diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4888c74ef..652bc3493 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,140 +1,61 @@
-# Contributing Guidelines
+# Contributing
 
-### Contents
+Trusted Server accepts focused code and documentation contributions. By
+submitting a contribution, you agree that it is licensed under the repository's
+Apache License 2.0.
 
-- [Submitting Pull Requests](#repeat-submitting-pull-requests)
-- [Writing Commit Messages](#memo-writing-commit-messages)
-- [Code Review](#white_check_mark-code-review)
-- [Coding Style](#nail_care-coding-style)
-- [Credits](#pray-credits)
+## Before implementation
 
-## :repeat: Submitting Pull Requests
+Search the issue tracker before opening a new issue. For a substantial change,
+describe the problem, intended behavior, affected adapters, and compatibility
+constraints before investing in an implementation. Do not place credentials or
+non-public vulnerability details in an issue; contact the maintainers privately
+before disclosure.
 
-We **love** pull requests! Before [forking the repo](https://help.github.com/en/github/getting-started-with-github/fork-a-repo) and [creating a pull request](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/proposing-changes-to-your-work-with-pull-requests) for non-trivial changes, it is usually best to first open an issue to discuss the changes, or discuss your intended approach for solving the problem in the comments for an existing issue.
+Read [CLAUDE.md](CLAUDE.md) for repository architecture, target constraints,
+coding conventions, error handling, documentation rules, and commit policy.
+The [project governance document](ProjectGovernance.md) defines decision and
+release responsibilities.
 
-For most contributions, after your first pull request is accepted and merged, you will be [invited to the project](https://help.github.com/en/github/setting-up-and-managing-your-github-user-account/inviting-collaborators-to-a-personal-repository) and given **push access**. :tada:
+## Make a focused change
 
-_Note: All contributions will be licensed under the project's license._
+- Keep one pull request centered on one coherent outcome.
+- Do not refactor or reformat unrelated code.
+- Add tests for new behavior and regression tests for defects.
+- Keep platform-specific dependencies out of `trusted-server-core`.
+- Use `error-stack` reports for production errors; the Spin entry-point FFI is
+  the sole documented `anyhow` exception.
+- Use fictional example data by default. A real public vendor endpoint requires
+  the exact reviewed exception described in `CLAUDE.md`.
+- Update the canonical guide or crate README when a user-visible contract
+  changes; do not copy volatile matrices into multiple documents.
 
-- **Smaller is better.** Submit **one** pull request per bug fix or feature. A pull request should contain isolated changes pertaining to a single bug fix or feature implementation. **Do not** refactor or reformat code that is unrelated to your change. It is better to **submit many small pull requests** rather than a single large one. Enormous pull requests will take enormous amounts of time to review, or may be rejected altogether.
+## Verify
 
-- **Coordinate bigger changes.** For large and non-trivial changes, open an issue to discuss a strategy with the maintainers. Otherwise, you risk doing a lot of work for nothing!
+Run the target-matched checks in [AGENTS.md](AGENTS.md#ci-gates), the
+canonical command surface for local and CI verification. [TESTING.md](TESTING.md)
+covers auction-orchestration testing specifically and repeats the adapter test
+aliases relevant to that runbook; it isn't a link index for other runbooks.
 
-- **Prioritize understanding over cleverness.** Write code clearly and concisely. Remember that source code usually gets written once and read often. Ensure the code is clear to the reader. The purpose and logic should be obvious to a reasonably skilled developer, otherwise you should add a comment that explains it.
+Keep a pull request in draft while required checks or known changes remain.
+Before requesting review, inspect the complete diff, resolve all failures, and
+state any platform path that could not be exercised.
 
-- **Follow existing coding style and conventions.** Keep your code consistent with the style, formatting, and conventions in the rest of the code base. When possible, these will be enforced with a linter. Consistency makes it easier to review and modify in the future.
+## Commits
 
-- **Include test coverage.** Add unit tests or UI tests when possible. Follow existing patterns for implementing tests.
+Write concise, imperative, sentence-case subjects without semantic prefixes or
+bracketed tags. Keep the subject at 50 characters when practical and do not end
+it with a period. Use a wrapped body when the reason, compatibility effect, or
+non-obvious tradeoff is not evident from the diff.
 
-- **Use the repo's default branch.** Branch from and [submit your pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request) to the repo's default branch. Usually this is `main`, but it could be `dev`, `develop`, or `master`.
+Examples:
 
-- **[Resolve any merge conflicts](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/resolving-a-merge-conflict-on-github)** that occur.
+- `Document Cloudflare startup configuration`
+- `Reject ambiguous integration route records`
 
-- **Keep PR in Draft** until ready for review. When it is ready, assign the PR to yourself and request at least one reviewer.
+## Review
 
-- **Promptly address any CI failures**. If your pull request fails to build or pass tests, please push another commit to fix it.
-
-- When writing comments, use properly constructed sentences, including punctuation.
-
-- Use spaces, not tabs.
-
-## :memo: Writing Commit Messages
-
-Please [write a great commit message](https://chris.beams.io/posts/git-commit/).
-
-1. Separate subject from body with a blank line
-1. Limit the subject line to 50 characters
-1. Use sentence case (capitalize the first word)
-1. Do not end the subject line with a period
-1. Use the imperative mood in the subject line (example: "Fix networking issue")
-1. Wrap the body at about 72 characters
-1. Use the body to explain **why**, _not what and how_ (the code shows that!)
-1. Do not use semantic prefixes or tags (examples: `fix:`, `feat:`, `[Docs]`)
-1. Keep PR state out of commit messages; use GitHub Draft PRs instead
-
-```
-Short summary of changes in 50 chars or less
-
-Add a more detailed explanation here, if necessary. Possibly give
-some background about the issue being fixed, etc. The body of the
-commit message can be several paragraphs. Further paragraphs come
-after blank lines and please do proper word-wrap.
-
-Wrap it to about 72 characters or so. In some contexts,
-the first line is treated as the subject of the commit and the
-rest of the text as the body. The blank line separating the summary
-from the body is critical (unless you omit the body entirely);
-various tools like `log`, `shortlog` and `rebase` can get confused
-if you run the two together.
-
-Explain the problem that this commit is solving. Focus on why you
-are making this change as opposed to how or what. The code explains
-how or what. Reviewers and your future self can read the patch,
-but might not understand why a particular solution was implemented.
-Are there side effects or other unintuitive consequences of this
-change? Here's the place to explain them.
-
- - Bullet points are okay, too
-
- - A hyphen or asterisk should be used for the bullet, preceded
-   by a single space, with blank lines in between
-
-Note the fixed or relevant GitHub issues at the end:
-
-Resolves: #123
-See also: #456, #789
-```
-
-## :white_check_mark: Code Review
-
-- **Review the code, not the author.** Look for and suggest improvements without disparaging or insulting the author. Provide actionable feedback and explain your reasoning.
-
-- **You are not your code.** When your code is critiqued, questioned, or constructively criticized, remember that you are not your code. Do not take code review personally.
-
-- **Always do your best.** No one writes bugs on purpose. Do your best, and learn from your mistakes.
-
-- Kindly note any violations to the guidelines specified in this document.
-
-- **Use CREG (Code Review Emoji Guide)** to give the reviewee added context and clarity to follow up on code review.
-
-### Emoji Legend
-
-|        |             `:code:`             | Meaning                                                                                                                                                                                                                                         |
-| :----: | :------------------------------: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 😃👍💯 |    `:smiley:` `:+1:` `:100:`     | I like this... <br /><br /> ...and I want the author to know it! This is a way to highlight positive parts of a code review.                                                                                                                    |
-|   🔧   |            `:wrench:`            | I think this needs to be changed. <br /><br />This is a concern or suggested change/refactor that I feel is worth addressing.                                                                                                                   |
-|   ❓   |           `:question:`           | I have a question. <br /><br /> This should be a fully formed question with sufficient information and context that requires a response.                                                                                                        |
-|  🤔💭  | `:thinking:` `:thought_balloon:` | Let me think out loud here for a minute. <br /><br /> I might express concern, suggest an alternative solution, or walk through the code in my own words to make sure I understand.                                                             |
-|   🌱   |           `:seedling:`           | Planting a seed for future. <br /><br /> An observation or suggestion that is not a change request, but may have larger implications. Generally something to keep in mind for the future.                                                       |
-|   📝   |             `:memo:`             | This is an explanatory note, fun fact, or relevant commentary that does not require any action.                                                                                                                                                 |
-|   ⛏    |             `:pick:`             | This is a nitpick. <br /><br /> This does not require any changes and is often better left unsaid. This may include stylistic, formatting, or organization suggestions and should likely be prevented/enforced by linting if they really matter |
-|   ♻️   |           `:recycle:`            | Suggestion for refactoring. <br /><br /> Should include enough context to be actionable and not be considered a nitpick.                                                                                                                        |
-|   🏕   |           `:camping:`            | Here is an opportunity, not directly related to your changes, for us to leave the campground [code] cleaner than we found it.                                                                                                                   |
-|   📌   |           `:pushpin:`            | This is a concern that is _out of scope_ and should be staged appropriately for follow up.                                                                                                                                                      |
-
-## :nail_care: Coding Style
-
-Consistency is the most important. Following the existing Rust style, formatting, and naming conventions of the file you are modifying and of the overall project. Failure to do so will result in a prolonged review process that has to focus on updating the superficial aspects of your code, rather than improving its functionality and performance.
-
-Style and format will be enforced with a linter when PR is created.
-
-## :warning: Error Handling
-
-We use [error-stack](https://docs.rs/error-stack/latest/error_stack/) for error handling to provide rich context and traceability.
-
-### Guidelines
-
-1. **Use `Report<E>`**: Public functions should generally return `Result<T, Report<TrustedServerError>>`.
-2. **Context**: Use `.change_context(TrustedServerError::Variant)` to wrap errors and provide semantic meaning.
-   ```rust
-   // Good
-   file.read_to_string(&mut content)
-       .change_context(TrustedServerError::Configuration { message: "Failed to read config".into() })?;
-   ```
-3. **Attachments**: Use `.attach_printable("additional info")` to add debugging context without changing the error variant.
-4. **Consistency**: Avoid returning bare `TrustedServerError` unless absolutely necessary (e.g. implementing traits). Wrap them in `Report::new()`.
-
-## :pray: Credits
-
-- https://github.com/jessesquires/.github/blob/main/CONTRIBUTING.md
-- https://github.com/erikthedeveloper/code-review-emoji-guide
+Review the change, not the author. Tie blocking feedback to a correctness,
+security, compatibility, maintainability, or documented-requirement concern.
+Mark optional improvements as non-blocking and move unrelated work to a
+separate issue.
diff --git a/crates/trusted-server-adapter-axum/README.md b/crates/trusted-server-adapter-axum/README.md
new file mode 100644
index 000000000..3e4863e14
--- /dev/null
+++ b/crates/trusted-server-adapter-axum/README.md
@@ -0,0 +1,25 @@
+# trusted-server-adapter-axum
+
+Native development adapter for Trusted Server. It runs the shared application
+through Axum on the host, without an edge simulator, and is not a production
+deployment target.
+
+The crate owns Axum route registration, middleware, outbound HTTP through
+`reqwest`, and environment-backed platform services. Its route surface follows
+the shared core contract, but request-time KV operations are unavailable and a
+startup error makes every route, including `/health`, return 500. Application
+configuration reaches the process through the documented environment bridge;
+the local EdgeZero config-store file is not read directly.
+
+Build and test from the repository root:
+
+```bash
+cargo build-axum
+cargo test-axum
+```
+
+Run the isolated first-success check with `./scripts/smoke-axum.sh`. See the
+[Axum development guide](../../docs/guide/axum-dev.md) for its config and
+secret handoff, negative cases, success oracle, and cleanup behavior. Shared
+runtime behavior belongs in
+[`trusted-server-core`](../trusted-server-core/README.md), not this adapter.
diff --git a/crates/trusted-server-adapter-cloudflare/README.md b/crates/trusted-server-adapter-cloudflare/README.md
new file mode 100644
index 000000000..208827e68
--- /dev/null
+++ b/crates/trusted-server-adapter-cloudflare/README.md
@@ -0,0 +1,25 @@
+# trusted-server-adapter-cloudflare
+
+Cloudflare Workers adapter for Trusted Server. Production code targets
+`wasm32-unknown-unknown` with the `cloudflare` feature; native builds exist for
+adapter tests and deliberately exclude the Workers entry point.
+
+The crate translates Worker requests and responses, registers the shared
+router, and implements Cloudflare-specific HTTP and secret access. The current
+runtime does not open the KV config value written by `ts config push`; startup
+instead consumes the nested `TRUSTED_SERVER_CONFIG` variable bridge. It also
+has no `/health` route or request-time KV registry and permits one enabled
+auction provider.
+
+Build and test from the repository root:
+
+```bash
+cargo build-cloudflare
+cargo test-cloudflare
+```
+
+Run `./scripts/smoke-cloudflare.sh` for the isolated Wrangler handoff check.
+The [Cloudflare deployment guide](../../docs/guide/cloudflare.md) documents the
+required double encoding, secret bindings, failure cases, and cleanup. Keep
+portable request behavior in
+[`trusted-server-core`](../trusted-server-core/README.md).
diff --git a/crates/trusted-server-adapter-fastly/README.md b/crates/trusted-server-adapter-fastly/README.md
new file mode 100644
index 000000000..24558148a
--- /dev/null
+++ b/crates/trusted-server-adapter-fastly/README.md
@@ -0,0 +1,25 @@
+# trusted-server-adapter-fastly
+
+Production Fastly Compute adapter for Trusted Server, targeting
+`wasm32-wasip1`.
+
+This crate owns the Fastly entry point, dynamic backend construction, edge
+cache behavior, config and secret-store access, EC KV operations, rate limits,
+streaming template assembly, and Fastly-only Tinybird auction emission. Its
+`/health` response is served before application construction, so liveness does
+not prove that configuration loaded. Platform-neutral routing, settings,
+auctions, integrations, and rewrites remain in `trusted-server-core`.
+
+Build and test from the repository root:
+
+```bash
+cargo build-fastly
+cargo test-fastly
+```
+
+The test alias uses Viceroy for the WASM target. Run
+`./scripts/smoke-fastly.sh` for the isolated config-store, secret-store, and
+publisher-response handoff. See the
+[Fastly deployment guide](../../docs/guide/fastly.md) for provisioning and
+runtime boundaries and [Auction Telemetry](../../docs/guide/telemetry.md) for
+the Fastly-only telemetry path.
diff --git a/crates/trusted-server-adapter-spin/README.md b/crates/trusted-server-adapter-spin/README.md
new file mode 100644
index 000000000..fe33c9055
--- /dev/null
+++ b/crates/trusted-server-adapter-spin/README.md
@@ -0,0 +1,23 @@
+# trusted-server-adapter-spin
+
+Experimental Fermyon Spin adapter for Trusted Server. The component targets
+`wasm32-wasip1` with the `spin` feature; native builds exercise route and
+platform tests.
+
+The crate maps Spin HTTP, variables, and the `default` key-value store into the
+shared runtime. Startup failures install a restricted 503 router that keeps
+`/health` live. The adapter permits one enabled auction provider. Request-time
+KV services beyond startup config loading remain unavailable. Its entry point
+uses `anyhow::Result` only because the EdgeZero Spin FFI requires that type.
+
+Build and test from the repository root:
+
+```bash
+cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
+cargo test-spin
+```
+
+Run `./scripts/smoke-spin.sh` for the isolated config, encoded-secret, failure,
+and publisher-response checks. See the
+[Spin deployment guide](../../docs/guide/spin.md) for the exact local-store
+mapping and operational limitations.
diff --git a/crates/trusted-server-cli/README.md b/crates/trusted-server-cli/README.md
new file mode 100644
index 000000000..443919b71
--- /dev/null
+++ b/crates/trusted-server-cli/README.md
@@ -0,0 +1,23 @@
+# trusted-server-cli
+
+Host-target operator CLI for Trusted Server. The installed binary is `ts`.
+
+The CLI validates and publishes application configuration through EdgeZero,
+delegates platform lifecycle commands, audits public pages and ad-template
+configuration, and builds external Prebid artifacts. It is not part of any
+adapter WASM artifact. Most commands support Linux and macOS; the production-
+hostname development proxy and local CA commands are macOS-only.
+
+Install and test from the repository root:
+
+```bash
+cargo install-cli
+./scripts/test-cli.sh
+```
+
+The test script selects and, when necessary, installs the host Rust target,
+runs the CLI suite, and executes the ignored browser-backed audit fixtures
+serially. See the [CLI guide](../../docs/guide/cli.md) for the generated
+two-platform command inventory and the
+[EdgeZero guide](../../docs/guide/edgezero.md) for configuration lifecycle and
+store semantics.
diff --git a/crates/trusted-server-core/README.md b/crates/trusted-server-core/README.md
index 69575b0d2..1d8c54ea9 100644
--- a/crates/trusted-server-core/README.md
+++ b/crates/trusted-server-core/README.md
@@ -1,59 +1,51 @@
 # trusted-server-core
 
-Utilities shared by Trusted Server components. This crate contains HTML/CSS rewriting helpers used to normalize ad creative assets to first‑party proxy endpoints.
-
-## Creative Rewriting
-
-The `creative` module rewrites external asset URLs in creative markup to a unified first‑party proxy so the publisher controls egress.
-
-Key rules:
-
-- Proxy absolute/protocol‑relative URLs (http/https or `//`) to `/first-party/proxy?tsurl=<base-url>&<original-query-params>&tstoken=<sig>`
-- Leave relative URLs unchanged (e.g., `/path`, `../path`, `local/file`)
-- Ignore non‑network schemes: `data:`, `javascript:`, `mailto:`, `tel:`, `blob:`, `about:`
-
-Rewritten locations:
-
-- `<img src>`, `data-src`, `[srcset]`, `[imagesrcset]`
-- `<script src>`
-- `<video src>`, `<audio src>`, `<source src>`
-- `<object data>`, `<embed src>`
-- `<input type="image" src>`
-- SVG: `<image href|xlink:href>`, `<use href|xlink:href>`
-- `<iframe src>`
-- `<link rel~="stylesheet|preload|prefetch" href>` and `imagesrcset`
-- Inline styles (`[style]`) and `<style>` blocks: `url(...)` values are rewritten
-
-Additional behavior:
-
-- Injects a lightweight client helper into creative HTML once per document to preserve first‑party click URLs even if runtime scripts mutate anchors:
-    - Injected at the top of `<body>`: `<script src="/static/tsjs=tsjs-creative.min.js" async></script>`
-    - The bundle guards anchor clicks by restoring the originally rewritten first‑party link at click time.
-    - Served through the unified endpoint described below.
-
-Helpers:
-
-- `rewrite_creative_html(settings, markup) -> String` — rewrite an HTML fragment
-- `rewrite_css_body(settings, css) -> Result<String, CssRewriteError>` — rewrite a CSS body (`url(...)` entries)
-- `rewrite_srcset(settings, srcset) -> String` — proxy absolute candidates; preserve descriptors (`1x`, `1.5x`, `100w`)
-- `split_srcset_candidates(srcset) -> Vec<&str>` — robust splitting for commas with/without spaces; avoids splitting the first `data:` mediatype comma
-
-JS bundles (served by publisher module):
-
-- Dynamic endpoint: `/static/tsjs=tsjs-unified.min.js?v=<hash>`
-    - At build time, embedded integrations are compiled as separate IIFEs (`tsjs-core.js`, `tsjs-creative.js`, etc.); Prebid is generated externally and served through `/integrations/prebid/bundle.js`.
-    - At runtime, the server concatenates `tsjs-core.js` + enabled integration modules based on `IntegrationRegistry` config
-    - The URL filename is fixed for backward compatibility; the `?v=` hash changes when modules change
-
-Behavior is covered by an extensive test suite in `crates/trusted-server-core/src/creative.rs`.
-
-## Edge Cookie (EC) Identifier Propagation
-
-- The `ec/` module owns the EC identity subsystem:
-    - `ec/generation.rs` — creates HMAC-based IDs using the client IP and publisher passphrase (format: `64hex.6alnum`).
-    - `ec/mod.rs` — `EcContext` struct with two-phase lifecycle (`read_from_request` + `generate_if_needed`), `get_ec_id` helper.
-    - `ec/consent.rs` — EC-specific consent gating wrapper.
-    - `ec/cookies.rs` — `Set-Cookie` header creation and expiration helpers.
-- `publisher.rs::handle_publisher_request` issues the `ts-ec` cookie when absent so the browser keeps the identifier on subsequent requests.
-- `proxy.rs::handle_first_party_proxy` replays the identifier to third-party creative origins by appending `ts-ec=<value>` to the reconstructed target URL, follows redirects (301/302/303/307/308) up to four hops, and keeps downstream fetches linked to the same user scope.
-- `proxy.rs::handle_first_party_click` adds `ts-ec=<value>` to outbound click redirect URLs so analytics endpoints can associate clicks with impressions without third-party cookies.
+Portable application core shared by every Trusted Server adapter. It targets
+both supported WASM environments and native adapter tests, so it must not depend
+on an edge SDK, Tokio runtime, filesystem, socket, or host-only process API.
+
+## Responsibilities
+
+- `settings` and `settings_data` define typed application configuration,
+  validation, secret references, and runtime normalization.
+- `platform` defines the HTTP, backend, store, geo, client-info, and telemetry
+  service boundary adapters implement.
+- `publisher`, `router`, `handlers`, and `response` dispatch publisher and
+  administrative requests through platform-neutral request/response types.
+- `auction` builds plans, invokes providers and mediators, selects bids, and
+  emits bounded telemetry events.
+- `integrations` registers explicit proxy, rewrite, injection, filter,
+  post-processing, provider, and browser-module capabilities.
+- `ec` owns edge-cookie generation, consent decisions, identity graph access,
+  and partner synchronization.
+- `html_processor`, `host_rewrite`, `streaming_processor`, and `rsc_flight`
+  transform eligible publisher responses without corrupting non-HTML or RSC
+  payloads.
+- `proxy`, `creative`, `image_optimizer`, and `asset_routes` implement bounded
+  first-party asset and creative handling.
+- `auth`, `request_signing`, `key_manager`, and `jwk` implement authentication
+  and signing contracts.
+- `cache_policy`, `template_cache`, and `template_assembly` define portable
+  cache and assembly decisions; adapters supply storage and streaming I/O.
+- `tsjs` selects embedded browser modules supplied by `trusted-server-js`.
+- `openrtb` connects auction logic to the checked OpenRTB data model.
+
+Adapter crates own runtime startup, SDK conversion, concrete storage, outbound
+transport, and target-specific limitations. Adding an integration should use
+the narrowest registration hook and the core-neutral `RuntimeServices`
+boundary; see the [Integration Guide](../../docs/guide/integration-guide.md).
+
+## Build and test
+
+From the repository root:
+
+```bash
+cargo build-fastly
+cargo test-fastly
+```
+
+The Fastly aliases compile and test the core for `wasm32-wasip1` through
+Viceroy. Cloudflare and native adapter suites exercise the same core under
+their target configurations. Use [TESTING.md](../../TESTING.md) for the complete
+target matrix and [Architecture](../../docs/guide/architecture.md) for the
+request-level system view.
diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e82cb8837..2d3981721 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -1,257 +1,40 @@
-# Integration Tests
+# trusted-server-integration-tests
 
-End-to-end tests that verify the trusted server against real frontend
-containers using [Testcontainers](https://testcontainers.com/) and
-[Playwright](https://playwright.dev/).
+Native test package for cross-adapter parity, documentation compilation, and
+end-to-end publisher behavior. It is not linked into an adapter artifact.
 
-## Prerequisites
+## Test surfaces
 
-- **Docker** — running and accessible
-- **Viceroy** — Fastly local simulator (`cargo install viceroy --version 0.17.0 --locked --force`)
-- **wasm32-wasip1 target** — `rustup target add wasm32-wasip1`
-- **Node.js** — version pinned in `.tool-versions`, for browser tests only
+- `tests/parity.rs` calls Axum, Cloudflare, and Spin routers in process and
+  compares their shared route behavior.
+- `tests/documentation_snippets.rs` extracts the checked integration-guide
+  fixture and compiles it in an isolated offline crate.
+- `tests/integration.rs` exercises the Fastly/Viceroy and Axum paths against the
+  WordPress and Next.js fixture containers.
+- `browser/` uses Playwright and Chromium to verify script loading, navigation,
+  rewriting, APS rendering, and GPT diagnostics in real pages.
 
-## Quick start
+The package uses the native host target. Fastly application artifacts are
+compiled separately for `wasm32-wasip1`; Docker, Viceroy, Node, and Chromium
+are required only by the end-to-end surfaces that invoke them.
 
-### HTTP-level tests
+## Run
 
-```bash
-./scripts/integration-tests.sh
-```
-
-This script handles everything:
-
-1. Builds the WASM binary
-2. Generates Viceroy configs from the readable `trusted-server.integration.toml`
-   fixture
-3. Builds the WordPress and Next.js Docker images
-4. Runs all integration tests sequentially
-
-### Browser tests
+From the repository root:
 
 ```bash
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test documentation_snippets
+./scripts/integration-tests.sh
 ./scripts/integration-tests-browser.sh
 ```
 
-This script:
-
-1. Builds the WASM binary and Docker images (same as above)
-2. Generates the Viceroy config consumed by Playwright global setup
-3. Installs Playwright and Chromium
-4. Runs browser tests for Next.js and WordPress sequentially
-
-### Run a single test
-
-```bash
-# HTTP-level
-./scripts/integration-tests.sh test_wordpress_fastly
-./scripts/integration-tests.sh test_nextjs_fastly
-
-# Browser — single framework after building WASM/images and generating configs
-cd crates/trusted-server-integration-tests/browser
-VICEROY_CONFIG_PATH=../../../target/integration-test-artifacts/configs/viceroy.toml \
-TEST_FRAMEWORK=nextjs npx playwright test
-VICEROY_CONFIG_PATH=../../../target/integration-test-artifacts/configs/viceroy.toml \
-TEST_FRAMEWORK=wordpress npx playwright test
-```
-
-### Verbose output
-
-```bash
-./scripts/integration-tests.sh --nocapture
-```
-
-## Docker images
-
-Two test images are built from fixtures in `fixtures/frameworks/`:
-
-| Image | Dockerfile | Description |
-|---|---|---|
-| `test-wordpress:latest` | `fixtures/frameworks/wordpress/Dockerfile` | PHP built-in server with a minimal test theme |
-| `test-nextjs:latest` | `fixtures/frameworks/nextjs/Dockerfile` | Next.js 14 standalone app with 4 pages, API routes, forms, shared navigation, and deferred scripts |
-
-Both images include test fixtures with absolute origin URLs (`ORIGIN_HOST` env
-var) so the trusted server's URL rewriting can be verified.
-
-### Build images manually
-
-```bash
-docker build -t test-wordpress:latest \
-  crates/trusted-server-integration-tests/fixtures/frameworks/wordpress/
-
-docker build \
-  --build-arg NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')" \
-  -t test-nextjs:latest \
-  crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/
-```
-
-## Generated Viceroy configs
-
-The source-controlled Viceroy template contains only local runtime resources such
-as KV stores, secret stores, and JWKS config. The Trusted Server application
-config is kept as readable TOML in
-`fixtures/configs/trusted-server.integration.toml` and converted into an
-EdgeZero `BlobEnvelope` at test setup time.
-
-Generate the post-cutover Viceroy config manually with:
-
-```bash
-ARTIFACTS_DIR=target/integration-test-artifacts \
-INTEGRATION_ORIGIN_PORT=8888 \
-./scripts/generate-integration-viceroy-configs.sh
-```
-
-Generated output:
-
-| File | Purpose |
-|---|---|
-| `target/integration-test-artifacts/configs/viceroy.toml` | Fastly integration, EC lifecycle, and browser tests |
-
-Set `VICEROY_CONFIG_PATH` to the generated file when invoking `cargo test` or
-Playwright directly.
-
-## Test scenarios
-
-### HTTP-level — standard (all frameworks)
-
-| Scenario | What it tests |
-|---|---|
-| `HtmlInjection` | Exactly one `<script id="trustedserver-js" src="/static/tsjs=...">` in proxied HTML |
-| `ScriptServing` | `/static/tsjs=tsjs-unified.min.js` returns JavaScript with bundle markers |
-| `AttributeRewriting` | `href`/`src` URLs with origin host are rewritten to proxy host (including inside ad slots) |
-| `ScriptServingUnknownFile404` | Unknown `/static/tsjs=...` paths return 404, not HTML fallback |
-
-### HTTP-level — Next.js custom
-
-| Scenario | What it tests |
-|---|---|
-| `NextJsRscFlight` | RSC Flight responses are not corrupted (no HTML, no script injection) |
-| `NextJsServerActions` | POST requests pass through proxy; unknown actions return 404/soft-404 |
-| `NextJsApiRoute` | API routes (`/api/hello`) return JSON without HTML injection |
-| `NextJsFormAction` | `<form action>` URLs rewritten from origin host to proxy host |
-
-### HTTP-level — WordPress custom
-
-| Scenario | What it tests |
-|---|---|
-| `WordPressAdminInjection` | `/wp-admin/` pages receive script injection (documents current behavior) |
-
-### Browser-level — shared (all frameworks)
-
-| Spec | What it tests |
-|---|---|
-| `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
-| `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
-| `aps-renderer` | Static route nonce gating, restrictive CSP, replay rejection, and opaque iframe/script isolation |
-
-### Browser-level — Next.js
-
-| Spec | What it tests |
-|---|---|
-| `navigation` | 4-page SPA navigation chain preserves injection without full reload, back button works, deferred route script executes after SPA transition |
-| `api-passthrough` | API routes return JSON without script injection (`/api/hello`, `/api/data`) |
-| `form-rewriting` | `<form action>` URL rewritten from origin to proxy on `/contact` page |
-| `gpt-diagnostics` | Inactive/active tab behavior, GPT lifecycle capture, conservative overlap handling, exact binding, remount, local export, and non-interference |
-
-### Browser-level — WordPress
-
-| Spec | What it tests |
-|---|---|
-| `admin-injection` | `/wp-admin/` has script tag in live DOM |
-
-## Architecture
-
-```
-tests/
-  integration.rs       # Test entry point — runs framework x runtime matrix
-  common/
-    assertions.rs      # HTML assertion helpers (script tag, attribute rewriting)
-    runtime.rs         # Error types, RuntimeEnvironment trait, env var helpers
-  environments/
-    mod.rs             # Runtime registry, port allocation, health checking
-    fastly.rs          # Viceroy-based Fastly Compute runtime
-  frameworks/
-    mod.rs             # Framework registry and FrontendFramework trait
-    scenarios.rs       # Standard and custom test scenarios
-    wordpress.rs       # WordPress container config
-    nextjs.rs          # Next.js container config
-browser/
-  playwright.config.ts # Playwright configuration (chromium, workers: 1)
-  global-setup.ts      # Starts Docker container + Viceroy before tests
-  global-teardown.ts   # Stops container + Viceroy after tests
-  helpers/
-    infra.ts           # Docker + Viceroy spawn/kill logic
-    wait-for-ready.ts  # Health check polling
-    state.ts           # Reads shared state file between setup/tests/teardown
-  tests/
-    shared/            # Tests that run for all frameworks
-    nextjs/            # Next.js-specific browser tests
-    wordpress/         # WordPress-specific browser tests
-fixtures/
-  configs/
-    trusted-server.integration.toml  # Readable Trusted Server app-config source
-    viceroy-template.toml            # Viceroy local_server template (KV stores, secrets)
-  frameworks/
-    wordpress/             # WordPress Docker image source
-    nextjs/                # Next.js Docker image source
-```
-
-### How it works
-
-1. A Docker container starts for the frontend framework, mapped to a fixed
-   origin port (default 8888)
-2. `scripts/generate-integration-viceroy-configs.sh` reads
-   `fixtures/configs/trusted-server.integration.toml`, wraps it in an EdgeZero
-   `BlobEnvelope`, and injects it into generated Viceroy configs under
-   `target/integration-test-artifacts/configs/`
-3. Viceroy spawns with the WASM binary and generated config on a random port
-4. **HTTP tests**: reqwest sends requests to Viceroy and asserts on responses
-5. **Browser tests**: Playwright opens Chromium pointing at Viceroy and verifies
-   script injection, bundle loading, and client-side navigation in a real browser
-
-### Why `--test-threads=1` / `workers: 1`
-
-All tests share the same fixed origin port (8888). The trusted server config is
-baked into the WASM binary at compile time with this port, so only one Docker
-container can be bound to it at a time.
-
-## CI
-
-Integration tests run in a separate workflow (`.github/workflows/integration-tests.yml`)
-triggered by:
-
-- Pull request opened, updated, or reopened
-- Manual dispatch
-
-Four jobs run in sequence then parallel:
-
-1. **prepare-artifacts** — builds the WASM binary, Docker images, and generated
-   legacy/EdgeZero Viceroy configs once
-2. **integration-tests** — HTTP-level tests (Rust + testcontainers), runs after `prepare-artifacts`
-3. **integration-tests-edgezero** — EC lifecycle smoke tests against the
-   generated EdgeZero Viceroy config
-4. **browser-tests** — Playwright tests (Node.js + Chromium), runs after `prepare-artifacts` in parallel with `integration-tests`
-
-They are **not** part of `cargo test --workspace` because the integration-tests
-crate requires a native target while the workspace default is `wasm32-wasip1`.
-
-## Dependency maintenance
-
-`crates/trusted-server-integration-tests` is a workspace member, so it shares
-`[workspace.dependencies]` and the single root `Cargo.lock` with the adapters it
-exercises. There is no separate lockfile or version-drift check to maintain:
-update a shared dependency once in the root `[workspace.dependencies]` (or in this
-crate's own `Cargo.toml` for integration-only dependencies) and the shared
-lockfile resolves it. The crate is native + Docker-based (testcontainers), so it
-is excluded from the wasm workspace aliases and run via `./scripts/integration-tests.sh`.
-
-## Known gaps
+The orchestration scripts build artifacts and Docker images and write generated
+Viceroy configuration under `target/integration-test-artifacts`. The browser
+script stops its matching test containers on exit; build products, images, npm
+dependencies, and generated configuration remain for reuse. Tests use an
+isolated readable app-config fixture and do not consume an operator's
+gitignored `trusted-server.toml`.
 
-- **GDPR consent propagation** — the consent field exists in `AuctionRequest`
-  but is not yet populated or forwarded. Requires implementation first.
-- **Next.js integration features** — the WASM binary is built without
-  `integrations.nextjs` enabled, so Next.js-specific rewriters/post-processors
-  are not exercised. RSC Flight/Server Actions tests are compatibility smoke
-  tests only.
-- **GTM integration** — not enabled in test config. Has unit coverage in
-  `google_tag_manager.rs`.
+See [Testing](../../TESTING.md) for the complete gate matrix and
+[`scripts/README.md`](../../scripts/README.md) for inputs and cleanup behavior.
diff --git a/crates/trusted-server-integration-tests/tests/documentation_snippets.rs b/crates/trusted-server-integration-tests/tests/documentation_snippets.rs
new file mode 100644
index 000000000..d9c36d233
--- /dev/null
+++ b/crates/trusted-server-integration-tests/tests/documentation_snippets.rs
@@ -0,0 +1,83 @@
+use std::fs;
+use std::process::Command;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+const GUIDE: &str = include_str!("../../../docs/guide/integration-guide.md");
+const START: &str = "<!-- documentation-snippet:runtime-services:start -->";
+const END: &str = "<!-- documentation-snippet:runtime-services:end -->";
+
+#[test]
+fn integration_guide_runtime_services_fixture_compiles() {
+    let marked = GUIDE
+        .split_once(START)
+        .and_then(|(_, tail)| tail.split_once(END).map(|(body, _)| body))
+        .expect("should contain one bounded runtime-services snippet");
+    let source = marked
+        .trim()
+        .strip_prefix("```rust\n")
+        .and_then(|body| body.strip_suffix("\n```"))
+        .expect("should contain exactly one Rust fence inside the snippet markers");
+
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("should have a current system clock")
+        .as_nanos();
+    let fixture_root = std::env::temp_dir().join(format!(
+        "trusted-server-documentation-snippet-{}-{nonce}",
+        std::process::id()
+    ));
+    let source_dir = fixture_root.join("src");
+    fs::create_dir_all(&source_dir).expect("should create isolated fixture directory");
+
+    let repository_root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(std::path::Path::parent)
+        .expect("should resolve repository root")
+        .canonicalize()
+        .expect("should canonicalize repository root");
+    let core_path = repository_root.join("crates/trusted-server-core");
+    let workspace_manifest = fs::read_to_string(repository_root.join("Cargo.toml"))
+        .expect("should read the workspace manifest");
+    let error_stack_requirement = workspace_manifest
+        .lines()
+        .find_map(|line| {
+            let assignment = line.trim().strip_prefix("error-stack")?.trim_start();
+            let value = assignment.strip_prefix('=')?;
+            let start = value.find('"')? + 1;
+            let end = start + value[start..].find('"')?;
+            Some(value[start..end].to_owned())
+        })
+        .expect("should find the workspace error-stack requirement");
+    let manifest = format!(
+        "[package]\nname = \"documentation-snippet\"\nversion = \"0.0.0\"\nedition = \"2024\"\n\n[workspace]\n\n[dependencies]\nerror-stack = \"{error_stack_requirement}\"\ntrusted-server-core = {{ path = {:?} }}\n",
+        core_path
+    );
+    fs::write(fixture_root.join("Cargo.toml"), manifest)
+        .expect("should write isolated fixture manifest");
+    fs::copy(
+        repository_root.join("Cargo.lock"),
+        fixture_root.join("Cargo.lock"),
+    )
+    .expect("should seed the fixture with the repository dependency resolution");
+    fs::write(source_dir.join("lib.rs"), source).expect("should write exact documented source");
+
+    let output = Command::new("cargo")
+        .args(["check", "--offline", "--quiet"])
+        .current_dir(&fixture_root)
+        // The target directory is shared across runs for dependency-cache
+        // reuse; cargo's own build-directory lock serializes concurrent runs.
+        .env(
+            "CARGO_TARGET_DIR",
+            repository_root.join("target/documentation-snippets"),
+        )
+        .output()
+        .expect("should execute cargo check for documented source");
+    fs::remove_dir_all(&fixture_root).expect("should remove isolated fixture directory");
+
+    assert!(
+        output.status.success(),
+        "documented integration fixture must compile:\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
diff --git a/crates/trusted-server-js/README.md b/crates/trusted-server-js/README.md
new file mode 100644
index 000000000..7b83072fa
--- /dev/null
+++ b/crates/trusted-server-js/README.md
@@ -0,0 +1,25 @@
+# trusted-server-js
+
+Rust wrapper and TypeScript build for Trusted Server's browser runtime.
+
+The build script discovers the checked TypeScript entries, invokes the Node
+build, and embeds the resulting IIFE bundles in Rust. The Rust API returns
+individual bundles, deterministic concatenations, and content hashes used by
+adapter responses. Browser behavior lives under `lib/src`; generated `dist`
+files are build outputs, not edited sources. The external Prebid.js artifact is
+built separately and is not the deferred Trusted Server Prebid shim.
+
+Run the JavaScript checks from `crates/trusted-server-js/lib`:
+
+```bash
+npm ci
+npm run lint
+npx vitest run
+npm run format
+npm run build
+```
+
+Rust target checks include this crate through `cargo test-fastly`. See
+[Trusted Server JavaScript](../../docs/guide/tsjs.md) for the 12 integration
+entries, 13 emitted bundles, and immediate, deferred, and standalone loading
+modes.
diff --git a/crates/trusted-server-openrtb-codegen/README.md b/crates/trusted-server-openrtb-codegen/README.md
new file mode 100644
index 000000000..18a4a14ed
--- /dev/null
+++ b/crates/trusted-server-openrtb-codegen/README.md
@@ -0,0 +1,21 @@
+# trusted-server-openrtb-codegen
+
+Host-only maintenance tool that regenerates Trusted Server's checked-in
+OpenRTB Rust model from the local protobuf schema.
+
+The generator requires `protoc`. It compiles
+`trusted-server-openrtb/proto/openrtb.proto`, removes protobuf-only derives and
+attributes, adds the repository's serde conventions, and replaces
+`trusted-server-openrtb/src/generated.rs`. Ordinary application builds do not
+run this package and do not require `protoc`.
+
+Use the owning wrapper from the repository root:
+
+```bash
+./crates/trusted-server-openrtb/generate.sh
+cargo test --package trusted-server-openrtb-codegen --target "$(rustc -vV | sed -n 's/host: //p')"
+```
+
+Review the complete generated diff before committing it. The
+[`trusted-server-openrtb` README](../trusted-server-openrtb/README.md) describes
+the schema adaptations and public model boundary.
diff --git a/crates/trusted-server-openrtb/README.md b/crates/trusted-server-openrtb/README.md
index 3eeac2534..3940a6fde 100644
--- a/crates/trusted-server-openrtb/README.md
+++ b/crates/trusted-server-openrtb/README.md
@@ -1,43 +1,30 @@
 # trusted-server-openrtb
 
-OpenRTB 2.6 data model generated from the [IAB Tech Lab protobuf schema](https://github.com/nicoboss/openrtb/blob/master/proto/openrtb.proto). Types are used exclusively with JSON serde — protobuf binary encoding is stripped during code generation.
+Portable Rust representation of the OpenRTB 2.6 JSON model used by Trusted
+Server auctions. The generated types are ordinary serde values; protobuf binary
+encoding is deliberately absent.
 
-## How types are generated
+`src/generated.rs` is checked in, so normal builds on native,
+`wasm32-wasip1`, and `wasm32-unknown-unknown` do not require `protoc` or execute
+code generation. All generated model types are re-exported at the crate root.
+The hand-written API also provides `bool_as_int` for OpenRTB's integer boolean
+encoding and `ToExt` for converting selected extension values into omit-when-
+empty JSON maps.
 
-Generated code is checked into `src/generated.rs` so the crate has **no build-time dependency on `protoc`**. To regenerate after proto changes, run the wrapper script (it builds and runs the separate `trusted-server-openrtb-codegen` package and writes `src/generated.rs`):
+## Regenerate
 
-```sh
-./crates/trusted-server-openrtb/generate.sh
-```
-
-The `generate.sh` / `trusted-server-openrtb-codegen` pipeline has three phases:
-
-1. **Proto compilation** — `prost-build` compiles `proto/openrtb.proto` into Rust structs.
-2. **Strip protobuf concerns** — `prost::Message` derives and `#[prost(...)]` attributes are removed since we only use JSON encoding.
-3. **Add serde + OpenRTB support** — `Serialize`/`Deserialize` derives are injected along with `skip_serializing_if` for `Option` and `Vec` fields. Extensible structs receive an `ext: Option<Map<String, Value>>` field, and `Option<bool>` fields get the `bool_as_int` serde adapter for the OpenRTB `0`/`1` convention.
-
-### Proto modifications from upstream
-
-The IAB proto uses `edition = "2023"` which generates non-optional scalars. The local copy converts to `proto2` with explicit `optional` on every field so prost generates `Option<T>`, matching OpenRTB's "omit if not set" semantics. `Ext` messages are removed from the proto and re-injected by the codegen postprocessor as `Option<serde_json::Map>`. See the header comment in `proto/openrtb.proto` for the full list of changes.
-
-## Crate API
+The local protobuf source uses `proto2` and explicit optional fields so the
+generated Rust model preserves OpenRTB omission semantics. The generator then
+removes `prost::Message` concerns, adds serde derives and skip rules, and
+injects extension maps.
 
