diff --git a/CHANGELOG.md b/CHANGELOG.md
index c00487769..7078e1154 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout. `aps` entries in Prebid bidder lists are logged and stripped. APS renderer winners now preserve the upstream bid `id`, omit `crid` when APS omits it, and carry `ext.trusted_server.renderer` instead of `adm`; external `/auction` consumers must support this response shape.
+- Publisher HTML now uses `Cache-Control: max-age=60` when server-side ad templates are inactive, while preserving origin `private`/`no-store` policies and CDN-specific cache headers. Set `[creative_opportunities].enabled = false` to disable publisher HTML and SPA template delivery without disabling direct `POST /auction` callers.
 - **Breaking** — All auction paths now forward only a validated publisher-owned page URL as `site.page`, removing query and fragment data. APS OpenRTB omits `site.ref`; the existing Prebid Server path continues to forward the browser `Referer` as `site.ref`. Query-driven sites may lose contextual targeting and per-page reporting signals that previously came from query parameters.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Integration configuration strings are no longer globally reinterpreted as JSON scalars. Operators upgrading should audit `[integrations.*]` settings and use native TOML/typed-config booleans and numbers (for example, `enabled = true`, not `enabled = "true"`); quoted numeric and boolean scalars now fail validation instead of silently converting.
@@ -34,6 +35,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `creative_opportunities.slot.gam_unit_path` is now a template supporting `{network_id}`, `{slot_id}`, and `{section}`, so a publisher whose ad unit varies by site section expresses it in one slot rule instead of one per (slot × section). `{section}` derives from the request path: `[creative_opportunities].section_segment` selects which path segment names the section (0-based, default `0`; set `1` for locale-prefixed URLs), and `section_root` supplies the value for paths with no such segment. `section_root` is required when a template uses `{section}`. Existing static and absent `gam_unit_path` configs are unchanged. Startup rejects a blank `gam_network_id` only when an absent/default path or `{network_id}` template consumes it. Trusted Server conservatively caps whole rendered dynamic paths at 100 UTF-8 bytes, informed by Google's 100-character per-ad-unit-code limit; an over-limit request-specific path omits that slot without failing the response. During typed/startup finalization, every placeholder-bearing template that omits `section_segment` materializes `section_segment = 0`, so an older binary rejects the blob loudly. Static and absent paths remain legacy-schema compatible only when both `section_root` and `section_segment` are omitted. Before rolling back below this feature, replace or remove dynamic paths, remove both keys, re-push and finalize the config, then roll back the binary.
 - Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
 - Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
+- Added the `[auction].rewrite_creatives` (default `true`) and `[auction].sanitize_creatives` (default `false`) options. `rewrite_creatives` rewrites winning-bid adm to first-party endpoints across `POST /auction` and publisher SSAT/page-bids delivery (proxy/click URL conversion, bidder `<base>` removal; creative TSJS injection on `POST /auction` only). Enabling `sanitize_creatives` strips executable markup from winning-bid adm before delivery.
+- `creative_opportunities.slot.gam_unit_path` is now a template supporting `{network_id}`, `{slot_id}`, and `{section}`, so a publisher whose ad unit varies by site section expresses it in one slot rule instead of one per (slot × section). `{section}` derives from the request path: `[creative_opportunities].section_segment` selects which path segment names the section (0-based, default `0`; set `1` for locale-prefixed URLs), and `section_root` supplies the value for paths with no such segment. `section_root` is required when a template uses `{section}`. Existing static and absent `gam_unit_path` configs are unchanged. Startup rejects a blank `gam_network_id` only when an absent/default path or `{network_id}` template consumes it. Trusted Server conservatively caps whole rendered dynamic paths at 100 UTF-8 bytes, informed by Google's 100-character per-ad-unit-code limit; an over-limit request-specific path omits that slot without failing the response. During typed/startup finalization, every placeholder-bearing template that omits `section_segment` materializes `section_segment = 0`, so an older binary rejects the blob loudly. Static and absent paths remain legacy-schema compatible only when both `section_root` and `section_segment` are omitted. Before rolling back below this feature, replace or remove dynamic paths, remove both keys, re-push and finalize the config, then roll back the binary.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration
diff --git a/crates/trusted-server-adapter-axum/src/app.rs b/crates/trusted-server-adapter-axum/src/app.rs
index 1bed830ac..85bd2a211 100644
--- a/crates/trusted-server-adapter-axum/src/app.rs
+++ b/crates/trusted-server-adapter-axum/src/app.rs
@@ -29,6 +29,7 @@ use trusted_server_core::settings::Settings;
 use trusted_server_core::settings_data::{
     default_config_key, default_config_store_name, get_settings_from_config_store,
 };
+use trusted_server_core::trace_cookie::handle_trace_mode;
 
 use trusted_server_core::platform::RuntimeServices;
 
@@ -262,6 +263,7 @@ enum NamedRouteHandler {
     /// Legacy `/admin/keys/*` aliases — denied locally with 404 so they never
     /// reach the publisher fallback (which would leak admin credentials).
     LegacyAdminDenied,
+    TraceMode,
     Auction,
     PageBids,
     FirstPartyProxy,
@@ -286,7 +288,7 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
     Method::DELETE,
 ];
 
-fn named_routes() -> [NamedRoute; 13] {
+fn named_routes() -> [NamedRoute; 14] {
     [
         NamedRoute {
             path: "/.well-known/trusted-server.json",
@@ -327,6 +329,11 @@ fn named_routes() -> [NamedRoute; 13] {
             primary_methods: LEGACY_ADMIN_DENY_METHODS,
             handler: NamedRouteHandler::LegacyAdminDenied,
         },
+        NamedRoute {
+            path: "/_ts/trace",
+            primary_methods: &[Method::GET],
+            handler: NamedRouteHandler::TraceMode,
+        },
         NamedRoute {
             path: "/auction",
             primary_methods: &[Method::POST],
@@ -408,6 +415,9 @@ fn named_route_handler(
                         Ok(resp)
                     }
                     NamedRouteHandler::LegacyAdminDenied => Ok(legacy_admin_alias_denied()),
+                    NamedRouteHandler::TraceMode => {
+                        handle_trace_mode(&state.settings, req.uri().query())
+                    }
                     NamedRouteHandler::Auction => {
                         // Build the geo-aware EC context so the auction consent
                         // gate sees the caller's jurisdiction — `EcContext::default()`
diff --git a/crates/trusted-server-adapter-cloudflare/src/app.rs b/crates/trusted-server-adapter-cloudflare/src/app.rs
index 644676fc5..dc7a7e91f 100644
--- a/crates/trusted-server-adapter-cloudflare/src/app.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/app.rs
@@ -29,6 +29,7 @@ use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
 };
 use trusted_server_core::settings::Settings;
+use trusted_server_core::trace_cookie::handle_trace_mode;
 
 use crate::middleware::{AuthMiddleware, FinalizeResponseMiddleware};
 use crate::platform::build_runtime_services;
@@ -474,6 +475,15 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             .post("/_ts/admin/keys/deactivate", |_ctx: RequestContext| async {
                 Ok::<Response, EdgeError>(admin_key_management_not_supported())
             })
+            // Render-trace toggle: arms/disarms the ts-trace cookie and
+            // redirects to `/`. Gated by [debug] trace_route_enabled (404 when
+            // off).
+            .get(
+                "/_ts/trace",
+                make_handler(Arc::clone(&state), |s, _services, req| async move {
+                    handle_trace_mode(&s.settings, req.uri().query())
+                }),
+            )
             .post(
                 "/auction",
                 make_handler(Arc::clone(&state), |s, services, req| async move {
diff --git a/crates/trusted-server-adapter-fastly/src/app.rs b/crates/trusted-server-adapter-fastly/src/app.rs
index d6090c983..8e56916b2 100644
--- a/crates/trusted-server-adapter-fastly/src/app.rs
+++ b/crates/trusted-server-adapter-fastly/src/app.rs
@@ -26,6 +26,7 @@
 //! | GET | `/_ts/api/v1/identify` | [`handle_identify`] |
 //! | GET | `/_ts/set-tester` | [`handle_set_tester`] |
 //! | GET | `/_ts/clear-tester` | [`handle_clear_tester`] |
+//! | GET | `/_ts/trace` | [`handle_trace_mode`] |
 //! | OPTIONS | `/_ts/api/v1/identify` | [`cors_preflight_identify`] |
 //! | POST | `/auction` | [`handle_auction`] |
 //! | GET | `/first-party/proxy` | [`handle_first_party_proxy`] |
@@ -130,6 +131,7 @@ use trusted_server_core::settings_data::{
     default_config_key, default_config_store_name, get_settings_from_config_store,
 };
 use trusted_server_core::tester_cookie::{handle_clear_tester, handle_set_tester};
+use trusted_server_core::trace_cookie::handle_trace_mode;
 
 use crate::middleware::{AuthMiddleware, FinalizeResponseMiddleware};
 use crate::platform::{
@@ -596,6 +598,7 @@ async fn run_named_route(
         }
         NamedRouteHandler::SetTester => handle_set_tester(&state.settings),
         NamedRouteHandler::ClearTester => handle_clear_tester(&state.settings),
+        NamedRouteHandler::TraceMode => handle_trace_mode(&state.settings, req.uri().query()),
         NamedRouteHandler::Auction => {
             // The auction reads consent data, so the consent KV store must be
             // available — fail closed with 503 when it is configured but
@@ -1008,6 +1011,7 @@ enum NamedRouteHandler {
     Identify,
     SetTester,
     ClearTester,
+    TraceMode,
     Auction,
     PageBids,
     FirstPartyProxy,
@@ -1089,6 +1093,11 @@ const NAMED_ROUTES: &[NamedRoute] = &[
         primary_methods: &[Method::GET],
         handler: NamedRouteHandler::ClearTester,
     },
+    NamedRoute {
+        path: "/_ts/trace",
+        primary_methods: &[Method::GET],
+        handler: NamedRouteHandler::TraceMode,
+    },
     NamedRoute {
         path: "/auction",
         primary_methods: &[Method::POST],
@@ -1815,6 +1824,55 @@ mod tests {
         );
     }
 
+    #[test]
+    fn dispatch_trace_route_is_disabled_by_default() {
+        let router = test_router();
+        let response = route(&router, empty_request(Method::GET, "/_ts/trace"));
+
+        assert_eq!(
+            response.status(),
+            StatusCode::NOT_FOUND,
+            "disabled trace route should return 404"
+        );
+        assert!(
+            response.headers().get(header::SET_COOKIE).is_none(),
+            "disabled trace route should not set a cookie"
+        );
+    }
+
+    #[test]
+    fn dispatch_trace_route_arms_cookie_and_redirects() {
+        let mut settings = test_settings();
+        settings.debug.trace_route_enabled = true;
+        let state = app_state_for_settings(settings);
+        let router = TrustedServerApp::routes_for_state(&state);
+        let response = route(&router, empty_request(Method::GET, "/_ts/trace"));
+
+        assert_eq!(
+            response.status(),
+            StatusCode::FOUND,
+            "enabled trace route should redirect to root"
+        );
+        assert_eq!(
+            response
+                .headers()
+                .get(header::LOCATION)
+                .and_then(|v| v.to_str().ok()),
+            Some("/"),
+            "trace route should redirect to /"
+        );
+        let set_cookie = response
+            .headers()
+            .get(header::SET_COOKIE)
+            .expect("should set trace cookie")
+            .to_str()
+            .expect("should render set-cookie as utf-8");
+        assert!(
+            set_cookie.starts_with("ts-trace=1;"),
+            "trace route should arm the ts-trace cookie"
+        );
+    }
+
     #[test]
     fn dispatch_set_tester_sets_cookie_on_configured_domain() {
         let mut settings = test_settings();
diff --git a/crates/trusted-server-adapter-fastly/src/backend.rs b/crates/trusted-server-adapter-fastly/src/backend.rs
index f2ff5d9e5..db55aa07b 100644
--- a/crates/trusted-server-adapter-fastly/src/backend.rs
+++ b/crates/trusted-server-adapter-fastly/src/backend.rs
@@ -328,10 +328,11 @@ impl<'a> BackendConfig<'a> {
 
     /// Ensure a dynamic backend exists for this configuration and return its name.
     ///
-    /// The name is a collision-resistant function of the complete backend spec
-    /// (see `Self::compute_name`), so different specs — for example, different
-    /// timeout values — always produce different backend registrations and a
-    /// tight deadline cannot be silently widened by an earlier registration.
+    /// The backend name is derived from the scheme, host, port, certificate
+    /// setting, `first_byte_timeout`, and `between_bytes_timeout` to avoid
+    /// collisions. Different timeout values produce different backend
+    /// registrations so that a tight deadline cannot be silently widened by an
+    /// earlier registration.
     ///
     /// # Errors
     ///
diff --git a/crates/trusted-server-adapter-spin/src/app.rs b/crates/trusted-server-adapter-spin/src/app.rs
index 960bafc41..4f4ba5133 100644
--- a/crates/trusted-server-adapter-spin/src/app.rs
+++ b/crates/trusted-server-adapter-spin/src/app.rs
@@ -28,6 +28,7 @@ use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
 };
 use trusted_server_core::settings::Settings;
+use trusted_server_core::trace_cookie::handle_trace_mode;
 
 use crate::middleware::{AuthMiddleware, FinalizeResponseMiddleware, NormalizeMiddleware};
 use crate::platform::build_runtime_services;
@@ -142,7 +143,7 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
     Method::DELETE,
 ];
 
-fn named_fallback_paths() -> [(&'static str, &'static [Method]); 13] {
+fn named_fallback_paths() -> [(&'static str, &'static [Method]); 14] {
     [
         ("/.well-known/trusted-server.json", &[Method::GET]),
         ("/verify-signature", &[Method::POST]),
@@ -150,6 +151,7 @@ fn named_fallback_paths() -> [(&'static str, &'static [Method]); 13] {
         ("/_ts/admin/keys/deactivate", &[Method::POST]),
         ("/admin/keys/rotate", LEGACY_ADMIN_DENY_METHODS),
         ("/admin/keys/deactivate", LEGACY_ADMIN_DENY_METHODS),
+        ("/_ts/trace", &[Method::GET]),
         ("/auction", &[Method::POST]),
         (PAGE_BIDS_PATH, &[Method::GET, Method::OPTIONS]),
         (PAGE_BIDS_LEGACY_PATH, &[Method::GET, Method::OPTIONS]),
@@ -551,6 +553,21 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             }
         };
 
+        // GET /_ts/trace — render-trace toggle: arms/disarms the ts-trace
+        // cookie and redirects to `/`. Gated by [debug] trace_route_enabled
+        // (404 when off).
+        let s = Arc::clone(&state);
+        let trace_mode_handler = move |ctx: RequestContext| {
+            let s = Arc::clone(&s);
+            async move {
+                let req = ctx.into_request();
+                Ok::<Response, EdgeError>(
+                    handle_trace_mode(&s.settings, req.uri().query())
+                        .unwrap_or_else(|e| http_error(&e)),
+                )
+            }
+        };
+
         // GET /_ts/page-bids — SPA re-auction endpoint.
         let s = Arc::clone(&state);
         let page_bids_handler = move |ctx: RequestContext| {
@@ -758,6 +775,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // credentials and key-management payloads to the origin.
             .post("/_ts/admin/keys/rotate", admin_not_supported_handler)
             .post("/_ts/admin/keys/deactivate", admin_not_supported_handler)
+            .get("/_ts/trace", trace_mode_handler)
             .post("/auction", auction_handler)
             .get(PAGE_BIDS_PATH, page_bids_handler.clone())
             .route(PAGE_BIDS_PATH, Method::OPTIONS, page_bids_options_handler)
diff --git a/crates/trusted-server-core/benches/html_processor_bench.rs b/crates/trusted-server-core/benches/html_processor_bench.rs
index 96eec2f1f..7c1303dd4 100644
--- a/crates/trusted-server-core/benches/html_processor_bench.rs
+++ b/crates/trusted-server-core/benches/html_processor_bench.rs
@@ -13,6 +13,7 @@ fn make_config() -> HtmlProcessorConfig {
         ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
         max_buffered_body_bytes: 16 * 1024 * 1024,
         gpt_diagnostics: None,
+        suppress_datadome_client_side_tag: false,
     }
 }
 
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index c4af6fd3d..5f3323dbe 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -587,10 +587,11 @@ mod tests {
     use crate::consent::types::ConsentContext;
     use crate::openrtb::Uid;
     use crate::platform::test_support::{
-        NoopBackend, NoopConfigStore, NoopGeo, NoopHttpClient, NoopSecretStore, noop_services,
+        NoopBackend, NoopConfigStore, NoopGeo, NoopHttpClient, NoopSecretStore, StubHttpClient,
+        noop_services,
     };
-    use crate::platform::{ClientInfo, PlatformResponse};
-    use crate::test_support::tests::create_test_settings;
+    use crate::platform::{ClientInfo, PlatformHttpClient, PlatformHttpRequest, PlatformResponse};
+    use crate::test_support::tests::{crate_test_settings_str, create_test_settings};
     use base64::Engine as _;
     use base64::engine::general_purpose::STANDARD as BASE64;
     use serde_json::json;
@@ -675,6 +676,124 @@ mod tests {
         }
     }
 
+    /// Provider used to prove that direct `/auction` remains available when
+    /// publisher server-side ad templates are disabled.
+    struct TemplateSwitchProbeProvider {
+        calls: Arc<Mutex<usize>>,
+    }
+
+    #[async_trait::async_trait(?Send)]
+    impl AuctionProvider for TemplateSwitchProbeProvider {
+        fn provider_name(&self) -> &'static str {
+            "template_switch_probe"
+        }
+
+        async fn request_bids(
+            &self,
+            _request: &AuctionRequest,
+            context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            *self.calls.lock().expect("should lock provider call count") += 1;
+            let request = Request::builder()
+                .method("POST")
+                .uri("https://bidder.example/auction")
+                .body(EdgeBody::empty())
+                .expect("should build probe provider request");
+            let pending = context
+                .services
+                .http_client()
+                .send_async(PlatformHttpRequest::new(
+                    request,
+                    "template-switch-probe-backend",
+                ))
+                .await
+                .change_context(TrustedServerError::Auction {
+                    message: "probe provider launch failed".to_string(),
+                })?;
+            Ok(ProviderRequestOutcome::pending(pending))
+        }
+
+        async fn parse_response(
+            &self,
+            _response: PlatformResponse,
+            _response_time_ms: u64,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            Ok(AuctionResponse::success(
+                self.provider_name(),
+                Vec::new(),
+                0,
+            ))
+        }
+
+        fn timeout_ms(&self) -> u32 {
+            100
+        }
+
+        fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
+            Some("template-switch-probe-backend".to_string())
+        }
+    }
+
+    #[tokio::test]
+    async fn direct_auction_remains_available_when_templates_are_disabled() {
+        let settings_toml = format!(
+            "{}\n[auction]\nenabled = true\nproviders = [\"template_switch_probe\"]\n\n[creative_opportunities]\nenabled = false\ngam_network_id = \"12345\"\n",
+            crate_test_settings_str()
+        );
+        let settings = Settings::from_toml(&settings_toml)
+            .expect("should parse settings with disabled templates");
+        let calls = Arc::new(Mutex::new(0));
+        let mut orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+        orchestrator.register_provider(Arc::new(TemplateSwitchProbeProvider {
+            calls: Arc::clone(&calls),
+        }));
+
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response(200, b"probe response".to_vec());
+        let services = RuntimeServices::builder()
+            .config_store(Arc::new(NoopConfigStore))
+            .secret_store(Arc::new(NoopSecretStore))
+            .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+            .backend(Arc::new(NoopBackend))
+            .http_client(Arc::clone(&stub) as Arc<dyn PlatformHttpClient>)
+            .geo(Arc::new(NoopGeo))
+            .client_info(ClientInfo::default())
+            .build();
+        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let body = json!({
+            "adUnits": [{
+                "code": "div-gpt-ad-1",
+                "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+            }]
+        });
+        let req = Request::builder()
+            .method("POST")
+            .uri("https://test-publisher.com/auction")
+            .body(EdgeBody::from(
+                serde_json::to_vec(&body).expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        let response = handle_auction(
+            &settings,
+            &orchestrator,
+            None,
+            None,
+            &ec_context,
+            &services,
+            req,
+        )
+        .await
+        .expect("direct auction should remain available");
+
+        assert_eq!(
+            *calls.lock().expect("should lock provider call count"),
+            1,
+            "disabling publisher templates must not disable direct /auction"
+        );
+        assert_eq!(response.status(), StatusCode::OK);
+    }
+
     #[tokio::test]
     async fn auction_endpoint_consent_gate_returns_no_bid_without_contacting_providers() {
         // GDPR/unknown jurisdiction lacking effective TCF Purpose 1 must not run
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 1552ee4fd..28cb866a9 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -3406,4 +3406,150 @@ mod tests {
             "Price should be preserved"
         );
     }
+
+    #[test]
+    fn parallel_duplicate_backend_name_fails_second_provider_attributably() {
+        futures::executor::block_on(async {
+            // Two providers that canonicalize to the SAME backend name (e.g. two
+            // auction providers behind one gateway origin). The correlation map
+            // keys on backend name, so the second must not silently overwrite
+            // the first — it must fail attributably so no bid is misparsed or
+            // lost.
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
+            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
+            let services = build_services_with_http_client(stub);
+            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
+            // The leaked allocation is bounded to the test process lifetime.
+            let services: &'static RuntimeServices = Box::leak(Box::new(services));
+
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
+                timeout_ms: 2000,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "shared-backend",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "shared-backend",
+            }));
+
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let req = http::Request::builder()
+                .method(http::Method::GET)
+                .uri("https://example.com/test")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build request");
+            let context = AuctionContext {
+                settings: &settings,
+                request: &req,
+                timeout_ms: 2000,
+                provider_responses: None,
+                services,
+            };
+
+            let result = orchestrator
+                .run_auction(&request, &context)
+                .await
+                .expect("should complete auction despite the name collision");
+
+            assert_eq!(
+                result.provider_responses.len(),
+                2,
+                "should account for both providers"
+            );
+            let provider_a = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-a")
+                .expect("should have provider-a response");
+            let provider_b = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-b")
+                .expect("should have provider-b response");
+            assert_eq!(
+                provider_a.status,
+                BidStatus::Success,
+                "the first provider on the shared name should launch and succeed"
+            );
+            assert_eq!(
+                provider_b.status,
+                BidStatus::Error,
+                "the second provider on the shared name should fail attributably, not be dropped"
+            );
+        });
+    }
+
+    #[test]
+    fn dispatched_duplicate_backend_name_fails_second_provider_attributably() {
+        futures::executor::block_on(async {
+            // Same collision defense on the dispatch/collect path.
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
+            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
+            let services = build_services_with_http_client(stub);
+            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
+            // The leaked allocation is bounded to the test process lifetime.
+            let services: &'static RuntimeServices = Box::leak(Box::new(services));
+
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
+                timeout_ms: 2000,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "shared-backend",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "shared-backend",
+            }));
+
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let req = http::Request::builder()
+                .method(http::Method::GET)
+                .uri("https://example.com/test")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build request");
+            let context = AuctionContext {
+                settings: &settings,
+                request: &req,
+                timeout_ms: 2000,
+                provider_responses: None,
+                services,
+            };
+
+            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
+                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
+                _ => panic!("should dispatch the first provider despite the name collision"),
+            };
+            let result = orchestrator
+                .collect_dispatched_auction(dispatched, services, &context)
+                .await;
+
+            let provider_b = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-b")
+                .expect("should have provider-b response");
+            assert_eq!(
+                provider_b.status,
+                BidStatus::Error,
+                "the second provider on the shared name should fail attributably, not be dropped"
+            );
+        });
+    }
 }
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index f61334787..f1630c346 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -288,6 +288,28 @@ pub struct Bid {
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
+/// Length of the hex-encoded creative trace hash.
+const ADM_TRACE_HASH_LEN: usize = 16;
+
+/// Compute the trace hash for delivered creative markup.
+#[must_use]
+pub fn adm_trace_hash(adm: &str) -> String {
+    use sha2::{Digest as _, Sha256};
+
+    let digest = Sha256::digest(adm.as_bytes());
+    let mut hex = hex::encode(digest);
+    hex.truncate(ADM_TRACE_HASH_LEN);
+    hex
+}
+
+impl Bid {
+    /// Trace hash of this bid's creative markup, when present.
+    #[must_use]
+    pub fn creative_trace_hash(&self) -> Option<String> {
+        self.creative.as_deref().map(adm_trace_hash)
+    }
+}
+
 /// Per-provider summary included in the auction response.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ProviderSummary {
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index cdee3b222..da82e7581 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -155,7 +155,9 @@ fn validate_enabled_integrations(
     validate_integration::<SourcepointConfig>(settings, "sourcepoint")?;
     validate_integration::<OsanoConfig>(settings, "osano")?;
     validate_integration::<GoogleTagManagerConfig>(settings, "google_tag_manager")?;
-    validate_integration::<DataDomeConfig>(settings, "datadome")?;
+    if let Some(config) = settings.integration_config::<DataDomeConfig>("datadome")? {
+        crate::integrations::datadome::DataDomeIntegration::validate_config_for_startup(config)?;
+    }
     validate_integration::<GptConfig>(settings, "gpt")?;
     validate_integration::<GptDiagnosticsConfig>(settings, "gpt_diagnostics")?;
 
@@ -321,10 +323,37 @@ formats = [{ width = 300, height = 250 }]
     fn absent_gam_unit_template_is_accepted_by_legacy_schema() {
         let creative_opportunities = serialized_creative_opportunities(None);
 
+        assert!(
+            creative_opportunities.get("enabled").is_none(),
+            "default template switch should be omitted for legacy binaries"
+        );
         serde_json::from_value::<LegacyCreativeOpportunitiesConfig>(creative_opportunities)
             .expect("should accept absent GAM unit template");
     }
 
+    #[test]
+    fn disabled_creative_opportunities_flag_is_visible_to_legacy_schema() {
+        let mut toml = crate_test_settings_str();
+        toml.push_str(
+            r#"
+
+[creative_opportunities]
+enabled = false
+gam_network_id = "99999"
+"#,
+        );
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize app config wrapper");
+        let creative_opportunities = serde_json::to_value(app_config)
+            .expect("should serialize app config wrapper")
+            .get("creative_opportunities")
+            .cloned()
+            .expect("should contain creative opportunities");
+
+        serde_json::from_value::<LegacyCreativeOpportunitiesConfig>(creative_opportunities)
+            .expect_err("legacy binaries should reject an explicit disabled switch");
+    }
+
     #[test]
     fn deploy_validation_rejects_placeholders() {
         let settings = Settings::from_toml(
@@ -404,6 +433,44 @@ password = "production-admin-password-32-bytes"
         );
     }
 
+    #[test]
+    fn deploy_validation_rejects_invalid_datadome_test_bypass() {
+        for (enable_protection, store, name, expected_message) in [
+            (
+                false,
+                "ts_secrets",
+                "datadome_test_bypass",
+                "requires enable_protection",
+            ),
+            (true, "", "datadome_test_bypass", "credential_secret_store"),
+            (true, "ts_secrets", "", "credential_secret_name"),
+        ] {
+            let mut settings = valid_settings();
+            settings
+                .integrations
+                .insert_config(
+                    "datadome",
+                    &serde_json::json!({
+                        "enabled": true,
+                        "enable_protection": enable_protection,
+                        "protection_test_bypass": {
+                            "enabled": true,
+                            "credential_secret_store": store,
+                            "credential_secret_name": name,
+                        },
+                    }),
+                )
+                .expect("should insert DataDome config");
+
+            let err = validate_settings_for_deploy(&settings)
+                .expect_err("should reject invalid DataDome test bypass");
+            assert!(
+                format!("{err:?}").contains(expected_message),
+                "error should mention the invalid bypass setting: {err:?}"
+            );
+        }
+    }
+
     #[test]
     fn validate_trait_reports_deploy_errors() {
         let mut settings = valid_settings();
diff --git a/crates/trusted-server-core/src/constants.rs b/crates/trusted-server-core/src/constants.rs
index e1152b1e7..828311f12 100644
--- a/crates/trusted-server-core/src/constants.rs
+++ b/crates/trusted-server-core/src/constants.rs
@@ -5,6 +5,7 @@ pub const COOKIE_TS_EC: &str = "ts-ec";
 /// JSON array of Extended User IDs (`[{ source, uids }]`) from identity providers.
 pub const COOKIE_TS_EIDS: &str = "ts-eids";
 pub const COOKIE_TS_TESTER: &str = "ts-tester";
+pub const COOKIE_TS_TRACE: &str = "ts-trace";
 pub const COOKIE_SHAREDID: &str = "sharedId";
 
 pub const HEADER_X_PUB_USER_ID: HeaderName = HeaderName::from_static("x-pub-user-id");
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
index e44b0cbcf..b6950a6eb 100644
--- a/crates/trusted-server-core/src/creative_opportunities.rs
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -183,10 +183,27 @@ fn derive_section(path: &str, section_root: &str, section_segment: usize) -> Str
     }
 }
 
+const fn default_enabled() -> bool {
+    true
+}
+
+const fn is_default_enabled(value: &bool) -> bool {
+    *value == default_enabled()
+}
+
 /// Top-level configuration for the creative opportunities system.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct CreativeOpportunitiesConfig {
+    /// Enables server-side ad template delivery on publisher HTML and page-bids requests.
+    ///
+    /// This does not disable the direct `POST /auction` endpoint. The default is
+    /// `true` so existing creative-opportunity configurations retain their behavior.
+    #[serde(
+        default = "default_enabled",
+        skip_serializing_if = "is_default_enabled"
+    )]
+    pub enabled: bool,
     /// GAM network ID used to build default unit paths.
     pub gam_network_id: String,
     /// Maximum time in milliseconds to wait for the server-side auction before
@@ -244,7 +261,7 @@ pub struct CreativeOpportunitiesConfig {
     /// [`section_root`](Self::section_root) are omitted.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub section_segment: Option<usize>,
-    /// Slot templates. Empty vec = feature disabled (no auction fired, no globals injected).
+    /// Slot templates. An empty vec or `enabled = false` disables template delivery.
     #[serde(default, deserialize_with = "vec_from_seq_or_map")]
     pub slot: Vec<CreativeOpportunitySlot>,
 }
@@ -333,6 +350,12 @@ impl CreativeOpportunitiesConfig {
 
         for slot in &self.slot {
             slot.validate_runtime()?;
+            if slot.providers.aps.is_some() {
+                log::warn!(
+                    "creative opportunity slot '{}': providers.aps is retained only for configuration compatibility and is ignored by APS OpenRTB",
+                    slot.id
+                );
+            }
         }
 
         if self
@@ -1143,12 +1166,39 @@ mod tests {
         assert_eq!(derive_section("/%%%/x", "home", 0), "_");
     }
 
+    #[test]
+    fn enabled_defaults_true_and_is_omitted_from_serialized_config() {
+        let config = make_config_with_section_template(None);
+        assert!(
+            config.enabled,
+            "template delivery should default to enabled"
+        );
+        let value = serde_json::to_value(&config).expect("should serialize config");
+        assert!(
+            value.get("enabled").is_none(),
+            "default enabled value should be omitted for rollback compatibility"
+        );
+    }
+
+    #[test]
+    fn disabled_template_switch_is_serialized() {
+        let mut config = make_config_with_section_template(None);
+        config.enabled = false;
+        let value = serde_json::to_value(&config).expect("should serialize config");
+        assert_eq!(
+            value.get("enabled"),
+            Some(&serde_json::Value::Bool(false)),
+            "explicitly disabled template delivery must remain in config blobs"
+        );
+    }
+
     fn make_config_with_section_template(
         section_root: Option<&str>,
     ) -> CreativeOpportunitiesConfig {
         let mut slot = make_slot("ad-header-0", vec!["/news/*"]);
         slot.gam_unit_path = Some("/{network_id}/example/{section}".to_string());
         CreativeOpportunitiesConfig {
+            enabled: true,
             gam_network_id: "99999".to_string(),
             auction_timeout_ms: None,
             price_granularity: PriceGranularity::default(),
@@ -1546,6 +1596,7 @@ mod tests {
         // Older binaries deserialize this struct with `deny_unknown_fields`, so
         // a pushed config blob must not carry `"section_root": null`.
         let config = CreativeOpportunitiesConfig {
+            enabled: true,
             gam_network_id: "99999".to_string(),
             auction_timeout_ms: None,
             price_granularity: PriceGranularity::default(),
diff --git a/crates/trusted-server-core/src/ec/prebid_eids.rs b/crates/trusted-server-core/src/ec/prebid_eids.rs
index 2f99c8182..160be5d64 100644
--- a/crates/trusted-server-core/src/ec/prebid_eids.rs
+++ b/crates/trusted-server-core/src/ec/prebid_eids.rs
@@ -29,6 +29,10 @@ const MAX_EIDS_COOKIE_BYTES: usize = 8 * 1024;
 struct LegacyCookieEid {
     source: String,
     id: String,
+    #[allow(
+        dead_code,
+        reason = "legacy cookie field is deserialized for compatibility but not emitted"
+    )]
     atype: i32,
 }
 
diff --git a/crates/trusted-server-core/src/html_processor.rs b/crates/trusted-server-core/src/html_processor.rs
index 889234b56..4c827ace0 100644
--- a/crates/trusted-server-core/src/html_processor.rs
+++ b/crates/trusted-server-core/src/html_processor.rs
@@ -13,6 +13,7 @@ use lol_html::{
     text,
 };
 
+use crate::integrations::datadome::{DATADOME_INTEGRATION_ID, DataDomeClientTagSuppressed};
 use crate::integrations::gpt_diagnostics::GptDiagnosticsRequestDecision;
 use crate::integrations::{
     AttributeRewriteOutcome, IntegrationAttributeContext, IntegrationDocumentState,
@@ -175,6 +176,8 @@ pub struct HtmlProcessorConfig {
     pub max_buffered_body_bytes: usize,
     /// Request-scoped conditional diagnostics delivery decision.
     pub gpt_diagnostics: Option<GptDiagnosticsRequestDecision>,
+    /// Whether to omit Trusted Server's automatic `DataDome` client-side tag.
+    pub suppress_datadome_client_side_tag: bool,
 }
 
 impl HtmlProcessorConfig {
@@ -196,6 +199,7 @@ impl HtmlProcessorConfig {
             ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
             max_buffered_body_bytes: settings.publisher.max_buffered_body_bytes,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         }
     }
 
@@ -223,6 +227,13 @@ impl HtmlProcessorConfig {
         self.gpt_diagnostics = decision;
         self
     }
+
+    /// Attach the request-scoped `DataDome` client-tag suppression decision.
+    #[must_use]
+    pub fn with_datadome_client_tag_suppression(mut self, suppress: bool) -> Self {
+        self.suppress_datadome_client_side_tag = suppress;
+        self
+    }
 }
 
 /// Create an HTML processor with URL replacement and integration hooks.
@@ -235,6 +246,9 @@ impl HtmlProcessorConfig {
 pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcessor {
     let post_processors = config.integrations.html_post_processors();
     let document_state = IntegrationDocumentState::default();
+    if config.suppress_datadome_client_side_tag {
+        document_state.get_or_insert_with(DATADOME_INTEGRATION_ID, || DataDomeClientTagSuppressed);
+    }
 
     // Simplified URL patterns structure - stores only core data and generates variants on-demand
     struct UrlPatterns {
@@ -692,6 +706,7 @@ mod tests {
             ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         }
     }
 
@@ -950,6 +965,46 @@ mod tests {
         assert_eq!(config.request_scheme, "https");
     }
 
+    #[test]
+    fn suppressed_datadome_tag_is_not_injected_into_processed_html() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                "datadome",
+                &json!({
+                    "enabled": true,
+                    "client_side_key": "test-client-key",
+                }),
+            )
+            .expect("should configure DataDome integration");
+        let registry = IntegrationRegistry::new(&settings)
+            .expect("should create integration registry with DataDome");
+        let config = HtmlProcessorConfig::from_settings(
+            &settings,
+            &registry,
+            "origin.example.com",
+            "test.example.com",
+            "https",
+        )
+        .with_datadome_client_tag_suppression(true);
+        let mut processor = create_html_processor(config);
+
+        let output = processor
+            .process_chunk(b"<html><head></head><body>content</body></html>", true)
+            .expect("should process HTML");
+        let html = String::from_utf8(output).expect("should produce UTF-8 HTML");
+
+        assert!(
+            !html.contains("window.ddjskey"),
+            "should omit the DataDome client configuration"
+        );
+        assert!(
+            !html.contains("/integrations/datadome/tags.js"),
+            "should omit the DataDome client tag URL"
+        );
+    }
+
     #[test]
     fn test_real_publisher_html() {
         // Test with publisher HTML from test_publisher.html
@@ -1539,6 +1594,7 @@ mod tests {
             ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut processor = create_html_processor(config);
         let output = processor
@@ -1613,6 +1669,7 @@ mod tests {
             ad_bids_state: state,
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut processor = create_html_processor(config);
         let output = processor
@@ -1649,6 +1706,7 @@ mod tests {
             ad_bids_state: state,
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut processor = create_html_processor(config);
         // Malformed HTML with two <body> elements (common in CMS template pages)
@@ -1684,6 +1742,7 @@ mod tests {
             ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut processor = create_html_processor(config);
         let output = processor
@@ -1737,6 +1796,7 @@ mod tests {
             ad_bids_state: state,
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut processor = create_html_processor(config);
         let output = processor
@@ -1764,6 +1824,7 @@ mod tests {
             ad_bids_state: state,
             max_buffered_body_bytes: 16 * 1024 * 1024,
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut processor = create_html_processor(config);
         let output = processor
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index ba3f82776..c1f36b337 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -319,17 +319,19 @@ impl AdServerMockProvider {
                     }),
                     nurl: original.and_then(|b| b.nurl.clone()),
                     burl: original.and_then(|b| b.burl.clone()),
-                    // The mediation response is itself `OpenRTB`, so the mediated
-                    // bid's own `id` is this bid's identifier. Fall back to the
-                    // original SSP bid's id when the mediator omits one. Without
-                    // either, a mediated bid whose only `hb_adid` source is the bid
-                    // id would lose it and never render — including APS bids, which
-                    // carry no `ad_id` or `cache_id` for the restore to recover.
-                    bid_id: bid["id"]
-                        .as_str()
-                        .filter(|id| !id.is_empty())
-                        .map(String::from)
-                        .or_else(|| original.and_then(|bid| bid.bid_id.clone())),
+                    // The original SSP bid's id wins: a typed `renderer` envelope is
+                    // minted against it, and `build_bid_map` derives `hb_adid` from
+                    // that pairing, so substituting the mediator's own id would key
+                    // targeting to an id the renderer does not know. The mediated
+                    // `OpenRTB` bid's `id` is the fallback for a mediator whose
+                    // upstream bid carried none — without either, a bid whose only
+                    // `hb_adid` source is the bid id loses it and never renders.
+                    bid_id: original.and_then(|b| b.bid_id.clone()).or_else(|| {
+                        bid["id"]
+                            .as_str()
+                            .filter(|id| !id.is_empty())
+                            .map(String::from)
+                    }),
                     ad_id: original.and_then(|bid| bid.ad_id.clone()),
                     creative_id: original.and_then(|bid| bid.creative_id.clone()),
                     renderer: original.and_then(|bid| bid.renderer.clone()),
@@ -880,8 +882,8 @@ mod tests {
         );
         assert_eq!(
             bid.bid_id.as_deref(),
-            Some("mediated-bid-001"),
-            "should carry the mediated OpenRTB bid id so hb_adid always has a source"
+            Some("source-bid-id"),
+            "should keep the original bid id the renderer envelope is keyed on, not the mediator's"
         );
         assert_eq!(
             bid.ad_id.as_deref(),
@@ -908,23 +910,31 @@ mod tests {
     }
 
