543,12 +545,45 @@ impl EcPartner {
 ///
 /// Mapped from the `[ec]` TOML section. Controls EC identity generation,
 /// KV store names, and partner registry.
-#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
-#[serde(deny_unknown_fields)]
+///
+/// Every key in the section other than the fields below is one module's
+/// `[ec.<name>]` settings table, held in
+/// [`module_blocks`](Self::module_blocks), so the field names below are
+/// reserved and cannot name a module.
+#[derive(Debug, Default, Clone, Deserialize, Serialize)]
 pub struct Ec {
-    /// Publisher passphrase used as HMAC key for EC generation.
-    #[validate(custom(function = Ec::validate_passphrase))]
-    pub passphrase: Redacted<String>,
+    /// The name of the Edge Cookie identity module to activate.
+    ///
+    /// Set it in the `[ec]` TOML section, for example `"hmac"`. The name is
+    /// the module's implementation unless its `[ec.<name>]` block names a
+    /// different one, in which case the name is a label of the operator's
+    /// choosing (see [`module_blocks`](Self::module_blocks)). Deployment
+    /// tooling can merge a `TRUSTED_SERVER__EC__MODULE` environment value
+    /// into the published configuration before it is loaded, so the same
+    /// compiled WebAssembly can switch modules at deployment. The running
+    /// server reads its settings from the platform config store, not the
+    /// environment. When absent, no Edge Cookie is generated and Trusted
+    /// Server runs statelessly, and the explicit `"none"` spells the same
+    /// choice. A selection whose implementation needs settings it has no block
+    /// for is rejected at startup by
+    /// [`validate_module_selection`](Self::validate_module_selection).
+    ///
+    /// Typed as [`EcModuleSelection`], which reads and writes the same
+    /// string, so every check that asks which module is selected matches on
+    /// one vocabulary rather than comparing string literals.
+    #[serde(default)]
+    pub module: Option<EcModuleSelection>,
+
+    /// Deprecated location of the HMAC passphrase, read so a configuration
+    /// written for the previous release still starts.
+    ///
+    /// [`migrate_legacy_ec_layout`](Self::migrate_legacy_ec_layout) maps it
+    /// to `module = "hmac"` with the passphrase in the `[ec.hmac]` block and
+    /// logs a deprecation warning, so a fleet can move configuration and
+    /// binaries independently. A configuration carrying both the old and the
+    /// new form is rejected rather than guessed at.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub passphrase: Option<Redacted<String>>,
 
     /// Fastly KV store name for the EC identity graph.
     #[serde(default)]
@@ -574,8 +609,20 @@ pub struct Ec {
 
     /// Partners (SSPs, DSPs, identity vendors) for EC identity sync.
     #[serde(default, deserialize_with = "vec_from_seq_or_map")]
-    #[validate(nested)]
     pub partners: Vec<EcPartner>,
+
+    /// The settings tables of the Edge Cookie identity modules, keyed by the
+    /// name each is written under.
+    ///
+    /// A module has a block only when it has settings of its own, so
+    /// `[ec] module = "hmac"` needs an `[ec.hmac]` block for its required
+    /// passphrase while a module with no settings needs none. The
+    /// [`module`](Self::module) selector names the active module and
+    /// [`validate_module_selection`](Self::validate_module_selection)
+    /// rejects a block it does not name, so at most one block survives
+    /// startup.
+    #[serde(flatten)]
+    pub module_blocks: EcModuleBlocks,
 }
 