-All generated types are re-exported at the crate root for flat access:
+From the repository root, with `protoc` installed:
 
-```rust
-use trusted_server_openrtb::{BidRequest, BidResponse, Imp, Banner, Device, User};
+```bash
+./crates/trusted-server-openrtb/generate.sh
 ```
 
-### `bool_as_int`
-
-Serde helper module that transparently converts `Option<bool>` to/from `0`/`1` integers on the wire. Applied automatically to generated boolean fields.
-
-### `ToExt`
-
-Trait for converting a `Serialize` type into an `Option<Map<String, Value>>` suitable for an `ext` field. Returns `None` for empty maps so `ext` is omitted from JSON output rather than serialized as `"ext": {}`. Only implemented on specific ext structs (not a blanket impl).
-
-```rust
-use trusted_server_openrtb::ToExt;
-
-let ext_value = my_custom_ext.to_ext(); // Option<Map<String, Value>>
-```
+Review `proto/openrtb.proto`, `src/generated.rs`, and the generator changes as
+one unit. Run the shared target suite with `cargo test-fastly`; run the host-only
+generator tests with the command in the
+[`trusted-server-openrtb-codegen` README](../trusted-server-openrtb-codegen/README.md).
diff --git a/docs/.gitignore b/docs/.gitignore
index 57a09c39d..097c22936 100644
--- a/docs/.gitignore
+++ b/docs/.gitignore
@@ -1,3 +1,4 @@
 node_modules
 .vitepress/dist
 .vitepress/cache
+.vitepress/.temp
diff --git a/docs/.prettierignore b/docs/.prettierignore
index 94aa6e0c8..33bcca85c 100644
--- a/docs/.prettierignore
+++ b/docs/.prettierignore
@@ -1,3 +1,4 @@
 .vitepress/cache
 .vitepress/dist
+.vitepress/.temp
 node_modules
diff --git a/docs/.vitepress/config.mts b/docs/.vitepress/config.mts
index 498e2e37a..422085179 100644
--- a/docs/.vitepress/config.mts
+++ b/docs/.vitepress/config.mts
@@ -5,8 +5,12 @@ import { resolve, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
+const buildSha = process.env.GITHUB_SHA?.trim()
+
+if (buildSha && !/^[0-9a-f]{40}$/.test(buildSha)) {
+  throw new Error('GITHUB_SHA must be a lowercase 40-character commit SHA')
+}
 
-// Parse .tool-versions file to extract version numbers
 function getToolVersions(): Record<string, string> {
   const toolVersionsPath = resolve(__dirname, '../../.tool-versions')
   const versions: Record<string, string> = {}
@@ -22,24 +26,37 @@ function getToolVersions(): Record<string, string> {
         }
       }
     }
-  } catch (e) {
-    console.warn('Could not read .tool-versions file:', e)
+  } catch (error) {
+    console.warn('Could not read .tool-versions file:', error)
   }
 
   return versions
 }
 
+function provenanceBanner(): string {
+  const source = buildSha
+    ? `Built from commit \`${buildSha}\`.`
+    : 'Built from a local checkout; no immutable commit SHA was supplied.'
+  return `::: info Rolling main documentation\n${source} Content may describe unreleased behavior.\n:::`
+}
+
 const toolVersions = getToolVersions()
 
-// https://vitepress.dev/reference/site-config
 export default withMermaid(
   defineConfig({
     title: 'Trusted Server',
     description:
       'Edge computing for ad serving, consent signal handling, and edge cookie (EC) generation',
     base: '/trusted-server',
+    lastUpdated: true,
+    srcExclude: [
+      'superpowers/**',
+      'internal/**',
+      'epics/**',
+      'README.md',
+      'business-use-cases.md',
+    ],
 
-    // Replace version placeholders like {{NODEJS_VERSION}} with values from .tool-versions
     markdown: {
       config: (md) => {
         const originalParse = md.parse.bind(md)
@@ -49,20 +66,20 @@ export default withMermaid(
             const placeholder = `{{${tool.toUpperCase()}_VERSION}}`
             processed = processed.replaceAll(placeholder, version)
           }
-          return originalParse(processed, env)
+          return originalParse(`${provenanceBanner()}\n\n${processed}`, env)
         }
       },
     },
 
     themeConfig: {
-      // https://vitepress.dev/reference/default-theme-config
+      search: {
+        provider: 'local',
+      },
       nav: [
         { text: 'Home', link: '/' },
-        { text: 'Guide', link: '/guide/getting-started' },
-        { text: 'Business Value', link: '/business-use-cases' },
+        { text: 'Guide', link: '/guide/' },
         { text: 'Roadmap', link: '/roadmap' },
       ],
-
       sidebar: [
         {
           text: 'Introduction',
@@ -72,13 +89,28 @@ export default withMermaid(
               link: '/guide/what-is-trusted-server',
             },
             { text: 'Getting Started', link: '/guide/getting-started' },
+            {
+              text: 'Onboarding',
+              link: '/guide/onboarding',
+            },
+          ],
+        },
+        {
+          text: 'Operator',
+          items: [
+            { text: 'EdgeZero Lifecycle', link: '/guide/edgezero' },
+            { text: 'Configuration', link: '/guide/configuration' },
+            { text: 'CLI', link: '/guide/cli' },
+            { text: 'Dev Proxy', link: '/guide/ts-dev-proxy' },
+            { text: 'Testing', link: '/guide/testing' },
+            { text: 'Auction Testing', link: '/guide/auction-testing' },
           ],
         },
         {
-          text: 'Core Concepts',
+          text: 'Product',
           items: [
             { text: 'Edge Cookies', link: '/guide/edge-cookies' },
-            { text: 'EC Setup Guide', link: '/guide/ec-setup-guide' },
+            { text: 'EC Setup', link: '/guide/ec-setup-guide' },
             { text: 'GDPR Compliance', link: '/guide/gdpr-compliance' },
             { text: 'Ad Serving', link: '/guide/ad-serving' },
             {
@@ -88,124 +120,84 @@ export default withMermaid(
             { text: 'First-Party Proxy', link: '/guide/first-party-proxy' },
             { text: 'Asset Routes', link: '/guide/asset-routes' },
             { text: 'Creative Processing', link: '/guide/creative-processing' },
+            { text: 'Trusted Server JavaScript', link: '/guide/tsjs' },
+            { text: 'Auction Telemetry', link: '/guide/telemetry' },
+            { text: 'RSC Hydration', link: '/guide/rsc-hydration' },
             {
-              text: 'Integrations Overview',
-              link: '/guide/integrations-overview',
+              text: 'Edge Cookie External Sync',
+              link: '/guide/collective-sync',
             },
-          ],
-        },
-        {
-          text: 'Security',
-          items: [
             { text: 'Request Signing', link: '/guide/request-signing' },
             { text: 'Key Rotation', link: '/guide/key-rotation' },
+            { text: 'Proxy Signing', link: '/guide/proxy-signing' },
           ],
         },
         {
-          text: 'Development',
+          text: 'Deployment',
           items: [
-            { text: 'Architecture', link: '/guide/architecture' },
-            { text: 'Configuration', link: '/guide/configuration' },
-            { text: 'CLI', link: '/guide/cli' },
-            { text: 'Testing', link: '/guide/testing' },
-            { text: 'Integration Guide', link: '/guide/integration-guide' },
-            { text: 'Dev Proxy', link: '/guide/ts-dev-proxy' },
+            { text: 'Fastly', link: '/guide/fastly' },
+            { text: 'Axum Development', link: '/guide/axum-dev' },
+            { text: 'Cloudflare Workers', link: '/guide/cloudflare' },
+            { text: 'Fermyon Spin', link: '/guide/spin' },
           ],
         },
         {
-          text: 'Advanced',
+          text: 'Integrations',
           items: [
-            { text: 'RSC Hydration', link: '/guide/rsc-hydration' },
             {
-              text: 'Proxy Signing',
-              link: '/guide/proxy-signing',
+              text: 'Integration Inventory',
+              link: '/guide/integrations-overview',
             },
+            { text: 'Development Guide', link: '/guide/integration-guide' },
             {
-              text: 'Edge Cookie External Sync',
-              link: '/guide/collective-sync',
+              text: 'Ad Server Mock',
+              link: '/guide/integrations/adserver_mock',
+            },
+            { text: 'APS', link: '/guide/integrations/aps' },
+            { text: 'DataDome', link: '/guide/integrations/datadome' },
+            { text: 'Didomi', link: '/guide/integrations/didomi' },
+            {
+              text: 'Google Tag Manager',
+              link: '/guide/integrations/google_tag_manager',
+            },
+            { text: 'GPT', link: '/guide/integrations/gpt' },
+            {
+              text: 'GPT Runtime Diagnostics',
+              link: '/guide/integrations/gpt-diagnostics',
             },
+            { text: 'Lockr', link: '/guide/integrations/lockr' },
+            { text: 'Next.js', link: '/guide/integrations/nextjs' },
+            { text: 'Osano', link: '/guide/integrations/osano' },
+            { text: 'Permutive', link: '/guide/integrations/permutive' },
+            { text: 'Prebid', link: '/guide/integrations/prebid' },
+            { text: 'Sourcepoint', link: '/guide/integrations/sourcepoint' },
+            { text: 'Testlight', link: '/guide/integrations/testlight' },
           ],
         },
         {
           text: 'Reference',
           items: [
+            { text: 'Architecture', link: '/guide/architecture' },
             { text: 'API Reference', link: '/guide/api-reference' },
             { text: 'Error Reference', link: '/guide/error-reference' },
           ],
         },
-        {
-          text: 'Partner Integrations',
-          items: [
-            {
-              text: 'Identity',
-              items: [{ text: 'Lockr', link: '/guide/integrations/lockr' }],
-            },
-            {
-              text: 'CMP',
-              items: [
-                { text: 'Didomi', link: '/guide/integrations/didomi' },
-                { text: 'Osano', link: '/guide/integrations/osano' },
-              ],
-            },
-            {
-              text: 'Data',
-              items: [
-                { text: 'Permutive', link: '/guide/integrations/permutive' },
-              ],
-            },
-            {
-              text: 'Ad Serving',
-              items: [
-                { text: 'GAM', link: '/guide/integrations/gam' },
-                {
-                  text: 'GPT Runtime Diagnostics',
-                  link: '/guide/integrations/gpt-diagnostics',
-                },
-              ],
-            },
-            {
-              text: 'Demand Wrapper',
-              items: [
-                { text: 'Prebid', link: '/guide/integrations/prebid' },
-                { text: 'APS', link: '/guide/integrations/aps' },
-              ],
-            },
-            {
-              text: 'SSP',
-              items: [{ text: 'Kargo', link: '/guide/integrations/kargo' }],
-            },
-            {
-              text: 'Framework Support',
-              items: [{ text: 'Next.js', link: '/guide/integrations/nextjs' }],
-            },
-            {
-              text: 'Security',
-              items: [
-                { text: 'DataDome', link: '/guide/integrations/datadome' },
-              ],
-            },
-          ],
-        },
       ],
-
       socialLinks: [
         {
           icon: 'github',
           link: 'https://github.com/IABTechLab/trusted-server',
         },
       ],
-
       footer: {
         message: 'Released under the Apache License 2.0.',
         copyright: 'Copyright © 2018-present IAB Technology Laboratory',
       },
     },
-    // Mermaid configuration
     mermaid: {
       flowchart: {
         useMaxWidth: true,
       },
-      // https://mermaid.js.org/config/setup/modules/mermaidAPI.html#mermaidapi-configuration-defaults
     },
     mermaidPlugin: {
       class: 'mermaid',
diff --git a/docs/README.md b/docs/README.md
index 072ab9db5..588925287 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -41,13 +41,20 @@ The documentation is automatically deployed to GitHub Pages when changes are pus
 
 ### Custom Domain Setup
 
-1. **Update CNAME file**: Edit `docs/public/CNAME` with your domain:
+The current deployment is a GitHub Pages project site with VitePress `base` set
+to `/trusted-server`. It is not configured for a custom domain.
 
-   ```
-   docs.yourdomain.com
-   ```
+Before enabling a custom domain:
+
+1. **Change and verify the site base**: Set VitePress `base` to `/` (or remove
+   it to use that default), build the site, and verify asset and navigation
+   URLs. Review this change together with the domain configuration.
+
+2. **Set the custom domain**: In repository **Settings** → **Pages**, enter the
+   verified domain. This repository intentionally tracks no
+   `docs/public/CNAME` file; do not add one.
 
-2. **Configure DNS**: Add DNS records at your domain provider:
+3. **Configure DNS**: Add DNS records at your domain provider:
 
    **Option A - CNAME Record** (recommended for subdomains):
 
@@ -68,7 +75,7 @@ The documentation is automatically deployed to GitHub Pages when changes are pus
    Value: 185.199.111.153
    ```
 
-3. **Verify in GitHub**:
+4. **Verify in GitHub**:
    - Go to **Settings** → **Pages**
    - Enter your custom domain
    - Wait for DNS check to pass
@@ -78,7 +85,8 @@ The documentation is automatically deployed to GitHub Pages when changes are pus
 
 **Trigger**:
 
-- Push to `main` branch (only when `docs/**` changes)
+- Push to `main` when `docs/**`, `.tool-versions`, or the deployment workflow
+  changes
 - Manual trigger via Actions tab
 
 **Build Process**:
@@ -116,26 +124,26 @@ The documentation is automatically deployed to GitHub Pages when changes are pus
 
 **Check**:
 
-- DNS records propagated (use `dig docs.yourdomain.com`)
-- CNAME file exists in `docs/public/CNAME`
-- Custom domain verified in GitHub Pages settings
+- DNS records propagated (use `dig docs.example.com`)
+- Custom domain configured and verified in GitHub Pages settings
 - HTTPS enforced (may take up to 24 hours)
 
 **DNS Verification**:
 
 ```bash
 # Check CNAME record
-dig docs.yourdomain.com CNAME
+dig docs.example.com CNAME
 
 # Check A records (for apex domain)
-dig yourdomain.com A
+dig example.com A
 ```
 
 ### 404 Errors
 
 **Check**:
 
-- VitePress `base` config (should not be set for custom domains)
+- VitePress `base` is `/trusted-server` for the project site or `/` for a
+  verified custom-domain deployment
 - Links use correct paths (start with `/`)
 - Build output in `docs/.vitepress/dist` is correct
 
@@ -151,7 +159,6 @@ docs/
 │   ├── configuration.md
 │   └── ...
 ├── public/                 # Static assets
-│   └── CNAME              # Custom domain file
 ├── index.md               # Homepage
 ├── package.json           # Dependencies
 └── README.md             # This file
@@ -169,6 +176,6 @@ When adding new documentation:
 
 ## Links
 
-- **Production**: (Configure your custom domain)
+- **Deployment**: GitHub Pages project site under `/trusted-server/`
 - **GitHub Repo**: https://github.com/IABTechLab/trusted-server
 - **VitePress Docs**: https://vitepress.dev
diff --git a/docs/business-use-cases.md b/docs/business-use-cases.md
index 4e78a2e51..50fdcf82c 100644
--- a/docs/business-use-cases.md
+++ b/docs/business-use-cases.md
@@ -1,5 +1,11 @@
 # Business Use Cases
 
+> [!CAUTION]
+> **Unverified planning material.** The claims, metrics, projections, and
+> capabilities in this document have not been validated against the current
+> implementation. Do not treat them as shipped behavior or product
+> commitments.
+
 Scenarios where publishers can realize measurable value with Trusted
 Server across revenue, consent handling, performance, and user
 experience.
diff --git a/docs/eslint.config.js b/docs/eslint.config.js
index a4a3c0f2b..aaf8757dc 100644
--- a/docs/eslint.config.js
+++ b/docs/eslint.config.js
@@ -3,7 +3,12 @@ import tseslint from 'typescript-eslint'
 
 export default [
   {
-    ignores: ['.vitepress/cache/**', '.vitepress/dist/**', 'node_modules/**'],
+    ignores: [
+      '.vitepress/cache/**',
+      '.vitepress/dist/**',
+      '.vitepress/.temp/**',
+      'node_modules/**',
+    ],
   },
   js.configs.recommended,
   ...tseslint.configs.recommended,
diff --git a/docs/guide/ad-serving.md b/docs/guide/ad-serving.md
index 9486821f5..171764bc1 100644
--- a/docs/guide/ad-serving.md
+++ b/docs/guide/ad-serving.md
@@ -1,121 +1,75 @@
 # Ad Serving
 
-Learn how Trusted Server handles consent-aware ad serving.
+Trusted Server supports two shipped ad-delivery paths: a direct server-side
+auction API and publisher-page processing at the edge. Both paths use the same
+validated settings and compiled auction plan.
 
-## Overview
+## Request flow
 
-Trusted Server provides edge-based ad serving with consent signal enforcement and real-time bidding support.
+For ordinary publisher requests, the selected adapter fetches the configured
+publisher origin. Eligible HTML responses pass through the shared processing
+pipeline, which can rewrite first-party URLs, inject Trusted Server JavaScript,
+and place configured ad opportunities. Non-HTML responses remain on the
+publisher proxy path.
 
-## Supported Integrations
+`POST /auction` accepts the documented auction request shape. When
+`[auction].enabled = true`, the compiled `AuctionPlan` selects configured
+providers, routes bidder codes, executes supported provider fan-out, applies an
+optional mediator, and returns the winning bids. When auctions are disabled,
+the endpoint returns a no-bid response without contacting a provider.
 
-### Equativ
+## Shipped demand and mediation
 
-Primary ad server integration with support for:
+Provider instances are declared under `[auction.providers.<id>]`. The shipped
+profiles are:
 
-- Direct ad requests
-- Creative proxying
-- Click tracking
-- Impression tracking
+- `standard` for a generic OpenRTB 2.6 endpoint;
+- `prebid-server` for Prebid Server request controls; and
+- `aps` for the APS OpenRTB contract and typed renderer response.
 
-### Prebid
-
-Real-time bidding integration:
-
-- Header bidding support
-- Bid caching
-- Timeout management
-- Winner selection
-
-## Ad Request Flow
-
-1. Request validation
-2. Consent signal check
-3. EC ID generation (when the consent evaluation permits)
-4. Ad server request
-5. Response processing
-6. Creative delivery
-
-## Configuration
-
-Configure ad servers in `trusted-server.toml`:
+Browser-visible bidder codes are mapped separately under
+`[auction.bidders.<id>]`. `adserver_mock` is the only registered mediator; it
+is optional and is configured under `[integrations.adserver_mock]`.
 
 ```toml
-[ad_servers.equativ]
-endpoint = "https://ad-server.example.com"
-timeout_ms = 1000
+[auction]
 enabled = true
 
-[prebid]
-timeout_ms = 1500
-cache_ttl = 300
-```
-
-## Creative Handling
-
-### Proxy Mode
-
-Creatives can be proxied through Trusted Server for:
-
-- Security scanning
-- Content modification
-- Click tracking injection
-- Consent signal enforcement
+[auction.providers.pbs-main]
+protocol = "openrtb-2.6"
+profile = "prebid-server"
+endpoint = "https://prebid.example.com/openrtb2/auction"
+routing = "explicit"
 
-### Direct Mode
-
-Creatives served directly from ad server:
-
-- Lower latency
-- Reduced edge load
-- Less control over content
-
-## Tracking
-
-### Impression Tracking
-
-```javascript
-// Placeholder example
-trustedServer.trackImpression({
-  adId: 'ad-123',
-  ecId: 'ec-xyz',
-  consent: true,
-})
+[auction.bidders.example-bidder]
+provider = "pbs-main"
 ```
 
-### Click Tracking
-
-Click tracking via first-party context:
-
-- URLs carry no name, email, or account identifier fields supplied by the user
-- EC ID when issued under the consent gate
-- Encrypted parameters
-
-## Performance
-
-### Edge Caching
-
-- Bid responses cached at edge
-- Creative assets cached
-- Configuration cached
-- Reduced origin requests
-
-### Timeouts
+Deploy validation compiles this configuration before publication. Adapter
+startup adds target-specific provider-count and backend-name checks; see
+[Auction orchestration](/guide/auction-orchestration) for the complete schema
+and adapter limits.
 
-Configurable timeouts for:
+## Creative delivery
 
-- Ad server requests
-- Prebid auctions
-- Creative fetching
+Winning OpenRTB markup can be rewritten through the first-party proxy and can
+be sanitized when the corresponding auction settings are enabled. The default
+is rewriting enabled and sanitization disabled. APS winners use the typed
+renderer contract instead of exposing raw `adm`.
 
-## Best Practices
+Publisher HTML uses the integration registry to contribute head markup and to
+select embedded TSJS modules. The registry does not fetch arbitrary integration
+assets at runtime.
 
-1. Set appropriate timeouts for your use case
-2. Enable caching for frequently requested ads
-3. Monitor ad server response times
-4. Use proxy mode for security-sensitive content
-5. Implement fallback ads
+## Operational checks
 
-## Next Steps
+- Validate configuration with `ts config validate` before deployment.
+- Use the [auction test runbook](/guide/auction-testing) for focused and
+  end-to-end checks.
+- Confirm provider authorization and test inventory with each upstream before
+  enabling traffic.
+- Treat provider timeout values as logical budgets; no adapter currently
+  promises an abortable provider-wide wall-clock deadline.
 
-- Review [Architecture](/guide/architecture)
-- Configure [Testing](/guide/testing)
+See also [Creative processing](/guide/creative-processing) and the
+[Integrations overview](/guide/integrations-overview).
diff --git a/docs/guide/api-reference.md b/docs/guide/api-reference.md
index 56306e364..6f8eeeaa1 100644
--- a/docs/guide/api-reference.md
+++ b/docs/guide/api-reference.md
@@ -14,12 +14,90 @@ Quick reference for all Trusted Server HTTP endpoints.
 
 ---
 
+## Adapter and startup support
+
+| Adapter      | Release status | Health     | Startup status | Startup health | Provider fan-out | Trusted-client-IP handling     | Request normalization            |
+| ------------ | -------------- | ---------- | -------------- | -------------- | ---------------- | ------------------------------ | -------------------------------- |
+| `axum`       | development    | real       | `500`          | no             | multiple         | outermost sanitize             | none                             |
+| `cloudflare` | development    | absent     | `500`          | no             | single           | outermost sanitize             | none                             |
+| `fastly`     | production     | pre router | `500`          | yes            | multiple         | entry-point resolve + sanitize | none                             |
+| `spin`       | experimental   | real       | `503`          | yes            | single           | outermost sanitize             | innermost Spin-header derivation |
+
+`trusted client IP handling` describes the optional
+`[trusted_client_ip]` configuration. Fastly resolves the authenticated header
+at the entry point and sanitizes all forwarding headers. The other adapters
+install the sanitizer as the outermost router middleware but do not resolve
+that configuration. Spin additionally normalizes its runtime-provided
+authority, scheme, and client-address headers in the innermost middleware.
+
+## Route availability
+
+| Router  | Path                                   | Methods                                                    | Shape          | Predicate                             | Fastly                | Axum                  | Cloudflare            | Spin                  |
+| ------- | -------------------------------------- | ---------------------------------------------------------- | -------------- | ------------------------------------- | --------------------- | --------------------- | --------------------- | --------------------- |
+| normal  | `/.well-known/trusted-server.json`     | `GET`                                                      | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/__ts/page-bids`                      | `GET`                                                      | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/__ts/page-bids`                      | `OPTIONS`                                                  | literal        | `always`                              | guarded               | guarded               | guarded               | guarded               |
+| normal  | `/_ts/admin/ec/{id}`                   | `GET`                                                      | template       | `always`                              | real                  | unsupported           | unsupported           | unsupported           |
+| normal  | `/_ts/admin/ec`                        | `GET`                                                      | literal        | `always`                              | real                  | unsupported           | unsupported           | unsupported           |
+| normal  | `/_ts/admin/eids`                      | `GET`                                                      | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/_ts/admin/keys/deactivate`           | `POST`                                                     | literal        | `always`                              | real                  | unsupported           | unsupported           | unsupported           |
+| normal  | `/_ts/admin/keys/rotate`               | `POST`                                                     | literal        | `always`                              | real                  | unsupported           | unsupported           | unsupported           |
+| normal  | `/_ts/api/v1/batch-sync`               | `POST`                                                     | literal        | `always`                              | real                  | —                     | —                     | —                     |
+| normal  | `/_ts/api/v1/identify`                 | `GET`, `OPTIONS`                                           | literal        | `always`                              | real                  | —                     | —                     | —                     |
+| normal  | `/_ts/clear-tester`                    | `GET`                                                      | literal        | `settings.tester_cookie.enabled`      | real                  | —                     | —                     | —                     |
+| normal  | `/_ts/debug/ja4`                       | `GET`                                                      | conditional    | `settings.debug.ja4_endpoint_enabled` | real                  | —                     | —                     | —                     |
+| normal  | `/_ts/page-bids`                       | `GET`                                                      | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/_ts/page-bids`                       | `OPTIONS`                                                  | literal        | `always`                              | guarded               | guarded               | guarded               | guarded               |
+| normal  | `/_ts/set-tester`                      | `GET`                                                      | literal        | `settings.tester_cookie.enabled`      | real                  | —                     | —                     | —                     |
+| normal  | `/admin/keys/deactivate`               | `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` | literal        | `always`                              | guarded               | guarded               | guarded               | guarded               |
+| normal  | `/admin/keys/rotate`                   | `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` | literal        | `always`                              | guarded               | guarded               | guarded               | guarded               |
+| normal  | `/auction`                             | `POST`                                                     | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/first-party/click`                   | `GET`                                                      | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/first-party/proxy-rebuild`           | `GET`, `POST`                                              | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/first-party/proxy`                   | `GET`                                                      | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/first-party/sign`                    | `GET`, `POST`                                              | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/health`                              | `GET`                                                      | literal        | `always`                              | real                  | real                  | —                     | real                  |
+| normal  | `/static/tsjs=<file>`                  | `GET`                                                      | template       | `path.starts_with(/static/tsjs=)`     | real                  | real                  | real                  | real                  |
+| normal  | `/verify-signature`                    | `POST`                                                     | literal        | `always`                              | real                  | real                  | real                  | real                  |
+| normal  | `/{*rest}`                             | `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` | template       | `publisher_fallback`                  | publisher fallback    | publisher fallback    | publisher fallback    | publisher fallback    |
+| normal  | `/`                                    | `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` | literal        | `publisher_fallback`                  | publisher fallback    | publisher fallback    | publisher fallback    | publisher fallback    |
+| normal  | `<proxy.asset_routes[].prefix>{*rest}` | `GET`, `HEAD`                                              | config derived | `settings.proxy.asset_routes[]`       | real                  | —                     | —                     | —                     |
+| startup | `/health`                              | `GET`                                                      | literal        | `startup_error`                       | real                  | —                     | —                     | real                  |
+| startup | `/{*rest}`                             | `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` | template       | `startup_error`                       | startup error (`500`) | startup error (`500`) | startup error (`500`) | startup error (`503`) |
+| startup | `/`                                    | `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` | literal        | `startup_error`                       | startup error (`500`) | startup error (`500`) | startup error (`500`) | startup error (`503`) |
+
+`real`, `unsupported`, `guarded`, `publisher fallback`, and `startup error` are
+distinct observable dispositions. An em dash means that the adapter has no
+local route; the publisher fallback can therefore receive that path. The
+startup rows are a separate degraded router, not additional normal routes.
+
+## Contract conventions
+
+Each endpoint contract below states authentication, request and response shape,
+status behavior, cache and CORS behavior, configuration gates, rate limiting,
+and an example or an explicit not-applicable value.
+
+`Auth: none` means that the endpoint has no built-in authentication. An
+operator can still wrap any path with a `[[handlers]]` Basic-auth rule. Unless
+an endpoint says otherwise, it has no endpoint-specific CORS policy and no
+in-process rate limiter. Responses still pass through the adapter's standard
+response finalizer. Upstream proxies can preserve selected upstream headers;
+that is not a blanket CORS grant.
+
+There is no repository-wide error body schema. Some handlers return structured
+JSON, some return an empty body, and shared adapter errors are plain text with
+safe client-facing messages. Treat the status and body documented for each
+endpoint as authoritative.
+
 ## Utility Endpoints
 
 ### GET /\_ts/set-tester
 
 Sets a first-party tester marker cookie for QA or troubleshooting workflows.
 
+**Contract:** Auth: none. Request body: not applicable. Rate limit: none.
+Endpoint-specific CORS: none.
+
 **Configuration:** Disabled by default. Enable with:
 
 ```toml
@@ -54,6 +132,9 @@ curl -i "https://edge.example.com/_ts/set-tester"
 
 Clears the first-party tester marker cookie for QA or troubleshooting workflows.
 
+**Contract:** Auth: none. Request body: not applicable. Rate limit: none.
+Endpoint-specific CORS: none.
+
 **Configuration:** Uses the same `[tester_cookie].enabled` flag as `/_ts/set-tester`.
 
 **Response when enabled:**
@@ -86,14 +167,23 @@ curl -i "https://edge.example.com/_ts/clear-tester"
 ### POST /auction
 
 Browser and programmatic auction endpoint. It accepts the Trusted Server ad-unit
-request shape and returns an OpenRTB response with first-party processed
-creatives. Creative URLs are rewritten by default; set
-`[auction].sanitize_creatives = true` to strip executable markup.
+request shape and returns an OpenRTB response. Creative markup follows the
+independent `[auction].sanitize_creatives` and `[auction].rewrite_creatives`
+settings; sanitization is opt-in and rewriting is enabled by default.
 
 Configured provider IDs appear in response metadata and provider responses.
 Consumers that previously matched the literal provider name `prebid` must use
 the configured provider ID, such as `pbs-main`.
 
+**Contract:** Auth: none. The buffered JSON body is limited to 256 KiB. A
+successful auction and an intentional no-bid both return `200` JSON; disabling
+`[auction]` or denying consent produces the no-bid form without calling a
+provider. An oversized body returns `413`; malformed input and validation
+failures use the shared adapter error mapping; provider failures use the shared
+`5xx` mapping. The endpoint sets no dedicated cache or CORS policy and has no
+in-process rate limiter. Provider selection, timeouts, and fan-out are governed
+by `[auction]` and the enabled provider profiles.
+
 **Request Body:**
 
 ```json
@@ -121,6 +211,37 @@ curl -X POST https://edge.example.com/auction \
   -d '{"adUnits":[{"code":"banner","mediaTypes":{"banner":{"sizes":[[300,250]]}}}]}'
 ```
 
+### GET /\_ts/page-bids and GET /\_\_ts/page-bids
+
+Runs the page-level auction used by the TSJS single-page-application hook. The
+`/__ts/page-bids` spelling is a deprecated compatibility alias and adds a
+`Link` header pointing to its removal issue.
+
+**Request schema:** `path` is optional and defaults to `/`; query and fragment
+text inside it are removed before creative-opportunity matching. `format` is
+optional and must be `json` when present. A request is admitted only when
+`Sec-Fetch-Site: same-origin`, or when `Sec-Fetch-Site` is absent and the
+request carries `X-TSJS-Page-Bids`. Every `OPTIONS` request is denied so a
+cross-origin caller cannot acquire permission to send that non-simple header.
+
+**Response schema:** `200 application/json` with `{ "slots": [...], "bids":
+{...} }`. The ad-stack kill switch, an auction kill switch, or denied consent
+returns empty collections. Unknown `format` returns `400`; a rejected GET or
+any `OPTIONS` returns `403`; missing `[creative_opportunities]` returns `404`.
+The `200`, `400`, and `403` terminal responses are `private, no-store`. The
+endpoint has no built-in authentication, CORS grant, or rate limiter.
+
+**Configuration:** `[creative_opportunities]`, `[auction]`, slot page patterns,
+provider profiles, and consent settings. Bot and prefetch requests retain slot
+shape but skip live provider calls.
+
+**Example:**
+
+```bash
+curl 'https://edge.example.com/_ts/page-bids?path=%2Fnews&format=json' \
+  -H 'Sec-Fetch-Site: same-origin'
+```
+
 ---
 
 ## Edge Cookie Endpoints
@@ -135,6 +256,18 @@ Returns EC identity plus the authenticated partner's UID and EID for the current
 
 **Auth:** Bearer token (`Authorization: Bearer <partner-api-key>`)
 
+**Contract:** The request has no body and uses the `ts-ec` cookie plus the
+request consent context. `200` returns the JSON shape below; `204` means there
+is no active EC ID; `401` means the Bearer token is unknown; and `403` means
+consent or the request origin was denied. A KV read failure still returns `200`
+with `degraded: true`. Every response is `no-store`, varies on `Origin` and
+`Authorization`, and also sends `Pragma: no-cache`. HTTPS origins equal to or
+below `[publisher].domain` receive reflected credentialed CORS for
+`GET, OPTIONS`; every other supplied origin receives `403`. `OPTIONS` returns
+`200` for no origin or an allowed origin. There is no endpoint rate limiter.
+The endpoint is Fastly-only and requires the EC store and a statically
+configured `[[ec.partners]]` token.
+
 **Request:**
 
 - Uses `ts-ec` cookie and consent signals
@@ -168,6 +301,15 @@ Server-to-server batch sync endpoint for writing EC ID to partner UID mappings.
 
 **Auth:** Bearer token (`Authorization: Bearer <partner-api-key>`)
 
+**Contract:** The JSON body is limited to 2 MiB and 1,000 mappings. The
+per-partner, per-minute limit is `ec.partners[].batch_rate_limit`. Responses are
+`200` when every mapping is accepted or `207` when at least one is rejected;
+item reasons are `invalid_ec_id`, `invalid_partner_uid`, `ineligible`, or
+`kv_unavailable`. Authentication failure returns `401 {"error":"invalid_token"}`;
+rate exhaustion returns `429`; an oversized body returns `413`; too many
+mappings returns `400`. The endpoint emits JSON but defines no dedicated cache
+or CORS headers. It is Fastly-only and requires the EC KV store.
+
 **Request Body:**
 
 ```json
@@ -192,6 +334,10 @@ Server-to-server batch sync endpoint for writing EC ID to partner UID mappings.
 }
 ```
 
+**Example:** `curl -X POST https://edge.example.com/_ts/api/v1/batch-sync -H
+'Authorization: Bearer <partner-api-key>' -H 'Content-Type: application/json'
+--data @mappings.json`.
+
 ---
 
 ### GET /first-party/proxy
@@ -199,11 +345,13 @@ Server-to-server batch sync endpoint for writing EC ID to partner UID mappings.
 Unified proxy for resources referenced by creatives (images, scripts, CSS, etc.).
 
 **Query Parameters:**
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `tsurl` | string | Yes | Target URL without query parameters (base URL) |
-| `tstoken` | string | Yes | Base64 URL-safe SHA-256 digest of encrypted full target URL |
-| `*` | any | No | Original target URL query parameters (preserved as-is) |
+
+| Parameter | Type    | Required | Description                                                                 |
+| --------- | ------- | -------- | --------------------------------------------------------------------------- |
+| `tsurl`   | string  | Yes      | Target URL without query parameters (base URL)                              |
+| `tstoken` | string  | Yes      | Base64url SHA-256 token derived from the encrypted reconstructed target URL |
+| `tsexp`   | integer | No       | Unix expiry carried by newly minted URLs and covered by `tstoken`           |
+| `*`       | any     | No       | Original target URL query parameters (preserved as-is)                      |
 
 **Response:**
 
@@ -219,6 +367,20 @@ Unified proxy for resources referenced by creatives (images, scripts, CSS, etc.)
 - Follows redirects (301/302/303/307/308, max 4 hops)
 - Injects EC ID as `ts-ec` query parameter
 - Logs 1×1 pixel impressions
+- Enforces `proxy.allowed_domains` on the initial fetch and every redirect;
+  an empty list is open mode
+
+**Contract:** Auth: signed query token, not HTTP credentials. Success preserves
+the upstream status and selected headers; HTML and CSS can be rewritten and
+image content type can be inferred. Missing `tsurl`/`tstoken`, malformed or
+expired `tsexp`, and upstream proxy failures currently use the shared `502`
+proxy-error mapping; a mismatched token or blocked host returns `403`.
+Redirects are followed for 301/302/303/307/308, with at most four hops. Cache
+and CORS are derived from the sanitized upstream response and response
+finalization; there is no endpoint CORS grant or rate limiter. This endpoint
+validates an existing signature—it does not mint one. Signing depends on
+`publisher.proxy_secret`; server-side fetches also enforce
+`proxy.allowed_domains`.
 
 **Example:**
 
@@ -230,9 +392,9 @@ curl "https://edge.example.com/first-party/proxy?tsurl=https://ad.doubleclick.ne
 
 **Error Responses:**
 
-- `400 Bad Request` - Missing or invalid `tstoken`
-- `403 Forbidden` - Token validation failed
-- `500 Internal Server Error` - Upstream fetch failed
+- `403 Forbidden` - Token validation or allowed-domain validation failed
+- `502 Bad Gateway` - Missing signing fields, invalid/expired expiration, or
+  upstream proxy failure
 
 ---
 
@@ -241,11 +403,13 @@ curl "https://edge.example.com/first-party/proxy?tsurl=https://ad.doubleclick.ne
 Click tracking redirect endpoint.
 
 **Query Parameters:**
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `tsurl` | string | Yes | Target redirect URL without query parameters |
-| `tstoken` | string | Yes | Base64 URL-safe SHA-256 digest of encrypted full target URL |
-| `*` | any | No | Original target URL query parameters |
+
+| Parameter | Type    | Required | Description                                                                 |
+| --------- | ------- | -------- | --------------------------------------------------------------------------- |
+| `tsurl`   | string  | Yes      | Target redirect URL without query parameters                                |
+| `tstoken` | string  | Yes      | Base64url SHA-256 token derived from the encrypted reconstructed target URL |
+| `tsexp`   | integer | No       | Optional Unix expiry covered by `tstoken`                                   |
+| `*`       | any     | No       | Original target URL query parameters                                        |
 
 **Response:**
 
@@ -259,6 +423,12 @@ Click tracking redirect endpoint.
 - Logs click metadata (tsurl, referer, user agent)
 - Does not proxy content (redirect only)
 
+**Contract:** Auth: signed query token. A valid request returns `302` with
+`Cache-Control: no-store, private`; it does not apply `proxy.allowed_domains`
+because it performs no server-side fetch. Signature errors have the same `403`
+versus shared `502` split as `/first-party/proxy`. The route has no dedicated
+CORS grant or rate limiter and validates rather than mints a signature.
+
 **Example:**
 
 ```bash
@@ -272,6 +442,16 @@ curl -I "https://edge.example.com/first-party/click?tsurl=https://advertiser.com
 
 URL signing endpoint. Returns a signed first-party proxy URL for a valid HTTP or HTTPS target. When `proxy.allowed_domains` is non-empty, the endpoint checks the parsed target host before signing. An empty list permits every valid host.
 
+**Contract:** Auth: none unless an operator adds a handler. GET accepts a `url`
+query value; POST accepts `{ "url": "..." }` and is limited to 64 KiB. `200`
+returns `{href, base}` and gives `href` a 30-second `tsexp`. A disallowed host
+returns `403`, an oversized POST returns `413`, and malformed/unsupported URLs
+or JSON use the current shared error mapping. The endpoint sets JSON content
+type but no dedicated cache or CORS policy and has no rate limiter. It mints a
+new proxy signature; it does not validate a caller-supplied `tstoken`.
+Signing depends on `publisher.proxy_secret` and checks
+`proxy.allowed_domains` before minting.
+
 **Request Methods:** GET or POST
 
 **GET Request:**
@@ -302,6 +482,9 @@ curl -X POST https://edge.example.com/first-party/sign \
 **Error Responses:**
 
 - `403 Forbidden`: The target has a valid host that does not match a non-empty `proxy.allowed_domains` list
+- `413 Payload Too Large`: The POST body exceeds 64 KiB
+- Shared `5xx`: Malformed JSON or an invalid/unsupported target under the
+  current proxy-error mapping
 
 **Use Cases:**
 
@@ -315,6 +498,17 @@ curl -X POST https://edge.example.com/first-party/sign \
 
 URL mutation recovery endpoint. Re-signs a click URL after creative JavaScript modifies its query parameters. The original `tstoken` is validated first, and `tsurl`, `tstoken`, and `tsexp` can never be added or removed.
 
+**Contract:** Auth: the original signed click URL. JSON and form POST bodies
+are limited to 64 KiB. A JSON POST returns `200` with the response below; GET
+and form-encoded POST return `302` to the rebuilt click URL. All success forms
+are `no-store, private`. A bad original token returns `403`; malformed input,
+an expired token, a non-click `tsclick`, a reserved-field mutation, or an
+attempt to overwrite an existing query parameter uses the shared error
+mapping; oversized bodies return `413`. There is no dedicated CORS grant or
+rate limiter. Rebuild validates the old signature before minting its
+replacement and never permits `tsurl`, `tstoken`, or `tsexp` mutation.
+Validation and re-signing depend on `publisher.proxy_secret`.
+
 **Request Body:**
 
 ```json
@@ -374,6 +568,12 @@ Validation is identical to the POST form.
 Returns the Trusted Server discovery document, which includes active public keys in JWKS
 format for signature verification.
 
+**Contract:** Auth: none. Request body: not applicable. `200 application/json`
+returns `{version, jwks}`; signing-store lookup, parse, or serialization failure
+uses the shared `500` response. The endpoint has no dedicated cache, CORS, or
+rate-limit policy. It requires usable `[request_signing]` storage and at least
+the store state needed to enumerate active public keys.
+
 **Response:**
 
 ```json
@@ -411,6 +611,14 @@ curl https://edge.example.com/.well-known/trusted-server.json
 
 Verifies a signature against a payload and key ID.
 
+**Contract:** Auth: none. The JSON body is limited to 4 KiB. A syntactically
+valid request always returns `200 application/json`: `verified` is false for an
+invalid signature, missing key, or internal verification failure, and the
+internal failure is exposed only as the sanitized `internal verification error`
+value. An oversized body returns `413`; malformed JSON uses the shared `500`
+configuration-error mapping. There is no dedicated cache, CORS, or rate-limit
+policy. `[request_signing]` storage must be readable.
+
 **Request Body:**
 
 ```json
@@ -437,7 +645,8 @@ Verifies a signature against a payload and key ID.
 {
   "verified": false,
   "kid": "ts-2025-01-A",
-  "message": "Invalid signature"
+  "message": "Signature verification failed",
+  "error": "Invalid signature"
 }
 ```
 
@@ -457,6 +666,15 @@ Generates and activates a new signing key.
 
 **Authentication:** Requires basic auth (configured via `handlers` in `trusted-server.toml`)
 
+**Contract:** Fastly implements this route; Axum, Cloudflare, and Spin return
+`501`. Startup requires complete Basic-auth coverage of `/_ts/admin`. The body
+is empty or JSON `{ "kid": "..." }`, limited to 4 KiB. A supplied KID must be
+1–128 characters, use ASCII alphanumerics plus `-_.:`, and start with a
+lowercase ASCII letter. Success returns `200`; invalid KIDs return structured
+`400`; store/rotation failures return structured `500`. Successful and failure
+bodies use the same schema and set `success` accordingly. The handler defines
+no dedicated cache, CORS, or rate-limit policy.
+
 **Request Body (Optional):**
 
 ```json
@@ -471,10 +689,12 @@ If omitted, auto-generates date-based ID (e.g., `ts-2025-01-15-A`).
 
 ```json
 {
+  "success": true,
+  "message": "Key rotated successfully",
   "new_kid": "ts-2025-01-15-A",
   "previous_kid": "ts-2025-01-14-A",
   "active_kids": ["ts-2025-01-15-A", "ts-2025-01-14-A"],
-  "message": "Key rotation successful"
+  "jwk": { "kty": "OKP", "crv": "Ed25519", "kid": "ts-2025-01-15-A" }
 }
 ```
 
@@ -502,6 +722,13 @@ Deactivates or deletes a signing key.
 