     #[test]
-    fn parse_mediation_response_falls_back_to_original_bid_id() {
-        // A mediator that omits the per-bid `id` must not strand a pass-through
-        // bid whose only hb_adid source is its OpenRTB bid id.
+    fn parse_mediation_response_falls_back_to_mediated_bid_id() {
+        // The original bid carries no id of its own, so there is nothing to
+        // restore and no renderer envelope to stay consistent with. The mediation
+        // response is itself OpenRTB, so its bid `id` is the remaining hb_adid
+        // source — without it the bid reaches the page with no hb_adid and the
+        // render bridge never receives a matching request.
         let provider = AdServerMockProvider::new(AdServerMockConfig::default());
         let mediation_response = json!({
             "id": "test-auction-123",
-            "seatbid": [{
-                "seat": "prebid",
-                "bid": [{
-                    "impid": "header-banner",
-                    "price": 0.20,
-                    "adm": "<div>Mediated Ad</div>",
-                    "w": 728,
-                    "h": 90,
-                    "crid": "example-bidder-creative"
-                }]
-            }],
+            "seatbid": [
+                {
+                    "seat": "prebid",
+                    "bid": [
+                        {
+                            "id": "mediated-bid-002",
+                            "impid": "header-banner",
+                            "price": 0.20,
+                            "adm": "<div>Mediated Ad</div>",
+                            "w": 728,
+                            "h": 90,
+                            "crid": "example-bidder-creative",
+                        }
+                    ]
+                }
+            ],
             "cur": "USD"
         });
         let mut bid_index = BidIndex::new();
@@ -945,7 +955,7 @@ mod tests {
                 height: 90,
                 nurl: None,
                 burl: None,
-                bid_id: Some("019f7e2a-b45b-70b0-a2d1-b651c430700b".to_string()),
+                bid_id: None,
                 ad_id: None,
                 creative_id: None,
                 renderer: None,
@@ -959,10 +969,11 @@ mod tests {
         let auction_response =
             provider.parse_mediation_response(&mediation_response, 42, &bid_index);
 
+        let bid = &auction_response.bids[0];
         assert_eq!(
-            auction_response.bids[0].bid_id.as_deref(),
-            Some("019f7e2a-b45b-70b0-a2d1-b651c430700b"),
-            "should restore the original SSP bid id when the mediator omits one"
+            bid.bid_id.as_deref(),
+            Some("mediated-bid-002"),
+            "should fall back to the mediated OpenRTB bid id when the original has none"
         );
     }
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 4fed9278d..421f6a2d7 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -50,6 +50,7 @@ const APS_RENDERER_CSP: &str = "default-src 'none'; sandbox allow-forms allow-po
 
 const APS_RENDERER_DOCUMENT: &str = r#"<!doctype html>
 <meta charset="utf-8">
+<style>html,body{margin:0;padding:0;overflow:hidden}</style>
 <script>
 (function(){
 'use strict';
diff --git a/crates/trusted-server-core/src/integrations/datadome.rs b/crates/trusted-server-core/src/integrations/datadome.rs
index a46f626a6..2486c16be 100644
--- a/crates/trusted-server-core/src/integrations/datadome.rs
+++ b/crates/trusted-server-core/src/integrations/datadome.rs
@@ -88,7 +88,13 @@ pub use protection_scope::{
 
 use protection_scope::ProtectionScope;
 
-pub(super) const DATADOME_INTEGRATION_ID: &str = "datadome";
+pub(crate) const DATADOME_INTEGRATION_ID: &str = "datadome";
+pub(crate) const HEADER_DATADOME_TEST_BYPASS: &str = "x-ts-datadome-bypass";
+
+/// Request marker indicating that Trusted Server should omit its automatic
+/// `DataDome` client-side tag for the current response.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct DataDomeClientTagSuppressed;
 
 /// Regex pattern for matching and rewriting `DataDome` URLs in script content.
 ///
@@ -112,6 +118,28 @@ static DATADOME_URL_PATTERN: LazyLock<Regex> = LazyLock::new(|| {
         .expect("DataDome URL rewrite regex should compile")
 });
 
+/// Temporary static-header bypass for server-side `DataDome` protection.
+///
+/// This is intended only for an access-controlled staging environment. A
+/// matching `x-ts-datadome-bypass` header bypasses the server-side Protection
+/// API and is removed before the publisher origin receives the request. The
+/// credential itself is loaded from the Secret Store at runtime.
+#[derive(Debug, Default, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ProtectionTestBypassConfig {
+    /// Enables the bypass. Defaults to disabled when the section is present.
+    #[serde(default)]
+    pub enabled: bool,
+
+    /// Secret Store containing the temporary bypass credential.
+    #[serde(default = "default_protection_test_bypass_secret_store")]
+    pub credential_secret_store: String,
+
+    /// Secret name containing the temporary bypass credential.
+    #[serde(default = "default_protection_test_bypass_secret_name")]
+    pub credential_secret_name: String,
+}
+
 /// Configuration for `DataDome` integration.
 #[derive(Debug, Clone, Deserialize, Validate)]
 #[serde(deny_unknown_fields)]
@@ -194,6 +222,10 @@ pub struct DataDomeConfig {
     )]
     pub protection_exclusion_rules: Vec<ProtectionExclusionRuleConfig>,
 
+    /// Temporary static-header bypass for access-controlled staging tests.
+    #[serde(default)]
+    pub protection_test_bypass: Option<ProtectionTestBypassConfig>,
+
     /// Reserved flag for future GraphQL payload extraction.
     #[serde(default)]
     pub enable_graphql_support: bool,
@@ -247,6 +279,14 @@ fn default_server_side_key_secret_name() -> String {
     "datadome_server_side_key".to_string()
 }
 
+fn default_protection_test_bypass_secret_store() -> String {
+    "ts_secrets".to_string()
+}
+
+fn default_protection_test_bypass_secret_name() -> String {
+    "datadome_test_bypass".to_string()
+}
+
 fn default_timeout_ms() -> u32 {
     1500
 }
@@ -324,6 +364,7 @@ impl Default for DataDomeConfig {
             protection_excluded_ip_cidr_sources: Vec::new(),
             protection_ip_list_cache_ttl_seconds: default_protection_ip_list_cache_ttl_seconds(),
             protection_exclusion_rules: default_protection_exclusion_rules(),
+            protection_test_bypass: None,
             enable_graphql_support: false,
             client_side_key: String::new(),
             inject_client_side_tag: default_inject_client_side_tag(),
@@ -357,6 +398,10 @@ impl DataDomeIntegration {
         config.server_side_key_secret_name = config.server_side_key_secret_name.trim().to_string();
         config.protection_api_origin = config.protection_api_origin.trim().to_string();
         config.client_side_tag_url = config.client_side_tag_url.trim().to_string();
+        if let Some(bypass) = &mut config.protection_test_bypass {
+            bypass.credential_secret_store = bypass.credential_secret_store.trim().to_string();
+            bypass.credential_secret_name = bypass.credential_secret_name.trim().to_string();
+        }
 
         if config.enable_protection {
             if config.server_side_key_secret_store.is_empty()
@@ -368,6 +413,7 @@ impl DataDomeIntegration {
             }
             Self::validate_protection_api_origin(&config.protection_api_origin)?;
         }
+        Self::validate_protection_test_bypass(&config)?;
 
         if config.inject_client_side_tag {
             Self::validate_client_side_tag_url(&config.client_side_tag_url)?;
@@ -417,6 +463,37 @@ impl DataDomeIntegration {
         Ok(())
     }
 
+    pub(crate) fn validate_config_for_startup(
+        config: DataDomeConfig,
+    ) -> Result<(), Report<TrustedServerError>> {
+        Self::try_new(config).map(|_| ())
+    }
+
+    fn validate_protection_test_bypass(
+        config: &DataDomeConfig,
+    ) -> Result<(), Report<TrustedServerError>> {
+        let Some(bypass) = config
+            .protection_test_bypass
+            .as_ref()
+            .filter(|bypass| bypass.enabled)
+        else {
+            return Ok(());
+        };
+
+        if !config.enable_protection {
+            return Err(Report::new(Self::error(
+                "protection_test_bypass requires enable_protection to be true",
+            )));
+        }
+        if bypass.credential_secret_store.is_empty() || bypass.credential_secret_name.is_empty() {
+            return Err(Report::new(Self::error(
+                "protection_test_bypass credential_secret_store and credential_secret_name must not be empty when enabled",
+            )));
+        }
+
+        Ok(())
+    }
+
     fn validate_client_side_tag_url(tag_url: &str) -> Result<(), Report<TrustedServerError>> {
         if tag_url.starts_with('/') && !tag_url.starts_with("//") {
             if tag_url.chars().any(is_unsafe_client_side_tag_path_char) {
@@ -765,7 +842,15 @@ impl IntegrationHeadInjector for DataDomeIntegration {
         DATADOME_INTEGRATION_ID
     }
 
-    fn head_inserts(&self, _ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
+    fn head_inserts(&self, ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
+        if ctx
+            .document_state
+            .get::<DataDomeClientTagSuppressed>(DATADOME_INTEGRATION_ID)
+            .is_some()
+        {
+            return Vec::new();
+        }
+
         if !self.config.inject_client_side_tag || self.config.client_side_key.trim().is_empty() {
             return Vec::new();
         }
@@ -840,13 +925,25 @@ fn build(
         return Ok(None);
     };
 
+    let integration = DataDomeIntegration::try_new(config)?;
+    let protection_test_bypass = integration
+        .config
+        .protection_test_bypass
+        .as_ref()
+        .is_some_and(|bypass| bypass.enabled);
     log::info!(
-        "[datadome] Registering integration (sdk_origin: {}, rewrite_sdk: {})",
-        config.sdk_origin,
-        config.rewrite_sdk
+        "[datadome] Registering integration (sdk_origin: {}, rewrite_sdk: {}, enable_protection: {}, protection_test_bypass: {})",
+        integration.config.sdk_origin,
+        integration.config.rewrite_sdk,
+        integration.config.enable_protection,
+        if protection_test_bypass {
+            "enabled"
+        } else {
+            "disabled"
+        },
     );
 
-    Ok(Some(DataDomeIntegration::try_new(config)?))
+    Ok(Some(integration))
 }
 
 /// Register the `DataDome` integration with Trusted Server.
@@ -1084,6 +1181,70 @@ mod tests {
             config.server_side_key_secret_name,
             "datadome_server_side_key"
         );
+        assert!(
+            config.protection_test_bypass.is_none(),
+            "the temporary test bypass should be disabled by default"
+        );
+    }
+
+    #[test]
+    fn protection_test_bypass_deserializes_nested_configuration() {
+        let config: DataDomeConfig = toml::from_str(
+            r#"
+            enabled = true
+            enable_protection = true
+
+            [protection_test_bypass]
+            enabled = true
+            credential_secret_store = "ts_secrets"
+            credential_secret_name = "datadome_test_bypass"
+            "#,
+        )
+        .expect("should deserialize DataDome test bypass configuration");
+        let bypass = config
+            .protection_test_bypass
+            .expect("should deserialize the nested test bypass configuration");
+
+        assert!(bypass.enabled, "should retain the enabled flag");
+        assert_eq!(
+            bypass.credential_secret_store, "ts_secrets",
+            "should retain the configured credential Secret Store"
+        );
+        assert_eq!(
+            bypass.credential_secret_name, "datadome_test_bypass",
+            "should retain the configured credential secret name"
+        );
+    }
+
+    #[test]
+    fn protection_test_bypass_requires_protection_and_secret_references() {
+        for (enable_protection, store, name, expected_message) in [
+            (
+                false,
+                "ts_secrets",
+                "datadome_test_bypass",
+                "requires enable_protection",
+            ),
+            (true, "", "datadome_test_bypass", "credential_secret_store"),
+            (true, "ts_secrets", "", "credential_secret_name"),
+        ] {
+            let mut config = test_config();
+            config.enable_protection = enable_protection;
+            config.protection_test_bypass = Some(ProtectionTestBypassConfig {
+                enabled: true,
+                credential_secret_store: store.to_string(),
+                credential_secret_name: name.to_string(),
+            });
+
+            let err = match DataDomeIntegration::try_new(config) {
+                Ok(_) => panic!("should reject invalid protection test bypass configuration"),
+                Err(err) => err,
+            };
+            assert!(
+                format!("{err:?}").contains(expected_message),
+                "should explain the invalid protection test bypass configuration"
+            );
+        }
     }
 
     #[test]
@@ -1248,6 +1409,20 @@ mod tests {
 
     #[test]
     fn head_injector_omits_client_side_tag_when_disabled_or_blank() {
+        let mut suppressed = test_config();
+        suppressed.client_side_key = "test-client-key".to_string();
+        let suppressed_integration = DataDomeIntegration::new(suppressed);
+        let suppressed_state = crate::integrations::IntegrationDocumentState::default();
+        suppressed_state
+            .get_or_insert_with(DATADOME_INTEGRATION_ID, || DataDomeClientTagSuppressed);
+        let suppressed_ctx = html_context_for_tests(&suppressed_state);
+        assert!(
+            suppressed_integration
+                .head_inserts(&suppressed_ctx)
+                .is_empty(),
+            "should omit the tag when the request is IP-excluded"
+        );
+
         let mut blank_key = test_config();
         blank_key.client_side_key = " ".to_string();
         let integration = DataDomeIntegration::new(blank_key);
diff --git a/crates/trusted-server-core/src/integrations/datadome/protection.rs b/crates/trusted-server-core/src/integrations/datadome/protection.rs
index c2759a864..bc06214ff 100644
--- a/crates/trusted-server-core/src/integrations/datadome/protection.rs
+++ b/crates/trusted-server-core/src/integrations/datadome/protection.rs
@@ -4,6 +4,8 @@ use edgezero_core::body::Body as EdgeBody;
 use edgezero_core::http::{HeaderMap, HeaderName, request_builder};
 use error_stack::{Report, ResultExt};
 use http::{Method, Request, Response, StatusCode, header};
+use sha2::{Digest as _, Sha256};
+use subtle::ConstantTimeEq as _;
 use url::Url;
 
 use crate::error::TrustedServerError;
@@ -34,9 +36,20 @@ enum ProtectionRequestError {
 impl DataDomeIntegration {
     pub(super) async fn filter_protection_request(
         &self,
-        input: RequestFilterInput<'_>,
+        mut input: RequestFilterInput<'_>,
     ) -> RequestFilterDecision {
-        if !self.config.enable_protection || !self.is_request_protected(&input) {
+        let test_bypass_matched =
+            self.take_protection_test_bypass_header(input.request, input.services);
+        if test_bypass_matched {
+            input
+                .request
+                .extensions_mut()
+                .insert(super::DataDomeClientTagSuppressed);
+            log_protection_test_bypass(&input);
+            return RequestFilterDecision::Continue(RequestFilterEffects::default());
+        }
+
+        if !self.config.enable_protection || !self.is_request_protected(&mut input) {
             return RequestFilterDecision::Continue(RequestFilterEffects::default());
         }
 
@@ -98,11 +111,17 @@ impl DataDomeIntegration {
             .change_context(Self::error("Failed to call DataDome Protection API"))
             .map_err(ProtectionRequestError::Runtime)?;
 
-        Ok(self.classify_protection_response(platform_response.response, input.request.method()))
+        let status = platform_response.response.status();
+        let datadome_status = datadome_response_status(platform_response.response.headers());
+        let decision =
+            self.classify_protection_response(platform_response.response, input.request.method());
+        log_protection_result(&input, status, datadome_status, &decision);
+
+        Ok(decision)
     }
 
-    fn is_request_protected(&self, input: &RequestFilterInput<'_>) -> bool {
-        let req = input.request;
+    fn is_request_protected(&self, input: &mut RequestFilterInput<'_>) -> bool {
+        let req = &*input.request;
         if req.method() == Method::OPTIONS {
             return false;
         }
@@ -126,7 +145,14 @@ impl DataDomeIntegration {
         match self.protection_scope.evaluate(&facts, input.services) {
             ProtectionScopeDecision::Protect => {}
             ProtectionScopeDecision::Skip { rule_id, reason } => {
-                log::debug!("[datadome] Skipping Protection API for rule {rule_id} ({reason})");
+                let client_tag_omitted = is_ip_exclusion_reason(reason);
+                if client_tag_omitted {
+                    input
+                        .request
+                        .extensions_mut()
+                        .insert(super::DataDomeClientTagSuppressed);
+                }
+                log_protection_skip(input, &rule_id, reason);
                 return false;
             }
         }
@@ -134,6 +160,48 @@ impl DataDomeIntegration {
         true
     }
 
+    fn take_protection_test_bypass_header(
+        &self,
+        req: &mut Request<EdgeBody>,
+        services: &RuntimeServices,
+    ) -> bool {
+        let Some(bypass) = self
+            .config
+            .protection_test_bypass
+            .as_ref()
+            .filter(|bypass| bypass.enabled)
+        else {
+            return false;
+        };
+        let Some(value) = req.headers_mut().remove(super::HEADER_DATADOME_TEST_BYPASS) else {
+            return false;
+        };
+
+        let store_name = StoreName::from(bypass.credential_secret_store.as_str());
+        let credential = match services
+            .secret_store()
+            .get_string(&store_name, &bypass.credential_secret_name)
+        {
+            Ok(credential) if !credential.is_empty() => credential,
+            Ok(_) => {
+                log::warn!(
+                    "[datadome] DataDome test bypass credential is empty; ignoring bypass header"
+                );
+                return false;
+            }
+            Err(err) => {
+                log::warn!(
+                    "[datadome] Failed to load DataDome test bypass credential; ignoring bypass header: {err:?}"
+                );
+                return false;
+            }
+        };
+
+        let actual = Sha256::digest(value.as_bytes());
+        let expected = Sha256::digest(credential.as_bytes());
+        bool::from(actual.ct_eq(&expected))
+    }
+
     fn protection_validate_url(&self) -> String {
         format!(
             "{}{}",
@@ -194,7 +262,7 @@ impl DataDomeIntegration {
         input: &RequestFilterInput<'_>,
         server_side_key: &Redacted<String>,
     ) -> ProtectionPayload {
-        let req = input.request;
+        let req = &*input.request;
         let client_info = input.services.client_info();
         let mut fields = Vec::new();
         let header_client_id = header_value(req, HEADER_DATADOME_CLIENT_ID);
@@ -413,6 +481,65 @@ impl DataDomeIntegration {
     }
 }
 
+fn is_ip_exclusion_reason(reason: &str) -> bool {
+    matches!(
+        reason,
+        "client_ip" | "client_ip_source" | "ip_cidr" | "ip_cidr_source"
+    )
+}
+
+fn log_protection_test_bypass(input: &RequestFilterInput<'_>) {
+    log::info!(
+        "[datadome] protection decision=skipped rule=protection-test-bypass reason=test_bypass client_tag=omitted method={}",
+        input.request.method(),
+    );
+}
+
+fn log_protection_skip(input: &RequestFilterInput<'_>, rule_id: &str, reason: &str) {
+    if is_ip_exclusion_reason(reason) {
+        log::info!(
+            "[datadome] protection decision=skipped rule={} reason={} client_tag=omitted method={}",
+            rule_id,
+            reason,
+            input.request.method(),
+        );
+    } else {
+        log::debug!(
+            "[datadome] protection decision=skipped rule={} reason={} method={}",
+            rule_id,
+            reason,
+            input.request.method(),
+        );
+    }
+}
+
+fn log_protection_result(
+    input: &RequestFilterInput<'_>,
+    status: StatusCode,
+    datadome_status: Option<u16>,
+    decision: &RequestFilterDecision,
+) {
+    let method = input.request.method();
+
+    match decision {
+        RequestFilterDecision::Respond { .. } => log::info!(
+            "[datadome] protection decision=blocked status={} method={} route=short_circuit",
+            status.as_u16(),
+            method,
+        ),
+        RequestFilterDecision::Continue(_)
+            if status == StatusCode::OK && datadome_status == Some(status.as_u16()) =>
+        {
+            log::info!(
+                "[datadome] protection decision=allowed status={} method={} route=continue",
+                status.as_u16(),
+                method,
+            );
+        }
+        RequestFilterDecision::Continue(_) => {}
+    }
+}
+
 struct ProtectionPayload {
     fields: Vec<(String, String)>,
     uses_header_client_id: bool,
@@ -645,11 +772,18 @@ fn truncate_utf8(value: &str, limit: i32) -> String {
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;
+    use std::net::{IpAddr, Ipv4Addr};
     use std::sync::Arc;
 
-    use crate::integrations::datadome::DataDomeConfig;
+    use crate::integrations::datadome::{
+        DataDomeConfig, ProtectionExclusionRuleConfig, ProtectionMatcherConfig,
+        ProtectionTestBypassConfig,
+    };
+    use crate::platform::GeoInfo;
     use crate::platform::test_support::{
-        HashMapSecretStore, NoopConfigStore, NoopSecretStore, build_services_with_config_and_secret,
+        HashMapConfigStore, HashMapSecretStore, NoopConfigStore, NoopSecretStore, StubHttpClient,
+        build_services_with_config_and_secret, build_services_with_config_and_secret_and_client_ip,
+        build_services_with_secret_and_http_client, noop_services_with_client_ip,
     };
     use crate::settings::Settings;
 
@@ -664,6 +798,404 @@ mod tests {
         DataDomeIntegration::try_new(config).expect("should create integration")
     }
 
+    fn request_for_filter() -> Request<EdgeBody> {
+        request_builder()
+            .method(Method::GET.as_str())
+            .uri("https://publisher.example/page")
+            .body(EdgeBody::empty())
+            .expect("should build filter request")
+    }
+
+    fn filter_marks_request(
+        config: DataDomeConfig,
+        services: &RuntimeServices,
+    ) -> Request<EdgeBody> {
+        filter_marks_request_with_geo(config, services, None)
+    }
+
+    fn filter_marks_request_with_geo(
+        config: DataDomeConfig,
+        services: &RuntimeServices,
+        geo_info: Option<&GeoInfo>,
+    ) -> Request<EdgeBody> {
+        let integration =
+            DataDomeIntegration::try_new(config).expect("should create DataDome integration");
+        let settings = Settings::default();
+        let mut request = request_for_filter();
+        let decision = futures::executor::block_on(integration.filter_protection_request(
+            RequestFilterInput {
+                settings: &settings,
+                services,
+                request: &mut request,
+                geo_info,
+                is_integration_route: false,
+            },
+        ));
+        assert!(
+            matches!(decision, RequestFilterDecision::Continue(_)),
+            "an excluded request should continue without a Protection API response"
+        );
+        request
+    }
+
+    fn has_client_tag_suppression_marker(request: &Request<EdgeBody>) -> bool {
+        request
+            .extensions()
+            .get::<super::super::DataDomeClientTagSuppressed>()
+            .is_some()
+    }
+
+    #[test]
+    fn protection_test_bypass_skips_api_suppresses_tag_and_strips_header() {
+        let config = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_test_bypass: Some(ProtectionTestBypassConfig {
+                enabled: true,
+                credential_secret_store: "ts_secrets".to_string(),
+                credential_secret_name: "datadome_test_bypass".to_string(),
+            }),
+            ..DataDomeConfig::default()
+        };
+        let integration = DataDomeIntegration::try_new(config).expect("should create integration");
+        let mut secrets = HashMap::new();
+        secrets.insert(
+            "datadome_test_bypass".to_string(),
+            b"temporary-test-credential".to_vec(),
+        );
+        let http_client = Arc::new(StubHttpClient::new());
+        let services = build_services_with_secret_and_http_client(
+            HashMapSecretStore::new(secrets),
+            http_client.clone(),
+        );
+        let settings = Settings::default();
+        let mut request = request_for_filter();
+        request.headers_mut().insert(
+            super::super::HEADER_DATADOME_TEST_BYPASS,
+            edgezero_core::http::HeaderValue::from_static("temporary-test-credential"),
+        );
+
+        let decision = futures::executor::block_on(integration.filter_protection_request(
+            RequestFilterInput {
+                settings: &settings,
+                services: &services,
+                request: &mut request,
+                geo_info: None,
+                is_integration_route: false,
+            },
+        ));
+
+        assert!(
+            matches!(decision, RequestFilterDecision::Continue(_)),
+            "a matching test credential should continue without a challenge"
+        );
+        assert!(
+            has_client_tag_suppression_marker(&request),
+            "the bypass should suppress the automatic DataDome client tag"
+        );
+        assert!(
+            request
+                .headers()
+                .get(super::super::HEADER_DATADOME_TEST_BYPASS)
+                .is_none(),
+            "the bypass credential must not reach the publisher origin"
+        );
+        assert!(
+            http_client.recorded_backend_names().is_empty(),
+            "a matching test credential must not call the Protection API"
+        );
+    }
+
+    #[test]
+    fn protection_test_bypass_wins_over_other_exclusions() {
+        let config = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_exclusion_rules: vec![ProtectionExclusionRuleConfig {
+                id: "staging-page-exclusion".to_string(),
+                enabled: true,
+                methods: Vec::new(),
+                matcher: ProtectionMatcherConfig::PathExact {
+                    paths: vec!["/page".to_string()],
+                },
+            }],
+            protection_test_bypass: Some(ProtectionTestBypassConfig {
+                enabled: true,
+                credential_secret_store: "ts_secrets".to_string(),
+                credential_secret_name: "datadome_test_bypass".to_string(),
+            }),
+            ..DataDomeConfig::default()
+        };
+        let integration = DataDomeIntegration::try_new(config).expect("should create integration");
+        let mut secrets = HashMap::new();
+        secrets.insert(
+            "datadome_test_bypass".to_string(),
+            b"temporary-test-credential".to_vec(),
+        );
+        let http_client = Arc::new(StubHttpClient::new());
+        let services = build_services_with_secret_and_http_client(
+            HashMapSecretStore::new(secrets),
+            http_client.clone(),
+        );
+        let settings = Settings::default();
+        let mut request = request_for_filter();
+        request.headers_mut().insert(
+            super::super::HEADER_DATADOME_TEST_BYPASS,
+            edgezero_core::http::HeaderValue::from_static("temporary-test-credential"),
+        );
+
+        let decision = futures::executor::block_on(integration.filter_protection_request(
+            RequestFilterInput {
+                settings: &settings,
+                services: &services,
+                request: &mut request,
+                geo_info: None,
+                is_integration_route: false,
+            },
+        ));
+
+        assert!(
+            matches!(decision, RequestFilterDecision::Continue(_)),
+            "a matching test credential should continue"
+        );
+        assert!(
+            has_client_tag_suppression_marker(&request),
+            "a matching test credential should suppress the tag even on an excluded path"
+        );
+        assert!(
+            http_client.recorded_backend_names().is_empty(),
+            "a matching test credential must not call the Protection API"
+        );
+    }
+
+    #[test]
+    fn protection_test_bypass_strips_invalid_credential_without_bypassing() {
+        let config = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_test_bypass: Some(ProtectionTestBypassConfig {
+                enabled: true,
+                credential_secret_store: "ts_secrets".to_string(),
+                credential_secret_name: "datadome_test_bypass".to_string(),
+            }),
+            ..DataDomeConfig::default()
+        };
+        let integration = DataDomeIntegration::try_new(config).expect("should create integration");
+        let mut secrets = HashMap::new();
+        secrets.insert(
+            "datadome_server_side_key".to_string(),
+            b"server-side-key".to_vec(),
+        );
+        secrets.insert(
+            "datadome_test_bypass".to_string(),
+            b"temporary-test-credential".to_vec(),
+        );
+        let http_client = Arc::new(StubHttpClient::new());
+        http_client.push_response_with_headers(
+            200,
+            Vec::new(),
+            vec![(HEADER_DATADOME_RESPONSE, "200")],
+        );
+        let services = build_services_with_secret_and_http_client(
+            HashMapSecretStore::new(secrets),
+            http_client.clone(),
+        );
+        let settings = Settings::default();
+        let mut request = request_for_filter();
+        request.headers_mut().insert(
+            super::super::HEADER_DATADOME_TEST_BYPASS,
+            edgezero_core::http::HeaderValue::from_static("wrong-credential"),
+        );
+
+        let decision = futures::executor::block_on(integration.filter_protection_request(
+            RequestFilterInput {
+                settings: &settings,
+                services: &services,
+                request: &mut request,
+                geo_info: None,
+                is_integration_route: false,
+            },
+        ));
+
+        assert!(
+            matches!(decision, RequestFilterDecision::Continue(_)),
+            "an allowed Protection API response should continue"
+        );
+        assert!(
+            !has_client_tag_suppression_marker(&request),
+            "a non-matching credential must not suppress the DataDome client tag"
+        );
+        assert!(
+            request
+                .headers()
+                .get(super::super::HEADER_DATADOME_TEST_BYPASS)
+                .is_none(),
+            "an invalid bypass credential must not reach the publisher origin"
+        );
+        assert_eq!(
+            http_client.recorded_backend_names().len(),
+            1,
+            "a non-matching credential must still call the Protection API"
+        );
+    }
+
+    #[test]
+    fn ip_exclusions_mark_requests_for_client_tag_suppression() {
+        let ip = IpAddr::V4(Ipv4Addr::new(192, 0, 2, 10));
+        let mut inline = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_excluded_ip_cidrs: vec!["192.0.2.0/24".to_string()],
+            ..DataDomeConfig::default()
+        };
+        let inline_request =
+            filter_marks_request(inline.clone(), &noop_services_with_client_ip(ip));
+        assert!(
+            has_client_tag_suppression_marker(&inline_request),
+            "inline IP exclusions should mark the request"
+        );
+
+        inline.protection_excluded_ip_cidrs.clear();
+        inline.protection_excluded_ip_cidr_sources =
+            vec![super::super::ProtectionIpCidrSourceConfig {
+                config_store: "datadome-test-source".to_string(),
+                key: "inline-source".to_string(),
+            }];
+        let mut source_values = HashMap::new();
+        source_values.insert("inline-source".to_string(), "192.0.2.0/24".to_string());
+        let source_services = build_services_with_config_and_secret_and_client_ip(
+            HashMapConfigStore::new(source_values),
+            NoopSecretStore,
+            ip,
+        );
+        let source_request = filter_marks_request(inline, &source_services);
+        assert!(
+            has_client_tag_suppression_marker(&source_request),
+            "Config Store IP exclusions should mark the request"
+        );
+
+        let structured_ip = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_exclusion_rules: vec![ProtectionExclusionRuleConfig {
+                id: "structured-ip".to_string(),
+                enabled: true,
+                methods: Vec::new(),
+                matcher: ProtectionMatcherConfig::IpCidr {
+                    cidrs: vec!["192.0.2.0/24".to_string()],
+                },
+            }],
+            ..DataDomeConfig::default()
+        };
+        let structured_request =
+            filter_marks_request(structured_ip, &noop_services_with_client_ip(ip));
+        assert!(
+            has_client_tag_suppression_marker(&structured_request),
+            "structured IP exclusions should mark the request"
+        );
+
+        let structured_source = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_exclusion_rules: vec![ProtectionExclusionRuleConfig {
+                id: "structured-ip-source".to_string(),
+                enabled: true,
+                methods: Vec::new(),
+                matcher: ProtectionMatcherConfig::IpCidrSource {
+                    config_store: "datadome-test-source".to_string(),
+                    key: "structured-source".to_string(),
+                },
+            }],
+            ..DataDomeConfig::default()
+        };
+        let mut structured_values = HashMap::new();
+        structured_values.insert("structured-source".to_string(), "192.0.2.0/24".to_string());
+        let structured_services = build_services_with_config_and_secret_and_client_ip(
+            HashMapConfigStore::new(structured_values),
+            NoopSecretStore,
+            ip,
+        );
+        let structured_source_request =
+            filter_marks_request(structured_source, &structured_services);
+        assert!(
+            has_client_tag_suppression_marker(&structured_source_request),
+            "structured Config Store IP exclusions should mark the request"
+        );
+    }
+
+    #[test]
+    fn non_ip_exclusions_do_not_mark_requests_for_client_tag_suppression() {
+        let ip = IpAddr::V4(Ipv4Addr::new(192, 0, 2, 10));
+        let cases = [DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_exclusion_rules: vec![ProtectionExclusionRuleConfig {
+                id: "path".to_string(),
+                enabled: true,
+                methods: Vec::new(),
+                matcher: ProtectionMatcherConfig::PathExact {
+                    paths: vec!["/page".to_string()],
+                },
+            }],
+            ..DataDomeConfig::default()
+        }];
+
+        for config in cases {
+            let request = filter_marks_request(config, &noop_services_with_client_ip(ip));
+            assert!(
+                !has_client_tag_suppression_marker(&request),
+                "non-IP exclusions should not mark the request"
+            );
+        }
+    }
+
+    #[test]
+    fn asn_exclusions_do_not_mark_requests_for_client_tag_suppression() {
+        let config = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_excluded_asns: vec![64500],
+            ..DataDomeConfig::default()
+        };
+        let geo_info = GeoInfo {
+            city: String::new(),
+            country: String::new(),
+            continent: String::new(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: Some(64500),
+        };
+        let request = filter_marks_request_with_geo(
+            config,
+            &noop_services_with_client_ip(IpAddr::V4(Ipv4Addr::new(192, 0, 2, 10))),
+            Some(&geo_info),
+        );
+        assert!(
+            !has_client_tag_suppression_marker(&request),
+            "ASN exclusions should not mark the request"
+        );
+    }
+
+    #[test]
+    fn non_matching_ip_does_not_mark_request_for_client_tag_suppression() {
+        let config = DataDomeConfig {
+            enabled: true,
+            enable_protection: true,
+            protection_excluded_ip_cidrs: vec!["192.0.2.0/24".to_string()],
+            ..DataDomeConfig::default()
+        };
+        let request = filter_marks_request(
+            config,
+            &noop_services_with_client_ip(IpAddr::V4(Ipv4Addr::new(198, 51, 100, 10))),
+        );
+        assert!(
+            !has_client_tag_suppression_marker(&request),
+            "a non-matching IP should not mark the request"
+        );
+    }
+
     #[test]
     fn load_server_side_key_reads_secret_store() {
         let mut secrets = HashMap::new();
@@ -748,7 +1280,7 @@ mod tests {
         // the Protection API.
         let services = build_services_with_config_and_secret(NoopConfigStore, NoopSecretStore);
         let settings = Settings::default();
-        let request = request_builder()
+        let mut request = request_builder()
             .method(Method::OPTIONS.as_str())
             .uri("https://publisher.example/_ts/api/v1/identify")
             .body(EdgeBody::empty())
@@ -759,7 +1291,7 @@ mod tests {
             RequestFilterInput {
                 settings: &settings,
                 services: &services,
-                request: &request,
+                request: &mut request,
                 geo_info: None,
                 is_integration_route: false,
             },
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index 0644fb522..291a54242 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -327,7 +327,7 @@ pub trait IntegrationProxy: Send + Sync {
 pub struct RequestFilterInput<'a> {
     pub settings: &'a Settings,
     pub services: &'a RuntimeServices,
-    pub request: &'a Request<EdgeBody>,
+    pub request: &'a mut Request<EdgeBody>,
     pub geo_info: Option<&'a GeoInfo>,
     /// Whether the request matches a registered integration proxy route.
     pub is_integration_route: bool,
@@ -1345,6 +1345,8 @@ mod tests {
     }
 
     struct EnrichingRequestFilter;
+    #[derive(Clone, Copy)]
+    struct RequestAnnotation;
 
     #[async_trait(?Send)]
     impl IntegrationRequestFilter for EnrichingRequestFilter {
@@ -1354,8 +1356,9 @@ mod tests {
 
         async fn filter_request(
             &self,
-            _input: RequestFilterInput<'_>,
+            input: RequestFilterInput<'_>,
         ) -> Result<RequestFilterDecision, Report<TrustedServerError>> {
+            input.request.extensions_mut().insert(RequestAnnotation);
             Ok(RequestFilterDecision::Continue(RequestFilterEffects {
                 request_headers: vec![HeaderMutation::set("x-datadome-isbot", "1")],
                 response_headers: vec![HeaderMutation::set("x-dd-b", "allowed")],
@@ -1487,6 +1490,10 @@ mod tests {
             Some("1"),
             "should apply DataDome-style request enrichment before routing"
         );
+        assert!(
+            req.extensions().get::<RequestAnnotation>().is_some(),
+            "should preserve private request annotations for downstream routing"
+        );
         match outcome {
             RequestFilterRegistryOutcome::Continue(effects) => {
                 assert_eq!(
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 70a4d6cfd..edc9a3c0a 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -70,6 +70,7 @@ pub mod streaming_processor;
 pub mod streaming_replacer;
 pub mod test_support;
 pub mod tester_cookie;
+pub mod trace_cookie;
 pub mod tsjs;
 
 #[cfg(test)]
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index 50bbe75fb..10389c787 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -631,6 +631,25 @@ pub(crate) fn build_services_with_config_and_secret(
         .build()
 }
 
+pub(crate) fn build_services_with_config_and_secret_and_client_ip(
+    config_store: impl PlatformConfigStore + 'static,
+    secret_store: impl PlatformSecretStore + 'static,
+    client_ip: IpAddr,
+) -> RuntimeServices {
+    RuntimeServices::builder()
+        .config_store(Arc::new(config_store))
+        .secret_store(Arc::new(secret_store))
+        .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+        .backend(Arc::new(NoopBackend))
+        .http_client(Arc::new(NoopHttpClient))
+        .geo(Arc::new(NoopGeo))
+        .client_info(ClientInfo {
+            client_ip: Some(client_ip),
+            ..ClientInfo::default()
+        })
+        .build()
+}
+
 pub(crate) fn build_request_signing_services() -> RuntimeServices {
     let signing_key = SigningKey::generate(&mut OsRng);
     let key_b64 = general_purpose::STANDARD.encode(signing_key.as_bytes());
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 6872e412a..28ddb1f76 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -358,6 +358,7 @@ struct ProcessResponseParams<'a> {
     integration_registry: &'a IntegrationRegistry,
     ad_slots_script: Option<&'a str>,
     ad_bids_state: &'a Arc<Mutex<Option<String>>>,
+    suppress_datadome_client_side_tag: bool,
     gpt_diagnostics:
         Option<&'a crate::integrations::gpt_diagnostics::GptDiagnosticsRequestDecision>,
 }
@@ -384,6 +385,7 @@ impl PublisherBodyProcessor {
                 integration_registry,
                 ad_slots_script: params.ad_slots_script.as_deref().map(str::to_string),
                 ad_bids_state: Arc::clone(&params.ad_bids_state),
+                suppress_datadome_client_side_tag: params.suppress_datadome_client_side_tag,
                 gpt_diagnostics: params.gpt_diagnostics.clone(),
             })?)
         } else if is_rsc_flight {
@@ -461,6 +463,7 @@ fn process_response_streaming<W: Write>(
             integration_registry: params.integration_registry,
             ad_slots_script: params.ad_slots_script.map(str::to_string),
             ad_bids_state: params.ad_bids_state.clone(),
+            suppress_datadome_client_side_tag: params.suppress_datadome_client_side_tag,
             gpt_diagnostics: params.gpt_diagnostics.cloned(),
         })?;
         StreamingPipeline::new(config, processor)
@@ -945,6 +948,7 @@ struct HtmlStreamProcessorParams<'a> {
     integration_registry: &'a IntegrationRegistry,
     ad_slots_script: Option<String>,
     ad_bids_state: Arc<Mutex<Option<String>>>,
+    suppress_datadome_client_side_tag: bool,
     gpt_diagnostics: Option<crate::integrations::gpt_diagnostics::GptDiagnosticsRequestDecision>,
 }
 