 impl Ec {
@@ -637,6 +684,468 @@ impl Ec {
         }
         Ok(())
     }
+
+    /// Validates the module selection against the configured blocks.
+    ///
+    /// When [`module`](Self::module) is set, the selection has to resolve
+    /// to an implementation this deployment can configure, and every block in
+    /// [`module_blocks`](Self::module_blocks) has to be the one the
+    /// selector names, so a deployment that selects a module (in TOML or via
+    /// the environment override) but has not configured it fails fast at
+    /// startup rather than silently running stateless. When no module is
+    /// selected, Trusted Server runs statelessly and this check passes.
+    ///
+    /// Whether the named implementation exists at all is settled by
+    /// [`build_module`](crate::ec::module::build_module), which is the
+    /// one place that knows both the implementations built into core and the
+    /// one this deployment's adapter injects.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when a module name or
+    /// implementation is not a module name, when a block is configured with no
+    /// selector or alongside `"none"`, when the selector names a key `[ec]`
+    /// reads as its own setting, when a block the selector does not name is
+    /// configured, or when the selected module resolves to an
+    /// implementation that needs settings and has no block.
+    pub fn validate_module_selection(&self) -> Result<(), Report<TrustedServerError>> {
+        for (name, block) in self.module_blocks.iter() {
+            Self::validate_module_name(name)?;
+            if let Some(implementation) = &block.implementation {
+                Self::validate_module_name(implementation)?;
+            }
+        }
+
+        let Some(selection) = self.module.as_ref() else {
+            if !self.module_blocks.is_empty() {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "[ec.<name>] module blocks are configured but no [ec] module \
+                              is selected. Set [ec] module = \"<name>\" to activate one, or \
+                              remove the blocks to run statelessly"
+                        .to_owned(),
+                }));
+            }
+            return Ok(());
+        };
+
+        // `"none"` is explicit statelessness, the same meaning as omitting the
+        // selector, spelled out. It is subject to the same rule that no
+        // module blocks may be left configured.
+        let EcModuleSelection::Named(name) = selection else {
+            if !self.module_blocks.is_empty() {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "[ec] module = \"none\" selects stateless operation, but \
+                              [ec.<name>] module blocks are configured. Remove the blocks, \
+                              or select the module they configure"
+                        .to_owned(),
+                }));
+            }
+            return Ok(());
+        };
+
+        let name = name.as_str();
+        Self::validate_module_name(name)?;
+        if EC_SECTION_KEYS.contains(&name) || name == REMOVED_EC_PROVIDERS_TABLE {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "[ec] module = \"{name}\" names a key the `[ec]` section reads as its \
+                     own setting, so no module can be configured under it. Give the \
+                     module a name of its own"
+                ),
+            }));
+        }
+
+        // A module has a block only when it has settings, and core knows
+        // which of its own implementations need them. A module an adapter
+        // injects has the contents of its block read by that adapter when it
+        // builds the module, so core cannot say whether it needs one.
+        if self.module_blocks.implementation(name) == HMAC_MODULE_KEY
+            && !self.module_blocks.contains_key(name)
+        {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "Edge Cookie module `{name}` is selected but has no `[ec.{name}]` configuration"
+                ),
+            }));
+        }
+
+        // Every configured block must be the selected one. An unreferenced
+        // block is almost always a mistake (a mistyped selector or a stale
+        // block), and accepting it silently invites configuration drift.
+        let unreferenced: Vec<&str> = self
+            .module_blocks
+            .keys()
+            .map(String::as_str)
+            .filter(|configured| *configured != name)
+            .collect();
+        if unreferenced.is_empty() {
+            Ok(())
+        } else {
+            Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "[ec.{}] is configured but `{name}` is selected. Remove the unselected \
+                     block, or correct the selector",
+                    unreferenced.join("], [ec.")
+                ),
+            }))
+        }
+    }
+
+    /// Validates one module name or implementation id.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when `name` is not a
+    /// module name, see [`crate::module_name::is_valid`].
+    fn validate_module_name(name: &str) -> Result<(), Report<TrustedServerError>> {
+        if crate::module_name::is_valid(name) {
+            return Ok(());
+        }
+        Err(Report::new(TrustedServerError::Configuration {
+            message: format!(
+                "Edge Cookie module name `{name}` is not a module name, which is parts \
+                 joined by `.`, each of lower case letters, digits, `_` or `-`"
+            ),
+        }))
+    }
+
+    /// Migrates the deprecated `[ec] passphrase` form to the module layout.
+    ///
+    /// A configuration still carrying the old key keeps working for one
+    /// release cycle, mapping to `module = "hmac"` with the passphrase in
+    /// the `[ec.hmac]` block, and a deprecation warning names the new
+    /// location. A configuration carrying both forms is rejected so a
+    /// half-edited file fails loudly instead of one form silently winning.
+    ///
+    /// The deprecated key is held to the same passphrase rules as the new
+    /// `[ec.hmac]` block. Validation runs before this migration and the
+    /// deprecated field carries no check of its own, so without the check here
+    /// a short or empty passphrase in the old location would start a
+    /// deployment that the new location rejects.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when both the deprecated
+    /// key and any part of the module configuration are present, or when the
+    /// deprecated passphrase fails [`Self::validate_passphrase`].
+    pub fn migrate_legacy_ec_layout(&mut self) -> Result<(), Report<TrustedServerError>> {
+        let Some(passphrase) = self.passphrase.take() else {
+            return Ok(());
+        };
+        if self.module.is_some() || !self.module_blocks.is_empty() {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: "[ec] passphrase (deprecated) and the [ec] module configuration \
+                          are both present. Keep exactly one form, moving the passphrase to \
+                          [ec.hmac] and deleting the old key"
+                    .to_owned(),
+            }));
+        }
+        Self::validate_passphrase(&passphrase).map_err(|err| {
+            Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "[ec] passphrase (deprecated) is invalid ({err}). Use a random secret \
+                     of at least {} bytes, placed in [ec.hmac]",
+                    Self::MIN_PASSPHRASE_LENGTH,
+                ),
+            })
+        })?;
+        log::warn!(
+            "[ec] passphrase is deprecated. Move it to [ec.hmac] passphrase and set \
+             [ec] module = \"hmac\""
+        );
+        self.module = Some(EcModuleSelection::from(HMAC_MODULE_KEY));
+        self.module_blocks.insert(
+            HMAC_MODULE_KEY.to_owned(),
+            EcModuleBlock::from(HmacModuleConfig { passphrase }),
+        );
+        Ok(())
+    }
+}
+
+impl Validate for Ec {
+    /// Validates the partner entries and the settings of every block that
+    /// configures the built-in HMAC module.
+    ///
+    /// Written out rather than derived because each block's errors are keyed
+    /// by the name the operator wrote the block under, so a passphrase
+    /// `[ec.primary]` rejects is reported at `ec.primary.passphrase`. A
+    /// derived nested validation would key them under this struct's own field
+    /// name, which is a path no configuration has.
+    fn validate(&self) -> Result<(), ValidationErrors> {
+        let mut errors = ValidationErrors::new();
+        errors.merge_self("partners", self.partners.validate());
+        for (name, config) in self.module_blocks.hmac_blocks() {
+            if let Err(block_errors) = config.validate() {
+                errors.errors_mut().insert(
+                    Cow::Owned(name.to_owned()),
+                    ValidationErrorsKind::Struct(Box::new(block_errors)),
+                );
+            }
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(errors)
+        }
+    }
+}
+
+/// The keys the `[ec]` section reads as its own settings.
+///
+/// Every other key in the section is one module's `[ec.<name>]` settings
+/// table, so these names are reserved and cannot name a module. They are
+/// written out because serde reads the [`Ec`] fields by name and has no way to
+/// report the list back for an error message.
+const EC_SECTION_KEYS: &[&str] = &[
+    "module",
+    "passphrase",
+    "ec_store",
+    "pull_sync_concurrency",
+    "cluster_trust_threshold",
+    "cluster_recheck_secs",
+    "partners",
+];
+
+/// The removed table that used to hold every module's settings.
+const REMOVED_EC_PROVIDERS_TABLE: &str = "providers";
+
+/// The key in a module block that names the implementation it configures.
+///
+/// Anything reading a module block out of a serialized configuration rather
+/// than out of [`EcModuleBlock`] reads the same key from here, so the two
+/// cannot drift apart.
+pub(crate) const MODULE_IMPLEMENTATION_KEY: &str = "implementation";
+
+/// The `[ec.<name>]` settings tables of the Edge Cookie identity modules,
+/// keyed by the name each is written under.
+///
+/// A module that has settings is configured in its own table, for example:
+///
+/// ```toml
+/// [ec]
+/// module = "hmac"
+///
+/// [ec.hmac]
+/// passphrase = "replace-with-32-plus-byte-random-secret"
+/// ```
+///
+/// A table may name the implementation it configures, which makes its own name
+/// a label of the operator's choosing, so the same configuration can also be
+/// written as:
+///
+/// ```toml
+/// [ec]
+/// module = "primary"
+///
+/// [ec.primary]
+/// implementation = "hmac"
+/// passphrase = "replace-with-32-plus-byte-random-secret"
+/// ```
+///
+/// The active module is chosen by the [`Ec::module`] selector, and the one
+/// table present must be the one it names (see
+/// [`Ec::validate_module_selection`]).
+#[derive(Debug, Default, Clone, Serialize)]
+#[serde(transparent)]
+pub struct EcModuleBlocks(BTreeMap<String, EcModuleBlock>);
+
+impl EcModuleBlocks {
+    /// The implementation the module `name` resolves to.
+    ///
+    /// A block may name the implementation it configures. Without one, and
+    /// when the module has no block at all, the module's name is its
+    /// implementation.
+    #[must_use]
+    pub fn implementation<'a>(&'a self, name: &'a str) -> &'a str {
+        self.0
+            .get(name)
+            .and_then(|block| block.implementation.as_deref())
+            .unwrap_or(name)
+    }
+
+    /// Every configured block that sets the built-in HMAC module up, with
+    /// the name it is written under.
+    ///
+    /// The name is the label the operator chose, so a caller reporting one of
+    /// these settings names the path the operator wrote rather than the
+    /// implementation's own.
+    pub fn hmac_blocks(&self) -> impl Iterator<Item = (&str, &HmacModuleConfig)> {
+        self.0
+            .iter()
+            .filter_map(|(name, block)| block.hmac_settings().map(|config| (name.as_str(), config)))
+    }
+}
+
+impl Deref for EcModuleBlocks {
+    type Target = BTreeMap<String, EcModuleBlock>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl DerefMut for EcModuleBlocks {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+impl<'de> Deserialize<'de> for EcModuleBlocks {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        struct BlocksVisitor;
+
+        impl<'de> serde::de::Visitor<'de> for BlocksVisitor {
+            type Value = EcModuleBlocks;
+
+            fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                formatter.write_str("the `[ec.<name>]` module settings tables")
+            }
+
+            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
+            where
+                A: serde::de::MapAccess<'de>,
+            {
+                let mut blocks = BTreeMap::new();
+                while let Some(name) = map.next_key::<String>()? {
+                    let table = map.next_value::<JsonValue>()?;
+                    blocks.insert(name.clone(), read_module_block::<A::Error>(&name, table)?);
+                }
+                Ok(EcModuleBlocks(blocks))
+            }
+        }
+
+        deserializer.deserialize_map(BlocksVisitor)
+    }
+}
+
+/// Reads one key left over from the `[ec]` section as the module block it
+/// names.
+///
+/// This is where the `[ec]` section gets the unknown-key check that the fixed
+/// fields lose by holding the module blocks alongside them. A key that is
+/// not a table cannot be a module, so it is reported as the mistyped setting
+/// it almost certainly is.
+fn read_module_block<E>(name: &str, table: JsonValue) -> Result<EcModuleBlock, E>
+where
+    E: serde::de::Error,
+{
+    if name == REMOVED_EC_PROVIDERS_TABLE {
+        return Err(E::custom(
+            "[ec.providers] is no longer read. Each module's settings moved to a table of \
+             its own under [ec], so a block written as [ec.providers.hmac] is now [ec.hmac]",
+        ));
+    }
+    let JsonValue::Object(mut table) = table else {
+        let known = EC_SECTION_KEYS
+            .iter()
+            .map(|key| format!("`{key}`"))
+            .collect::<Vec<_>>()
+            .join(", ");
+        return Err(E::custom(format!(
+            "unknown field `{name}`, expected one of {known}, or an [ec.<name>] module \
+             settings table"
+        )));
+    };
+    let implementation = match table.remove(MODULE_IMPLEMENTATION_KEY) {
+        None => None,
+        Some(JsonValue::String(implementation)) => Some(implementation),
+        Some(_) => {
+            return Err(E::custom(format!(
+                "`implementation` in [ec.{name}] must be a string naming the module \
+                 implementation the block configures"
+            )));
+        }
+    };
+
+    // The implementation decides how the rest of the table is read. Core reads
+    // its own modules' settings here, so a mistyped key fails where the
+    // configuration is read rather than at the request that needed it, and
+    // keeps the settings of a module an adapter injects as the raw values
+    // that adapter deserializes for itself.
+    let settings = if implementation.as_deref().unwrap_or(name) == HMAC_MODULE_KEY {
+        let config = serde_json::from_value(JsonValue::Object(table))
+            .map_err(|err| E::custom(format!("[ec.{name}] is invalid ({err})")))?;
+        EcModuleSettings::Hmac(config)
+    } else {
+        EcModuleSettings::Injected(table)
+    };
+    Ok(EcModuleBlock {
+        implementation,
+        settings,
+    })
+}
+
+/// One module's `[ec.<name>]` settings table.
+#[derive(Debug, Clone, Serialize)]
+pub struct EcModuleBlock {
+    /// The implementation this block configures, written as
+    /// `implementation = "<id>"`, when the block's own name is not it.
+    ///
+    /// Setting it makes the block name a label of the operator's choosing, so
+    /// one implementation can be configured under any name. Everything that
+    /// resolves the selected module reads the implementation rather than the
+    /// label.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub implementation: Option<String>,
+
+    /// Everything the block holds other than `implementation`.
+    #[serde(flatten)]
+    pub settings: EcModuleSettings,
+}
+
+impl EcModuleBlock {
+    /// The built-in HMAC module's settings, when this block configures it.
+    #[must_use]
+    pub fn hmac_settings(&self) -> Option<&HmacModuleConfig> {
+        match &self.settings {
+            EcModuleSettings::Hmac(config) => Some(config),
+            EcModuleSettings::Injected(_) => None,
+        }
+    }
+}
+
+impl From<HmacModuleConfig> for EcModuleBlock {
+    /// Builds the `[ec.hmac]` block, the built-in HMAC module configured
+    /// under its own name. A block under a label names its implementation
+    /// instead.
+    fn from(config: HmacModuleConfig) -> Self {
+        Self {
+            implementation: None,
+            settings: EcModuleSettings::Hmac(config),
+        }
+    }
+}
+
+/// The settings one module block holds, read according to the
+/// implementation the block configures.
+#[derive(Debug, Clone, Serialize)]
+#[serde(untagged)]
+pub enum EcModuleSettings {
+    /// The built-in HMAC module's settings.
+    Hmac(HmacModuleConfig),
+
+    /// The settings of a module an adapter injects, kept as the raw values
+    /// the block held. The adapter that builds the module deserializes them
+    /// into the vendor crate's own config type, so core never names a vendor
+    /// and a new module adds nothing here.
+    Injected(serde_json::Map<String, JsonValue>),
+}
+
+/// Configuration for the built-in HMAC Edge Cookie module.
+///
+/// Mapped from the `[ec.hmac]` TOML block, or from a block under a label whose
+/// `implementation` is `hmac`. Unknown keys are rejected, so a mistyped
+/// setting fails at startup instead of being accepted silently and leaving the
+/// intended setting at its default.
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
+#[serde(deny_unknown_fields)]
+pub struct HmacModuleConfig {
+    /// Publisher passphrase used as the HMAC key for EC generation.
+    #[validate(custom(function = Ec::validate_passphrase))]
+    pub passphrase: Redacted<String>,
 }
 