 **Authentication:** Requires basic auth
 
+**Contract:** Fastly implements this route; Axum, Cloudflare, and Spin return
+`501`. The JSON body is limited to 4 KiB. Deactivation accepts legacy KIDs that
+satisfy the 1–128 character and safe-character rules but do not satisfy the
+new-key lowercase-leading rule. Success returns `200`; invalid KIDs return a
+structured `400`; storage failures return a structured `500`. The handler
+defines no dedicated cache, CORS, or rate-limit policy.
+
 **Request Body:**
 
 ```json
@@ -520,9 +747,11 @@ Deactivates or deletes a signing key.
 
 ```json
 {
-  "kid": "ts-2025-01-14-A",
-  "active_kids": ["ts-2025-01-15-A"],
-  "message": "Key deactivated successfully"
+  "success": true,
+  "message": "Key deactivated successfully",
+  "deactivated_kid": "ts-2025-01-14-A",
+  "deleted": false,
+  "remaining_active_kids": ["ts-2025-01-15-A"]
 }
 ```
 
@@ -541,6 +770,9 @@ curl -X POST https://edge.example.com/_ts/admin/keys/deactivate \
 
 These endpoints expose sensitive identity and cookie data and require HTTP Basic Authentication. Configure a handler that covers the entire `/_ts/admin` namespace; startup rejects configurations that do not protect every admin route, including handlers that match only some `/_ts/admin/ec/{id}` values — the dynamic route needs a prefix-level matcher such as `^/_ts/admin` or `^/_ts/admin/ec/`. The whole `/_ts/admin` prefix is reserved: any admin path that reaches publisher fallback — unknown, malformed, or percent-encoded (`/_ts/admin%2Fec`) — is answered locally with `404` and is never proxied, so an admin `Authorization` header and request body never reach the publisher origin. The retired non-`/_ts` `/admin/keys` aliases are reserved the same way. Normal diagnostic-handler responses after successful authentication are JSON with `Cache-Control: no-store`. Missing or invalid credentials receive the shared plaintext `401 Unauthorized` Basic-auth challenge. Unexpected configuration or KV failures use the adapter's shared plaintext `5xx` error response. Those authentication and internal-error responses are outside the diagnostic JSON and cache-header contract.
 
+The diagnostic handlers have no CORS grant or in-process rate limiter. Apply an
+edge policy if operator access also needs request-rate enforcement.
+
 The examples below use fictional IDs and values only.
 
 ### GET /\_ts/admin/ec
@@ -589,6 +821,11 @@ Parses the request's `ts-eids` and `sharedId` cookies and previews which configu
 
 After successful authentication this endpoint always returns `200 OK`; missing or malformed cookies are represented by `cookie_present`, `sharedid_present`, and `parse_error`. The `ingest.matched` and `ingest.unmatched` arrays show the ingestion preview. Each unmatched entry contains its `source` and either a `no_partner` reason when no configured partner recognizes it or `no_valid_uid` when the partner exists but every supplied UID is empty or exceeds the storage limit.
 
+The request body is not applicable. The `200` JSON response is `no-store`.
+`401`, `405`, and unexpected `5xx` responses follow the shared admin behavior
+above. The route is available on every adapter and depends on configured EC
+partners, but not on the EC KV store.
+
 ```json
 {
   "ingest": {
@@ -616,6 +853,70 @@ curl -u 'admin:<resolved-admin-password>' \
 
 Malformed diagnostic paths return a local `404`, and unsupported methods return a local `405`; they are never forwarded to the publisher origin.
 
+### Legacy /admin/keys/rotate and /admin/keys/deactivate aliases
+
+All seven fallback methods return local `404 text/plain`. These retired aliases
+accept no schema, invoke no key operation, forward nothing to the publisher,
+and define no cache, CORS, or rate-limit policy. Example: `curl -i
+https://edge.example.com/admin/keys/rotate` must not reach the origin.
+
+---
+
+## Operational and fallback endpoints
+
+### GET /health
+
+**Contract:** Auth: none. Request and JSON schema: not applicable. Fastly,
+Axum, and Spin return `200 text/plain` with `ok`; Cloudflare has no local health
+route. Fastly short-circuits before application construction. Spin keeps the
+probe live in its startup-error router; Fastly also remains live because it is
+pre-router. The route has no configuration gate, dedicated cache or CORS
+policy, or rate limiter. Example: `curl -fsS https://edge.example.com/health`.
+
+This is liveness, not readiness: a `200` does not prove that configuration,
+stores, publisher proxying, or integrations are usable.
+
+### GET /\_ts/debug/ja4
+
+**Contract:** Fastly-only; gated by `[debug].ja4_endpoint_enabled`. Auth: none
+unless wrapped by a handler. The request has no body. Enabled requests return
+`200 text/plain` with JA4, HTTP/2 fingerprint, cipher, TLS version, user-agent,
+and client-hint values. Disabled requests return `404`. The response is
+`no-store, private` and varies on the user-agent/client-hint fields. It defines
+no CORS policy or rate limiter. Example: `curl -i
+https://edge.example.com/_ts/debug/ja4`.
+
+### GET or HEAD `<proxy.asset_routes[].prefix>{path}`
+
+**Contract:** Fastly-only and registered once for each
+`[[proxy.asset_routes]]` entry. Auth: optional S3 SigV4 origin credentials,
+which authenticate Trusted Server to the origin rather than the caller.
+Request body: not applicable. The route maps the remainder of the path and the
+configured query policy to the selected origin, preserves range and conditional
+request semantics, and returns the origin status/body after stripping unsafe
+response headers. Cache behavior follows the route's normalized cache policy;
+credentialed or otherwise private responses are forced `private, no-store`.
+No dedicated CORS grant or rate limiter is installed. Example: if the prefix is
+`/assets/`, request `curl -I https://edge.example.com/assets/logo.svg`.
+
+### Publisher fallback: `/` and `/{*rest}`
+
+**Contract:** `GET`, `POST`, `HEAD`, `OPTIONS`, `PUT`, `PATCH`, and `DELETE`
+proxy to `[publisher].backend`. The request and response schemas are the
+publisher origin's schemas. Trusted Server may rewrite eligible HTML, assemble
+templates, inject configured integrations, apply EC finalization, and preserve
+streaming where supported. The origin status is normally preserved; fetch or
+processing failures use shared adapter errors. Cacheability is decided from
+the origin response plus personalization, cookie, template, and rewrite
+effects. CORS is therefore the sanitized publisher-origin policy, not a global
+Trusted Server policy. There is no built-in endpoint rate limiter. Example:
+`curl -i https://edge.example.com/article`.
+
+When startup fails, the degraded router replaces normal routing: Fastly,
+Axum, and Cloudflare return `500` for both fallback shapes and all seven
+methods; Spin returns a generic `503`. Only the health behavior shown in the
+table survives.
+
 ---
 
 ## TSJS Library Endpoint
@@ -626,15 +927,17 @@ Serves the TSJS (Trusted Server JavaScript) library.
 
 **Path Pattern:** `/static/tsjs=<filename>?v=<hash>`
 
-**Supported Filenames:**
-
-- `tsjs-unified.js`
-- `tsjs-unified.min.js`
+**Supported filenames:** `tsjs-unified.js` and `tsjs-unified.min.js` serve the
+core plus enabled immediate modules. `tsjs-<integration>.js` and
+`tsjs-<integration>.min.js` serve a known enabled deferred module, plus the
+enabled standalone `gpt_diagnostics` module. An unknown, disabled, or
+non-deferred module filename returns `404`.
 
 **Query Parameters:**
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `v` | string | No | Cache-busting hash (SHA256 of bundle contents) |
+
+| Parameter | Type   | Required | Description                                    |
+| --------- | ------ | -------- | ---------------------------------------------- |
+| `v`       | string | No       | Cache-busting hash (SHA256 of bundle contents) |
 
 **Response:**
 
@@ -642,6 +945,14 @@ Serves the TSJS (Trusted Server JavaScript) library.
 - **Body:** TSJS bundle (IIFE format)
 - **Headers:** ETag for caching
 
+**Contract:** Auth: none. Request body: not applicable. A known eligible bundle
+returns `200 application/javascript`; conditional requests can return `304`;
+unknown/disabled filenames return `404`. When `v` exactly equals the generated
+content hash, the response is public and immutable for one year. Other bundle
+responses retain validator-based static caching without the immutable promise.
+The route defines no CORS policy or rate limiter. Its module gate is the
+compiled integration registry, not an arbitrary filename lookup.
+
 **Example:**
 
 ```html
@@ -658,6 +969,96 @@ All integration modules are built at compile time. At runtime, the server concat
 
 ## Integration Endpoints
 
+Every row below records a compiled integration registration predicate.
+An integration with no HTTP route can still contribute a browser module,
+rewriter, injector, post-processor, request filter, or auction mediator.
+
+| Integration          | Registration predicate                                           | HTTP routes                                       |
+| -------------------- | ---------------------------------------------------------------- | ------------------------------------------------- |
+| `adserver_mock`      | `auction.mediator=adserver_mock;enabled=true`                    | None                                              |
+| `aps`                | `plan.has_profile(aps);rendering_mode=publisher_native`          | None                                              |
+| `aps`                | `plan.has_profile(aps);rendering_mode=trusted_server`            | `GET /integrations/aps/renderer`                  |
+| `creative`           | `always`                                                         | None                                              |
+| `datadome`           | `enabled=true;enable_protection=false`                           | `GET /integrations/datadome/js/*`                 |
+| `datadome`           | `enabled=true;enable_protection=false`                           | `GET /integrations/datadome/js/`                  |
+| `datadome`           | `enabled=true;enable_protection=false`                           | `GET /integrations/datadome/tags.js`              |
+| `datadome`           | `enabled=true;enable_protection=false`                           | `POST /integrations/datadome/js/*`                |
+| `datadome`           | `enabled=true;enable_protection=false`                           | `POST /integrations/datadome/js/`                 |
+| `datadome`           | `enabled=true;enable_protection=true`                            | `GET /integrations/datadome/js/*`                 |
+| `datadome`           | `enabled=true;enable_protection=true`                            | `GET /integrations/datadome/js/`                  |
+| `datadome`           | `enabled=true;enable_protection=true`                            | `GET /integrations/datadome/tags.js`              |
+| `datadome`           | `enabled=true;enable_protection=true`                            | `POST /integrations/datadome/js/*`                |
+| `datadome`           | `enabled=true;enable_protection=true`                            | `POST /integrations/datadome/js/`                 |
+| `didomi`             | `enabled=true;prefix=proxy_path\|\|/integrations/didomi/consent` | `GET <prefix>/*`                                  |
+| `didomi`             | `enabled=true;prefix=proxy_path\|\|/integrations/didomi/consent` | `POST <prefix>/*`                                 |
+| `google_tag_manager` | `enabled=true`                                                   | `GET /integrations/google_tag_manager/collect`    |
+| `google_tag_manager` | `enabled=true`                                                   | `GET /integrations/google_tag_manager/g/collect`  |
+| `google_tag_manager` | `enabled=true`                                                   | `GET /integrations/google_tag_manager/gtag.js`    |
+| `google_tag_manager` | `enabled=true`                                                   | `GET /integrations/google_tag_manager/gtag/js`    |
+| `google_tag_manager` | `enabled=true`                                                   | `GET /integrations/google_tag_manager/gtm.js`     |
+| `google_tag_manager` | `enabled=true`                                                   | `POST /integrations/google_tag_manager/collect`   |
+| `google_tag_manager` | `enabled=true`                                                   | `POST /integrations/google_tag_manager/g/collect` |
+| `gpt_diagnostics`    | `enabled=true`                                                   | None                                              |
+| `js_asset_proxy`     | `enabled=true;asset.proxy=enabled`                               | `GET <asset.path>` per configured asset           |
+| `gpt`                | `enabled=true`                                                   | `GET /integrations/gpt/pagead/*`                  |
+| `gpt`                | `enabled=true`                                                   | `GET /integrations/gpt/script`                    |
+| `gpt`                | `enabled=true`                                                   | `GET /integrations/gpt/tag/*`                     |
+| `lockr`              | `enabled=true`                                                   | `GET /integrations/lockr/api/*`                   |
+| `lockr`              | `enabled=true`                                                   | `GET /integrations/lockr/sdk`                     |
+| `lockr`              | `enabled=true`                                                   | `POST /integrations/lockr/api/*`                  |
+| `nextjs`             | `enabled=true`                                                   | None                                              |
+| `osano`              | `enabled=true`                                                   | None                                              |
+| `permutive`          | `enabled=true`                                                   | `GET /integrations/permutive/api/*`               |
+| `permutive`          | `enabled=true`                                                   | `GET /integrations/permutive/cdn/*`               |
+| `permutive`          | `enabled=true`                                                   | `GET /integrations/permutive/events/*`            |
+| `permutive`          | `enabled=true`                                                   | `GET /integrations/permutive/sdk`                 |
+| `permutive`          | `enabled=true`                                                   | `GET /integrations/permutive/secure-signal/*`     |
+| `permutive`          | `enabled=true`                                                   | `GET /integrations/permutive/sync/*`              |
+| `permutive`          | `enabled=true`                                                   | `POST /integrations/permutive/api/*`              |
+| `permutive`          | `enabled=true`                                                   | `POST /integrations/permutive/events/*`           |
+| `permutive`          | `enabled=true`                                                   | `POST /integrations/permutive/secure-signal/*`    |
+| `permutive`          | `enabled=true`                                                   | `POST /integrations/permutive/sync/*`             |
+| `prebid`             | `enabled=true;script_patterns=config-derived`                    | `GET /integrations/prebid/bundle.js`              |
+| `prebid`             | `enabled=true;script_patterns=config-derived`                    | `GET <integrations.prebid.script_patterns[]>`     |
+| `sourcepoint`        | `enabled=true`                                                   | `GET /integrations/sourcepoint/cdn/*`             |
+| `sourcepoint`        | `enabled=true`                                                   | `HEAD /integrations/sourcepoint/cdn/*`            |
+| `sourcepoint`        | `enabled=true`                                                   | `OPTIONS /integrations/sourcepoint/cdn/*`         |
+| `sourcepoint`        | `enabled=true`                                                   | `POST /integrations/sourcepoint/cdn/*`            |
+| `testlight`          | `enabled=true`                                                   | `POST /integrations/testlight/auction`            |
+
+### Integration proxy contracts
+
+All integration routes are registered only when the documented predicate is
+true. A disabled integration registers no route, so its path continues through
+normal routing and can reach the publisher fallback. Duplicate registrations
+are startup errors. None of these routes has built-in caller authentication or
+an in-process rate limiter; `[[handlers]]` and platform controls remain
+available when a deployment needs either.
+
+| Route family      | Request and success contract                                                                                                                                           | Errors, cache, and CORS                                                                                                                                                                       | Example                                                                                                                                   |
+| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| APS renderer      | `GET /integrations/aps/renderer`; no body; `200 text/html` static opaque-frame renderer with CSP, `nosniff`, and `no-referrer`                                         | Present only for an enabled APS profile in `trusted_server` rendering mode; no dedicated cache/CORS headers                                                                                   | Browser-internal iframe target; curl is not a meaningful auction test                                                                     |
+| DataDome tag      | `GET /integrations/datadome/tags.js`; query forwarded; successful upstream `200` is rewritten and returned as JavaScript                                               | Non-200 upstream status is preserved; rewritten `200` uses `cache_ttl_seconds`; upstream `Access-Control-Allow-Origin` is copied when present                                                 | `curl -i https://edge.example.com/integrations/datadome/tags.js`                                                                          |
+| DataDome signals  | `GET` or `POST /integrations/datadome/js/` and `/js/*`; method, query, bounded POST body, and selected browser headers forwarded to `api_origin`                       | Upstream status/body/headers preserved; transport or size failures use shared integration errors; no added cache/CORS policy                                                                  | Browser SDK traffic; manual payload is upstream-schema-specific                                                                           |
+| Didomi consent    | `GET` or `POST` under the configured prefix (default `/integrations/didomi/consent/*`); path selects SDK or API origin; query and bounded POST body forwarded          | Upstream status/body preserved; SDK responses receive the integration's CORS headers; API responses retain selected upstream headers; no local cache policy                                   | `curl -i https://edge.example.com/integrations/didomi/consent/loader.js`                                                                  |
+| GTM/gtag scripts  | `GET` the generated `gtm.js`, `gtag.js`, or `gtag/js` paths; query forwarded or configured container ID supplied; successful script is rewritten                       | Non-success upstream status preserved; rewritten scripts use `cache_max_age`; oversized rewritten upstream bodies use shared integration errors                                               | `curl -i 'https://edge.example.com/integrations/google_tag_manager/gtm.js?id=GTM-XXXX'`                                                   |
+| Google collect    | `GET` or `POST` the generated `collect` or `g/collect` paths; query, selected headers, and bounded body proxy to the configured Google origin                          | Malformed `Content-Length` returns `400`; body over `max_beacon_body_size` returns `413`; stream-read failure returns `502`; upstream response otherwise preserved                            | Browser beacon; body schema belongs to Google Analytics                                                                                   |
+| JS asset proxy    | `GET` each configured `[[integrations.js_asset_proxy.assets]]` path whose `proxy = "enabled"`; the exact `origin_url` is fetched and served first-party                | Upstream failures use shared integration errors; successful responses honor the per-asset or integration `cache_ttl_seconds`; `blocked` assets register no route and strip matching tags      | Path is operator-configured, for example `curl -i https://edge.example.com/js/vendor-tag.js`                                              |
+| GPT               | `GET` `/script`, `/pagead/*`, or `/tag/*`; path/query proxy to the configured GPT origins and script content can be rewritten                                          | Upstream status is preserved; successful scripts/assets apply integration cache rules; selected upstream CORS is preserved                                                                    | `curl -i https://edge.example.com/integrations/gpt/script`                                                                                |
+| Lockr SDK         | `GET /integrations/lockr/sdk`; no body; fetches and returns the configured SDK as JavaScript                                                                           | Successful SDK uses `cache_ttl_seconds`; upstream/transport failures follow integration mapping; no added CORS policy                                                                         | `curl -i https://edge.example.com/integrations/lockr/sdk`                                                                                 |
+| Lockr API         | `GET` or `POST /integrations/lockr/api/*`; path, query, selected headers, and bounded body proxy to `api_endpoint`; publisher credentials are stripped                 | Upstream status/body preserved; no local cache/CORS policy                                                                                                                                    | Payload is Lockr-specific; use the SDK for normal calls                                                                                   |
+| Permutive SDK     | `GET /integrations/permutive/sdk`; no body; fetches `{organization_id}.edge.permutive.app/{workspace_id}-web.js`                                                       | Successful SDK is JavaScript cached for `cache_ttl_seconds`; transport failures follow integration mapping                                                                                    | `curl -i https://edge.example.com/integrations/permutive/sdk`                                                                             |
+| Permutive proxies | Generated `GET`/`POST` API, secure-signal, events, and sync routes plus `GET` CDN; suffix, query, selected headers, and bounded body proxy to the corresponding origin | Upstream status/body preserved; no added cache/CORS policy                                                                                                                                    | `curl -i https://edge.example.com/integrations/permutive/api/settings`                                                                    |
+| Prebid bundle     | `GET /integrations/prebid/bundle.js`; no request body; proxies the configured external bundle                                                                          | Requires `external_bundle_url` and its host in `proxy.allowed_domains`; `v` must satisfy the configured cache mode; response strips unsafe headers and applies the bundle cache contract      | `curl -i 'https://edge.example.com/integrations/prebid/bundle.js?v=<configured-sha256>'`                                                  |
+| Prebid blockers   | `GET` each exact configured `script_patterns` path; returns `200` empty JavaScript to suppress the publisher bundle                                                    | No upstream call; empty list registers none; dedicated CORS is not applicable                                                                                                                 | `curl -i https://edge.example.com/prebid.js`                                                                                              |
+| Sourcepoint CDN   | `GET`, `HEAD`, `OPTIONS`, or `POST /integrations/sourcepoint/cdn/*`; suffix/query and a bounded body proxy to `cdn_origin`; selected consent cookies can round-trip    | Upstream status preserved; cookie-bearing responses are private; eligible static responses use `cache_ttl_seconds`; redirect locations and eligible JS/HTML content are rewritten first-party | `curl -i https://edge.example.com/integrations/sourcepoint/cdn/unified/wrapperMessagingWithoutDetection.js`                               |
+| Testlight auction | `POST /integrations/testlight/auction`; OpenRTB JSON is bounded, parsed, and sent to the configured endpoint with `user.id` populated from the consent-allowed EC ID   | Malformed/oversized input and transport errors use shared mappings; upstream status/body preserved; no added cache/CORS policy and no EC response header                                      | `curl -X POST https://edge.example.com/integrations/testlight/auction -H 'Content-Type: application/json' -d '{"imp":[{"id":"slot-1"}]}'` |
+
+`adserver_mock`, `creative`, `gpt_diagnostics`, `nextjs`, and `osano` have no
+HTTP endpoint. Their request schema, statuses, cache/CORS contract, rate limit,
+and curl example are therefore not applicable; their browser, mediator,
+rewriter, or diagnostic behavior is documented in the integration guides.
+
 ### Prebid Integration
 
 #### POST /auction
@@ -745,34 +1146,7 @@ No EC ID response header is emitted. EC identity is maintained with the `ts-ec`
 
 ---
 
-## Error Responses
-
-All endpoints use consistent error response format:
-
-```json
-{
-  "error": "Error type",
-  "message": "Detailed error description",
-  "details": {
-    "field": "Additional context"
-  }
-}
-```
-
-**Common HTTP Status Codes:**
-| Code | Meaning | Common Causes |
-|------|---------|---------------|
-| 400 | Bad Request | Missing required parameters, invalid JSON |
-| 401 | Unauthorized | Missing or invalid basic auth credentials |
-| 403 | Forbidden | Invalid token signature, disabled integration |
-| 404 | Not Found | Unknown endpoint, missing resource |
-| 500 | Internal Server Error | Upstream service failure, configuration error |
-| 502 | Bad Gateway | Backend service unavailable |
-| 504 | Gateway Timeout | Backend service timeout exceeded |
-
----
-
-## Authentication
+## Authentication and policy boundaries
 
 ### Basic Authentication
 
@@ -805,30 +1179,33 @@ curl -u 'admin:<resolved-admin-password>' https://edge.example.com/_ts/admin/key
 - `/_ts/admin/eids`
 - Any paths matching configured `handlers` patterns
 
----
-
-## Rate Limiting
-
-Trusted Server relies on Fastly's built-in rate limiting. Configure in Fastly dashboard:
+The EC partner APIs use their own Bearer-token contract. Signed first-party
+proxy routes use `tstoken` instead of HTTP authentication. All other built-in
+routes are unauthenticated unless the operator deliberately wraps them with a
+handler.
 
-**Recommended Limits:**
+### Rate limiting
 
-- Public endpoints: 1000 req/min per IP
-- Admin endpoints: 10 req/min per IP
-- TSJS serving: 10000 req/min (highly cacheable)
+`/_ts/api/v1/batch-sync` is the only endpoint in this reference with a
+built-in request-rate limiter. Its limit is per partner and configured with
+`ec.partners[].batch_rate_limit`. Other limits must be implemented with the
+deployment platform or an upstream service; this project does not prescribe
+universal numeric limits.
 
----
+### CORS
 
-## CORS
+CORS is endpoint-specific. `/_ts/api/v1/identify` implements a closed,
+publisher-domain policy and an explicit `OPTIONS` handler. Page-bids explicitly
+denies preflight. Several integration proxies preserve or synthesize only the
+headers described in their contract. `response_headers` is standard response
+finalization, not a substitute for registering and validating an `OPTIONS`
+route; do not infer cross-origin support from a configured header alone.
 
-CORS headers are not enabled by default. Configure `response_headers` for cross-origin requests:
+### Errors
 
-```toml
-[response_headers]
-Access-Control-Allow-Origin = "*"
-Access-Control-Allow-Methods = "GET, POST, OPTIONS"
-Access-Control-Allow-Headers = "Content-Type, Authorization"
-```
+Error representation is also endpoint-specific. Consult the contract above
+and [Error Reference](./error-reference.md). Do not write a client that assumes
+every failure is JSON or that every upstream failure has the same status.
 
 ---
 
diff --git a/docs/guide/architecture.md b/docs/guide/architecture.md
index 3aa1b8857..a6145f80d 100644
--- a/docs/guide/architecture.md
+++ b/docs/guide/architecture.md
@@ -90,18 +90,19 @@ cargo clippy-spin-wasm
 
 ## Design Patterns
 
-### RequestWrapper Trait
-
-Abstracts HTTP request handling to support different backends:
-
-```rust
-// Placeholder example
-pub trait RequestWrapper {
-    fn get_header(&self, name: &str) -> Option<String>;
-    fn get_cookie(&self, name: &str) -> Option<String>;
-    // ...
-}
-```
+### Platform services
+
+Core request and response values use the standard `http` types with
+`edgezero_core::body::Body`. Runtime-specific capabilities are supplied through
+`RuntimeServices`, which holds trait objects for configuration and secret
+stores, KV access, dynamic backends, outbound HTTP, geographic lookup, template
+assembly, and template caching.
+
+The contracts live under `trusted_server_core::platform`, including
+`PlatformConfigStore`, `PlatformSecretStore`, `PlatformBackend`,
+`PlatformHttpClient`, `PlatformGeo`, `PlatformTemplateAssembler`, and
+`PlatformTemplateCache`. Each adapter constructs the services it supports;
+unavailable capabilities fail through explicit unavailable implementations.
 
 ### Settings-Driven Configuration
 
diff --git a/docs/guide/auction-testing.md b/docs/guide/auction-testing.md
new file mode 100644
index 000000000..b92b78b0f
--- /dev/null
+++ b/docs/guide/auction-testing.md
@@ -0,0 +1,70 @@
+# Auction testing
+
+Use controlled upstream fixtures for auction tests. Do not point local smoke
+tests at production bidder endpoints.
+
+## Validate the configuration first
+
+The CLI compiles the complete target-independent `AuctionPlan`, including
+provider profiles, bidder routes, extension bounds, notification settings, and
+mediator selection:
+
+```bash
+ts config validate --strict
+```
+
+For a local Fastly run, write the validated envelope into Viceroy state before
+starting the adapter:
+
+```bash
+ts config push --adapter fastly --local
+fastly compute serve
+```
+
+`fastly compute serve` alone is insufficient: the checked-in config store is
+empty, and non-health requests fail until a valid app-config envelope is
+available.
+
+## Exercise `POST /auction`
+
+Configure each provider endpoint to a controlled fixture, then send a
+Prebid-compatible request:
+
+```bash
+curl --fail-with-body \
+  --header 'content-type: application/json' \
+  --request POST \
+  --data '{"adUnits":[{"code":"header-banner","mediaTypes":{"banner":{"sizes":[[728,90]]}}}]}' \
+  http://localhost:7676/auction
+```
+
+Check the response and logs for these invariants:
+
+- a disabled auction returns a no-bid response without provider dispatch;
+- `routing = "explicit"` sends a slot only to its mapped provider;
+- `routing = "all_eligible"` sends eligible banner slots without leaking
+  another provider's bidder parameters;
+- provider-local failures do not fabricate bids;
+- with no mediator, the orchestrator selects the highest valid bid per slot;
+- with `mediator = "adserver_mock"`, the configured mediator owns final
+  selection; and
+- APS winners use `ext.trusted_server.renderer` rather than raw `adm`.
+
+## Run automated coverage
+
+The shared auction tests run through the target-specific aliases:
+
+```bash
+cargo test-fastly auction
+cargo test-axum auction
+cargo test-cloudflare auction
+cargo test-spin auction
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity auction
+```
+
+Fastly and Axum support multi-provider fan-out. Cloudflare and Spin reject an
+enabled plan with more than one provider at startup, so their negative tests
+are part of the contract rather than skipped coverage.
+
+See [Auction orchestration](/guide/auction-orchestration) for configuration and
+response details.
diff --git a/docs/guide/axum-dev.md b/docs/guide/axum-dev.md
new file mode 100644
index 000000000..a98acbb06
--- /dev/null
+++ b/docs/guide/axum-dev.md
@@ -0,0 +1,57 @@
+# Axum development server
+
+The Axum adapter runs Trusted Server as a native local process. It is the
+shortest path for inspecting requests without an edge runtime; it is not a
+production deployment target.
+
+## Support status
+
+| Adapter | Release status | Health | Startup status | Startup health | Provider fan-out | Trusted-client-IP handling | Request normalization |
+| ------- | -------------- | ------ | -------------- | -------------- | ---------------- | -------------------------- | --------------------- |
+| `axum`  | development    | real   | `500`          | no             | multiple         | outermost sanitize         | none                  |
+
+This row is the canonical status summary. Axum supports multiple
+auction providers and exposes a real `/health` handler. A startup failure
+replaces every route with a 500 response, including `/health`.
+
+## Verify the complete local handoff
+
+From the repository root, run:
+
+```bash
+./scripts/smoke-axum.sh
+```
+
+The script creates and strictly validates an isolated config, then runs `ts
+config push --adapter axum --local`. That push writes the config envelope to
+the temporary `.edgezero/` directory; the Axum process does not read that file
+directly. The script reads the envelope and exports it as
+`TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG`.
+
+Secrets use `TRUSTED_SERVER_SECRET_{STORE}_{KEY}`. The exact required variables
+are:
+
+- `TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_HANDLER_PASSWORD`
+- `TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_PUBLISHER_PROXY_SECRET`
+- `TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_EC_PASSPHRASE`
+
+Before the positive request, the smoke omits the config and each secret in
+separate process starts. Each request must return 500 and its log must identify
+the missing environment variable or exact setting path. This prevents a port,
+launcher, or origin error from satisfying a negative case.
+
+The final publisher request must return 200, include the stub-origin sentinel,
+rewrite its origin URL to the Axum listener, and remove the original URL. The
+exit trap stops the Axum process and stub origin, then removes the temporary
+config, local-push output, bodies, headers, and logs.
+
+## Runtime boundaries
+
+Axum implements the read-only `/_ts/admin/eids` diagnostic. EC record lookup
+and key rotation are registered but return not-supported responses because the
+adapter has no request-time KV implementation. It sanitizes forwarded client-IP
+headers but does not resolve `[trusted_client_ip]`; see the
+[adapter matrix](./api-reference#adapter-and-startup-support).
+
+For an edge deployment, use the [Fastly](./fastly),
+[Cloudflare](./cloudflare), or [Spin](./spin) guide.
diff --git a/docs/guide/cli.md b/docs/guide/cli.md
index 776b7aaa8..2c4eb34ab 100644
--- a/docs/guide/cli.md
+++ b/docs/guide/cli.md
@@ -3,6 +3,52 @@
 The Trusted Server CLI binary is `ts`. It is a host-target operator tool for
 configuration, page audits, and EdgeZero-backed lifecycle commands.
 
+## Command index
+
+The table summarizes native `--help` output on Linux and macOS. Platform-only
+commands are shown explicitly.
+
+| Command                          | Availability  | Summary                                                                                          | Usage                                                                                                          |
+| -------------------------------- | ------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
+| `ts`                             | Linux + macOS | Trusted Server CLI                                                                               | `ts <COMMAND>`                                                                                                 |
+| `ts active-version`              | Linux + macOS | Print the currently active deployment version for a target adapter                               | `ts active-version --adapter <ADAPTER> --service-id <SERVICE_ID>`                                              |
+| `ts audit`                       | Linux + macOS | Browser-backed page and ad-template audits                                                       | `ts audit [COMMAND]`                                                                                           |
+| `ts audit ad-templates`          | Linux + macOS | Verify configured ad-template slots against live page evidence                                   | `ts audit ad-templates <COMMAND>`                                                                              |
+| `ts audit ad-templates generate` | Linux + macOS | Scrape a live page's GPT slots and update the config's `[creative_opportunities]` slots in place | `ts audit ad-templates generate [OPTIONS] <URL>`                                                               |
+| `ts audit ad-templates verify`   | Linux + macOS | Verify ad-template slots for one or more live URLs                                               | `ts audit ad-templates verify [OPTIONS] <URLS>...`                                                             |
+| `ts audit generate`              | Linux + macOS | Bootstrap a draft Trusted Server config + JS asset audit from a live page                        | `ts audit generate [OPTIONS] <URL>`                                                                            |
+| `ts audit page`                  | Linux + macOS | Audit a single page and print a read-only summary                                                | `ts audit page [OPTIONS] <URL>`                                                                                |
+| `ts auth`                        | Linux + macOS | Sign in / out / status against an `EdgeZero` adapter                                             | `ts auth <COMMAND>`                                                                                            |
+| `ts auth login`                  | Linux + macOS | Sign in (`wrangler login` / `fastly profile create` / `spin cloud login`)                        | `ts auth login --adapter <ADAPTER>`                                                                            |
+| `ts auth logout`                 | Linux + macOS | Sign out (`wrangler logout` / `fastly profile delete` / `spin cloud logout`)                     | `ts auth logout --adapter <ADAPTER>`                                                                           |
+| `ts auth status`                 | Linux + macOS | Show the current session (`wrangler whoami` / `fastly profile list` / `spin cloud info`)         | `ts auth status --adapter <ADAPTER>`                                                                           |
+| `ts build`                       | Linux + macOS | Build the project for a target adapter                                                           | `ts build --adapter <ADAPTER> [ADAPTER_ARGS]...`                                                               |
+| `ts config`                      | Linux + macOS | Trusted Server app-config commands                                                               | `ts config <COMMAND>`                                                                                          |
+| `ts config ad-templates`         | Linux + macOS | Diagnose server-side ad-template configuration and path matching                                 | `ts config ad-templates <COMMAND>`                                                                             |
+| `ts config ad-templates check`   | Linux + macOS | Assert that a page path or URL matches the expected slot set                                     | `ts config ad-templates check [OPTIONS] <--expected-slot <ID>\|--expect-no-slots> <PATH_OR_URL>`               |
+| `ts config ad-templates explain` | Linux + macOS | Explain why a page path or URL would or would not run the ad stack                               | `ts config ad-templates explain [OPTIONS] <PATH_OR_URL>`                                                       |
+| `ts config ad-templates lint`    | Linux + macOS | Validate ad-template config and summarize deploy-time implications                               | `ts config ad-templates lint [OPTIONS]`                                                                        |
+| `ts config ad-templates match`   | Linux + macOS | Show creative opportunity slots matching a page path or URL                                      | `ts config ad-templates match [OPTIONS] <PATH_OR_URL>`                                                         |
+| `ts config diff`                 | Linux + macOS | Diff `trusted-server.toml` against the live `EdgeZero` config                                    | `ts config diff [OPTIONS] --adapter <ADAPTER>`                                                                 |
+| `ts config gc`                   | Linux + macOS | Reclaim orphaned chunk entries leaked from prior oversized pushes                                | `ts config gc [OPTIONS] --adapter <ADAPTER>`                                                                   |
+| `ts config init`                 | Linux + macOS | Initialize a Trusted Server config file from the example template                                | `ts config init [OPTIONS]`                                                                                     |
+| `ts config push`                 | Linux + macOS | Push `trusted-server.toml` as a blob envelope through `EdgeZero`                                 | `ts config push [OPTIONS] --adapter <ADAPTER>`                                                                 |
+| `ts config validate`             | Linux + macOS | Validate `edgezero.toml` and the typed Trusted Server config                                     | `ts config validate [OPTIONS]`                                                                                 |
+| `ts deploy`                      | Linux + macOS | Deploy the project through a target adapter                                                      | `ts deploy [OPTIONS] --adapter <ADAPTER> [-- <ADAPTER_ARGS>...]`                                               |
+| `ts dev`                         | Linux + macOS | Local developer tools (e.g. the macOS-only production-hostname proxy)                            | `ts dev`                                                                                                       |
+| `ts dev proxy`                   | macOS only    | Run the local production-hostname dev proxy (macOS only)                                         | `ts dev proxy [OPTIONS] [COMMAND]`                                                                             |
+| `ts dev proxy ca`                | macOS only    | Manage the per-machine dev CA                                                                    | `ts dev proxy ca <COMMAND>`                                                                                    |
+| `ts dev proxy ca install`        | macOS only    | Add the CA to the OS trust store (macOS login keychain)                                          | `ts dev proxy ca install`                                                                                      |
+| `ts dev proxy ca path`           | macOS only    | Print the per-machine CA certificate path                                                        | `ts dev proxy ca path`                                                                                         |
+| `ts dev proxy ca regenerate`     | macOS only    | Regenerate the per-machine CA (invalidates prior trust)                                          | `ts dev proxy ca regenerate`                                                                                   |
+| `ts dev proxy ca uninstall`      | macOS only    | Remove the CA from the OS trust store                                                            | `ts dev proxy ca uninstall`                                                                                    |
+| `ts healthcheck`                 | Linux + macOS | Probe a deployed version until it reports healthy                                                | `ts healthcheck [OPTIONS] --adapter <ADAPTER> --domain <DOMAIN> --service-id <SERVICE_ID> --version <VERSION>` |
+| `ts prebid`                      | Linux + macOS | Trusted Server Prebid commands                                                                   | `ts prebid <COMMAND>`                                                                                          |
+| `ts prebid bundle`               | Linux + macOS | Generate a local external Prebid bundle and update config metadata                               | `ts prebid bundle [OPTIONS]`                                                                                   |
+| `ts provision`                   | Linux + macOS | Provision platform resources through a target adapter                                            | `ts provision [OPTIONS] --adapter <ADAPTER>`                                                                   |
+| `ts rollback`                    | Linux + macOS | Roll a service back to a previously active deployment version                                    | `ts rollback [OPTIONS] --adapter <ADAPTER> --service-id <SERVICE_ID> --version <VERSION>`                      |
+| `ts serve`                       | Linux + macOS | Serve the project locally through a target adapter                                               | `ts serve --adapter <ADAPTER>`                                                                                 |
+
 ## Install from source
 
 From the repository root, install the `ts` binary with the workspace Cargo alias:
@@ -71,6 +117,13 @@ fields to existing configs before relying on their overrides. Pass `--no-env`
 for file-only operation. See [Configuration](/guide/configuration#environment-variable-overrides-typed-cli)
 for migration and rollback guidance.
 
+`config diff`, `config push --dry-run`, and the confirmation preview shown by
+`config push` render resolved app-config values. Store-backed secret fields are
+key names at this stage, but deliberately inline values such as
+`trusted_client_ip.shared_secret` can appear verbatim. Use `--no-diff` for a
+push when terminal output or CI logs are not an approved place for inline
+configuration secrets; `--no-diff` does not change validation or publication.
+
 `config push` publishes a single EdgeZero `BlobEnvelope` containing the validated
 Trusted Server settings JSON. This blob model is intentional because full
 Trusted Server configs can exceed Fastly limits when split into one config-store
diff --git a/docs/guide/cloudflare.md b/docs/guide/cloudflare.md
new file mode 100644
index 000000000..73448d8cf
--- /dev/null
+++ b/docs/guide/cloudflare.md
@@ -0,0 +1,65 @@
+# Cloudflare Workers deployment
+
+The Cloudflare adapter runs the shared Trusted Server router in a Worker. The
+current runtime requires an explicit local or deployment-time bridge from the
+config that `ts config push` writes into KV to the nested
+`TRUSTED_SERVER_CONFIG` variable consumed at startup.
+
+## Support status
+
+| Adapter      | Release status | Health | Startup status | Startup health | Provider fan-out | Trusted-client-IP handling | Request normalization |
+| ------------ | -------------- | ------ | -------------- | -------------- | ---------------- | -------------------------- | --------------------- |
+| `cloudflare` | development    | absent | `500`          | no             | single           | outermost sanitize         | none                  |
+
+This row is the canonical status summary. Cloudflare has no
+`/health` route, supports one enabled auction provider, and returns 500 on
+every route when startup fails.
+
+## Verify the complete local handoff
+
+Install the Wrangler version pinned in `.tool-versions`, then run:
+
+```bash
+./scripts/smoke-cloudflare.sh
+```
+
+The smoke refuses an absent pin or a different Wrangler executable. It creates
+an isolated Worker manifest, maps the EdgeZero config store to
+`TRUSTED_SERVER_KV`, and runs `ts config push --adapter cloudflare --local`.
+It reads `trusted_server_config` back with `wrangler kv key get` using both the
+explicit binding and local mode. The returned envelope becomes the string
+value of `app_config` in a JSON object; that outer JSON is assigned to the
+`TRUSTED_SERVER_CONFIG` Worker variable. This double encoding is required by
+the current startup reader.
+
+The generated local Wrangler files define `handler_password`,
+`publisher_proxy_secret`, and `ec_passphrase` separately. The smoke launches
+`wrangler dev` once without the config binding and once for each omitted
+secret. Each case requires a 500 response and verifies the exact missing
+binding against Wrangler's runtime binding inventory. The positive publisher
+request must return 200, include the stub-origin sentinel, rewrite its origin
+URL to the Worker listener, and omit the original URL.
+
+The exit trap stops Wrangler and the stub origin and removes the isolated KV,
+generated Wrangler manifests, response captures, and logs. It does not modify
+the checked-in manifests.
+
+## Configure a deployed Worker
+
+Local `[vars]` are only for the isolated smoke. For a deployed Worker, obtain
+the validated envelope from the target KV namespace, construct the same nested
+`TRUSTED_SERVER_CONFIG` JSON, and configure it in the deployment environment.
+Store the three credential values with `wrangler secret put
+handler_password`, `wrangler secret put publisher_proxy_secret`, and `wrangler
+secret put ec_passphrase`; do not commit them to a Wrangler manifest. Deploy
+only after all four bindings are present.
+
+A successful `ts config push` alone does not configure this runtime: the
+Worker currently does not open `TRUSTED_SERVER_KV` during startup. Request-time
+store registries are also unwired, so EC KV lookup and key rotation are not
+available. The read-only `/_ts/admin/eids` diagnostic remains available.
+Forwarded client-IP headers are sanitized, but `[trusted_client_ip]` is not
+resolved. See the [API reference](./api-reference) for route-level behavior.
+
+Compare the [Fastly](./fastly), [Spin](./spin), and [Axum](./axum-dev)
+adapter journeys.
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 89dc43aea..d5ebc103f 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -69,6 +69,49 @@ resolved only while an instance builds runtime settings. An adapter can map the
 logical ID to a different physical name. For example, Fastly commonly maps
 `trusted_server_secrets` to physical store `ts_secrets`.
 
+Two accepted secret-shaped fields are deliberately different:
+
+- `trusted_client_ip.shared_secret` is an inline value in the app-config blob;
+  it is redacted by debug formatting but is not resolved from a secret store.
+- `tinybird.access_token_secret` is deprecated input. It is accepted for
+  migration, then discarded and omitted from serialized config; use
+  `tinybird.auction_token_secret` as the store key name instead.
+
+The four deprecated `secret_store` selectors under Tinybird, DataDome, its
+protection-test bypass, and S3 route authentication are also accepted and
+discarded. Store selection comes from the adapter's EdgeZero mapping.
+
+::: warning CLI output and inline secrets
+`ts config diff`, `ts config push --dry-run`, and the interactive push preview
+can print deliberately inline values. Use `ts config push --no-diff` when that
+output is not safe for the current terminal or CI log. The flag suppresses the
+diff; it does not move inline values to a secret store.
+:::
+
+The following table records the independent lifecycle, key-identity,
+serialization, runtime, and secret axes for every exceptional field:
+
+| Path                                                         | Lifecycle  | Key identity                        | Serialization | Runtime              | Secret handling          |
+| ------------------------------------------------------------ | ---------- | ----------------------------------- | ------------- | -------------------- | ------------------------ |
+| `AssetOriginAuth.s3_sig_v4`                                  | deprecated | alias of `AssetOriginAuth.s3_sigv4` | skipped       | deserialization only | none                     |
+| `DataDomeConfig.server_side_key_secret_name`                 | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `DataDomeConfig.server_side_key_secret_store`                | deprecated | canonical                           | skipped       | normalized away      | none                     |
+| `DataDomeProtectionTestBypassConfig.credential_secret_name`  | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `DataDomeProtectionTestBypassConfig.credential_secret_store` | deprecated | canonical                           | skipped       | normalized away      | none                     |
+| `Ec.passphrase`                                              | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `EcPartner.api_token`                                        | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `EcPartner.ts_pull_token`                                    | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `Handler.password`                                           | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `Publisher.proxy_secret`                                     | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `S3SigV4AuthConfig.access_key_id`                            | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `S3SigV4AuthConfig.secret_access_key`                        | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `S3SigV4AuthConfig.secret_store`                             | deprecated | canonical                           | skipped       | normalized away      | none                     |
+| `S3SigV4AuthConfig.session_token`                            | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `TinybirdSettings.access_token_secret`                       | deprecated | canonical                           | skipped       | normalized away      | accepted, then discarded |
+| `TinybirdSettings.auction_token_secret`                      | canonical  | canonical                           | serialized    | active               | store resolved           |
+| `TinybirdSettings.secret_store`                              | deprecated | canonical                           | skipped       | normalized away      | none                     |
+| `TrustedClientIpConfig.shared_secret`                        | canonical  | canonical                           | serialized    | active               | deliberately inline      |
+
 Prepare an initial reference-based deployment in this order:
 
 1. Create the physical store and configure its `trusted_server_secrets` mapping.
@@ -78,8 +121,16 @@ Prepare an initial reference-based deployment in this order:
 4. Run `ts config validate`, then `ts config push --adapter fastly`.
 5. Start or deploy instances after the store and pushed config are both ready.
 
-Changing a store value does not alter already-built state. Restart or redeploy
-instances when rotating static credentials.
+Migrate an existing deployment in this order:
+
+1. Populate the physical store mapped from `trusted_server_secrets` with the
+   existing credential values without printing them in shell history, logs, or
+   CI output.
+2. Replace each active credential value with a stable key name and remove the
+   legacy Tinybird, DataDome, and S3 `secret_store` selectors.
+3. Run `ts config validate`, then `ts config push --adapter fastly --no-diff`.
+4. Restart/redeploy instances as needed to load the new values. Rotation is
+   startup-scoped; changing a store value does not alter already-built state.
 
 Keep `publisher.proxy_secret` and `ec.passphrase` stable unless intentionally
 rotating signed URLs or EC identifiers. On Spin, the app-config blob is stored
@@ -141,18 +192,25 @@ fail and the service will return its startup-error response.
 
 ## Key Sections
 
-| Section               | Purpose                                      |
-| --------------------- | -------------------------------------------- |
-| `[publisher]`         | Domain, origin, proxy settings               |
-| `[trusted_client_ip]` | Authenticated client-IP forwarding           |
-| `[ec]`                | Edge Cookie (EC) ID generation               |
-| `[tester_cookie]`     | Optional tester-cookie endpoint              |
-| `[proxy]`             | Proxy SSRF allowlist and asset routes        |
-| `[cache]`             | Static/rehosted asset cache policy rules     |
-| `[image_optimizer]`   | Reusable Image Optimizer profile sets        |
-| `[request_signing]`   | Ed25519 request signing                      |
-| `[auction]`           | Auction orchestration                        |
-| `[integrations.*]`    | Partner integrations (Prebid, Next.js, etc.) |
+| Section                    | Purpose                                                                 |
+| -------------------------- | ----------------------------------------------------------------------- |
+| `[auction]`                | Auction orchestration, provider instances, bidder routes, and mediation |
+| `[cache]`                  | Static and rehosted asset cache policy                                  |
+| `[consent]`                | Consent interpretation, forwarding, and conflict resolution             |
+| `[creative_opportunities]` | Server-side page ad opportunities and templates                         |
+| `[debug]`                  | Explicit non-production diagnostics                                     |
+| `[ec]`                     | Edge Cookie identity, persistence, and partner sync                     |
+| `[[handlers]]`             | Ordered HTTP Basic-auth rules                                           |
+| `[image_optimizer]`        | Reusable Fastly Image Optimizer profiles                                |
+| `[integrations.*]`         | Typed partner and browser integration settings                          |
+| `[proxy]`                  | Proxy allowlist, TLS policy, and asset routes                           |
+| `[publisher]`              | Publisher domain, origin, and proxy signing key                         |
+| `[request_signing]`        | Outbound Ed25519 request signing and management-store IDs               |
+| `[response_headers]`       | Headers added to Trusted Server responses                               |
+| `[rewrite]`                | First-party URL rewrite exclusions                                      |
+| `[tester_cookie]`          | Optional tester-cookie endpoints                                        |
+| `[tinybird]`               | Direct Tinybird auction telemetry                                       |
+| `[trusted_client_ip]`      | Authenticated front-door client-IP forwarding                           |
 
 ## Example: Production Setup
 
@@ -630,6 +688,43 @@ TRUSTED_SERVER__EC__EC_STORE=ec_identity_store
 
 - Empty string
 
+## Consent Configuration
+
+`[consent]` controls request-local interpretation and forwarding of privacy
+signals. It does not create a second consent database. Set `consent_store` to a
+KV store name only when consent should persist with the EC identity graph.
+
+### `[consent]`
+
+| Field                                          | Type           | Default                     | Contract                                                    |
+| ---------------------------------------------- | -------------- | --------------------------- | ----------------------------------------------------------- |
+| `mode`                                         | String         | `"interpreter"`             | `interpreter` decodes signals; `proxy` forwards raw strings |
+| `check_expiration`                             | Boolean        | `true`                      | Check TCF timestamps                                        |
+| `max_consent_age_days`                         | Integer        | `395`                       | Clamped to `1..=3650`                                       |
+| `consent_store`                                | String or null | `null`                      | Optional KV store for EC-linked consent persistence         |
+| `gdpr.applies_in`                              | Array[String]  | EU/EEA and UK codes         | Observability only; does not synthesize consent             |
+| `us_states.privacy_states`                     | Array[String]  | Checked built-in state list | Jurisdictions with active comprehensive privacy laws        |
+| `us_privacy_defaults.notice_given`             | Boolean        | `true`                      | Publisher policy used for GPC-only requests                 |
+| `us_privacy_defaults.lspa_covered`             | Boolean        | `false`                     | Publisher LSPA posture                                      |
+| `us_privacy_defaults.gpc_implies_optout`       | Boolean        | `true`                      | Treat `Sec-GPC: 1` as sale opt-out                          |
+| `conflict_resolution.mode`                     | String         | `"restrictive"`             | `restrictive`, `newest`, or `permissive`                    |
+| `conflict_resolution.freshness_threshold_days` | Integer        | `30`                        | Age difference required by `newest`                         |
+
+```toml
+[consent]
+mode = "interpreter"
+check_expiration = true
+max_consent_age_days = 395
+
+[consent.conflict_resolution]
+mode = "restrictive"
+freshness_threshold_days = 30
+```
+
+`applies_in` and `privacy_states` are policy inputs. Review them against the
+publisher's operating jurisdictions instead of assuming the built-in lists are
+legal advice.
+
 ## Response Headers
 
 Custom headers added to all responses.
@@ -1198,6 +1293,32 @@ when_missing = "smart"
 
 See [Asset Routes](/guide/asset-routes) for request flow, S3 auth details, and Image Optimizer behavior.
 
+## Tinybird Configuration
+
+`[tinybird]` sends auction events directly to the Tinybird Events API. The
+emitter is active only when `enabled = true`; access-log emission is not wired.
+
+### `[tinybird]`
+
+| Field                  | Type           | Default                | Contract                                                           |
+| ---------------------- | -------------- | ---------------------- | ------------------------------------------------------------------ |
+| `enabled`              | Boolean        | `false`                | Enable auction telemetry                                           |
+| `api_host`             | String         | `""`                   | Required when enabled; regional host without scheme, port, or path |
+| `auction_dataset`      | String         | `"auction_events_raw"` | 1–128 ASCII letters, digits, or `_`                                |
+| `auction_token_secret` | String or null | `null`                 | Store key required when enabled; resolved value must be nonempty   |
+| `access_enabled`       | Boolean        | `false`                | Reserved; `true` fails startup because no emitter is wired         |
+| `access_dataset`       | String         | `"access_logs_raw"`    | Reserved access-log dataset name                                   |
+| `access_sample_rate`   | Number         | `0.0`                  | `0.0..=1.0`; reserved while access emission is disabled            |
+| `max_body_bytes`       | Integer        | `1048576`              | At least `1024` bytes                                              |
+
+`secret_store` and `access_token_secret` are deprecated compatibility inputs.
+Both are removed during normalization; neither reaches runtime or serialized
+output. New configurations use only `auction_token_secret`, whose value is
+resolved through `trusted_server_secrets`.
+
+The complete enabled example appears in
+[Tinybird auction telemetry](#tinybird-auction-telemetry).
+
 ## Cache Configuration
 
 Static and rehosted asset cache upgrades are operator-controlled. By default,
@@ -1319,8 +1440,27 @@ tracked in [#908](https://github.com/IABTechLab/trusted-server/issues/908).
 
 ## Integration Configurations
 
-Settings for built-in integrations (Prebid, Next.js, Osano, Permutive, Testlight). For other
-integrations (APS, Didomi, Lockr, GAM, etc.), see the relevant integration guides.
+Every deploy-validated integration ID is listed here. A section is optional
+unless its integration is enabled or a CLI workflow retains an explicit
+disabled stub.
+
+| Section                             | Reference                                                          |
+| ----------------------------------- | ------------------------------------------------------------------ |
+| `[integrations.adserver_mock]`      | [Ad Server Mock](/guide/integrations/adserver_mock)                |
+| `[integrations.aps]`                | [APS](/guide/integrations/aps)                                     |
+| `[integrations.datadome]`           | [DataDome](/guide/integrations/datadome)                           |
+| `[integrations.didomi]`             | [Didomi](/guide/integrations/didomi)                               |
+| `[integrations.google_tag_manager]` | [Google Tag Manager](/guide/integrations/google_tag_manager)       |
+| `[integrations.gpt]`                | [GPT](/guide/integrations/gpt)                                     |
+| `[integrations.gpt_diagnostics]`    | [GPT diagnostics](/guide/integrations/gpt-diagnostics)             |
+| `[integrations.js_asset_proxy]`     | [JS Asset Proxy](#js-asset-proxy-integration) (no dedicated guide) |
+| `[integrations.lockr]`              | [lockr](/guide/integrations/lockr)                                 |
+| `[integrations.nextjs]`             | [Next.js](/guide/integrations/nextjs)                              |
+| `[integrations.osano]`              | [Osano](/guide/integrations/osano)                                 |
+| `[integrations.permutive]`          | [Permutive](/guide/integrations/permutive)                         |
+| `[integrations.prebid]`             | [Prebid](/guide/integrations/prebid)                               |
+| `[integrations.sourcepoint]`        | [Sourcepoint](/guide/integrations/sourcepoint)                     |
+| `[integrations.testlight]`          | [Testlight](/guide/integrations/testlight)                         |
 
 ### Common Fields
 
@@ -1331,24 +1471,194 @@ apply when the integration section exists in `trusted-server.toml`.
 | --------- | ------- | ------------------------------ |
 | `enabled` | Boolean | Enable/disable the integration |
 
+### Ad Server Mock Integration
+
+**Section**: `[integrations.adserver_mock]`
+
+This integration is the optional auction mediator selected by
+`auction.mediator = "adserver_mock"`; it is not an OpenRTB provider.
+
+| Field                  | Type           | Default  | Contract                                          |
+| ---------------------- | -------------- | -------- | ------------------------------------------------- |
+| `enabled`              | Boolean        | `false`  | Enable mediator registration                      |
+| `endpoint`             | URL            | Required | Mediation service URL                             |
+| `timeout_ms`           | Integer        | `500`    | `1..=60000` milliseconds                          |
+| `price_floor`          | Number or null | `null`   | Optional minimum accepted CPM                     |
+| `context_query_params` | Object         | `{}`     | Maps admitted auction-context keys to query names |
+
+### APS Browser Integration
+
+**Section**: `[integrations.aps]`
+
+| Field            | Type    | Default            | Contract                               |
+| ---------------- | ------- | ------------------ | -------------------------------------- |
+| `enabled`        | Boolean | `false`            | Enable browser-side APS behavior       |
+| `rendering_mode` | String  | `"trusted_server"` | `trusted_server` or `publisher_native` |
+
+Server endpoint, timeout, account, inventory, and debug settings belong to an
+`aps` provider and its `profile_config`, not this browser section. See
+[APS](/guide/integrations/aps).
+
+### DataDome Integration
+
+**Section**: `[integrations.datadome]`
+
+The [DataDome guide](/guide/integrations/datadome) explains request behavior
+and exclusion-rule syntax. This table covers every canonical top-level field:
+
+| Field                                  | Type           | Default                          | Contract                                                        |
+| -------------------------------------- | -------------- | -------------------------------- | --------------------------------------------------------------- |
+| `enabled`                              | Boolean        | `false`                          | Enable DataDome registration                                    |
+| `sdk_origin`                           | URL            | `https://js.datadome.co`         | Browser SDK origin                                              |
+| `api_origin`                           | URL            | `https://api-js.datadome.co`     | Browser signal API origin                                       |
+| `cache_ttl_seconds`                    | Integer        | `3600`                           | `60..=86400` seconds                                            |
+| `rewrite_sdk`                          | Boolean        | `true`                           | Rewrite matching SDK URLs                                       |
+| `enable_protection`                    | Boolean        | `false`                          | Call the Protection API before route matching                   |
+| `server_side_key_secret_name`          | String or null | `null`                           | Secret-store key required when protection is enabled            |
+| `protection_api_origin`                | URL            | `https://api-fastly.datadome.co` | Protection API origin                                           |
+| `timeout_ms`                           | Integer        | `1500`                           | `1..=10000` milliseconds                                        |
+| `protection_excluded_methods`          | Array[String]  | `["OPTIONS"]`                    | Methods that bypass protection                                  |
+| `protection_excluded_asns`             | Array[Integer] | `[]`                             | Client ASNs that bypass protection                              |
+| `protection_excluded_ip_cidrs`         | Array[String]  | `[]`                             | Inline client-IP CIDRs that bypass protection                   |
+| `protection_excluded_ip_cidr_sources`  | Array[Object]  | `[]`                             | Config-store sources of client-IP CIDRs that bypass protection  |
+| `protection_ip_list_cache_ttl_seconds` | Integer        | `300`                            | `1..=86400` seconds                                             |
+| `protection_exclusion_rules`           | Array[Object]  | Static-asset path-regex rule     | Ordered typed exclusion rules                                   |
+| `protection_test_bypass`               | Object or null | `null`                           | Access-controlled test bypass; disabled when present by default |
+| `enable_graphql_support`               | Boolean        | `false`                          | Reserved; `true` is accepted but ignored in v1                  |
+| `client_side_key`                      | String         | `""`                             | Key used for browser-tag injection                              |
+| `inject_client_side_tag`               | Boolean        | `true`                           | Inject only when `client_side_key` is nonempty                  |
+| `client_side_tag_url`                  | String         | `/integrations/datadome/tags.js` | Root-relative or HTTPS injection URL                            |
+| `client_side_configuration`            | JSON value     | `{ "ajaxListenerPath": true }`   | Value assigned to `window.ddoptions`                            |
+
+Each `protection_excluded_ip_cidr_sources` item requires `key` and defaults
+`config_store` to `datadome-ip-bypass`. Each
+`protection_exclusion_rules` item requires `id` (legacy alias `name`), defaults
+`enabled` to `true`, defaults `methods` to every method, and selects one typed
+matcher: `path_exact`, `path_prefix`, `path_regex`,
+`query_param_non_empty`, `asn`, `ip_cidr`, or `ip_cidr_source`.
+
+When `protection_test_bypass` is present, its `enabled` field defaults to
+`false`; `credential_secret_name` identifies the secret-store key and becomes
+required only when the bypass is enabled. The resolved credential must contain
+at least 32 bytes.
+
+The deprecated `server_side_key_secret_store` and nested
+`credential_secret_store` inputs are accepted and discarded. Do not add them
+to new configurations.
+
+### Didomi Integration
+
+**Section**: `[integrations.didomi]`
+
+| Field        | Type           | Default                          | Contract                                                            |
+| ------------ | -------------- | -------------------------------- | ------------------------------------------------------------------- |
+| `enabled`    | Boolean        | `true`                           | Enable the reverse proxy when the section exists                    |
+| `proxy_path` | String or null | `/integrations/didomi/consent`   | No trailing slash, repeated slash, dot segment, or unsafe character |
+| `sdk_origin` | URL            | `https://sdk.privacy-center.org` | SDK upstream                                                        |
+| `api_origin` | URL            | `https://api.privacy-center.org` | API upstream                                                        |
+
+See [Didomi](/guide/integrations/didomi) for the routed endpoint shapes.
+
+### Google Tag Manager Integration
+
+**Section**: `[integrations.google_tag_manager]`
+
+| Field                  | Type    | Default                            | Contract                                            |
+| ---------------------- | ------- | ---------------------------------- | --------------------------------------------------- |
+| `enabled`              | Boolean | `false`                            | Enable tag-gateway routes and rewriting             |
+| `container_id`         | String  | Required                           | `GTM-` followed by 4–20 uppercase letters or digits |
+| `upstream_url`         | URL     | `https://www.googletagmanager.com` | Script upstream                                     |
+| `cache_max_age`        | Integer | `900`                              | `60..=86400` seconds                                |
+| `max_beacon_body_size` | Integer | `65536`                            | `1024..=1048576` bytes                              |
+
+See [Google Tag Manager](/guide/integrations/google_tag_manager).
+
+### GPT Integration
+
+**Section**: `[integrations.gpt]`
+
+| Field                     | Type           | Default                 | Contract                                               |
+| ------------------------- | -------------- | ----------------------- | ------------------------------------------------------ |
+| `enabled`                 | Boolean        | `true`                  | Enable GPT when the section exists                     |
+| `gam_attribution_enabled` | Boolean        | `false`                 | Add page-level `ts=true` targeting                     |
+| `script_url`              | URL            | Google's secure GPT URL | Bootstrap source                                       |
+| `cache_ttl_seconds`       | Integer        | `3600`                  | `60..=86400` seconds                                   |
+| `rewrite_script`          | Boolean        | `true`                  | Rewrite matching GPT script URLs                       |
+| `slim_prebid_url`         | String or null | `null`                  | Optional tsjs-prebid bundle loaded after `window.load` |
+
+See [GPT](/guide/integrations/gpt).
+
+### GPT Diagnostics Integration
+
+**Section**: `[integrations.gpt_diagnostics]`
+
+The only field is `enabled`, a Boolean that defaults to `false`. When enabled,
+the standalone diagnostics tag is available, but individual browser sessions
+still require the activation flow in [GPT diagnostics](/guide/integrations/gpt-diagnostics).
+
+### JS Asset Proxy Integration
+
+**Section**: `[integrations.js_asset_proxy]`
+
+Serves explicitly configured third-party JavaScript assets from first-party
+paths. Each asset maps one exact publisher-facing path to one exact HTTPS
+upstream URL and can independently enable proxying, disable proxying, or block
+matching script tags in publisher HTML. There is no dedicated integration
+guide; the registered routes appear in the
+[API reference](/guide/api-reference#integration-endpoints).
+
+| Field               | Type    | Default | Contract                                      |
+| ------------------- | ------- | ------- | --------------------------------------------- |
+| `enabled`           | Boolean | `false` | Enable asset proxying and HTML rewriting      |
+| `cache_ttl_seconds` | Integer | None    | Optional downstream cache TTL for every asset |
+| `assets`            | Array   | `[]`    | Asset mappings; required when enabled         |
+
+Each `[[integrations.js_asset_proxy.assets]]` entry:
+
+| Field               | Type    | Default   | Contract                                                  |
+| ------------------- | ------- | --------- | --------------------------------------------------------- |
+| `path`              | String  | Required  | Exact first-party request path served by Trusted Server   |
+| `origin_url`        | String  | Required  | Exact upstream JavaScript URL fetched and match-rewritten |
+| `proxy`             | String  | `enabled` | `enabled`, `disabled`, or `blocked` (removes script tags) |
+| `cache_ttl_seconds` | Integer | None      | Optional per-asset downstream cache TTL override          |
+
+### lockr Integration
+
+**Section**: `[integrations.lockr]`
+
+| Field               | Type            | Default                                             | Contract                             |
+| ------------------- | --------------- | --------------------------------------------------- | ------------------------------------ |
+| `enabled`           | Boolean         | `true`                                              | Enable lockr when the section exists |
+| `app_id`            | String          | Required                                            | Nonempty lockr application ID        |
+| `api_endpoint`      | URL             | `https://identity.loc.kr`                           | API origin                           |
+| `sdk_url`           | URL             | `https://aim.loc.kr/identity-lockr-trust-server.js` | SDK source                           |
+| `cache_ttl_seconds` | Integer         | `3600`                                              | `60..=86400` seconds                 |
+| `rewrite_sdk`       | Boolean         | `true`                                              | Rewrite matching lockr SDK URLs      |
+| `rewrite_sdk_host`  | Boolean or null | `null`                                              | Deprecated compatibility input       |
+| `origin_override`   | URL or null     | `null`                                              | Optional upstream `Origin` override  |
+
+See [lockr](/guide/integrations/lockr).
+
 ### Prebid Integration
 
 `[integrations.prebid]` owns browser behavior only. Server endpoint, provider
 timeout, routing, profile debug/test controls, consent forwarding, bidder-param
 overrides, and notification suppression belong under `[auction]`.
 
-| Browser field                         | Type          | Default                                                                | Description                                                                    |
-| ------------------------------------- | ------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
-| `enabled`                             | Boolean       | `true`                                                                 | Enable browser bundle injection, interception, and the `trustedServer` adapter |
-| `account_id`                          | String        | `None`                                                                 | Optional account value injected into browser Prebid configuration              |
-| `timeout_ms`                          | Integer       | `1000`                                                                 | Browser Prebid.js timeout; independent of every server provider timeout        |
-| `debug`                               | Boolean       | `false`                                                                | Browser Prebid.js debug flag; independent of server profile debug              |
-| `client_side_bidders`                 | Array[String] | `[]`                                                                   | Bidders kept on native browser adapters                                        |
-| `excluded_gam_ad_unit_path_suffixes`  | Array[String] | `[]`                                                                   | GAM suffixes excluded from Trusted Server refresh auctions                     |
-| `script_patterns`                     | Array[String] | `["/prebid.js", "/prebid.min.js", "/prebidjs.js", "/prebidjs.min.js"]` | Publisher Prebid script paths intercepted by Trusted Server                    |
-| `external_bundle_url`                 | String        | Required when enabled                                                  | HTTPS publisher-specific Prebid.js bundle URL                                  |
-| `external_bundle_sha256` / `*_sri`    | String        | `None`                                                                 | Optional bundle integrity and cache metadata                                   |
-| `bundle.adapters` / `user_id_modules` | Array[String] | CLI selection                                                          | Inputs used by `ts prebid bundle`                                              |
+| Browser field                        | Type                  | Default                                                                | Contract                                                                       |
+| ------------------------------------ | --------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
+| `enabled`                            | Boolean               | `true`                                                                 | Enable browser bundle injection, interception, and the `trustedServer` adapter |
+| `account_id`                         | String or null        | `null`                                                                 | Optional account value injected into browser Prebid configuration              |
+| `timeout_ms`                         | Integer               | `1000`                                                                 | Browser Prebid.js timeout; independent of every server provider timeout        |
+| `debug`                              | Boolean               | `false`                                                                | Browser Prebid.js debug flag; independent of server profile debug              |
+| `script_patterns`                    | Array[String]         | `["/prebid.js", "/prebid.min.js", "/prebidjs.js", "/prebidjs.min.js"]` | Publisher Prebid script paths intercepted by Trusted Server                    |
+| `external_bundle_url`                | String or null        | `null`                                                                 | Required when enabled; absolute HTTPS URL with an allowlisted proxy host       |
+| `external_bundle_sha256`             | String or null        | `null`                                                                 | Optional 64-character hexadecimal SHA-256                                      |
+| `external_bundle_sri`                | String or null        | `null`                                                                 | Optional space-separated `sha256`, `sha384`, or `sha512` integrity tokens      |
+| `client_side_bidders`                | Array[String]         | `[]`                                                                   | Bidders kept on native browser adapters                                        |
+| `excluded_gam_ad_unit_path_suffixes` | Array[String]         | `[]`                                                                   | Trimmed, non-root, slash-prefixed GAM path suffixes                            |
+| `bundle.adapters`                    | Array[String]         | `[]`                                                                   | Prebid.js bidder adapters used only by `ts prebid bundle`                      |
+| `bundle.user_id_modules`             | Array[String] or null | `null`                                                                 | Optional user-ID modules used only by `ts prebid bundle`                       |
 
 Server-side bidder codes are derived from validated `[auction.bidders.*]`
 routes and injected into the browser. There is no second server bidder list in
@@ -1438,11 +1748,11 @@ win on conflicts.
 
 **Section**: `[integrations.nextjs]`
 
-| Field                        | Type          | Default                 | Description                   |
-| ---------------------------- | ------------- | ----------------------- | ----------------------------- |
-| `enabled`                    | Boolean       | `false`                 | Enable Next.js integration    |
-| `rewrite_attributes`         | Array[String] | `["href","link","url"]` | Attributes to rewrite         |
-| `max_combined_payload_bytes` | Integer       | `10485760`              | Max combined RSC payload size |
+| Field                        | Type          | Default                   | Contract                                           |
+| ---------------------------- | ------------- | ------------------------- | -------------------------------------------------- |
+| `enabled`                    | Boolean       | `false`                   | Enable Next.js integration                         |
+| `rewrite_attributes`         | Array[String] | `["href", "link", "url"]` | Nonempty set of structured payload keys to rewrite |
+| `max_combined_payload_bytes` | Integer       | `10485760`                | Maximum combined RSC payload size in bytes         |
 
 **Example**:
 
@@ -1489,16 +1799,16 @@ The Osano mirror runs in the browser, so consent cookies it writes are available
 
 **Section**: `[integrations.permutive]`
 
-| Field                     | Type    | Default                                | Description                      |
-| ------------------------- | ------- | -------------------------------------- | -------------------------------- |
-| `enabled`                 | Boolean | `true`                                 | Enable Permutive integration     |
-| `organization_id`         | String  | Required                               | Permutive organization ID        |
-| `workspace_id`            | String  | Required                               | Permutive workspace ID           |
-| `project_id`              | String  | `""`                                   | Permutive project ID             |
-| `api_endpoint`            | String  | `https://api.permutive.com`            | Permutive API URL                |
-| `secure_signals_endpoint` | String  | `https://secure-signals.permutive.app` | Secure signals URL               |
-| `cache_ttl_seconds`       | Integer | `3600`                                 | Cache TTL in seconds             |
-| `rewrite_sdk`             | Boolean | `true`                                 | Rewrite Permutive SDK references |
+| Field                     | Type    | Default                                | Contract                                     |
+| ------------------------- | ------- | -------------------------------------- | -------------------------------------------- |
+| `enabled`                 | Boolean | `true`                                 | Enable Permutive integration                 |
+| `organization_id`         | String  | Required                               | Nonempty Permutive organization ID           |
+| `workspace_id`            | String  | Required                               | Nonempty Permutive workspace ID              |
+| `project_id`              | String  | `""`                                   | Optional project ID; reserved for future use |
+| `api_endpoint`            | URL     | `https://api.permutive.com`            | Permutive API URL                            |
+| `secure_signals_endpoint` | URL     | `https://secure-signals.permutive.app` | Secure Signals URL                           |
+| `cache_ttl_seconds`       | Integer | `3600`                                 | `60..=86400` seconds                         |
+| `rewrite_sdk`             | Boolean | `true`                                 | Rewrite Permutive SDK references             |
 
 **Example**:
 
@@ -1514,17 +1824,31 @@ cache_ttl_seconds = 7200
 rewrite_sdk = true
 ```
 