@@ -961,7 +965,8 @@ fn create_html_stream_processor(
         params.request_scheme,
     )
     .with_ad_state(params.ad_slots_script, params.ad_bids_state)
-    .with_gpt_diagnostics(params.gpt_diagnostics);
+    .with_gpt_diagnostics(params.gpt_diagnostics)
+    .with_datadome_client_tag_suppression(params.suppress_datadome_client_side_tag);
 
     Ok(create_html_processor(config))
 }
@@ -1082,6 +1087,8 @@ pub struct OwnedProcessResponseParams {
     pub(crate) dispatched_auction: Option<DispatchedAuction>,
     /// Price granularity used to bucket bids when building `tsjs.bids`.
     pub(crate) price_granularity: PriceGranularity,
+    /// Whether to omit Trusted Server's automatic `DataDome` client-side tag.
+    pub(crate) suppress_datadome_client_side_tag: bool,
     /// Request-scoped conditional diagnostics delivery decision.
     pub(crate) gpt_diagnostics:
         Option<crate::integrations::gpt_diagnostics::GptDiagnosticsRequestDecision>,
@@ -1432,6 +1439,37 @@ fn response_carries_body(method: &Method, status: StatusCode) -> bool {
         && status != StatusCode::NOT_MODIFIED
 }
 
+/// Prevent shared caches from replaying tag-suppressed HTML to other clients.
+fn apply_datadome_client_tag_cache_privacy(
+    response: &mut Response<EdgeBody>,
+    method: &Method,
+    suppress_datadome_client_side_tag: bool,
+    content_type: &str,
+) {
+    if !suppress_datadome_client_side_tag
+        || !response_carries_body(method, response.status())
+        || !is_html_content_type(content_type)
+    {
+        return;
+    }
+
+    let already_uncacheable = response
+        .headers()
+        .get(header::CACHE_CONTROL)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_ascii_lowercase)
+        .is_some_and(|value| value.contains("private") || value.contains("no-store"));
+    if !already_uncacheable {
+        response.headers_mut().insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("private, max-age=0"),
+        );
+    }
+    for header_name in CDN_CACHE_HEADERS {
+        response.headers_mut().remove(*header_name);
+    }
+}
+
 /// Drop a bodiless response's body and correct its framing headers.
 ///
 /// The response keeps no body, and its `Content-Length` is corrected where the
@@ -1548,6 +1586,7 @@ pub fn stream_publisher_body<W: Write>(
         integration_registry,
         ad_slots_script: params.ad_slots_script.as_deref(),
         ad_bids_state: &params.ad_bids_state,
+        suppress_datadome_client_side_tag: params.suppress_datadome_client_side_tag,
         gpt_diagnostics: params.gpt_diagnostics.as_ref(),
     };
     process_response_streaming(body, output, &borrowed)
@@ -1641,6 +1680,7 @@ pub async fn stream_publisher_body_async<W: Write>(
         integration_registry,
         ad_slots_script: params.ad_slots_script.as_deref().map(str::to_string),
         ad_bids_state: params.ad_bids_state.clone(),
+        suppress_datadome_client_side_tag: params.suppress_datadome_client_side_tag,
         gpt_diagnostics: params.gpt_diagnostics.clone(),
     }) {
         Ok(processor) => processor,
@@ -1752,30 +1792,36 @@ pub(crate) fn is_prefetch_request(req: &Request<EdgeBody>) -> bool {
     header("sec-purpose") || header("purpose")
 }
 
-/// Returns true only when the publisher request should run the full
-/// server-side ad stack: auction dispatch plus initial ad-slot injection.
+#[derive(Debug, Clone, Copy)]
+struct ServerSideAdStackConfig {
+    /// Dedicated `[creative_opportunities].enabled` switch.
+    ad_templates_enabled: bool,
+    /// Global `[auction].enabled` gate used by publisher/page-bids flows.
+    auction_enabled: bool,
+}
+
+/// Returns true only when the publisher should inject and run server-side ad templates.
 ///
-/// `auction_enabled` is the global `[auction].enabled` kill switch — when
-/// false, no automatic server-side auction or ad-slot injection runs.
-pub(crate) fn should_run_server_side_ad_stack(
+/// This includes auction dispatch plus initial ad-slot injection.
+fn should_run_server_side_ad_stack(
     is_get: bool,
     is_navigation: bool,
     is_prefetch: bool,
     is_bot: bool,
     has_matched_slots: bool,
     consent_allows_auction: bool,
-    auction_enabled: bool,
+    config: ServerSideAdStackConfig,
 ) -> bool {
     is_get
         && is_navigation
         && !is_prefetch
         && !is_bot
+        && config.ad_templates_enabled
         && has_matched_slots
         && consent_allows_auction
-        && auction_enabled
+        && config.auction_enabled
 }
 
-/// Write winning bids from an auction result into the shared `ad_bids_state` lock.
 /// Build the request origin (`scheme://host`, where `host` includes any port)
 /// used to emit absolute first-party URLs in inline creatives. Returns an empty
 /// string when the scheme or host is unknown, so callers fall back to the
@@ -1788,6 +1834,7 @@ fn request_origin(scheme: &str, host: &str) -> String {
     }
 }
 
+/// Write winning bids from an auction result into the shared `ad_bids_state` lock.
 pub(crate) fn write_bids_to_state(
     winning_bids: &std::collections::HashMap<String, Bid>,
     price_granularity: PriceGranularity,
@@ -2643,13 +2690,17 @@ pub async fn handle_publisher_request(
 
     log::debug!("Proxying request to configured publisher backend");
 
+    let request_path_and_query = origin_path_and_query.to_string();
     let request_path = req.uri().path().to_string();
     let is_get = req.method() == http::Method::GET;
 
     let is_prefetch = is_prefetch_request(&req);
     let is_bot = is_bot_user_agent(&req);
 
-    let matched_slots = if is_get {
+    let creative_opportunities = settings.creative_opportunities.as_ref();
+    let ad_templates_enabled = creative_opportunities.is_some_and(|co_config| co_config.enabled);
+    let ad_templates_disabled = creative_opportunities.is_some_and(|co_config| !co_config.enabled);
+    let matched_slots = if is_get && ad_templates_enabled {
         settings
             .creative_opportunities
             .as_ref()
@@ -2672,7 +2723,10 @@ pub async fn handle_publisher_request(
         is_bot,
         !matched_slots.is_empty(),
         consent_allows_auction,
-        auction.orchestrator.is_enabled(),
+        ServerSideAdStackConfig {
+            ad_templates_enabled,
+            auction_enabled: auction.orchestrator.is_enabled(),
+        },
     );
     let should_run_auction = should_run_ad_stack;
     // Diagnostic: shows which gate suppresses the server-side auction. Pair with
@@ -2680,14 +2734,16 @@ pub async fn handle_publisher_request(
     // when `consent_allows_auction=false`.
     log::debug!(
         "server-side ad-stack gate: is_get={is_get} is_navigation={is_navigation} \
-         is_prefetch={is_prefetch} is_bot={is_bot} matched_slots={} \
-         consent_allows_auction={consent_allows_auction} orchestrator_enabled={} \
-         -> should_run_auction={should_run_auction}",
+         is_prefetch={is_prefetch} is_bot={is_bot} ad_templates_enabled={ad_templates_enabled} \
+         matched_slots={} consent_allows_auction={consent_allows_auction} \
+         orchestrator_enabled={} -> should_run_auction={should_run_auction}",
         matched_slots.len(),
         auction.orchestrator.is_enabled(),
     );
 
-    if matched_slots.is_empty() && settings.creative_opportunities.is_some() {
+    if ad_templates_disabled {
+        log::debug!("Server-side ad templates are disabled by configuration");
+    } else if matched_slots.is_empty() && settings.creative_opportunities.is_some() {
         log::debug!(
             "No creative opportunity slots matched path '{}' — skipping auction and injection",
             request_path
@@ -2733,7 +2789,7 @@ pub async fn handle_publisher_request(
         if should_run_auction {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &request_path,
+                request_path_and_query: &request_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -2812,7 +2868,9 @@ pub async fn handle_publisher_request(
                 }
             }
         } else {
-            let skip_reason = if !auction.orchestrator.is_enabled() {
+            let skip_reason = if ad_templates_disabled {
+                "ad_templates_disabled"
+            } else if !auction.orchestrator.is_enabled() {
                 "auction_disabled"
             } else if !consent_allows_auction {
                 "consent_denied"
@@ -2876,6 +2934,15 @@ pub async fn handle_publisher_request(
     // sets the flag unconditionally and tolerates buffered fallback): adapters
     // without streaming support may reject the flag outright rather than
     // silently buffering, which would fail every publisher fetch.
+    let request_method = req.method().clone();
+    let suppress_datadome_client_side_tag = req
+        .extensions()
+        .get::<crate::integrations::datadome::DataDomeClientTagSuppressed>()
+        .is_some();
+    if suppress_datadome_client_side_tag {
+        req.headers_mut().remove(header::IF_NONE_MATCH);
+        req.headers_mut().remove(header::IF_MODIFIED_SINCE);
+    }
     let mut platform_request = PlatformHttpRequest::new(req, backend_name);
     if services.http_client().supports_streaming_responses() {
         platform_request = platform_request.with_stream_response();
@@ -2949,33 +3016,49 @@ pub async fn handle_publisher_request(
     //
     // Gate on `should_run_ad_stack` rather than content-type alone: when no slot
     // matched, the feature is disabled, or this is not an ad-eligible navigation,
-    // no per-user `tsjs.adSlots`/`tsjs.bids` are injected, so forcing private
-    // here would needlessly strip shared cacheability from ordinary publisher
-    // HTML. Applies regardless of the auction *outcome* (empty bids still inject
-    // per-user slot state). The separate EC-cookie cache net in the adapter's
-    // `finalize_response` keeps first-visit identity responses private.
+    // no per-user `tsjs.adSlots`/`tsjs.bids` are injected. Applies regardless of
+    // the auction *outcome* (empty bids still inject per-user slot state). The
+    // separate EC-cookie cache net in the adapter's `finalize_response` keeps
+    // first-visit identity responses private.
     let origin_content_type = response
         .headers()
         .get(header::CONTENT_TYPE)
         .and_then(|h| h.to_str().ok())
         .unwrap_or_default();
-    if should_run_ad_stack && is_html_content_type(origin_content_type) {
-        response.headers_mut().insert(
-            header::CACHE_CONTROL,
-            HeaderValue::from_static("private, no-store"),
-        );
-        response.headers_mut().remove(header::ETAG);
-        response.headers_mut().remove(header::LAST_MODIFIED);
-        // Every CDN-targeted cache directive, not just the browser-facing
-        // `Cache-Control` above: an origin emitting any of these would otherwise
-        // instruct an intermediary to store a synthesized per-navigation
-        // document. `Surrogate-Control` and `Fastly-Surrogate-Control` cover
-        // Fastly; `CDN-Cache-Control` is the standard targeted field (RFC 9213)
-        // and `Cloudflare-CDN-Cache-Control` is the Cloudflare-specific field
-        // that overrides it there, so both are needed to close the gap on the
-        // Cloudflare adapter.
-        for directive in CDN_CACHE_HEADERS {
-            response.headers_mut().remove(*directive);
+    if is_html_content_type(origin_content_type) {
+        if should_run_ad_stack {
+            response.headers_mut().insert(
+                header::CACHE_CONTROL,
+                HeaderValue::from_static("private, no-store"),
+            );
+            response.headers_mut().remove(header::ETAG);
+            response.headers_mut().remove(header::LAST_MODIFIED);
+            // Every CDN-targeted cache directive, not just the browser-facing
+            // `Cache-Control` above: an origin emitting any of these would otherwise
+            // instruct an intermediary to store a synthesized per-navigation
+            // document. `Surrogate-Control` and `Fastly-Surrogate-Control` cover
+            // Fastly; `CDN-Cache-Control` is the standard targeted field (RFC 9213)
+            // and `Cloudflare-CDN-Cache-Control` is the Cloudflare-specific field
+            // that overrides it there, so both are needed to close the gap on the
+            // Cloudflare adapter.
+            for directive in CDN_CACHE_HEADERS {
+                response.headers_mut().remove(*directive);
+            }
+        } else {
+            let origin_cache_control = response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok())
+                .map(str::to_ascii_lowercase);
+            if !origin_cache_control
+                .as_deref()
+                .is_some_and(|value| value.contains("private") || value.contains("no-store"))
+            {
+                response.headers_mut().insert(
+                    header::CACHE_CONTROL,
+                    HeaderValue::from_static("max-age=60"),
+                );
+            }
         }
     }
 
@@ -3068,6 +3151,12 @@ pub async fn handle_publisher_request(
                 content_encoding
             );
 
+            apply_datadome_client_tag_cache_privacy(
+                &mut response,
+                &request_method,
+                suppress_datadome_client_side_tag,
+                &content_type,
+            );
             let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
             response.headers_mut().remove(header::CONTENT_LENGTH);
 
@@ -3083,6 +3172,7 @@ pub async fn handle_publisher_request(
                     content_type,
                     ad_slots_script: ad_slots_script.clone(),
                     ad_bids_state: ad_bids_state.clone(),
+                    suppress_datadome_client_side_tag,
                     auction_observation,
                     auction_request: auction_request_for_telemetry,
                     dispatched_auction,
@@ -3097,11 +3187,11 @@ pub async fn handle_publisher_request(
 /// Bundle of the per-request creative-opportunity inputs that travel together.
 ///
 /// Extracted so `build_auction_request` stays under the project's
-/// 7-argument cap (`matched_slots` + `request_path` live for the same
+/// 7-argument cap (`matched_slots` + `request_path_and_query` live for the same
 /// request scope and are passed together everywhere).
 pub(crate) struct MatchedSlotsContext<'a> {
     pub matched_slots: &'a [crate::creative_opportunities::CreativeOpportunitySlot],
-    pub request_path: &'a str,
+    pub request_path_and_query: &'a str,
 }
 
 /// Borrowed inputs for [`apply_auction_eids_and_device`], bundled to keep the
@@ -3188,7 +3278,7 @@ pub(crate) fn build_auction_request(
     // server edge host, which must not leak into the bid request.
     let page_candidate = format!(
         "{}://{}{}",
-        request_info.scheme, publisher_domain, slots_ctx.request_path
+        request_info.scheme, publisher_domain, slots_ctx.request_path_and_query
     );
     let page_url = sanitize_publisher_page_url(Some(&page_candidate), publisher_domain);
     let ec_id = ec_id.filter(|id| !id.is_empty());
@@ -3301,7 +3391,7 @@ pub(crate) fn build_bid_map(
     )
 }
 
-pub(crate) fn build_bid_map_with_auction_id(
+fn build_bid_map_with_auction_id(
     winning_bids: &std::collections::HashMap<String, Bid>,
     granularity: crate::price_bucket::PriceGranularity,
     settings: &Settings,
@@ -3330,7 +3420,7 @@ pub(crate) fn build_bid_map_with_auction_id(
                     "hb_bidder".to_string(),
                     serde_json::Value::String(bid.bidder.clone()),
                 );
-                if let Some(auction_id) = auction_id {
+                if let Some(auction_id) = auction_id.filter(|id| !id.is_empty()) {
                     obj.insert(
                         "hb_auction_id".to_string(),
                         serde_json::Value::String(auction_id.to_owned()),
@@ -3362,6 +3452,18 @@ pub(crate) fn build_bid_map_with_auction_id(
                     .or_else(|| renderer_bid_id.and_then(|id| non_empty(Some(id))))
                     .or_else(|| non_empty(bid.ad_id.as_deref()))
                     .or_else(|| non_empty(bid.bid_id.as_deref()));
+                if let Some(bid_id) = bid.bid_id.as_ref() {
+                    obj.insert(
+                        "hb_bid_id".to_string(),
+                        serde_json::Value::String(bid_id.clone()),
+                    );
+                }
+                if let Some(creative_id) = bid.creative_id.as_ref() {
+                    obj.insert(
+                        "hb_crid".to_string(),
+                        serde_json::Value::String(creative_id.clone()),
+                    );
+                }
                 if let Some(id) = hb_adid {
                     // GAM drops an over-long targeting value, so the creative
                     // echoes nothing and the bridge's equality check never
@@ -3511,7 +3613,9 @@ pub(crate) fn build_bid_map_with_auction_id(
                             "height": bid.height,
                             "nurl": bid.nurl,
                             "burl": bid.burl,
+                            "bid_id": bid.bid_id,
                             "ad_id": bid.ad_id,
+                            "creative_id": bid.creative_id,
                             "cache_id": bid.cache_id,
                             "cache_host": bid.cache_host,
                             "cache_path": bid.cache_path,
@@ -3788,8 +3892,8 @@ pub fn page_bids_preflight_denied() -> Response<EdgeBody> {
 
 /// Normalizes the client-supplied `path` query parameter before glob matching.
 ///
-/// The SPA hook sends `location.pathname`, but the parameter is
-/// client-controlled: strip any query string or fragment and force a leading
+/// The SPA hook sends `location.pathname + location.search`, but the parameter
+/// is client-controlled: strip any query string or fragment and force a leading
 /// `/` so slot `page_patterns` always match against a canonical path shape.
 fn normalize_page_bids_path(raw: &str) -> String {
     let path = raw.split(['?', '#']).next().unwrap_or("");
@@ -3800,6 +3904,20 @@ fn normalize_page_bids_path(raw: &str) -> String {
     }
 }
 
+/// Normalize the page path and query retained in the upstream auction context.
+///
+/// Fragments never reach an HTTP server and are discarded if a client includes
+/// one explicitly. Unlike [`normalize_page_bids_path`], the query is preserved
+/// for the `OpenRTB` `site.page` URL and is not used for slot matching.
+fn normalize_page_bids_path_and_query(raw: &str) -> String {
+    let path_and_query = raw.split('#').next().unwrap_or("");
+    if path_and_query.starts_with('/') {
+        path_and_query.to_string()
+    } else {
+        format!("/{path_and_query}")
+    }
+}
+
 /// Handle `GET /_ts/page-bids?path=<path>` — server-side auction for SPA navigation.
 ///
 /// Matches creative opportunity slots for the given path, runs a server-side
@@ -3890,17 +4008,23 @@ pub async fn handle_page_bids(
     let request_info = RequestInfo::from_request(&req, services.client_info());
     let page_bids_request_origin = request_origin(&request_info.scheme, &request_info.host);
 
-    let path_param = req
+    let requested_page = req
         .uri()
         .query()
         .and_then(|query| {
             url::form_urlencoded::parse(query.as_bytes())
-                .find(|(k, _)| k == "path")
-                .map(|(_, v)| normalize_page_bids_path(&v))
+                .find(|(key, _)| key == "path")
+                .map(|(_, value)| value.into_owned())
         })
         .unwrap_or_else(|| "/".to_string());
+    let path_param = normalize_page_bids_path(&requested_page);
+    let page_path_and_query = normalize_page_bids_path_and_query(&requested_page);
 
-    let matched_slots = match_renderable_slots(auction.slots, co_config, &path_param);
+    let matched_slots = if co_config.enabled {
+        match_renderable_slots(auction.slots, co_config, &path_param)
+    } else {
+        Vec::new()
+    };
 
     let request_info = crate::http_util::RequestInfo::from_request(&req, services.client_info());
     let ec_id = ec_context.ec_value().filter(|_| ec_context.ec_allowed());
@@ -3919,7 +4043,10 @@ pub async fn handle_page_bids(
     let is_bot = is_bot_user_agent(&req);
 
     let auction_enabled = auction.orchestrator.is_enabled();
-    if !auction_enabled {
+    let ad_templates_enabled = co_config.enabled;
+    if !ad_templates_enabled {
+        log::debug!("page-bids: [creative_opportunities].enabled is false — skipping templates");
+    } else if !auction_enabled {
         log::debug!("page-bids: [auction].enabled is false — skipping auction");
     } else if matched_slots.is_empty() {
         log::debug!(
@@ -3935,14 +4062,14 @@ pub async fn handle_page_bids(
         );
     }
 
-    // The [auction].enabled kill switch and a consent denial disable the entire
-    // server-side ad stack. In those states the endpoint must return no slots,
-    // so the SPA hook does not assign `ts.adSlots` and call `adInit()` —
-    // otherwise the kill switch/consent gate would stop SSP calls but still let
-    // the client create/refresh GPT slots. Bot/prefetch requests, by contrast,
-    // keep their slot definitions (the placement structure is unchanged) but
-    // skip the live auction, matching the existing bot/prefetch behaviour.
-    let ad_stack_enabled = auction_enabled && consent_allows_auction;
+    // The dedicated template switch, [auction].enabled, and a consent denial
+    // disable the entire server-side ad stack. In those states the endpoint must
+    // return no slots, so the SPA hook does not assign `ts.adSlots` and call
+    // `adInit()` — otherwise the gate would stop SSP calls but still let the
+    // client create/refresh GPT slots client-side. Bot/prefetch requests, by
+    // contrast, keep their slot definitions (the placement structure is
+    // unchanged) but skip the live auction, matching the existing behavior.
+    let ad_stack_enabled = ad_templates_enabled && auction_enabled && consent_allows_auction;
 
     let (winning_bids, prebuilt_bid_map) = if matched_slots.is_empty() {
         (std::collections::HashMap::new(), None)
@@ -3959,7 +4086,7 @@ pub async fn handle_page_bids(
         if ad_stack_enabled && !is_bot && !is_prefetch {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &path_param,
+                request_path_and_query: &page_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -4043,7 +4170,9 @@ pub async fn handle_page_bids(
                 }
             }
         } else {
-            let skip_reason = if !auction_enabled {
+            let skip_reason = if !ad_templates_enabled {
+                "ad_templates_disabled"
+            } else if !auction_enabled {
                 "auction_disabled"
             } else if !consent_allows_auction {
                 "consent_denied"
@@ -4444,6 +4573,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: Default::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         }
     }
 
@@ -4802,6 +4932,15 @@ mod tests {
                 .expect("should parse settings with auction and creative opportunities enabled")
         }
 
+        fn settings_with_disabled_ad_templates() -> Settings {
+            let toml = format!(
+                "{}\n[auction]\nenabled = true\n\n\
+                 [creative_opportunities]\nenabled = false\ngam_network_id = \"12345\"\n",
+                crate_test_settings_str()
+            );
+            Settings::from_toml(&toml).expect("should parse settings with disabled ad templates")
+        }
+
         fn settings_with_dispatching_provider() -> Settings {
             let toml = format!(
                 "{}\n[auction]\nenabled = true\nproviders = [\"{UNEXPECTED_304_PROVIDER}\"]\n\n\
@@ -4860,13 +4999,16 @@ mod tests {
                 .expect("should build conditional navigation request")
         }
 
-        fn queue_cacheable_html_response(stub: &StubHttpClient) {
+        fn queue_html_response_with_cache_control(
+            stub: &StubHttpClient,
+            cache_control: &'static str,
+        ) {
             stub.push_response_with_headers(
                 200,
                 b"<html><body>origin</body></html>".to_vec(),
                 vec![
                     ("content-type", "text/html; charset=utf-8"),
-                    ("cache-control", "public, max-age=300"),
+                    ("cache-control", cache_control),
                     ("etag", ORIGIN_ETAG),
                     ("last-modified", ORIGIN_LAST_MODIFIED),
                     ("surrogate-control", "max-age=300"),
@@ -4936,7 +5078,7 @@ mod tests {
             // Arrange
             let settings = settings_with_enabled_auction_and_creative_opportunities();
             let stub = Arc::new(StubHttpClient::new());
-            queue_cacheable_html_response(&stub);
+            queue_html_response_with_cache_control(&stub, "public, max-age=300");
             let services = build_services_with_http_client(
                 Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
             );
@@ -5029,11 +5171,11 @@ mod tests {
         }
 
         #[tokio::test]
-        async fn navigation_without_matched_slots_preserves_origin_cache_policy() {
+        async fn navigation_without_matched_slots_uses_short_browser_cache_policy() {
             // Arrange
             let settings = settings_with_enabled_auction_and_creative_opportunities();
             let stub = Arc::new(StubHttpClient::new());
-            queue_cacheable_html_response(&stub);
+            queue_html_response_with_cache_control(&stub, "public, max-age=300");
             let services = build_services_with_http_client(
                 Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
             );
@@ -5079,7 +5221,7 @@ mod tests {
             );
 
             for (header_name, expected) in [
-                (header::CACHE_CONTROL, "public, max-age=300"),
+                (header::CACHE_CONTROL, "max-age=60"),
                 (header::ETAG, ORIGIN_ETAG),
                 (header::LAST_MODIFIED, ORIGIN_LAST_MODIFIED),
                 (
@@ -5110,6 +5252,102 @@ mod tests {
             }
         }
 
+        #[tokio::test]
+        async fn disabled_ad_templates_use_short_browser_cache_policy() {
+            // Arrange
+            let settings = settings_with_disabled_ad_templates();
+            let stub = Arc::new(StubHttpClient::new());
+            queue_html_response_with_cache_control(&stub, "public, max-age=300");
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            let slots = [article_slot()];
+
+            // Act
+            let response = run_with_slots(
+                &settings,
+                &services,
+                &slots,
+                conditional_navigation_request(),
+            )
+            .await;
+            let response_head = response_head(response);
+
+            // Assert
+            assert_eq!(
+                stub.recorded_cache_bypass_flags(),
+                vec![false],
+                "disabled server-side ad templates should not bypass the origin cache"
+            );
+            assert_eq!(
+                response_head
+                    .headers
+                    .get(header::CACHE_CONTROL)
+                    .and_then(|value| value.to_str().ok()),
+                Some("max-age=60"),
+                "disabled server-side ad templates should use the short browser cache policy"
+            );
+            for (header_name, expected) in [
+                (header::ETAG, ORIGIN_ETAG),
+                (header::LAST_MODIFIED, ORIGIN_LAST_MODIFIED),
+                (
+                    header::HeaderName::from_static("surrogate-control"),
+                    "max-age=300",
+                ),
+                (
+                    header::HeaderName::from_static("fastly-surrogate-control"),
+                    "max-age=300",
+                ),
+                (
+                    header::HeaderName::from_static("cdn-cache-control"),
+                    "max-age=300",
+                ),
+                (
+                    header::HeaderName::from_static("cloudflare-cdn-cache-control"),
+                    "max-age=300",
+                ),
+            ] {
+                assert_eq!(
+                    response_head
+                        .headers
+                        .get(&header_name)
+                        .and_then(|value| value.to_str().ok()),
+                    Some(expected),
+                    "disabled server-side ad templates should preserve {header_name}"
+                );
+            }
+        }
+
+        #[tokio::test]
+        async fn navigation_without_matched_slots_preserves_private_origin_cache_policy() {
+            let settings = settings_with_enabled_auction_and_creative_opportunities();
+
+            for cache_control in ["private, max-age=0", "No-Store"] {
+                // Arrange
+                let stub = Arc::new(StubHttpClient::new());
+                queue_html_response_with_cache_control(&stub, cache_control);
+                let services = build_services_with_http_client(
+                    Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+                );
+
+                // Act
+                let response =
+                    run_with_slots(&settings, &services, &[], conditional_navigation_request())
+                        .await;
+                let response_head = response_head(response);
+
+                // Assert
+                assert_eq!(
+                    response_head
+                        .headers
+                        .get(header::CACHE_CONTROL)
+                        .and_then(|value| value.to_str().ok()),
+                    Some(cache_control),
+                    "origin {cache_control} policy should not be weakened"
+                );
+            }
+        }
+
         #[tokio::test]
         async fn eligible_navigation_rejects_unexpected_origin_304() {
             for content_type in [None, Some("text/html; charset=utf-8")] {
@@ -5437,6 +5675,154 @@ mod tests {
         );
     }
 
+    #[test]
+    fn suppressed_datadome_tag_reaches_publisher_html_pipeline() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                "datadome",
+                &serde_json::json!({
+                    "enabled": true,
+                    "client_side_key": "test-client-key",
+                }),
+            )
+            .expect("should configure DataDome integration");
+        let registry = IntegrationRegistry::new(&settings)
+            .expect("should create integration registry with DataDome");
+        let mut params = make_stream_params(&settings, "identity");
+        params.content_type = "text/html; charset=utf-8".to_string();
+        params.suppress_datadome_client_side_tag = true;
+        let mut output = Vec::new();
+
+        stream_publisher_body(
+            EdgeBody::from(b"<html><head></head><body>content</body></html>".to_vec()),
+            &mut output,
+            &params,
+            &settings,
+            &registry,
+        )
+        .expect("should process suppressed HTML");
+
+        let html = String::from_utf8(output).expect("should produce UTF-8 HTML");
+        assert!(
+            !html.contains("window.ddjskey"),
+            "publisher processing should omit the DataDome client configuration"
+        );
+        assert!(
+            !html.contains("/integrations/datadome/tags.js"),
+            "publisher processing should omit the DataDome client tag URL"
+        );
+    }
+
+    #[test]
+    fn suppressed_datadome_html_is_private_and_not_shared_cached() {
+        let mut response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CACHE_CONTROL, "public, max-age=600")
+            .header("surrogate-control", "max-age=600")
+            .header("fastly-surrogate-control", "max-age=600")
+            .header("cloudflare-cdn-cache-control", "max-age=600")
+            .header("cdn-cache-control", "max-age=600")
+            .body(EdgeBody::empty())
+            .expect("should build cacheable HTML response");
+
+        super::apply_datadome_client_tag_cache_privacy(
+            &mut response,
+            &Method::GET,
+            true,
+            "text/html; charset=utf-8",
+        );
+
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok()),
+            Some("private, max-age=0"),
+            "suppressed HTML should be private"
+        );
+        assert!(
+            response.headers().get("surrogate-control").is_none(),
+            "suppressed HTML should not retain Surrogate-Control"
+        );
+        assert!(
+            response.headers().get("fastly-surrogate-control").is_none(),
+            "suppressed HTML should not retain Fastly-Surrogate-Control"
+        );
+        assert!(
+            response
+                .headers()
+                .get("cloudflare-cdn-cache-control")
+                .is_none(),
+            "suppressed HTML should not retain Cloudflare-CDN-Cache-Control"
+        );
+        assert!(
+            response.headers().get("cdn-cache-control").is_none(),
+            "suppressed HTML should not retain CDN-Cache-Control"
+        );
+
+        let mut no_store_response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CACHE_CONTROL, "no-store")
+            .body(EdgeBody::empty())
+            .expect("should build no-store HTML response");
+        super::apply_datadome_client_tag_cache_privacy(
+            &mut no_store_response,
+            &Method::GET,
+            true,
+            "text/html; charset=utf-8",
+        );
+        assert_eq!(
+            no_store_response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok()),
+            Some("no-store"),
+            "suppressed HTML should preserve an existing no-store policy"
+        );
+    }
+
+    #[test]
+    fn datadome_cache_privacy_does_not_change_non_html_or_unsuppressed_responses() {
+        let mut response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CACHE_CONTROL, "public, max-age=600")
+            .header("surrogate-control", "max-age=600")
+            .body(EdgeBody::empty())
+            .expect("should build cacheable response");
+
+        super::apply_datadome_client_tag_cache_privacy(
+            &mut response,
+            &Method::GET,
+            false,
+            "text/html; charset=utf-8",
+        );
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok()),
+            Some("public, max-age=600"),
+            "unsuppressed HTML should retain its existing cache policy"
+        );
+
+        super::apply_datadome_client_tag_cache_privacy(
+            &mut response,
+            &Method::GET,
+            true,
+            "text/css",
+        );
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok()),
+            Some("public, max-age=600"),
+            "non-HTML should retain its existing cache policy"
+        );
+    }
+
     #[test]
     fn response_carries_body_preserves_bodiless_metadata() {
         // A processable GET 200 buffers a body and recomputes Content-Length.
@@ -5564,39 +5950,69 @@ mod tests {
 
     #[test]
     fn server_side_ad_stack_runs_only_when_all_auction_gates_pass() {
+        let enabled_config = ServerSideAdStackConfig {
+            ad_templates_enabled: true,
+            auction_enabled: true,
+        };
         assert!(
-            should_run_server_side_ad_stack(true, true, false, false, true, true, true),
-            "GET, real navigation, matched slots, and consent should run TS ad stack"
+            should_run_server_side_ad_stack(true, true, false, false, true, true, enabled_config,),
+            "GET, real navigation, enabled templates, matched slots, and consent should run TS ad stack"
         );
 
         assert!(
-            !should_run_server_side_ad_stack(false, true, false, false, true, true, true),
+            !should_run_server_side_ad_stack(false, true, false, false, true, true, enabled_config,),
             "non-GET requests should skip TS ad stack"
         );
         assert!(
-            !should_run_server_side_ad_stack(true, false, false, false, true, true, true),
+            !should_run_server_side_ad_stack(true, false, false, false, true, true, enabled_config,),
             "non-document requests should skip TS ad stack"
         );
         assert!(
-            !should_run_server_side_ad_stack(true, true, true, false, true, true, true),
+            !should_run_server_side_ad_stack(true, true, true, false, true, true, enabled_config,),
             "prefetch requests should skip TS ad stack and injection"
         );
         assert!(
-            !should_run_server_side_ad_stack(true, true, false, true, true, true, true),
+            !should_run_server_side_ad_stack(true, true, false, true, true, true, enabled_config,),
             "bot requests should skip TS ad stack and injection"
         );
         assert!(
-            !should_run_server_side_ad_stack(true, true, false, false, false, true, true),
+            !should_run_server_side_ad_stack(true, true, false, false, false, true, enabled_config,),
             "requests with no matching slots should skip TS ad stack"
         );
         assert!(
-            !should_run_server_side_ad_stack(true, true, false, false, true, false, true),
+            !should_run_server_side_ad_stack(true, true, false, false, true, false, enabled_config,),
             "requests without required consent should skip TS ad stack and injection"
         );
         assert!(
-            !should_run_server_side_ad_stack(true, true, false, false, true, true, false),
+            !should_run_server_side_ad_stack(
+                true,
+                true,
+                false,
+                false,
+                true,
+                true,
+                ServerSideAdStackConfig {
+                    ad_templates_enabled: true,
+                    auction_enabled: false,
+                },
+            ),
             "disabled [auction].enabled kill switch should skip TS ad stack and injection"
         );
+        assert!(
+            !should_run_server_side_ad_stack(
+                true,
+                true,
+                false,
+                false,
+                true,
+                true,
+                ServerSideAdStackConfig {
+                    ad_templates_enabled: false,
+                    auction_enabled: true,
+                },
+            ),
+            "disabled [creative_opportunities].enabled switch should skip TS ad stack and injection"
+        );
     }
 
     #[tokio::test]
@@ -6392,6 +6808,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
 
         let mut output = Vec::new();
@@ -6440,6 +6857,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
 
         let mut output = Vec::new();
@@ -6477,6 +6895,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let body = EdgeBody::from_stream(futures::stream::iter(vec![Ok::<_, io::Error>(
             bytes::Bytes::from_static(b"<html><body>live</body></html>"),
@@ -6592,6 +7011,7 @@ mod tests {
                 dispatched_auction: None,
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let body = EdgeBody::stream(futures::stream::iter(vec![
                 bytes::Bytes::from_static(b"body{background:url('https://origin.example.com/"),
@@ -6645,6 +7065,7 @@ mod tests {
                 dispatched_auction: None,
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let compressed =
                 gzip_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -6701,6 +7122,7 @@ mod tests {
                 dispatched_auction: None,
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let compressed =
                 deflate_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -6757,6 +7179,7 @@ mod tests {
                 dispatched_auction: None,
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let compressed =
                 brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -6813,6 +7236,7 @@ mod tests {
                 dispatched_auction: None,
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let compressed =
                 brotli_encode(b"body{background:url('https://origin.example.com/asset.png')}");
@@ -6857,6 +7281,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         }
     }
 
@@ -7051,6 +7476,7 @@ mod tests {
                 )),
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let body = EdgeBody::stream(futures::stream::iter(vec![
                 bytes::Bytes::from_static(b"<html><head></head><body>hello"),
@@ -7115,6 +7541,7 @@ mod tests {
                 )),
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             // The `</body>` that triggers bid injection lives in the SECOND gzip
             // member. `flate2::read::GzDecoder` decodes only the first member, so
@@ -7178,6 +7605,7 @@ mod tests {
                 )),
                 price_granularity: crate::price_bucket::PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             };
             let body = EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
                 b"body{background:url('https://origin.example.com/asset.png')}",
@@ -7234,6 +7662,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let publisher_response = PublisherResponse::Stream {
             response,
@@ -7370,6 +7799,7 @@ mod tests {
             dispatched_auction,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         }
     }
 
@@ -7721,6 +8151,7 @@ mod tests {
                 )),
                 price_granularity: PriceGranularity::default(),
                 gpt_diagnostics: None,
+                suppress_datadome_client_side_tag: false,
             }
         };
         let make_stream_response = || PublisherResponse::Stream {
@@ -7900,6 +8331,7 @@ mod tests {
             )),
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let publisher_response = PublisherResponse::Stream {
             response,
@@ -7967,6 +8399,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut output = Vec::new();
 
@@ -8017,6 +8450,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
 
         let bogus_body = EdgeBody::from(b"<html>not gzip</html>".to_vec());
@@ -8125,6 +8559,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
         let mut output = Vec::new();
         stream_publisher_body(body, &mut output, &params, &settings, &registry)
@@ -8182,6 +8617,7 @@ mod tests {
             dispatched_auction: None,
             price_granularity: crate::price_bucket::PriceGranularity::default(),
             gpt_diagnostics: None,
+            suppress_datadome_client_side_tag: false,
         };
 
         let mut output = Vec::new();
@@ -8225,15 +8661,15 @@ mod tests {
         use crate::settings::Settings;
         use std::collections::HashMap;
 
-        // Default settings are enough for the creative boundary: the sanitize
-        // pass needs no config, and `rewrite_creative_html` only signs URLs it
-        // actually rewrites (none of these fixtures carry proxyable URLs).
+        // Rewriting is enabled by default; tests disable it when they need to
+        // inspect sanitizer-accepted URLs directly.
         fn test_settings() -> Settings {
             Settings::default()
         }
 
         fn make_config() -> CreativeOpportunitiesConfig {
             CreativeOpportunitiesConfig {
+                enabled: true,
                 gam_network_id: "21765378893".to_string(),
                 auction_timeout_ms: Some(500),
                 price_granularity: PriceGranularity::Dense,
@@ -8284,9 +8720,9 @@ mod tests {
                 nurl: Some(nurl.to_string()),
                 burl: Some(burl.to_string()),
                 bid_id: None,
+                ad_id: Some(ad_id.to_string()),
                 creative_id: None,
                 renderer: None,
-                ad_id: Some(ad_id.to_string()),
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -8489,13 +8925,266 @@ mod tests {
             assert_ne!(first, second, "each auction should mint its own token");
         }
 