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
@@ -3122,6 +3631,8 @@ impl Settings {
             })
         })?;
 
+        settings.ec.migrate_legacy_ec_layout()?;
+        settings.ec.validate_module_selection()?;
         settings.validate_admin_coverage()?;
         settings.validate_admin_handler_passwords()?;
 
@@ -3206,8 +3717,10 @@ impl Settings {
     pub fn reject_placeholder_secrets(&self) -> Result<(), Report<TrustedServerError>> {
         let mut insecure_fields: Vec<String> = Vec::new();
 
-        if Ec::is_placeholder_passphrase(self.ec.passphrase.expose()) {
-            insecure_fields.push("ec.passphrase".to_owned());
+        for (name, hmac) in self.ec.module_blocks.hmac_blocks() {
+            if Ec::is_placeholder_passphrase(hmac.passphrase.expose()) {
+                insecure_fields.push(format!("ec.{name}.passphrase"));
+            }
         }
         if Publisher::is_placeholder_proxy_secret(self.publisher.proxy_secret.expose()) {
             insecure_fields.push("publisher.proxy_secret".to_owned());
@@ -3891,7 +4404,10 @@ mod tests {
         prebid::PrebidIntegrationConfig,
     };
     use crate::redacted::Redacted;
-    use crate::test_support::tests::{crate_test_settings_str, create_test_settings};
+    use crate::test_support::tests::{
+        crate_test_settings_str, crate_test_settings_str_with_ec_section, create_test_settings,
+        hmac_passphrase, select_hmac_module,
+    };
 
     fn trusted_client_ip_toml(ip_header: &str, auth_header: &str, shared_secret: &str) -> String {
         format!(
@@ -4041,7 +4557,7 @@ mod tests {
         let mut settings = create_test_settings();
 
         settings.publisher.proxy_secret = Redacted::new(CANARY_PROXY_SECRET.to_string());
-        settings.ec.passphrase = Redacted::new(CANARY_EC_PASSPHRASE.to_string());
+        select_hmac_module(&mut settings.ec, HMAC_MODULE_KEY, CANARY_EC_PASSPHRASE);
 
         settings.handlers = vec![Handler {
             path: "^/secure".to_string(),
@@ -4123,7 +4639,7 @@ mod tests {
 
         let canaries = [
             ("publisher.proxy_secret", CANARY_PROXY_SECRET),
-            ("ec.passphrase", CANARY_EC_PASSPHRASE),
+            ("ec.hmac.passphrase", CANARY_EC_PASSPHRASE),
             ("handlers[].username", CANARY_HANDLER_USERNAME),
             ("handlers[].password", CANARY_HANDLER_PASSWORD),
             ("ec.partners[].api_token", CANARY_EC_PARTNER_API_TOKEN),
@@ -4908,7 +5424,12 @@ mod tests {
         );
         assert_eq!(settings.publisher.origin_host_header_override, None);
         assert_eq!(
-            settings.ec.passphrase.expose(),
+            settings.ec.module.as_ref(),
+            Some(&EcModuleSelection::from(HMAC_MODULE_KEY)),
+            "test settings should select the hmac EC module"
+        );
+        assert_eq!(
+            hmac_passphrase(&settings.ec, HMAC_MODULE_KEY),
             "test-secret-key-32-bytes-minimum"
         );
 
@@ -5136,6 +5657,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn module_selection_allows_no_module_for_stateless_operation() {
+        let ec = Ec::default();
+        assert!(ec.module.is_none(), "default Ec selects no module");
+        ec.validate_module_selection()
+            .expect("should allow no module selected and run statelessly");
+    }
+
+    #[test]
+    fn selecting_an_implementation_that_needs_settings_without_its_block_is_rejected() {
+        // The built-in HMAC module has a required passphrase, so selecting
+        // it with no `[ec.hmac]` block is a deployment that would run
+        // stateless under a selector saying otherwise.
+        let toml_str = crate_test_settings_str_with_ec_section("[ec]\nmodule = \"hmac\"\n");
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("an implementation with no settings block should fail at startup");
+        assert!(
+            format!("{err:?}").contains("`hmac` is selected but has no `[ec.hmac]` configuration"),
+            "should name the missing block: {err:?}"
+        );
+    }
+
+    #[test]
+    fn selecting_a_module_with_no_settings_needs_no_block() {
+        // A block exists only when a module has settings, and only the
+        // adapter that injects a module knows whether it has any, so a
+        // selector naming one core does not supply is left to
+        // `build_module`, which is where the injected modules are known.
+        let toml_str = crate_test_settings_str_with_ec_section("[ec]\nmodule = \"acme\"\n");
+
+        let settings =
+            Settings::from_toml(&toml_str).expect("a module with no settings should need no block");
+        assert!(
+            settings.ec.module_blocks.is_empty(),
+            "the selection should stand on its own with no block configured"
+        );
+    }
+
     #[test]
     fn cache_asset_rule_globs_respect_path_separators() {
         let toml_str = format!(
@@ -5242,6 +5802,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn module_blocks_without_a_selector_are_rejected() {
+        // A half-migrated configuration that carries an [ec.hmac] block but
+        // never selects it would silently run stateless, so it is rejected at
+        // startup instead.
+        let toml_str = crate_test_settings_str().replace("module = \"hmac\"\n", "");
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a module block with no selector should fail at startup");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
     #[test]
     fn cache_asset_rule_policy_validation_rejects_unsafe_config() {
         let missing_ttl = format!(
@@ -5355,6 +5934,78 @@ mod tests {
         );
     }
 