+### Sourcepoint Integration
+
+**Section**: `[integrations.sourcepoint]`
+
+| Field               | Type           | Default                        | Contract                                                          |
+| ------------------- | -------------- | ------------------------------ | ----------------------------------------------------------------- |
+| `enabled`           | Boolean        | `false`                        | Enable Sourcepoint proxying and rewriting                         |
+| `rewrite_sdk`       | Boolean        | `true`                         | Rewrite matching Sourcepoint URLs                                 |
+| `cdn_origin`        | URL            | `https://cdn.privacy-mgmt.com` | HTTP(S) URL whose host is exactly `cdn.privacy-mgmt.com`          |
+| `auth_cookie_name`  | String or null | `null`                         | 1–64 letters, digits, `_`, or `-`; built-in cookies need no entry |
+| `cache_ttl_seconds` | Integer        | `3600`                         | `60..=86400` seconds                                              |
+
+See [Sourcepoint](/guide/integrations/sourcepoint).
+
 ### Testlight Integration
 
 **Section**: `[integrations.testlight]`
 
-| Field             | Type    | Default                                     | Description                         |
-| ----------------- | ------- | ------------------------------------------- | ----------------------------------- |
-| `enabled`         | Boolean | `true`                                      | Enable Testlight integration        |
-| `endpoint`        | String  | Required                                    | Testlight auction endpoint          |
-| `timeout_ms`      | Integer | `1000`                                      | Request timeout in milliseconds     |
-| `shim_src`        | String  | `/static/tsjs=tsjs-unified.min.js?v=<hash>` | Script source for testlight shim    |
-| `rewrite_scripts` | Boolean | `false`                                     | Rewrite Testlight script references |
+| Field             | Type    | Default                            | Contract                            |
+| ----------------- | ------- | ---------------------------------- | ----------------------------------- |
+| `enabled`         | Boolean | `false`                            | Enable Testlight integration        |
+| `endpoint`        | URL     | Required                           | Testlight auction endpoint          |
+| `timeout_ms`      | Integer | `1000`                             | `10..=60000` milliseconds           |
+| `shim_src`        | String  | `/static/tsjs=tsjs-unified.min.js` | Nonempty script source for the shim |
+| `rewrite_scripts` | Boolean | `false`                            | Rewrite Testlight script references |
 
 **Example**:
 
@@ -1694,6 +2018,28 @@ timeout_ms = 500
 | `profile_config` | No       | `{}`            | Typed object owned by the selected profile                    |
 | `notifications`  | No       | No suppression  | Common `nurl`/`burl` suppression after response normalization |
 
+### Profile configuration
+
+The table reflects the typed profile schemas. `Required` refers to the selected
+profile's `profile_config` object, not to the provider wrapper.
+
+| Profile         | Field                      | Required | Default | Provider timeout default | Constraints                                                                                                      |
+| --------------- | -------------------------- | -------- | ------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------- |
+| `aps`           | `account_id`               | Yes      | —       | `800 ms`                 | String or integer; trimmed, nonempty, at most 1024 bytes                                                         |
+| `aps`           | `allow_script_creatives`   | No       | `false` | `800 ms`                 | Script creatives are ineligible unless enabled                                                                   |
+| `aps`           | `debug`                    | No       | `false` | `800 ms`                 | May expose unredacted request and response data                                                                  |
+| `aps`           | `inventory_domain`         | No       | `None`  | `800 ms`                 | DNS name, at most 253 bytes; configure with inventory_page_origin                                                |
+| `aps`           | `inventory_page_origin`    | No       | `None`  | `800 ms`                 | HTTPS origin without credentials, port, path, query, or fragment; host must equal or be beneath inventory_domain |
+| `prebid-server` | `bid_param_override_rules` | No       | `[]`    | `1000 ms`                | Ordered exact-match rules; at least one matcher and a nonempty set object                                        |
+| `prebid-server` | `bid_param_overrides`      | No       | `{}`    | `1000 ms`                | Per-bidder nonempty shallow-merge objects                                                                        |
+| `prebid-server` | `bid_param_zone_overrides` | No       | `{}`    | `1000 ms`                | Per-bidder, per-zone nonempty shallow-merge objects                                                              |
+| `prebid-server` | `consent_forwarding`       | No       | `both`  | `1000 ms`                | `openrtb_only`, `cookies_only`, or `both`                                                                        |
+| `prebid-server` | `debug`                    | No       | `false` | `1000 ms`                | Includes upstream exchange diagnostics                                                                           |
+| `prebid-server` | `debug_query_params`       | No       | `None`  | `1000 ms`                | Optional legacy page-URL query fragment                                                                          |
+| `prebid-server` | `test_mode`                | No       | `false` | `1000 ms`                | Sets OpenRTB `test = 1`                                                                                          |
+| `standard`      | `imp_ext`                  | No       | `{}`    | Auction timeout          | JSON object; at most 16384 bytes, depth 8, and 256 keys per object                                               |
+| `standard`      | `request_ext`              | No       | `{}`    | Auction timeout          | JSON object; at most 16384 bytes, depth 8, and 256 keys per object; `trusted_server` is reserved                 |
+
 Timeout defaults are 1000 ms for `prebid-server`, 800 ms for `aps`, and the
 auction timeout for `standard`. An explicit provider timeout overrides the
 profile default. Runtime uses `min(provider timeout, auction time remaining)`
@@ -1717,8 +2063,9 @@ exact ID `trustedServer`. Browser `trustedServer.bidderParams` accepts at most
 
 For the `standard` profile, `profile_config.request_ext` and `imp_ext` must be
 JSON objects. Each object is limited to 16 KiB serialized, eight container
-levels, and 256 keys at any one object level. Reserved driver, profile, and
-signing fields cannot be overwritten.
+levels, and 256 keys at any one object level. Within `request_ext`, the
+`trusted_server` member is reserved and cannot be overwritten. `imp_ext` has no
+reserved-member guard in the current implementation.
 
 Common notification suppression uses exact returned OpenRTB seat values, not
 bidder route IDs:
@@ -2088,6 +2435,38 @@ no slot at all, so no template is rendered for it.
 Startup validation rejects a malformed template: an unknown placeholder (e.g.
 `{oops}`), an unmatched or nested `{`, a stray `}`, or an empty `gam_unit_path`.
 
+## Debug Configuration
+
+Every debug switch defaults to `false`. These controls expose request,
+auction, TLS, or creative data and are for controlled non-production use only.
+
+### `[debug]`
+
+| Field                                                     | Type          | Default                                | Contract                                                         |
+| --------------------------------------------------------- | ------------- | -------------------------------------- | ---------------------------------------------------------------- |
+| `ja4_endpoint_enabled`                                    | Boolean       | `false`                                | Expose `GET /_ts/debug/ja4` on Fastly                            |
+| `auction_html_comment`                                    | Boolean       | `false`                                | Insert an auction diagnostic comment before `</body>`            |
+| `inject_adm_for_testing`                                  | Boolean       | `false`                                | Enable the direct GAM-replace test path and raw `debug_bid` data |
+| `auction_html_comment_options.include_provider_responses` | Boolean       | `true`                                 | Include provider response summaries                              |
+| `auction_html_comment_options.include_mediator_response`  | Boolean       | `true`                                 | Include mediator response summaries                              |
+| `auction_html_comment_options.include_bids`               | Boolean       | `true`                                 | Include provider bid arrays                                      |
+| `auction_html_comment_options.metadata_keys`              | Array[String] | `error_type`, `http_status`, `message` | Must be a subset of this fixed allowlist                         |
+| `auction_html_comment_options.verbosity`                  | String        | `"redacted"`                           | `redacted`, `upstream`, or `full`                                |
+| `auction_html_comment_options.format`                     | String        | `"compact"`                            | `compact` or `pretty`                                            |
+
+The default options table is omitted from serialized config for rollback
+compatibility. A non-default table is serialized and therefore requires every
+running binary to understand it. `upstream` and `full` can expose
+identity-bearing provider data; `inject_adm_for_testing` carries raw creative
+markup. Do not enable them in production.
+
+```toml
+[debug]
+ja4_endpoint_enabled = false
+auction_html_comment = false
+inject_adm_for_testing = false
+```
+
 ## Fastly Runtime Config Store
 
 After the EdgeZero cutover, the Fastly adapter always dispatches through the
@@ -2265,16 +2644,12 @@ trusted-server.dev.toml      # Development overrides
 - Rerun `ts config push` after changing a deploy-time override
 - Try explicit string: `VARIABLE='value'` not `VARIABLE=value`
 
-### Debug Configuration
-
-**Print Loaded Config** (test only):
+### Inspect Configuration Inputs
 
-```rust
-use trusted_server_core::settings_data::get_settings;
-
-let settings = get_settings()?;
-println!("{:#?}", settings);
-```
+Runtime adapters load the app-config envelope with
+`get_settings_from_config_store` from the `trusted_server_core::settings_data`
+module. For a source file or local fixture, use `Settings::from_toml`; there is
+no process-global settings accessor.
 
 **Check Environment**:
 
diff --git a/docs/guide/creative-processing.md b/docs/guide/creative-processing.md
index 24e8dc0c3..10dcb62d5 100644
--- a/docs/guide/creative-processing.md
+++ b/docs/guide/creative-processing.md
@@ -791,41 +791,24 @@ The Trusted Server JavaScript (TSJS) library is automatically injected:
 
 ```html
 <script
-  async
-  src="/static/tsjs-core.min.js"
-  data-tsjs-integration="core"
+  src="/static/tsjs=tsjs-unified.min.js?v=<hash>"
+  id="trustedserver-js"
 ></script>
 ```
 
 **Timing**: Injected **once per HTML response** before any other scripts.
 
-### Integration Bundles
+### Integration bundles
 
-Integrations can request additional bundles:
+The integration registry selects TSJS modules by enabled integration ID. A
+registered ID with a compiled module is included in the immediate unified
+bundle unless its builder calls `.with_deferred_js()`; deferred modules are
+served separately as `/static/tsjs=tsjs-<id>.min.js`. Builders can call
+`.without_js()` when the Rust integration must not select a TSJS module.
 
-```rust
-IntegrationRegistration::builder("my_integration")
-    .with_asset("my_integration")  // Requests tsjs-my_integration.min.js
-    .build()
-```
-
-**Result**:
-
-```html
-<head>
-  <script
-    async
-    src="/static/tsjs-core.min.js"
-    data-tsjs-integration="core"
-  ></script>
-  <script
-    async
-    src="/static/tsjs-my_integration.min.js"
-    data-tsjs-integration="my_integration"
-  ></script>
-  <!-- Rest of head content -->
-</head>
-```
+The always-present `creative` module and all immediate integration modules are
+served through `/static/tsjs=tsjs-unified.min.js`. Trusted Server does not
+accept an arbitrary asset name from an integration registration.
 