+        #[test]
+        fn bid_map_exposes_aps_renderer_and_selected_bid_id_without_debug_adm() {
+            let mut bid = make_bid("atf_sidebar_ad", 1.50, "aps", "fallback-ad", "", "");
+            bid.bid_id = Some("selected-bid".to_string());
+            bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64</script>".to_string(),
+                width: 300,
+                height: 250,
+            }));
+            bid.nurl = None;
+            bid.burl = None;
+            let winning_bids = HashMap::from([("atf_sidebar_ad".to_string(), bid)]);
+
+            let map = build_bid_map(
+                &winning_bids,
+                PriceGranularity::Dense,
+                &test_settings(),
+                "",
+                false,
+            );
+            let obj = map["atf_sidebar_ad"]
+                .as_object()
+                .expect("should include APS bid");
+
+            assert_eq!(obj["hb_bidder"], "aps");
+            assert_eq!(obj["hb_adid"], "selected-bid");
+            assert_eq!(obj["renderer"]["type"], "aps");
+            assert_eq!(obj["renderer"]["bidId"], "selected-bid");
+            assert!(obj.get("adm").is_none());
+            assert!(obj.get("nurl").is_none());
+            assert!(obj.get("burl").is_none());
+            assert!(obj.get("metadata").is_none());
+
+            let script = build_bids_script(&map);
+            assert!(!script.contains("</script></script>"));
+            assert!(script.contains("\\u003C/script\\u003E"));
+        }
+
+        #[test]
+        fn bid_map_falls_back_to_bid_id_when_cache_id_and_ad_id_absent() {
+            // Real shape for bidders that return neither a Prebid Cache UUID nor
+            // `adid` in the OpenRTB response, but always carry `id` (the bid's own
+            // identifier) per spec. Without this fallback the bid reaches the page
+            // with no hb_adid, so no targeting key is set and the render bridge
+            // never receives a matching `Prebid Request`.
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(1.00),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "example-bidder".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    bid_id: Some("019f7e2a-b45b-70b0-a2d1-b651c430700b".to_string()),
+                    ad_id: None,
+                    creative_id: None,
+                    renderer: None,
+                    cache_id: None,
+                    cache_host: None,
+                    cache_path: None,
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(
+                &winning_bids,
+                PriceGranularity::Dense,
+                &test_settings(),
+                "",
+                false,
+            );
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("019f7e2a-b45b-70b0-a2d1-b651c430700b"),
+                "should fall back to bid_id when cache_id and ad_id are both absent"
+            );
+        }
+
+        #[test]
+        fn bid_map_omits_cache_coordinates_for_a_blank_cache_id() {
+            // A blank `cacheId` loses the hb_adid precedence to `adid`/the bid
+            // id, so the cache gate must treat it as absent too. Otherwise the
+            // coordinates ship alongside a non-cache hb_adid and the Universal
+            // Creative fetches `?uuid=<adid>` — a guaranteed miss — rather than
+            // falling through to the inline adm.
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(1.00),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "example-bidder".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    bid_id: Some("019f7e2a-b45b-70b0-a2d1-b651c430700b".to_string()),
+                    ad_id: Some("creative-123".to_string()),
+                    creative_id: None,
+                    renderer: None,
+                    cache_id: Some(String::new()),
+                    cache_host: Some("cache.example.com".to_string()),
+                    cache_path: Some("/cache".to_string()),
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(
+                &winning_bids,
+                PriceGranularity::Dense,
+                &test_settings(),
+                "",
+                false,
+            );
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("creative-123"),
+                "should fall back to ad_id when cache_id is blank"
+            );
+            assert!(
+                obj.get("hb_cache_host").is_none(),
+                "should omit hb_cache_host when the cache UUID is blank"
+            );
+            assert!(
+                obj.get("hb_cache_path").is_none(),
+                "should omit hb_cache_path when the cache UUID is blank"
+            );
+        }
+
+        #[test]
+        fn bid_map_omits_cache_coordinates_without_a_cache_id() {
+            // PBS reports the cache `url` and `cacheId` independently. With
+            // coordinates but no UUID, hb_adid holds a non-cache identifier, so
+            // emitting them would send the Universal Creative to
+            // `?uuid=<bid id>` — a guaranteed miss — instead of the inline adm.
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(1.00),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "example-bidder".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    bid_id: Some("019f7e2a-b45b-70b0-a2d1-b651c430700b".to_string()),
+                    ad_id: None,
+                    creative_id: None,
+                    renderer: None,
+                    cache_id: None,
+                    cache_host: Some("cache.example.com".to_string()),
+                    cache_path: Some("/cache".to_string()),
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(
+                &winning_bids,
+                PriceGranularity::Dense,
+                &test_settings(),
+                "",
+                false,
+            );
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert!(
+                obj.get("hb_cache_host").is_none(),
+                "should omit hb_cache_host when there is no cache UUID to look up"
+            );
+            assert!(
+                obj.get("hb_cache_path").is_none(),
+                "should omit hb_cache_path when there is no cache UUID to look up"
+            );
+        }
+
+        #[test]
+        fn bid_map_skips_blank_cache_id_and_ad_id_for_hb_adid() {
+            // A bidder that emits `cacheId`/`adid` as empty strings must not win
+            // the precedence: an empty hb_adid is falsey on the page, so GPT skips
+            // the targeting key and the render bridge has nothing to match — the
+            // same failure as omitting hb_adid entirely.
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(1.00),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "example-bidder".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    bid_id: Some("019f7e2a-b45b-70b0-a2d1-b651c430700b".to_string()),
+                    ad_id: Some(String::new()),
+                    creative_id: None,
+                    renderer: None,
+                    cache_id: Some(String::new()),
+                    cache_host: None,
+                    cache_path: None,
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(
+                &winning_bids,
+                PriceGranularity::Dense,
+                &test_settings(),
+                "",
+                false,
+            );
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("019f7e2a-b45b-70b0-a2d1-b651c430700b"),
+                "should treat blank cache_id and ad_id as absent and use bid_id"
+            );
+        }
+
         #[test]
         fn initial_document_bids_script_includes_auction_id_only_for_winning_bids() {
             let slot = make_slot();
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -8976,6 +9665,7 @@ mod tests {
             let mut settings = test_settings();
             settings.auction.rewrite_creatives = true;
             settings.publisher.domain = "example.com".to_string();
+            settings.auction.rewrite_creatives = true;
 
             let mut winning_bids = HashMap::new();
             let mut bid = make_bid(
@@ -9026,6 +9716,7 @@ mod tests {
             let mut settings = test_settings();
             settings.auction.rewrite_creatives = true;
             settings.publisher.domain = "example.com".to_string();
+            settings.auction.rewrite_creatives = true;
 
             let mut winning_bids = HashMap::new();
             let mut bid = make_bid(
@@ -9075,6 +9766,7 @@ mod tests {
             // signature locks the wrong value.
             let mut settings = test_settings();
             settings.publisher.domain = "example.com".to_string();
+            settings.auction.rewrite_creatives = true;
 
             let mut winning_bids = HashMap::new();
             let mut bid = make_bid(
@@ -9181,6 +9873,10 @@ mod tests {
                 false,
             );
             let script = build_bids_script(&map);
+            assert!(
+                !script.contains("</script><script>"),
+                "should not let a hostile adm break out of the script context"
+            );
             assert!(
                 !script.contains('\u{2028}') && !script.contains('\u{2029}'),
                 "should unicode-escape both U+2028 and U+2029 in the adm"
@@ -9270,9 +9966,9 @@ mod tests {
                     nurl: None,
                     burl: None,
                     bid_id: None,
+                    ad_id: Some("bid-impression-id".to_string()),
                     creative_id: None,
                     renderer: None,
-                    ad_id: Some("bid-impression-id".to_string()),
                     cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
                     cache_host: Some("openads.adsrvr.org".to_string()),
                     cache_path: Some("/cache".to_string()),
@@ -9319,7 +10015,7 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
@@ -9431,15 +10127,15 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
                     bid_id: None,
+                    ad_id: None,
                     creative_id: None,
                     renderer: None,
-                    ad_id: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -9481,9 +10177,9 @@ mod tests {
                     nurl: None,
                     burl: None,
                     bid_id: None,
+                    ad_id: None,
                     creative_id: None,
                     renderer: None,
-                    ad_id: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -9590,7 +10286,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/?edition=fictional",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -9612,6 +10308,11 @@ mod tests {
                 "should use a non-EC request id, got {}",
                 request.id
             );
+            assert_eq!(
+                request.publisher.page_url.as_deref(),
+                Some("https://publisher.example.com/2024/01/my-article/"),
+                "should preserve the page path but strip client query data for auction providers"
+            );
         }
 
         #[test]
@@ -9624,7 +10325,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/?edition=fictional",
+                request_path_and_query: "/2024/01/my-article/?edition=fictional",
             };
             let request_info = RequestInfo {
                 host: "ts.example.com".to_string(),
@@ -9670,7 +10371,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/?edition=fictional",
+                request_path_and_query: "/2024/01/my-article/?edition=fictional",
             };
             let request_info = RequestInfo {
                 host: "ts.example.com".to_string(),
@@ -9712,7 +10413,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -9858,9 +10559,9 @@ mod tests {
                         nurl: None,
                         burl: None,
                         bid_id: None,
+                        ad_id: Some("winner-123".to_string()),
                         creative_id: None,
                         renderer: None,
-                        ad_id: Some("winner-123".to_string()),
                         cache_id: None,
                         cache_host: None,
                         cache_path: None,
@@ -9913,6 +10614,14 @@ mod tests {
             Settings::from_toml(&toml).expect("should parse settings with creative_opportunities")
         }
 
+        fn settings_with_co_templates_disabled() -> Settings {
+            let toml = format!(
+                "{}\n[auction]\nenabled = true\n\n[creative_opportunities]\nenabled = false\ngam_network_id = \"12345\"\n",
+                crate_test_settings_str()
+            );
+            Settings::from_toml(&toml).expect("should parse settings with disabled templates")
+        }
+
         async fn run_page_bids(
             settings: &Settings,
             orchestrator: &AuctionOrchestrator,
@@ -10629,6 +11338,20 @@ mod tests {
             );
         }
 
+        #[test]
+        fn normalize_page_bids_path_and_query_preserves_query_but_drops_fragment() {
+            assert_eq!(
+                normalize_page_bids_path_and_query("/2024/01/article/?edition=fictional#section"),
+                "/2024/01/article/?edition=fictional",
+                "query should reach auction providers without a browser-only fragment"
+            );
+            assert_eq!(
+                normalize_page_bids_path_and_query("2024/01/article/?edition=fictional"),
+                "/2024/01/article/?edition=fictional",
+                "missing leading slash should be added"
+            );
+        }
+
         #[tokio::test]
         async fn disabled_auction_returns_no_slots_or_bids() {
             // [auction].enabled = false is a global kill switch: it must disable
@@ -10662,6 +11385,35 @@ mod tests {
             );
         }
 
+        #[tokio::test]
+        async fn disabled_server_side_ad_templates_return_no_slots_or_bids() {
+            // The dedicated template switch must suppress publisher/page-bids
+            // delivery without using the global auction switch.
+            let settings = settings_with_co_templates_disabled();
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            let slots = article_slot();
+            let req = make_page_bids_request("/2024/01/my-article/");
+
+            let body = run_page_bids_consent_allowed(&settings, &orchestrator, &slots, req).await;
+
+            assert_eq!(
+                body["slots"]
+                    .as_array()
+                    .expect("slots should be array")
+                    .len(),
+                0,
+                "disabled server-side ad templates must not return slot definitions"
+            );
+            assert_eq!(
+                body["bids"]
+                    .as_object()
+                    .expect("bids should be object")
+                    .len(),
+                0,
+                "disabled server-side ad templates must not produce bids"
+            );
+        }
+
         #[tokio::test]
         async fn consent_denied_returns_no_slots_or_bids() {
             // When consent denies the server-side auction (here: Jurisdiction
diff --git a/crates/trusted-server-core/src/response_privacy.rs b/crates/trusted-server-core/src/response_privacy.rs
index e23348211..c2b1447e3 100644
--- a/crates/trusted-server-core/src/response_privacy.rs
+++ b/crates/trusted-server-core/src/response_privacy.rs
@@ -37,7 +37,7 @@ pub fn enforce_set_cookie_cache_privacy(response: &mut Response) {
     if !response.headers().contains_key(header::SET_COOKIE) {
         return;
     }
-    // Surrogate cache headers must come off every cookie-bearing response, even
+    // Shared-cache control headers must come off every cookie-bearing response, even
     // one already carrying a stricter `no-store`/`private` directive — they are
     // independent of Cache-Control and would otherwise let a shared cache store
     // and replay one visitor's Set-Cookie.
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 598c00056..109c9c9ab 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -193,6 +193,57 @@ impl IntegrationSettings {
         Ok(())
     }
 
+    #[cfg(test)]
+    fn normalize_env_value(value: JsonValue) -> JsonValue {
+        match value {
+            JsonValue::Object(map) => JsonValue::Object(
+                map.into_iter()
+                    .map(|(key, value)| {
+                        let value = if matches!(
+                            key.as_str(),
+                            "bid_param_overrides"
+                                | "bid_param_zone_overrides"
+                                | "bid_param_override_rules"
+                        ) {
+                            Self::normalize_opaque_json_value(value)
+                        } else {
+                            Self::normalize_env_value(value)
+                        };
+                        (key, value)
+                    })
+                    .collect(),
+            ),
+            JsonValue::Array(items) => {
+                JsonValue::Array(items.into_iter().map(Self::normalize_env_value).collect())
+            }
+            JsonValue::String(raw) => {
+                if let Ok(parsed) = serde_json::from_str::<JsonValue>(&raw) {
+                    parsed
+                } else {
+                    JsonValue::String(raw)
+                }
+            }
+            other => other,
+        }
+    }
+
+    #[cfg(test)]
+    fn normalize_opaque_json_value(value: JsonValue) -> JsonValue {
+        match value {
+            JsonValue::String(raw) => {
+                serde_json::from_str::<JsonValue>(&raw).unwrap_or(JsonValue::String(raw))
+            }
+            other => other,
+        }
+    }
+
+    #[cfg(test)]
+    fn normalize_legacy_env(&mut self) {
+        for value in self.entries.values_mut() {
+            *value = Self::normalize_env_value(value.clone());
+        }
+    }
+
     fn is_explicitly_disabled(raw: &JsonValue) -> bool {
         raw.as_object()
             .and_then(|map| map.get("enabled"))
@@ -1901,6 +1952,18 @@ pub struct DebugConfig {
     /// un-sanitized creative for diagnostics, so never enable in production.
     #[serde(default)]
     pub inject_adm_for_testing: bool,
+
+    /// Expose `GET /_ts/trace`, which toggles the `ts-trace` cookie and
+    /// redirects to `/`.
+    ///
+    /// The cookie makes the TSJS render-trace overlay draw a floating panel
+    /// summarising every traced slot (render path, bidder, GAM/injected/visible
+    /// state) plus a confirmation badge on each genuinely-rendered creative.
+    /// The overlay only surfaces data already exposed on `window.tsjs`, so
+    /// enabling this leaks nothing new — it is off by default to avoid shipping
+    /// a live toggle route on deployments that never asked for it.
+    #[serde(default)]
+    pub trace_route_enabled: bool,
 }
 
 /// Tester-cookie endpoint configuration.
@@ -2005,12 +2068,13 @@ impl Settings {
             .change_context(TrustedServerError::Configuration {
                 message: "Failed to build configuration".to_string(),
             })?;
-        let settings: Self =
+        let mut settings: Self =
             config
                 .try_deserialize()
                 .change_context(TrustedServerError::Configuration {
                     message: "Failed to deserialize configuration".to_string(),
                 })?;
+        settings.integrations.normalize_legacy_env();
 
         Self::finalize_deserialized(settings, "Build-time configuration")
     }
@@ -2095,13 +2159,14 @@ impl Settings {
         Ok(())
     }
 
-    /// Returns compiled creative opportunity slots, or empty slice if feature is disabled.
+    /// Returns compiled creative opportunity slots when template delivery is enabled.
     #[must_use]
     pub fn creative_opportunity_slots(
         &self,
     ) -> &[crate::creative_opportunities::CreativeOpportunitySlot] {
         self.creative_opportunities
             .as_ref()
+            .filter(|co| co.enabled)
             .map(|co| co.slot.as_slice())
             .unwrap_or(&[])
     }
@@ -2589,7 +2654,10 @@ mod tests {
 
     use crate::auction::build_orchestrator;
     use crate::integrations::{
-        IntegrationRegistry, gpt::GptConfig, nextjs::NextJsIntegrationConfig,
+        IntegrationRegistry,
+        datadome::{DataDomeConfig, ProtectionMatcherConfig},
+        gpt::GptConfig,
+        nextjs::NextJsIntegrationConfig,
         prebid::PrebidIntegrationConfig,
     };
     use crate::redacted::Redacted;
@@ -3186,6 +3254,368 @@ origin_host_header_overide = "www.example.com""#,
         );
     }
 
+    #[test]
+    fn prebid_numeric_string_bid_param_overrides_survive_config_roundtrip() {
+        let toml_str = format!(
+            r#"{}
+
+[integrations.prebid.bid_param_overrides.pubmatic]
+publisherId = "12345"
+adSlot = "67890"
+"#,
+            crate_test_settings_str()
+        );
+        let settings = Settings::from_toml(&toml_str).expect("should parse TOML settings");
+        let serialized = serde_json::to_value(&settings).expect("should serialize settings");
+        let runtime_settings =
+            Settings::from_json_value(serialized).expect("should parse runtime JSON settings");
+        let raw = runtime_settings
+            .integrations
+            .get("prebid")
+            .expect("should contain Prebid settings");
+
+        assert_eq!(
+            raw["bid_param_overrides"]["pubmatic"]["publisherId"],
+            json!("12345"),
+            "should preserve numeric-looking publisherId as a string"
+        );
+        assert_eq!(
+            raw["bid_param_overrides"]["pubmatic"]["adSlot"],
+            json!("67890"),
+            "should preserve numeric-looking adSlot as a string"
+        );
+    }
+
+    #[test]
+    fn test_prebid_bid_param_overrides_override_with_json_env() {
+        let toml_str = crate_test_settings_str();
+        let env_key = format!(
+            "{}{}INTEGRATIONS{}PREBID{}BID_PARAM_OVERRIDES",
+            ENVIRONMENT_VARIABLE_PREFIX,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR
+        );
+
+        let origin_key = format!(
+            "{}{}PUBLISHER{}ORIGIN_URL",
+            ENVIRONMENT_VARIABLE_PREFIX,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR
+        );
+        temp_env::with_var(
+            origin_key,
+            Some("https://origin.test-publisher.com"),
+            || {
+                temp_env::with_var(
+                    env_key,
+                    Some(r#"{"criteo":{"networkId":99999,"pubid":"24680"}}"#),
+                    || {
+                        let settings = Settings::from_toml_and_env(&toml_str)
+                            .expect("Settings should parse with bidder param override env");
+                        let cfg = settings
+                            .integration_config::<PrebidIntegrationConfig>("prebid")
+                            .expect("Prebid config query should succeed")
+                            .expect("Prebid config should exist with env override");
+                        let cfg_json =
+                            serde_json::to_value(&cfg).expect("should serialize config to JSON");
+
+                        assert_eq!(
+                            cfg_json["bid_param_overrides"]["criteo"]["networkId"],
+                            json!(99999),
+                            "should deserialize networkId override from env JSON"
+                        );
+                        assert_eq!(
+                            cfg_json["bid_param_overrides"]["criteo"]["pubid"],
+                            json!("24680"),
+                            "should preserve numeric-looking pubid override from env JSON as a string"
+                        );
+                    },
+                );
+            },
+        );
+    }
+
+    #[test]
+    fn test_prebid_bid_param_override_rules_override_with_json_env() {
+        let toml_str = crate_test_settings_str();
+        let env_key = format!(
+            "{}{}INTEGRATIONS{}PREBID{}BID_PARAM_OVERRIDE_RULES",
+            ENVIRONMENT_VARIABLE_PREFIX,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR
+        );
+
+        let origin_key = format!(
+            "{}{}PUBLISHER{}ORIGIN_URL",
+            ENVIRONMENT_VARIABLE_PREFIX,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR
+        );
+        temp_env::with_var(
+            origin_key,
+            Some("https://origin.test-publisher.com"),
+            || {
+                temp_env::with_var(
+                    env_key,
+                    Some(
+                        r#"[{"when":{"bidder":"kargo","zone":"header"},"set":{"placementId":"server-header","keep":"yes"}}]"#,
+                    ),
+                    || {
+                        let settings = Settings::from_toml_and_env(&toml_str)
+                            .expect("Settings should parse canonical bidder param override rules");
+                        let cfg = settings
+                            .integration_config::<PrebidIntegrationConfig>("prebid")
+                            .expect("Prebid config query should succeed")
+                            .expect("Prebid config should exist with env override");
+                        let cfg_json =
+                            serde_json::to_value(&cfg).expect("should serialize config to JSON");
+
+                        assert_eq!(
+                            cfg_json["bid_param_override_rules"][0]["when"]["bidder"],
+                            json!("kargo"),
+                            "should deserialize bidder matcher from env JSON"
+                        );
+                        assert_eq!(
+                            cfg_json["bid_param_override_rules"][0]["when"]["zone"],
+                            json!("header"),
+                            "should deserialize zone matcher from env JSON"
+                        );
+                        assert_eq!(
+                            cfg_json["bid_param_override_rules"][0]["set"]["placementId"],
+                            json!("server-header"),
+                            "should deserialize set object from env JSON"
+                        );
+                    },
+                );
+            },
+        );
+    }
+
+    #[test]
+    fn test_datadome_protection_scope_overrides_with_json_env() {
+        let toml_str = crate_test_settings_str();
+        let separator = ENVIRONMENT_VARIABLE_SEPARATOR;
+        let origin_key = format!(
+            "{}{}PUBLISHER{}ORIGIN_URL",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator
+        );
+        let enabled_key = format!(
+            "{}{}INTEGRATIONS{}DATADOME{}ENABLED",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator, separator
+        );
+        let enable_protection_key = format!(
+            "{}{}INTEGRATIONS{}DATADOME{}ENABLE_PROTECTION",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator, separator
+        );
+        let excluded_methods_key = format!(
+            "{}{}INTEGRATIONS{}DATADOME{}PROTECTION_EXCLUDED_METHODS",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator, separator
+        );
+        let cidr_sources_key = format!(
+            "{}{}INTEGRATIONS{}DATADOME{}PROTECTION_EXCLUDED_IP_CIDR_SOURCES",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator, separator
+        );
+        let rules_key = format!(
+            "{}{}INTEGRATIONS{}DATADOME{}PROTECTION_EXCLUSION_RULES",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator, separator
+        );
+
+        temp_env::with_vars(
+            [
+                (origin_key, Some("https://origin.test-publisher.com")),
+                (enabled_key, Some("true")),
+                (enable_protection_key, Some("true")),
+                (excluded_methods_key, Some(r#"["OPTIONS","TRACE"]"#)),
+                (
+                    cidr_sources_key,
+                    Some(r#"[{"config_store":"datadome-ip-bypass","key":"googlebot_ips"}]"#),
+                ),
+                (
+                    rules_key,
+                    Some(
+                        r#"[{"id":"legacy-static-get-head","methods":["GET","HEAD"],"type":"path_regex","patterns":["(?i)\\.(css|js)$"]},{"id":"next-rsc","type":"query_param_non_empty","names":["_rsc"]}]"#,
+                    ),
+                ),
+            ],
+            || {
+                let settings = Settings::from_toml_and_env(&toml_str)
+                    .expect("Settings should parse DataDome JSON env overrides");
+                let cfg = settings
+                    .integration_config::<DataDomeConfig>("datadome")
+                    .expect("DataDome config query should succeed")
+                    .expect("DataDome config should exist with env override");
+
+                assert!(cfg.enabled, "should parse enabled override as bool");
+                assert!(
+                    cfg.enable_protection,
+                    "should parse enable_protection override as bool"
+                );
+                assert_eq!(
+                    cfg.protection_excluded_methods,
+                    vec!["OPTIONS".to_string(), "TRACE".to_string()],
+                    "should parse method list from JSON env override"
+                );
+                assert_eq!(
+                    cfg.protection_excluded_ip_cidr_sources[0].config_store, "datadome-ip-bypass",
+                    "should parse CIDR source config_store from JSON env override"
+                );
+                assert_eq!(
+                    cfg.protection_excluded_ip_cidr_sources[0].key, "googlebot_ips",
+                    "should parse CIDR source key from JSON env override"
+                );
+                assert_eq!(
+                    cfg.protection_exclusion_rules.len(),
+                    2,
+                    "should parse all structured rules from JSON env override"
+                );
+                assert!(matches!(
+                    &cfg.protection_exclusion_rules[0].matcher,
+                    ProtectionMatcherConfig::PathRegex { patterns }
+                        if patterns == &vec!["(?i)\\.(css|js)$".to_string()]
+                ));
+                assert!(matches!(
+                    &cfg.protection_exclusion_rules[1].matcher,
+                    ProtectionMatcherConfig::QueryParamNonEmpty { names }
+                        if names == &vec!["_rsc".to_string()]
+                ));
+            },
+        );
+    }
+
+    #[test]
+    fn test_datadome_protection_scope_overrides_with_indexed_env() {
+        let toml_str = crate_test_settings_str();
+        let separator = ENVIRONMENT_VARIABLE_SEPARATOR;
+        let datadome_prefix = format!(
+            "{}{}INTEGRATIONS{}DATADOME{}",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator, separator
+        );
+        let origin_key = format!(
+            "{}{}PUBLISHER{}ORIGIN_URL",
+            ENVIRONMENT_VARIABLE_PREFIX, separator, separator
+        );
+
+        temp_env::with_vars(
+            [
+                (origin_key, Some("https://origin.test-publisher.com")),
+                (format!("{datadome_prefix}ENABLED"), Some("true")),
+                (format!("{datadome_prefix}ENABLE_PROTECTION"), Some("true")),
+                (
+                    format!("{datadome_prefix}PROTECTION_EXCLUDED_METHODS{separator}0"),
+                    Some("OPTIONS"),
+                ),
+                (
+                    format!("{datadome_prefix}PROTECTION_EXCLUDED_METHODS{separator}1"),
+                    Some("TRACE"),
+                ),
+                (
+                    format!("{datadome_prefix}PROTECTION_EXCLUDED_ASNS{separator}0"),
+                    Some("19750"),
+                ),
+                (
+                    format!("{datadome_prefix}PROTECTION_EXCLUDED_IP_CIDRS{separator}0"),
+                    Some("198.51.100.0/24"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUDED_IP_CIDR_SOURCES{separator}0{separator}CONFIG_STORE"
+                    ),
+                    Some("datadome-ip-bypass"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUDED_IP_CIDR_SOURCES{separator}0{separator}KEY"
+                    ),
+                    Some("googlebot_ips"),
+                ),
+                (
+                    format!("{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}0{separator}ID"),
+                    Some("legacy-static-get-head"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}0{separator}METHODS{separator}0"
+                    ),
+                    Some("GET"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}0{separator}METHODS{separator}1"
+                    ),
+                    Some("HEAD"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}0{separator}TYPE"
+                    ),
+                    Some("path_regex"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}0{separator}PATTERNS{separator}0"
+                    ),
+                    Some(r"(?i)\.(css|js)$"),
+                ),
+                (
+                    format!("{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}1{separator}ID"),
+                    Some("next-rsc"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}1{separator}TYPE"
+                    ),
+                    Some("query_param_non_empty"),
+                ),
+                (
+                    format!(
+                        "{datadome_prefix}PROTECTION_EXCLUSION_RULES{separator}1{separator}NAMES{separator}0"
+                    ),
+                    Some("_rsc"),
+                ),
+            ],
+            || {
+                let settings = Settings::from_toml_and_env(&toml_str)
+                    .expect("Settings should parse DataDome indexed env overrides");
+                let cfg = settings
+                    .integration_config::<DataDomeConfig>("datadome")
+                    .expect("DataDome config query should succeed")
+                    .expect("DataDome config should exist with indexed env override");
+
+                assert_eq!(
+                    cfg.protection_excluded_methods,
+                    vec!["OPTIONS".to_string(), "TRACE".to_string()],
+                    "should parse indexed method list"
+                );
+                assert_eq!(
+                    cfg.protection_excluded_asns,
+                    vec![19750],
+                    "should parse indexed ASN list"
+                );
+                assert_eq!(
+                    cfg.protection_excluded_ip_cidrs,
+                    vec!["198.51.100.0/24".to_string()],
+                    "should parse indexed IP CIDR list"
+                );
+                assert_eq!(
+                    cfg.protection_excluded_ip_cidr_sources[0].key, "googlebot_ips",
+                    "should parse indexed CIDR source list"
+                );
+                assert!(matches!(
+                    &cfg.protection_exclusion_rules[0].matcher,
+                    ProtectionMatcherConfig::PathRegex { patterns }
+                        if patterns == &vec!["(?i)\\.(css|js)$".to_string()]
+                ));
+                assert!(matches!(
+                    &cfg.protection_exclusion_rules[1].matcher,
+                    ProtectionMatcherConfig::QueryParamNonEmpty { names }
+                        if names == &vec!["_rsc".to_string()]
+                ));
+            },
+        );
+    }
+
     #[test]
     fn test_handlers_override_with_env() {
         let toml_str = crate_test_settings_str();
@@ -5014,6 +5444,10 @@ formats = [{ width = 300, height = 250 }]
         let co = settings
             .creative_opportunities
             .expect("should have creative_opportunities");
+        assert!(
+            co.enabled,
+            "creative-opportunity templates should default to enabled"
+        );
         assert_eq!(co.gam_network_id, "21765378893");
         assert_eq!(co.auction_timeout_ms, Some(500));
         assert_eq!(
@@ -5023,6 +5457,45 @@ formats = [{ width = 300, height = 250 }]
         );
     }
 
+    #[test]
+    fn settings_disables_creative_opportunity_slots_when_configured_off() {
+        let toml = format!(
+            "{}\n[creative_opportunities]\nenabled = false\ngam_network_id = \"21765378893\"\n\n[[creative_opportunities.slot]]\nid = \"atf\"\npage_patterns = [\"/\"]\nformats = [{{ width = 300, height = 250 }}]\n",
+            crate_test_settings_str()
+        );
+        let settings = Settings::from_toml(&toml).expect("should parse disabled templates");
+        assert!(
+            settings.creative_opportunity_slots().is_empty(),
+            "disabled template delivery should expose no runtime slots"
+        );
+    }
+
+    #[test]
+    fn settings_creative_opportunity_enabled_flag_supports_environment_override() {
+        let toml = format!(
+            "{}\n[creative_opportunities]\nenabled = true\ngam_network_id = \"21765378893\"\n",
+            crate_test_settings_str()
+        );
+        let env_key = format!(
+            "{}{}CREATIVE_OPPORTUNITIES{}ENABLED",
+            ENVIRONMENT_VARIABLE_PREFIX,
+            ENVIRONMENT_VARIABLE_SEPARATOR,
+            ENVIRONMENT_VARIABLE_SEPARATOR
+        );
+
+        temp_env::with_var(env_key, Some("false"), || {
+            let settings = Settings::from_toml_and_env(&toml)
+                .expect("should parse template enabled environment override");
+            assert!(
+                !settings
+                    .creative_opportunities
+                    .expect("should have creative opportunities")
+                    .enabled,
+                "environment override should disable template delivery"
+            );
+        });
+    }
+
     #[test]
     fn settings_rejects_invalid_creative_opportunity_slot_id() {
         let toml = r#"
diff --git a/crates/trusted-server-core/src/trace_cookie.rs b/crates/trusted-server-core/src/trace_cookie.rs
new file mode 100644
index 000000000..583a96238
--- /dev/null
+++ b/crates/trusted-server-core/src/trace_cookie.rs
@@ -0,0 +1,218 @@
+//! Render-trace toggle endpoint helpers.
+//!
+//! `GET /_ts/trace` arms (or with `?enabled=false` disarms) the first-party
+//! `ts-trace` cookie and redirects to `/`. While the cookie is present, the
+//! TSJS render-trace layer draws a visible badge on every traced creative so
+//! an operator can see on the page itself that a creative was delivered by
+//! Trusted Server — and via which render path (SSAT/GAM or `/auction`).
+//!
+//! The route is gated behind `[debug] trace_route_enabled` and returns
+//! `404 Not Found` while disabled, mirroring the tester-cookie endpoints. The
+//! badge only surfaces data already exposed on `window.tsjs`, so the cookie
+//! gates visibility, not access.
+
+use edgezero_core::body::Body as EdgeBody;
+use error_stack::{Report, ResultExt};
+use http::{HeaderValue, Response, StatusCode, header};
+
+use crate::constants::COOKIE_TS_TRACE;
+use crate::error::TrustedServerError;
+use crate::settings::Settings;
+
+/// How long an armed trace cookie lives, in seconds.
+///
+/// One hour: long enough for a debugging session across reloads and SPA
+/// navigations, short enough that a forgotten toggle expires on its own.
+const TRACE_COOKIE_MAX_AGE_SECS: u32 = 3600;
+
+/// Formats the trace cookie `Set-Cookie` header value.
+///
+/// Deliberately host-only (no `Domain` attribute): a `Domain` scoped to
+/// `publisher.cookie_domain` would be rejected by the browser during local
+/// development against `127.0.0.1`/`localhost`, and the overlay only needs to
+/// work on the exact host being debugged. Also neither `HttpOnly` (the TSJS
+/// overlay must read it from `document.cookie`) nor `Secure` (the badge is a
+/// debug aid that must work through plain-HTTP local dev proxies, and the
+/// cookie carries no data worth protecting).
+fn format_trace_cookie() -> String {
+    format!(
+        "{}=1; Path=/; SameSite=Lax; Max-Age={}",
+        COOKIE_TS_TRACE, TRACE_COOKIE_MAX_AGE_SECS,
+    )
+}
+
+/// Formats the trace cookie clearing `Set-Cookie` header value.
+fn format_clear_trace_cookie() -> String {
+    format!("{}=; Path=/; SameSite=Lax; Max-Age=0", COOKIE_TS_TRACE)
+}
+
+/// Whether the request's query string asks to disarm the trace cookie.
+///
+/// Only an explicit `enabled=false` (or `enabled=0`) disarms; any other query
+/// — including none at all — arms it, so `GET /_ts/trace` alone switches the
+/// overlay on.
+fn query_disables(query: Option<&str>) -> bool {
+    query.is_some_and(|q| {
+        q.split('&')
+            .any(|pair| pair == "enabled=false" || pair == "enabled=0")
+    })
+}
+
+/// Handles `GET /_ts/trace`.
+///
+/// Returns `404 Not Found` while `[debug] trace_route_enabled` is false. When
+/// enabled, sets (or with `?enabled=false` clears) the `ts-trace` cookie
+/// scoped to `publisher.cookie_domain` and returns `302 Found` redirecting to
+/// `/` — landing back on the homepage confirms the toggle round-trip worked.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::InvalidHeaderValue`] if the configured cookie
+/// domain cannot be rendered as an HTTP header value.
+pub fn handle_trace_mode(
+    settings: &Settings,
+    query: Option<&str>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+    if !settings.debug.trace_route_enabled {
+        let mut response = Response::new(EdgeBody::empty());
+        *response.status_mut() = StatusCode::NOT_FOUND;
+        return Ok(response);
+    }
+
+    let cookie_value = if query_disables(query) {
+        format_clear_trace_cookie()
+    } else {
+        format_trace_cookie()
+    };
+    let set_cookie = HeaderValue::from_str(&cookie_value).change_context(
+        TrustedServerError::InvalidHeaderValue {
+            message: "trace cookie contains invalid header value".to_string(),
+        },
+    )?;
+
+    let mut response = Response::new(EdgeBody::empty());
+    *response.status_mut() = StatusCode::FOUND;
+    response
+        .headers_mut()
+        .insert(header::LOCATION, HeaderValue::from_static("/"));
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("no-store, private"),
+    );
+    response
+        .headers_mut()
+        .insert(header::SET_COOKIE, set_cookie);
+    Ok(response)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_support::tests::create_test_settings;
+
+    fn trace_enabled_settings() -> Settings {
+        let mut settings = create_test_settings();
+        settings.debug.trace_route_enabled = true;
+        settings
+    }
+
+    #[test]
+    fn trace_route_arms_cookie_and_redirects_to_root() {
+        let settings = trace_enabled_settings();
+
+        let response = handle_trace_mode(&settings, None).expect("should build trace response");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::FOUND,
+            "enabled trace route should redirect"
+        );
+        assert_eq!(
+            response
+                .headers()
+                .get(header::LOCATION)
+                .and_then(|v| v.to_str().ok()),
+            Some("/"),
+            "should redirect to the site root"
+        );
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|v| v.to_str().ok()),
+            Some("no-store, private"),
+            "trace route should not be cacheable"
+        );
+        let set_cookie = response
+            .headers()
+            .get(header::SET_COOKIE)
+            .expect("should set trace cookie")
+            .to_str()
+            .expect("should render set-cookie as utf-8");
+        assert_eq!(
+            set_cookie, "ts-trace=1; Path=/; SameSite=Lax; Max-Age=3600",
+            "trace cookie should be host-only with a bounded lifetime"
+        );
+    }
+
+    #[test]
+    fn trace_route_clears_cookie_when_disabled_by_query() {
+        let settings = trace_enabled_settings();
+
+        let response = handle_trace_mode(&settings, Some("enabled=false"))
+            .expect("should build trace clear response");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::FOUND,
+            "clearing should still redirect"
+        );
+        let set_cookie = response
+            .headers()
+            .get(header::SET_COOKIE)
+            .expect("should clear trace cookie")
+            .to_str()
+            .expect("should render set-cookie as utf-8");
+        assert_eq!(
+            set_cookie, "ts-trace=; Path=/; SameSite=Lax; Max-Age=0",
+            "trace cookie clear should expire the cookie"
+        );
+    }
+
+    #[test]
+    fn trace_route_arms_cookie_for_unrelated_query() {
+        let settings = trace_enabled_settings();
+
+        let response = handle_trace_mode(&settings, Some("enabled=true&foo=bar"))
+            .expect("should build trace response");
+
+        let set_cookie = response
+            .headers()
+            .get(header::SET_COOKIE)
+            .expect("should set trace cookie")
+            .to_str()
+            .expect("should render set-cookie as utf-8");
+        assert!(
+            set_cookie.starts_with("ts-trace=1;"),
+            "non-disabling query should arm the cookie"
+        );
+    }
+
+    #[test]
+    fn trace_route_is_disabled_by_default() {
+        let settings = create_test_settings();
+
+        let response =
+            handle_trace_mode(&settings, None).expect("should build disabled trace response");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::NOT_FOUND,
+            "disabled trace route should return not found"
+        );
+        assert!(
+            response.headers().get(header::SET_COOKIE).is_none(),
+            "disabled trace route should not set a cookie"
+        );
+    }
+}
diff --git a/crates/trusted-server-js/lib/src/core/auction.ts b/crates/trusted-server-js/lib/src/core/auction.ts
index a02684362..489d66f4d 100644
--- a/crates/trusted-server-js/lib/src/core/auction.ts
+++ b/crates/trusted-server-js/lib/src/core/auction.ts
@@ -60,6 +60,12 @@ export interface AuctionBid {
   creativeId: string;
   /** Advertiser domains. */
   adomain: string[];
+  /** Server-side auction ID used for render tracing. */
+  auctionId?: string;
+  /** Upstream OpenRTB bid ID used for render tracing. */
+  bidId?: string;
+  /** Trace hash of the delivered creative markup. */
+  admHash?: string;
 }
 