+    #[test]
+    fn legacy_passphrase_migrates_to_the_hmac_module() {
+        let mut ec = Ec {
+            passphrase: Some(Redacted::new("test-secret-key-32-bytes-minimum".to_owned())),
+            ..Ec::default()
+        };
+        ec.migrate_legacy_ec_layout()
+            .expect("should migrate the deprecated form");
+        assert_eq!(
+            ec.module.as_ref(),
+            Some(&EcModuleSelection::from(HMAC_MODULE_KEY)),
+            "the deprecated passphrase should select the hmac module"
+        );
+        assert_eq!(
+            hmac_passphrase(&ec, HMAC_MODULE_KEY),
+            "test-secret-key-32-bytes-minimum",
+            "the passphrase should move into the hmac block"
+        );
+        assert!(
+            ec.passphrase.is_none(),
+            "the deprecated field should be consumed by the migration"
+        );
+    }
+
+    /// The crate test configuration with its `[ec]` section rewritten to the
+    /// deprecated single-passphrase form.
+    fn legacy_ec_settings_str(passphrase: &str) -> String {
+        let legacy = crate_test_settings_str_with_ec_section(&format!(
+            "[ec]\npassphrase = \"{passphrase}\"\n"
+        ));
+        assert!(
+            !legacy.contains("[ec.hmac]"),
+            "the legacy configuration should carry no module block"
+        );
+        legacy
+    }
+
+    #[test]
+    fn a_legacy_passphrase_is_held_to_the_passphrase_rules() {
+        // Validation runs before the migration and the deprecated field
+        // carries no check of its own, so the migration itself has to apply
+        // the passphrase rules. Without that, a value the new `[ec.hmac]`
+        // block rejects would still start a deployment from the old location.
+        let short = Settings::from_toml(&legacy_ec_settings_str("short"))
+            .expect_err("a short legacy passphrase should be rejected");
+        assert!(
+            format!("{short:?}").contains("passphrase (deprecated) is invalid"),
+            "should name the deprecated passphrase as the fault: {short:?}"
+        );
+
+        let empty = Settings::from_toml(&legacy_ec_settings_str(""))
+            .expect_err("an empty legacy passphrase should be rejected");
+        assert!(
+            format!("{empty:?}").contains("passphrase (deprecated) is invalid"),
+            "should name the deprecated passphrase as the fault: {empty:?}"
+        );
+
+        let settings =
+            Settings::from_toml(&legacy_ec_settings_str("test-secret-key-32-bytes-minimum"))
+                .expect("a legacy passphrase of adequate length should still start");
+        assert_eq!(
+            settings.ec.module.as_ref(),
+            Some(&EcModuleSelection::from(HMAC_MODULE_KEY)),
+            "an adequate legacy passphrase should still select the hmac module"
+        );
+        assert_eq!(
+            hmac_passphrase(&settings.ec, HMAC_MODULE_KEY),
+            "test-secret-key-32-bytes-minimum",
+            "an adequate legacy passphrase should still move into the hmac block"
+        );
+    }
+
     #[test]
     fn cache_asset_rule_validation_rejects_invalid_config() {
         let duplicate_ids = format!(
@@ -5432,6 +6083,287 @@ mod tests {
         );
     }
 