 ### Bundle Types
 
diff --git a/docs/guide/edgezero.md b/docs/guide/edgezero.md
new file mode 100644
index 000000000..30d56856b
--- /dev/null
+++ b/docs/guide/edgezero.md
@@ -0,0 +1,76 @@
+# EdgeZero Lifecycle and Stores
+
+EdgeZero is the deployment and configuration layer used by the `ts` CLI.
+The repository's `edgezero.toml` declares one application, three logical
+stores, and the Fastly, Axum, Cloudflare, and Spin adapter commands.
+
+## Lifecycle
+
+Use `ts config init` to create a file, edit the generated
+`trusted-server.toml`, and run `ts config validate` before any platform
+write. `ts config diff --adapter ADAPTER` compares the validated local
+configuration with the selected platform value. `ts config push --adapter
+ADAPTER` writes it. Build, serve, deploy, health-check, rollback, and active
+version operations use the adapter commands declared in `edgezero.toml`.
+
+Configuration is startup state, not a live control plane. A successful push
+does not change a running instance until the target's restart or deployment
+path loads that value. Use `--staging` only with the corresponding staging
+deployment flow: it writes `LOGICAL_ID_staging` in the same physical store,
+while production continues to read the ordinary logical key.
+
+## Logical and physical stores
+
+The manifest declares portable logical IDs:
+
+| Kind          | Logical ID               |
+| ------------- | ------------------------ |
+| KV            | `trusted_server_kv`      |
+| Configuration | `trusted_server_config`  |
+| Secrets       | `trusted_server_secrets` |
+
+An adapter maps those IDs to platform resources. The runtime-facing
+`StoreName` used for reads and the management-facing `StoreId` used for
+writes are deliberately distinct types. Environment mappings such as
+`EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME` may change the
+physical store name without changing application configuration.
+
+Fastly binds its stores in `fastly.toml`. Axum uses isolated local state for
+development. Cloudflare maps the configuration value through its Worker
+binding. Spin resolves the manifest mapping and writes supported local
+key-value backends. Consult the adapter guide before assuming that a declared
+logical store is wired for runtime reads on every target.
+
+## Blob and chunk flow
+
+`config push` serializes validated settings into one EdgeZero
+`BlobEnvelope`. Store-backed settings contain secret key names, not secret
+values; the adapter resolves those keys from the logical secret store during
+startup.
+
+When a Fastly envelope exceeds one Config Store entry, the writer stores
+bounded chunks and replaces the root value with a versioned
+`fastly_config_chunks` pointer. Startup verifies each chunk's declared
+length and SHA-256 and then verifies the reconstructed envelope. A missing,
+oversized, reordered, or modified chunk fails configuration loading.
+
+`ts config gc --adapter fastly` previews orphaned chunks by default. An
+actual deletion requires `--yes --older-than WINDOW`. The age assertion
+applies to the whole physical store, not one root key; verify the reported
+store before deletion, especially when using `--store` or `--no-env`.
+
+## Safe operator sequence
+
+1. Put required secret values in the physical store mapped from
+   `trusted_server_secrets`.
+2. Run `ts config validate`.
+3. Review `ts config diff --adapter ADAPTER`; use `--no-diff` when
+   deliberately inline configuration must not appear in logs.
+4. Run `ts config push --adapter ADAPTER`.
+5. Start or deploy the adapter and verify a non-health publisher route. A
+   healthy endpoint alone may not prove that application configuration loaded.
+
+See [Configuration](/guide/configuration) for the field contract, the
+[CLI guide](/guide/cli) for exact command help, and
+[deployment guides](/guide/integrations-overview#adapter-support) for target
+behavior.
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index 0f7fd26bc..3b3fe65ed 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -8,7 +8,7 @@ Common errors, their causes, and solutions when working with Trusted Server.
 - [Runtime Errors](#runtime-errors)
 - [Integration Errors](#integration-errors)
 - [Request Signing Errors](#request-signing-errors)
-- [Build & Deployment Errors](#build--deployment-errors)
+- [Build & Deployment Errors](#build-deployment-errors)
 
 ---
 
@@ -606,10 +606,10 @@ npm ci
 npm run build
 ```
 
-3. Check for TypeScript errors:
+3. Run the TypeScript-aware ESLint checks:
 
 ```bash
-npm run type-check
+npm run lint
 ```
 
 4. Skip TSJS build temporarily:
diff --git a/docs/guide/fastly.md b/docs/guide/fastly.md
index f63b4f627..bc1174033 100644
--- a/docs/guide/fastly.md
+++ b/docs/guide/fastly.md
@@ -2,6 +2,17 @@
 
 This guide covers setting up your Fastly account and Compute service for Trusted Server.
 
+## Support status
+
+| Adapter  | Release status | Health     | Startup status | Startup health | Provider fan-out | Trusted-client-IP handling     | Request normalization |
+| -------- | -------------- | ---------- | -------------- | -------------- | ---------------- | ------------------------------ | --------------------- |
+| `fastly` | production     | pre router | `500`          | yes            | multiple         | entry-point resolve + sanitize | none                  |
+
+The row above summarizes the
+[adapter-support contract](./api-reference#adapter-and-startup-support). A healthy
+response does not prove that configuration loaded: Fastly serves `/health`
+before it constructs the application.
+
 ## Create a Fastly Account
 
 1. Go to [manage.fastly.com](https://manage.fastly.com) and create an account if you don't have one
@@ -345,9 +356,41 @@ fastly resource-link list --service-id <service-id> --version <active-version>
 
 If EC sync returns `kv_unavailable` or identify responses are degraded, first check that the identity store is present and linked to the active version. Legacy partner/consent KV bindings can be removed once no deployment-specific tooling depends on them.
 
+## Verify the complete local handoff
+
+Run the repository smoke from a clean shell:
+
+```bash
+./scripts/smoke-fastly.sh
+```
+
+The script creates an isolated application config, applies its publisher-origin
+overrides, and runs strict validation. It then executes `ts config push
+--adapter fastly --local`, adds all three required entries to
+`[local_server.secret_stores.ts_secrets]`, and starts `fastly compute serve`
+through Viceroy. The required keys are `handler_password`,
+`publisher_proxy_secret`, and `ec_passphrase`.
+
+The check deliberately proves both halves of startup. With no config entry, it
+requires `/health` to return 200 while the publisher route returns 500 with the
+missing `trusted_server_config` diagnostic. It then removes each required
+secret independently and requires the corresponding setting path to fail.
+Finally, the publisher request must return 200, retain the stub-origin
+sentinel, rewrite an origin URL to the Fastly listener, and omit the original
+URL. A green health response cannot satisfy that final assertion.
+
+The script copies `edgezero.toml` and `fastly.toml` into a per-run temporary
+project before pushing local configuration or adding synthetic secrets. The
+tracked manifests remain untouched, including when smoke runs overlap. Its trap
+stops Viceroy and the stub origin and removes the temporary project. For a
+deployed service, provision and link the stores described above and write the
+three secrets through Fastly's secret-store interface.
+
 ## Next Steps
 
 - Return to [Getting Started](/guide/getting-started) to continue setup
 - See [Configuration](/guide/configuration) for detailed configuration options
 - See [EC Setup Guide](/guide/ec-setup-guide) for end-to-end EC verification
 - See [Request Signing](/guide/request-signing) for setting up cryptographic signing
+- Compare the [Cloudflare](./cloudflare), [Spin](./spin), and [Axum](./axum-dev)
+  adapter journeys
diff --git a/docs/guide/index.md b/docs/guide/index.md
index e69de29bb..8a2c00d04 100644
--- a/docs/guide/index.md
+++ b/docs/guide/index.md
@@ -0,0 +1,30 @@
+# Guide
+
+Use these guides to understand Trusted Server, configure a deployment, and
+contribute to the project.
+
+## Start here
+
+- [What is Trusted Server?](/guide/what-is-trusted-server)
+- [Getting Started](/guide/getting-started)
+
+## Core concepts
+
+- [Edge Cookies](/guide/edge-cookies)
+- [GDPR Compliance](/guide/gdpr-compliance)
+- [Ad Serving](/guide/ad-serving)
+- [First-Party Proxy](/guide/first-party-proxy)
+- [Asset Routes](/guide/asset-routes)
+
+## Development
+
+- [Architecture](/guide/architecture)
+- [Configuration](/guide/configuration)
+- [CLI](/guide/cli)
+- [Testing](/guide/testing)
+- [Integration Guide](/guide/integration-guide)
+
+## Reference
+
+- [API Reference](/guide/api-reference)
+- [Error Reference](/guide/error-reference)
diff --git a/docs/guide/integration-guide.md b/docs/guide/integration-guide.md
index cf7da71f6..f127d4207 100644
--- a/docs/guide/integration-guide.md
+++ b/docs/guide/integration-guide.md
@@ -1,380 +1,223 @@
-# Integration Guide
+# Integration Development
 
-This document explains how to integrate a new integration module with the Trusted Server runtime. The workflow mirrors the built-in `testlight` sample in `crates/trusted-server-core/src/integrations/testlight.rs`.
+Trusted Server integrations are platform-neutral registrations assembled by
+`IntegrationRegistry`. Adapter crates provide I/O through
+`RuntimeServices`; integration code must not import Fastly, Cloudflare,
+Axum, or Spin SDK types.
 
-## Architecture Overview
+## Choose the narrowest hook
 
-| Component                                                               | Purpose                                                                                                                                                                                                                                                      |
-| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `crates/trusted-server-core/src/integrations/registry.rs`               | Defines the `IntegrationProxy`, `IntegrationAttributeRewriter`, `IntegrationScriptRewriter`, and `IntegrationHeadInjector` traits and hosts the `IntegrationRegistry`, which drives proxy routing, HTML/text rewrites, and head injection.                   |
-| `Settings::integrations` (`crates/trusted-server-core/src/settings.rs`) | Free-form JSON blob keyed by integration ID. Use `IntegrationSettings::insert_config` to seed configs; each module deserializes and validates (`validator::Validate`) its own config and exposes an `enabled` flag so the core settings schema stays stable. |
-| Fastly entrypoint (`crates/trusted-server-adapter-fastly/src/main.rs`)  | Instantiates the registry once per request, routes `/integrations/<id>/…` requests to the appropriate proxy, and passes the registry to the publisher origin proxy so HTML rewriting remains integration-aware.                                              |
-| `html_processor.rs`                                                     | Applies first-party URL rewrites, injects the Trusted Server JS shim, and lets integrations override attribute values (for example to swap script URLs).                                                                                                     |
+- `IntegrationProxy` owns explicit method/path endpoints and receives
+  `Settings`, `RuntimeServices`, and an EdgeZero-neutral request.
+- `IntegrationAttributeRewriter` inspects selected HTML attributes.
+- `IntegrationScriptRewriter` handles one declared selector.
+- `IntegrationHeadInjector` inserts deterministic head markup.
+- `IntegrationHtmlPostProcessor` is for bounded whole-document work that
+  cannot be performed during streaming.
+- `IntegrationRequestFilter` makes an early request decision.
 
-## Step-by-Step Integration
+Build one `IntegrationRegistration` with only the hooks the feature needs.
+Use `with_deferred_js()` only for a separately loaded integration module and
+`without_js()` when another asset path owns delivery. Proxy routes should be
+namespaced and bounded; do not introduce a general outbound proxy.
 
-### 1. Define Integration Configuration
+## Compiling core-neutral fixture
 
-Add a `trusted-server.toml` block and any environment overrides under `TRUSTED_SERVER__INTEGRATIONS__<ID>__*`. Configuration values are exposed to your module via `Settings::integration_config(<id>)`.
+The fixture below registers an attribute rewriter and constructs every
+required `RuntimeServices` service without an adapter dependency. The
+documentation test extracts this exact fence and compiles it as an isolated
+crate.
 
-```toml
-[integrations.my_integration]
-endpoint = "https://example.com/api"
-timeout_ms = 1000
-rewrite_scripts = true
-```
-
-### 2. Create the Integration Module
-
-Add a module under `crates/trusted-server-core/src/integrations/<id>/mod.rs` (see `crates/trusted-server-core/src/integrations/testlight.rs` for reference) and expose it in `crates/trusted-server-core/src/integrations/mod.rs`.
-
-Key pieces:
+<!-- documentation-snippet:runtime-services:start -->
 
 ```rust
-#[derive(Deserialize, Validate)]
-struct MyIntegrationConfig {
-    #[serde(default = "default_enabled")]
-    enabled: bool,
-    // …
-}
-
-impl IntegrationConfig for MyIntegrationConfig {
-    fn is_enabled(&self) -> bool { self.enabled }
-}
-
-pub struct MyIntegration {
-    config: MyIntegrationConfig,
-}
-
-pub fn build(settings: &Settings) -> Option<Arc<MyIntegration>> {
-    let config = settings
-        .integration_config::<MyIntegrationConfig>("my_integration")
-        .ok()
-        .flatten()?;
-    Some(Arc::new(MyIntegration { config }))
-}
-
-// Tests or scaffolding code can seed configs without hand-writing JSON:
-settings
-    .integrations
-    .insert_config(
-        "my_integration",
-        &serde_json::json!({
-            "enabled": true,
-            "endpoint": "https://example.com/api"
-        }),
-    )?;
-```
-
-`Settings::integration_config::<T>` automatically deserializes the raw JSON blob, runs [`validator`](https://docs.rs/validator/latest/validator/) on the type, and drops configs whose `is_enabled` returns `false`. Always derive/implement `Validate` for schema enforcement and implement `IntegrationConfig` (typically wrapping a `#[serde(default)] enabled` flag) so operators can toggle integrations without code changes.
-
-### 3. Return an IntegrationRegistration
+use std::net::IpAddr;
+use std::sync::Arc;
+
+use error_stack::Report;
+use trusted_server_core::integrations::{
+    AttributeRewriteAction, IntegrationAttributeContext,
+    IntegrationAttributeRewriter, IntegrationRegistration,
+};
+use trusted_server_core::platform::{
+    BackendNamingPolicy, ClientInfo, GeoInfo, PlatformBackend,
+    PlatformBackendSpec, PlatformConfigStore, PlatformError, PlatformGeo,
+    PlatformSecretStore, RuntimeServices, StoreId, StoreName,
+    UnavailableHttpClient, UnavailableKvStore,
+};
+
+struct ReadOnlyStore;
+
+impl PlatformConfigStore for ReadOnlyStore {
+    fn get(
+        &self,
+        _store: &StoreName,
+        _key: &str,
+    ) -> Result<String, Report<PlatformError>> {
+        Err(Report::new(PlatformError::Unsupported))
+    }
 
-Each integration registers itself via a `register` function that returns an `IntegrationRegistration`. This object describes which HTTP proxies and HTML rewrites the integration exposes:
+    fn put(
+        &self,
+        _store: &StoreId,
+        _key: &str,
+        _value: &str,
+    ) -> Result<(), Report<PlatformError>> {
+        Err(Report::new(PlatformError::Unsupported))
+    }
 
-```rust
-pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
-    let integration = build(settings)?;
-    Some(
-        IntegrationRegistration::builder("my_integration")
-            .with_proxy(integration.clone())
-            .with_attribute_rewriter(integration.clone())
-            .with_script_rewriter(integration.clone())
-            .with_head_injector(integration)
-            .with_asset("my_integration")
-            .build(),
-    )
+    fn delete(
+        &self,
+        _store: &StoreId,
+        _key: &str,
+    ) -> Result<(), Report<PlatformError>> {
+        Err(Report::new(PlatformError::Unsupported))
+    }
 }
-```
-
-Any combination of the vectors may be populated. Modules that only need HTML rewrites can skip the `proxies` field altogether, and vice versa. The registry automatically iterates over the static builder list in `crates/trusted-server-core/src/integrations/mod.rs`, so adding the new `register` function is enough to make the integration discoverable.
-
-### 4. Implement IntegrationProxy for Endpoints
 
-Implement the trait from `registry.rs` when your integration needs its own HTTP entrypoint:
-
-```rust
-#[async_trait(?Send)]
-impl IntegrationProxy for MyIntegration {
-    fn integration_name(&self) -> &'static str {
-        "my_integration"
+impl PlatformSecretStore for ReadOnlyStore {
+    fn get_bytes(
+        &self,
+        _store: &StoreName,
+        _key: &str,
+    ) -> Result<Vec<u8>, Report<PlatformError>> {
+        Err(Report::new(PlatformError::Unsupported))
     }
 
-    fn routes(&self) -> Vec<IntegrationEndpoint> {
-        vec![
-            self.post("/auction"),
-            self.get("/status"),
-        ]
+    fn create(
+        &self,
+        _store: &StoreId,
+        _key: &str,
+        _value: &str,
+    ) -> Result<(), Report<PlatformError>> {
+        Err(Report::new(PlatformError::Unsupported))
     }
 
-    async fn handle(
+    fn delete(
         &self,
-        settings: &Settings,
-        req: Request,
-    ) -> Result<Response, Report<TrustedServerError>> {
-        // Parse/generate EC IDs, forward upstream, and return the response.
+        _store: &StoreId,
+        _key: &str,
+    ) -> Result<(), Report<PlatformError>> {
+        Err(Report::new(PlatformError::Unsupported))
     }
 }
-```
-
-::: tip Route Helpers
-Use the provided helper methods to automatically namespace your routes under `/integrations/{integration_name()}/`. Available helpers: `get()`, `post()`, `put()`, `delete()`, and `patch()`. This lets you define routes with just their relative paths (e.g., `self.post("/auction")` becomes `"/integrations/my_integration/auction"`).
-:::
-
-Routes are matched verbatim in `crates/trusted-server-adapter-fastly/src/main.rs`, so stick to stable paths and register whichever HTTP methods you need. **New integrations should namespace their routes under `/integrations/{INTEGRATION_NAME}/`** using the helper methods for consistency, but you can define routes manually if needed (e.g., for backwards compatibility).
-
-The shared context already injects Trusted Server logging, headers, and error handling; the handler only needs to deserialize the request, call the upstream endpoint, and stamp integration-specific headers.
-
-#### Proxying Upstream Requests
-
-Use the shared helper in `crates/trusted-server-core/src/proxy.rs` to forward requests so you automatically get the same header copying, redirect handling, HTML/CSS rewrite behavior, and EC ID handling the first-party proxy uses:
 
-```rust
-use crate::proxy::{proxy_request, ProxyRequestConfig};
-use fastly::http::{header, HeaderValue};
-
-let payload = serde_json::to_vec(&my_body)?;
-let response = proxy_request(
-    settings,
-    req,
-    ProxyRequestConfig::new(&self.config.endpoint)
-        .with_body(payload)
-        .with_header(header::CONTENT_TYPE, HeaderValue::from_static("application/json"))
-        .with_streaming(), // stream passthrough; disable if you need HTML rewrites
-)
-.await?;
-```
-
-Set `forward_ec_id` to `false` if the upstream should not receive the caller's EC ID (`Testlight` does this), and disable `follow_redirects` if you need to surface redirects directly to the caller.
-
-**Streaming passthrough example:**
-
-```rust
-let response = proxy_request(
-    settings,
-    req,
-    ProxyRequestConfig::new("https://example.com/pixel")
-        .with_streaming() // no HTML/CSS rewrites; preserves origin compression
-);
-```
+struct FixtureBackend;
 
-::: info When to Use Streaming
-Use streaming when the upstream response is binary or large and you do not need creative rewrites. Keep the default (non-streaming) mode when you want HTML/CSS content rewritten through the existing creative pipeline.
-:::
-
-### 5. Implement HTML Rewrite Hooks (Optional)
-
-If the integration needs to rewrite script/link tags or inject HTML, implement `IntegrationAttributeRewriter` for attribute mutation and `IntegrationScriptRewriter` for inline `<script>` or text content rewrites. Both traits return typed actions (`AttributeRewriteAction`, `ScriptRewriteAction`) so you can keep existing markup, swap values, or drop elements entirely.
-
-```rust
-impl IntegrationAttributeRewriter for MyIntegration {
-    fn integration_id(&self) -> &'static str { "my_integration" }
-
-    fn handles_attribute(&self, attribute: &str) -> bool {
-        attribute == "src" || attribute == "href"
+impl PlatformBackend for FixtureBackend {
+    fn naming_policy(&self) -> BackendNamingPolicy {
+        BackendNamingPolicy::Axum
     }
 
-    fn rewrite(
+    fn predict_name(
         &self,
-        attr_name: &str,
-        attr_value: &str,
-        ctx: &IntegrationAttributeContext<'_>,
-    ) -> AttributeRewriteAction {
-        if attr_value.contains("cdn.example.com/legacy.js") {
-            // Drop remote script entirely – unified bundle already contains the logic.
-            AttributeRewriteAction::remove_element()
-        } else if attr_name == "src" {
-            AttributeRewriteAction::replace(tsjs::unified_script_src())
+        spec: &PlatformBackendSpec,
+    ) -> Result<String, Report<PlatformError>> {
+        if spec.host.is_empty() {
+            Err(Report::new(PlatformError::Backend))
         } else {
-            AttributeRewriteAction::keep()
+            Ok("fixture-origin".to_owned())
         }
     }
-}
-
-impl IntegrationScriptRewriter for MyIntegration {
-    fn integration_id(&self) -> &'static str { "my_integration" }
-    fn selector(&self) -> &'static str { "script#__NEXT_DATA__" }
 
-    fn rewrite(
+    fn ensure(
         &self,
-        content: &str,
-        ctx: &IntegrationScriptContext<'_>,
-    ) -> ScriptRewriteAction {
-        if let Some(rewritten) = try_rewrite_next_payload(content) {
-            ScriptRewriteAction::replace(rewritten)
-        } else {
-            ScriptRewriteAction::keep()
-        }
+        spec: &PlatformBackendSpec,
+    ) -> Result<String, Report<PlatformError>> {
+        self.predict_name(spec)
     }
 }
-```
-
-`html_processor.rs` calls these hooks after applying the standard origin→first-party rewrite, so you can simply swap URLs, append query parameters, or mutate inline JSON. Use this to point `<script>` tags at your own tsjs-managed bundle (for example, `/static/tsjs=tsjs-testlight.min.js`) or to rewrite embedded Next.js payloads.
-
-::: warning Removing Elements
-Returning `AttributeRewriteAction::remove_element()` (or `ScriptRewriteAction::RemoveNode` for inline content) removes the element entirely, so integrations can drop publisher-provided markup when the Trusted Server already injects a safe alternative. Prebid, for example, removes publisher `prebid.js` tags because Trusted Server injects a first-party `/integrations/prebid/bundle.js` URL for the configured external bundle.
-:::
-
-### 5b. Implement Head Injection (Optional)
 
-If the integration needs to inject HTML snippets at the start of `<head>` (for example, configuration scripts or global bootstraps), implement `IntegrationHeadInjector`. Snippets are prepended into `<head>` before the TSJS bundle tags, so they run first.
+struct FixtureGeo;
 
-```rust
-impl IntegrationHeadInjector for MyIntegration {
-    fn integration_id(&self) -> &'static str { "my_integration" }
-
-    fn head_inserts(&self, ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
-        vec![format!(
-            r#"<script>tsjs.setConfig({{ mode: "my_integration", host: "{}" }});</script>"#,
-            ctx.request_host
-        )]
+impl PlatformGeo for FixtureGeo {
+    fn lookup(
+        &self,
+        _client_ip: Option<IpAddr>,
+    ) -> Result<Option<GeoInfo>, Report<PlatformError>> {
+        Ok(None)
     }
 }
-```
-
-`html_processor.rs` calls `head_inserts` once per HTML response when the `<head>` element is first encountered. The returned snippets are concatenated before the unified script tag, so ordering between integrations is not guaranteed — keep snippets self-contained.
-
-::: tip When to Use Head Injection
-Use `IntegrationHeadInjector` when you need to emit configuration, inline scripts, or `<meta>` tags that must appear early in `<head>`. For attribute or script content changes on existing elements, prefer `IntegrationAttributeRewriter` or `IntegrationScriptRewriter` instead.
-:::
-
-### 6. Register the Module
-
-Add the module to `crates/trusted-server-core/src/integrations/mod.rs`'s builder list. The registry will call its `register` function automatically. Once registered:
-
-- `crates/trusted-server-adapter-fastly/src/main.rs` automatically exposes the declared route(s).
-- `handle_publisher_request` receives the same registry so HTML responses get integration shims without further code changes.
-- `IntegrationRegistry::registered_integrations()` exposes a machine-readable summary of hooks for tests, tooling, or diagnostics.
-- Declared assets are injected automatically into `<head>`; the runtime emits `<script async data-tsjs-integration="<name>">` tags for every bundle discovered through `.with_asset(...)`.
-
-### 7. Provide Static Assets (If Needed)
-
-Place any integration-specific JavaScript entrypoint under `crates/trusted-server-js/lib/src/integrations/<integration-id>/index.ts` (for example, `crates/trusted-server-js/lib/src/integrations/testlight/index.ts`). The shared `npm run build` script automatically discovers every integration directory with an `index.ts` file and produces a bundle named `tsjs-<integration-id>.js`, which the Rust crate embeds as `/static/tsjs=tsjs-<integration-id>.min.js`.
-
-Integrations that ship additional JS (such as Testlight) typically expose a `shim_src` config and rewrite publisher tags to point at that URL. Prebid drops publisher tags because the server injects the configured external Prebid bundle through a first-party route.
-
-### 8. Test Locally
-
-1. Add minimal config (`trusted-server.toml` + `.env.*` overrides).
-2. Run `cargo fmt --all -- --check` and `cargo clippy-fastly && cargo clippy-axum`.
-3. Execute targeted tests, e.g. `cargo test -p trusted-server-core html_processor`.
-4. Use `fastly compute serve` (with Viceroy installed) to hit `/integrations/<id>/…` and fetch HTML from your origin to confirm rewrites are applied.
-
-::: tip Testing Strategy
-For unit tests, prefer exposing helper constructors that accept a stub `shim_src` so your tests can point rewriters at a deterministic URL without touching the Tsjs build artifacts.
-:::
-
-By following these steps you can ship independent integration modules that plug into the Trusted Server runtime without modifying the Fastly entrypoint or HTML processor each time.
-
-## Existing Integrations
-
-Two built-in integrations demonstrate how the framework pieces fit together.
-
-Integrations are loaded in one of two ways:
-
-- **Immediate** (default) — concatenated into the main `tsjs-unified.min.js` bundle, loaded synchronously at `<head>` start.
-- **Deferred** — served as a separate `<script defer>` tag (`tsjs-{id}.min.js`), loaded after HTML parsing completes. Used for large modules that would otherwise block rendering. Integrations opt in by calling `.with_deferred_js()` on their registration builder.
-
-### Testlight
-
-**Loading**: Immediate
-
-**Purpose**: Sample partner stub showing request proxying, attribute rewrites, and asset injection.
-
-**Key files**:
 
-- `crates/trusted-server-core/src/integrations/testlight.rs` - Rust implementation
-- `crates/trusted-server-js/lib/src/integrations/testlight/index.ts` - TypeScript shim
+struct AssetRewriter;
 
-### Prebid
-
-**Loading**: External first-party bundle (`/integrations/prebid/bundle.js`)
-
-**Purpose**: Production Prebid Server bridge that owns `/auction`, injects Prebid client configuration, removes publisher-supplied Prebid scripts, and loads a publisher-specific generated Prebid bundle through a same-origin first-party route.
-
-**Key files**:
-
-- `crates/trusted-server-core/src/integrations/prebid.rs` - Rust implementation
-- `crates/trusted-server-js/lib/src/integrations/prebid/index.ts` - TypeScript NPM integration
-
-#### Prebid Integration Details
-
-Prebid applies the same steps outlined above with a few notable patterns:
-
-**1. Typed Configuration**
-
-`PrebidIntegrationConfig` lives alongside the integration module (`crates/trusted-server-core/src/integrations/prebid.rs`), implements `IntegrationConfig + Validate`, and exposes an `enabled` flag so operators can toggle it without code changes. Configuration lives under `[integrations.prebid]`:
+impl IntegrationAttributeRewriter for AssetRewriter {
+    fn integration_id(&self) -> &'static str {
+        "example"
+    }
 
-```toml
-[integrations.prebid]
-enabled = true
-timeout_ms = 1200
-client_side_bidders = ["example-browser"]
-external_bundle_url = "https://assets.example.com/prebid/trusted-prebid.js"
-# external_bundle_sha256 = "..."
-# external_bundle_sri = "sha384-..."
-# script_patterns = ["/static/prebid/*"]
+    fn handles_attribute(&self, attribute: &str) -> bool {
+        matches!(attribute, "src" | "href")
+    }
 
-[auction.providers.pbs-main]
-protocol = "openrtb-2.6"
-profile = "prebid-server"
-endpoint = "https://prebid.example.com/openrtb2/auction"
-routing = "explicit"
+    fn rewrite(
+        &self,
+        _attribute: &str,
+        value: &str,
+        _context: &IntegrationAttributeContext<'_>,
+    ) -> AttributeRewriteAction {
+        value
+            .strip_prefix("https://assets.example/")
+            .map(|path| AttributeRewriteAction::replace(format!("/assets/{path}")))
+            .unwrap_or_else(AttributeRewriteAction::keep)
+    }
+}
 
-[auction.bidders.example-server]
-provider = "pbs-main"
+pub fn registration() -> IntegrationRegistration {
+    IntegrationRegistration::builder("example")
+        .with_attribute_rewriter(Arc::new(AssetRewriter))
+        .build()
+}
 