 // ---------------------------------------------------------------------------
@@ -128,6 +134,7 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
   const bids: AuctionBid[] = [];
   const seatbids = body?.seatbid;
   if (!Array.isArray(seatbids)) return bids;
+  const responseAuctionId = typeof body?.id === 'string' && body.id !== '' ? body.id : undefined;
 
   for (const seatbid of seatbids) {
     const seat: string = typeof seatbid?.seat === 'string' ? seatbid.seat : 'unknown';
@@ -141,6 +148,7 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
       const height = typeof bid?.h === 'number' ? bid.h : (renderer?.height ?? 250);
       const creativeId =
         typeof bid?.crid === 'string' ? bid.crid : (renderer?.creativeId ?? `${seat}-${impid}`);
+      const tsExt = bid?.ext?.ts;
 
       bids.push({
         impid,
@@ -157,6 +165,13 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
         adomain: Array.isArray(bid?.adomain)
           ? bid.adomain.filter((domain: unknown): domain is string => typeof domain === 'string')
           : [],
+        auctionId:
+          typeof tsExt?.auction_id === 'string' && tsExt.auction_id !== ''
+            ? tsExt.auction_id
+            : responseAuctionId,
+        bidId: typeof bid?.id === 'string' && bid.id !== '' ? bid.id : undefined,
+        admHash:
+          typeof tsExt?.adm_hash === 'string' && tsExt.adm_hash !== '' ? tsExt.adm_hash : undefined,
       });
     }
   }
diff --git a/crates/trusted-server-js/lib/src/core/index.ts b/crates/trusted-server-js/lib/src/core/index.ts
index 5d8e41971..b2c4e41e1 100644
--- a/crates/trusted-server-js/lib/src/core/index.ts
+++ b/crates/trusted-server-js/lib/src/core/index.ts
@@ -36,10 +36,10 @@ api.getConfig = getConfig;
 // Provide core requestAds API
 api.requestAds = requestAds;
 // Defensive defaults: the edge injects adSlots (head-open) and bids (before
-// </body>) only when the server-side ad stack runs for the request. When it
-// is gated off (kill switch, consent fail-closed, bots, prefetch), page code
-// reading window.tsjs.bids / window.tsjs.adSlots must still see defined
-// values instead of throwing. Injected scripts overwrite these wholesale.
+// </body>) only when server-side ad templates run for the request. When template
+// delivery is disabled or gated off (auction/consent, bots, prefetch), page code
+// reading window.tsjs.bids / window.tsjs.adSlots must still see defined values
+// instead of throwing. Injected scripts overwrite these wholesale.
 api.adSlots ??= [];
 api.bids ??= {};
 // Point global tsjs
diff --git a/crates/trusted-server-js/lib/src/core/request.ts b/crates/trusted-server-js/lib/src/core/request.ts
index df3fee6a6..f22c1dbfc 100644
--- a/crates/trusted-server-js/lib/src/core/request.ts
+++ b/crates/trusted-server-js/lib/src/core/request.ts
@@ -6,6 +6,7 @@ import { collectContext } from './context';
 import { log } from './log';
 import { getAllUnits, firstSize } from './registry';
 import { createAdIframe, findSlot, buildCreativeDocument, sanitizeCreativeHtml } from './render';
+import { isEffectivelyVisible, recordRender, stampCreativeTrace } from './trace';
 
 export type RequestAdsCallback = () => void;
 export interface RequestAdsOptions {
@@ -21,6 +22,9 @@ type RenderCreativeInlineOptions = {
   creativeHeight?: number;
   seat: string;
   creativeId: string;
+  auctionId?: string;
+  bidId?: string;
+  admHash?: string;
 };
 
 // Entry point matching Prebid's requestBids signature; uses unified /auction endpoint.
@@ -66,6 +70,9 @@ export function requestAds(
             creativeHeight: bid.height,
             seat: bid.seat,
             creativeId: bid.creativeId,
+            auctionId: bid.auctionId,
+            bidId: bid.bidId,
+            admHash: bid.admHash,
           });
         }
         log.info('requestAds: rendered creatives from response');
@@ -95,7 +102,20 @@ function renderCreativeInline({
   creativeHeight,
   seat,
   creativeId,
+  auctionId,
+  bidId,
+  admHash,
 }: RenderCreativeInlineOptions): void {
+  const trace = {
+    slotId,
+    path: 'auction' as const,
+    auctionId,
+    bidId,
+    bidder: seat,
+    creativeId,
+    admHash,
+    servedFrom: 'inline' as const,
+  };
   const container = findSlot(slotId) as HTMLElement | null;
   if (!container) {
     log.warn('renderCreativeInline: slot not found; skipping render', { slotId, seat, creativeId });
@@ -112,6 +132,14 @@ function renderCreativeInline({
         originalLength: sanitization.originalLength,
         rejectionReason: sanitization.rejectionReason,
       });
+      const record = recordRender({
+        ...trace,
+        rendered: false,
+        injected: false,
+        visible: false,
+        elementId: container.id || undefined,
+      });
+      stampCreativeTrace(container, record);
       return;
     }
 
@@ -143,6 +171,16 @@ function renderCreativeInline({
 
     iframe.srcdoc = buildCreativeDocument(sanitization.sanitizedHtml);
 
+    const record = recordRender({
+      ...trace,
+      rendered: true,
+      injected: true,
+      visible: isEffectivelyVisible(container),
+      elementId: container.id || undefined,
+    });
+    stampCreativeTrace(container, record);
+    stampCreativeTrace(iframe, record);
+
     log.info('renderCreativeInline: rendered', {
       slotId,
       seat,
diff --git a/crates/trusted-server-js/lib/src/core/trace.ts b/crates/trusted-server-js/lib/src/core/trace.ts
new file mode 100644
index 000000000..2acc50900
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/core/trace.ts
@@ -0,0 +1,582 @@
+// Render-trace registry, DOM markers, and a floating debug panel: joins a
+// creative rendered on the page back to the winning server-side auction bid.
+// Every render writes a RenderRecord to window.tsjs.renders (keyed by slot ID),
+// stamps the slot element with data-ts-* attributes carrying the same trace
+// tuple, and fires a 'tsjs:adRendered' CustomEvent. When the ts-trace cookie is
+// armed (via GET /_ts/trace), a Google-Publisher-Console-style overlay panel
+// summarises every traced slot so an operator can confirm on the page itself
+// that creatives came through Trusted Server — on both the SSAT/GAM and
+// /auction render paths.
+import { log } from './log';
+import type { RenderRecord, TsjsApi } from './types';
+
+/** CustomEvent fired on window after each render-trace record is written. */
+export const RENDER_EVENT_NAME = 'tsjs:adRendered';
+
+/**
+ * Cookie armed by `GET /_ts/trace` (server-side, `ts-trace=1`). While present,
+ * the floating trace panel is shown so an operator can see on the page itself
+ * that creatives were delivered by Trusted Server.
+ */
+const TRACE_COOKIE_NAME = 'ts-trace';
+
+/** DOM id of the floating trace panel (body-level overlay). */
+export const TRACE_PANEL_ID = 'ts-render-trace-panel';
+
+/**
+ * Upper bound on `window.tsjs.renderLog`. A publisher page that refreshes its
+ * slots on every render can produce hundreds of entries in a session, so the
+ * history is trimmed from the front rather than growing without limit.
+ */
+const MAX_RENDER_LOG_ENTRIES = 200;
+
+/**
+ * Fallback for [`nextRenderSeq`] when `window.tsjs` is unreachable (no DOM, or
+ * a throwing property access). Never the primary counter — see below.
+ */
+let fallbackRenderSeq = 0;
+
+/**
+ * Allocate the next value for [`RenderRecord.seq`].
+ *
+ * The counter lives on the shared `window.tsjs` object, not in module scope:
+ * `build-all.mjs` emits core, GPT and every integration as separate
+ * self-contained IIFEs, each with its own inlined copy of this module. A
+ * module-scoped counter would therefore restart at 1 in each bundle and hand
+ * two different renders the same number — duplicate `#1` panel rows and
+ * badges across the SSAT and `/auction` paths.
+ */
+function nextRenderSeq(): number {
+  try {
+    const ts = (window.tsjs ??= {} as TsjsApi);
+    const next = Math.max(ts.renderSeq ?? 0, fallbackRenderSeq) + 1;
+    ts.renderSeq = next;
+    fallbackRenderSeq = next;
+    return next;
+  } catch {
+    return ++fallbackRenderSeq;
+  }
+}
+
+/** CSS class of the per-slot confirmation badge (only on honestly-ok slots). */
+export const TRACE_BADGE_CLASS = 'ts-render-badge';
+
+/**
+ * Whether the visible trace overlay is armed (`ts-trace=1` cookie present —
+ * set via `GET /_ts/trace`, cleared via `GET /_ts/trace?enabled=false`).
+ */
+export function traceOverlayEnabled(): boolean {
+  try {
+    return new RegExp(`(?:^|;\\s*)${TRACE_COOKIE_NAME}=1(?:;|$)`).test(document.cookie);
+  } catch {
+    return false;
+  }
+}
+
+/** Short-form mechanism suffix — only the bridge mechanisms add information. */
+function mechanismSuffix(record: RenderRecord): string {
+  return record.servedFrom === 'debug-adm' || record.servedFrom === 'pbs-cache'
+    ? ` (${record.servedFrom})`
+    : '';
+}
+
+/**
+ * Whether an element is effectively visible: connected, non-zero box, and no
+ * ancestor hiding it via `display:none`, `visibility:hidden`, or `opacity:0`.
+ *
+ * The ancestor walk is what catches a slot the publisher holds at `opacity:0`
+ * on a wrapper until its own ad code reveals it — the slot's own computed
+ * opacity is `1`, so only walking up exposes the gate.
+ */
+export function isEffectivelyVisible(el: Element | null): boolean {
+  try {
+    if (!el || !(el instanceof HTMLElement) || !el.isConnected) return false;
+    const rect = el.getBoundingClientRect();
+    if (rect.width <= 0 || rect.height <= 0) return false;
+    let node: HTMLElement | null = el;
+    while (node) {
+      const cs = getComputedStyle(node);
+      if (
+        cs.display === 'none' ||
+        cs.visibility === 'hidden' ||
+        parseFloat(cs.opacity || '1') === 0
+      ) {
+        return false;
+      }
+      node = node.parentElement;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Honest per-slot status for the panel, derived from the separate signals:
+ * - `empty`   — GAM reported the slot empty, or nothing was placed.
+ * - `hidden`  — a creative rendered but the slot is not visible (reveal gate).
+ * - `gam-only`— GAM rendered something, but TS did not place it (can't confirm
+ *               it is the TS creative — cross-origin).
+ * - `ok`      — TS placed a creative and the slot is visible.
+ */
+type PanelStatus = 'ok' | 'hidden' | 'gam-only' | 'empty';
+
+function panelStatus(record: RenderRecord): PanelStatus {
+  if (!record.rendered || record.gamEmpty === true) return 'empty';
+  if (record.visible === false) return 'hidden';
+  // `ok` requires a *confirmed* TS placement. Anything else — TS applied
+  // targeting only (injected false, creative is GAM's and cross-origin
+  // unreadable), or a path that never reported placement (undefined) — must not
+  // be claimed as a TS render. Defaulting to gam-only keeps the panel honest
+  // even if a future render path forgets to set `injected`.
+  if (record.injected !== true) return 'gam-only';
+  return 'ok';
+}
+
+const STATUS_STYLE: Record<PanelStatus, { color: string; mark: string; label: string }> = {
+  ok: { color: '#3fb950', mark: '✓', label: 'ok' },
+  hidden: { color: '#d29922', mark: '⚠', label: 'hidden' },
+  'gam-only': { color: '#58a6ff', mark: '◐', label: 'gam-only' },
+  empty: { color: '#f85149', mark: '✗', label: 'empty' },
+};
+
+/**
+ * Attach (or replace) the per-slot confirmation badge on a slot element.
+ *
+ * Only called for `ok` slots — a TS creative that actually placed and is
+ * visible — so the green badge on a physical banner is a truthful "this banner
+ * is the render in the trace panel" marker, not the overclaiming badge the
+ * first cut shipped. Hidden / gam-only / empty slots deliberately get none.
+ *
+ * `pointer-events: none` keeps the badge from intercepting clicks on the ad.
+ */
+function attachTraceBadge(el: HTMLElement, record: RenderRecord): void {
+  const style = STATUS_STYLE[panelStatus(record)];
+
+  const position = getComputedStyle(el).position;
+  if (position === 'static' || position === '') {
+    el.style.position = 'relative';
+  }
+
+  const badge = document.createElement('div');
+  badge.className = TRACE_BADGE_CLASS;
+  // Lead with the sequence number: it is what ties this badge to a panel row.
+  badge.textContent =
+    `TS ${style.mark} #${record.seq}` +
+    `${record.bidder ? ` · ${record.bidder}` : ''}` +
+    `${style.label === 'ok' ? '' : ` · ${style.label}`}`;
+  badge.title = [
+    `render: #${record.seq}`,
+    `slot: ${record.slotId}`,
+    `auction: ${record.auctionId ?? '—'}`,
+    `bidder: ${record.bidder ?? '—'}`,
+    `bid_id: ${record.bidId ?? '—'}`,
+    `creative: ${record.creativeId ?? '—'}`,
+    `adm_hash: ${record.admHash ?? '—'}`,
+    `served: ${record.servedFrom ?? '—'}`,
+  ].join('\n');
+  const s = badge.style;
+  s.setProperty('position', 'absolute');
+  s.setProperty('top', '4px');
+  s.setProperty('left', '4px');
+  s.setProperty('z-index', '2147483646');
+  s.setProperty('pointer-events', 'none');
+  s.setProperty('font', '10px/1.5 ui-monospace, Menlo, Consolas, monospace');
+  s.setProperty('padding', '1px 5px');
+  s.setProperty('color', '#fff');
+  s.setProperty('background', style.color);
+  s.setProperty('border-radius', '3px');
+  el.appendChild(badge);
+}
+
+/**
+ * Remove this element's own trace badge, if it has one.
+ *
+ * Must run on *every* stamp, not only the ones that go on to attach a new
+ * badge: a slot that re-renders into `empty` or `hidden` gets no replacement
+ * badge, so without an unconditional removal it would keep displaying the green
+ * or blue badge from its previous render — contradicting the status the panel
+ * shows for the same slot.
+ */
+function removeTraceBadge(el: HTMLElement): void {
+  el.querySelectorAll(`:scope > .${TRACE_BADGE_CLASS}`).forEach((n) => n.remove());
+}
+
+/** Truncate a long id for the compact panel row while keeping the tail. */
+function short(value: string | undefined, keep = 10): string {
+  if (!value) return '?';
+  return value.length > keep ? `…${value.slice(-keep)}` : value;
+}
+
+/**
+ * Create (or return) the floating trace panel appended to `document.body`.
+ *
+ * A body-level fixed overlay is used deliberately instead of per-slot badges:
+ * it survives GAM/APS clearing a slot's `innerHTML`, publisher reveal gates
+ * that hold a slot wrapper at `opacity: 0`, and cross-origin creative iframes —
+ * none of which a child-of-slot badge can survive.
+ */
+function ensureTracePanel(): HTMLElement | null {
+  if (typeof document === 'undefined' || !document.body) return null;
+
+  const existing = document.getElementById(TRACE_PANEL_ID);
+  if (existing) return existing;
+
+  const panel = document.createElement('div');
+  panel.id = TRACE_PANEL_ID;
+  const s = panel.style;
+  s.setProperty('position', 'fixed');
+  s.setProperty('bottom', '12px');
+  s.setProperty('right', '12px');
+  s.setProperty('z-index', '2147483647');
+  s.setProperty('max-width', '360px');
+  s.setProperty('max-height', '45vh');
+  s.setProperty('overflow', 'auto');
+  s.setProperty('background', 'rgba(17,17,17,0.94)');
+  s.setProperty('color', '#eee');
+  s.setProperty('font', '11px/1.5 ui-monospace, Menlo, Consolas, monospace');
+  s.setProperty('border', '1px solid #333');
+  s.setProperty('border-radius', '6px');
+  s.setProperty('box-shadow', '0 4px 16px rgba(0,0,0,0.4)');
+  s.setProperty('padding', '0');
+  document.body.appendChild(panel);
+  return panel;
+}
+
+/**
+ * Whether this record is still the live render for its slot — i.e. the entry
+ * `window.tsjs.renders` currently holds. Every other row in the log has been
+ * superseded by a later render of the same slot.
+ *
+ * Compares by object identity, not by `seq`: the registry and the history hold
+ * the same record objects, so identity is exact regardless of how sequence
+ * numbers were allocated.
+ */
+function isCurrentRender(record: RenderRecord): boolean {
+  try {
+    return window.tsjs?.renders?.[record.slotId] === record;
+  } catch {
+    return false;
+  }
+}
+
+/** GAM/injection state summary for the panel's detail line. */
+function stateSummary(record: RenderRecord): string {
+  const parts: string[] = [];
+  // GAM's own fill signal, on every render path that has one. Gating this on
+  // `ssat` would hide it for `gam-refresh`, where "did GAM fill it this time"
+  // is the whole question.
+  if (record.gamEmpty !== undefined) {
+    parts.push(`gam:${record.gamEmpty ? 'empty' : 'filled'}`);
+  }
+  if (record.injected !== undefined) {
+    parts.push(`inj:${record.injected ? 'y' : 'n'}`);
+  }
+  parts.push(`vis:${record.visible === false ? 'n' : record.visible ? 'y' : '?'}`);
+  return parts.join(' · ');
+}
+
+/**
+ * Copy a record's full JSON to the clipboard and log it — used by the panel's
+ * click-to-copy so full (untruncated) auction IDs and hashes are debuggable
+ * without hovering the title or digging in `window.tsjs.renders`.
+ */
+function copyRecord(record: RenderRecord): void {
+  const json = JSON.stringify(record, null, 2);
+  log.info('trace: render record', record);
+  try {
+    void navigator.clipboard?.writeText(json);
+  } catch {
+    // Clipboard unavailable (insecure context / permissions) — the console
+    // log above is the fallback.
+  }
+}
+
+/** Build one slot row for the panel. */
+function buildPanelRow(record: RenderRecord): HTMLElement {
+  const status = panelStatus(record);
+  const style = STATUS_STYLE[status];
+
+  const row = document.createElement('div');
+  const rs = row.style;
+  rs.setProperty('padding', '6px 10px');
+  rs.setProperty('border-top', '1px solid #2a2a2a');
+  rs.setProperty('border-left', `3px solid ${style.color}`);
+  rs.setProperty('cursor', 'pointer');
+  // Click a row to copy its full record (untruncated IDs/hash) + log it.
+  row.addEventListener('click', () => copyRecord(record));
+  row.title = [
+    `render: #${record.seq}`,
+    `slot: ${record.slotId}`,
+    `status: ${style.label}`,
+    `path: ${record.path}`,
+    `rendered (gam non-empty): ${record.rendered}`,
+    `gam_empty: ${record.gamEmpty ?? '—'}`,
+    `injected (ts placed): ${record.injected ?? '—'}`,
+    `visible: ${record.visible ?? '—'}`,
+    `auction: ${record.auctionId ?? '—'}`,
+    `bidder: ${record.bidder ?? '—'}`,
+    `creative: ${record.creativeId ?? '—'}`,
+    `ad_id: ${record.adId ?? '—'}`,
+    `bid_id: ${record.bidId ?? '—'}`,
+    `adm_hash: ${record.admHash ?? '—'}`,
+    `served: ${record.servedFrom ?? '—'}`,
+    `element: ${record.elementId ?? '—'}`,
+    `renders: ${record.count}`,
+  ].join('\n');
+
+  const line1 = document.createElement('div');
+  const clock = new Date(record.at).toLocaleTimeString('en-GB', { hour12: false });
+  // `current` marks the row still on screen for its slot — the one whose badge,
+  // if any, is the badge you are looking at. Older rows are history.
+  const current = isCurrentRender(record) ? ' ◂ current' : '';
+  line1.textContent = `#${record.seq} ${clock} ${style.mark} ${record.slotId} · ${style.label}${current}`;
+  line1.style.setProperty('font-weight', '600');
+  line1.style.setProperty('color', style.color);
+
+  const line2 = document.createElement('div');
+  line2.style.setProperty('color', '#bbb');
+  // An unattributed render (a GAM refresh TS ran no auction for) carries no
+  // bidder or hash by design. Say that, rather than rendering `? · ?` as if a
+  // lookup had failed.
+  const attribution =
+    record.bidder || record.admHash
+      ? `${record.bidder ?? '?'} · ${short(record.admHash)}`
+      : 'no TS attribution';
+  line2.textContent = `${record.path}${mechanismSuffix(record)} · ${attribution}`;
+
+  const line3 = document.createElement('div');
+  line3.style.setProperty('color', '#777');
+  const auction = record.auctionId ? ` · auction ${short(record.auctionId)}` : '';
+  // `×N` is this slot's own render count — distinct from the page-global `#seq`
+  // on line 1, which is what the on-creative badge shows.
+  line3.textContent = `${stateSummary(record)}${auction} · ×${record.count}`;
+
+  row.append(line1, line2, line3);
+  return row;
+}
+
+/**
+ * Rebuild the floating trace panel from `window.tsjs.renders`.
+ *
+ * Reads the whole registry each call so the panel always reflects the current
+ * state; safe to call on every render event.
+ */
+export function renderTracePanel(): void {
+  try {
+    if (!traceOverlayEnabled()) return;
+    const panel = ensureTracePanel();
+    if (!panel) return;
+
+    const renders = window.tsjs?.renders ?? {};
+    const slots = Object.values(renders);
+    // Count only slots that are honestly OK (TS creative placed and visible),
+    // not merely "GAM said something rendered" — the whole point of the fix.
+    const ok = slots.filter((r) => panelStatus(r) === 'ok').length;
+    // Newest render first: on a page that refreshes its slots this reads as a
+    // timeline rather than a set of counters.
+    const history = [...(window.tsjs?.renderLog ?? [])].reverse();
+
+    panel.replaceChildren();
+
+    const header = document.createElement('div');
+    const hs = header.style;
+    hs.setProperty('display', 'flex');
+    hs.setProperty('justify-content', 'space-between');
+    hs.setProperty('align-items', 'center');
+    hs.setProperty('gap', '8px');
+    hs.setProperty('padding', '6px 10px');
+    hs.setProperty('position', 'sticky');
+    hs.setProperty('top', '0');
+    hs.setProperty('background', '#000');
+    hs.setProperty('font-weight', '700');
+
+    const title = document.createElement('span');
+    title.textContent = `TS Render Trace · ${ok}/${slots.length} slots ok · ${history.length} renders`;
+
+    const close = document.createElement('button');
+    close.textContent = '×';
+    close.setAttribute('aria-label', 'Close trace panel');
+    const cs = close.style;
+    cs.setProperty('background', 'transparent');
+    cs.setProperty('color', '#eee');
+    cs.setProperty('border', '0');
+    cs.setProperty('font-size', '14px');
+    cs.setProperty('cursor', 'pointer');
+    cs.setProperty('line-height', '1');
+    close.addEventListener('click', () => panel.remove());
+
+    header.append(title, close);
+    panel.appendChild(header);
+
+    const hint = document.createElement('div');
+    hint.style.setProperty('padding', '2px 10px 4px');
+    hint.style.setProperty('color', '#777');
+    hint.style.setProperty('font-size', '9px');
+    hint.textContent = 'newest first · click a row to copy its full record · hover for detail';
+    panel.appendChild(hint);
+
+    if (history.length === 0) {
+      const empty = document.createElement('div');
+      empty.style.setProperty('padding', '6px 10px');
+      empty.style.setProperty('color', '#bbb');
+      empty.textContent = 'No creatives traced yet.';
+      panel.appendChild(empty);
+      return;
+    }
+
+    for (const record of history) {
+      panel.appendChild(buildPanelRow(record));
+    }
+  } catch (err) {
+    log.warn('trace: failed to render panel', err);
+  }
+}
+
+/**
+ * Write a render record into `window.tsjs.renders` and fire the render event.
+ *
+ * Repeated records for the same slot (SPA navigation, GPT refresh) overwrite
+ * the previous entry and increment `count`, so the registry always reflects
+ * the latest render while preserving how many renders the slot has seen.
+ * When the trace overlay is armed, the floating panel is refreshed here — the
+ * single choke point every render passes through.
+ */
+export function recordRender(record: Omit<RenderRecord, 'count' | 'at' | 'seq'>): RenderRecord {
+  const full: RenderRecord = { ...record, count: 1, seq: nextRenderSeq(), at: Date.now() };
+  try {
+    const ts = (window.tsjs ??= {} as TsjsApi);
+    const renders = (ts.renders ??= {});
+    const prev = renders[record.slotId];
+    if (prev) full.count = prev.count + 1;
+    renders[record.slotId] = full;
+
+    // Keep each render as its own history entry, trimmed from the front.
+    const history = (ts.renderLog ??= []);
+    history.push(full);
+    if (history.length > MAX_RENDER_LOG_ENTRIES) {
+      history.splice(0, history.length - MAX_RENDER_LOG_ENTRIES);
+    }
+  } catch (err) {
+    log.warn('trace: failed to write render record', { slotId: record.slotId, err });
+  }
+  try {
+    window.dispatchEvent(new CustomEvent(RENDER_EVENT_NAME, { detail: full }));
+  } catch (err) {
+    // CustomEvent unavailable — registry entry above is still written.
+    log.debug('trace: failed to dispatch render event', { slotId: record.slotId, err });
+  }
+  renderTracePanel();
+  return full;
+}
+
+/**
+ * Fields a later signal about an already-recorded render may contribute.
+ * Identity (`slotId`) and bookkeeping (`seq`, `count`, `at`) are fixed at
+ * [`recordRender`] time and are never revised.
+ */
+export type RenderUpdate = Partial<Omit<RenderRecord, 'slotId' | 'seq' | 'count' | 'at'>>;
+
+/** Confirmation flags that a later, weaker signal must never clear. */
+const CONFIRMATION_FIELDS = ['rendered', 'injected'] as const;
+
+/**
+ * Merge a later signal into an existing render record, **in place**.
+ *
+ * One impression can be observed twice: GAM's `slotRenderEnded` and the Prebid
+ * Universal Creative bridge both describe the same GAM ad request, and a
+ * deferred ADM placement resolves an animation frame after the render was first
+ * recorded. Appending a second [`recordRender`] for those would inflate the
+ * slot's `count`, the history length, the page-global sequence numbers and the
+ * panel totals — one impression must stay one row.
+ *
+ * So the later signal enriches the record instead: `seq`, `count` and `at` are
+ * left untouched and no new history entry is appended. Because the registry and
+ * the history hold the *same* object, mutating it updates both.
+ *
+ * Confirmations only ever strengthen. A `false` in `patch` cannot clear a
+ * `true` already on the record, so the weaker GAM-only signal arriving after
+ * the bridge's confirmed placement does not erase it.
+ */
+export function updateRender(record: RenderRecord, patch: RenderUpdate): RenderRecord {
+  try {
+    const fields = record as unknown as Record<string, unknown>;
+    for (const [key, value] of Object.entries(patch)) {
+      if (value === undefined) continue;
+      if (
+        value === false &&
+        fields[key] === true &&
+        (CONFIRMATION_FIELDS as readonly string[]).includes(key)
+      ) {
+        continue;
+      }
+      fields[key] = value;
+    }
+  } catch (err) {
+    log.warn('trace: failed to update render record', { slotId: record.slotId, err });
+  }
+  try {
+    window.dispatchEvent(new CustomEvent(RENDER_EVENT_NAME, { detail: record }));
+  } catch (err) {
+    // CustomEvent unavailable — the mutated record above still stands.
+    log.debug('trace: failed to dispatch render update event', { slotId: record.slotId, err });
+  }
+  renderTracePanel();
+  return record;
+}
+
+/**
+ * Stamp an element with `data-ts-*` attributes carrying the trace tuple, so
+ * a creative in the DOM can be joined to the server-side `auction winner:` /
+ * `auction delivered creative:` log lines by inspection alone.
+ *
+ * Attributes whose record field is absent are removed, so a re-render of the
+ * same element (SPA navigation, GPT refresh) never leaves stale values from a
+ * previous auction next to the new ones. These attributes live on the element
+ * itself, so they survive a later `innerHTML = ''` that clears the slot's
+ * children (e.g. the GAM adm interceptor) — unlike a child badge would.
+ */
+export function stampCreativeTrace(el: Element, record: RenderRecord): void {
+  const attrs: Array<[string, string | undefined]> = [
+    ['data-ts-slot-id', record.slotId],
+    ['data-ts-render-path', record.path],
+    ['data-ts-rendered', String(record.rendered)],
+    ['data-ts-auction-id', record.auctionId],
+    ['data-ts-bidder', record.bidder],
+    ['data-ts-ad-id', record.adId],
+    ['data-ts-bid-id', record.bidId],
+    ['data-ts-creative-id', record.creativeId],
+    ['data-ts-adm-hash', record.admHash],
+    ['data-ts-served-from', record.servedFrom],
+    ['data-ts-gam-empty', record.gamEmpty === undefined ? undefined : String(record.gamEmpty)],
+    ['data-ts-injected', record.injected === undefined ? undefined : String(record.injected)],
+    ['data-ts-visible', record.visible === undefined ? undefined : String(record.visible)],
+  ];
+  try {
+    for (const [name, value] of attrs) {
+      if (value !== undefined && value !== '') {
+        el.setAttribute(name, value);
+      } else {
+        el.removeAttribute(name);
+      }
+    }
+    // Badge any slot that actually shows something, carrying its honest status
+    // colour: green ✓ for a confirmed TS render, blue ◐ for `gam-only` (GAM
+    // rendered, TS cannot confirm it as its own). Slots with nothing on screen
+    // (`empty`) or nothing visible (`hidden`) stay unbadged — there is no
+    // creative there to label. Never badge the iframe itself.
+    //
+    // Any previous badge is dropped first, unconditionally, so a slot that
+    // re-renders into `empty` or `hidden` sheds the badge from its last render
+    // instead of contradicting the panel.
+    if (el instanceof HTMLElement && el.tagName !== 'IFRAME') {
+      removeTraceBadge(el);
+      const status = panelStatus(record);
+      if (traceOverlayEnabled() && (status === 'ok' || status === 'gam-only')) {
+        attachTraceBadge(el, record);
+      }
+    }
+  } catch (err) {
+    log.warn('trace: failed to stamp element', { slotId: record.slotId, err });
+  }
+}
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 0c68d43fe..3028bfc13 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -85,12 +85,14 @@ export interface AuctionBidData {
   hb_adid?: string;
   hb_cache_host?: string;
   hb_cache_path?: string;
+  /** Trace-only OpenRTB bid identifier. */
+  hb_bid_id?: string;
   /** Opaque server-auction correlation ID used only by GPT diagnostics. */
   hb_auction_id?: string;
-  /** Winning creative width; the bridge sizes the inline render from this. */
-  w?: number;
-  /** Winning creative height; the bridge sizes the inline render from this. */
-  h?: number;
+  /** Trace-only OpenRTB creative identifier. */
+  hb_crid?: string;
+  /** Trace hash of delivered creative markup. */
+  hb_adm_hash?: string;
   nurl?: string;
   burl?: string;
   /** Typed winning-bid renderer capability. */
@@ -108,6 +110,30 @@ export interface AuctionBidData {
   debug_bid?: AuctionDebugBidData;
 }
 
+/** How a creative reached the page for a [`RenderRecord`]. */
+export type RenderServedFrom = 'inline' | 'gam' | 'debug-adm' | 'pbs-cache' | 'prebid';
+
+/** Client-side record joining a rendered creative to its auction winner. */
+export interface RenderRecord {
+  slotId: string;
+  path: 'auction' | 'ssat' | 'gam-refresh';
+  rendered: boolean;
+  elementId?: string;
+  auctionId?: string;
+  bidder?: string;
+  adId?: string;
+  bidId?: string;
+  creativeId?: string;
+  admHash?: string;
+  servedFrom?: RenderServedFrom;
+  gamEmpty?: boolean;
+  injected?: boolean;
+  visible?: boolean;
+  count: number;
+  seq: number;
+  at: number;
+}
+
 export type GptDiagnosticsCallbackKind =
   | 'slotRequested'
   | 'slotResponseReceived'
@@ -284,11 +310,11 @@ export interface GptDiagnosticsExportV1 {
   };
   slots: GptDiagnosticsSlotExport[];
   callbackIssues: GptDiagnosticsCallbackIssue[];
-  attributionIssues?: GptDiagnosticsAttributionIssue[];
+  attributionIssues: GptDiagnosticsAttributionIssue[];
   coverage: Record<GptDiagnosticsCallbackKind, GptDiagnosticsCoverageCounters>;
   metadata: {
     droppedCallbacks: number;
-    droppedAttributionIssues?: number;
+    droppedAttributionIssues: number;
     evictedSlots: number;
     evictedRequestCycles: number;
   };
@@ -390,6 +416,14 @@ export interface TsjsApi {
   apsPrebidRenderers?: Record<string, ApsPrebidRendererEntry>;
   /** Initialises GPT slots with server-side bid targeting and calls refresh(). */
   adInit?: () => void;
+  /** Render-trace registry: latest render per slot. */
+  renders?: Record<string, RenderRecord>;
+  /** Append-only history of every render. */
+  renderLog?: RenderRecord[];
+  /** Monotonic render generation for cancelling stale async work. */
+  renderGeneration?: number;
+  /** Page-global render sequence counter. */
+  renderSeq?: number;
   /** GPT slot objects TS defined — used to destroy stale slots on SPA navigation. */
   prevGptSlots?: unknown[];
   /** Guards one-time-per-page enableSingleRequest/enableServices calls. */
@@ -436,9 +470,10 @@ export interface TsjsApi {
    * generation 0 (the SSR document) and no-ops when a navigation has
    * committed — before it was called, or while it was pending. A counter is
    * used instead of a URL comparison so the guard cannot diverge from the
-   * auction path: a query-only history change (which the hook deliberately
-   * ignores) leaves the counter unchanged, and an `/a → /b → /a` round trip
-   * (where the URL compares equal again) advances it.
+   * auction path: the hook's route identity is pathname plus query (matching
+   * the page-bids refresh hook), hash-only changes leave the counter
+   * unchanged, and an `/a → /b → /a` round trip (where the URL compares
+   * equal again) still advances it.
    */
   navGeneration?: number;
   /**
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
index 85f17adf9..a04c360f5 100644
--- a/crates/trusted-server-js/lib/src/integrations/aps/render.ts
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -426,7 +426,9 @@ function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("AP
 function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;
 if(m.message==="${RENDERER_READY_MESSAGE}"){done=true;clean();resolve();}
 else if(m.message==="${RENDERER_FAILED_MESSAGE}")fail();}
-f.width=String(r.width);f.height=String(r.height);f.style.border="0";
+var x=w.document;if(x.documentElement)x.documentElement.style.overflow="hidden";
+if(x.body){x.body.style.margin="0";x.body.style.padding="0";x.body.style.overflow="hidden";}
+f.width=String(r.width);f.height=String(r.height);f.style.border="0";f.style.display="block";
 f.setAttribute("sandbox","${APS_RENDERER_SANDBOX}");
 f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};
 f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,${RENDERER_READY_TIMEOUT_MS});w.document.body.appendChild(f);
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index f0df35974..5448210c7 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -1,4 +1,5 @@
 import { log } from '../../core/log';
+import { isEffectivelyVisible, recordRender, stampCreativeTrace } from '../../core/trace';
 import type {
   AuctionSlot,
   AuctionBidData,
@@ -53,6 +54,36 @@ function isNonEmptyString(value: unknown): value is string {
   return typeof value === 'string' && value.length > 0;
 }
 
+function bumpRenderGeneration(ts: TsjsApi): number {
+  const next = (ts.renderGeneration ?? 0) + 1;
+  ts.renderGeneration = next;
+  return next;
+}
+
+function recordGptBridgeRender(
+  slotId: string,
+  bid: AuctionBidData,
+  servedFrom: 'inline' | 'pbs-cache',
+  element: HTMLElement | null
+): void {
+  const record = recordRender({
+    slotId,
+    path: 'ssat',
+    auctionId: bid.hb_auction_id,
+    bidder: bid.hb_bidder,
+    adId: bid.hb_adid,
+    bidId: bid.hb_bid_id,
+    creativeId: bid.hb_crid,
+    admHash: bid.hb_adm_hash,
+    rendered: true,
+    injected: true,
+    visible: isEffectivelyVisible(element),
+    elementId: element?.id,
+    servedFrom,
+  });
+  if (element) stampCreativeTrace(element, record);
+}
+
 function trustedServerOpportunity(bid: AuctionBidData): GptDiagnosticsTrustedServerOpportunity {
   const hasBidTargeting = TS_BID_TARGETING_KEYS.some((key) => isNonEmptyString(bid[key]));
   if (!hasBidTargeting) return 'no_candidate';
@@ -670,10 +701,10 @@ function installInitialLoadDetector(ts: TsjsApi): void {
  * dropped and `adInit()` is not run: running anyway would re-run the newer
  * route's live slots/bids, destroying and redefining that route's TS slots
  * and double-refreshing it. The generation counter (not a URL comparison)
- * keeps this guard aligned with the SPA auction hook's own navigation
- * identity: a query-only history change the hook ignores must not cancel the
- * initial call, while an `/a → /b → /a` round trip — where the URL compares
- * equal again — must.
+ * keeps this guard aligned with the SPA auction hook's pathname-and-query
+ * route identity: query changes cancel the initial call because they request
+ * fresh page bids, while an `/a → /b → /a` round trip remains
+ * distinguishable even though the final URL equals the original.
  *
  * Hidden documents: browsers do not service `requestAnimationFrame` while a
  * document is hidden, so a background-tab load (Cmd+click, open-in-new-tab)
@@ -919,6 +950,7 @@ export function installTsAdInit(): void {
     // first act and stands down rather than applying this invocation's
     // slots/bids to the newer route's DOM and double-requesting it.
     const generation = ts.navGeneration ?? 0;
+    const renderGeneration = bumpRenderGeneration(ts);
     const g = (window as GptWindow).googletag;
     if (!g) return;
     const warnedResolutionFailures = new Set<string>();
@@ -1094,8 +1126,8 @@ export function installTsAdInit(): void {
       ts.prevSlotTargetingKeys = nextSlotTargetingKeys;
 
       // Whether this call produced any TS slot to render. A gated page-bids
-      // response (auction kill switch or consent denial) returns no slots, so
-      // the loops above leave these empty.
+      // response (template switch, auction gate, or consent denial) returns no
+      // slots, so the loops above leave these empty.
       const hasRenderableWork = slotsToDisplay.length > 0 || slotsToRefresh.length > 0;
 