+    #[test]
+    fn legacy_passphrase_alongside_module_config_is_rejected() {
+        let mut ec = Ec {
+            passphrase: Some(Redacted::new("test-secret-key-32-bytes-minimum".to_owned())),
+            module: Some(EcModuleSelection::from(HMAC_MODULE_KEY)),
+            ..Ec::default()
+        };
+        let err = ec
+            .migrate_legacy_ec_layout()
+            .expect_err("both forms present should be rejected");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
+    #[test]
+    fn an_unknown_key_in_the_hmac_module_block_is_rejected() {
+        // A mistyped key dropped silently would leave the setting the
+        // operator meant to change at its default.
+        let toml_str = crate_test_settings_str().replace(
+            "passphrase = \"test-secret-key-32-bytes-minimum\"",
+            "passphrase = \"test-secret-key-32-bytes-minimum\"\n            typo_key = \"x\"",
+        );
+        assert!(
+            toml_str.contains("typo_key"),
+            "the test configuration should carry the unknown key"
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("an unknown key in [ec.hmac] should be rejected");
+        assert!(
+            format!("{err:?}").contains("typo_key"),
+            "should name the unknown key: {err:?}"
+        );
+    }
+
+    #[test]
+    fn module_none_is_explicit_stateless() {
+        let ec = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        ec.validate_module_selection()
+            .expect("explicit none with no blocks should be valid");
+    }
+
+    #[test]
+    fn module_none_with_configured_blocks_is_rejected() {
+        let mut ec = Ec::default();
+        select_hmac_module(&mut ec, HMAC_MODULE_KEY, "test-secret-key-32-bytes-minimum");
+        ec.module = Some(EcModuleSelection::None);
+        assert!(
+            ec.validate_module_selection().is_err(),
+            "none alongside configured blocks should be rejected"
+        );
+    }
+
+    #[test]
+    fn an_unselected_module_block_is_rejected() {
+        // A vendor selector with the vendor block present, plus a stray hmac
+        // block, is almost always a stale or mistyped configuration.
+        let toml_str = crate_test_settings_str().replace(
+            "module = \"hmac\"",
+            "module = \"acme\"\n\n            [ec.acme]\n            api_key = \"example\"",
+        );
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a configured but unselected block should fail at startup");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
+    #[test]
+    fn a_labeled_block_the_selector_does_not_name_is_rejected() {
+        // A block under a label is still a module block, so it is held to
+        // the rule every block is held to, which is that the selector names
+        // it.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            r#"[ec]
+module = "hmac"
+
+[ec.hmac]
+passphrase = "test-secret-key-32-bytes-minimum"
+
+[ec.primary]
+implementation = "hmac"
+passphrase = "another-test-secret-key-32-bytes"
+"#,
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a labeled block the selector does not name should fail at startup");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("[ec.primary] is configured but `hmac` is selected"),
+            "should name the unselected labeled block, got: {message}"
+        );
+    }
+
+    #[test]
+    fn the_removed_providers_table_is_rejected_with_its_new_location() {
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"hmac\"\n\n[ec.providers.hmac]\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("the removed [ec.providers] table should be rejected");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("[ec.providers] is no longer read") && message.contains("[ec.hmac]"),
+            "should send the operator to the new location, got: {message}"
+        );
+    }
+
+    #[test]
+    fn a_key_under_ec_that_is_not_a_table_is_an_unknown_field() {
+        // Holding the module blocks alongside the fixed keys costs the
+        // section serde's own unknown-key check, so a mistyped setting has to
+        // be caught where the blocks are read.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"hmac\"\nec_stor = \"ec_identity_store\"\n\n[ec.hmac]\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        );
+
+        let err =
+            Settings::from_toml(&toml_str).expect_err("a mistyped [ec] key should be rejected");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("unknown field `ec_stor`") && message.contains("`ec_store`"),
+            "should name the mistyped key and the keys it could have been, got: {message}"
+        );
+    }
+
+    #[test]
+    fn the_reserved_ec_keys_are_the_ones_the_section_reads() {
+        // The list is written out for the unknown-field message and the
+        // reserved-name check, so it has to stay level with the struct.
+        let ec = Ec {
+            passphrase: Some(Redacted::new("test-secret-key-32-bytes-minimum".to_owned())),
+            ..Ec::default()
+        };
+        let value = serde_json::to_value(&ec).expect("should serialize the [ec] section");
+        let written = value
+            .as_object()
+            .expect("the section should serialize as a table")
+            .keys()
+            .map(String::as_str)
+            .collect::<HashSet<_>>();
+
+        assert_eq!(
+            written,
+            EC_SECTION_KEYS.iter().copied().collect::<HashSet<_>>(),
+            "EC_SECTION_KEYS should name every key the [ec] section reads as its own"
+        );
+    }
+
+    #[test]
+    fn a_reserved_key_cannot_name_a_module() {
+        let toml_str = crate_test_settings_str_with_ec_section("[ec]\nmodule = \"ec_store\"\n");
+
+        let err =
+            Settings::from_toml(&toml_str).expect_err("a reserved key should not name a module");
+        assert!(
+            format!("{err:?}").contains("names a key the `[ec]` section reads as its own setting"),
+            "should say why the name cannot be used: {err:?}"
+        );
+    }
+
+    #[test]
+    fn module_names_and_implementations_follow_the_module_name_rule() {
+        for ec_section in [
+            "[ec]\nmodule = \"Primary\"\n",
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"Hmac\"\n",
+            "[ec]\nmodule = \"primary\"\n\n[ec.Primary]\nimplementation = \"hmac\"\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        ] {
+            let err = Settings::from_toml(&crate_test_settings_str_with_ec_section(ec_section))
+                .expect_err("a name that is not a module name should be rejected");
+            assert!(
+                format!("{err:?}").contains("is not a module name"),
+                "should hold `{ec_section}` to the module name rule: {err:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_hmac_block_without_its_passphrase_names_the_block() {
+        // The implementation the block names decides how its settings are
+        // read, so the block the operator wrote is what the error names.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"hmac\"\n",
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("an hmac block without its passphrase should be rejected");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("[ec.primary] is invalid") && message.contains("passphrase"),
+            "should name the block and the setting it lacks, got: {message}"
+        );
+    }
+
+    #[test]
+    fn a_labeled_block_round_trips_through_serialization() {
+        // The pushed configuration is the serialized settings, so a label and
+        // the implementation it names have to survive being written back.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"hmac\"\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        );
+        let settings = Settings::from_toml(&toml_str).expect("should parse a labeled module block");
+
+        let value = serde_json::to_value(&settings).expect("should serialize settings");
+        assert_eq!(
+            value["ec"]["primary"]["implementation"], "hmac",
+            "the label should keep the implementation it names"
+        );
+
+        let reparsed =
+            Settings::from_json_value(value).expect("should reparse the serialized settings");
+        assert_eq!(
+            reparsed.ec.module_blocks.implementation("primary"),
+            HMAC_MODULE_KEY,
+            "the implementation should survive the round trip"
+        );
+        assert_eq!(
+            hmac_passphrase(&reparsed.ec, "primary"),
+            "test-secret-key-32-bytes-minimum"
+        );
+
+        // A block under the implementation's own name is written back as it
+        // was, without gaining a key the operator never wrote.
+        let written = serde_json::to_value(create_test_settings())
+            .expect("should serialize the test settings");
+        assert!(
+            written["ec"]["hmac"].get("implementation").is_none(),
+            "an unlabeled block should not gain an implementation key: {}",
+            written["ec"]["hmac"]
+        );
+    }
+
+    #[test]
+    fn an_injected_modules_settings_are_kept_as_written() {
+        // Core never names a vendor, so the block of a module an adapter
+        // injects is kept as the values it held for that adapter to read.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"acme\"\n\n[ec.acme]\nendpoint = \"https://ec.acme.example.com\"\n",
+        );
+        let settings = Settings::from_toml(&toml_str).expect("should parse a vendor module block");
+
+        let block = settings
+            .ec
+            .module_blocks
+            .get("acme")
+            .expect("should configure the acme block");
+        assert_eq!(
+            settings.ec.module_blocks.implementation("acme"),
+            "acme",
+            "a block that names no implementation is its own name's"
+        );
+        let EcModuleSettings::Injected(injected) = &block.settings else {
+            panic!("a vendor block should keep its settings as the raw values it held");
+        };
+        assert_eq!(injected["endpoint"], "https://ec.acme.example.com");
+
+        // They survive being written back into the pushed configuration, so
+        // the adapter reads what the operator wrote.
+        let written = serde_json::to_value(&settings).expect("should serialize settings");
+        assert_eq!(
+            written["ec"]["acme"]["endpoint"],
+            "https://ec.acme.example.com"
+        );
+    }
+
     #[test]
     fn validate_rejects_trailing_slash_in_origin_url() {
         let toml_str = crate_test_settings_str().replace(
@@ -5844,7 +6776,11 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
+        select_hmac_module(
+            &mut settings.ec,
+            HMAC_MODULE_KEY,
+            "test-secret-key-32-bytes-minimum",
+        );
         settings.handlers[0].password =
             Redacted::new("replace-with-admin-password-32-bytes".to_owned());
 
@@ -5883,7 +6819,6 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
         settings.ec.partners = vec![test_partner_with_pull_token(
             "partner-api-token-32-bytes-minimum",
         )];
@@ -5902,7 +6837,6 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
         settings.ec.partners = vec![test_partner_with_pull_token(
             "unit-test-realistic-pull-sync-token-32-bytes-min",
         )];
@@ -5917,7 +6851,6 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
         settings.ec.partners = vec![test_partner_with_tokens(
             Some("partner-api-token-32-bytes-minimum"),
             "replace-with-partner-api-token-32-bytes-minimum",
@@ -6501,6 +7434,9 @@ source_domain = "partner.example.com"
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -6532,6 +7468,9 @@ source_domain = "partner.example.com"
             max_buffered_body_bytes = 0
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         );
@@ -7908,6 +8847,9 @@ source_domain = "partner.example.com"
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -8243,6 +9185,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -8327,6 +9272,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -8363,6 +9311,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -8405,6 +9356,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
diff --git a/crates/trusted-server-core/src/streaming_replacer.rs b/crates/trusted-server-core/src/streaming_replacer.rs
index f9a3caac46..a457d220cd 100644
--- a/crates/trusted-server-core/src/streaming_replacer.rs
+++ b/crates/trusted-server-core/src/streaming_replacer.rs
@@ -16,6 +16,9 @@ pub struct Replacement {
 }
 
 /// A generic streaming replacer that processes content in chunks
+///
+/// The replacements are made in one pass, so what a replacement writes is
+/// never matched again.
 pub struct StreamingReplacer {
     /// List of replacements to apply
     pub replacements: Vec<Replacement>,
@@ -117,12 +120,7 @@ impl StreamingReplacer {
             // Check if this is a valid UTF-8 boundary
             if let Ok(s) = std::str::from_utf8(&combined[..adjusted_end_bytes]) {
                 // Valid UTF-8 up to this point, process it
-                let mut processed = s.to_owned();
-
-                // Apply all replacements
-                for replacement in &self.replacements {
-                    processed = processed.replace(&replacement.find, &replacement.replace_with);
-                }
+                let processed = replace_each_once(s, &self.replacements);
 
                 // Save the overlap for the next chunk
                 if is_last_chunk {
@@ -147,11 +145,60 @@ impl StreamingReplacer {
     }
 }
 