-[proxy]
-allowed_domains = ["assets.example.com"]
+pub fn runtime_services() -> RuntimeServices {
+    let store = Arc::new(ReadOnlyStore);
+    RuntimeServices::builder()
+        .config_store(store.clone())
+        .secret_store(store)
+        .kv_store(Arc::new(UnavailableKvStore))
+        .backend(Arc::new(FixtureBackend))
+        .http_client(Arc::new(UnavailableHttpClient))
+        .geo(Arc::new(FixtureGeo))
+        .client_info(ClientInfo::default())
+        .build()
+}
 ```
 
-The `proxy.allowed_domains` entry is required for `external_bundle_url` and must
-cover the bundle host plus any HTTPS redirect targets used by that host.
-
-Browser integration tests can inject `[integrations.prebid]` settings with the
-same registry helper as other integrations. Server provider and bidder behavior
-must be constructed from the compiled auction plan rather than integration-owned
-endpoint or bidder fields.
-
-**2. Routes Owned by the Integration**
-
-`IntegrationProxy::routes` declares `/integrations/prebid/bundle.js` for first-party Prebid bundle delivery and script-pattern routes that return empty JavaScript for intercepted publisher Prebid URLs. Auctions continue to use the shared `/auction` endpoint.
-
-**3. HTML Rewrites Through the Registry**
-
-When the integration is enabled, the `IntegrationAttributeRewriter` removes any `<script src="prebid*.js">` or `<link href=…>` references that match `script_patterns`. Trusted Server injects `window.__tsjs_prebid` plus a same-origin `<script defer src="/integrations/prebid/bundle.js">` tag, so dropping publisher assets prevents duplicate downloads while configuration is available before the external bundle initializes.
-
-**4. External Bundle Assets & Testing**
-
-The NPM integration lives in `crates/trusted-server-js/lib/src/integrations/prebid/index.ts` and is built with `crates/trusted-server-js/lib/build-prebid-external.mjs`, outside the embedded Cargo TSJS build. Tests typically assert that publisher references disappear and the first-party `/integrations/prebid/bundle.js` tag is present.
-
-**5. Hybrid EID forwarding**
-
-For Prebid-routed auctions, Trusted Server now forwards identity using a hybrid model:
+<!-- documentation-snippet:runtime-services:end -->
 
-- TSJS reads current-request EIDs from `pbjs.getUserIdsAsEids()` and includes them in the `/auction` payload.
-- The edge resolves additional EIDs from the EC/KV identity graph.
-- The auction handler merges and deduplicates both sets.
-- The Prebid provider forwards the merged result to Prebid Server as `user.ext.eids`.
-- The `ts-eids` cookie is still ingested after the response so future requests can benefit from those IDs even without fresh browser-side resolution.
+Production adapters replace every unavailable or fixture service with the
+target implementation. The builder deliberately panics when a required service
+is omitted, so adapter startup must construct the complete service graph.
 
-Reusing these patterns makes it straightforward to convert additional legacy flows (for example, Next.js rewrites) into first-class integrations.
+## Proxy implementation rules
 
-## Future Improvements
+An `IntegrationProxy::handle` implementation receives the complete runtime
+service graph. Register or predict backends through `services.backend()`,
+send through `services.http_client()`, bound request and response bodies, and
+return `Report<TrustedServerError>` with integration context. The registry
+strips internal identity headers before dispatch; an integration must opt into
+any explicit forwarding behavior.
 
-We plan to expand integration capabilities in several areas:
+Streaming support is an adapter capability. Request
+`PlatformHttpRequest::with_stream_response()` only when the caller has
+checked `supports_streaming_responses()`; unsupported adapters must reject
+the request instead of silently buffering it.
 
-1. **Declarative Routing & Middleware** - Richer endpoints (path params, shared middleware, structured context) beyond simple method/path matching.
-2. **Granular HTML Hooks** - Ordered selectors, head/body injection points, and DOM-aware helpers so multiple integrations can safely collaborate.
-3. **Integration Manifest** - Schema describing required bundles, routes, config validation, and feature flags to keep registration data-driven.
-4. **Shared Request Utilities** - Reusable building blocks for EC ID injection, consent enforcement, and OpenRTB shaping.
-5. **tsjs Tooling** - Auto-generated integration bundles, scaffolding for TS shims/tests, and metadata surfaced back to Rust.
-6. **Testing & Observability Hooks** - Integration-focused mocks, local harnesses, and telemetry emitters for easier validation and monitoring.
+## Browser and script guards
 
-Contributions toward these enhancements are welcome.
+Add a browser module only when browser state is required. Immediate modules
+join the hashed unified bundle; deferred and standalone delivery are explicit
+registry decisions. Dynamic script interception must register with the shared
+DOM insertion dispatcher, remain idempotent, and leave unmatched elements
+untouched. See [Trusted Server JavaScript](/guide/tsjs) and
+[GPT's guarded handoff](/guide/integrations/gpt#server-slot-handoff).
 
-## Next Steps
+## Registration checklist
 
-- Learn about [Request Signing](/guide/request-signing) for secure communication
-- Review [Architecture](/guide/architecture) for system design
-- Set up [Testing](/guide/testing) for your integration
+1. Add typed settings with validation and a disabled default unless the
+   integration is intentionally universal.
+2. Register the exact capability predicates and route methods.
+3. Add source and behavior parity records.
+4. Add positive, negative, body-bound, header, and adapter-capability tests.
+5. Document configuration, failure behavior, and runtime limitations.
+6. Run the target aliases from [Testing](/guide/testing).
diff --git a/docs/guide/integrations-overview.md b/docs/guide/integrations-overview.md
index 706fb1a91..f14a5b2f9 100644
--- a/docs/guide/integrations-overview.md
+++ b/docs/guide/integrations-overview.md
@@ -1,390 +1,83 @@
-# Integrations Overview
-
-Trusted Server provides built-in integrations with third-party services for first-party data collection and consent-aware advertising. The available integrations are compared below.
-
-## Quick Comparison
-
-| Integration         | Type                | Endpoints  | HTML Rewriting               | Primary Use Case            | Status      |
-| ------------------- | ------------------- | ---------- | ---------------------------- | --------------------------- | ----------- |
-| **Prebid**          | Proxy + Rewriter    | 2-3 routes | Removes Prebid.js scripts    | Server-side header bidding  | Production  |
-| **Next.js**         | Script Rewriter     | None       | Rewrites Next.js data        | First-party Next.js routing | Production  |
-| **Permutive**       | Proxy + Rewriter    | 6 routes   | Rewrites SDK URLs            | First-party audience data   | Production  |
-| **Sourcepoint**     | Proxy + Rewriter    | 2 routes   | Rewrites CMP asset URLs      | First-party CMP delivery    | Development |
-| **Osano**           | Browser Mirror      | None       | Consent cookie mirroring     | First-party consent signals | Development |
-| **GPT Diagnostics** | Browser Diagnostics | None       | Closed-shadow local console  | GPT lifecycle debugging     | Development |
-| **Testlight**       | Proxy + Rewriter    | 1 route    | Rewrites integration scripts | Testing/development         | Development |
-
-## Integration Details
-
-### Prebid
-
-**What it does:** Supplies the browser Prebid.js bundle and `trustedServer`
-adapter while auction provider maps independently configure server-side Prebid
-Server demand.
-
-**Key Features:**
-
-- OpenRTB 2.x protocol conversion
-- EC ID injection into bid requests
-- First-party creative resource proxying
-- CDN URL rewriting (7+ major SSPs)
-- GPC signal support
-- Request signing for authentication
-
-**Configuration:**
-
-```toml
-[integrations.prebid]
-enabled = true
-timeout_ms = 1000
-debug = false
-client_side_bidders = ["example-browser"]
-external_bundle_url = "https://assets.example.com/prebid/trusted-prebid.js"
-
-[proxy]
-allowed_domains = ["assets.example.com"]
-
-[auction.providers.pbs-main]
-protocol = "openrtb-2.6"
-profile = "prebid-server"
-endpoint = "https://prebid.example.com/openrtb2/auction"
-routing = "explicit"
-
-[auction.bidders.example-server]
-provider = "pbs-main"
-```
-
-**Endpoints:**
-
-- `POST /auction` - Browser and programmatic auction endpoint
-- `GET /integrations/prebid/bundle.js` - First-party external bundle proxy
-- `GET <script_patterns>` - Configured empty-script interception routes
-
-**When to use:** You want to monetize your site with programmatic advertising while maintaining first-party context.
-
-**Learn more:** [Ad Serving Guide](./ad-serving.md)
-
----
-
-### Next.js
-
-**What it does:** Rewrites Next.js application data to route traffic through Trusted Server's first-party proxy.
-
-**Key Features:**
-
-- Next.js 13+ App Router support (RSC streaming)
-- Pages Router support (static data payload)
-- Configurable attribute rewriting
-- Protocol-relative URL handling
-- Preserves JSON structure
-
-**Configuration:**
-
-```toml
-[integrations.nextjs]
-enabled = false
-rewrite_attributes = ["href", "link", "url"]
-```
-
-**Endpoints:** None (pure HTML/script rewriting)
-
-**When to use:** You have a Next.js application and want to ensure all links and assets route through your first-party domain.
-
-**Learn more:** [Integration Guide](./integration-guide.md)
-
----
-
-### Permutive
-
-**What it does:** Provides first-party data collection and audience segmentation by proxying Permutive's SDK and API endpoints.
-
-**Key Features:**
-
-- Complete first-party SDK serving
-- Multi-endpoint proxying (API, Events, Sync, Secure Signals, CDN)
-- SDK caching for performance
-- Cookies set on the publisher's domain
-- Header forwarding for authentication
-
-**Configuration:**
-
-```toml
-[integrations.permutive]
-enabled = true
-organization_id = "myorg"
-workspace_id = "workspace-12345"
-project_id = "project-789"
-api_endpoint = "https://api.permutive.com"
-secure_signals_endpoint = "https://secure-signals.permutive.app"
-cache_ttl_seconds = 3600
-rewrite_sdk = true
-```
-
-**Endpoints:**
-
-- `GET /integrations/permutive/sdk` - SDK serving
-- `GET/POST /integrations/permutive/api/*` - API proxy
-- `GET/POST /integrations/permutive/secure-signal/*` - Secure Signals
-- `GET/POST /integrations/permutive/events/*` - Event collection
-- `GET/POST /integrations/permutive/sync/*` - ID synchronization
-- `GET /integrations/permutive/cdn/*` - CDN proxy
-
-**When to use:** You use Permutive for audience segmentation and want to maintain first-party data collection.
-
-**Learn more:** [Integration Guide](./integration-guide.md)
-
----
-
-### Sourcepoint
-
-**What it does:** Proxies Sourcepoint CMP CDN endpoints through Trusted Server and rewrites publisher references to first-party paths.
-
-**Key Features:**
-
-- CDN proxy for `cdn.privacy-mgmt.com`
-- HTML attribute rewriting for Sourcepoint assets
-- JavaScript body rewriting for webpack chunks and API URLs
-- Head-injected `window._sp_` property trap for runtime config
-- Client-side script guard for dynamic script insertion
-
-**Configuration:**
-
-```toml
-[integrations.sourcepoint]
-enabled = true
-rewrite_sdk = true
-cdn_origin = "https://cdn.privacy-mgmt.com"
-# auth_cookie_name = "sp_auth"
-cache_ttl_seconds = 3600
-```
-
-**Endpoints:**
-
-- `GET/POST /integrations/sourcepoint/cdn/*` - Sourcepoint CDN proxy
-
-**When to use:** You load Sourcepoint CMP assets and want them to flow through first-party paths without introducing an open-ended proxy.
-
-**Learn more:** [Sourcepoint Integration](./integrations/sourcepoint.md)
-
----
-
-### Osano
-
-**What it does:** Mirrors Osano's browser IAB API consent signals into standard first-party consent cookies for later Trusted Server requests.
-
-**Key Features:**
-
-- Mirrors USP, GPP, and TCF consent signals
-- Writes `us_privacy`, `__gpp`, `__gpp_sid`, and `euconsent-v2`
-- Marks owned cookies with `_ts_consent_src=osano`
-- Preserves unmarked or foreign-owned consent cookies
-- Clears stale Osano-owned cookies only after Osano readiness
-
-**Configuration:**
-
-```toml
-[integrations.osano]
-enabled = true
-```
-
-**Endpoints:** None. Osano v1 only enables the browser consent mirror module.
-
-**Operational note:** Because mirroring runs in the browser after the page response starts, the first page request cannot include cookies written by the Osano mirror. Server-side consent behavior should rely on mirrored cookies from subsequent requests after Osano APIs are ready.
-
-**When to use:** You use Osano for consent management and want Osano's browser consent signals available to Trusted Server as standard first-party cookies.
-
-**Learn more:** [Osano Integration](./integrations/osano.md)
-
----
-
-### GPT Runtime Diagnostics
-
-**What it does:** Observes documented GPT lifecycle callbacks and Trusted Server integration evidence, then presents directly observed slot, request-path, delivery, timing, coverage, binding, and visibility facts in a local browser console.
-
-**Key Features:**
-
-- Explicit browser-session `ts_console` activation through a host-only HttpOnly cookie
-- Conditional standalone delivery only on active HTML documents
-- Initial and refresh request-cycle history, with observed request paths and replacements
-- Delivery states derived only from observed Trusted Server creative evidence
-- Source-neutral Ad Manager identifiers and response classes reported by GPT
-- Conservative unmatched, ambiguous, and attribution issue reporting
-- Exact DOM binding and non-layout-changing viewport badges
-- Versioned local JSON export with no diagnostic upload
-- No inferred demand ownership: a filled slot alone never proves Trusted Server delivery
-
-**Configuration:**
-
-```toml
-[integrations.gpt_diagnostics]
-enabled = true
-```
-
-**Endpoints:** None. The feature observes GPT in the browser and makes no diagnostic network request.
-
-**When to use:** You need to debug GPT request, response, render, load, viewability, refresh, delivery-attribution, and slot-binding behavior without changing ad delivery.
-
-**Learn more:** [GPT Runtime Diagnostics](./integrations/gpt-diagnostics.md)
-
----
-
-### Testlight
-
-**What it does:** Testing/development integration for validating the integration system with OpenRTB-like auctions.
-
-**Key Features:**
-
-- EC ID injection demonstration
-- Flexible JSON schema (preserves unknown fields)
-- Stream passthrough mode
-- Script replacement capability
-- Validation with serde + validator
-
-**Configuration:**
-
-```toml
-[integrations.testlight]
-enabled = true
-endpoint = "https://testlight-server.example.com"
-timeout_ms = 1000
-shim_src = "/static/tsjs-unified.js"
-rewrite_scripts = false
-```
-
-**Endpoints:**
-
-- `POST /integrations/testlight/auction` - Auction endpoint with ID injection
-
-**When to use:** You're developing or testing integration functionality and need a simple endpoint to validate EC ID injection.
-
-**Learn more:** [Testing Guide](./testing.md)
-
----
-
-## Integration Architecture
-
-All integrations use a consistent architecture:
-
-### Route Namespacing
-
-- Pattern: `/integrations/{integration_name}/{endpoint}`
-- Examples:
-  - `/integrations/permutive/api/settings`
-  - `/integrations/testlight/auction`
-
-### Configuration Pattern
-
-All integrations support:
-
-- TOML configuration in `trusted-server.toml`
-- Environment variable overrides
-- Enable/disable flags
-- Validation at startup
-
-### Rewriting System
-
-Integrations can implement four types of rewriting:
-
-1. **HTTP Proxying** - Route requests through first-party domain
-2. **HTML Attribute Rewriting** - Modify element attributes during streaming
-3. **Script Content Rewriting** - Transform inline script content
-4. **Head Injection** - Insert HTML snippets at the start of `<head>`
-
-## Choosing an Integration
-
-Use this flowchart to determine which integrations you need:
-
-```
-Do you serve ads?
-├─ Yes → Enable Prebid integration
-└─ No → Skip Prebid
-
-Do you use Next.js?
-├─ Yes → Enable Next.js integration
-└─ No → Skip Next.js
-
-Do you use Permutive for audience data?
-├─ Yes → Enable Permutive integration
-└─ No → Skip Permutive
-
-Do you use Sourcepoint for consent management?
-├─ Yes → Enable Sourcepoint integration
-└─ No → Skip Sourcepoint
-
-Do you use Osano for consent management?
-├─ Yes → Enable Osano integration
-└─ No → Skip Osano
-
-Are you developing/testing integrations?
-├─ Yes → Enable Testlight integration
-└─ No → Skip Testlight
-```
-
-## Performance Considerations
-
-| Integration         | Performance Impact | Caching Strategy              | Notes                                           |
-| ------------------- | ------------------ | ----------------------------- | ----------------------------------------------- |
-| **Prebid**          | Medium             | Response caching possible     | Timeout configurable (default 1s)               |
-| **Next.js**         | Low                | N/A (streaming rewrite)       | Minimal overhead, runs during HTML streaming    |
-| **Permutive**       | Low                | SDK cached (1 hour default)   | API calls proxied in real-time                  |
-| **Sourcepoint**     | Low                | CDN cached (1 hour default)   | JS rewriting adds minor overhead                |
-| **GPT Diagnostics** | Low when active    | Static module publicly cached | Module omitted until browser-session activation |
-| **Testlight**       | Low                | No caching                    | Development use only                            |
-
-## Environment Variables
-
-EdgeZero overlays existing scalar leaves only. Use the
-`TRUSTED_SERVER__INTEGRATIONS__{INTEGRATION}__{SETTING}` pattern for integration
-leaves. Provider map keys preserve hyphens, so `pbs-main` uses `PBS-MAIN`, not
-`PBS_MAIN`. Shell assignment syntax cannot contain that hyphenated name; use
-`env` when running the CLI:
-
-```bash
-env 'TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=2000' \
-  'TRUSTED_SERVER__INTEGRATIONS__PREBID__DEBUG=true' \
-  'TRUSTED_SERVER__AUCTION__PROVIDERS__PBS-MAIN__PROFILE_CONFIG__DEBUG=true' \
-  ts config validate
-```
-
-Edit TOML and re-push it to change arrays, tables, maps, or rules. See
-[Configuration Reference](./configuration.md) for complete details.
-
-## Custom Integrations
-
-You can create your own integrations by implementing the integration traits:
-
-- `IntegrationProxy` - For HTTP endpoint proxying
-- `IntegrationAttributeRewriter` - For HTML attribute rewriting
-- `IntegrationScriptRewriter` - For script content transformation
-- `IntegrationHeadInjector` - For injecting HTML snippets into `<head>`
-
-See the [Integration Guide](./integration-guide.md) for details on building custom integrations.
-
-## Common Questions
-
-### Can I enable multiple integrations?
-
-Yes! All integrations can run simultaneously. They operate independently and don't conflict.
-
-### Do integrations affect page load time?
-
-Minimal impact. HTML rewriting happens during streaming (Next.js), and proxy endpoints only execute when called. Prebid timeout is configurable.
-
-### Can I disable integrations at runtime?
-
-No. Integration configuration is read at startup. You must redeploy to change integration settings.
-
-### Are integrations required?
-
-No. All integrations are optional. You can run Trusted Server with no integrations enabled and use it purely for EC ID generation and first-party proxying.
-
-### How do I add a new integration?
-
-See the [Integration Guide](./integration-guide.md) for a complete tutorial on building custom integrations.
-
-## Next Steps
-
-- Learn about [Configuration](./configuration.md)
-- Understand [Request Signing](./request-signing.md)
-- Explore [Creative Processing](./creative-processing.md)
-- Review [API Reference](./api-reference.md)
+# Integrations and Runtime Support
+
+Trusted Server combines an edge adapter, server-side integrations, auction
+providers, and browser modules. These layers are related but not
+interchangeable: a deploy ID may register a settings builder, an auction-plan
+component, or a mediator, while browser code can be bundled, deferred, or
+loaded by a separate tag.
+
+## Adapter support
+
+| Adapter      | Release status | Health     | Startup status | Startup health | Provider fan-out | Trusted-client-IP handling     | Request normalization            |
+| ------------ | -------------- | ---------- | -------------- | -------------- | ---------------- | ------------------------------ | -------------------------------- |
+| `axum`       | development    | real       | `500`          | no             | multiple         | outermost sanitize             | none                             |
+| `cloudflare` | development    | absent     | `500`          | no             | single           | outermost sanitize             | none                             |
+| `fastly`     | production     | pre router | `500`          | yes            | multiple         | entry-point resolve + sanitize | none                             |
+| `spin`       | experimental   | real       | `503`          | yes            | single           | outermost sanitize             | innermost Spin-header derivation |
+
+This table summarizes the adapter implementations. “Startup health” means the
+degraded startup router still serves `/health`; it does not
+mean configuration loaded. “Provider fan-out” describes whether the adapter
+can dispatch one auction to multiple configured providers. See the individual
+[Fastly](/guide/fastly), [Axum](/guide/axum-dev),
+[Cloudflare](/guide/cloudflare), and [Spin](/guide/spin) deployment guides for
+their operational procedures.
+
+## Integration inventory
+
+| Integration                                                    | Operational status | Deploy ID | Registration       | Browser loading |
+| -------------------------------------------------------------- | ------------------ | --------- | ------------------ | --------------- |
+| [`adserver_mock`](/guide/integrations/adserver_mock)           | development        | yes       | auction mediator   | none            |
+| [`aps`](/guide/integrations/aps)                               | development        | yes       | auction plan       | none            |
+| [`creative`](/guide/creative-processing)                       | development        | no        | browser capability | bundled         |
+| [`datadome`](/guide/integrations/datadome)                     | development        | yes       | settings builder   | bundled         |
+| [`didomi`](/guide/integrations/didomi)                         | production         | yes       | settings builder   | bundled         |
+| [`google_tag_manager`](/guide/integrations/google_tag_manager) | production         | yes       | settings builder   | bundled         |
+| [`gpt`](/guide/integrations/gpt)                               | production         | yes       | settings builder   | bundled         |
+| [`gpt_diagnostics`](/guide/integrations/gpt-diagnostics)       | development        | yes       | settings builder   | standalone      |
+| `js_asset_proxy` (no dedicated guide)                          | development        | yes       | settings builder   | none            |
+| [`lockr`](/guide/integrations/lockr)                           | production         | yes       | settings builder   | bundled         |
+| [`nextjs`](/guide/integrations/nextjs)                         | production         | yes       | settings builder   | none            |
+| [`osano`](/guide/integrations/osano)                           | development        | yes       | settings builder   | bundled         |
+| [`permutive`](/guide/integrations/permutive)                   | production         | yes       | settings builder   | bundled         |
+| [`prebid`](/guide/integrations/prebid)                         | production         | yes       | auction plan       | deferred        |
+| [`sourcepoint`](/guide/integrations/sourcepoint)               | development        | yes       | settings builder   | bundled         |
+| [`testlight`](/guide/integrations/testlight)                   | development        | yes       | settings builder   | bundled         |
+
+The inventory summarizes compiled registration sets and reviewed maturity
+records. A deploy ID means the deployment validator accepts
+that identifier; it does not imply that every adapter implements the same
+runtime capability. `creative` is a browser capability, not a deploy ID.
+
+Browser loading has three distinct modes:
+
+- `bundled` modules execute from the immediate unified `tsjs` bundle.
+- `deferred` modules are fetched after that bundle; Prebid uses this mode.
+- `standalone` modules use a dedicated tag decision and are not part of the
+  unified bundle; GPT diagnostics uses this mode.
+- `none` means the capability has no integration browser module.
+
+See [Trusted Server JavaScript](/guide/tsjs) for the exact 12-module,
+13-bundle model and [API Reference](/guide/api-reference) for route
+families and adapter availability.
+
+## How capabilities compose
+
+Enabled integrations share ordered request, HTML, and browser pipelines. They
+are not guaranteed to be independent. Registration predicates determine which
+proxy routes, attribute or script rewriters, head injectors, request filters,
+post-processors, auction providers, and browser modules are active. Validate
+the complete configuration and test the resulting page rather than assuming
+that any arbitrary combination is conflict-free.
+
+Configuration is loaded when the process starts. Change it through the
+[EdgeZero configuration lifecycle](/guide/edgezero), then restart or deploy the
+adapter as required. Exact fields and defaults live in the
+[Configuration Reference](/guide/configuration).
+
+## Adding an integration
+
+Use the [Integration Guide](/guide/integration-guide) for the runtime-neutral
+extension path and a compiling `RuntimeServices` fixture. Add only the hooks a
+capability needs; do not create a catch-all proxy or assume an adapter-specific
+HTTP implementation in core code.
diff --git a/docs/guide/integrations/adserver_mock.md b/docs/guide/integrations/adserver_mock.md
new file mode 100644
index 000000000..cc3fa4444
--- /dev/null
+++ b/docs/guide/integrations/adserver_mock.md
@@ -0,0 +1,27 @@
+# Ad Server Mock Mediator
+
+`adserver_mock` is a development mediator for the auction orchestrator. It
+is not an ordinary bidder provider and does not expose an integration proxy
+route.
+
+Enable `[integrations.adserver_mock]` and set
+`auction.mediator = "adserver_mock"`. Startup registers the mediator only
+when both conditions hold. The orchestrator first gathers responses from the
+configured auction providers, then passes successful bids to the mediator's
+HTTP endpoint for final selection.
+
+The mediator supports banner bids. It omits bids without a decoded numeric
+price, applies the optional CPM floor, and restores render and accounting
+fields from the original provider bids after the mediation response. Duplicate
+provider/slot/bidder identities are last-write-wins and generate a warning
+because accounting restoration may become ambiguous.
+
+`context_query_params` maps auction-context keys to endpoint query
+parameters. List values become comma-separated strings and URL construction
+percent-encodes names and values. Use this only for explicitly reviewed context
+fields; it is not a generic request-forwarding mechanism.
+
+The default endpoint is a loopback Mocktioneer address and the integration is
+disabled by default. Configure an explicit endpoint for shared environments.
+See [Auction Orchestration](/guide/auction-orchestration) and the generated
+[Configuration Reference](/guide/configuration#ad-server-mock-integration).
diff --git a/docs/guide/integrations/gam.md b/docs/guide/integrations/gam.md
index 46316df0c..304619ede 100644
--- a/docs/guide/integrations/gam.md
+++ b/docs/guide/integrations/gam.md
@@ -1,58 +1,13 @@
-# Google Ad Manager (GAM) Integration
+# Google Ad Manager integration status
 
-**Category**: Ad Serving
-**Status**: Planned for 2026
-**Type**: Ad Server
+Trusted Server does not ship a direct Google Ad Manager integration or an
+`[integrations.gam]` configuration section.
 
-## Overview
+The TSJS GPT module can place server-side auction results into publisher-owned
+GPT slots, including APS renderer winners. That browser handoff is not a GAM
+API integration and does not provide campaign management, reporting, or direct
+GAM demand.
 
-The Google Ad Manager (GAM) integration will enable direct integration with Google's ad serving platform, providing first-party ad delivery and reporting.
-
-## Planned Features
-
-- **Direct GAM Integration**: Native support for GAM ad requests
-- **Dynamic Ad Slots**: Programmatic slot management
-- **Programmatic Guaranteed**: Direct deals and PG support
-- **First-Party Reporting**: Ad performance metrics
-- **Secure Signals**: Encoded audience signals shared with publisher-selected partners
-- **Creative Rendering**: First-party creative delivery
-
-## Expected Configuration
-
-```toml
-[integrations.gam]
-enabled = true
-publisher_id = "your-publisher-id"
-network_code = "your-network-code"
-endpoint = "https://securepubads.g.doubleclick.net"
-```
-
-## Use Cases
-
-### Header Bidding + Direct
-
-Combine header bidding (Prebid) with GAM direct campaigns for optimal yield.
-
-### Programmatic Guaranteed
-
-Manage PG deals with deterministic delivery.
-
-### Unified Reporting
-
-Consolidated reporting across all monetization channels.
-
-## Status
-
-This integration is currently in the planning phase. See the [Roadmap](/roadmap) for timeline and progress updates.
-
-**Target Release**: Q1 2026
-
-## Get Involved
-
-Interested in contributing to the GAM integration? Check out the [GitHub issue](https://github.com/IABTechLab/trusted-server/issues) or join the discussion.
-
-## Next Steps
-
-- Review [Roadmap](/roadmap) for latest status
-- Check [Prebid Integration](/guide/integrations/prebid) for current header bidding support
-- Explore [Ad Serving Guide](/guide/ad-serving) for general ad serving concepts
+Use the [Integrations overview](/guide/integrations-overview) for the current
+integration inventory and [Auction orchestration](/guide/auction-orchestration)
+for shipped provider profiles.
diff --git a/docs/guide/integrations/gpt.md b/docs/guide/integrations/gpt.md
index b55f65f7e..ae070950f 100644
--- a/docs/guide/integrations/gpt.md
+++ b/docs/guide/integrations/gpt.md
@@ -116,6 +116,38 @@ Takes over `googletag.cmd` so every queued callback is wrapped before GPT execut
 - Consent gating of ad requests
 - Ad-unit path rewriting for A/B testing
 
+### Server slot handoff
+
+For the initial server-rendered auction, the head bootstrap installs
+`window.tsjs.adInit` before the compiled bundle arrives. It reads the
+server-injected slot and bid state synchronously, defines a fallback GPT slot
+on the actual inner div, and records the slot in `gptSlotHandoffs`. It never
+defines a competing slot on an outer `-container` element. When publisher code
+later calls `googletag.defineSlot` for the same placement, the idempotent wrapper
+hands the existing inner-div binding back to GPT.
+
+The bootstrap observes modern `googletag.setConfig({ disableInitialLoad: ... })`
+and the legacy `pubads().disableInitialLoad()` call. If initial load is
+disabled, it refreshes only the newly defined Trusted Server slots. It never
+calls an unbounded `refresh()` that could refresh publisher-owned inventory.
+
+`adInit` owns the initial document only. Server-side targeting and the Trusted
+Server render bridge own the initial bid handoff and proven win/billing beacon
+path. After load, the slim Prebid module owns scroll-triggered and refresh
+auctions. SPA navigation obtains page bids through `GET /_ts/page-bids` (the
+legacy `GET /__ts/page-bids` alias remains available); it does not use
+`POST /auction` for that navigation flow.
+
+### Shared script-guard dispatcher
+
+GPT's six interception layers register with the shared DOM insertion
+dispatcher used by integration guards. Installation is idempotent. A candidate
+URL is rewritten only when it matches GPT's accepted host/path rules; an
+unmatched URL continues through the native DOM operation. If a descriptor or
+prototype hook cannot be installed, the remaining layers still run, but the
+integration does not claim complete interception for browser behavior outside
+those guarded seams.
+
 ### GAM Treatment Attribution
 
 Setting `gam_attribution_enabled = true` adds the fixed page-level GPT targeting
@@ -223,4 +255,3 @@ treated as invalid for experiment reporting.
 - Review [Integrations Overview](/guide/integrations-overview) for comparison with other integrations
 - Check [Configuration Reference](/guide/configuration) for advanced options
 - Learn about [First-Party Proxy](/guide/first-party-proxy) architecture
-- See [Google Ad Manager](/guide/integrations/gam) for the planned direct GAM integration
diff --git a/docs/guide/integrations/kargo.md b/docs/guide/integrations/kargo.md
index 139aab25c..4e1c71a95 100644
--- a/docs/guide/integrations/kargo.md
+++ b/docs/guide/integrations/kargo.md
@@ -1,66 +1,13 @@
-# Kargo SSP Integration
+# Kargo integration status
 
-**Category**: SSP (Supply-Side Platform)
-**Status**: In Development
-**Type**: Direct SSP Integration
+Trusted Server does not ship a native Kargo integration or an
+`[integrations.kargo]` configuration section.
 
-## Overview
+Kargo can be used only as upstream demand through a separately configured
+OpenRTB or Prebid Server path when the publisher and upstream service support
+it. Trusted Server does not provide Kargo-specific request translation,
+viewability measurement, creative formats, or reporting.
 
-The Kargo integration provides direct access to Kargo's supply-side platform for premium programmatic demand.
-
-## What is Kargo?
-
-Kargo is a mobile-first SSP specializing in high-impact, brand-safe advertising with:
-
-- Premium brand demand
-- Advanced creative formats
-- Viewability optimization
-- First-party data activation
-
-## Planned Features
-
-- **Direct Kargo Bidding**: Native Kargo bid adapter
-- **First-Party Creative Rendering**: All creatives served through publisher domain
-- **Enhanced Viewability Measurement**: Real-time viewability metrics
-- **Brand Safety**: Pre-bid brand safety validation
-- **Custom Creative Formats**: Support for Kargo's rich media units
-
-## Expected Configuration
-
-```toml
-[integrations.kargo]
-enabled = true
-publisher_id = "your-kargo-publisher-id"
-endpoint = "https://krk.kargo.com"
-timeout_ms = 1000
-```
-
-## Use Cases
-
-### Premium Brand Campaigns
-
-Access to Kargo's premium brand advertisers for higher CPMs.
-
-### Mobile Optimization
-
-Kargo's mobile-first approach optimizes for mobile inventory.
-
-### High-Impact Formats
-
-Leverage Kargo's proprietary creative formats for better engagement.
-
-## Status
-
-This integration is currently being developed on a separate branch. Check with the team for the latest status.
-
-**Expected Release**: Q1-Q2 2026
-
-## Get Involved
-
-Interested in beta testing the Kargo integration? Reach out via [GitHub Discussions](https://github.com/IABTechLab/trusted-server/discussions).
-
-## Next Steps
-
-- Review [Roadmap](/roadmap) for SSP integration plans
-- Check [Prebid Integration](/guide/integrations/prebid) for current demand access
-- Explore [Ad Serving](/guide/ad-serving) for general concepts
+Use the [Integrations overview](/guide/integrations-overview) for the current
+integration inventory and [Auction orchestration](/guide/auction-orchestration)
+for the generic provider configuration.
diff --git a/docs/guide/integrations/lockr.md b/docs/guide/integrations/lockr.md
index 700b0c4ad..ef9e57b0f 100644
--- a/docs/guide/integrations/lockr.md
+++ b/docs/guide/integrations/lockr.md
@@ -142,11 +142,11 @@ The Lockr integration is implemented in [crates/trusted-server-core/src/integrat
 
 ### Key Components
 
-**Identity Sync Endpoint**:
+**Routed Endpoints**:
 
-- Route: `/integrations/lockr/sync`
-- Method: POST
-- Purpose: Synchronize EC ID with Lockr vault
+- Route: `/integrations/lockr/sdk` (GET) serves the Lockr SDK first-party
+- Route: `/integrations/lockr/api/*` (GET, POST) proxies Lockr API calls
+- Purpose: Keep SDK delivery and identity API traffic on the publisher origin
 
 **ID Mapping**:
 
diff --git a/docs/guide/integrations/testlight.md b/docs/guide/integrations/testlight.md
new file mode 100644
index 000000000..b7c23cca7
--- /dev/null
+++ b/docs/guide/integrations/testlight.md
@@ -0,0 +1,29 @@
+# Testlight Integration
+
+Testlight is a disabled-by-default development integration for exercising the
+proxy and HTML-rewrite seams. Enabling it requires a valid upstream endpoint.
+
+## Auction proxy
+
+`POST /integrations/testlight/auction` accepts a bounded JSON body. The
+request must carry a valid `ts-ec` cookie. Testlight replaces `user.id`
+with the derived EC ID while preserving unknown JSON fields, then sends the
+request upstream as JSON. The registry removes the internal EC header before
+dispatch, and Testlight explicitly disables EC-header forwarding.
+
+The upstream response remains status- and header-preserving except for
+`Content-Length`, which is removed after bounded collection. Valid JSON is
+re-serialized and receives `application/json`; non-JSON bytes are returned
+unchanged without claiming a JSON content type.
+
+## Script rewrite
+
+When `rewrite_scripts = true`, `src` and `href` values containing
+`testlight.js` are replaced with `shim_src`. Other attributes and values
+are unchanged. The default shim source is the registry-free unified `tsjs`
+path because Testlight is an immediate bundled module.
+
+This integration is for controlled development validation, not a production
+auction provider. See [Configuration](/guide/configuration#testlight-integration)
+for exact fields and [Integration Guide](/guide/integration-guide) for the
+underlying extension seams.
diff --git a/docs/guide/onboarding.md b/docs/guide/onboarding.md
index 5e59deb77..1310484ef 100644
--- a/docs/guide/onboarding.md
+++ b/docs/guide/onboarding.md
@@ -1,160 +1,119 @@
-# New Engineer Onboarding Guide
-
-This document is intended for internal onboarding. For public setup steps, start with
-[Getting Started](/guide/getting-started). For test commands and workflows, use the
-[Testing guide](/guide/testing).
-
-Welcome to the Trusted Server project! This guide keeps internal onboarding notes concise and links out to the canonical docs.
-
-## Table of Contents
-
-1. [Start Here](#start-here)
-2. [Local Setup Notes](#local-setup-notes)
-3. [Codebase Pointers](#codebase-pointers)
-4. [Development Workflow](#development-workflow)
-5. [Debugging & Troubleshooting](#debugging--troubleshooting)
-6. [Team & Governance](#team--governance)
-7. [Resources & Getting Help](#resources--getting-help)
-8. [Onboarding Checklist](#onboarding-checklist)
-
----
-
-## Start Here
-
-- Product overview: [What is Trusted Server](/guide/what-is-trusted-server)
-- System design: [Architecture](/guide/architecture)
-- Setup and deploy: [Getting Started](/guide/getting-started) and [Fastly Setup](/guide/fastly)
-- Configure features: [Configuration](/guide/configuration) (see the Detailed Reference section)
-- Testing workflow: [Testing guide](/guide/testing)
-- Integrations: [Integrations Overview](/guide/integrations-overview) and [Integration Guide](/guide/integration-guide)
-
-## Local Setup Notes
-
-- Tool versions live in `.tool-versions` (use asdf or your preferred version manager).
-- For docs site development, see `docs/README.md`.
-
-## Codebase Pointers
-
-| File                                                      | Purpose                          |
-| --------------------------------------------------------- | -------------------------------- |
-| `crates/trusted-server-adapter-fastly/src/main.rs`        | Request routing entry point      |
-| `crates/trusted-server-core/src/publisher.rs`             | Publisher origin handling        |
-| `crates/trusted-server-core/src/proxy.rs`                 | First-party proxy implementation |
-| `crates/trusted-server-core/src/ec/`                      | EC identity subsystem            |
-| `crates/trusted-server-core/src/integrations/registry.rs` | Integration module pattern       |
-| `trusted-server.toml`                                     | Application configuration        |
-
-## Development Workflow
-
-- Contribution process: [CONTRIBUTING.md](https://github.com/IABTechLab/trusted-server/blob/main/CONTRIBUTING.md)
-- Adding integrations: [Integration Guide](/guide/integration-guide)
-- Request flows: [SEQUENCE.md](https://github.com/IABTechLab/trusted-server/blob/main/SEQUENCE.md)
-
-## Debugging & Troubleshooting
-
-- [Error Reference](/guide/error-reference)
-- [Testing guide](/guide/testing)
-- [Fastly Setup](/guide/fastly) (local simulator notes)
-
----
-
-## Team & Governance
-
-### Project Structure
-
-The project follows IAB Tech Lab's open-source governance model:
-
-- **Trusted Server Task Force**: Defines requirements and roadmap (meets biweekly)
-- **Development Team**: Handles engineering implementation and releases
-
-### Team Roles
-
-| Role         | Responsibility                       |
-| ------------ | ------------------------------------ |
-| Project Lead | Overall project vision and direction |
-| Developer    | Contributes code/docs                |
-
-See [ProjectGovernance.md](https://github.com/IABTechLab/trusted-server/blob/main/ProjectGovernance.md) for full details.
-
-### Key Contacts
-
-| Role         | GitHub Handle                                                |
-| ------------ | ------------------------------------------------------------ |
-| Project Lead | [@jevansnyc](https://github.com/jevansnyc)                   |
-| Developer    | [@aram356](https://github.com/aram356)                       |
-| Developer    | [@ChristianPavilonis](https://github.com/ChristianPavilonis) |
-
-### Meetings
-
-<!-- TODO: Add actual meeting links and times -->
-
-- **Task Force Meeting**: Biweekly (check calendar for schedule)
-- **Development Team Standup**: Weekly (check calendar for schedule)
-
-Ask your manager or onboarding buddy for calendar invites to relevant meetings.
-
----
-
-## Resources & Getting Help
-
-### Documentation
-
-| Resource                                                                                  | Description                                 |
-| ----------------------------------------------------------------------------------------- | ------------------------------------------- |
-| [README.md](https://github.com/IABTechLab/trusted-server/blob/main/README.md)             | Project overview and setup                  |
-| [CONTRIBUTING.md](https://github.com/IABTechLab/trusted-server/blob/main/CONTRIBUTING.md) | Contribution guidelines                     |
-| [AGENTS.md](https://github.com/IABTechLab/trusted-server/blob/main/AGENTS.md)             | AI agent conventions and project guidelines |
-| [SEQUENCE.md](https://github.com/IABTechLab/trusted-server/blob/main/SEQUENCE.md)         | Request flow diagrams                       |
-| [FAQ_POC.md](https://github.com/IABTechLab/trusted-server/blob/main/FAQ_POC.md)           | Frequently asked questions                  |
-
-For docs site development, see `docs/README.md`.
-
-### Getting Help
-
-- **GitHub Issues**: For bugs, feature requests, and questions
-- **Task Force Meetings**: Biweekly meetings for roadmap discussions
-- **Code Review**: Submit PRs for feedback from maintainers
-
-### External Resources
-
-- [Fastly Compute Documentation](https://developer.fastly.com/learning/compute/)
-- [Rust Book](https://doc.rust-lang.org/book/)
-- [WebAssembly Overview](https://webassembly.org/)
-- [OpenRTB Specification](https://iabtechlab.com/standards/openrtb/)
-
----
-
-## Onboarding Checklist
-
-Use this checklist to track your onboarding progress:
-
-### Access & Accounts
-
-- [ ] Get GitHub access to [IABTechLab/trusted-server](https://github.com/IABTechLab/trusted-server)
-- [ ] Get access to the [Trusted Server project board](https://github.com/orgs/IABTechLab/projects/3)
-- [ ] Create a [Fastly account](https://manage.fastly.com) and obtain an API token
-- [ ] Join the Slack workspace and `#trusted-server-internal` channel
-- [ ] Get calendar invites for Task Force and Development Team meetings
-
-### Environment Setup
-
-- [ ] Complete the setup steps in [Getting Started](/guide/getting-started)
-- [ ] Run the test flow in the [Testing guide](/guide/testing)
-- [ ] Start the local server (see [Getting Started](/guide/getting-started))
-
-### Codebase Exploration
-
-- [ ] Read through `main.rs` to understand request routing
-- [ ] Trace a request through `publisher.rs` and `proxy.rs`
-- [ ] Understand the EC identity subsystem in `ec/`
-- [ ] Review an existing integration (e.g., `prebid.rs`)
-
-### Documentation & Contribution
-
-- [ ] Read `CONTRIBUTING.md` for PR guidelines
-- [ ] Browse the [documentation site guides](/guide/getting-started)
-- [ ] Make a small contribution (fix a typo, add a test, etc.)
-
----
-
-Welcome aboard! Don't hesitate to ask questions - we're here to help you succeed.
+# Onboarding
+
+This page explains the codebase context that the reference guides assume: what
+Trusted Server does, how a publisher request moves through it, which ad-tech
+terms mean what here, and where to begin working.
+
+Use [Getting Started](/guide/getting-started) to review the prerequisites and
+run a local adapter. Repository-only maintainer onboarding remains in
+`docs/internal/onboarding.md`, which VitePress intentionally does not publish.
+
+## Mental model
+
+Trusted Server is an edge reverse proxy with a runtime-neutral Rust core. For a
+publisher-page request, it can:
+
+1. derive an Edge Cookie (EC) identity and apply consent policy;
+2. dispatch a server-side ad auction while fetching the publisher origin;
+3. rewrite eligible HTML and creatives and inject selected browser modules; and
+4. expose configured integrations and third-party assets through first-party
+   routes.
+
+Not every request enters the publisher pipeline. Health, administrative,
+integration, TSJS, and configured asset routes can terminate earlier.
+
+## Trace a Fastly publisher request
+
+The adapters share the core publisher handler, but their entry points and
+streaming capabilities differ. This trace uses Fastly to show the streaming
+path. Navigate by function name; line numbers change.
+
+| Step | Function or area                                     | Responsibility                                                                                            |
+| ---- | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| 1    | `adapter-fastly/src/main.rs` — `main`                | Answer `/health` immediately; otherwise initialize logging and call `edgezero_main`                       |
+| 2    | `main.rs` — `edgezero_main`                          | Load runtime configuration, sanitize forwarded client data, capture TLS/device signals, and dispatch      |
+| 3    | EdgeZero router                                      | Select a named Trusted Server route or the fallback handler                                               |
+| 4    | `adapter-fastly/src/app.rs` — `dispatch_fallback`    | Build EC request state, run pre-route integration filters, and distinguish asset/integration traffic      |
+| 5    | `dispatch_fallback`                                  | For an eligible publisher navigation, generate an EC ID when needed and call the shared publisher handler |
+| 6    | `core/src/publisher.rs` — `handle_publisher_request` | Use the consent context, match configured slots, and evaluate the server-side ad-stack gate               |
+| 7    | `handle_publisher_request`                           | Dispatch eligible bidder requests before sending the request to the publisher origin                      |
+| 8    | Publisher response pipeline                          | Classify the origin response, then rewrite or inject into eligible HTML                                   |
+| 9    | Fastly entry point                                   | Apply final EC and filter effects, then send the buffered or streaming response                           |
+
+Two ordering details matter when debugging:
+
+- Bid requests are dispatched before the publisher-origin request is sent.
+  Auction collection can wait at the HTML body seam without delaying the
+  initial body prefix.
+- The ad-stack gate controls both auction dispatch and ad-template injection.
+  A closed gate can therefore resemble an auction failure even when no bidder
+  was called.
+
+See [Architecture](/guide/architecture) for component boundaries and
+[Auction Orchestration](/guide/auction-orchestration) for the auction path.
+
+## Vocabulary used in this repository
+
+| Term                 | Meaning here                                                                                                 |
+| -------------------- | ------------------------------------------------------------------------------------------------------------ |
+| Impression           | One opportunity to show an ad in a slot                                                                      |
+| Ad slot or placement | A configured page region that can receive an ad                                                              |
+| Bid                  | A demand source's offer for an impression                                                                    |
+| CPM                  | Bid price per thousand impressions                                                                           |
+| Auction              | Collection and comparison of eligible bids for the page's matched slots                                      |
+| Header bidding       | Competition among demand sources before the ad server makes its final decision                               |
+| SSP                  | Supply-side platform; sells publisher inventory                                                              |
+| DSP                  | Demand-side platform; buys inventory for advertisers                                                         |
+| Creative             | The markup, image, script, or renderer selected for an ad                                                    |
+| OpenRTB              | The IAB JSON protocol used by the server auction interfaces                                                  |
+| Prebid               | The open-source header-bidding ecosystem; this repository supports browser and server-side integration paths |
+| GPT                  | Google Publisher Tag, the browser library used to request ads from Google Ad Manager                         |
+| GAM                  | Google Ad Manager, an ad server used by publishers                                                           |
+| EC ID                | Edge Cookie identifier derived with HMAC-SHA256 plus a random suffix                                         |
+| Consent signal       | Privacy input such as an encoded TCF, GPP, or US Privacy value, or the GPC header                            |
+| CMP                  | Consent management platform; collects choices and exposes consent signals                                    |
+| First-party proxy    | A Trusted Server route that fetches an allowed third-party resource through the publisher-facing service     |
+
+## Code map
+
+| Path                                           | Responsibility                                                  |
+| ---------------------------------------------- | --------------------------------------------------------------- |
+| `crates/trusted-server-core/`                  | Runtime-neutral request, identity, consent, proxy, and ad logic |
+| `crates/trusted-server-core/src/publisher.rs`  | Publisher fallback, auction dispatch, and response processing   |
+| `crates/trusted-server-core/src/auction/`      | Auction orchestration and provider implementations              |
+| `crates/trusted-server-core/src/ec/`           | EC identity graph and administrative operations                 |
+| `crates/trusted-server-core/src/consent/`      | Consent extraction, decoding, and enforcement                   |
+| `crates/trusted-server-core/src/integrations/` | Server-side integration registry and handlers                   |
+| `crates/trusted-server-js/lib/src/`            | Browser-side TypeScript and integration modules                 |
+| `crates/trusted-server-adapter-*`              | Fastly, Axum, Cloudflare, and Spin runtime entry points         |
+| `crates/trusted-server-cli/`                   | Native `ts` operator CLI                                        |
+
+## First development loop
+
+1. Install the versions in `.tool-versions` with asdf or another version
+   manager. The pinned Node installation supplies npm, which a clean checkout
+   needs to generate the browser bundles.
+2. Follow [Getting Started](/guide/getting-started) and run the Axum adapter.
+   It is the shortest local path and requires no edge account.
+3. Use target-specific Cargo aliases. Bare workspace `cargo build` and
+   `cargo test` do not cover the mixed native and WebAssembly targets correctly.
+4. Re-run `cargo install-cli` after pulling CLI or configuration-schema changes
+   so the installed `ts` binary matches the checkout.
+5. Trace one request through the functions above, then make a focused change
+   next to an existing test. Use [Testing](/guide/testing) to select the matching
+   adapter gate.
+
+## Triage map
+
+| Symptom                           | Start here                                                                                          |
+| --------------------------------- | --------------------------------------------------------------------------------------------------- |
+| Build or test command fails       | [Testing](/guide/testing); confirm the adapter and target                                           |
+| Configuration is rejected         | [Configuration](/guide/configuration), then the [CLI guide](/guide/cli)                             |
+| Ads do not render                 | [GPT Diagnostics](/guide/integrations/gpt-diagnostics), then inspect the ad-stack and consent gates |
+| Behavior differs on a real site   | [Dev Proxy](/guide/ts-dev-proxy)                                                                    |
+| An adapter fails during startup   | [Error Reference](/guide/error-reference), then the adapter-specific guide                          |
+| An integration route is uncertain | [Integrations Overview](/guide/integrations-overview) and [API Reference](/guide/api-reference)     |
+
+For contribution scope, commit conventions, and required checks, read
+[CONTRIBUTING.md](https://github.com/IABTechLab/trusted-server/blob/main/CONTRIBUTING.md)
+and [AGENTS.md](https://github.com/IABTechLab/trusted-server/blob/main/AGENTS.md).
diff --git a/docs/guide/spin.md b/docs/guide/spin.md
new file mode 100644
index 000000000..a0e2f8fd3
--- /dev/null
+++ b/docs/guide/spin.md
@@ -0,0 +1,66 @@
+# Fermyon Spin deployment
+
+The Spin adapter packages Trusted Server as a WASI component. Startup reads
+the config blob from Spin's `default` key-value store and resolves credentials
+through Spin variables.
+
+## Support status
+
+| Adapter | Release status | Health | Startup status | Startup health | Provider fan-out | Trusted-client-IP handling | Request normalization            |
+| ------- | -------------- | ------ | -------------- | -------------- | ---------------- | -------------------------- | -------------------------------- |
+| `spin`  | experimental   | real   | `503`          | yes            | single           | outermost sanitize         | innermost Spin-header derivation |
+
+This row is the canonical status summary. Spin supports one enabled
+auction provider. When startup fails, its hardened router preserves `/health`
+but answers publisher routes with 503; neither response proves successful
+configuration.
+
+## Verify the complete local handoff
+
+With the Spin CLI installed, run:
+
+```bash
+./scripts/smoke-spin.sh
+```
+
+The script creates an isolated manifest and strictly validates a fresh app
+config. It maps the logical EdgeZero store with
+`EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME=default`, then runs `ts
+config push --adapter spin --local`. Without that mapping, the push can land in
+a store the runtime never reads. Local push writes the temporary
+`.spin/sqlite_key_value.db`; no repository-local Spin state is used.
+
+Spin encodes `v_<store>_v_<key>` names. The smoke supplies these exact
+variables:
+
+- `v_trusted_x5fserver_x5fsecrets_v_handler_x5fpassword`
+- `v_trusted_x5fserver_x5fsecrets_v_publisher_x5fproxy_x5fsecret`
+- `v_trusted_x5fserver_x5fsecrets_v_ec_x5fpassphrase`
+
+It first launches `spin up` before config is pushed, then relaunches it while
+omitting each variable independently. Every publisher request must return 503,
+and the controlled config or variable delta must identify the intended missing
+input. A generic degraded response cannot satisfy the check.
+
+The final non-health publisher request must return 200, retain the stub-origin
+sentinel, rewrite its origin URL to the Spin listener, and omit the original
+URL. The exit trap stops Spin and the stub origin and removes the isolated
+manifest, SQLite store, response captures, and logs.
+
+## Runtime boundaries
+
+Use the same store mapping and encoded variables in the deployment provider;
+empty variable defaults fail closed. Spin's request-time store registry is
+currently unwired, so EC KV lookup, request-signing key variables, and key
+rotation are unavailable. The read-only `/_ts/admin/eids` diagnostic remains
+available. Forwarded client-IP headers are sanitized, and Spin derives its
+runtime authority, scheme, and client-address headers in the innermost
+normalization layer.
+
+Spin is not installed in the integration CI environment. The recurring manual
+smoke therefore needs a named owner, tested commit, exact tool versions, and an
+expiry; those details are recorded with each run in the documentation-refresh
+evidence ledger.
+
+Compare the [Fastly](./fastly), [Cloudflare](./cloudflare), and
+[Axum](./axum-dev) adapter journeys.
diff --git a/docs/guide/telemetry.md b/docs/guide/telemetry.md
new file mode 100644
index 000000000..a4ad08b93
--- /dev/null
+++ b/docs/guide/telemetry.md
@@ -0,0 +1,51 @@
+# Auction Telemetry
+
+Trusted Server can emit bounded auction observations directly to Tinybird.
+Emission is currently wired only by the Fastly adapter. Other adapters use the
+core no-op sink even if they can parse the shared settings.
+
+## Data path
+
+The request entry point derives coarse `DeviceSignals`. Auction execution
+combines those signals with request and navigation facts in an
+`AuctionObservationContext`. The terminal auction outcome is converted into
+an `AuctionEventBatch` containing summary, provider-call, and bid rows.
+Fastly serializes the batch as NDJSON and starts one Tinybird Events API
+request to the configured auction datasource.
+
+Emission is best effort. Failure to construct or start telemetry is logged and
+must not change the customer response. The sink drops the in-flight handle
+after dispatch; it does not wait for Tinybird's response. Each batch is limited
+to 512 rows and `tinybird.max_body_bytes` bytes. The Fastly backend uses
+two-second first-byte and between-byte timeouts.
+
+## Privacy boundary
+
+Telemetry records operational auction facts, not the EC identifier. The event
+model includes coarse device classification, auction source and outcome,
+provider status and timing, slot dimensions, media type, seat, price,
+currency, win state, and selected creative identifiers. Tests reject the
+request's derived EC ID from serialized NDJSON.
+
+`browser_family` is a coarse User-Agent classification. Recognized values
+are `chrome`, `safari`, `firefox`, `edge`, and `opera`; unrecognized
+clients produce no value. Edge, Opera, and iOS-specific tokens are matched
+before generic Chrome or Safari tokens so embedded UA tokens do not
+misclassify them.
+
+## Configuration
+
+Set `tinybird.enabled = true`, provide the regional API host, select the
+auction datasource, and set `auction_token_secret` to the key holding that
+datasource's APPEND token in the default app-config secret store. The default
+datasource is `auction_events_raw`; the default body limit is 1 MiB and the
+minimum accepted limit is 1 KiB.
+
+`tinybird.access_enabled = true` is rejected because no access-log emitter is
+wired. `access_dataset` and `access_sample_rate` are reserved.
+`access_token_secret` is deprecated input and is normalized away; it cannot
+enable access telemetry.
+
+The exact settings and secret-handling dispositions are in
+[Configuration](/guide/configuration#tinybird). The tracked Tinybird project is
+described in [`tinybird/README.md`](https://github.com/IABTechLab/trusted-server/blob/main/tinybird/README.md).
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
index e1751bc49..bff414f7c 100644
--- a/docs/guide/testing.md
+++ b/docs/guide/testing.md
@@ -1,367 +1,139 @@
 # Testing
 
-Learn how to test Trusted Server locally and in CI/CD.
+Trusted Server spans native and WebAssembly targets. Use the repository's
+target-specific commands; `cargo test --workspace` is not a valid gate because
+the adapters do not share one compilation target.
 
-## Test Infrastructure
+## Required gates
 
-### Viceroy
+[AGENTS.md](https://github.com/IABTechLab/trusted-server/blob/main/AGENTS.md#ci-gates)
+is the single source of truth for the complete local and CI gate matrix. Run
+the checks that match the files you change. Pull-request CI covers the full
+supported operating-system and target matrix.
 
-Viceroy is the local test runtime for Fastly Compute applications. It simulates the Fastly environment locally and is required for running the WASM crate tests.
+## Adapter test targets
 
-```bash
-# Install viceroy
-cargo install viceroy --version 0.17.0 --locked --force
-
-# Run Fastly/WASM crate tests (viceroy is invoked automatically via .cargo/config.toml runner)
-cargo test-fastly
-```
+The aliases in `.cargo/config.toml` select the correct target and feature set:
 
-### Axum adapter tests
+| Adapter    | Test command            | Execution target                                         |
+| ---------- | ----------------------- | -------------------------------------------------------- |
+| Fastly     | `cargo test-fastly`     | `wasm32-wasip1` under Viceroy                            |
+| Axum       | `cargo test-axum`       | Native host                                              |
+| Cloudflare | `cargo test-cloudflare` | Native host tests; production builds use WASM            |
+| Spin       | `cargo test-spin`       | Native host tests; production builds use `wasm32-wasip1` |
 
-The Axum adapter runs as a native binary — no Viceroy or WASM toolchain needed:
+Fastly tests require the Viceroy version recorded in `.tool-versions`:
 
 ```bash
-cargo test-axum
-```
-
-### Test Organization
-
-Tests are organized alongside source code in `#[cfg(test)]` modules:
-
-```rust
-// crates/trusted-server-core/src/ec/generation.rs
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_generate_ec_id() {
-        let settings = create_test_settings();
-        let req = create_test_request(vec![
-            (header::USER_AGENT, "Mozilla/5.0"),
-            (header::COOKIE, "pub_userid=12345"),
-        ]);
-
-        let ec_id = generate_ec_id(&settings, &req)
-            .expect("should generate EC ID");
-
-        assert!(!ec_id.is_empty());
-    }
-}
+cargo install viceroy --version 0.17.0 --locked --force
+rustup target add wasm32-wasip1 wasm32-unknown-unknown
 ```
 
-## Running Tests
-
-### Unit Tests
+Pass a test-name filter after an alias to narrow a run:
 
 ```bash
-# Run Fastly/WASM crate tests (requires Viceroy)
-cargo test-fastly
-
-# Run Axum adapter tests (native)
-cargo test-axum
-
-# Run a specific test by name (Fastly/WASM)
 cargo test-fastly test_generate_ec_id
-
-# Run a specific test by name (Axum native)
-cargo test-axum test_generate_ec_id
-
-# Run tests for a specific crate (native)
-cargo test -p trusted-server-core
-
-# Run tests matching a pattern (Fastly/WASM)
-cargo test-fastly ec
+cargo test-axum sets_geo_unavailable_header
 ```
 
-### Integration Tests
-
-The integration test suite runs the full pipeline against Docker containers using both the Fastly (Viceroy) and Axum runtimes:
-
-```bash
-# Build both runtimes and run all integration tests
-./scripts/integration-tests.sh
+Tests live beside their implementations in `#[cfg(test)]` modules. Read the
+source test instead of copying it into another document; for example, EC ID
+tests are in `crates/trusted-server-core/src/edge_cookie.rs`, creative rewrite
+tests are in `crates/trusted-server-core/src/creative.rs`, and proxy tests are
+in `crates/trusted-server-core/src/proxy.rs`.
 
-# Run a single test
-./scripts/integration-tests.sh test_wordpress_axum
-./scripts/integration-tests.sh test_wordpress_fastly
-```
+## Documentation checks
 
-### Local Server Testing
-
-**Axum dev server** (no Fastly CLI required):
+Check the documentation surfaces from the repository root:
 
 ```bash
-# Start the Axum dev server
-cargo run -p trusted-server-adapter-axum
-
-# Test endpoints with curl
-curl http://localhost:8787/.well-known/trusted-server.json
-```
-
-**Fastly Viceroy** (requires Fastly CLI):
-
-```bash
-# Start local Fastly simulator
-fastly compute serve
-
-# Test endpoints with curl
-curl http://localhost:7676/.well-known/trusted-server.json
-```
+# Lint, format-check, and build the VitePress site (fails on dead links)
+cd docs && npm ci && npm run lint && npm run format && npm run build
 
-## Real Test Examples
-
-### EC ID Tests
-
-From `crates/trusted-server-core/src/ec/mod.rs`:
-
-```rust
-#[test]
-fn test_get_ec_id_with_header() {
-    let settings = create_test_settings();
-    let req = create_test_request(vec![(
-        HEADER_X_TS_EC,
-        "existing_ec_id",
-    )]);
-
-    let ec_id = get_ec_id(&req)
-        .expect("should get EC ID");
-    assert_eq!(ec_id, Some("existing_ec_id".to_string()));
-}
-
-#[test]
-fn test_get_ec_id_with_cookie() {
-    let settings = create_test_settings();
-    let req = create_test_request(vec![
-        (header::COOKIE, "ts-ec=existing_cookie_id")
-    ]);
-
-    let ec_id = get_ec_id(&req)
-        .expect("should get EC ID");
-    assert_eq!(ec_id, Some("existing_cookie_id".to_string()));
-}
-
-#[test]
-fn test_get_ec_id_none() {
-    let req = create_test_request(vec![]);
-    let ec_id = get_ec_id(&req)
-        .expect("should handle missing ID");
-    assert!(ec_id.is_none());
-}
+# Compile the maintained documentation snippet against the current core
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test documentation_snippets
 ```
 
-### Creative Rewriting Tests
-
-From `crates/trusted-server-core/src/creative.rs`:
-
-```rust
-#[test]
-fn rewrites_width_height_attrs() {
-    let settings = create_test_settings();
-    let html = r#"<div><img width="1" height="1" src="https://t.example/p.gif"></div>"#;
-
-    let out = rewrite_creative_html(&settings, html);
-
-    assert!(out.contains("/first-party/proxy?tsurl="), "{}", out);
-}
-
-#[test]
-fn injects_tsjs_creative_when_body_present() {
-    let settings = create_test_settings();
-    let html = r#"<html><body><p>hello</p></body></html>"#;
-
-    let out = rewrite_creative_html(&settings, html);
-
-    assert!(
-        out.contains("/static/tsjs=tsjs-unified.min.js"),
-        "expected unified tsjs injection: {}",
-        out
-    );
-    // Inject only once
-    assert_eq!(out.matches("/static/tsjs=tsjs-unified.min.js").count(), 1);
-}
+The site build also runs on every pull request through the `format-docs` job.
 
-#[test]
-fn rewrite_style_urls_handles_absolute_and_relative() {
-    let settings = create_test_settings();
-    let css = "background:url(https://cdn.example/a.png); border-image: url(/local/border.png)";
+## Cross-adapter parity and snippets
 
-    let out = rewrite_style_urls(&settings, css);
+The native integration-test crate compares shared router behavior and compiles
+the maintained integration-guide fixture:
 
-    // Absolute URLs rewritten
-    assert!(out.contains("/first-party/proxy?tsurl="));
-    // Relative URLs left as-is
-    assert!(out.contains("url(/local/border.png)"));
-}
-```
-
-### Proxy Tests
-
-From `crates/trusted-server-core/src/proxy.rs`:
-
-```rust
-#[test]
-fn proxy_request_config_supports_streaming_and_headers() {
-    let cfg = ProxyRequestConfig::new("https://example.com/asset")
-        .with_body(vec![1, 2, 3])
-        .with_header(
-            header::CONTENT_TYPE,
-            HeaderValue::from_static("application/octet-stream"),
-        )
-        .with_streaming();
-
-    assert_eq!(cfg.target_url, "https://example.com/asset");
-    assert!(cfg.follow_redirects, "should follow redirects by default");
-    assert!(cfg.forward_ec_id, "should forward EC ID by default");
-}
-
-#[test]
-fn header_copy_copies_curated_set() {
-    let mut src = Request::new(Method::GET, "https://edge.example/first-party/proxy");
-    src.set_header(HEADER_USER_AGENT, "UA/1.0");
-    src.set_header(HEADER_ACCEPT, "image/*");
-    src.set_header(HEADER_REFERER, "https://pub.example/page");
-
-    let mut dst = Request::new(Method::GET, "https://cdn.example/a.png");
-    copy_proxy_forward_headers(&src, &mut dst);
-
-    assert_eq!(
-        dst.get_header(HEADER_USER_AGENT).unwrap().to_str().unwrap(),
-        "UA/1.0"
-    );
-}
+```bash
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test documentation_snippets
 ```
 
-## Test Helpers
-
-The codebase provides test utilities in `crates/trusted-server-core/src/test_support.rs`:
-
-```rust
-use crate::test_support::tests::{create_test_settings, create_test_request};
-
-// Create settings with test defaults
-let settings = create_test_settings();
-
-// Create a request with specific headers
-let req = create_test_request(vec![
-    (header::USER_AGENT, "Mozilla/5.0"),
-    (header::COOKIE, "session=abc123"),
-]);
-```
+The snippet gate covers the marked fixture in the integration guide. Other
+Rust examples must either be rustdoc tests or link to their source tests; prose
+pages must not present copied implementation fragments as compiled examples.
 