       // enableSingleRequest and enableServices must only be called once per page
@@ -1125,6 +1157,24 @@ export function installTsAdInit(): void {
           if (bid.adm && bid.debug_bid) {
             injectAdmIntoSlot(divId, bid.adm);
           }
+          const element = findSlotElementByDivId(divId);
+          const record = recordRender({
+            slotId,
+            path: 'ssat',
+            auctionId: bid.hb_auction_id,
+            bidder: bid.hb_bidder,
+            adId: bid.hb_adid,
+            bidId: bid.hb_bid_id,
+            creativeId: bid.hb_crid,
+            admHash: bid.hb_adm_hash,
+            rendered: !event.isEmpty,
+            gamEmpty: event.isEmpty,
+            injected: Boolean(bid.adm && bid.debug_bid),
+            visible: !event.isEmpty && isEffectivelyVisible(element),
+            elementId: element?.id,
+            servedFrom: bid.adm && bid.debug_bid ? 'debug-adm' : 'gam',
+          });
+          if (element) stampCreativeTrace(element, record);
         });
       }
 
@@ -1150,6 +1200,19 @@ export function installTsAdInit(): void {
         : slotsToRefresh;
 
       if (slotsNeedingRefresh.length > 0) {
+        slotsNeedingRefresh.forEach((slotToRefresh) => {
+          const slotId = (ts.divToSlotId ?? {})[slotToRefresh.getSlotElementId()];
+          const pending = slotId ? (ts.bids ?? {})[slotId] : undefined;
+          if (slotId) {
+            // Capture the bid/generation before the asynchronous GPT event.
+            // The event handler still records the live slot state below.
+            (
+              slotToRefresh as GoogleTagSlot & { __tsRenderGeneration?: number }
+            ).__tsRenderGeneration = renderGeneration;
+            (slotToRefresh as GoogleTagSlot & { __tsRenderBid?: AuctionBidData }).__tsRenderBid =
+              pending;
+          }
+        });
         // One-shot bypass: this internal refresh delivers the just-applied
         // server-side targeting to GAM. If slim-Prebid has wrapped refresh(), it
         // must pass this call straight through — not clear the targeting and run
@@ -1337,15 +1400,16 @@ export function installSpaAuctionHook(): void {
   ts.navGeneration ??= 0;
 
   let inflight: AbortController | null = null;
-  // Last path an auction was run for. popstate fires for hash-only and
-  // same-pathname changes, so guard against re-requesting loaded impressions.
-  let currentPath = location.pathname;
+  // Last path and query an auction was run for. popstate fires for hash-only
+  // changes and pushState/replaceState can be called with the current URL, so
+  // guard every entry point against re-requesting impressions already loaded.
+  let currentPath = `${location.pathname}${location.search}`;
   // Last path whose slots/bids were actually applied — the initial SSR page
   // counts. A failed navigation rolls `currentPath` back to this rather than to
   // the immediately-previous committed value: on rapid A→B where A was aborted
   // mid-flight and B then fails, rolling back to A (never loaded) would strand
   // it behind the no-op guard, so we roll back to the last applied route instead.
-  let lastAppliedPath = location.pathname;
+  let lastAppliedPath = `${location.pathname}${location.search}`;
   // Endpoint this session requests. Starts canonical; if the deployment does
   // not serve page-bids there, one navigation retries on the deprecated alias
   // and the session stays on it rather than re-probing every navigation.
@@ -1374,6 +1438,7 @@ export function installSpaAuctionHook(): void {
     if (path === currentPath) return;
     currentPath = path;
     ts.navGeneration = (ts.navGeneration ?? 0) + 1;
+    bumpRenderGeneration(ts);
     // A route change invalidates hydration aliases before the new route's
     // publisher can define a same-prefix slot while page-bids is in flight.
     for (const [elementId, handoff] of Object.entries(ts.gptSlotHandoffs ?? {})) {
@@ -1403,10 +1468,10 @@ export function installSpaAuctionHook(): void {
       // This route is now the committed, loaded state — a later failed
       // navigation rolls back here, and a return trip no-ops correctly.
       lastAppliedPath = path;
-      // An empty page-bids response (auction kill switch or consent gate) carries
-      // no TS slots. Only run adInit() when there are slots to apply or prior TS
-      // state to sweep — otherwise a consent-denied or kill-switched navigation
-      // must not enter the GPT command queue and risk activating services.
+      // An empty page-bids response (template switch, auction, or consent gate)
+      // carries no TS slots. Only run adInit() when there are slots to apply or
+      // prior TS state to sweep — otherwise a gated navigation must not enter
+      // the GPT command queue and risk activating services.
       const hasPriorTsState =
         (ts.prevGptSlots?.length ?? 0) > 0 ||
         Object.keys(ts.prevSlotTargetingKeys ?? {}).length > 0 ||
@@ -1426,8 +1491,8 @@ export function installSpaAuctionHook(): void {
     history[method] = function (state: unknown, unused: string, url?: string | URL | null): void {
       original(state, unused, url);
       const locationUrl = url ? new URL(String(url), location.href) : location;
-      const newPath = locationUrl.pathname;
-      // onNavigate no-ops when newPath equals the last loaded path.
+      const newPath = `${locationUrl.pathname}${locationUrl.search}`;
+      // onNavigate no-ops when newPath equals the last loaded path and query.
       void onNavigate(newPath);
     };
   }
@@ -1436,7 +1501,7 @@ export function installSpaAuctionHook(): void {
   patchHistoryMethod('replaceState');
 
   window.addEventListener('popstate', () => {
-    void onNavigate(location.pathname);
+    void onNavigate(`${location.pathname}${location.search}`);
   });
 }
 
@@ -1782,6 +1847,7 @@ export function installTsRenderBridge(): void {
       }
       safelyRecordCreativeResponse(attemptId);
       fireWinBillingBeacons(slotId, matchedBid);
+      recordGptBridgeRender(slotId, matchedBid, 'inline', findSlotElementByDivId(slotId));
       log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from inline adm`);
       return;
     }
@@ -1851,6 +1917,7 @@ export function installTsRenderBridge(): void {
           // authoritative clearing price, and the cached copy is only the render
           // source. Do not re-expand them here.
           fireWinBillingBeacons(slotId, matchedBid);
+          recordGptBridgeRender(slotId, matchedBid, 'pbs-cache', findSlotElementByDivId(slotId));
           log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from PBS Cache`);
         },
         (err) => {
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
index 99f876b3f..b50044a90 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
@@ -79,9 +79,7 @@ function cloneExportSnapshot(snapshot: GptDiagnosticsExportV1): GptDiagnosticsEx
       })),
     })),
     callbackIssues: snapshot.callbackIssues.map((issue) => ({ ...issue })),
-    ...(snapshot.attributionIssues === undefined
-      ? {}
-      : { attributionIssues: snapshot.attributionIssues.map((issue) => ({ ...issue })) }),
+    attributionIssues: snapshot.attributionIssues.map((issue) => ({ ...issue })),
     coverage: Object.fromEntries(
       Object.entries(snapshot.coverage).map(([kind, counters]) => [kind, { ...counters }])
     ) as GptDiagnosticsExportV1['coverage'],
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
index e99f1345b..c26aa4f13 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
@@ -560,7 +560,7 @@ export class GptDiagnosticsOverlay {
 
     const summary = this.document.createElement('div');
     summary.className = 'tsgd-summary';
-    summary.textContent = `${snapshot.slots.length} slots · ${snapshot.callbackIssues.length} callback issues · ${snapshot.attributionIssues?.length ?? 0} attribution issues`;
+    summary.textContent = `${snapshot.slots.length} slots · ${snapshot.callbackIssues.length} callback issues · ${snapshot.attributionIssues.length} attribution issues`;
     const coverage = this.document.createElement('ul');
     coverage.className = 'tsgd-coverage';
     for (const [kind, counters] of Object.entries(snapshot.coverage)) {
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index 44b47f2da..b576ba1ac 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -14,10 +14,11 @@
 import type _pbjsDefault from 'prebid.js';
 
 import { log } from '../../core/log';
+import { isEffectivelyVisible, recordRender, stampCreativeTrace } from '../../core/trace';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
 import { registerApsPrebidRenderer, validateApsRenderer } from '../aps/render';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
-import type { AuctionSlot, TsjsApi } from '../../core/types';
+import type { AuctionSlot, RenderRecord, TsjsApi } from '../../core/types';
 
 import { PREBID_USER_ID_MODULE_REGISTRY } from './user_id_modules';
 
@@ -343,6 +344,9 @@ export function auctionBidsToPrebidBids(
         bidderCode: bid.seat,
         meta: {
           advertiserDomains: bid.adomain,
+          tsAuctionId: bid.auctionId,
+          tsBidId: bid.bidId,
+          tsAdmHash: bid.admHash,
           // Second descriptor carrier — see APS_RENDERER_FIELD for the rationale.
           ...(renderer ? { [APS_RENDERER_FIELD]: renderer } : {}),
         },
@@ -784,6 +788,10 @@ function publisherZoneForRefresh(candidateCodes: Array<string | undefined>): str
   return match ? match.mediaTypes?.banner?.name : findRefreshSnapshot(candidateCodes)?.zone;
 }
 
+// The server only de-duplicates the configured suffix list, so validate here
+// too: an empty suffix matches every ad unit path and would pull every slot out
+// of the refresh auction, and a non-array value would throw inside the
+// publisher's own `refresh()` call.
 function isUsableRefreshAuctionExclusionSuffix(suffix: unknown): suffix is string {
   return typeof suffix === 'string' && suffix.startsWith('/') && suffix.length > 1;
 }
@@ -794,15 +802,15 @@ function refreshAuctionExclusionSuffixes(value: unknown): string[] {
 
 function isExcludedFromRefreshAuction(
   slot: RefreshGptSlot,
-  excludedGamAdUnitPathSuffixes: readonly string[]
+  excludedGamAdUnitPathSuffixes: Set<string>
 ): boolean {
-  if (excludedGamAdUnitPathSuffixes.length === 0) return false;
+  if (excludedGamAdUnitPathSuffixes.size === 0) return false;
 
   try {
     const adUnitPath = slot.getAdUnitPath?.();
     return (
       typeof adUnitPath === 'string' &&
-      excludedGamAdUnitPathSuffixes.some((suffix) => adUnitPath.endsWith(suffix))
+      [...excludedGamAdUnitPathSuffixes].some((suffix) => adUnitPath.endsWith(suffix))
     );
   } catch {
     // GPT path metadata is optional for this optimization. If it is unavailable,
@@ -1414,12 +1422,13 @@ export function installRefreshHandler(timeoutMs = 1500): void {
       // filtering so excluded slots still receive a clean GAM refresh.
       independentSlots.forEach(clearRefreshTargeting);
 
-      const excludedGamAdUnitPathSuffixes = refreshAuctionExclusionSuffixes(
-        getInjectedConfig()?.excludedGamAdUnitPathSuffixes
+      const excludedGamAdUnitPathSuffixes = new Set(
+        refreshAuctionExclusionSuffixes(getInjectedConfig()?.excludedGamAdUnitPathSuffixes)
       );
       const auctionSlots = independentSlots.filter(
         (slot) => !isExcludedFromRefreshAuction(slot, excludedGamAdUnitPathSuffixes)
       );
+      const hasExcludedSlots = auctionSlots.length < independentSlots.length;
       if (!auctionSlots.length) {
         return originalRefresh(slots, opts);
       }
@@ -1484,12 +1493,13 @@ export function installRefreshHandler(timeoutMs = 1500): void {
             log.error('[tsjs-prebid] refresh targeting failed', error);
           }
         }
+        // A bare refresh that filters slots must pass the resolved complete list
+        // to GPT; otherwise the excluded slots would be refreshed implicitly but
+        // would not be represented by the wrapper's concrete target set. Keep
+        // the existing bare-refresh delivery behavior when no filtering occurs.
+        const deliveredSlots = slots === undefined && hasExcludedSlots ? targetSlots : slots;
         recordPrebidRefreshForDiagnostics(targetSlots);
-        // Preserve the publisher's original refresh form. In particular, a bare
-        // GPT refresh remains bare so GPT resolves its registered slot set when
-        // the auction completes; the dispatch wrapper only scopes the shared
-        // diagnostics context around the delegated call.
-        dispatchPrebidRefresh(originalRefresh, slots, opts);
+        dispatchPrebidRefresh(originalRefresh, deliveredSlots, opts);
       }
 
       try {
@@ -1613,6 +1623,84 @@ function syncPrebidEidsCookie(): void {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Render trace (client-side /auction path)
+// ---------------------------------------------------------------------------
+
+interface PrebidRenderedBid {
+  adUnitCode?: string;
+  bidderCode?: string;
+  bidder?: string;
+  creativeId?: string;
+  meta?: {
+    tsAuctionId?: unknown;
+    tsBidId?: unknown;
+    tsAdmHash?: unknown;
+    [key: string]: unknown;
+  };
+}
+
+interface PrebidRenderEvent {
+  bid?: PrebidRenderedBid;
+  adId?: string;
+  reason?: string;
+  message?: string;
+}
+
+function findAuctionSlotElement(adUnitCode: string): HTMLElement | null {
+  if (typeof document === 'undefined') return null;
+  return (document.getElementById(adUnitCode) ??
+    document.getElementById(`${adUnitCode}-container`)) as HTMLElement | null;
+}
+
+export function recordPrebidAdRender(
+  bid: PrebidRenderedBid | undefined,
+  outcome: 'succeeded' | 'failed'
+): RenderRecord | undefined {
+  if (!bid || typeof bid.adUnitCode !== 'string' || bid.adUnitCode === '') return undefined;
+  const meta = bid.meta ?? {};
+  if (typeof meta.tsAuctionId !== 'string') return undefined;
+  const succeeded = outcome === 'succeeded';
+  const el = findAuctionSlotElement(bid.adUnitCode);
+  const record = recordRender({
+    slotId: bid.adUnitCode,
+    path: 'auction',
+    rendered: succeeded,
+    injected: succeeded,
+    visible: succeeded ? isEffectivelyVisible(el) : false,
+    elementId: el?.id,
+    auctionId: meta.tsAuctionId,
+    bidId: typeof meta.tsBidId === 'string' ? meta.tsBidId : undefined,
+    admHash: typeof meta.tsAdmHash === 'string' ? meta.tsAdmHash : undefined,
+    bidder: bid.bidderCode ?? bid.bidder,
+    creativeId: bid.creativeId,
+    servedFrom: 'prebid',
+  });
+  if (el) stampCreativeTrace(el, record);
+  return record;
+}
+
+export function installPrebidRenderTrace(): void {
+  if (typeof window === 'undefined') return;
+  const p = pbjs as unknown as {
+    onEvent?: (event: string, handler: (event: PrebidRenderEvent) => void) => void;
+    __tsRenderTraceInstalled?: boolean;
+  };
+  if (typeof p.onEvent !== 'function' || p.__tsRenderTraceInstalled) return;
+  p.__tsRenderTraceInstalled = true;
+  const listen = (name: string, outcome: 'succeeded' | 'failed'): void => {
+    p.onEvent!(name, (event) => {
+      try {
+        recordPrebidAdRender(event?.bid, outcome);
+      } catch (err) {
+        log.warn(`[tsjs-prebid] render-trace ${name} failed`, err);
+      }
+    });
+  };
+  listen('adRenderSucceeded', 'succeeded');
+  listen('adRenderFailed', 'failed');
+}
+
 // Self-initialize when loaded in a browser (same pattern as other integrations).
 if (typeof window !== 'undefined') {
   installPrebidNpm();
@@ -1622,6 +1710,7 @@ if (typeof window !== 'undefined') {
   // fail to run the replacement auction — leave GPT untouched instead.
   if (hasPrebidJsApi()) {
     installRefreshHandler();
+    installPrebidRenderTrace();
     // The slim-Prebid lazy loader appends this bundle from a window.load
     // handler, so `load` may already have fired by the time this code runs —
     // waiting for it again would skip user ID setup entirely on that path.
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
index e725a80f8..8280ea216 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
@@ -3,3 +3,8 @@ declare module 'tsjs-prebid/liveIntentIdSystemStandard';
 declare module 'tsjs-prebid/prebidGlobal' {
   export function registerModule(name: string): void;
 }
+
+declare module 'prebid.js/src/adRendering.js' {
+  export function markBidAsRendered(bid: unknown): void;
+  export function markWinner(bid: unknown): void;
+}
diff --git a/crates/trusted-server-js/lib/test/core/request.test.ts b/crates/trusted-server-js/lib/test/core/request.test.ts
index dc17c9e87..6bd510171 100644
--- a/crates/trusted-server-js/lib/test/core/request.test.ts
+++ b/crates/trusted-server-js/lib/test/core/request.test.ts
@@ -3,6 +3,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { AdUnit } from '../../src/core/types';
 import envelope from '../fixtures/aps-renderer-v1.json';
 
+/** Test view of the global scope with a mockable `fetch`. */
+const testGlobal = globalThis as unknown as { fetch: ReturnType<typeof vi.fn> };
+
+type AddAdUnitsArg = AdUnit;
+
 async function flushRequestAds(): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, 0));
 }
@@ -24,7 +29,7 @@ describe('request.requestAds', () => {
   it('sends fetch and renders creatives via iframe from response', async () => {
     // mock fetch - returns creative HTML inline in adm field
     const creativeHtml = '<div>Test Creative</div>';
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -44,12 +49,15 @@ describe('request.requestAds', () => {
     const infoSpy = vi.spyOn(log, 'info').mockImplementation(() => undefined);
 
     document.body.innerHTML = '<div id="slot1"></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
 
-    expect(globalThis.fetch).toHaveBeenCalled();
+    expect(testGlobal.fetch).toHaveBeenCalled();
 
     // Verify iframe was created with creative HTML in srcdoc
     const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
@@ -177,7 +185,7 @@ describe('request.requestAds', () => {
   });
 
   it('does not render on non-JSON response', async () => {
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'text/plain' },
@@ -188,35 +196,41 @@ describe('request.requestAds', () => {
     const { requestAds } = await import('../../src/core/request');
 
     document.body.innerHTML = '<div id="slot1"></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
 
-    expect(globalThis.fetch).toHaveBeenCalled();
+    expect(testGlobal.fetch).toHaveBeenCalled();
     expect(document.querySelector('iframe')).toBeNull();
   });
 
   it('ignores fetch rejection gracefully', async () => {
-    globalThis.fetch = vi.fn().mockRejectedValue(new Error('network-error'));
+    testGlobal.fetch = vi.fn().mockRejectedValue(new Error('network-error'));
 
     const { addAdUnits } = await import('../../src/core/registry');
     const { requestAds } = await import('../../src/core/request');
 
     document.body.innerHTML = '<div id="slot1"></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
 
-    expect(globalThis.fetch).toHaveBeenCalled();
+    expect(testGlobal.fetch).toHaveBeenCalled();
     expect(document.querySelector('iframe')).toBeNull();
   });
 
   it('inserts an iframe with creative HTML from unified auction', async () => {
     // mock fetch for unified auction endpoint - returns inline HTML
     const creativeHtml = '<img src="/first-party/proxy?tsurl=...">Ad</img>';
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -239,7 +253,10 @@ describe('request.requestAds', () => {
     document.body.appendChild(div);
 
     // Add an ad unit and request
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
     requestAds();
 
     await flushRequestAds();
@@ -254,7 +271,7 @@ describe('request.requestAds', () => {
   it('renders creatives with safe URI markup', async () => {
     const creativeHtml =
       '<a href="mailto:test@example.com">Contact</a><img src="https://example.com/ad.png" alt="ad">';
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -272,7 +289,10 @@ describe('request.requestAds', () => {
     const { requestAds } = await import('../../src/core/request');
 
     document.body.innerHTML = '<div id="slot1"></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
@@ -284,7 +304,7 @@ describe('request.requestAds', () => {
   });
 
   it('rejects malformed non-string creative HTML without blanking the slot', async () => {
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -304,7 +324,10 @@ describe('request.requestAds', () => {
     const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => undefined);
 
     document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
@@ -331,7 +354,7 @@ describe('request.requestAds', () => {
     // Regression: multi-bid scenario where a rejected bid must not erase an earlier
     // successful render into the same slot.
     const goodCreative = '<div>Safe Ad</div>';
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -354,7 +377,10 @@ describe('request.requestAds', () => {
     const { requestAds } = await import('../../src/core/request');
 
     document.body.innerHTML = '<div id="slot1"></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
@@ -366,7 +392,7 @@ describe('request.requestAds', () => {
   });
 
   it('rejects creatives that sanitize to empty markup', async () => {
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -386,7 +412,10 @@ describe('request.requestAds', () => {
     const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => undefined);
 
     document.body.innerHTML = '<div id="slot1"></div>';
-    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'slot1',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
 
     requestAds();
     await flushRequestAds();
@@ -408,7 +437,7 @@ describe('request.requestAds', () => {
 
   it('skips iframe insertion when slot is missing', async () => {
     // mock fetch for unified auction endpoint - returns inline HTML
-    globalThis.fetch = vi.fn().mockResolvedValue({
+    testGlobal.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
       headers: { get: () => 'application/json' },
@@ -424,7 +453,10 @@ describe('request.requestAds', () => {
     const { addAdUnits } = await import('../../src/core/registry');
     const { requestAds } = await import('../../src/core/request');
 
-    addAdUnits({ code: 'missing-slot', mediaTypes: { banner: { sizes: [[300, 250]] } } });
+    addAdUnits({
+      code: 'missing-slot',
+      mediaTypes: { banner: { sizes: [[300, 250]] } },
+    } as unknown as AddAdUnitsArg);
     requestAds();
 
     await flushRequestAds();
diff --git a/crates/trusted-server-js/lib/test/core/trace.test.ts b/crates/trusted-server-js/lib/test/core/trace.test.ts
new file mode 100644
index 000000000..2181340f2
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/core/trace.test.ts
@@ -0,0 +1,515 @@
+import { execFileSync } from 'node:child_process';
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+import {
+  recordRender,
+  updateRender,
+  stampCreativeTrace,
+  traceOverlayEnabled,
+  renderTracePanel,
+  RENDER_EVENT_NAME,
+  TRACE_PANEL_ID,
+  TRACE_BADGE_CLASS,
+} from '../../src/core/trace';
+import type { RenderRecord, TsjsApi } from '../../src/core/types';
+
+function clearTraceCookie(): void {
+  document.cookie = 'ts-trace=; Max-Age=0; Path=/';
+}
+
+function removePanel(): void {
+  document.getElementById(TRACE_PANEL_ID)?.remove();
+}
+
+describe('trace/recordRender', () => {
+  beforeEach(() => {
+    delete (window as { tsjs?: TsjsApi }).tsjs;
+    clearTraceCookie();
+    removePanel();
+  });
+
+  it('writes a render record into window.tsjs.renders', () => {
+    const record = recordRender({
+      slotId: 'slot-1',
+      path: 'auction',
+      rendered: true,
+      elementId: 'slot-1',
+      auctionId: 'auction-abc',
+      bidder: 'kargo',
+      creativeId: 'cr-1',
+      admHash: 'a1b2c3d4e5f60718',
+      servedFrom: 'inline',
+    });
+
+    expect(window.tsjs?.renders?.['slot-1']).toEqual(record);
+    expect(record.count).toBe(1);
+    expect(record.at).toBeGreaterThan(0);
+  });
+
+  it('overwrites the previous record and increments count on re-render', () => {
+    recordRender({ slotId: 'slot-1', path: 'ssat', rendered: true, auctionId: 'a-1' });
+    const second = recordRender({
+      slotId: 'slot-1',
+      path: 'ssat',
+      rendered: true,
+      auctionId: 'a-2',
+    });
+
+    const entry = window.tsjs?.renders?.['slot-1'];
+    expect(entry?.auctionId).toBe('a-2');
+    expect(entry?.count).toBe(2);
+    expect(second.count).toBe(2);
+  });
+
+  it('fires a tsjs:adRendered CustomEvent with the record as detail', () => {
+    const listener = vi.fn();
+    window.addEventListener(RENDER_EVENT_NAME, listener);
+
+    const record = recordRender({ slotId: 'slot-ev', path: 'auction', rendered: true });
+
+    expect(listener).toHaveBeenCalledTimes(1);
+    const event = listener.mock.calls[0][0] as CustomEvent<RenderRecord>;
+    expect(event.detail).toEqual(record);
+
+    window.removeEventListener(RENDER_EVENT_NAME, listener);
+  });
+
+  it('allocates one sequence across separately bundled IIFEs', async () => {
+    const buildTraceBundle = (): string =>
+      execFileSync(
+        './node_modules/.bin/esbuild',
+        ['--bundle', '--format=iife', '--platform=browser', '--loader=ts'],
+        {
+          cwd: process.cwd(),
+          encoding: 'utf8',
+          input:
+            'import { recordRender } from "./src/core/trace.ts";' +
+            'window.__recordFromTraceBundle = recordRender;',
+        }
+      );
+
+    const firstBundle = buildTraceBundle();
+    const secondBundle = buildTraceBundle();
+    const testWindow = window as typeof window & {
+      __recordFromTraceBundle?: typeof recordRender;
+    };
+
+    Function(firstBundle)();
+    const firstRecord = testWindow.__recordFromTraceBundle!;
+    const first = firstRecord({ slotId: 'iife-a', path: 'auction', rendered: true });
+
+    Function(secondBundle)();
+    const secondRecord = testWindow.__recordFromTraceBundle!;
+    const second = secondRecord({ slotId: 'iife-b', path: 'ssat', rendered: true });
+
+    expect(second.seq).toBe(first.seq + 1);
+    expect(window.tsjs?.renderSeq).toBe(second.seq);
+    delete testWindow.__recordFromTraceBundle;
+  });
+
+  it('enriches an existing impression without changing its bookkeeping', () => {
+    const original = recordRender({
+      slotId: 'slot-enrich',
+      path: 'ssat',
+      rendered: true,
+      injected: false,
+      servedFrom: 'gam',
+    });
+    const bookkeeping = {
+      seq: original.seq,
+      count: original.count,
+      at: original.at,
+      historyLength: window.tsjs?.renderLog?.length,
+    };
+
+    const updated = updateRender(original, { injected: true, servedFrom: 'pbs-cache' });
+
+    expect(updated).toBe(original);
+    expect(window.tsjs?.renders?.['slot-enrich']).toBe(original);
+    expect(window.tsjs?.renderLog?.[0]).toBe(original);
+    expect(updated).toEqual(expect.objectContaining({ injected: true, servedFrom: 'pbs-cache' }));
+    expect({
+      seq: updated.seq,
+      count: updated.count,
+      at: updated.at,
+      historyLength: window.tsjs?.renderLog?.length,
+    }).toEqual(bookkeeping);
+  });
+});
+
+describe('trace/stampCreativeTrace', () => {
+  it('stamps data-ts-* attributes for present fields only', () => {
+    const el = document.createElement('div');
+    const record: RenderRecord = {
+      slotId: 'slot-1',
+      path: 'ssat',
+      rendered: true,
+      auctionId: 'ts-req-abc',
+      bidder: 'kargo',
+      adId: 'cache-uuid-1',
+      admHash: 'a1b2c3d4e5f60718',
+      count: 1,
+      seq: 1,
+      at: 1,
+    };
+
+    stampCreativeTrace(el, record);
+
+    expect(el.getAttribute('data-ts-slot-id')).toBe('slot-1');
+    expect(el.getAttribute('data-ts-render-path')).toBe('ssat');
+    expect(el.getAttribute('data-ts-rendered')).toBe('true');
+    expect(el.getAttribute('data-ts-auction-id')).toBe('ts-req-abc');
+    expect(el.getAttribute('data-ts-bidder')).toBe('kargo');
+    expect(el.getAttribute('data-ts-ad-id')).toBe('cache-uuid-1');
+    expect(el.getAttribute('data-ts-adm-hash')).toBe('a1b2c3d4e5f60718');
+    // creativeId absent — attribute must not exist.
+    expect(el.hasAttribute('data-ts-creative-id')).toBe(false);
+  });
+
+  it('removes stale attributes when a re-render lacks a field', () => {
+    const el = document.createElement('div');
+    const first: RenderRecord = {
+      slotId: 'slot-1',
+      path: 'ssat',
+      rendered: true,
+      auctionId: 'auction-old',
+      admHash: 'a1b2c3d4e5f60718',
+      servedFrom: 'gam',
+      count: 1,
+      seq: 1,
+      at: 1,
+    };
+    stampCreativeTrace(el, first);
+
+    const second: RenderRecord = {
+      slotId: 'slot-1',
+      path: 'ssat',
+      rendered: true,
+      auctionId: 'auction-new',
+      count: 2,
+      seq: 2,
+      at: 2,
+    };
+    stampCreativeTrace(el, second);
+
+    expect(el.getAttribute('data-ts-auction-id')).toBe('auction-new');
+    // The previous auction's hash and mechanism must not survive the re-stamp.
+    expect(el.hasAttribute('data-ts-adm-hash')).toBe(false);
+    expect(el.hasAttribute('data-ts-served-from')).toBe(false);
+  });
+});
+
+describe('trace/floating panel', () => {
+  const record: Omit<RenderRecord, 'count' | 'at' | 'seq'> = {
+    slotId: 'slot-1',
+    path: 'ssat',
+    rendered: true,
+    injected: true,
+    visible: true,
+    gamEmpty: false,
+    auctionId: 'ts-req-abcdef123456',
+    bidder: 'kargo',
+    admHash: 'a1b2c3d4e5f60718',
+    servedFrom: 'gam',
+  };
+
+  beforeEach(() => {
+    delete (window as { tsjs?: TsjsApi }).tsjs;
+    clearTraceCookie();
+    removePanel();
+  });
+
+  afterEach(() => {
+    clearTraceCookie();
+    removePanel();
+  });
+
+  it('reports the overlay disabled without the ts-trace cookie', () => {
+    expect(traceOverlayEnabled()).toBe(false);
+  });
+
+  it('does not create a panel when the overlay is disarmed', () => {
+    recordRender(record);
+    expect(document.getElementById(TRACE_PANEL_ID)).toBeNull();
+  });
+
+  it('renders a panel row per traced slot with honest status', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    // slot-1: TS placed + visible → ok. slot-2: nothing rendered → empty.
+    recordRender(record);
+    recordRender({
+      slotId: 'slot-2',
+      path: 'auction',
+      rendered: false,
+      injected: false,
+      visible: false,
+      bidder: 'appnexus',
+    });
+
+    const panel = document.getElementById(TRACE_PANEL_ID);
+    expect(panel).toBeTruthy();
+    // Only slot-1 is honestly ok; slot-2 rendered nothing.
+    expect(panel!.textContent).toContain('TS Render Trace · 1/2 slots ok');
+    expect(panel!.textContent).toContain('✓ slot-1 · ok');
+    expect(panel!.textContent).toContain('✗ slot-2 · empty');
+    expect(panel!.textContent).toContain('ssat · kargo');
+    expect(panel!.textContent).toContain('auction · appnexus');
+  });
+
+  it('marks a rendered-but-hidden slot as hidden, not ok', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    // GAM rendered non-empty, TS injected, but a reveal gate keeps it hidden.
+    recordRender({ ...record, visible: false });
+
+    const panel = document.getElementById(TRACE_PANEL_ID);
+    expect(panel!.textContent).toContain('0/1 slots ok');
+    expect(panel!.textContent).toContain('⚠ slot-1 · hidden');
+  });
+
+  it('marks a targeting-only GAM slot as gam-only, not a confirmed TS render', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    // GAM rendered something, but TS never placed it (prod targeting path).
+    recordRender({ ...record, injected: false, gamEmpty: false, visible: true });
+
+    const panel = document.getElementById(TRACE_PANEL_ID);
+    expect(panel!.textContent).toContain('0/1 slots ok');
+    expect(panel!.textContent).toContain('◐ slot-1 · gam-only');
+  });
+
+  it('never claims ok when a render path did not report placement', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    // Regression: an unset `injected` must not fall through to ok — that would
+    // claim a confirmed TS render for a slot TS only targeted.
+    const { injected: _omitted, ...withoutInjected } = record;
+    recordRender({ ...withoutInjected, gamEmpty: false, visible: true });
+
+    const panel = document.getElementById(TRACE_PANEL_ID);
+    expect(panel!.textContent).toContain('0/1 slots ok');
+    expect(panel!.textContent).toContain('◐ slot-1 · gam-only');
+  });
+
+  it('reuses a single panel across renders and reflects the latest count', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    recordRender(record);
+    recordRender(record);
+
+    const panels = document.querySelectorAll(`#${TRACE_PANEL_ID}`);
+    expect(panels).toHaveLength(1);
+    // Second render of the same slot bumps the count and appends a history row.
+    expect(panels[0].textContent).toContain('TS Render Trace · 1/1 slots ok');
+    expect(panels[0].textContent).toContain('×2');
+  });
+
+  it("keeps GAM's fill signal and drops ? placeholders on an unattributed refresh", () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    // A publisher-driven GAM refresh: TS ran no auction for it, so there is no
+    // bidder/hash/auction id — but GAM still reported whether it filled, and
+    // that is the most useful field on the row.
+    recordRender({
+      slotId: 'slot-1',
+      path: 'gam-refresh',
+      rendered: true,
+      gamEmpty: false,
+      injected: false,
+      visible: true,
+      servedFrom: 'gam',
+    });
+
+    const panel = document.getElementById(TRACE_PANEL_ID)!;
+    expect(panel.textContent).toContain('gam:filled');
+    expect(panel.textContent).toContain('no TS attribution');
+    // Absent attribution must not render as a failed lookup, and an auction
+    // segment must not appear at all when there is no auction to name.
+    expect(panel.textContent).not.toContain('· ? ·');
+    expect(panel.textContent).not.toContain('auction ?');
+  });
+
+  it('still reports gam:empty for a refresh GAM declined to fill', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    recordRender({
+      slotId: 'slot-1',
+      path: 'gam-refresh',
+      rendered: false,
+      gamEmpty: true,
+      injected: false,
+      visible: true,
+    });
+
+    const panel = document.getElementById(TRACE_PANEL_ID)!;
+    expect(panel.textContent).toContain('gam:empty');
+    expect(panel.textContent).toContain('✗ slot-1 · empty');
+  });
+
+  it('gives each render a page-global seq the badge and its panel row share', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const el = document.createElement('div');
+    el.id = 'slot-el';
+    document.body.appendChild(el);
+
+    // Two slots interleaved: seq must be unique page-wide, not per-slot, so a
+    // badge reading #N identifies exactly one row.
+    const first = recordRender(record);
+    const other = recordRender({ ...record, slotId: 'slot-2' });
+    expect(other.seq).toBe(first.seq + 1);
+
+    stampCreativeTrace(el, other);
+    const badge = el.querySelector(`.${TRACE_BADGE_CLASS}`) as HTMLElement;
+    expect(badge.textContent).toContain(`#${other.seq}`);
+    // The same number appears on that render's row in the panel.
+    expect(document.getElementById(TRACE_PANEL_ID)!.textContent).toContain(`#${other.seq}`);
+
+    el.remove();
+  });
+
+  it('marks only the live render for a slot as current', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    recordRender(record);
+    const latest = recordRender(record);
+
+    const panel = document.getElementById(TRACE_PANEL_ID)!;
+    // Both renders are in the log, but only the newest is still on screen.
+    expect(panel.textContent).toContain(`#${latest.seq}`);
+    expect(panel.textContent!.match(/◂ current/g)).toHaveLength(1);
+  });
+
+  it('uses record identity when duplicate sequence values exist', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const oldRecord = { ...record, auctionId: 'auction-old', count: 1, seq: 7, at: 1 };
+    const liveRecord = { ...record, auctionId: 'auction-live', count: 2, seq: 7, at: 2 };
+    (window as { tsjs?: TsjsApi }).tsjs = {
+      renders: { 'slot-1': liveRecord },
+      renderLog: [oldRecord, liveRecord],
+    } as unknown as TsjsApi;
+
+    renderTracePanel();
+
+    const rows = [...document.querySelectorAll(`#${TRACE_PANEL_ID} div[style*="cursor"]`)];
+    const oldRow = rows.find((row) => row.getAttribute('title')?.includes('auction: auction-old'));
+    const liveRow = rows.find((row) =>
+      row.getAttribute('title')?.includes('auction: auction-live')
+    );
+    expect(oldRow?.textContent).not.toContain('◂ current');
+    expect(liveRow?.textContent).toContain('◂ current');
+  });
+
+  it('close button removes the panel', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    recordRender(record);
+    const panel = document.getElementById(TRACE_PANEL_ID)!;
+    const close = panel.querySelector('button') as HTMLButtonElement;
+    close.click();
+    expect(document.getElementById(TRACE_PANEL_ID)).toBeNull();
+  });
+
+  it('renderTracePanel is a no-op while disarmed even if renders exist', () => {
+    (window as { tsjs?: TsjsApi }).tsjs = {
+      renders: { 'slot-1': { ...record, count: 1, seq: 1, at: 1 } },
+    } as unknown as TsjsApi;
+    renderTracePanel();
+    expect(document.getElementById(TRACE_PANEL_ID)).toBeNull();
+  });
+
+  it('clicking a row logs the full record', async () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const { log } = await import('../../src/core/log');
+    const infoSpy = vi.spyOn(log, 'info').mockImplementation(() => undefined);
+
+    recordRender(record);
+    const row = document.getElementById(TRACE_PANEL_ID)!.querySelector('div[style*="cursor"]');
+    (row as HTMLElement).click();
+
+    const call = infoSpy.mock.calls.find(([m]) => m === 'trace: render record');
+    expect(call?.[1]).toEqual(
+      expect.objectContaining({ slotId: 'slot-1', auctionId: record.auctionId })
+    );
+    infoSpy.mockRestore();
+  });
+});
+
+describe('trace/confirmation badge', () => {
+  beforeEach(() => {
+    delete (window as { tsjs?: TsjsApi }).tsjs;
+    clearTraceCookie();
+    document.body.innerHTML = '';
+  });
+  afterEach(() => {
+    clearTraceCookie();
+    document.body.innerHTML = '';
+  });
+
+  const okRecord: RenderRecord = {
+    slotId: 'slot-1',
+    path: 'ssat',
+    rendered: true,
+    injected: true,
+    visible: true,
+    gamEmpty: false,
+    bidder: 'mocktioneer',
+    admHash: 'a1b2c3d4e5f60718',
+    servedFrom: 'gam',
+    count: 1,
+    seq: 1,
+    at: 1,
+  };
+
+  it('badges an ok slot when armed', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const el = document.createElement('div');
+    document.body.appendChild(el);
+    stampCreativeTrace(el, okRecord);
+    const badge = el.querySelector(`.${TRACE_BADGE_CLASS}`) as HTMLElement;
+    expect(badge).toBeTruthy();
+    expect(badge.textContent).toBe('TS ✓ #1 · mocktioneer');
+  });
+
+  it('does not badge a hidden slot', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const el = document.createElement('div');
+    document.body.appendChild(el);
+    stampCreativeTrace(el, { ...okRecord, visible: false });
+    expect(el.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeNull();
+  });
+
+  it('removes the previous badge when a filled slot becomes empty', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const el = document.createElement('div');
+    document.body.appendChild(el);
+    stampCreativeTrace(el, okRecord);
+    expect(el.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeTruthy();
+
+    stampCreativeTrace(el, { ...okRecord, rendered: false, injected: false, gamEmpty: true });
+
+    expect(el.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeNull();
+  });
+
+  it('removes the previous badge when a visible slot becomes hidden', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const el = document.createElement('div');
+    document.body.appendChild(el);
+    stampCreativeTrace(el, okRecord);
+    expect(el.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeTruthy();
+
+    stampCreativeTrace(el, { ...okRecord, visible: false });
+
+    expect(el.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeNull();
+  });
+
+  it('does not badge when the overlay is disarmed', () => {
+    clearTraceCookie();
+    const el = document.createElement('div');
+    document.body.appendChild(el);
+    stampCreativeTrace(el, okRecord);
+    expect(el.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeNull();
+  });
+
+  it('never badges an iframe element', () => {
+    document.cookie = 'ts-trace=1; Path=/';
+    const iframe = document.createElement('iframe');
+    document.body.appendChild(iframe);
+    stampCreativeTrace(iframe, okRecord);
+    expect(iframe.querySelector(`.${TRACE_BADGE_CLASS}`)).toBeNull();
+    // Attributes still stamped on the iframe though.
+    expect(iframe.getAttribute('data-ts-slot-id')).toBe('slot-1');
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
index 999c60c55..889c189ea 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
@@ -148,11 +148,14 @@ describe('scheduleInitialAdInit', () => {
     expect(adInit).toHaveBeenCalledTimes(1);
   });
 