+/// `text` with each occurrence of a replacement's `find` written as its
+/// `replace_with`, in one pass from the start, so no replacement is read
+/// again.
+///
+/// The earliest match is taken each time, and the longer of two that start at
+/// the same place. A replacement with an empty `find` is ignored. Each
+/// replacement's next match is kept until the pass moves beyond it, so the
+/// text is searched once for each replacement however many matches it holds.
+fn replace_each_once(text: &str, replacements: &[Replacement]) -> String {
+    let find_from = |replacement: &Replacement, from: usize| {
+        if replacement.find.is_empty() {
+            return None;
+        }
+        text[from..]
+            .find(replacement.find.as_str())
+            .map(|at| from + at)
+    };
+    // Where each replacement next matches, at or after `done`.
+    let mut next_match: Vec<Option<usize>> = replacements
+        .iter()
+        .map(|replacement| find_from(replacement, 0))
+        .collect();
+    let mut out = String::with_capacity(text.len());
+    let mut done = 0;
+    while let Some((at, replacement)) = next_match
+        .iter()
+        .zip(replacements)
+        .filter_map(|(at, replacement)| at.map(|at| (at, replacement)))
+        .min_by(|a, b| {
+            a.0.cmp(&b.0)
+                .then_with(|| b.1.find.len().cmp(&a.1.find.len()))
+        })
+    {
+        out.push_str(&text[done..at]);
+        out.push_str(&replacement.replace_with);
+        done = at + replacement.find.len();
+        for (start, each) in next_match.iter_mut().zip(replacements) {
+            if start.is_some_and(|start| start < done) {
+                *start = find_from(each, done);
+            }
+        }
+    }
+    out.push_str(&text[done..]);
+    out
+}
+
 // Note: The stream_process function has been removed in favor of using
 // `StreamingPipeline` from the `streaming_processor` module, which provides
 // a more comprehensive solution with compression support.
 
 /// Helper function to create a `StreamingReplacer` for URL replacements
+///
+/// Each of the origin's addresses is written once, so a request host that
+/// contains the origin host is not matched again inside its replacement.
 #[must_use]
 pub fn create_url_replacer(
     origin_host: &str,
@@ -401,6 +448,96 @@ mod tests {
         assert!(result.contains("//test.example.com/script.js"));
     }
 
+    /// A request host that begins with the origin host, as a local host named
+    /// after the publisher does, is written once in every address over either
+    /// scheme, in one chunk or in many, rather than matched again inside its
+    /// own replacement.
+    #[test]
+    fn a_request_host_that_begins_with_the_origin_host_is_written_once() {
+        let content = r#"{"a":"https://publisher.example/news","b":"http://publisher.example/old","c":"//publisher.example/c.png","d":"publisher.example/bare"}"#;
+
+        for scheme in ["http", "https"] {
+            let expected = format!(
+                r#"{{"a":"{scheme}://publisher.example.localhost/news","b":"{scheme}://publisher.example.localhost/old","c":"//publisher.example.localhost/c.png","d":"publisher.example.localhost/bare"}}"#
+            );
+            for chunk_size in [content.len(), 7] {
+                let replacer = create_url_replacer(
+                    "publisher.example",
+                    "https://publisher.example",
+                    "publisher.example.localhost",
+                    scheme,
+                );
+
+                assert_eq!(
+                    process_with_fixed_chunk_size(replacer, content.as_bytes(), chunk_size),
+                    expected,
+                    "should write the request host once over {scheme} in chunks of {chunk_size}"
+                );
+            }
+        }
+    }
+
+    /// Hosts that do not begin with the origin host are written as before,
+    /// both one with no part of the origin host in it and a `www.` host in
+    /// front of an apex origin, whose addresses must not become `www.www.`.
+    #[test]
+    fn a_request_host_that_does_not_begin_with_the_origin_host_is_written_as_before() {
+        for (origin, request) in [
+            ("publisher.example", "publisher-example.localhost"),
+            ("example.com", "www.example.com"),
+        ] {
+            let mut replacer =
+                create_url_replacer(origin, &format!("https://{origin}"), request, "https");
+            let content = format!(
+                r#"{{"a":"https://{origin}/a","b":"http://{origin}/b","c":"//{origin}/c.png","d":"{origin}/d"}}"#
+            );
+
+            let processed = replacer.process_chunk(content.as_bytes(), true);
+
+            assert_eq!(
+                String::from_utf8(processed).expect("output should be valid UTF-8"),
+                format!(
+                    r#"{{"a":"https://{request}/a","b":"https://{request}/b","c":"//{request}/c.png","d":"{request}/d"}}"#
+                ),
+                "should write {request} once for {origin}"
+            );
+        }
+    }
+
+    #[test]
+    fn each_replacement_is_made_once_from_the_start() {
+        let replacements = [
+            ("https://a.example", "http://a.example.localhost"),
+            ("http://a.example", "http://a.example.localhost"),
+            ("//a.example", "//a.example.localhost"),
+            ("a.example", "a.example.localhost"),
+            ("", "never"),
+        ]
+        .map(|(find, replace_with)| Replacement {
+            find: find.to_owned(),
+            replace_with: replace_with.to_owned(),
+        });
+
+        assert_eq!(
+            replace_each_once(
+                "https://a.example/1 http://a.example/2 //a.example/3 a.example/4",
+                &replacements
+            ),
+            "http://a.example.localhost/1 http://a.example.localhost/2 //a.example.localhost/3 a.example.localhost/4"
+        );
+        let reversed: Vec<Replacement> = replacements.iter().rev().cloned().collect();
+        assert_eq!(
+            replace_each_once("https://a.example/1 a.example/4", &reversed),
+            "http://a.example.localhost/1 a.example.localhost/4",
+            "should take the earliest match whatever the order of the list"
+        );
+        assert_eq!(
+            replace_each_once("nothing here", &replacements),
+            "nothing here"
+        );
+        assert_eq!(replace_each_once("", &replacements), "");
+    }
+
     #[test]
     fn test_process_chunk_utf8_boundary_cases() {
         struct Utf8BoundaryCase<'a> {
@@ -536,7 +673,7 @@ mod tests {
 
     #[test]
     fn test_pattern_priority() {
-        // Test that longer patterns are replaced first (order matters)
+        // The longer of two patterns that start at the same place is replaced
         let replacements = vec![
             Replacement {
                 find: "hello world".to_owned(),
@@ -554,7 +691,7 @@ mod tests {
         let processed = replacer.process_chunk(input, true);
         let result = String::from_utf8(processed).expect("output should be valid UTF-8");
 
-        // Note: Since we apply replacements in order, "hello world" gets replaced first
+        // "hello world" and "hello" start at the same place, so the longer is taken
         assert_eq!(result, "Say greetings universe and hi there!");
     }
 
@@ -578,7 +715,7 @@ mod tests {
         let processed = replacer.process_chunk(input, true);
         let result = String::from_utf8(processed).expect("output should be valid UTF-8");
 
-        // "abc" gets replaced first, so "bcd" is no longer found
+        // "abc" starts first, so "bcd", which overlaps it, is not replaced
         assert_eq!(result, "xyzdef");
     }
 
diff --git a/crates/trusted-server-core/src/test_support.rs b/crates/trusted-server-core/src/test_support.rs
index 37b8a9e657..f07a2ff4ea 100644
--- a/crates/trusted-server-core/src/test_support.rs
+++ b/crates/trusted-server-core/src/test_support.rs
@@ -2,7 +2,9 @@
 pub mod tests {
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource, TcfConsent};
-    use crate::settings::Settings;
+    use crate::ec::module::{EcModuleSelection, HMAC_MODULE_KEY};
+    use crate::redacted::Redacted;
+    use crate::settings::{Ec, EcModuleBlock, HmacModuleConfig, Settings};
 
     #[must_use]
     pub fn crate_test_settings_str() -> String {
@@ -35,7 +37,11 @@ pub mod tests {
             rewrite_attributes = ["href", "link", "url"]
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
+
             [request_signing]
             config_store_id = "test-config-store-id"
             secret_store_id = "test-secret-store-id"
@@ -43,6 +49,26 @@ pub mod tests {
         .to_owned()
     }
 