-## Code Quality
+## End-to-end publisher tests
 
-### Formatting
+The end-to-end script builds the Fastly and Axum adapters, creates generated
+Viceroy configuration under `target/integration-test-artifacts`, builds the
+WordPress and Next.js Docker fixtures, and runs the ignored integration suite
+serially:
 
 ```bash
-# Check formatting
-cargo fmt --check
-
-# Auto-format code
-cargo fmt
+./scripts/integration-tests.sh
 ```
 
-### Linting
+Pass a test filter to run one path:
 
 ```bash
-# Run clippy for Fastly/WASM adapter
-cargo clippy-fastly
-
-# Run clippy for Axum native adapter
-cargo clippy-axum
-
-# Fix clippy warnings automatically (Axum)
-cargo clippy-axum --fix --allow-dirty
+./scripts/integration-tests.sh test_wordpress_axum
+./scripts/integration-tests.sh test_nextjs_fastly
 ```
 
-### Code Coverage
+Browser coverage uses Playwright and Chromium against both fixtures:
 
 ```bash
-# Generate coverage report (requires cargo-tarpaulin)
-cargo install cargo-tarpaulin
-cargo tarpaulin --out Html
+./scripts/integration-tests-browser.sh
 ```
 
-## CI/CD Testing
-
-### GitHub Actions
-
-Tests run automatically on pull requests and main branch commits. See `.github/workflows/` for the complete CI configuration.
-
-```yaml
-# Example workflow (see .github/workflows/test.yml for the full version)
-name: Test
-on: [push, pull_request]
-jobs:
-  test-rust: # Fastly/WASM crates — requires Viceroy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install Rust
-        uses: dtolnay/rust-action@stable
-      - name: Run tests
-        run: cargo test-fastly
-      - name: Run clippy
-        run: cargo clippy-fastly
-
-  test-axum: # Axum native adapter — no Viceroy needed
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build Axum adapter
-        run: cargo build -p trusted-server-adapter-axum
-      - name: Run Axum adapter tests
-        run: cargo test-axum
-```
+These suites require Docker, the pinned Node.js version, Viceroy, and the
+`wasm32-wasip1` target. See the
+[integration-test crate README](https://github.com/IABTechLab/trusted-server/blob/main/crates/trusted-server-integration-tests/README.md)
+for the exact surfaces and retained build artifacts.
 
-## Debugging Tests
+## Adapter runtime smokes
 
-### Enable Debug Logging
+Each smoke script starts a real local runtime in temporary state. It verifies
+missing configuration, each required secret, and a successful publisher proxy
+request with URL rewriting:
 
 ```bash
-RUST_LOG=debug cargo test-axum -- --nocapture
+./scripts/smoke-axum.sh
+./scripts/smoke-fastly.sh
+./scripts/smoke-cloudflare.sh
+./scripts/smoke-spin.sh
 ```
 
-### Run Single Test with Full Output
+The scripts build a missing adapter artifact when necessary. They require the
+corresponding runtime CLI: Fastly CLI for Fastly, the pinned Wrangler release
+for Cloudflare, and Spin CLI for Spin. Default ports can be overridden through
+the environment variables documented in `scripts/README.md`.
 
-```bash
-cargo test-axum test_name -- --nocapture --test-threads=1
-```
+## Debugging a failure
 
-### Viceroy Limitations
-
-When tests fail, viceroy doesn't display line numbers. To debug:
-
-1. Run with `--nocapture` to see all output
-2. Add `log::info!()` statements to trace execution
-3. Run specific tests in isolation with `--test-threads=1`
-
-## Performance Testing
-
-### Load Testing
+Show captured output and serialize a focused test when ordering or shared test
+state matters:
 
 ```bash
-# Using wrk
-wrk -t12 -c400 -d30s http://localhost:7676/
-
-# Using hey
-hey -n 10000 -c 100 http://localhost:7676/
-
-# Using k6
-k6 run load-test.js
+RUST_LOG=debug cargo test-axum test_name -- --nocapture --test-threads=1
+cargo test-fastly test_name -- --nocapture --test-threads=1
 ```
 
-## Best Practices
-
-1. **Test all new features** - Write tests alongside new code
-2. **Use descriptive names** - `test_ec_id_generation_with_consent`
-3. **Test edge cases** - Empty inputs, missing headers, invalid data
-4. **Keep tests fast** - Mock external dependencies
-5. **Use test helpers** - `create_test_settings()`, `create_test_request()`
-6. **Assert specific values** - Not just `assert!(result.is_ok())`
+Viceroy reports the guest test output but may not provide a native-style stack
+trace. Narrow the test filter first, then add temporary `log` diagnostics near
+the failing boundary. Do not use `println!` in production code.
 
-## Next Steps
+## Related guides
 
-- Review [Architecture](/guide/architecture) for system design
-- Configure your [Deployment](/guide/configuration)
-- Learn about [Request Signing](/guide/request-signing)
+- [Auction testing](/guide/auction-testing)
+- [Architecture](/guide/architecture)
+- [Configuration](/guide/configuration)
+- [Request signing](/guide/request-signing)
diff --git a/docs/guide/tsjs.md b/docs/guide/tsjs.md
new file mode 100644
index 000000000..83410de4e
--- /dev/null
+++ b/docs/guide/tsjs.md
@@ -0,0 +1,43 @@
+# Trusted Server JavaScript
+
+`tsjs` is the browser runtime produced by
+`crates/trusted-server-js/lib`. It supplies shared registry/render behavior
+and integration modules selected by the server-side registry.
+
+## Module and bundle inventory
+
+There are 12 integration source modules: `creative`, `datadome`, `didomi`,
+`google_tag_manager`, `gpt`, `gpt_diagnostics`, `lockr`, `osano`,
+`permutive`, `prebid`, `sourcepoint`, and `testlight`. The build emits
+13 named bundles because it also emits `core`.
+
+Those counts do not mean a page downloads 13 scripts. The server computes one
+content-addressed unified bundle from `core` plus the enabled immediate
+modules. Its URL includes the exact module-set hash, so different enabled sets
+do not share incorrect browser or edge-cache bytes.
+
+## Loading modes
+
+- Immediate modules are compiled into the synchronous unified bundle.
+- Prebid's integration shim is deferred and loaded separately after the
+  immediate bundle.
+- `gpt_diagnostics` is excluded from both unified and deferred registry
+  output. When the server's request decision enables diagnostics, it injects a
+  dedicated synchronous standalone tag.
+
+The first-party external Prebid.js artifact is a separate concern. When
+configured, `GET /integrations/prebid/bundle.js` proxies the operator-built
+bundle; it is not the deferred integration shim.
+
+## Runtime contract
+
+Modules register against the shared `window.tsjs` namespace. The registry
+orders initialization and avoids duplicate installation. Server-injected
+bootstrap state may exist before the compiled bundle loads; module setup must
+therefore be idempotent and preserve the server's handoff state.
+
+Dynamic script guards use one shared DOM insertion dispatcher. An integration
+may decide whether a candidate script is replaced, removed, or left alone, but
+must not install a competing global `appendChild` or `insertBefore` wrapper.
+See [GPT](/guide/integrations/gpt) for the slot/bootstrap handoff and
+[Integration Guide](/guide/integration-guide) for extension boundaries.
diff --git a/docs/internal/onboarding.md b/docs/internal/onboarding.md
new file mode 100644
index 000000000..7a84844e7
--- /dev/null
+++ b/docs/internal/onboarding.md
@@ -0,0 +1,42 @@
+# Maintainer Onboarding
+
+This document collects public repository and setup pointers for maintainers.
+For project usage, start with the public guides.
+
+## Start here
+
+- [What is Trusted Server?](../guide/what-is-trusted-server.md)
+- [Architecture](../guide/architecture.md)
+- [Getting Started](../guide/getting-started.md)
+- [Configuration](../guide/configuration.md)
+- [Testing](../guide/testing.md)
+- [Integrations Overview](../guide/integrations-overview.md)
+- [Integration Guide](../guide/integration-guide.md)
+
+## Local setup
+
+- Tool versions are defined in `.tool-versions`.
+- Documentation development instructions are in `docs/README.md`.
+- Contribution requirements are in
+  [CONTRIBUTING.md](https://github.com/IABTechLab/trusted-server/blob/main/CONTRIBUTING.md).
+
+## Codebase pointers
+
+| Path                                                      | Purpose                           |
+| --------------------------------------------------------- | --------------------------------- |
+| `crates/trusted-server-adapter-fastly/src/main.rs`        | Request routing entry point       |
+| `crates/trusted-server-core/src/publisher.rs`             | Publisher origin handling         |
+| `crates/trusted-server-core/src/proxy.rs`                 | First-party proxy implementation  |
+| `crates/trusted-server-core/src/ec/`                      | EC identity subsystem             |
+| `crates/trusted-server-core/src/integrations/registry.rs` | Integration module registry       |
+| `trusted-server.example.toml`                             | Example application configuration |
+
+## Development workflow
+
+- Follow [CONTRIBUTING.md](https://github.com/IABTechLab/trusted-server/blob/main/CONTRIBUTING.md)
+  when preparing changes.
+- Use the [Testing guide](../guide/testing.md) for test commands.
+- Use the [Integration Guide](../guide/integration-guide.md) when adding an
+  integration.
+- Report bugs and request changes through the repository's public
+  [GitHub issues](https://github.com/IABTechLab/trusted-server/issues).
diff --git a/docs/internal/runbooks/documentation-automation-release.md b/docs/internal/runbooks/documentation-automation-release.md
new file mode 100644
index 000000000..d8d956291
--- /dev/null
+++ b/docs/internal/runbooks/documentation-automation-release.md
@@ -0,0 +1,67 @@
+# Documentation Release Verification
+
+Use this runbook after PR #1049 reaches `main`. It verifies the deployed
+VitePress site. Repository tests and pull-request checks do not prove DNS, TLS,
+redirect, or hosted-content behavior.
+
+## Identify the deployment
+
+1. Resolve the merge commit with `git rev-parse origin/main`.
+2. Find the successful Deploy VitePress Docs workflow run for that exact SHA.
+3. Record the run ID, attempt, build job, deploy job, deployment URL, and GitHub
+   App identity.
+4. Stop if the deployed source SHA differs from the merge commit under review.
+
+## Verify the project-path site
+
+Request the deployed project root and representative pages from every navigation
+group:
+
+- landing and getting started;
+- configuration and EdgeZero;
+- API and all four adapter guides;
+- integrations and auction testing;
+- telemetry, JavaScript, CLI, errors, and testing.
+
+Require HTTP success, expected page-specific content, and a canonical URL under
+the `/trusted-server/` project path.
+
+Parse deployed HTML and request representative CSS, JavaScript, image, and font
+assets. Every local asset URL must preserve the project path and return
+successfully.
+
+## Verify containment
+
+Require no public route or navigation entry for:
+
+- `docs/internal/**`;
+- `docs/superpowers/**`;
+- repository-team onboarding;
+- the archived FAQ proof of concept; or
+- the unverified business-use-case source.
+
+A themed soft-404 is not proof of absence. Record the response status, final
+URL, and enough response text to distinguish an absent route from published
+content.
+
+## Verify CNAME behavior
+
+At the deployed source SHA, require `docs/public/CNAME` to be absent. Record:
+
+- DNS answers for the GitHub Pages host;
+- redirect chain from the project URL;
+- TLS hostname and certificate result;
+- canonical link; and
+- final asset paths.
+
+Do not infer custom-domain state from repository content alone.
+
+## Evidence handling
+
+Post the deployment receipt to PR #1049 or the release record selected by the
+maintainers. Include the exact deployed SHA and timestamp. Remove tokens,
+cookies, credential-bearing headers, and secrets before posting.
+
+If verification fails, open one focused repair issue containing the failed URL,
+expected behavior, observed status/redirect/content, deployed SHA, and workflow
+run. Do not weaken containment or restore the placeholder `CNAME` as a repair.
diff --git a/docs/package-lock.json b/docs/package-lock.json
index e31c9db5e..89cebb372 100644
--- a/docs/package-lock.json
+++ b/docs/package-lock.json
@@ -7,7 +7,7 @@
     "": {
       "name": "trusted-server-docs",
       "version": "1.0.0",
-      "license": "ISC",
+      "license": "Apache-2.0",
       "devDependencies": {
         "@eslint/js": "^10",
         "@types/node": "^24.10",
diff --git a/docs/package.json b/docs/package.json
index f74991a4c..c70fc831d 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -1,14 +1,16 @@
 {
   "name": "trusted-server-docs",
   "version": "1.0.0",
+  "private": true,
   "description": "Documentation site for Trusted Server",
-  "license": "ISC",
+  "license": "Apache-2.0",
   "author": "",
   "type": "module",
   "scripts": {
     "dev": "vitepress dev",
     "build": "vitepress build",
     "preview": "vitepress preview",
+    "check": "npm run lint && npm run format && npm run build",
     "format": "prettier --check .",
     "format:write": "prettier --write .",
     "lint": "eslint .",
diff --git a/docs/public/CNAME b/docs/public/CNAME
deleted file mode 100644
index dead23eda..000000000
--- a/docs/public/CNAME
+++ /dev/null
@@ -1 +0,0 @@
-your-custom-domain.com
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 2dd1189f2..f6645c12e 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,273 +1,59 @@
 # Roadmap
 