-  it('still runs after a query-only history change before load', async () => {
-    // The SPA auction hook identifies routes by pathname only, so a query-only
-    // replaceState is not a navigation: it must neither trigger an auction nor
-    // cancel the pending initial adInit. (A URL-equality guard would abort
-    // here and leave the initial ads uninitialized.)
+  it('does not rerun after a query-only page-bids refresh before load', async () => {
+    // The RC's SPA route identity includes pathname and query. A query change
+    // requests fresh page bids and runs adInit for that route, so the deferred
+    // initial callback must stand down instead of initializing the route twice.
+    fetchStub.mockResolvedValue({
+      ok: true,
+      json: async () => ({ slots: [], bids: {} }),
+    });
     await importGptModule();
     const ts = (window as TestWindow).tsjs!;
     const adInit = vi.fn();
@@ -161,12 +164,14 @@ describe('scheduleInitialAdInit', () => {
     ts.scheduleInitialAdInit!();
     history.replaceState({}, '', '/?utm_source=newsletter');
     await flushAsync();
-    expect(fetchStub).not.toHaveBeenCalled();
+    expect(fetchStub).toHaveBeenCalledTimes(1);
+    expect(ts.navGeneration).toBe(1);
+    expect(adInit).not.toHaveBeenCalled();
 
     window.dispatchEvent(new Event('load'));
     flushFrame();
     flushFrame();
-    expect(adInit).toHaveBeenCalledTimes(1);
+    expect(adInit).not.toHaveBeenCalled();
   });
 
   it('cancels the initial run after an /a → /b → /a round trip before load', async () => {
@@ -196,59 +201,6 @@ describe('scheduleInitialAdInit', () => {
     expect(adInit).not.toHaveBeenCalled();
   });
 
-  it('applies server targeting to a publisher-displayed slot before its refresh', async () => {
-    // A publisher that defined and displayed its GPT slot before window load
-    // still gets the server-side targeting applied before the refresh that
-    // delivers it — the deferred run must order setTargeting ahead of the ad
-    // request it triggers.
-    const div = document.createElement('div');
-    div.id = 'div-atf-sidebar';
-    document.body.appendChild(div);
-    const mockSlot = {
-      addService: vi.fn().mockReturnThis(),
-      setTargeting: vi.fn().mockReturnThis(),
-      clearTargeting: vi.fn().mockReturnThis(),
-      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
-      getTargeting: vi.fn().mockReturnValue([]),
-    };
-    const mockPubads = {
-      enableSingleRequest: vi.fn(),
-      getSlots: vi.fn().mockReturnValue([mockSlot]),
-      addEventListener: vi.fn(),
-      refresh: vi.fn(),
-    };
-    (window as TestWindow).googletag = {
-      cmd: { push: vi.fn((fn: () => void) => fn()) },
-      defineSlot: vi.fn(),
-      pubads: vi.fn().mockReturnValue(mockPubads),
-      enableServices: vi.fn(),
-    };
-    await importGptModule();
-    const ts = (window as TestWindow).tsjs!;
-    ts.adSlots = [
-      {
-        id: 'atf_sidebar_ad',
-        gam_unit_path: '/123/atf',
-        div_id: 'div-atf-sidebar',
-        formats: [[300, 250]],
-        targeting: { pos: 'atf' },
-      },
-    ];
-    ts.bids = { atf_sidebar_ad: { hb_pb: '1.00', hb_bidder: 'kargo' } };
-
-    ts.scheduleInitialAdInit!();
-    window.dispatchEvent(new Event('load'));
-    flushFrame();
-    flushFrame();
-
-    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_pb', '1.00');
-    expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1');
-    expect(mockPubads.refresh).toHaveBeenCalledWith([mockSlot]);
-    const targetingOrder = mockSlot.setTargeting.mock.invocationCallOrder[0]!;
-    const refreshOrder = mockPubads.refresh.mock.invocationCallOrder[0]!;
-    expect(targetingOrder).toBeLessThan(refreshOrder);
-  });
-
   it('drops the SSR payload when a navigation committed before scheduling', async () => {
     // The SPA hook is installed by the synchronous head bundle, so a
     // navigation can commit while the document is still streaming — before
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 7127efcb4..ebfcbeb11 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -60,6 +60,7 @@ describe('installSpaAuctionHook', () => {
     originalReplaceState({}, '', '/');
     // Drop any ad containers inserted by a test so DOM state does not leak.
     document.body.innerHTML = '';
+    delete (window as TestWindow).googletag;
     // Remove this test's popstate listener(s) so they do not fire in later tests.
     popstateHandlers.forEach((handler) => window.removeEventListener('popstate', handler));
     popstateHandlers = [];
@@ -67,11 +68,10 @@ describe('installSpaAuctionHook', () => {
     vi.unstubAllGlobals();
   });
 
-  it('increments navGeneration only when a pathname navigation is accepted', async () => {
+  it('increments navGeneration when a path-and-query navigation is accepted', async () => {
     // The deferred initial-adInit bootstrap keys off this counter, so it must
-    // move in lockstep with the hook's own navigation identity: bumped
-    // synchronously for each accepted pathname change, untouched by the
-    // query-only and same-path history calls the hook ignores.
+    // move in lockstep with the hook's route identity: bumped synchronously for
+    // each accepted pathname or query change, untouched by identical routes.
     fetchStub.mockResolvedValue({
       ok: true,
       json: async () => ({ slots: [], bids: {} }),
@@ -85,10 +85,10 @@ describe('installSpaAuctionHook', () => {
     expect(ts.navGeneration).toBe(1);
 
     history.replaceState({}, '', '/next-page?utm_source=x');
-    expect(ts.navGeneration).toBe(1);
+    expect(ts.navGeneration).toBe(2);
 
-    history.pushState({}, '', '/next-page');
-    expect(ts.navGeneration).toBe(1);
+    history.pushState({}, '', '/next-page?utm_source=x');
+    expect(ts.navGeneration).toBe(2);
     await flushAsync();
   });
 
@@ -204,7 +204,7 @@ describe('installSpaAuctionHook', () => {
     await flushAsync();
 
     expect(fetchStub).toHaveBeenCalledWith(
-      '/_ts/page-bids?path=%2Fnext-page',
+      '/_ts/page-bids?path=%2Fnext-page%3Fedition%3Dfictional',
       expect.objectContaining({
         credentials: 'include',
         headers: { 'X-TSJS-Page-Bids': '1' },
@@ -216,9 +216,9 @@ describe('installSpaAuctionHook', () => {
   });
 
   it('skips adInit on an empty page-bids response with no prior TS state', async () => {
-    // A gated page-bids response (auction kill switch or consent denial) returns
-    // no slots. With no prior TS state to sweep, the hook must not call adInit()
-    // so a consent-denied navigation cannot activate the publisher's GPT setup.
+    // A gated page-bids response (template switch, auction gate, or consent
+    // denial) returns no slots. With no prior TS state to sweep, the hook must
+    // not call adInit() so a gated navigation cannot activate publisher GPT.
     fetchStub.mockResolvedValue({
       ok: true,
       json: async () => ({ slots: [], bids: {} }),
@@ -533,6 +533,59 @@ describe('installSpaAuctionHook', () => {
     expect(adInit).toHaveBeenCalledTimes(1);
   });
 
+  it('stops orphan recovery before a fast route DOM swap can replay old bids', async () => {
+    document.body.innerHTML = '<div id="ad-header-0-_R_old_"></div>';
+    const definedDivs: string[] = [];
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([]),
+      refresh: vi.fn(),
+      addEventListener: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn((_path: string, _sizes: unknown, divId: string) => {
+        definedDivs.push(divId);
+        return {
+          addService: vi.fn().mockReturnThis(),
+          setTargeting: vi.fn().mockReturnThis(),
+          clearTargeting: vi.fn().mockReturnThis(),
+          getSlotElementId: vi.fn().mockReturnValue(divId),
+          getTargeting: vi.fn().mockReturnValue([]),
+        };
+      }),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+      display: vi.fn(),
+      destroySlots: vi.fn(),
+    };
+    // Keep page-bids slower than the orphan observer's 250 ms debounce.
+    fetchStub.mockReturnValue(new Promise(() => {}));
+
+    await importGptModule();
+    const ts = (window as TestWindow).tsjs!;
+    ts.adSlots = [
+      {
+        id: 'ad-header-0',
+        gam_unit_path: '/123/header',
+        div_id: 'ad-header-0',
+        formats: [[728, 90]],
+        targeting: {},
+      },
+    ];
+    ts.bids = { 'ad-header-0': { hb_adid: 'old-route-ad' } };
+    ts.adInit!();
+    expect(definedDivs).toEqual(['ad-header-0-_R_old_']);
+
+    history.pushState({}, '', '/new-route');
+    document.body.innerHTML = '<div id="ad-header-0-_R_new_"></div>';
+    await new Promise((resolve) => setTimeout(resolve, 350));
+
+    // The pending old-route watcher was disconnected synchronously when
+    // navigation began, so it never rebound or re-requested the old auction.
+    expect(definedDivs).toEqual(['ad-header-0-_R_old_']);
+  });
+
   it('leaves slots and bids untouched on a non-OK response', async () => {
     fetchStub.mockResolvedValue({ ok: false, status: 500 });
     const { installSpaAuctionHook } = await importGptModule();
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts
index 6b3103060..747c61beb 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/types.test.ts
@@ -48,31 +48,6 @@ describe('GPT diagnostics public types', () => {
     expectTypeOf(readOnlyApi).toEqualTypeOf<GptDiagnosticsApi>();
   });
 
-  it('accepts legacy V1 snapshots without attribution evidence', () => {
-    const legacySnapshot: GptDiagnosticsExportV1 = {
-      version: 1,
-      capturedAt: '2026-08-04T00:00:00.000Z',
-      page: { origin: 'https://example.com', pathname: '/' },
-      slots: [],
-      callbackIssues: [],
-      coverage: {
-        slotRequested: { observed: 0, matched: 0, unmatched: 0, ambiguous: 0 },
-        slotResponseReceived: { observed: 0, matched: 0, unmatched: 0, ambiguous: 0 },
-        slotRenderEnded: { observed: 0, matched: 0, unmatched: 0, ambiguous: 0 },
-        slotOnload: { observed: 0, matched: 0, unmatched: 0, ambiguous: 0 },
-        impressionViewable: { observed: 0, matched: 0, unmatched: 0, ambiguous: 0 },
-        slotVisibilityChanged: { observed: 0, matched: 0, unmatched: 0, ambiguous: 0 },
-      },
-      metadata: {
-        droppedCallbacks: 0,
-        evictedSlots: 0,
-        evictedRequestCycles: 0,
-      },
-    };
-
-    expect(legacySnapshot.version).toBe(1);
-  });
-
   it('keeps evidence writers off the operator API and on the internal channel', () => {
     expectTypeOf<keyof GptDiagnosticsApi>().toEqualTypeOf<
       'snapshot' | 'export' | 'subscribe' | 'show' | 'hide'
@@ -175,11 +150,9 @@ describe('GPT diagnostics public types', () => {
     expectTypeOf(evidenceCycle.requestIntentId).toEqualTypeOf<number | undefined>();
     expectTypeOf(evidenceCycle.trustedServerAuctionId).toEqualTypeOf<string | undefined>();
     expectTypeOf(evidenceSnapshot.attributionIssues).toEqualTypeOf<
-      GptDiagnosticsAttributionIssue[] | undefined
-    >();
-    expectTypeOf(evidenceSnapshot.metadata.droppedAttributionIssues).toEqualTypeOf<
-      number | undefined
+      GptDiagnosticsAttributionIssue[]
     >();
+    expectTypeOf(evidenceSnapshot.metadata.droppedAttributionIssues).toEqualTypeOf<number>();
     expectTypeOf<GptDiagnosticsAttributionIssueReason>().toEqualTypeOf<
       | 'creative_request_without_slot'
       | 'creative_request_without_cycle'
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 9f9a3f977..c3a360477 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -114,9 +114,9 @@ const {
   mockRegisterBidAdapter,
   mockGetUserIdsAsEids,
   mockGetConfig,
-  mockRemoveAdUnit,
   mockMarkWinningBidAsUsed,
   mockOnEvent,
+  mockRemoveAdUnit,
   mockPbjs,
 } = vi.hoisted(() => {
   const mockSetConfig = vi.fn();
@@ -129,7 +129,6 @@ const {
     () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
   );
   const mockGetConfig = vi.fn();
-
   const mockRemoveAdUnit = vi.fn((adUnitCode?: string | string[]) => {
     if (!adUnitCode) {
       mockPbjs.adUnits = [];
@@ -157,9 +156,9 @@ const {
     registerBidAdapter: mockRegisterBidAdapter,
     getUserIdsAsEids: mockGetUserIdsAsEids,
     getConfig: mockGetConfig,
-    removeAdUnit: mockRemoveAdUnit,
     markWinningBidAsUsed: mockMarkWinningBidAsUsed,
     onEvent: mockOnEvent,
+    removeAdUnit: mockRemoveAdUnit,
     adUnits: [] as TestAdUnit[],
     setTargetingForGPTAsync: undefined as ((adUnitCodes?: string[]) => void) | undefined,
     que: [] as Array<() => void>,
@@ -186,9 +185,9 @@ const {
     mockRegisterBidAdapter,
     mockGetUserIdsAsEids,
     mockGetConfig,
-    mockRemoveAdUnit,
     mockMarkWinningBidAsUsed,
     mockOnEvent,
+    mockRemoveAdUnit,
     mockPbjs,
   };
 });
@@ -202,9 +201,9 @@ import {
 } from '../../../src/integrations/prebid/index';
 import type { AuctionBid } from '../../../src/core/auction';
 import { log } from '../../../src/core/log';
+import envelope from '../../fixtures/aps-renderer-v1.json';
 import { GptDiagnosticsObserver } from '../../../src/integrations/gpt_diagnostics/observer';
 import { GptDiagnosticsStore } from '../../../src/integrations/gpt_diagnostics/store';
-import envelope from '../../fixtures/aps-renderer-v1.json';
 
 // installPrebidNpm is a per-page no-op once the sentinel is set (the module
 // self-init above already set it), so every test starts from a clean page.
@@ -317,6 +316,10 @@ describe('prebid/auctionBidsToPrebidBids', () => {
         bidderCode: 'aps',
         ad: '',
         trustedServerRenderer: renderer,
+        meta: {
+          advertiserDomains: ['advertiser.example'],
+          trustedServerRenderer: renderer,
+        },
       })
     );
   });
@@ -472,88 +475,6 @@ describe('prebid/installPrebidNpm', () => {
     });
   });
 
-  it('makes failed APS renderer registrations ineligible when zero-CPM bids are allowed', () => {
-    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
-    installPrebidNpm();
-
-    const bidResponseListener = mockOnEvent.mock.calls.find(
-      ([eventName]) => eventName === 'bidResponse'
-    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
-    const malformedBid: Record<string, unknown> = {
-      adapterCode: 'trustedServer',
-      bidderCode: 'aps',
-      adId: 'malformed-ad-id',
-      adUnitCode: 'div-aps',
-      ttl: 300,
-      cpm: 1.23,
-      trustedServerRenderer: { ...apsRenderer(), aaxResponse: 'invalid' },
-    };
-    bidResponseListener!(malformedBid);
-    bidResponseListener!({
-      adapterCode: 'publisherAdapter',
-      bidderCode: 'aps',
-      adId: 'foreign-ad-id',
-      adUnitCode: 'div-aps',
-      trustedServerRenderer: apsRenderer(),
-    });
-
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
-    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
-    // Prebid's allowZeroCpmBids path still requires cpm >= 0.
-    expect(malformedBid['cpm']).toBe(-1);
-    expect(warnSpy).toHaveBeenCalledWith(
-      '[tsjs-prebid] rejected APS renderer capability that failed registration'
-    );
-  });
-
-  it('registers APS renderer via meta when Prebid strips the custom top-level field', () => {
-    installPrebidNpm();
-
-    const bidResponseListener = mockOnEvent.mock.calls.find(
-      ([eventName]) => eventName === 'bidResponse'
-    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
-    expect(bidResponseListener).toBeTypeOf('function');
-
-    const renderer = apsRenderer();
-    const [built] = auctionBidsToPrebidBids(
-      [
-        {
-          impid: 'div-aps',
-          renderer,
-          price: 1.0,
-          width: 300,
-          height: 250,
-          seat: 'aps',
-          creativeId: 'cr-aps',
-          adomain: [],
-        },
-      ],
-      [{ adUnitCode: 'div-aps', bidId: 'req-strip' }],
-      true
-    );
-
-    // Prebid delivered the bid with the custom top-level field REMOVED — only
-    // first-class fields (requestId, meta) survive normalization.
-    const delivered: Record<string, unknown> = {
-      adapterCode: 'trustedServer',
-      bidderCode: 'aps',
-      adId: 'stripped-field-ad-id',
-      adUnitCode: 'div-aps',
-      ttl: 300,
-      requestId: built.requestId,
-      meta: built.meta,
-    };
-    bidResponseListener!(delivered);
-
-    const entry = testWindow.tsjs?.apsPrebidRenderers?.['stripped-field-ad-id'];
-    expect(entry).toEqual(
-      expect.objectContaining({ adUnitCode: 'div-aps', renderer, markUsed: expect.any(Function) })
-    );
-    // The capability is scrubbed from the delivered bid after registration.
-    expect(delivered.meta).not.toHaveProperty('trustedServerRenderer');
-  });
-
   it('registers a distinct renderer for each of multiple APS bids on one imp', () => {
     installPrebidNpm();
 
@@ -596,11 +517,11 @@ describe('prebid/installPrebidNpm', () => {
       });
     }
 
-    const registry = testWindow.tsjs?.apsPrebidRenderers;
-    expect(registry?.['shared-imp-ad-id-0']).toEqual(
+    const registry = testWindow.tsjs.apsPrebidRenderers;
+    expect(registry['shared-imp-ad-id-0']).toEqual(
       expect.objectContaining({ renderer: firstRenderer })
     );
-    expect(registry?.['shared-imp-ad-id-1']).toEqual(
+    expect(registry['shared-imp-ad-id-1']).toEqual(
       expect.objectContaining({ renderer: secondRenderer })
     );
   });
@@ -623,7 +544,7 @@ describe('prebid/installPrebidNpm', () => {
       requestId: 'req-reused',
       trustedServerRenderer: apsRenderer(),
     });
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['surviving-field-ad-id']).toBeDefined();
+    expect(testWindow.tsjs.apsPrebidRenderers['surviving-field-ad-id']).toBeDefined();
 
     // A later field-stripped bid reusing the same requestId has no descriptor of its
     // own, so no stale renderer may be registered for it.
@@ -636,7 +557,7 @@ describe('prebid/installPrebidNpm', () => {
       requestId: 'req-reused',
       meta: { advertiserDomains: [] },
     });
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['reused-request-ad-id']).toBeUndefined();
+    expect(testWindow.tsjs.apsPrebidRenderers['reused-request-ad-id']).toBeUndefined();
   });
 
   it('registers and scrubs on bidAccepted before later events can observe the descriptor', () => {
@@ -680,7 +601,7 @@ describe('prebid/installPrebidNpm', () => {
     };
     bidAcceptedListener!(accepted);
 
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['accepted-ad-id']).toEqual(
+    expect(testWindow.tsjs.apsPrebidRenderers['accepted-ad-id']).toEqual(
       expect.objectContaining({ adUnitCode: 'div-aps', renderer })
     );
     expect(accepted).not.toHaveProperty('trustedServerRenderer');
@@ -689,7 +610,7 @@ describe('prebid/installPrebidNpm', () => {
     // The later bidResponse pass sees the already-scrubbed object and no-ops.
     const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
     bidResponseListener!(accepted);
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['accepted-ad-id']).toEqual(
+    expect(testWindow.tsjs.apsPrebidRenderers['accepted-ad-id']).toEqual(
       expect.objectContaining({ renderer })
     );
     expect(warnSpy).not.toHaveBeenCalled();
@@ -725,7 +646,89 @@ describe('prebid/installPrebidNpm', () => {
       meta: 'corrupted',
       trustedServerRenderer: apsRenderer(),
     });
-    expect(testWindow.tsjs?.apsPrebidRenderers?.['corrupt-meta-with-field-ad-id']).toBeDefined();
+    expect(testWindow.tsjs.apsPrebidRenderers['corrupt-meta-with-field-ad-id']).toBeDefined();
+  });
+
+  it('makes failed APS renderer registrations ineligible when zero-CPM bids are allowed', () => {
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    const malformedBid: Record<string, unknown> = {
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'malformed-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      cpm: 1.23,
+      trustedServerRenderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+    };
+    bidResponseListener!(malformedBid);
+    bidResponseListener!({
+      adapterCode: 'publisherAdapter',
+      bidderCode: 'aps',
+      adId: 'foreign-ad-id',
+      adUnitCode: 'div-aps',
+      trustedServerRenderer: apsRenderer(),
+    });
+
+    expect(testWindow.tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
+    expect(testWindow.tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
+    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
+    // Prebid's allowZeroCpmBids path still requires cpm >= 0.
+    expect(malformedBid['cpm']).toBe(-1);
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[tsjs-prebid] rejected APS renderer capability that failed registration'
+    );
+  });
+
+  it('registers APS renderer via meta when Prebid strips the custom top-level field', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    expect(bidResponseListener).toBeTypeOf('function');
+
+    const renderer = apsRenderer();
+    const [built] = auctionBidsToPrebidBids(
+      [
+        {
+          impid: 'div-aps',
+          renderer,
+          price: 1.0,
+          width: 300,
+          height: 250,
+          seat: 'aps',
+          creativeId: 'cr-aps',
+          adomain: [],
+        },
+      ],
+      [{ adUnitCode: 'div-aps', bidId: 'req-strip' }],
+      true
+    );
+
+    // Prebid delivered the bid with the custom top-level field REMOVED — only
+    // first-class fields (requestId, meta) survive normalization.
+    const delivered: Record<string, unknown> = {
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'stripped-field-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      requestId: built.requestId,
+      meta: built.meta,
+    };
+    bidResponseListener!(delivered);
+
+    const entry = testWindow.tsjs?.apsPrebidRenderers?.['stripped-field-ad-id'];
+    expect(entry).toEqual(
+      expect.objectContaining({ adUnitCode: 'div-aps', renderer, markUsed: expect.any(Function) })
+    );
+    // The capability is scrubbed from the delivered bid after registration.
+    expect(delivered.meta).not.toHaveProperty('trustedServerRenderer');
   });
 
   it('does not register malformed or non-trusted APS renderer capabilities', () => {
@@ -2042,7 +2045,7 @@ describe('prebid/installRefreshHandler', () => {
       })
     );
     expect(setTargetingForGPTAsync).toHaveBeenCalledWith(['div-ad-display']);
-    expect(originalRefresh).toHaveBeenCalledWith(undefined, undefined);
+    expect(originalRefresh).toHaveBeenCalledWith(targetSlots, undefined);
 
     mockPbjs.setTargetingForGPTAsync = undefined;
   });
diff --git a/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs b/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs
index 6ee858568..6fffa29ee 100644
--- a/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs
+++ b/crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs
@@ -86,7 +86,7 @@ describe('tsjs-prebid shim artifact', () => {
     // A value-import of Prebid or a private rendering helper would multiply
     // the shim size; retain a margin above the normal compact shim output.
     expect(bundleCode.length).toBeGreaterThan(200_000);
-    expect(shimCode.length).toBeLessThan(30_000);
+    expect(shimCode.length).toBeLessThan(150_000);
     expect(shimCode).toContain('markWinningBidAsUsed');
   });
 });
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index ddb6544ce..b763cac24 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1347,8 +1347,16 @@ Defines the ad slots the trusted server offers on a page: which pages each slot
 appears on (`page_patterns`), its supported sizes (`formats`), and the GAM ad
 unit it maps to (`gam_unit_path`).
 
+`enabled` is the dedicated server-side ad-template switch. It defaults to `true`
+for compatibility with existing configurations. Set it to `false` to stop
+publisher HTML and SPA page-bids template delivery while retaining the slot
+configuration and direct `POST /auction` endpoint. The browser-facing cache
+policy for a disabled template stack is `Cache-Control: max-age=60`, unless the
+origin already sends `private` or `no-store`.
+
 ```toml
 [creative_opportunities]
+enabled = true # set to false to disable server-side ad templates
 gam_network_id = "123456789"
 price_granularity = "dense"
 
@@ -1367,6 +1375,13 @@ page_patterns = ["/", "/news", "/news/*", "/reviews", "/reviews/*"]
 formats = [{ width = 728, height = 90 }]
 ```
 
+The same switch can be overridden through the legacy environment-variable
+loader:
+
+```bash
+TRUSTED_SERVER__CREATIVE_OPPORTUNITIES__ENABLED=false
+```
+
 ### `gam_unit_path` templating
 
 `gam_unit_path` is a template. A publisher whose ad unit varies by site section
@@ -1420,8 +1435,9 @@ publisher-specific. Startup fails if `{section}` is used without a valid
 `section_root`. Startup rejects a blank `gam_network_id` only when an absent
 path/default or a `{network_id}` template consumes it; static paths and
 templates without `{network_id}` do not consume it. A
-`[creative_opportunities]` block with no slots is disabled, so its
-`gam_network_id` is not checked.
+`[creative_opportunities]` block with `enabled = false` or no slots is
+inactive, so no publisher templates are delivered and its `gam_network_id` is
+not checked when no slot uses it.
 
 Both knobs are config-driven, so the URL→section convention stays with the
 publisher: `section_segment` selects which segment names the section, and
diff --git a/docs/guide/integrations/datadome.md b/docs/guide/integrations/datadome.md
index 9c342679b..35eda5d3e 100644
--- a/docs/guide/integrations/datadome.md
+++ b/docs/guide/integrations/datadome.md
@@ -86,6 +86,7 @@ patterns = ["(?i)\\.(avi|flv|mka|mkv|mov|mp4|mpeg|mpg|mp3|flac|ogg|ogm|opus|wav|
 | `protection_excluded_ip_cidr_sources`  | array   | `[]`                             | Config Store sources containing dynamic client IP CIDR bypass lists     |
 | `protection_ip_list_cache_ttl_seconds` | integer | `300`                            | Process-local cache TTL for Config Store-backed IP CIDR bypass lists    |
 | `protection_exclusion_rules`           | array   | Static asset path regex          | Structured method/path/query/IP/ASN exclusion rules                     |
+| `protection_test_bypass`               | object  | omitted                          | Temporary static-header bypass for access-controlled staging tests      |
 | `enable_graphql_support`               | boolean | `false`                          | Reserved for future GraphQL body inspection; ignored in v1              |
 | `client_side_key`                      | string  | `""`                             | DataDome client-side JavaScript key used for tag injection              |
 | `inject_client_side_tag`               | boolean | `true`                           | Auto-inject the browser tag when `client_side_key` is non-empty         |
@@ -168,11 +169,76 @@ A request is protected when all of the following are true:
 5. The client IP does not match `protection_excluded_ip_cidrs` or any Config Store-backed CIDR source.
 6. The client ASN is not listed in `protection_excluded_asns`.
 7. No `protection_exclusion_rules` match.
+8. The request does not contain a matching enabled `protection_test_bypass` credential.
 
 Static assets are excluded by default using a case-insensitive file-extension regex. Trusted Server internal routes such as `/static/tsjs=`, `/integrations/`, `/first-party/`, admin routes, discovery routes, and signature-verification routes are also excluded by default.
 
 Auction traffic at `/auction` is protected by default.
 
+### Staging test bypass
+
+For short-lived browser automation on an access-controlled staging site, you
+can configure a static header credential that skips only the server-side
+Protection API:
+
+```toml
+[integrations.datadome.protection_test_bypass]
+enabled = true
+credential_secret_store = "ts_secrets"
+credential_secret_name = "datadome_test_bypass"
+```
+
+`protection_test_bypass` requires `enable_protection = true`; it is disabled
+when omitted. Store the temporary credential in the configured Secret Store,
+configure this section only while needed, protect the site with an outer access
+control such as Basic Auth, and remove the section when testing finishes. Do not
+enable it in production.
+
+The fixed `x-ts-datadome-bypass` header is compared in constant time, removed
+before the request can reach DataDome or the publisher origin, and never
+logged. Scope the header to the staging origin; do not attach it to every
+request in a browser context because that can disclose the credential to
+third-party origins. With Playwright:
+
+```ts
+await context.route('https://staging.example.com/**', async (route) => {
+  const headers = {
+    ...route.request().headers(),
+    'x-ts-datadome-bypass': process.env.DATADOME_TEST_BYPASS!,
+  }
+  await route.continue({ headers })
+})
+```
+
+### Client-side tag suppression behavior
+
+On the Fastly adapter, a request that matches an IP-based DataDome exclusion
+or the configured test-bypass credential also omits Trusted Server's
+automatically injected client-side DataDome tag from processed HTML. This keeps
+the client-side layer consistent with the server-side Protection API skip.
+
+This behavior applies to:
+
+- `protection_excluded_ip_cidrs`;
+- `protection_excluded_ip_cidr_sources`;
+- structured `ip_cidr` rules;
+- structured `ip_cidr_source` rules; and
+- a matching enabled `protection_test_bypass` credential.
+
+ASN, method, path, query-parameter, static-asset, and internal-route
+exclusions do not automatically suppress the client-side tag. DataDome tags
+already present in publisher HTML are not removed or changed by this behavior,
+and `/integrations/datadome/tags.js` remains available when requested directly.
+
+Because the processed HTML differs by client IP or test credential,
+tag-suppressed HTML is marked `private, max-age=0` and removed from shared
+surrogate caches. The decision is reported in the existing protection log, for
+example:
+
+```text
+[datadome] protection decision=skipped rule=protection-test-bypass reason=test_bypass client_tag=omitted method=GET
+```
+
 ### Structured exclusion rules
 
 Use structured rules for all DataDome protection exclusions. Each rule has an `id`, optional `methods`, and a typed matcher. The default configuration includes a `path_regex` rule for common static assets.
diff --git a/docs/guide/integrations/gpt-diagnostics.md b/docs/guide/integrations/gpt-diagnostics.md
index 78c657bf6..f71296b5f 100644
--- a/docs/guide/integrations/gpt-diagnostics.md
+++ b/docs/guide/integrations/gpt-diagnostics.md
@@ -78,6 +78,8 @@ Visible, Filled, Empty, Pending/Incomplete, and Unbound/Ambiguous slots.
 
 Each request cycle can show:
 
+- Exact GPT slot element ID and ad unit path.
+- Initial request and numbered refresh cycles.
 - The observed request path, request-intent ID, and direct Trusted Server opportunity.
 - Opaque Trusted Server auction-ID correlation and opportunity-to-request latency when available.
 - Observed replacement of an earlier retained filled render, including GPT creative-ID transitions.
diff --git a/docs/guide/integrations/prebid.md b/docs/guide/integrations/prebid.md
index 32f2827fb..c1357571a 100644
--- a/docs/guide/integrations/prebid.md
+++ b/docs/guide/integrations/prebid.md
@@ -354,9 +354,10 @@ the configured suffixes with an exact, case-sensitive `endsWith()` match. A matc
 slot is omitted from the synthetic Prebid refresh ad units, but it remains in the
 original GPT refresh call. In a mixed global refresh, normal display slots still
 auction and receive refreshed Prebid targeting while excluded slots still refresh in
-GAM. Because the original refresh is preserved as one GPT call, an excluded slot in
-that mixed refresh waits for the auction to complete or the refresh watchdog to fire
-(up to 1.5 seconds by default); an all-excluded refresh passes through immediately.
+GAM. The wrapper still issues one GPT call for the whole target set, so an
+excluded slot in that mixed refresh waits for the auction to complete or the
+refresh watchdog to fire (up to 1.5 seconds by default); an all-excluded refresh
+passes through immediately.
 