+    /// The crate test configuration with its whole `[ec]` section replaced by
+    /// `ec_section`, which carries its own `[ec]` header and any module
+    /// blocks.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the embedded TOML configuration no longer has an `[ec]`
+    /// section followed by a `[request_signing]` section.
+    #[must_use]
+    pub fn crate_test_settings_str_with_ec_section(ec_section: &str) -> String {
+        let base = crate_test_settings_str();
+        let (before, rest) = base
+            .split_once("[ec]")
+            .expect("should find the [ec] section in the test settings");
+        let (_, after) = rest
+            .split_once("[request_signing]")
+            .expect("should find the [request_signing] section in the test settings");
+        format!("{before}{ec_section}\n\n[request_signing]{after}")
+    }
+
     #[must_use]
     /// Creates test settings from embedded TOML configuration.
     ///
@@ -56,6 +82,39 @@ pub mod tests {
         settings
     }
 
+    /// Selects the built-in HMAC module under `name` with `passphrase`,
+    /// replacing whatever Edge Cookie module the settings carried.
+    ///
+    /// A `name` other than `hmac` is a label, so the block names the
+    /// implementation it configures.
+    pub fn select_hmac_module(ec: &mut Ec, name: &str, passphrase: &str) {
+        let mut block = EcModuleBlock::from(HmacModuleConfig {
+            passphrase: Redacted::new(passphrase.to_owned()),
+        });
+        if name != HMAC_MODULE_KEY {
+            block.implementation = Some(HMAC_MODULE_KEY.to_owned());
+        }
+        ec.module = Some(EcModuleSelection::from(name));
+        ec.module_blocks.clear();
+        ec.module_blocks.insert(name.to_owned(), block);
+    }
+
+    /// The passphrase the block `name` holds.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `name` has no block, or if its block configures another
+    /// module.
+    #[must_use]
+    pub fn hmac_passphrase<'a>(ec: &'a Ec, name: &str) -> &'a str {
+        ec.module_blocks
+            .get(name)
+            .and_then(EcModuleBlock::hmac_settings)
+            .unwrap_or_else(|| panic!("settings should configure the hmac module under `{name}`"))
+            .passphrase
+            .expose()
+    }
+
     /// A valid EC ID in `{64-hex}.{6-alnum}` format for use in tests.
     pub const VALID_SYNTHETIC_ID: &str =
         "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.Ab1234";
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index c3d9ff53d8..743fc25ea3 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -10,10 +10,13 @@ origin_url = "http://127.0.0.1:8888"
 proxy_secret = "integration_proxy_secret"
 
 [ec]
-passphrase = "integration_ec_passphrase"
+module = "hmac"
 ec_store = "ec_identity_store"
 pull_sync_concurrency = 3
 
+[ec.hmac]
+passphrase = "integration_ec_passphrase"
+
 [[ec.partners]]
 name = "Integration Test Partner"
 source_domain = "inttest.example.com"
diff --git a/crates/trusted-server-integration-tests/tests/parity.rs b/crates/trusted-server-integration-tests/tests/parity.rs
index 2428d7799b..88444913a9 100644
--- a/crates/trusted-server-integration-tests/tests/parity.rs
+++ b/crates/trusted-server-integration-tests/tests/parity.rs
@@ -46,6 +46,9 @@ fn test_settings() -> Settings {
             proxy_secret = "parity-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
diff --git a/docs/guide/api-reference.md b/docs/guide/api-reference.md
index f6c8f72d31..679e727ca2 100644
--- a/docs/guide/api-reference.md
+++ b/docs/guide/api-reference.md
@@ -863,13 +863,13 @@ The examples below use fictional IDs and values only.
 
 ### GET /\_ts/admin/ec/`{id}`
 
-Reads an EC identity-graph record for troubleshooting. The explicit route accepts an EC ID in `{64 lowercase hex}.{6 alphanumeric}` format. The bare route uses the request's `ts-ec` cookie.
+Reads an EC identity-graph record for troubleshooting. The explicit route accepts an EC ID created by the module this deployment selects, such as the built-in HMAC module's `hmac~{64 hex}.{6 alphanumeric}` form. The built-in HMAC module also still reads the bare legacy `{64 hex}.{6 alphanumeric}` form, and a deployment with no module selected accepts both of those forms. The bare route uses the request's `ts-ec` cookie.
 
 This lookup is implemented only by the Fastly adapter because the identity graph is stored in Fastly KV. Other adapters return `501 Not Implemented`.
 
 **Response fields:**
 
-- `ec_id`, `store`, and `generation` identify the raw KV lookup.
+- `ec_id` is the EC ID as requested, and `kv_key` is the identity-graph key the record was read from. The key is `ec_id` in the normalized form the identity graph stores, which is the same string as `ec_id` for an identifier the built-in HMAC module issued. `store` and `generation` identify the raw KV lookup.
 - `entry` preserves the stored JSON shape, including unknown and legacy fields. Derived `created_iso` and `consent.updated_iso` fields are added only when absent.
 - `metadata` preserves the stored metadata JSON shape.
 - `tombstone` reports whether consent has been withdrawn. It is absent when the entry body cannot be parsed as JSON or deserialized as the typed EC schema.
diff --git a/docs/guide/cloudflare.md b/docs/guide/cloudflare.md
index 73448d8cf1..37da849da6 100644
--- a/docs/guide/cloudflare.md
+++ b/docs/guide/cloudflare.md
@@ -33,7 +33,9 @@ value of `app_config` in a JSON object; that outer JSON is assigned to the
 the current startup reader.
 
 The generated local Wrangler files define `handler_password`,
-`publisher_proxy_secret`, and `ec_passphrase` separately. The smoke launches
+`publisher_proxy_secret`, and `ec_passphrase` separately. Edge Cookie identity
+is off by default, so the smoke's settings select the built-in `hmac` module,
+whose passphrase is the `ec_passphrase` secret. The smoke launches
 `wrangler dev` once without the config binding and once for each omitted
 secret. Each case requires a 500 response and verifies the exact missing
 binding against Wrangler's runtime binding inventory. The positive publisher
diff --git a/docs/guide/edge-cookies.md b/docs/guide/edge-cookies.md
index 113066cdaf..a99bc9d120 100644
--- a/docs/guide/edge-cookies.md
+++ b/docs/guide/edge-cookies.md
@@ -24,7 +24,9 @@ normalized client IP and a configured secret, with a short random
 suffix appended. On subsequent requests the value is read from the
 `ts-ec` cookie and reused.
 
-**Format:** `64-hex-hmac`.`6-alphanumeric-suffix`
+**Format:** `hmac~<64-hex-hmac>.<6-alphanumeric-suffix>`. The `hmac~`
+prefix is the module code, and a bare value with no prefix, as a
+browser may already hold, still resolves.
 
 **IP normalization:** IPv4 addresses pass through unchanged. IPv6
 addresses are masked to the /64 prefix before hashing, so a device
diff --git a/docs/guide/fastly.md b/docs/guide/fastly.md
index 6cf1e5e38c..f3c2852f90 100644
--- a/docs/guide/fastly.md
+++ b/docs/guide/fastly.md
@@ -439,7 +439,8 @@ Run the repository smoke from a clean shell:
 ```
 
 The script creates an isolated application config, applies its publisher-origin
-overrides, and runs strict validation. It then executes `ts config push
+overrides, selects the built-in `hmac` Edge Cookie module, and runs strict
+validation. It then executes `ts config push
 --adapter fastly --local`, adds all three required entries to
 `[local_server.secret_stores.trusted_server_secrets]`, and starts
 `fastly compute serve`
diff --git a/scripts/smoke-axum.sh b/scripts/smoke-axum.sh
index 3632dc3ff7..1366e4b993 100755
--- a/scripts/smoke-axum.sh
+++ b/scripts/smoke-axum.sh
@@ -109,7 +109,7 @@ run_case missing-proxy "$((BASE_PORT + 2))" "$ENVELOPE" \
     "failed to resolve secret reference at \`publisher.proxy_secret\`"
 run_case missing-ec "$((BASE_PORT + 3))" "$ENVELOPE" \
     "$SMOKE_HANDLER_VALUE" "$SMOKE_PROXY_VALUE" "" 500 \
-    "failed to resolve secret reference at \`ec.passphrase\`"
+    "failed to resolve secret reference at \`ec.hmac.passphrase\`"
 run_case positive "$((BASE_PORT + 4))" "$ENVELOPE" \
     "$SMOKE_HANDLER_VALUE" "$SMOKE_PROXY_VALUE" "$SMOKE_EC_VALUE" 200
 
diff --git a/scripts/smoke-cloudflare.sh b/scripts/smoke-cloudflare.sh
index 161823217f..4a2dce08e4 100755
--- a/scripts/smoke-cloudflare.sh
+++ b/scripts/smoke-cloudflare.sh
@@ -186,7 +186,7 @@ run_case missing-proxy "$((BASE_PORT + 2))" "$CONFIG_JSON" publisher_proxy_secre
     "failed to resolve secret reference at \`publisher.proxy_secret\` from secret store \`trusted_server_secrets\`"
 run_case missing-ec "$((BASE_PORT + 3))" "$CONFIG_JSON" ec_passphrase 500 \
     'env.ec_passphrase' \
-    "failed to resolve secret reference at \`ec.passphrase\` from secret store \`trusted_server_secrets\`"
+    "failed to resolve secret reference at \`ec.hmac.passphrase\` from secret store \`trusted_server_secrets\`"
 run_case positive "$((BASE_PORT + 4))" "$CONFIG_JSON" "" 200 "" ""
 
 echo "Cloudflare first-success smoke passed"
diff --git a/scripts/smoke-common.sh b/scripts/smoke-common.sh
index 4885472c47..040ae7e67b 100644
--- a/scripts/smoke-common.sh
+++ b/scripts/smoke-common.sh
@@ -184,6 +184,17 @@ smoke_initialize_config() {
     local origin_port="$3"
     SMOKE_APP_CONFIG="$workspace/trusted-server.toml"
     "$SMOKE_TS_BIN" config init --app-config "$SMOKE_APP_CONFIG"
+    # The example settings leave Edge Cookie identity off. Select the built-in
+    # hmac module and its block, so the missing-ec case has a secret to omit.
+    sed -e 's/^# module = "hmac"$/module = "hmac"/' \
+        -e '/^# \[ec\.hmac\]$/,/^# passphrase = /s/^# //' \
+        "$SMOKE_APP_CONFIG" >"$SMOKE_APP_CONFIG.hmac"
+    mv "$SMOKE_APP_CONFIG.hmac" "$SMOKE_APP_CONFIG"
+    local line
+    for line in 'module = "hmac"' '[ec.hmac]' 'passphrase = "ec_passphrase"'; do
+        grep --fixed-strings --line-regexp --quiet -- "$line" "$SMOKE_APP_CONFIG" ||
+            smoke_die "could not uncomment '$line' in $SMOKE_APP_CONFIG"
+    done
     export TRUSTED_SERVER__PUBLISHER__DOMAIN="127.0.0.1"
     export TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN="127.0.0.1"
     export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$origin_port"
diff --git a/scripts/smoke-fastly.sh b/scripts/smoke-fastly.sh
index 65635c2d23..5b539c845a 100755
--- a/scripts/smoke-fastly.sh
+++ b/scripts/smoke-fastly.sh
@@ -174,7 +174,7 @@ run_case missing-proxy "$((BASE_PORT + 2))" 500 \
     "failed to resolve secret reference at \`publisher.proxy_secret\`"
 write_without_secret "$CONFIGURED_FASTLY" "$FASTLY_MANIFEST" ec_passphrase
 run_case missing-ec "$((BASE_PORT + 3))" 500 \
-    "failed to resolve secret reference at \`ec.passphrase\`"
+    "failed to resolve secret reference at \`ec.hmac.passphrase\`"
 
 cp "$CONFIGURED_FASTLY" "$FASTLY_MANIFEST"
 run_case positive "$((BASE_PORT + 4))" 200
diff --git a/scripts/smoke-spin.sh b/scripts/smoke-spin.sh
index 3384dcf03b..38013c7173 100755
--- a/scripts/smoke-spin.sh
+++ b/scripts/smoke-spin.sh
@@ -133,7 +133,7 @@ run_case missing-handler "$((BASE_PORT + 1))" "$SPIN_HANDLER_VAR" 503 \
 run_case missing-proxy "$((BASE_PORT + 2))" "$SPIN_PROXY_VAR" 503 \
     "resolved secret at \`publisher.proxy_secret\` must not be empty"
 run_case missing-ec "$((BASE_PORT + 3))" "$SPIN_EC_VAR" 503 \
-    "resolved secret at \`ec.passphrase\` must not be empty"
+    "resolved secret at \`ec.hmac.passphrase\` must not be empty"
 run_case positive "$((BASE_PORT + 4))" "" 200
 
 echo "Spin first-success smoke passed"
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 066ad659e3..854030788a 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -6,10 +6,13 @@
 # `trusted-server.toml`. Copy it (`ts config init`), fill in the required
 # values, and push it (`ts config push`) as an EdgeZero app-config blob.
 #
-# Only three sections are REQUIRED for the server to start and pass validation:
+# Only two sections are REQUIRED for the server to start and pass validation:
 #   1. [[handlers]] covering /_ts/admin  (admin authentication)
 #   2. [publisher]                       (domain + origin)
-#   3. [ec] passphrase                   (Edge Cookie identity secret)
+#
+# Edge Cookie identity is optional and stays off until an [ec] module is
+# selected, so no identity secret is needed to start. See the Edge Cookie
+# section below.
 #
 # Everything below those is OPTIONAL. Most optional blocks are commented out —
 # uncomment and edit one to enable it — but a few integrations are kept as active
@@ -70,11 +73,20 @@ proxy_secret = "publisher_proxy_secret"
 
 
 # -----------------------------------------------------------------------------
-# REQUIRED — Edge Cookie (EC) identity
+# OPTIONAL — Edge Cookie (EC) identity
 # -----------------------------------------------------------------------------
 [ec]
-# Secret Store key for the secret used to derive EC identifiers.
-passphrase = "ec_passphrase"
+# Edge Cookie identity is OFF by default. With no module selected, Trusted
+# Server runs statelessly and generates no Edge Cookie. Activate one by
+# uncommenting the selector below, together with that module's own
+# [ec.<name>] block when it has settings (a block the selector does not name
+# is rejected at startup). Deployment tooling can merge a
+# TRUSTED_SERVER__EC__MODULE environment value into the published
+# configuration before it is loaded, and the running server itself reads its
+# settings from the platform config store rather than the environment. The
+# built-in hmac module is host-neutral, and a vendor module ships in its
+# own crate that the adapter composes in.
+# module = "hmac"
 # KV store that persists EC identity state. This is the physical store name
 # bound per adapter (e.g. `ec_identity_store` in fastly.toml); edgezero.toml's
 # logical KV id is `trusted_server_kv`.
@@ -85,6 +97,25 @@ pull_sync_concurrency = 3
 # cluster_trust_threshold = 10    # entries with cluster_size <= this are individual users
 # cluster_recheck_secs = 3600     # re-evaluate cluster_size after this many seconds
 
+# Built-in HMAC module block. Uncomment it together with the
+# `module = "hmac"` selector above. `passphrase` names the Secret Store key
+# holding the secret used to derive EC identifiers. That secret must be
+# >= 32 bytes and non-placeholder in production. Provision referenced keys in
+# trusted_server_secrets before validating/pushing.
+# [ec.hmac]
+# passphrase = "ec_passphrase"
+
+# A block can name the implementation it configures, which makes the block's
+# own name a label of your choosing. The same module could therefore be
+# selected as `module = "primary"` and configured in the block below
+# instead, which is how a deployment gives a module a name that means
+# something to the people running it.
+# A module from a crate is named by its folder below crates/, and may be
+# written in full, as edgecookie.<name>, or with that type folder left off.
+# [ec.primary]
+# implementation = "hmac"
+# passphrase = "ec_passphrase"
+
 # Example partner configuration. Provision referenced keys in
 # trusted_server_secrets before validating/pushing.
 # [[ec.partners]]