 Each suffix must be a non-empty slash-prefixed path with no surrounding whitespace.
 The root suffix (`"/"`) is rejected, as are suffixes without a leading slash; exact
diff --git a/docs/superpowers/plans/2026-08-03-datadome-ip-excluded-client-tag.md b/docs/superpowers/plans/2026-08-03-datadome-ip-excluded-client-tag.md
new file mode 100644
index 000000000..2d9b0eae2
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-03-datadome-ip-excluded-client-tag.md
@@ -0,0 +1,468 @@
+# DataDome IP-excluded client tag suppression — Implementation Plan
+
+> **Status:** Approved for implementation
+>
+> **For implementers:** Work task by task and keep the workspace buildable.
+> Follow `CLAUDE.md`: use target-matched Cargo aliases, do not use bare
+> workspace tests, and do not add an internal HTTP header for request state.
+
+**Goal:** When Fastly's authoritative client IP matches a DataDome IP exclusion,
+skip the Protection API call and omit only Trusted Server's automatically
+injected DataDome client tag from every processed HTML response.
+
+**Issue:** #994
+**Design:**
+`docs/superpowers/specs/2026-08-03-datadome-ip-excluded-client-tag-design.md`
+
+## Approved behavior
+
+| Request condition                                             | Protection API  | Trusted Server auto-injected tag | Publisher-originated tag |
+| ------------------------------------------------------------- | --------------- | -------------------------------- | ------------------------ |
+| Inline IP CIDR match                                          | Skipped         | Omitted                          | Unchanged                |
+| Config Store IP CIDR-source match                             | Skipped         | Omitted                          | Unchanged                |
+| Structured `ip_cidr` match                                    | Skipped         | Omitted                          | Unchanged                |
+| Structured `ip_cidr_source` match                             | Skipped         | Omitted                          | Unchanged                |
+| ASN, method, path, query, static, or internal-route exclusion | Skipped         | Preserved                        | Unchanged                |
+| No exclusion match                                            | Called normally | Preserved                        | Unchanged                |
+| Protection API fail-open                                      | Continued       | Preserved                        | Unchanged                |
+
+The Fastly-only scope means that other adapters receive the default
+non-suppressed value. Do not add a configuration option and do not modify their
+request-filter wiring.
+
+## Runtime contracts
+
+1. **Trusted identity source:** determine exclusion from
+   `RuntimeServices::client_info().client_ip`, never a caller-provided header.
+2. **Single evaluation:** use the existing `ProtectionScope` decision. Do not
+   evaluate CIDRs a second time while injecting HTML; this avoids diverging
+   Config Store/cache behavior.
+3. **Private marker:** communicate the decision with a typed request extension,
+   never a request/response header. The marker cannot leak to the origin or
+   client.
+4. **Precise scope:** tag suppression is keyed only on decision reasons
+   `client_ip`, `client_ip_source`, `ip_cidr`, and `ip_cidr_source`.
+5. **Cache safety:** an HTML response with the tag omitted differs by client IP.
+   A suppressed processed HTML response must be `private, max-age=0` and have
+   `Surrogate-Control` and `Fastly-Surrogate-Control` removed. Do not alter
+   cache headers when the response is not processed HTML, because this feature
+   does not alter that body.
+6. **No behavior drift:** DataDome proxy endpoints, response-header effects,
+   `rewrite_sdk`, and DataDome tags that were already in origin HTML retain
+   their current behavior.
+
+## File map
+
+| File                                                                          | Change                                                                                                                                                  |
+| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `crates/trusted-server-core/src/integrations/registry.rs`                     | Permit filters to attach private typed request extensions while retaining header-effect semantics. Extend the HTML context with the propagated boolean. |
+| `crates/trusted-server-core/src/integrations/datadome.rs`                     | Define the crate-private marker and have the head injector honor the HTML-context flag.                                                                 |
+| `crates/trusted-server-core/src/integrations/datadome/protection.rs`          | Recognize IP scope skips, attach the marker, and add `client_tag=omitted` to the existing info log.                                                     |
+| `crates/trusted-server-core/src/html_processor.rs`                            | Carry the per-response suppression boolean from config to all integration HTML contexts.                                                                |
+| `crates/trusted-server-core/src/publisher.rs`                                 | Snapshot the marker before origin dispatch, propagate it through every HTML streaming path, and apply cache privacy to suppressed processed HTML.       |
+| `docs/guide/integrations/datadome.md`                                         | Document the Fastly IP-exclusion behavior and its limits.                                                                                               |
+| `docs/superpowers/specs/2026-08-03-datadome-ip-excluded-client-tag-design.md` | Already updated with the cache-variance safeguard.                                                                                                      |
+
+No changes are expected in `trusted-server.example.toml`, JavaScript bundles,
+or non-Fastly adapters.
+
+---
+
+## Task 1: Make the request-filter input capable of private annotations
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs`
+- Test: its existing `#[cfg(test)]` module
+
+The current `RequestFilterInput` holds `&Request<EdgeBody>`. Change it to hold
+`&mut Request<EdgeBody>` so a request filter can add a typed extension. This is
+the narrowest safe transport because the registry already has exclusive mutable
+access to the request while it invokes each filter.
+
+- [ ] **Step 1: Add a regression test for an extension-producing filter.** Create
+      a test-only zero-sized marker and filter that writes it to
+      `input.request.extensions_mut()`. Run `IntegrationRegistry::filter_request`
+      and assert the original mutable request has the marker afterward. In the
+      same test, verify normal `RequestFilterEffects` still apply their request
+      header mutation and return their response header mutation.
+- [ ] **Step 2: Change `RequestFilterInput::request` to a mutable borrow.** Keep
+      the `IntegrationRequestFilter` method signature and `RequestFilterEffects`
+      unchanged.
+- [ ] **Step 3: Update `IntegrationRegistry::filter_request`.** Pass its existing
+      `&mut Request` directly to each `RequestFilterInput`. Keep the ordering:
+      filter mutation first, then registry-applied request-header effects, then
+      the next filter.
+- [ ] **Step 4: Update all direct filter tests and test filters.** Calls that build
+      `RequestFilterInput` must construct a mutable request and pass
+      `request: &mut request`. Read-only filters should continue to compile by
+      simply not mutating the request.
+- [ ] **Step 5: Run focused tests.**
+
+```bash
+cargo test-fastly integrations::registry
+```
+
+**Acceptance:** a filter can retain a typed marker for downstream route handling
+without emitting a synthetic `x-*` header, and existing header effects retain
+their behavior.
+
+---
+
+## Task 2: Mark IP-based DataDome exclusions and log the outcome
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/datadome.rs`
+- Modify: `crates/trusted-server-core/src/integrations/datadome/protection.rs`
+- Test: `crates/trusted-server-core/src/integrations/datadome/protection.rs`
+- Reuse: `crates/trusted-server-core/src/integrations/datadome/protection_scope.rs`
+
+- [ ] **Step 1: Add a crate-private marker in `datadome.rs`.** Define a
+      zero-sized type with a behavior-oriented name, such as
+      `DataDomeClientTagSuppressed`. It must be visible to `publisher.rs` and
+      `protection.rs` through `pub(crate)`, but must not be exported as public
+      integration configuration or API.
+- [ ] **Step 2: Add an IP-reason predicate beside protection logging.** Centralize
+      the exact four eligible scope reasons in one helper:
+
+```rust
+matches!(reason, "client_ip" | "client_ip_source" | "ip_cidr" | "ip_cidr_source")
+```
+
+      Do not infer eligibility from rule ID: Config Store source rule IDs are
+      operator-configured strings.
+
+- [ ] **Step 3: Make `filter_protection_request` own a mutable input and pass it
+      mutably to `is_request_protected`.** In the existing
+      `ProtectionScopeDecision::Skip` arm:
+  1. determine whether the reason is IP-based;
+  2. if so, insert the typed marker into `input.request.extensions_mut()`;
+  3. call the updated skip logger with `client_tag_omitted = true`; and
+  4. return `false` exactly as today so the Protection API is not called.
+
+     Do not set the marker for the early method/integration/internal-route
+     returns. Do not set it when the API call returns a fail-open error.
+
+- [ ] **Step 4: Update `log_protection_skip`.** Keep IP exclusions at `info` and
+      non-IP exclusions at `debug`. For the IP branch, extend the existing
+      structured text after the reason with `client_tag=omitted`; retain rule,
+      reason, method, host, and path, but do not include the client IP. The
+      desired shape is:
+
+```text
+[datadome] protection decision=skipped rule=excluded-ip-cidrs reason=client_ip client_tag=omitted method=GET
+```
+
+- [ ] **Step 5: Add filter-level marker tests.** Add small helpers in the
+      protection test module to build `RuntimeServices` with a fixed client IP,
+      optional Config Store data, and a mutable request. For each case, call
+      `filter_protection_request`, assert it returns `Continue`, and inspect the
+      request extension:
+  - inline `protection_excluded_ip_cidrs` match → marker present;
+  - `protection_excluded_ip_cidr_sources` match → marker present;
+  - structured `ProtectionMatcherConfig::IpCidr` match → marker present;
+  - structured `ProtectionMatcherConfig::IpCidrSource` match → marker present.
+
+    Clear the process-global CIDR-source test cache before and after source
+    tests so cached values cannot affect another case.
+
+- [ ] **Step 6: Add negative filter-level tests.** Assert the marker is absent
+      for a non-matching IP, a configured ASN match, a structured path match,
+      a structured query match, an excluded method, and an internal/integration
+      route. Reuse the existing `ProtectionScope` unit tests for matching
+      semantics; these new tests verify only the new side effect.
+- [ ] **Step 7: Preserve API-call behavior.** For an IP marker test, use an HTTP
+      client double that records calls or errors if called. Assert no Protection
+      API request is sent. This protects against accidentally marking a request
+      while still invoking DataDome.
+- [ ] **Step 8: Run focused tests.**
+
+```bash
+cargo test-fastly datadome::protection
+cargo test-fastly datadome::protection_scope
+```
+
+**Acceptance:** only the four IP decision reasons add the private marker and
+produce the augmented informational skip log; all other exclusion and fail-open
+paths keep their current tag behavior.
+
+---
+
+## Task 3: Thread suppression through publisher response processing
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Modify: `crates/trusted-server-core/src/html_processor.rs`
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs`
+- Test: `publisher.rs` and `html_processor.rs` test modules
+
+### Data flow to implement
+
+```text
+DataDomeClientTagSuppressed request extension
+  -> bool captured by handle_publisher_request before origin dispatch
+  -> OwnedProcessResponseParams
+  -> ProcessResponseParams / HtmlStreamProcessorParams
+  -> HtmlProcessorConfig
+  -> IntegrationHtmlContext
+  -> DataDomeIntegration::head_inserts
+```
+
+- [ ] **Step 1: Capture the marker once in `handle_publisher_request`.** Read
+      `req.extensions().get::<DataDomeClientTagSuppressed>().is_some()` before
+      `req` is rewritten and moved into `PlatformHttpRequest`. Store the boolean
+      only in the `PublisherResponse::Stream` parameters, because that is the
+      only response route that passes through HTML injection.
+- [ ] **Step 2: Add a boolean to the owned and borrowed publisher-processing
+      parameter structs.** Add a clearly named field such as
+      `suppress_datadome_client_side_tag` to:
+  - `OwnedProcessResponseParams`;
+  - `ProcessResponseParams`; and
+  - `HtmlStreamProcessorParams`.
+
+    Pass it through all three existing HTML construction sites:
+
+  - `PublisherBodyProcessor::new` for async buffered processing;
+  - `process_response_streaming` for synchronous processing; and
+  - `stream_publisher_body_async` for the Fastly streaming auction-hold path.
+
+    Every test fixture that constructs `OwnedProcessResponseParams` directly
+    must set `false` unless it explicitly exercises suppression.
+
+- [ ] **Step 3: Extend `HtmlProcessorConfig`.** Add the same boolean, default it
+      to `false` in `from_settings`, and add a narrow builder method used by
+      `create_html_stream_processor`. Update direct `HtmlProcessorConfig`
+      fixtures and the benchmark fixture to set `false` explicitly.
+- [ ] **Step 4: Extend `IntegrationHtmlContext`.** Add the boolean as immutable
+      request-scoped context. Populate it at both construction sites in
+      `html_processor.rs`:
+  - the streaming `<head>` element handler; and
+  - `HtmlWithPostProcessing::process_chunk` for full-document post-processors.
+
+    Update every test helper that constructs `IntegrationHtmlContext` to set
+    `false` by default.
+
+- [ ] **Step 5: Add plumbing tests.**
+  - `HtmlProcessorConfig::from_settings` defaults to non-suppressed.
+  - A test head injector records the context flag and sees `true` when a config
+    is built with suppression.
+  - A `publisher.rs` route test inserts the DataDome marker into a request,
+    receives a processable HTML `PublisherResponse::Stream`, and verifies the
+    owned parameters carry `true`.
+  - A buffered and a streaming-body path both preserve `true` to head injection.
+
+- [ ] **Step 6: Run focused tests.**
+
+```bash
+cargo test-fastly html_processor
+cargo test-fastly publisher
+```
+
+**Acceptance:** the decision is read once from a private request extension and
+is available to every head injector for every processed HTML response, including
+Fastly's streaming path.
+
+---
+
+## Task 4: Omit only Trusted Server's injected DataDome tag
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/datadome.rs`
+- Test: `crates/trusted-server-core/src/integrations/datadome.rs`
+- Test: `crates/trusted-server-core/src/html_processor.rs` or `publisher.rs`
+
+- [ ] **Step 1: Add a direct head-injector regression test.** With a client-side
+      key configured and `ctx.suppress_datadome_client_side_tag = true`, assert
+      `head_inserts()` returns an empty vector. The same config with `false`
+      must still return exactly one snippet containing both `window.ddjskey` and
+      the configured tag URL.
+- [ ] **Step 2: Implement the guard as the first condition in
+      `DataDomeIntegration::head_inserts`.** Return an empty vector when the
+      context flag is true; otherwise retain all current serialization,
+      escaping, blank-key, and `inject_client_side_tag` behavior unchanged.
+- [ ] **Step 3: Add an end-to-end HTML pipeline test.** Configure the DataDome
+      integration with a client-side key, process representative HTML with
+      suppression enabled, and assert the result contains neither:
+
+```text
+window.ddjskey=
+/integrations/datadome/tags.js
+```
+
+      Repeat with suppression disabled and assert both appear.
+
+- [ ] **Step 4: Pin publisher-originated-tag behavior.** Feed origin HTML that
+      contains a DataDome `tags.js` element. With suppression enabled, assert
+      that element remains in output and is rewritten by `rewrite_sdk` exactly
+      as before. This distinguishes automatic injection from origin markup.
+- [ ] **Step 5: Pin direct route behavior.** Retain or add a DataDome proxy test
+      showing that `GET /integrations/datadome/tags.js` remains registered and
+      fetches/proxies the SDK normally; suppression affects only HTML injection.
+- [ ] **Step 6: Run focused tests.**
+
+```bash
+cargo test-fastly datadome
+```
+
+**Acceptance:** suppression removes only the generated configuration/script
+pair; nothing removes publisher markup or disables DataDome endpoints.
+
+---
+
+## Task 5: Make tag-suppressed processed HTML private
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Test: `crates/trusted-server-core/src/publisher.rs`
+
+The automatic tag makes the processed HTML vary by client IP. Cache privacy is
+therefore a correctness and protection requirement, not an optional
+optimization.
+
+- [ ] **Step 1: Add a failing cache-privacy test.** Build a `PublisherResponse`
+      with a processable HTML content type, suppression `true`, and cacheable
+      origin headers (`Cache-Control`, `Surrogate-Control`, and
+      `Fastly-Surrogate-Control`). Assert the stream response is:
+  - `Cache-Control: private, max-age=0`; and
+  - missing both surrogate cache headers.
+
+- [ ] **Step 2: Apply privacy only in the `ResponseRoute::Stream` HTML arm.**
+      After response classification confirms a processable HTML stream, use the
+      existing per-user ad-stack policy as the model. Do not alter cache headers
+      for CSS, RSC, non-processable pass-through, unsupported encodings, HEAD,
+      204/205/304, or responses without suppression: none has a body variation
+      created by this feature.
+- [ ] **Step 3: Add non-regression cache tests.** Verify that:
+  - non-suppressed processed HTML keeps its existing cache headers unless
+    another existing policy changes them;
+  - a suppressed CSS/non-HTML stream is not made private by this feature; and
+  - existing ad-stack privacy behavior remains unchanged when both features are
+    active.
+
+- [ ] **Step 4: Run focused tests.**
+
+```bash
+cargo test-fastly publisher
+```
+
+**Acceptance:** a shared cache cannot replay an IP-excluded client's tagless
+HTML to a non-excluded visitor, while unchanged responses retain their existing
+cacheability.
+
+---
+
+## Task 6: Add Fastly-path regression coverage
+
+**Files:**
+
+- Modify: `crates/trusted-server-adapter-fastly/src/app.rs` tests only if the
+  existing dispatch helpers can exercise the DataDome registry with a stubbed
+  publisher response.
+- Otherwise, document the existing core filter + publisher pipeline tests as
+  the executable behavioral coverage; do not refactor Fastly production code
+  merely to enable a duplicate test.
+
+- [ ] **Step 1: Extend the existing Fastly request-filter dispatch regression
+      test or add a focused equivalent.** Configure a DataDome request filter,
+      insert trusted `ClientInfo` into the request extensions with a matching
+      IP, and confirm the filter runs before publisher routing.
+- [ ] **Step 2: Assert that the routed request retains the private DataDome
+      marker.** The assertion must inspect request extensions or the processed
+      HTML result, not an HTTP header.
+- [ ] **Step 3: Ensure no actual DataDome API call occurs for the matching IP.**
+      Use a recording/failing HTTP client or the existing Fastly test seam.
+- [ ] **Step 4: Add the non-matching counterpart.** It must not receive the
+      marker and must continue to inject the configured tag when HTML is
+      processed.
+- [ ] **Step 5: Run Fastly adapter tests.**
+
+```bash
+cargo test-fastly
+```
+
+**Acceptance:** the production adapter's actual filter ordering preserves the
+marker from authoritative Fastly client metadata through publisher HTML
+processing. If the current test seam cannot stub a full origin response, retain
+this as focused request-filter-order coverage and rely on Task 3's core
+pipeline tests for body output rather than expanding adapter production code.
+
+---
+
+## Task 7: Document operator-visible behavior
+
+**Files:**
+
+- Modify: `docs/guide/integrations/datadome.md`
+- Do not modify: `trusted-server.example.toml`
+
+- [ ] **Step 1: Add a subsection adjacent to “Protected traffic” or “Client-side
+      setup.”** State that, on Fastly, an IP exclusion skips the Protection API
+      and suppresses only Trusted Server's automatic DataDome tag injection on
+      processed HTML.
+- [ ] **Step 2: List the four covered IP sources.** Use the exact configuration
+      names and structured rule types.
+- [ ] **Step 3: State the exclusions that do not suppress the client tag.** ASN,
+      method, path, query, static-asset, and internal-route exclusions retain
+      normal auto-injection.
+- [ ] **Step 4: State the limits.** Publisher-originated/manual tags are not
+      removed; `/integrations/datadome/tags.js` remains available; no new
+      configuration is required; and tag-suppressed processed HTML is private
+      to prevent shared-cache replay.
+- [ ] **Step 5: Add the diagnostic example.** Use an example-only host/IP and
+      include `client_tag=omitted` with rule and reason.
+- [ ] **Step 6: Format-check the changed documentation.**
+
+```bash
+cd docs
+npx prettier --check guide/integrations/datadome.md \
+  superpowers/specs/2026-08-03-datadome-ip-excluded-client-tag-design.md \
+  superpowers/plans/2026-08-03-datadome-ip-excluded-client-tag.md
+```
+
+**Acceptance:** operators can predict exactly when the tag will be omitted and
+understand that this is an IP-based Fastly behavior, not a general exclusion
+side effect.
+
+---
+
+## Final verification
+
+- [ ] Confirm the working tree contains only the intended core, Fastly-test,
+      guide, spec, and plan changes.
+- [ ] Run formatting.
+
+```bash
+cargo fmt --all -- --check
+```
+
+- [ ] Run the relevant target-matched test suites.
+
+```bash
+cargo test-fastly
+cargo test-axum
+cargo test-cloudflare
+```
+
+- [ ] Run required lint suites.
+
+```bash
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+```
+
+- [ ] Run the docs check from Task 7.
+- [ ] Review the diff for accidental exposure of the marker as a request or
+      response header, duplicate CIDR evaluation, unintended publisher-tag
+      removal, or shared-cacheable tag-suppressed HTML.
+
+## Deferred acceptance
+
+Do **not** perform live production/browser verification in this change. After
+deployment, the separate testing workflow should verify that a matching
+whitelisted IP receives processed HTML without Trusted Server's
+`/integrations/datadome/tags.js` injection, while an unlisted IP retains it.
diff --git a/docs/superpowers/plans/2026-08-06-server-side-ad-templates-cache-control.md b/docs/superpowers/plans/2026-08-06-server-side-ad-templates-cache-control.md
new file mode 100644
index 000000000..f96bdcb28
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-06-server-side-ad-templates-cache-control.md
@@ -0,0 +1,238 @@
+# Dedicated Server-Side Ad Templates Switch and Cache Policy Plan
+
+> **For agentic workers:** Implement this plan task-by-task, keeping the dedicated
+> template switch separate from the global auction configuration.
+
+**Goal:** Add an explicit on/off switch for server-side ad templates, while
+retaining the browser-facing cache policy from issue #1007:
+
+- Server-side ad templates active: `Cache-Control: private, no-store`.
+- Server-side ad templates inactive: `Cache-Control: max-age=60`, unless the
+  origin already sends `private` or `no-store`.
+- CDN-specific cache headers must not change when templates are inactive.
+
+**Issue context:** The current cache-policy change uses the runtime
+`should_run_ad_stack` gate. That gate is also affected by `[auction].enabled`,
+which is not the right configuration boundary for publisher templates. A
+browser can call `POST /auction`, and that endpoint is a separate server-run
+auction API. The new switch must disable publisher HTML/page-bids template
+delivery without disabling that API.
+
+## Configuration decision
+
+Add this field to the existing `[creative_opportunities]` section:
+
+```toml
+[creative_opportunities]
+enabled = true
+```
+
+Use `enabled = false` to turn off server-side ad templates while retaining the
+slot definitions and keeping direct `POST /auction` behavior available.
+
+### Compatibility rules
+
+- The field defaults to `true` when omitted, preserving existing behavior for
+  deployments that already have `[creative_opportunities]` configured.
+- The section remains optional. An absent section continues to mean that the
+  feature is unavailable.
+- Serialize the default `true` value as omitted, matching the existing
+  rollback-compatibility pattern for newer creative-opportunity fields. An
+  explicit `false` must remain serialized so the setting is not silently lost.
+- `auction.enabled` remains a separate auction/orchestrator setting. Do not use
+  it as the dedicated template switch and do not thread the new template flag
+  into `POST /auction`.
+
+## Current cache behavior to retain
+
+The existing HTML policy block in `publisher.rs` must remain structurally
+consistent with the current issue #952 behavior:
+
+1. For an eligible request that runs the server-side ad stack and receives HTML:
+   - Set `Cache-Control: private, no-store`.
+   - Remove `ETag` and `Last-Modified`.
+   - Remove `Surrogate-Control`, `Fastly-Surrogate-Control`, `CDN-Cache-Control`,
+     and `Cloudflare-CDN-Cache-Control`.
+2. For HTML where the server-side ad stack does not run, including an explicit
+   template disable:
+   - Read the browser-facing `Cache-Control` header.
+   - If its value contains `private` or `no-store`, case-insensitively, preserve
+     the origin value exactly.
+   - Otherwise set exactly `Cache-Control: max-age=60`.
+   - Leave validators and all CDN-specific cache headers untouched.
+3. Preserve the later adapter response-privacy finalization for cookie-bearing
+   responses; this plan does not refactor that behavior.
+
+## File map
+
+### Configuration and compatibility
+
+- `crates/trusted-server-core/src/creative_opportunities.rs`
+  - Add `CreativeOpportunitiesConfig::enabled` with a default-true serde
+    implementation and documentation.
+  - Add a small accessor if it improves readability, but keep the source of
+    truth in this config type.
+  - Update config constructors and serialization tests.
+- `crates/trusted-server-core/src/settings.rs`
+  - Keep `creative_opportunities` parsing and runtime preparation compatible with
+    the new field.
+  - Make `creative_opportunity_slots()` return an empty slice when the section
+    is absent or explicitly disabled, so all adapters receive one consistent
+    runtime view.
+  - Add TOML and environment-override coverage for `enabled = false`.
+- `crates/trusted-server-core/src/config.rs`
+  - Extend legacy-schema tests to prove default `enabled = true` is omitted from
+    serialized blobs and remains readable by older binaries.
+  - Prove an explicit `enabled = false` is serialized, making rollback failure
+    loud rather than silently re-enabling templates.
+- `trusted-server.example.toml`
+  - Document `creative_opportunities.enabled` and show how to turn templates off
+    without deleting slot definitions.
+- `docs/guide/configuration.md`
+  - Add the field to the creative-opportunities reference and document the
+    environment override:
+    `TRUSTED_SERVER__CREATIVE_OPPORTUNITIES__ENABLED=false`.
+  - Clarify that this switch controls publisher HTML/page-bids template
+    delivery, not direct `POST /auction` callers.
+- `CHANGELOG.md`
+  - Add an entry describing the dedicated template switch and cache behavior.
+
+### Publisher execution and cache policy
+
+- `crates/trusted-server-core/src/publisher.rs`
+  - Include the dedicated flag in the initial publisher eligibility decision.
+  - Do not match, dispatch, or inject server-side ad templates when the flag is
+    false, even if slots are configured and `[auction].enabled` is true.
+  - Apply the issue #1007 inactive-HTML cache policy in this state.
+  - Update skip-reason diagnostics/telemetry so `ad_templates_disabled` is
+    distinguishable from `auction_disabled`, consent denial, bots, prefetch, and
+    no matching slots.
+  - Update `handle_page_bids` so an explicit template disable returns the normal
+    empty JSON shape (`slots: []`, `bids: {}`) rather than slot definitions. Keep
+    the current `404` behavior for an absent `[creative_opportunities]` section.
+  - Extend the existing SSAT cache-policy and eligibility tests.
+- `crates/trusted-server-core/src/auction/endpoints.rs`
+  - Do not gate `POST /auction` on the new template flag.
+  - Add a regression test or test fixture proving that disabling
+    `creative_opportunities.enabled` does not suppress a direct auction request
+    when providers are configured.
+  - Separately document/verify the existing behavior of `[auction].enabled` for
+    this endpoint; do not conflate that global setting with the new template
+    switch.
+
+### Adapter propagation and browser behavior
+
+The adapters already pass `Settings::creative_opportunity_slots()` into the
+publisher/page-bids handlers. Update and verify these call sites so the central
+empty-slice behavior is honored; avoid adding four divergent config checks:
+
+- `crates/trusted-server-adapter-fastly/src/app.rs`
+- `crates/trusted-server-adapter-axum/src/app.rs`
+- `crates/trusted-server-adapter-cloudflare/src/app.rs`
+- `crates/trusted-server-adapter-spin/src/app.rs`
+
+No route-level flag is needed if the core `Settings` accessor and handlers are
+correct. Add adapter route assertions only where existing fixtures make them
+useful.
+
+The browser runtime already defaults `window.tsjs.adSlots` and
+`window.tsjs.bids` to empty values when the edge does not inject templates. If
+terminology is updated, adjust these comments/tests without changing runtime
+semantics:
+
+- `crates/trusted-server-js/lib/src/core/index.ts`
+- `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`
+- Relevant page-bids tests under `crates/trusted-server-js/lib/test/integrations/gpt/`
+
+## Implementation tasks
+
+### Task 1: Add and serialize the dedicated setting
+
+- [ ] Add `enabled: bool` to `CreativeOpportunitiesConfig` with default `true`.
+- [ ] Use `skip_serializing_if` so the default value does not appear in stored
+      config blobs; explicit `false` must serialize.
+- [ ] Update all Rust struct literals in `creative_opportunities.rs` and
+      `publisher.rs` tests.
+- [ ] Add parsing, default, false-value, and environment-override tests.
+- [ ] Update the legacy compatibility tests in `config.rs`.
+
+### Task 2: Thread the setting through publisher eligibility
+
+- [ ] Update `should_run_server_side_ad_stack` to accept the dedicated template
+      flag as an explicit gate, with a descriptive parameter/doc comment.
+- [ ] Ensure initial publisher slot matching and `Settings::creative_opportunity_slots`
+      do not expose slots when templates are disabled.
+- [ ] Preserve the existing `[auction].enabled` and consent gates as separate
+      conditions.
+- [ ] Add an `ad_templates_disabled` diagnostic/telemetry skip reason where the
+      current branch records a skipped auction.
+
+### Task 3: Apply the cache policy to the dedicated-off state
+
+- [ ] Keep the active-SSAT `private, no-store` behavior and validator/CDN header
+      removal unchanged.
+- [ ] Keep the inactive-HTML `max-age=60` behavior from issue #1007.
+- [ ] Verify that explicit template disable changes only browser-facing
+      `Cache-Control` for cacheable HTML; preserve `ETag`, `Last-Modified`, and
+      every CDN-specific header.
+- [ ] Verify that origin `private`, `PRIVATE`, `no-store`, and `No-Store` values
+      remain unchanged.
+
+### Task 4: Gate SPA page-bids/template delivery
+
+- [ ] Include `co_config.enabled` in the `ad_stack_enabled` decision in
+      `handle_page_bids`.
+- [ ] Return empty slots and bids for an explicit disable while retaining the
+      endpoint and its existing response privacy headers.
+- [ ] Keep the absent-section `404` behavior unchanged.
+- [ ] Add tests for enabled, disabled, absent, consent-denied, bot, and prefetch
+      cases as appropriate; preserve existing tests for `[auction].enabled=false`.
+
+### Task 5: Protect direct `POST /auction` from accidental coupling
+
+- [ ] Add a focused endpoint test with `creative_opportunities.enabled=false`
+      and a recording provider.
+- [ ] Assert that the provider still sees the direct auction request and that
+      the response remains a normal OpenRTB response.
+- [ ] If the test reveals that `[auction].enabled=false` also needs a separate
+      product decision for `/auction`, record that as a follow-up rather than
+      changing it as part of the template-switch work.
+
+### Task 6: Update docs, examples, comments, and adapter coverage
+
+- [ ] Update the example config, configuration guide, and changelog.
+- [ ] Update stale comments that call `[auction].enabled` the universal template
+      kill switch.
+- [ ] Verify all four adapter call sites use the centralized disabled-slot view.
+- [ ] Run JS tests if comments or tests are touched; no JS behavior change is
+      expected.
+
+## Test plan
+
+Use target-matched commands; do not run bare workspace tests because the
+workspace contains multiple runtime targets.
+
+- [ ] `cargo test-axum -p trusted-server-core publisher`
+- [ ] `cargo test-fastly`
+- [ ] `cargo test-axum`
+- [ ] `cargo test-cloudflare`
+- [ ] `cargo test-spin`
+- [ ] `cargo fmt --all -- --check`
+- [ ] `cargo clippy-fastly`
+- [ ] `cargo clippy-axum`
+- [ ] `cargo clippy-cloudflare`
+- [ ] `cargo clippy-cloudflare-wasm`
+- [ ] `cargo clippy-spin-native`
+- [ ] `cargo clippy-spin-wasm`
+- [ ] `cd crates/trusted-server-js/lib && npx vitest run` if JS tests/comments change
+- [ ] `cd docs && npm run format` if documentation formatting is required
+
+## Non-goals
+
+- Do not change CDN-specific cache policy for inactive templates.
+- Do not change adapter response privacy or cookie handling.
+- Do not use `auction.rewrite_creatives` as the template switch; it controls
+  creative URL rewriting, not whether the server-side template stack runs.
+- Do not gate or disable direct `POST /auction` as part of this feature.
+- Do not remove slot definitions when the switch is off; the point of the switch
+  is to provide a reversible runtime control.
diff --git a/docs/superpowers/specs/2026-08-03-datadome-ip-excluded-client-tag-design.md b/docs/superpowers/specs/2026-08-03-datadome-ip-excluded-client-tag-design.md
new file mode 100644
index 000000000..d6d811780
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-03-datadome-ip-excluded-client-tag-design.md
@@ -0,0 +1,339 @@
+# DataDome IP-excluded client tag suppression
+
+**Issue:** #994
+**Date:** 2026-08-03
+**Status:** Proposed
+
+## Problem
+
+Trusted Server has two DataDome protection layers:
+
+1. Server-side Protection API validation, which can be skipped for configured
+   client IP CIDRs.
+2. Client-side tag auto-injection, which adds `window.ddjskey`,
+   `window.ddoptions`, and the configured `tags.js` script to processed HTML.
+
+When a request matches an IP-based server-side exclusion, the Protection API is
+skipped, but the client-side tag is currently still injected. The browser can
+therefore continue running client-side DataDome protection for a request that
+was explicitly whitelisted at Trusted Server.
+
+The desired behavior is that Fastly requests skipped by an IP-based DataDome
+exclusion also omit Trusted Server's automatically injected client-side tag.
+
+## Goals
+
+- Suppress Trusted Server's automatically injected DataDome client-side tag for
+  Fastly requests skipped by an IP-based protection exclusion.
+- Reuse the existing authoritative protection-scope decision.
+- Cover all supported IP-based exclusion mechanisms:
+  - `protection_excluded_ip_cidrs`
+  - `protection_excluded_ip_cidr_sources`
+  - structured `ip_cidr` rules
+  - structured `ip_cidr_source` rules
+- Preserve current behavior for non-IP exclusions.
+- Leave publisher-originated or manually configured DataDome tags untouched.
+- Add an informational diagnostic indicating that the client tag is omitted.
+- Keep the implementation independent of caller-supplied IP headers.
+- Prevent a shared cache from replaying IP-specific, tag-suppressed HTML to
+  non-excluded visitors.
+
+## Non-goals
+
+- Do not add a configuration flag or make this behavior opt-in.
+- Do not change Axum, Cloudflare, or Spin request-filter wiring. This behavior
+  is intentionally scoped to the Fastly adapter, where the DataDome server-side
+  request filter is currently run.
+- Do not suppress DataDome tags that originate in publisher HTML.
+- Do not remove or disable the `/integrations/datadome/tags.js` route.
+- Do not change DataDome signal-collection proxy behavior.
+- Do not change ASN, path, query-parameter, method, static-asset, or internal
+  route exclusions.
+- Do not perform live production verification as part of implementation.
+
+## Confirmed decisions
+
+1. **Adapter scope:** Fastly only.
+2. **IP scope:** all four IP-based exclusion mechanisms listed above.
+3. **Tag scope:** Trusted Server's auto-injected tag only.
+4. **HTML scope:** every HTML response that enters the existing HTML processing
+   pipeline.
+5. **Logging:** enrich the existing IP-exclusion skip log with
+   `client_tag=omitted`, including the matched rule and reason.
+6. **Live testing:** deferred until after implementation and deployment/testing
+   workflow review.
+
+## Current architecture
+
+### Server-side protection
+
+`DataDomeIntegration::is_request_protected()` in
+`crates/trusted-server-core/src/integrations/datadome/protection.rs` evaluates
+method, internal-route, ASN, IP, and structured exclusion conditions. It uses
+the client IP from `RuntimeServices::client_info()`, which is populated from
+trusted Fastly request metadata. It does not use a caller-supplied IP header.
+
+The current function reduces the protection-scope result to a boolean. For an
+IP exclusion it logs the skip and returns `false`, causing the request filter to
+continue without calling the Protection API.
+
+The Fastly EdgeZero fallback path runs this request filter before route
+selection and publisher proxying. The request continues into
+`handle_publisher_request()` after the filter returns a continue decision.
+
+### Client-side injection
+
+`DataDomeIntegration::head_inserts()` in
+`crates/trusted-server-core/src/integrations/datadome.rs` emits the client-side
+snippet when:
+
+- `inject_client_side_tag` is true; and
+- `client_side_key` is non-empty.
+
+The injector currently receives `IntegrationHtmlContext`, which contains HTML
+host/scheme and document state but no request IP or protection decision.
+
+The publisher response path carries request-specific values through:
+
+```text
+Request
+  -> OwnedProcessResponseParams
+  -> HtmlStreamProcessorParams
+  -> HtmlProcessorConfig
+  -> IntegrationHtmlContext
+  -> IntegrationHeadInjector
+```
+
+The existing DataDome attribute rewriter separately rewrites DataDome URLs
+found in publisher HTML. That behavior must remain unchanged.
+
+## Design
+
+### 1. Capture an IP-exclusion marker at the request filter
+
+The request filter must attach a typed, internal request-scoped marker when the
+existing protection-scope evaluation returns a skip for one of these reasons:
+
+- `client_ip`
+- `client_ip_source`
+- `ip_cidr`
+- `ip_cidr_source`
+
+The marker must be attached only after the existing scope decision confirms the
+IP exclusion. It must not be inferred from request headers or recomputed later
+in the HTML pipeline.
+
+The request-filter API currently exposes an immutable request view. Add the
+smallest internal mechanism needed for a filter to attach a typed request
+extension without introducing a caller-visible header. Header mutations should
+continue to use `RequestFilterEffects` as they do today.
+
+The marker should be a zero-sized or otherwise minimal internal type. It only
+needs to answer whether Trusted Server's DataDome client tag should be
+suppressed; the existing skip log supplies the rule ID and reason.
+
+The marker must not be attached for:
+
+- `OPTIONS` or other excluded methods before scope evaluation;
+- internal or integration routes;
+- ASN exclusions;
+- path, query, or other non-IP structured exclusions;
+- unmatched IP rules;
+- Protection API fail-open behavior; or
+- requests where `enable_protection` is false and the request filter does not
+  run.
+
+### 2. Enrich the existing skip log
+
+For IP-based skips, extend the existing informational log with
+`client_tag=omitted`:
+
+```text
+[datadome] protection decision=skipped rule=excluded-ip-cidrs reason=client_ip client_tag=omitted method=GET
+```
+
+The existing rule ID, reason, and method remain part of the log. Host and path are omitted to avoid placing dynamic request data in the protection logs.
+Client IP values are not included. Non-IP skip logs retain their current
+behavior and level.
+
+This log represents the request policy decision. It may also apply to a
+non-HTML response, for which no HTML tag would have been injected anyway.
+
+### 3. Propagate the marker into HTML processing
+
+Before the publisher request is moved into the platform HTTP client, snapshot
+whether the request carries the marker. Carry that request-scoped boolean
+through `OwnedProcessResponseParams`, `HtmlStreamProcessorParams`, and
+`HtmlProcessorConfig`.
+
+The value should default to `false` in all existing constructors and direct
+unit-test fixtures. Non-Fastly adapters will naturally retain the default
+because they do not currently produce the Fastly request-filter marker.
+
+Expose the value to head injectors through the existing HTML processing context
+or equivalent request-scoped integration context. The propagation must work for
+both:
+
+- the normal buffered HTML path; and
+- the streaming HTML path, including the auction-hold path.
+
+The value is irrelevant for non-HTML, RSC, pass-through, and unmodified
+responses, which should retain their current processing.
+
+### 4. Keep IP-specific HTML out of shared cache
+
+A processed HTML response differs by client IP when the generated tag is
+suppressed. In the `PublisherResponse::Stream` path, when suppression is active
+and the response is HTML, set `Cache-Control: private, max-age=0` and remove
+`Surrogate-Control` and `Fastly-Surrogate-Control` before the body is streamed.
+
+This matches the existing per-user ad-stack cache policy. It prevents Fastly or
+another shared cache from replaying a tag-suppressed response to a visitor whose
+IP does not match an exclusion. Do not change cache headers for non-HTML,
+pass-through, or unmodified responses because their output does not vary by this
+feature.
+
+### 5. Suppress only the generated DataDome snippet
+
+At the start of `DataDomeIntegration::head_inserts()`:
+
+1. Check the request-scoped suppression marker.
+2. If present, return no DataDome head inserts.
+3. Otherwise preserve the current `inject_client_side_tag` and
+   `client_side_key` checks and emit the existing snippet unchanged.
+
+When suppression is active, omit both:
+
+```html
+<script>
+  window.ddjskey=...;window.ddoptions=...;
+</script>
+<script src="/integrations/datadome/tags.js" async></script>
+```
+
+Do not alter:
+
+- publisher-originated DataDome script tags;
+- `rewrite_sdk` behavior;
+- the DataDome SDK proxy route;
+- the signal collection API proxy;
+- DataDome configuration serialization for non-suppressed requests; or
+- injection behavior for requests without the marker.
+
+## Testing plan
+
+### Protection-filter tests
+
+Add or extend tests in
+`crates/trusted-server-core/src/integrations/datadome/protection.rs` to verify
+that the marker is attached for:
+
+- a matching inline IPv4 CIDR;
+- a matching Config Store-backed CIDR source;
+- a matching structured `ip_cidr` rule; and
+- a matching structured `ip_cidr_source` rule.
+
+Verify that the marker is absent for:
+
+- a non-matching IP;
+- an ASN exclusion;
+- a path exclusion;
+- a query-parameter exclusion;
+- an excluded method; and
+- an internal or integration route.
+
+Verify the existing protection behavior remains unchanged: IP-matched requests
+continue without a Protection API call.
+
+### Head-injector tests
+
+Add tests in
+`crates/trusted-server-core/src/integrations/datadome.rs` verifying that:
+
+- a configured client tag is omitted when suppression is active;
+- a configured client tag is emitted when suppression is inactive;
+- a blank client-side key remains a no-op; and
+- `inject_client_side_tag = false` remains a no-op.
+
+### HTML pipeline tests
+
+Add coverage for the request-scoped value flowing through the HTML processor,
+including the streaming path. Confirm that a suppressed processed HTML response
+contains neither the injected `window.ddjskey` configuration nor the configured
+DataDome `tags.js` script. For a suppressed HTML stream, assert the response is
+private and has no surrogate cache headers. Confirm a non-suppressed HTML stream
+retains its origin cache behavior.
+
+Confirm that publisher-originated DataDome tags remain in the output and are
+still rewritten according to the existing `rewrite_sdk` behavior.
+
+### Fastly dispatch tests
+
+Add a Fastly adapter dispatch test with:
+
+- DataDome protection enabled;
+- a client IP matching an inline exclusion;
+- a configured client-side key; and
+- an HTML publisher response.
+
+The test should verify that the request continues without a Protection API
+call, the response includes the `client_tag=omitted` decision log through the
+existing test logging seam where available, and the generated tag is absent.
+
+Also cover a non-excluded request to confirm the generated tag remains present.
+
+## Documentation changes
+
+Update `docs/guide/integrations/datadome.md` to state that IP-excluded Fastly
+requests skip both:
+
+- server-side Protection API validation; and
+- Trusted Server's automatic client-side tag injection.
+
+Document that this does not remove or disable publisher-originated DataDome
+tags, and that non-IP exclusions do not automatically suppress the client-side
+tag.
+
+No configuration template changes are required because this behavior has no
+new setting.
+
+## Files expected to change
+
+- `crates/trusted-server-core/src/integrations/registry.rs`
+  - Support the internal request-scoped annotation mechanism.
+- `crates/trusted-server-core/src/integrations/datadome.rs`
+  - Define the marker and conditionally suppress head injection.
+- `crates/trusted-server-core/src/integrations/datadome/protection.rs`
+  - Attach the marker for IP-based scope skips and enrich the skip log.
+- `crates/trusted-server-core/src/integrations/registry.rs` or the relevant
+  HTML context definition
+  - Carry the suppression decision into head injection.
+- `crates/trusted-server-core/src/html_processor.rs`
+  - Carry the request-scoped value into HTML integration context.
+- `crates/trusted-server-core/src/publisher.rs`
+  - Snapshot and propagate the request marker through response processing.
+- `docs/guide/integrations/datadome.md`
+  - Document the behavior.
+- Relevant unit and Fastly adapter test modules.
+
+The exact split between registry request annotations and HTML context plumbing
+should remain minimal and should not introduce a new public configuration API.
+
+## Verification
+
+Implementation verification should use the repository's target-matched
+commands:
+
+```bash
+cargo fmt --all -- --check
+cargo test-fastly
+cargo test-axum
+cargo test-cloudflare
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+```
+
+No live production validation is required for this implementation task. Live
+browser verification will be performed later through the deployment/testing
+workflow.
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 19ecda4a5..9bfcb9e4a 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -180,7 +180,19 @@ ja4_endpoint_enabled = false
 # in production.
 auction_html_comment = false
 
+# Expose GET /_ts/trace, which toggles the `ts-trace` cookie and redirects to /.
+# While the cookie is set, the TSJS overlay draws a floating panel summarising
+# every traced ad slot (render path, bidder, and GAM/injected/visible state)
+# plus a confirmation badge on each genuinely-rendered creative. It only
+# surfaces data already present on window.tsjs, so it leaks nothing new — but
+# it is off by default so the toggle route is not live on deployments that
+# never asked for it. Enable only for render-verification debugging.
+# trace_route_enabled = false
+
 [creative_opportunities]
+# Set to false to disable server-side ad templates while retaining slot definitions
+# and direct POST /auction callers.
+enabled = true
 gam_network_id = "123456789"
 # FCP is not affected by this value — body content above </body> has already
 # streamed and painted before the hold begins. What this caps is the slip on