-The Trusted Server roadmap is organized around three strategic initiatives aligned with our GitHub project structure. This page outlines features currently in development and planned for 2026.
-
-## Overview
-
-Our development is focused on three key areas:
-
-1. **Edge Platform** - Code execution, proxy capabilities, and runtime support
-2. **Monetization** - Ad serving, identity, and bidstream integration
-3. **Transaction Trust** - Attestation, measurement, and fraud prevention
-
----
-
-## 🚀 Edge Platform: Code Execution, Proxy, and Runtime
-
-### In-Flight
-
-**Cloudflare Workers Support**
-
-- Adapt `/common/` crate for Cloudflare Workers runtime
-- Create platform-specific adapter in `/cloudflare/` crate
-- Maintain feature parity with Fastly Compute
-- Enable multi-platform publisher deployments
-
-**Next.js RSC (React Server Components) Enhancements**
-
-- Improved streaming support for App Router
-- Better hydration data parsing
-- Enhanced origin URL rewriting
-
-### Planned for 2026
-
-**SPIN + Akamai EdgeWorkers Support**
-
-- Port Trusted Server to Fermyon SPIN runtime
-- Enable deployment on Akamai's edge platform
-- WebAssembly Component Model adoption
-- Cross-platform WASI compatibility
-
-**Encoding/Decoding Streaming Improvements**
-
-- Enhanced Gzip, Brotli, Deflate streaming support
-- Memory-efficient large file processing
-- Improved compression passthrough modes
-
-**WebSockets Support**
-
-- Real-time bidirectional communication at the edge
-- Server-sent events (SSE) for live updates
-- Enhanced streaming auction support
-
-**Header Configuration Enhancements**
-
-- Advanced CORS policy management
-- Content Security Policy (CSP) templating
-- X-Frame-Options and crossorigin attribute control
-- Security header automation
-
----
-
-## 💰 Monetization: SSPs, DSPs, PBS, Ad-Servers, ID Providers
-
-### In-Flight
-
-**Prebid Server Integration Enhancements**
-
-- Improved OpenRTB 2.x support
-- Enhanced bidder configuration
-- Better timeout management
-
-**Permutive Audience Data**
-
-- First-party audience segmentation
-- Real-time cohort updates
-- Secure Signals integration
-
-**Amazon Publisher Services (APS) OpenRTB Integration**
-
-- Banner OpenRTB bidding with decoded-price competition
-- Opaque sandboxed rendering for direct and GAM/Universal Creative paths
-- Controlled rollout pending APS account-team confirmation for edge-originated traffic
-
-### Planned for 2026
-
-**Full Google Ad Manager (GAM) Support**
-
-- Complete GAM publisher integration
-- Dynamic ad slot management
-- Programmatic guaranteed support
-- First-party GAM reporting
-
-**Kargo SSP Integration**
-
-- Native Kargo bid adapter
-- First-party creative rendering
-- Enhanced viewability tracking
-
-**Additional SSP Integrations**
-
-- Index Exchange
-- OpenX
-- PubMatic
-- Other major SSPs
-
-**Prebid Server Rust Port**
-
-- Native Rust implementation of Prebid Server
-- Embedded WASM-based bidder adapters
-- Zero-cold-start header bidding
-- Reduce external dependencies
-
-**Better EC ID Syncing**
-
-- Enhanced ID sync with downstream partners
-- Batch sync optimization
-- Partner ID mapping tables
-- Sync status monitoring
-
-**Standalone EC ID Service**
-
-- Dedicated ID generation microservice
-- Cross-publisher ID graph support
-- ID resolution with configurable consent controls
-- API-first architecture
-
-**OpenRTB Geo Signal Enrichment**
-
-- Push X-Geo signals into bidstream
-- City, continent, coordinates, metro-code (DMA)
-- Country and region data
-- IP geolocation integration
-
-**Agentic Frameworks for Dynamic Ad Optimization**
-
-- LLM-powered ad relevance scoring
-- Context-aware creative selection
-- Real-time optimization agents
-
-**Content Protection & RSL Protocol**
-
-- Really Simple Licensing (RSL) integration
-- AI crawler detection and blocking
-- Content usage attribution
-- Licensing metadata injection
-
----
-
-## 🛡️ Transaction Trust: Attestation, Measurement, IVT & Fraud Prevention
-
-### In-Flight
-
-**Request Signing & JWKS**
-
-- Ed25519 cryptographic signing
-- JSON Web Key Set (JWKS) discovery
-- Key rotation automation
-
-### Planned for 2026
-
-**Advanced Observability and Security Tooling**
-
-A comprehensive creative forensics engine for ad behavior monitoring and fraud prevention:
-
-**Capabilities:**
-
-- Real-time creative behavior analysis using headless browser automation
-- Network traffic interception and validation
-- DOM manipulation detection
-- Unauthorized data exfiltration prevention
-- Malvertising and malicious script identification
-
-**Business Impact:**
-
-- **Compliance Support**: Detect and block creative behavior that conflicts with the publisher's consent policy (potential $2.3M+ fine risk reduction)
-- **Revenue Protection**: Detect bid manipulation and auction fraud ($400K+ annual recovery potential)
-- **User Trust**: Block malvertising before it reaches users (prevent user exodus, retain 100K+ users)
-- **Brand Safety**: Real-time creative quality assurance
-
-**Technical Implementation:**
-
-- Headless browser integration (Playwright/Puppeteer)
-- Chrome DevTools Protocol (CDP) for network inspection
-- Edge + backend hybrid architecture
-- Real-time alerting and blocking
-
-**LLM-Crawler Detection & .md Versions**
-
-- Detect AI training crawlers (GPTBot, Claude-Web, etc.)
-- Serve markdown versions for authorized AI consumption
-- Track AI content usage with RSL metadata
-- Content attribution and licensing
-
-**JavaScript Parsing/Evaluation Engine**
-
-- Safe JS execution sandbox at the edge
-- Creative script analysis before rendering
-- Malicious code detection
-- Dynamic creative validation
-
-**Verified Builds & Attestation**
-
-- Reproducible WASM builds
-- Cryptographic build verification
-- Transparency logs for deployed code
-- Publisher trust attestation
-
-**Invalid Traffic (IVT) Detection**
-
-- Bot traffic identification
-- Sophisticated invalid traffic (SIVT) detection
-- Fraud score attribution
-- Real-time traffic filtering
-
-**Consent Management Platform (CMP) Enhancements**
-
-- Deeper Didomi integration
-- OneTrust support
-- Quantcast CMP integration
-- TCF v2.2 format decoding and enforcement support. TCF is one consent framework among others, including GPP and GPC
-
----
-
-## Timeline & Priorities
-
-### Q1 2026
-
-- Cloudflare Workers Support (production ready)
-- Full GAM Integration
-- Advanced Observability tooling (beta)
-
-### Q2 2026
-
-- SPIN + Akamai Support
-- Prebid Server Rust Port (alpha)
-- Standalone EC ID Service
-
-### Q3 2026
-
-- Additional SSP Integrations (Index, OpenX, PubMatic)
-- LLM-Crawler Detection
-- Verified Builds
-
-### Q4 2026
-
-- Agentic frameworks for ad optimization
-- IVT detection (production)
-- WebSockets support
-
----
-
-## Contributing
-
-Interested in contributing to these initiatives? Check out our [GitHub Issues](https://github.com/IABTechLab/trusted-server/issues) for specific tasks and discussions.
-
-### How to Contribute
-
-1. **Pick an Initiative**: Choose from the roadmap above
-2. **Check Issues**: Look for existing issues or create a new one
-3. **Discuss Design**: Propose your approach in the issue
-4. **Submit PR**: Follow our [contribution guidelines](https://github.com/IABTechLab/trusted-server/blob/main/CONTRIBUTING.md)
-
----
-
-## Feedback
-
-Have ideas for the roadmap? [Open an issue](https://github.com/IABTechLab/trusted-server/issues/new) or join the discussion in our community channels.
-
-## Next Steps
-
-- Review [Architecture](/guide/architecture) to understand the system
-- Explore [Integration Guide](/guide/integration-guide) to build custom integrations
-- Check [Configuration](/guide/configuration) for deployment options
+This page separates shipped behavior from active engineering and deferred
+ideas. It does not assign release dates. GitHub issues and accepted design
+documents are the source for committed future work.
+
+## Shipped
+
+- Fastly Compute, Cloudflare Workers, and Fermyon Spin adapters, plus the
+  native Axum development adapter.
+- Publisher-origin proxying and shared HTML/creative processing.
+- Edge Cookie generation, consent evaluation, partner identity sync, and
+  administrative EC routes.
+- Server-side auctions with generic OpenRTB, Prebid Server, and APS profiles;
+  optional `adserver_mock` mediation; and first-party creative delivery.
+- Request signing, JWKS discovery, key-management routes, and signature
+  verification.
+- TSJS core and integration modules selected from the checked Rust and JS
+  registries.
+
+Shipped does not imply identical adapter capabilities. Consult the deployment
+and API references for target-specific route, store, fan-out, and telemetry
+limits.
+
+## Active engineering
+
+The repository currently tracks follow-up work for these verified gaps:
+
+- complete config-store integration on adapters whose runtime cannot yet read
+  the store written by `ts config push`;
+- align health and startup-failure behavior across adapters;
+- decide whether standard-profile `imp_ext` needs reserved-member protection;
+- remove or implement dead adapter configuration surfaces;
+- make Fastly staging deployments select the staging config blob; and
+- retire the deprecated `GET /__ts/page-bids` alias after measured traffic has
+  moved to `GET /_ts/page-bids`.
+
+## Deferred or unshipped
+
+The following are not current product capabilities:
+
+- direct Google Ad Manager or Kargo integrations;
+- a headless-browser creative-forensics or malvertising-blocking service;
+- invalid-traffic scoring, automated fraud detection, or an LLM optimization
+  framework;
+- WebSocket auction transport;
+- Akamai EdgeWorkers support; and
+- a standalone cross-publisher identity service.
+
+The excluded `business-use-cases.md` file contains unverified planning claims,
+including quantified benefits and malvertising detection. Those claims are not
+evidence of shipped functionality.
+
+## Proposing work
+
+Search the [issue tracker](https://github.com/IABTechLab/trusted-server/issues)
+before opening a proposal. A proposal should identify the affected adapter or
+core surface, define observable acceptance criteria, and avoid promising a
+release date until maintainers schedule it.
diff --git a/docs/superpowers/archive/FAQ_POC.md b/docs/superpowers/archive/FAQ_POC.md
new file mode 100644
index 000000000..991f059e6
--- /dev/null
+++ b/docs/superpowers/archive/FAQ_POC.md
@@ -0,0 +1,46 @@
+# Archived proof-of-concept FAQ
+
+> Historical record. This FAQ described the original proof of concept and is
+> not current product or operational documentation.
+
+**What is Trusted Server POC?**
+The POC or proof of concept is to prove the technical feasibility of managing advertising for publishers on the server. It uses the edge cloud like Fastly, Akamai etc. to initiate ad requests, integrate prebid server, receive ad response and stitch the ad on the server before sending the page to the client browser. In addition it showcases the capabilities to maintain a key-value (kv) store to use critical data needed by a publisher for advertising and the capability to uniquely identify a user agent using a persistent id
+
+**Is this ready for use by publishers?**
+NO. It is NOT a version 1.0 and is NOT ready for use by a punisher in its current form.Its a proof of concept (POC). The purpose is to showcase technical feasibility of executing publisher advertising functions server side and initiate industry effort to define and build an MVP or version 1.0 that is ready for use by publishers
+
+**Why did Tech Lab build the Trusted Server POC?**
+Today all of the publisher advertising is managed using third party providers, telemetry and capabilities available on the browser. New privacy initiatives and proposals by all major browsers are severely restricting most third party activities and telemetry used in advertising thus making it less and less effective, for e.g. third party cookie deprecation. Moreover, ad blocking is only growing worldwide. Managing ad requests on the edge cloud offers several advantages and better controls to the publisher, for e.g. device and user identification,enabling third parties with better control, managing privacy and improving page performance.
+
+**Will the Trusted Server work for mobile in app advertising?**
+The POC is designed for browsers and the initial trusted server focus is to support browser traffic. A second phase will focus on mobile apps.
+
+**Is the Trusted Server free?**
+YES. The trusted server will be free and open source and offered under Apache 2.0 license terms.
+
+**Does the POC integrate with my CMS?**
+As of today, it doesn’t. This is a simple POC where we are hosting the very basic HTML/JS content inside the Trusted Server application itself. We will begin to release modules and reference architecture as the project moves forward. We’d also love contributions from our community on this front!
+
+**What is the vision for MVP or version 1.0?**
+Tech Lab envisions the MVP to incorporate capabilities to make a valid Open RTB ad request using a prebid server and process the response for native, display and video ads. Our current plan for MVP version is that it can support addressability (user/device signals, ID solutions, other audience and targeting solutions), privacy management (CMP execution, GPP and TCF strings), CMS integration, Publisher Ad server integration and prebid server integration. We look forward to the industry to help develop the MVP definition.
+
+**Will Tech Lab build all the capabilities?**
+NOT all the capabilities. Tech Lab will build and support core services to enable existing publisher and adtech companies to build their own modules to support publisher advertising capabilities.
+
+**Does the Trusteed Server preclude using third party tags?**
+No, it does not. You should be able to begin migrating certain modules and parts of your content and experience as you go, without a forklift upgrade. We plan to support server side tagging capabilities to enable third party support.
+
+**Why are you only using two partners in the POC?**
+Fastly and Equativ volunteered time and resources to us and they fit the technical needs and requirements for Trusted Server. For the sake of getting to market ASAP, we chose to double down on these two partners. We do not play favorites or have any financial incentive with these two companies and will begin implementing on other partners in the near future. Any ad exchange supporting prebid server requests should already find support. We will prioritize modules for other edge cloud providers based on industry priorities
+
+**How will this project be managed?**
+Tech lab has created the ‘Trusted Server Taskforce’ to manage the requirements and roadmap for the project. We will maintain a core engineering team to build based on task force priorities and invite community contributions, especially third party providers to build their tags and modules for publishers.
+
+**How will you support the publishers planning to implement?**
+Yes! As of today we will be providing community support on a best effort basis as we scale up the architecture and use cases. We will do our best to respond to inquiries in the Github project as quickly as we can.
+
+**How will it work for medium size publishers using managed Word Press hosting (Ghost)?**
+Yes. As long as your managed service provider can separate the edge from the CMS, They should be able to run trusted server. Some work may be necessary and we look to the community for contributions in defining and building for it.
+
+**How will this comply with Privacy regulations?**
+The trusted server will have modules to support Consent Management Providers (CMP) and send the GPP or TCF string as required in the ad request.
diff --git a/docs/superpowers/plans/2026-08-30-documentation-refresh.md b/docs/superpowers/plans/2026-08-30-documentation-refresh.md
new file mode 100644
index 000000000..1e62cfea8
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-30-documentation-refresh.md
@@ -0,0 +1,275 @@
+# Documentation Refresh Implementation Plan
+
+- Status: executed on `spec-docs-refresh`
+- PR: https://github.com/IABTechLab/trusted-server/pull/1049
+- Base: `07dfc1c6dddf69345ded17bd2d40a3d01bb39bcf`
+- Revised: 2026-09-14 after reviewer scope and onboarding corrections
+
+## Goal
+
+Refresh the maintained documentation against shipped code, preserve the
+publisher setup journey, and verify every supported runtime without introducing
+a separate documentation tooling platform.
+
+## Delivery rules
+
+- Commit every package to PR #1049; create no individual PRs.
+- Keep the public documentation and ordinary regression coverage.
+- Do not add a standalone analysis workspace, generator manifests, scheduled
+  issue writers, or dependency-submission automation.
+- Use exact action release tags.
+- Delegate workflow logic longer than one line to repository scripts.
+- Keep the complete CI command matrix only in `CLAUDE.md`.
+- Bind historical evidence only to immutable commit SHAs; never describe a
+  moving branch head as exact.
+
+## Package 1: Publishing and information architecture
+
+Files:
+
+- `docs/.vitepress/config.mts`
+- `docs/guide/index.md`
+- `docs/guide/onboarding.md`
+- `docs/internal/onboarding.md`
+- `docs/business-use-cases.md`
+- `docs/superpowers/archive/FAQ_POC.md`
+- `docs/public/CNAME`
+
+Work:
+
+- [x] Retain product getting-started material on the public site.
+- [x] Publish onboarding without maintainer-only details.
+- [x] Move maintainer onboarding to the internal source tree.
+- [x] Exclude internal, archived, and unverified business-use-case material
+      from VitePress inputs.
+- [x] Remove the placeholder custom-domain file and retain the project-path
+      deployment base.
+- [x] Verify navigation and repository-relative onboarding links.
+
+Verification:
+
+```bash
+cd docs
+npm ci
+npm run lint
+npm run format
+npm run build
+```
+
+## Package 2: Product and operator guides
+
+Files include:
+
+- `README.md`, `CONTRIBUTING.md`, `ProjectGovernance.md`, `TESTING.md`
+- `docs/guide/{ad-serving,architecture,configuration,edgezero}.md`
+- `docs/guide/{api-reference,cli,testing,telemetry,tsjs}.md`
+- `docs/guide/{fastly,axum-dev,cloudflare,spin}.md`
+- `docs/guide/integrations-overview.md` and per-integration pages
+- `docs/guide/auction-testing.md` and `creative-processing.md`
+
+Work:
+
+- [x] Describe the portable core and four adapter boundaries.
+- [x] Document configuration initialization, validation, secret references,
+      push, adapter store mapping, and restart semantics.
+- [x] Document normal and degraded routes by adapter.
+- [x] Cover deploy IDs, integration activation, auction provider profiles,
+      JavaScript loading, telemetry, and CLI workflows.
+- [x] Use fictional examples and make maturity/limitations explicit.
+- [x] Retire or tombstone stale public claims.
+
+Verification:
+
+```bash
+cd docs
+npm run lint
+npm run format
+npm run build
+```
+
+Review every command, flag, route, setting, and integration claim against its
+implementation and focused tests.
+
+## Package 3: Crate and API documentation
+
+Files include each workspace crate README plus touched Rust and TypeScript
+modules.
+
+Work:
+
+- [x] Add a concise role, target, entry-point, and test command to every crate
+      README.
+- [x] Add useful module and public-item documentation where warnings exposed
+      missing context.
+- [x] Keep code changes documentation-only unless a test or smoke reveals an
+      actual defect.
+- [x] Preserve target portability in core crates.
+
+Verification:
+
+```bash
+cargo fmt --all -- --check
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+cargo clippy-cloudflare-wasm
+cargo clippy-spin-native
+cargo clippy-spin-wasm
+RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --all-features \
+  -p trusted-server-core -p trusted-server-js -p trusted-server-openrtb \
+  --target wasm32-wasip1
+cargo test --doc -p trusted-server-core
+```
+
+Run the remaining adapter and host rustdoc commands listed in
+`CLAUDE.md#ci-gates`.
+
+## Package 4: Documentation examples and route contracts
+
+Files:
+
+- `crates/trusted-server-integration-tests/tests/documentation_snippets.rs`
+- adapter route tests
+- example configuration tests
+
+Work:
+
+- [x] Compile representative guide snippets through production APIs.
+- [x] Assert documented route availability and degraded startup behavior.
+- [x] Keep tests independent of internal documentation records or manifests.
+- [x] Keep the example-template uncomment helper syntax-aware so prose comments
+      are not treated as configuration.
+
+Verification:
+
+```bash
+cargo test-fastly
+cargo test-axum
+cargo test-cloudflare
+cargo test-spin
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml \
+  --test parity
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml \
+  --test documentation_snippets
+```
+
+## Package 5: Runtime smoke coverage
+
+Files:
+
+- `scripts/smoke-common.sh`
+- `scripts/smoke-{axum,fastly,cloudflare,spin}.sh`
+- adapter deployment guides
+- integration workflow where supported
+
+Work:
+
+- [x] Use an owned temporary workspace and bounded ports for every adapter.
+- [x] Prove missing config and each required-secret failure.
+- [x] Require a real publisher success response, origin sentinel, and URL
+      rewrite; do not accept health alone.
+- [x] Capture Spin's real component stderr for startup failure.
+- [x] Keep Spin's global logging slot untouched.
+- [x] Copy Fastly manifests into a per-run project before config push or secret
+      mutation.
+- [x] Stop only owned processes and remove only validated temporary paths.
+
+Verification:
+
+```bash
+bash -n scripts/smoke-common.sh scripts/smoke-axum.sh \
+  scripts/smoke-fastly.sh scripts/smoke-cloudflare.sh scripts/smoke-spin.sh
+shellcheck -x scripts/smoke-common.sh scripts/smoke-axum.sh \
+  scripts/smoke-fastly.sh scripts/smoke-cloudflare.sh scripts/smoke-spin.sh
+./scripts/smoke-axum.sh
+./scripts/smoke-fastly.sh
+./scripts/smoke-cloudflare.sh
+./scripts/smoke-spin.sh
+```
+
+Run platform smokes only where the corresponding CLI is available; record omissions
+without representing them as passes.
+
+## Package 6: CI and dependency maintenance
+
+Files:
+
+- `.github/workflows/{format,test,integration-tests,codeql,deploy-docs}.yml`
+- `.github/actions/setup-integration-test-env/action.yml`
+- `.github/dependabot.yml`
+- `.tool-versions`
+- scripts invoked by workflow steps
+- `CLAUDE.md`, `TESTING.md`, `docs/guide/testing.md`
+
+Work:
+
+- [x] Retain read-only pull-request permissions.
+- [x] Build the VitePress site so internal links fail the docs job.
+- [x] Run documentation snippets, adapter checks, CLI tests, and release builds
+      in normal CI jobs.
+- [x] Keep the aggregate rustdoc and doctest pass in the manual documentation
+      workflow so it cannot become a required core or adapter check.
+- [x] Cover actual dependency roots in Dependabot.
+- [x] Read pinned tool versions through a shell script where workflow logic is
+      multiline.
+- [x] Use exact action release tags rather than commit hashes.
+- [x] Keep one canonical gate matrix and link to it elsewhere.
+- [x] Provide one source-preserving shell entry point for the existing
+      documentation gates without adding a parser, generator, or manifest system.
+- [x] Expose that entry point through a manual-only GitHub Actions workflow so
+      it does not become a required core or adapter check.
+
+Verification:
+
+```bash
+git diff --check
+rg -n 'uses: [^ ]+@[0-9a-f]{40}' .github
+rg -n 'run: *\\|' .github
+cargo metadata --locked --no-deps --format-version 1
+```
+
+Any remaining multiline `run` block requires a focused review and a script if
+it was introduced by this branch.
+
+## Package 7: Reviewer scope remediation
+
+Work:
+
+- [x] Remove the rejected standalone documentation tooling subtree.
+- [x] Remove its workflows, scripts, dependency root, inventories, markers, and
+      generated/check claims.
+- [x] Remove core test modules that read proposal-owned manifests.
+- [x] Preserve ordinary documentation snippet and adapter regression tests.
+- [x] Replace duplicated gate matrices with links to `CLAUDE.md`.
+- [x] Rewrite the spec, plan, decisions, evidence, and release runbook to match
+      the repository that will merge.
+- [x] Replace the Spin global logger with one direct startup stderr write.
+- [x] Isolate Fastly smoke manifests per run.
+
+Structural verification:
+
+```bash
+test ! -e tools
+! git grep -n 'tools/docs' -- crates/trusted-server-core
+git diff --check
+```
+
+## Final verification and delivery
+
+Run the complete matrix in `CLAUDE.md#ci-gates`, plus workflow and shell checks.
+Inspect:
+
+```bash
+git status --short
+git diff --stat 07dfc1c6...HEAD
+git diff --check
+```
+
+Then:
+
+1. commit with an imperative, sentence-case subject;
+2. push `spec-docs-refresh` to the existing PR;
+3. wait for checks on the exact pushed SHA;
+4. reply to each reviewer with the concrete fix and verification;
+5. resolve only threads whose finding is fully addressed; and
+6. update the bounded PR acceptance summary after hosted checks are green.
diff --git a/docs/superpowers/specs/2026-08-19-documentation-refresh-design.md b/docs/superpowers/specs/2026-08-19-documentation-refresh-design.md
new file mode 100644
index 000000000..f8cb0d7b7
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-19-documentation-refresh-design.md
@@ -0,0 +1,277 @@
+# Documentation Refresh Design
+
+- Status: approved and implemented on PR #1049
+- Design date: 2026-08-19
+- Last revised: 2026-09-14
+- Target branch: `rc/202608`
+- Audited base: `07dfc1c6dddf69345ded17bd2d40a3d01bb39bcf`
+
+## Purpose
+
+Trusted Server documentation had grown around the original Fastly-only
+implementation. It did not describe the current EdgeZero configuration
+lifecycle, four adapters, auction provider model, JavaScript bundle model,
+operator CLI, or the boundaries between public and internal material. Some
+pages also mixed future intent with shipped behavior.
+
+This refresh makes the maintained documentation describe the code that ships.
+It is a documentation and verification change, not a new repository tooling
+platform. It stays in PR #1049; no auxiliary implementation PR is required.
+
+## Scope guardrails
+
+The refresh includes:
+
+- public navigation, getting-started, configuration, API, adapter, integration,
+  auction, telemetry, JavaScript, CLI, and testing material;
+- crate READMEs and missing Rust or TypeScript API documentation;
+- real adapter smoke scripts and existing CI gates needed to validate the
+  documented commands;
+- publishing containment for internal and archived material; and
+- concise design, plan, decision, and evidence records.
+
+The refresh does not include:
+
+- a new documentation-analysis binary or separate Cargo workspace;
+- checked generator manifests, CLI help goldens, or source-classification
+  inventories;
+- scheduled external-link issue writers or dependency-submission automation;
+- branch-protection changes, deployment credentials, or a second PR; or
+- product refactors whose only purpose is to support documentation tooling.
+
+These exclusions are architectural boundaries. Normal product regression tests
+and the existing documentation-site, rustdoc, doctest, and snippet gates remain.
+
+## Sources of truth
+
+Documentation is maintained against the following implementation surfaces.
+
+| Contract                                              | Authoritative source                                         | Reader-facing destination                             |
+| ----------------------------------------------------- | ------------------------------------------------------------ | ----------------------------------------------------- |
+| Application fields, defaults, validation, and secrets | `trusted-server.example.toml`, `settings.rs`, `config.rs`    | Configuration and EdgeZero guides                     |
+| Public routes and degraded startup behavior           | Adapter router construction and route tests                  | API reference and adapter guides                      |
+| Adapter maturity and limitations                      | Adapter implementations, manifests, and tests                | Adapter support tables                                |
+| Integration enablement and routes                     | Integration builders, auction plan registration, JS registry | Integration overview and per-integration guides       |
+| Auction providers and profiles                        | `auction` modules and provider profile schemas               | Ad-serving, configuration, and auction-testing guides |
+| CLI commands and flags                                | Native `ts --help` output and command implementations        | CLI guide                                             |
+| Browser bundles and loading modes                     | `trusted-server-js` registry and build pipeline              | Trusted Server JavaScript guide                       |
+| Verification commands                                 | Cargo aliases and GitHub workflows                           | `CLAUDE.md#ci-gates`                                  |
+| Publishing behavior                                   | VitePress configuration and deploy workflow                  | Docs README and release runbook                       |
+
+Tables in the guides are maintained summaries. They do not claim to be
+generated or independently canonical. A change to an authoritative source must
+update its reader-facing documentation in the same pull request.
+
+## Audiences and information architecture
+
+### Publisher and operator path
+
+The public site must answer, in order:
+
+1. what Trusted Server does and which runtimes are supported;
+2. how to install prerequisites and create a local configuration;
+3. how configuration is validated, pushed, and resolved at runtime;
+4. how to deploy and verify the selected adapter;
+5. how integrations, auction providers, browser bundles, and proxy routes work;
+6. how to test and diagnose the deployment.
+
+The public landing and getting-started material retain that journey. Onboarding
+has two explicit homes: `docs/guide/onboarding.md` preserves the URL for public
+onboarding covering the request path, project vocabulary, code layout, and
+first development steps, while repository-team onboarding lives in
+`docs/internal/onboarding.md` because it contains maintainer workflow details
+rather than product installation instructions.
+
+### Maintainer path
+
+`README.md`, `CONTRIBUTING.md`, `CLAUDE.md`, `TESTING.md`, crate READMEs, and
+internal records cover repository structure, coding constraints, test targets,
+release evidence, and ownership boundaries. The CI matrix exists once in
+`CLAUDE.md`; other files link to it and may add focused runbooks without copying
+the matrix.
+
+### Archived and excluded material
+
+- `FAQ_POC.md` is historical and lives under `docs/superpowers/archive/`.
+- `docs/business-use-cases.md` remains source-visible with an explicit
+  unverified banner but is excluded from the public site.
+- `docs/internal/**` and `docs/superpowers/**` are never public navigation or
+  VitePress source inputs.
+- Retired integration pages may remain as tombstones only when they clearly say
+  the integration is unavailable.
+
+## Public documentation deliverables
+
+### Landing, architecture, and setup
+
+The landing page states the supported runtimes and links directly to setup,
+configuration, adapters, integrations, API, and testing. Architecture explains
+the portable core, adapter boundary, EdgeZero lifecycle, browser bundle
+pipeline, and auction orchestration without presenting obsolete Fastly-only
+flows.
+
+The getting-started path uses fictional domains and secrets, distinguishes
+local drafts from deployable configuration, and sends operators through
+validation before push or deployment.
+
+### Configuration and EdgeZero
+
+The configuration reference covers every top-level configuration family,
+including publisher behavior, handlers, integrations, auction providers,
+creative opportunities, request signing, trusted client IP, telemetry, debug,
+and platform stores. It distinguishes:
+
+- source TOML from the serialized app-config blob;
+- secret key references from secret values;
+- parse-time, deploy-time, startup-time, and request-time validation;
+- logical EdgeZero store IDs from adapter-specific bindings; and
+- provider wrapper fields from profile-specific `profile_config` fields.
+
+The EdgeZero guide owns configuration initialization, validation, push,
+envelope, store mapping, and restart/deploy semantics.
+
+### API and adapters
+
+The API reference records routes, methods, predicates, authentication, request
+shape, success behavior, failure behavior, cache/CORS behavior, and adapter
+availability. It separates normal routes from degraded startup routers.
+
+Each adapter guide states maturity, health behavior, startup status, provider
+fan-out, client-IP treatment, prerequisites, local handoff, deployment steps,
+store/secret bindings, limitations, and a concrete verification path:
+
+- Fastly: production, Viceroy-backed local smoke, multiple providers.
+- Axum: development server, native tests, no request-time KV implementation.
+- Cloudflare: development, one enabled provider, no normal health route.
+- Spin: experimental, one enabled provider, startup `503` with liveness health.
+
+### Integrations, auction, and JavaScript
+
+The integration overview lists all deploy-accepted integration IDs and
+separates registration from operational maturity. Per-integration pages explain
+activation, configuration, routes or hooks, browser loading, and limitations.
+
+Auction documentation defines provider instances, bidder routing, profiles,
+mediation, timeouts, and testing. The JavaScript guide distinguishes integration
+modules, emitted bundles, immediate/deferred/standalone loading, cache keys, and
+the publisher-visible namespace.
+
+### CLI and testing
+
+The CLI guide covers the Linux/macOS command union, platform-only commands,
+config, deploy, audit, development proxy, template, and Prebid bundle workflows.
+Examples must be executable descriptions of current flags; platform
+differences are explicit.
+
+The public testing guide explains target-specific Cargo aliases, Viceroy,
+adapter tests, browser fixtures, documentation snippets, and smoke scripts. It
+links to the single complete gate matrix instead of duplicating it.
+
+### READMEs and API documentation
+
+Every workspace crate has a short README stating its role, target, entry points,
+and focused verification command. Public Rust items and exported TypeScript
+surfaces receive useful documentation where warnings or reader navigation
+exposed gaps. Comments must explain behavior or constraints, not restate names.
+
+## Adapter smoke contracts
+
+All smoke scripts use isolated temporary state, start a real local runtime,
+exercise missing configuration and required-secret failures, and finish with a
+publisher request that proves origin proxying and URL rewriting. A health-only
+response is never sufficient.
+
+- Axum uses temporary config and store state.
+- Cloudflare uses temporary Wrangler manifests and local KV state.
+- Spin uses a temporary Spin manifest/KV store and reads the component stderr
+  captured by Spin.
+- Fastly copies `edgezero.toml` and `fastly.toml` into a per-run project. It
+  never edits or restores the tracked manifest, so overlapping runs cannot
+  overwrite one another or a user's edits.
+
+Spin's startup diagnostic is written directly to component stderr. It does not
+install a global logger, change the maximum log level, or suppress ordinary
+application logs.
+
+## Verification and CI
+
+Existing mechanisms provide the enforcement boundary:
+
+- VitePress ESLint, Prettier, and production build, including internal-link
+  validation;
+- Rust formatting and target-matched Clippy for all adapters and host tools;
+- adapter, core, CLI, OpenRTB codegen, integration-parity, and
+  documentation-snippet tests;
+- Fastly and Spin release builds;
+- rustdoc with warnings denied plus core doctests;
+- JavaScript lint, formatting, tests, and production build; and
+- real local adapter smoke scripts when the corresponding CLI is installed.
+
+`scripts/check-documentation.sh` composes the site, JSDoc, snippet, doctest,
+and rustdoc checks for local use and the manually dispatched Documentation
+checks workflow. It owns no parser, manifest, generated output, or tracked-file
+write path, and it cannot block normal core or adapter CI.
+
+GitHub actions use exact release tags. A workflow step with more than one line
+of executable logic delegates to a repository script. Pull-request workflows
+remain read-only.
+
+## Security and privacy
+
+Examples use `example.com` or explicitly fictional values. Documentation must
+not include live credentials, private contacts, customer identifiers, or
+internal access instructions. Secrets are described as store keys and
+provisioning actions, never embedded deployable values.
+
+The checked-in Fastly service ID is a temporary, owner-approved compatibility
+exception recorded in the decisions file. It expires on 2026-09-30 and must be
+removed or explicitly renewed through review.
+
+The VitePress site uses the repository project path and has no placeholder
+`CNAME`. Internal and archived directories are excluded at the source boundary,
+not merely hidden from navigation.
+
+## Compatibility
+
+The refresh does not change public application configuration shapes or normal
+route behavior. Added adapter route tests document existing parity. Startup
+fallback work is limited to preserving a real Spin diagnostic without claiming
+global logging. CI additions exercise existing supported targets.
+
+Removing the rejected tool proposal also removes its tool-manifest
+`include_str!` tests; production modules no longer depend, even in test builds,
+on a separate documentation proposal.
+
+## Risks and mitigations
+
+| Risk                                   | Mitigation                                                       |
+| -------------------------------------- | ---------------------------------------------------------------- |
+| Repeated tables drift                  | Name the implementation source and require same-PR updates       |
+| Gate instructions drift                | Keep the full matrix only in `CLAUDE.md`                         |
+| Public/internal leakage                | Exclude internal/archive sources in VitePress and test the build |
+| Adapter claims exceed reality          | Tie each claim to router tests and a runtime smoke               |
+| Smoke scripts alter user files         | Use per-run manifests and owned process cleanup                  |
+| Logging workaround suppresses records  | Emit only the startup diagnostic directly to Spin stderr         |
+| Examples expose sensitive data         | Use fictional values and review explicit exceptions              |
+| Cross-target commands fail on the host | Use repository Cargo aliases and pinned targets                  |
+
+## Acceptance criteria
+
+The refresh is complete when:
+
+- the public site builds with no dead internal links;
+- getting-started, public onboarding, and internal maintainer onboarding have
+  clear, separate homes;
+- configuration, API, adapters, integrations, auction, JavaScript, CLI,
+  telemetry, and testing are covered;
+- every crate has an accurate README and API documentation gates pass;
+- the complete test matrix appears only in `CLAUDE.md`;
+- no rejected tool directory, tool workflow, tool script, generated marker, or
+  product-test manifest receipt remains;
+- Spin does not set a global logger;
+- Fastly smoke does not write the repository manifests;
+- action references use exact release tags and multiline workflow logic lives
+  in scripts;
+- target-matched tests, docs checks, JavaScript checks, rustdoc, and workflow
+  structure checks pass; and
+- all commits are pushed to PR #1049.
diff --git a/scripts/README.md b/scripts/README.md
new file mode 100644
index 000000000..ad4ecf926
--- /dev/null
+++ b/scripts/README.md
@@ -0,0 +1,24 @@
+# Repository scripts
+
+Run these scripts from the repository root. They fail on command errors unless
+their documented orchestration handles a probe deliberately.
+
+| Script                                    | Inputs and prerequisites                                           | Side effects and cleanup                                                                                                                                                  |
+| ----------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `batch-sync.sh`                           | Endpoint, bearer token, EC ID, partner UID; `curl` and Python      | Sends one authenticated batch-sync request. Its temporary response file is removed on exit.                                                                               |
+| `benchmark.sh`                            | A running server; `curl`, `bc`, and optionally `hey`               | May install `hey` through Homebrew. `--save` writes under `benchmark-results/`; it does not stop the server.                                                              |
+| `profile.sh`                              | Fastly CLI, Rust WASM target, `curl`; endpoint and request options | Builds and starts the Fastly app, stops the owned process, and retains a profile under `benchmark-results/profiles/`. `--open` launches the local viewer.                 |
+| `generate-integration-viceroy-configs.sh` | Rust toolchain; optional origin port and artifact directory        | Builds the native generator and writes Viceroy config under `target/integration-test-artifacts/`; generated files persist.                                                |
+| `integration-tests.sh`                    | Docker, Viceroy, Rust WASM target, pinned Node                     | Builds WASM/native artifacts and two Docker images, generates Viceroy config, and runs native integration tests serially. Build products and images persist.              |
+| `integration-tests-browser.sh`            | The integration prerequisites plus npm and Playwright              | Installs package/browser dependencies, builds fixtures and images, runs both browser suites, and stops matching test containers on exit. Build and npm artifacts persist. |
+| `smoke-axum.sh`                           | `cargo`, `curl`, Python                                            | Uses an isolated temporary config/store and stub origin; stops owned processes and removes its workspace.                                                                 |
+| `smoke-fastly.sh`                         | Fastly CLI, `cargo`, `curl`, Python                                | Uses an isolated Fastly project and application config; stops owned processes and removes its workspace.                                                                  |
+| `smoke-cloudflare.sh`                     | Pinned Wrangler, `cargo`, `curl`, `jq`, and Python                 | Uses isolated Wrangler manifests, KV state, ports, and logs; stops owned processes and removes its workspace.                                                             |
+| `smoke-spin.sh`                           | Spin CLI, `cargo`, `curl`, and Python                              | Uses an isolated Spin manifest and SQLite KV store; stops owned processes and removes its workspace.                                                                      |
+| `smoke-common.sh`                         | Sourced by the four smoke scripts                                  | Defines bounded port, process, config, secret, and response assertions. Do not invoke it as a standalone smoke.                                                           |
+| `template-cache-local-test.sh`            | Viceroy, Node, OpenSSL, `curl`, `lsof`; optional ports and mode    | Builds local artifacts, generates certificates and fixtures in a temporary directory, stops owned servers, and removes the directory.                                     |
+| `test-cli.sh`                             | Rustup and the host toolchain; optional host triple                | May install the selected Rust target, then runs native CLI and browser-audit tests. Cargo artifacts persist.                                                              |
+
+The four adapter smoke contracts are documented in the
+[deployment guides](../docs/guide/integrations-overview.md#adapter-support).
+Repository-wide verification policy lives in [TESTING.md](../TESTING.md).
diff --git a/scripts/smoke-axum.sh b/scripts/smoke-axum.sh
new file mode 100755
index 000000000..3632dc3ff
--- /dev/null
+++ b/scripts/smoke-axum.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+
+# Exercise the complete Axum local config and secret handoff.
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+# shellcheck source=scripts/smoke-common.sh
+. "$REPO_ROOT/scripts/smoke-common.sh"
+
+smoke_require_command cargo
+smoke_require_command curl
+smoke_require_command jq
+smoke_require_command python3
+smoke_require_command pgrep
+
+WORKSPACE=$(smoke_make_workspace axum)
+ORIGIN_PORT=${AXUM_SMOKE_ORIGIN_PORT:-18889}
+BASE_PORT=${AXUM_SMOKE_PORT:-18890}
+ORIGIN_PID=""
+APP_PID=""
+
+cleanup() {
+    smoke_stop_process "$APP_PID"
+    smoke_stop_process "$ORIGIN_PID"
+    smoke_remove_workspace "$WORKSPACE"
+}
+trap cleanup EXIT INT TERM
+
+smoke_resolve_ts_binary "$REPO_ROOT"
+AXUM_BINARY=${AXUM_BINARY_PATH:-$REPO_ROOT/target/debug/trusted-server-axum}
+if [ ! -x "$AXUM_BINARY" ]; then
+    cargo build --manifest-path "$REPO_ROOT/Cargo.toml" -p trusted-server-adapter-axum
+fi
+[ -x "$AXUM_BINARY" ] || smoke_die "Axum binary not executable: $AXUM_BINARY"
+
+smoke_start_origin "$WORKSPACE" "$ORIGIN_PORT"
+ORIGIN_PID=$SMOKE_ORIGIN_PID
+smoke_initialize_config "$REPO_ROOT" "$WORKSPACE" "$ORIGIN_PORT"
+sed \
+    -e "s|= \"crates/|= \"$REPO_ROOT/crates/|g" \
+    -e "s|manifest = \"fastly.toml\"|manifest = \"$REPO_ROOT/fastly.toml\"|" \
+    "$REPO_ROOT/edgezero.toml" >"$WORKSPACE/edgezero.toml"
+(
+    cd "$WORKSPACE"
+    "$SMOKE_TS_BIN" config push \
+        --adapter axum \
+        --local \
+        --manifest "$WORKSPACE/edgezero.toml" \
+        --app-config "$SMOKE_APP_CONFIG" \
+        --yes \
+        --no-diff
+)
+ENVELOPE=$(jq --exit-status --raw-output \
+    '.trusted_server_config' \
+    "$WORKSPACE/.edgezero/local-config-trusted_server_config.json")
+
+run_case() {
+    local case_name="$1"
+    local port="$2"
+    local config_value="$3"
+    local handler_value="$4"
+    local proxy_value="$5"
+    local ec_value="$6"
+    local expected_status="$7"
+    local expected_diagnostic="${8:-}"
+    local log_path="$WORKSPACE/$case_name.log"
+    local body_path="$WORKSPACE/$case_name.body"
+    local headers_path="$WORKSPACE/$case_name.headers"
+    local env_args=(
+        env
+        -u "$SMOKE_CONFIG_ENV"
+        -u "$SMOKE_HANDLER_ENV"
+        -u "$SMOKE_PROXY_ENV"
+        -u "$SMOKE_EC_ENV"
+    )
+    [ -z "$config_value" ] || env_args+=("$SMOKE_CONFIG_ENV=$config_value")
+    [ -z "$handler_value" ] || env_args+=("$SMOKE_HANDLER_ENV=$handler_value")
+    [ -z "$proxy_value" ] || env_args+=("$SMOKE_PROXY_ENV=$proxy_value")
+    [ -z "$ec_value" ] || env_args+=("$SMOKE_EC_ENV=$ec_value")
+
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+
+    "${env_args[@]}" \
+        PORT="$port" \
+        "$AXUM_BINARY" >"$log_path" 2>&1 &
+    APP_PID=$!
+    smoke_wait_http "http://127.0.0.1:$port/" "$expected_status" \
+        "$body_path" "$headers_path"
+    smoke_assert_process_alive "$APP_PID" "Axum" "$log_path"
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+    smoke_stop_process "$APP_PID"
+    APP_PID=""
+
+    if [ -n "$expected_diagnostic" ]; then
+        smoke_assert_failure "$expected_status" "$expected_diagnostic" "$log_path"
+    else
+        smoke_assert_success "$body_path" "$ORIGIN_PORT" "$port"
+    fi
+}
+
+run_case missing-config "$BASE_PORT" "" \
+    "$SMOKE_HANDLER_VALUE" "$SMOKE_PROXY_VALUE" "$SMOKE_EC_VALUE" 500 \
+    "env var '$SMOKE_CONFIG_ENV' not set"
+run_case missing-handler "$((BASE_PORT + 1))" "$ENVELOPE" \
+    "" "$SMOKE_PROXY_VALUE" "$SMOKE_EC_VALUE" 500 \
+    "failed to resolve secret reference at \`handlers[0].password\`"
+run_case missing-proxy "$((BASE_PORT + 2))" "$ENVELOPE" \
+    "$SMOKE_HANDLER_VALUE" "" "$SMOKE_EC_VALUE" 500 \
+    "failed to resolve secret reference at \`publisher.proxy_secret\`"
+run_case missing-ec "$((BASE_PORT + 3))" "$ENVELOPE" \
+    "$SMOKE_HANDLER_VALUE" "$SMOKE_PROXY_VALUE" "" 500 \
+    "failed to resolve secret reference at \`ec.passphrase\`"
+run_case positive "$((BASE_PORT + 4))" "$ENVELOPE" \
+    "$SMOKE_HANDLER_VALUE" "$SMOKE_PROXY_VALUE" "$SMOKE_EC_VALUE" 200
+
+echo "Axum first-success smoke passed"
diff --git a/scripts/smoke-cloudflare.sh b/scripts/smoke-cloudflare.sh
new file mode 100755
index 000000000..161823217
--- /dev/null
+++ b/scripts/smoke-cloudflare.sh
@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+
+# Exercise the Cloudflare local KV-to-binding bridge and publisher proxy path.
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+# shellcheck source=scripts/smoke-common.sh
+. "$REPO_ROOT/scripts/smoke-common.sh"
+
+smoke_require_command bash
+smoke_require_command cargo
+smoke_require_command curl
+smoke_require_command jq
+smoke_require_command python3
+smoke_require_command wrangler
+smoke_require_command pgrep
+
+EXPECTED_WRANGLER=$(awk '$1 == "wrangler" { print $2 }' "$REPO_ROOT/.tool-versions")
+[ -n "$EXPECTED_WRANGLER" ] || smoke_die "missing Wrangler pin in .tool-versions"
+ACTUAL_WRANGLER=$(wrangler --version | sed -nE 's/^([0-9]+\.[0-9]+\.[0-9]+)$/\1/p')
+[ "$ACTUAL_WRANGLER" = "$EXPECTED_WRANGLER" ] ||
+    smoke_die "Wrangler $EXPECTED_WRANGLER is required; found ${ACTUAL_WRANGLER:-unknown}"
+
+WORKSPACE=$(smoke_make_workspace cloudflare)
+ORIGIN_PORT=${CLOUDFLARE_SMOKE_ORIGIN_PORT:-19089}
+BASE_PORT=${CLOUDFLARE_SMOKE_PORT:-19080}
+ORIGIN_PID=""
+APP_PID=""
+
+cleanup() {
+    smoke_stop_process "$APP_PID"
+    smoke_stop_process "$ORIGIN_PID"
+    smoke_remove_workspace "$WORKSPACE"
+}
+trap cleanup EXIT INT TERM
+
+smoke_resolve_ts_binary "$REPO_ROOT"
+CLOUDFLARE_ROOT="$REPO_ROOT/crates/trusted-server-adapter-cloudflare"
+if [ ! -f "$CLOUDFLARE_ROOT/build/index.js" ]; then
+    (cd "$CLOUDFLARE_ROOT" && bash build.sh)
+fi
+[ -f "$CLOUDFLARE_ROOT/build/index.js" ] ||
+    smoke_die "Cloudflare Worker bundle not found: $CLOUDFLARE_ROOT/build/index.js"
+
+smoke_start_origin "$WORKSPACE" "$ORIGIN_PORT"
+ORIGIN_PID=$SMOKE_ORIGIN_PID
+smoke_initialize_config "$REPO_ROOT" "$WORKSPACE" "$ORIGIN_PORT"
+
+CLOUDFLARE_WORK="$WORKSPACE/cloudflare"
+mkdir -p "$CLOUDFLARE_WORK"
+cp "$CLOUDFLARE_ROOT/wrangler.toml" "$CLOUDFLARE_WORK/wrangler.toml"
+cp "$CLOUDFLARE_ROOT/wrangler.ci.toml" "$CLOUDFLARE_WORK/wrangler.ci.toml"
+ln -s "$CLOUDFLARE_ROOT/build" "$CLOUDFLARE_WORK/build"
+sed \
+    -e "s|= \"crates/|= \"$REPO_ROOT/crates/|g" \
+    -e "s|manifest = \"fastly.toml\"|manifest = \"$REPO_ROOT/fastly.toml\"|" \
+    -e "s|manifest = \"$REPO_ROOT/crates/trusted-server-adapter-cloudflare/wrangler.toml\"|manifest = \"$CLOUDFLARE_WORK/wrangler.toml\"|" \
+    "$REPO_ROOT/edgezero.toml" >"$WORKSPACE/edgezero.toml"
+
+(
+    cd "$WORKSPACE"
+    EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME=TRUSTED_SERVER_KV \
+        "$SMOKE_TS_BIN" config push \
+        --adapter cloudflare \
+        --local \
+        --manifest "$WORKSPACE/edgezero.toml" \
+        --app-config "$SMOKE_APP_CONFIG" \
+        --yes \
+        --no-diff
+)
+ENVELOPE=$(
+    cd "$CLOUDFLARE_WORK"
+    wrangler kv key get trusted_server_config \
+        --binding TRUSTED_SERVER_KV \
+        --local \
+        --config wrangler.toml
+)
+[ -n "$ENVELOPE" ] || smoke_die "Wrangler KV read-back returned an empty envelope"
+CONFIG_JSON=$(jq --compact-output --null-input \
+    --arg app_config "$ENVELOPE" \
+    '{app_config: $app_config}')
+
+write_runtime_config() {
+    local destination="$1"
+    local config_json="$2"
+    local missing_key="${3:-}"
+    local config_line=""
+    if [ -n "$config_json" ]; then
+        config_line="TRUSTED_SERVER_CONFIG = '''$config_json'''"
+    fi
+    CLOUDFLARE_SMOKE_CONFIG_LINE="$config_line" awk \
+        -v missing_key="$missing_key" \
+        -v handler="$SMOKE_HANDLER_VALUE" \
+        -v proxy="$SMOKE_PROXY_VALUE" \
+        -v ec="$SMOKE_EC_VALUE" '
+        BEGIN {
+            config_line = ENVIRON["CLOUDFLARE_SMOKE_CONFIG_LINE"]
+        }
+        $0 == "TRUSTED_SERVER_CONFIG = \"{}\"" {
+            placeholders++
+            if (config_line != "") {
+                print config_line
+            }
+            next
+        }
+        { print }
+        END {
+            if (placeholders != 1) {
+                print "Cloudflare smoke template must contain one config placeholder" > "/dev/stderr"
+                exit 1
+            }
+            if (missing_key != "handler_password") {
+                print "handler_password = \"" handler "\""
+            }
+            if (missing_key != "publisher_proxy_secret") {
+                print "publisher_proxy_secret = \"" proxy "\""
+            }
+            if (missing_key != "ec_passphrase") {
+                print "ec_passphrase = \"" ec "\""
+            }
+        }
+    ' "$CLOUDFLARE_WORK/wrangler.ci.toml" >"$destination"
+}
+
+run_case() {
+    local case_name="$1"
+    local port="$2"
+    local config_json="$3"
+    local missing_key="$4"
+    local expected_status="$5"
+    local missing_binding="${6:-}"
+    local expected_diagnostic="${7:-}"
+    local config_path="$CLOUDFLARE_WORK/wrangler.$case_name.toml"
+    local log_path="$WORKSPACE/$case_name.log"
+    local body_path="$WORKSPACE/$case_name.body"
+    local headers_path="$WORKSPACE/$case_name.headers"
+
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+
+    write_runtime_config "$config_path" "$config_json" "$missing_key"
+    (
+        cd "$CLOUDFLARE_WORK"
+        exec wrangler dev \
+            --config "$config_path" \
+            --port "$port" \
+            --ip 127.0.0.1
+    ) >"$log_path" 2>&1 &
+    APP_PID=$!
+    smoke_wait_http "http://127.0.0.1:$port/" "$expected_status" \
+        "$body_path" "$headers_path"
+    smoke_assert_process_alive "$APP_PID" "Wrangler" "$log_path"
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+    smoke_stop_process "$APP_PID"
+    APP_PID=""
+
+    if [ -n "$expected_diagnostic" ]; then
+        grep --fixed-strings --quiet 'Your Worker has access to the following bindings:' "$log_path" ||
+            smoke_die "Wrangler did not report the runtime binding inventory"
+        if grep --fixed-strings --quiet "$missing_binding" "$log_path"; then
+            smoke_die "negative case unexpectedly exposed $missing_binding"
+        fi
+        if [ "$missing_binding" = "env.TRUSTED_SERVER_CONFIG" ]; then
+            grep --fixed-strings --quiet 'env.handler_password' "$log_path" ||
+                smoke_die "missing-config case did not retain the secret control binding"
+        else
+            grep --fixed-strings --quiet 'env.TRUSTED_SERVER_CONFIG' "$log_path" ||
+                smoke_die "missing-secret case did not retain the config control binding"
+        fi
+        smoke_assert_failure \
+            "$expected_status" \
+            "$expected_diagnostic" \
+            "$log_path"
+    else
+        smoke_assert_success "$body_path" "$ORIGIN_PORT" "$port"
+    fi
+}
+
+run_case missing-config "$BASE_PORT" "" "" 500 \
+    'env.TRUSTED_SERVER_CONFIG' \
+    'Cloudflare TRUSTED_SERVER_CONFIG is required'
+run_case missing-handler "$((BASE_PORT + 1))" "$CONFIG_JSON" handler_password 500 \
+    'env.handler_password' \
+    "failed to resolve secret reference at \`handlers[0].password\` from secret store \`trusted_server_secrets\`"
+run_case missing-proxy "$((BASE_PORT + 2))" "$CONFIG_JSON" publisher_proxy_secret 500 \
+    'env.publisher_proxy_secret' \
+    "failed to resolve secret reference at \`publisher.proxy_secret\` from secret store \`trusted_server_secrets\`"
+run_case missing-ec "$((BASE_PORT + 3))" "$CONFIG_JSON" ec_passphrase 500 \
+    'env.ec_passphrase' \
+    "failed to resolve secret reference at \`ec.passphrase\` from secret store \`trusted_server_secrets\`"
+run_case positive "$((BASE_PORT + 4))" "$CONFIG_JSON" "" 200 "" ""
+
+echo "Cloudflare first-success smoke passed"
diff --git a/scripts/smoke-common.sh b/scripts/smoke-common.sh
new file mode 100644
index 000000000..9335c42dd
--- /dev/null
+++ b/scripts/smoke-common.sh
@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2034
+
+# Shared, source-only helpers for the adapter first-success smokes.
+
+smoke_die() {
+    echo "smoke: $*" >&2
+    exit 1
+}
+
+smoke_require_command() {
+    command -v "$1" >/dev/null 2>&1 || smoke_die "required command not found: $1"
+}
+
+smoke_make_workspace() {
+    local adapter="$1"
+    local base="${TMPDIR:-/tmp}"
+    mktemp -d "$base/trusted-server-smoke-$adapter.XXXXXX"
+}
+
+smoke_remove_workspace() {
+    local workspace="$1"
+    case "$workspace" in
+        "${TMPDIR:-/tmp}"/trusted-server-smoke-*) rm -rf -- "$workspace" ;;
+        *) echo "smoke: refusing to remove unexpected workspace: $workspace" >&2 ;;
+    esac
+}
+
+smoke_stop_process() {
+    local pid="${1:-}"
+    [ -n "$pid" ] || return 0
+    # Capture child PIDs while the parent is alive; after the parent dies they
+    # are reparented and can no longer be found through it.
+    local children=""
+    children=$(pgrep -P "$pid" 2>/dev/null || true)
+    local child
+    for child in $children; do
+        kill -TERM "$child" 2>/dev/null || true
+    done
+    if kill -0 "$pid" 2>/dev/null; then
+        kill "$pid" 2>/dev/null || true
+        wait "$pid" 2>/dev/null || true
+    fi
+    # Only the direct parent is a shell job, so signaled children must be
+    # polled until they release their sockets.
+    local remaining
+    for child in $children; do
+        remaining=50
+        while kill -0 "$child" 2>/dev/null && [ "$remaining" -gt 0 ]; do
+            sleep 0.1
+            remaining=$((remaining - 1))
+        done
+        kill -KILL "$child" 2>/dev/null || true
+    done
+}
+
+smoke_assert_process_alive() {
+    local pid="$1"
+    local label="$2"
+    local log_path="${3:-}"
+    if ! kill -0 "$pid" 2>/dev/null; then
+        [ -z "$log_path" ] || sed -n '1,120p' "$log_path" >&2
+        smoke_die "$label exited before its assertion completed"
+    fi
+}
+
+smoke_wait_http() {
+    local url="$1"
+    local expected_status="$2"
+    local body_path="$3"
+    local headers_path="$4"
+    local attempt=0
+    SMOKE_HTTP_STATUS="000"
+    while [ "$attempt" -lt 60 ]; do
+        SMOKE_HTTP_STATUS=$(curl --silent --show-error \
+            --output "$body_path" \
+            --dump-header "$headers_path" \
+            --write-out '%{http_code}' \
+            "$url" 2>/dev/null || true)
+        if [ "$SMOKE_HTTP_STATUS" = "$expected_status" ]; then
+            return 0
+        fi
+        attempt=$((attempt + 1))
+        sleep 0.25
+    done
+    smoke_die "expected HTTP $expected_status from $url; received $SMOKE_HTTP_STATUS"
+}
+
+smoke_wait_log() {
+    local log_path="$1"
+    local expected="$2"
+    local attempt=0
+    while [ "$attempt" -lt 40 ]; do
+        if grep --fixed-strings --quiet -- "$expected" "$log_path"; then
+            return 0
+        fi
+        attempt=$((attempt + 1))
+        sleep 0.1
+    done
+    echo "smoke: expected diagnostic not found: $expected" >&2
+    sed -n '1,120p' "$log_path" >&2
+    exit 1
+}
+
+smoke_assert_failure() {
+    local expected_status="$1"
+    local expected_diagnostic="$2"
+    local log_path="$3"
+    [ "$SMOKE_HTTP_STATUS" = "$expected_status" ] ||
+        smoke_die "negative case returned HTTP $SMOKE_HTTP_STATUS, expected $expected_status"
+    smoke_wait_log "$log_path" "$expected_diagnostic"
+}
+
+smoke_assert_success() {
+    local body_path="$1"
+    local origin_port="$2"
+    local adapter_port="$3"
+    [ "$SMOKE_HTTP_STATUS" = "200" ] ||
+        smoke_die "publisher request returned HTTP $SMOKE_HTTP_STATUS, expected 200"
+    grep --fixed-strings --quiet 'SMOKE_ORIGIN_SENTINEL' "$body_path" ||
+        smoke_die "publisher response omitted the stub-origin sentinel"
+    grep --fixed-strings --quiet \
+        "href=\"http://127.0.0.1:$adapter_port/asset\"" "$body_path" ||
+        smoke_die "publisher response omitted the Trusted Server URL rewrite"
+    if grep --fixed-strings --quiet \
+        "href=\"http://127.0.0.1:$origin_port/asset\"" "$body_path"; then
+        smoke_die "publisher response retained the origin URL"
+    fi
+}
+
+smoke_start_origin() {
+    local workspace="$1"
+    local origin_port="$2"
+    local origin_dir="$workspace/origin"
+    mkdir -p "$origin_dir"
+    printf '%s\n' \
+        "<!doctype html><html><body>SMOKE_ORIGIN_SENTINEL<a href=\"http://127.0.0.1:$origin_port/asset\">asset</a></body></html>" \
+        >"$origin_dir/index.html"
+    python3 -m http.server "$origin_port" --bind 127.0.0.1 --directory "$origin_dir" \
+        >"$workspace/origin.log" 2>&1 &
+    SMOKE_ORIGIN_PID=$!
+    smoke_wait_http "http://127.0.0.1:$origin_port/" "200" \
+        "$workspace/origin-ready.body" "$workspace/origin-ready.headers"
+    smoke_assert_process_alive "$SMOKE_ORIGIN_PID" "stub origin" "$workspace/origin.log"
+    grep --fixed-strings --quiet 'SMOKE_ORIGIN_SENTINEL' "$workspace/origin-ready.body" ||
+        smoke_die "stub origin did not return its sentinel"
+}
+
+smoke_resolve_ts_binary() {
+    local repository="$1"
+    local candidate="${TS_BIN:-$repository/target/debug/ts}"
+    if [ ! -x "$candidate" ]; then
+        cargo build --manifest-path "$repository/Cargo.toml" -p trusted-server-cli --bin ts
+    fi
+    [ -x "$candidate" ] || smoke_die "Trusted Server CLI not executable: $candidate"
+    SMOKE_TS_BIN="$candidate"
+}
+
+smoke_initialize_config() {
+    local repository="$1"
+    local workspace="$2"
+    local origin_port="$3"
+    SMOKE_APP_CONFIG="$workspace/trusted-server.toml"
+    "$SMOKE_TS_BIN" config init --app-config "$SMOKE_APP_CONFIG"
+    export TRUSTED_SERVER__PUBLISHER__DOMAIN="127.0.0.1"
+    export TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN="127.0.0.1"
+    export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$origin_port"
+    "$SMOKE_TS_BIN" config validate \
+        --manifest "$repository/edgezero.toml" \
+        --app-config "$SMOKE_APP_CONFIG" \
+        --strict
+}
+
+SMOKE_CONFIG_ENV=TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG
+SMOKE_HANDLER_ENV=TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_HANDLER_PASSWORD
+SMOKE_PROXY_ENV=TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_PUBLISHER_PROXY_SECRET
+SMOKE_EC_ENV=TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_EC_PASSPHRASE
+SMOKE_HANDLER_VALUE=smoke-admin-password-32-bytes-ok
+SMOKE_PROXY_VALUE=smoke-publisher-proxy-secret-32-bytes
+SMOKE_EC_VALUE=smoke-edge-cookie-passphrase-32-bytes
diff --git a/scripts/smoke-fastly.sh b/scripts/smoke-fastly.sh
new file mode 100755
index 000000000..c2e8b01b9
--- /dev/null
+++ b/scripts/smoke-fastly.sh
@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+
+# Exercise Fastly local config push, secret provisioning, and publisher proxying.
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+# shellcheck source=scripts/smoke-common.sh
+. "$REPO_ROOT/scripts/smoke-common.sh"
+
+smoke_require_command cargo
+smoke_require_command curl
+smoke_require_command fastly
+smoke_require_command python3
+smoke_require_command pgrep
+
+WORKSPACE=$(smoke_make_workspace fastly)
+FASTLY_PROJECT="$WORKSPACE/project"
+FASTLY_MANIFEST="$FASTLY_PROJECT/fastly.toml"
+EDGEZERO_MANIFEST="$FASTLY_PROJECT/edgezero.toml"
+ORIGIN_PORT=${FASTLY_SMOKE_ORIGIN_PORT:-18989}
+BASE_PORT=${FASTLY_SMOKE_PORT:-18980}
+ORIGIN_PID=""
+APP_PID=""
+
+cleanup() {
+    smoke_stop_process "$APP_PID"
+    smoke_stop_process "$ORIGIN_PID"
+    smoke_remove_workspace "$WORKSPACE"
+}
+trap cleanup EXIT INT TERM
+
+mkdir -p "$FASTLY_PROJECT"
+cp "$REPO_ROOT/edgezero.toml" "$EDGEZERO_MANIFEST"
+cp "$REPO_ROOT/fastly.toml" "$FASTLY_MANIFEST"
+ln -s "$REPO_ROOT/crates" "$FASTLY_PROJECT/crates"
+
+smoke_resolve_ts_binary "$REPO_ROOT"
+WASM_BINARY=${WASM_BINARY_PATH:-$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm}
+if [ ! -f "$WASM_BINARY" ]; then
+    cargo build \
+        --manifest-path "$REPO_ROOT/Cargo.toml" \
+        --package trusted-server-adapter-fastly \
+        --release \
+        --target wasm32-wasip1
+fi
+[ -f "$WASM_BINARY" ] || smoke_die "Fastly Wasm artifact not found: $WASM_BINARY"
+
+smoke_start_origin "$WORKSPACE" "$ORIGIN_PORT"
+ORIGIN_PID=$SMOKE_ORIGIN_PID
+smoke_initialize_config "$FASTLY_PROJECT" "$WORKSPACE" "$ORIGIN_PORT"
+
+run_case() {
+    local case_name="$1"
+    local port="$2"
+    local expected_status="$3"
+    local expected_diagnostic="${4:-}"
+    local log_path="$WORKSPACE/$case_name.log"
+    local body_path="$WORKSPACE/$case_name.body"
+    local headers_path="$WORKSPACE/$case_name.headers"
+
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+
+    fastly compute serve \
+        --dir "$FASTLY_PROJECT" \
+        --file "$WASM_BINARY" \
+        --addr "127.0.0.1:$port" >"$log_path" 2>&1 &
+    APP_PID=$!
+
+    if [ "$case_name" = "missing-config" ]; then
+        smoke_wait_http "http://127.0.0.1:$port/health" "200" \
+            "$WORKSPACE/$case_name-health.body" \
+            "$WORKSPACE/$case_name-health.headers"
+    fi
+    smoke_wait_http "http://127.0.0.1:$port/" "$expected_status" \
+        "$body_path" "$headers_path"
+    smoke_assert_process_alive "$APP_PID" "Fastly CLI" "$log_path"
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+    smoke_stop_process "$APP_PID"
+    APP_PID=""
+
+    if [ -n "$expected_diagnostic" ]; then
+        smoke_assert_failure "$expected_status" "$expected_diagnostic" "$log_path"
+    else
+        smoke_assert_success "$body_path" "$ORIGIN_PORT" "$port"
+    fi
+}
+
+write_without_secret() {
+    local source="$1"
+    local destination="$2"
+    local missing_key="$3"
+    awk -v missing_key="$missing_key" '
+        $0 == "[[local_server.secret_stores.ts_secrets]]" {
+            header = $0
+            if ((getline key_line) <= 0 || (getline data_line) <= 0) {
+                exit 2
+            }
+            if (key_line == "key = \"" missing_key "\"" &&
+                data_line ~ /^data = "[^"]*"$/) {
+                removed++
+                next
+            }
+            print header
+            print key_line
+            print data_line
+            next
+        }
+        { print }
+        END {
+            if (removed != 1) {
+                print "expected one Fastly secret block for " missing_key \
+                    "; found " (removed + 0) > "/dev/stderr"
+                exit 1
+            }
+        }
+    ' "$source" >"$destination"
+}
+
+run_case missing-config "$BASE_PORT" 500 \
+    "key 'trusted_server_config' not found in config store 'trusted_server_config'"
+
+(
+    cd "$FASTLY_PROJECT"
+    "$SMOKE_TS_BIN" config push \
+        --adapter fastly \
+        --local \
+        --manifest "$EDGEZERO_MANIFEST" \
+        --app-config "$SMOKE_APP_CONFIG" \
+        --yes \
+        --no-diff
+)
+cat >>"$FASTLY_MANIFEST" <<EOF
+
+[[local_server.secret_stores.ts_secrets]]
+key = "handler_password"
+data = "$SMOKE_HANDLER_VALUE"
+
+[[local_server.secret_stores.ts_secrets]]
+key = "publisher_proxy_secret"
+data = "$SMOKE_PROXY_VALUE"
+
+[[local_server.secret_stores.ts_secrets]]
+key = "ec_passphrase"
+data = "$SMOKE_EC_VALUE"
+EOF
+CONFIGURED_FASTLY="$WORKSPACE/fastly.toml.configured"
+cp "$FASTLY_MANIFEST" "$CONFIGURED_FASTLY"
+
+write_without_secret "$CONFIGURED_FASTLY" "$FASTLY_MANIFEST" handler_password
+run_case missing-handler "$((BASE_PORT + 1))" 500 \
+    "failed to resolve secret reference at \`handlers[0].password\`"
+write_without_secret "$CONFIGURED_FASTLY" "$FASTLY_MANIFEST" publisher_proxy_secret
+run_case missing-proxy "$((BASE_PORT + 2))" 500 \
+    "failed to resolve secret reference at \`publisher.proxy_secret\`"
+write_without_secret "$CONFIGURED_FASTLY" "$FASTLY_MANIFEST" ec_passphrase
+run_case missing-ec "$((BASE_PORT + 3))" 500 \
+    "failed to resolve secret reference at \`ec.passphrase\`"
+
+cp "$CONFIGURED_FASTLY" "$FASTLY_MANIFEST"
+run_case positive "$((BASE_PORT + 4))" 200
+
+echo "Fastly first-success smoke passed"
diff --git a/scripts/smoke-spin.sh b/scripts/smoke-spin.sh
new file mode 100755
index 000000000..382f02ca8
--- /dev/null
+++ b/scripts/smoke-spin.sh
@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+# Exercise Spin's local SQLite config handoff and encoded secret variables.
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+# shellcheck source=scripts/smoke-common.sh
+. "$REPO_ROOT/scripts/smoke-common.sh"
+
+smoke_require_command cargo
+smoke_require_command curl
+smoke_require_command python3
+smoke_require_command spin
+smoke_require_command pgrep
+
+WORKSPACE=$(smoke_make_workspace spin)
+ORIGIN_PORT=${SPIN_SMOKE_ORIGIN_PORT:-19189}
+BASE_PORT=${SPIN_SMOKE_PORT:-19180}
+ORIGIN_PID=""
+APP_PID=""
+CONFIG_PUSHED=false
+
+cleanup() {
+    smoke_stop_process "$APP_PID"
+    smoke_stop_process "$ORIGIN_PID"
+    smoke_remove_workspace "$WORKSPACE"
+}
+trap cleanup EXIT INT TERM
+
+smoke_resolve_ts_binary "$REPO_ROOT"
+SPIN_WASM=${SPIN_WASM_PATH:-$REPO_ROOT/target/wasm32-wasip1/release/trusted_server_adapter_spin.wasm}
+if [ ! -f "$SPIN_WASM" ]; then
+    cargo build \
+        --manifest-path "$REPO_ROOT/Cargo.toml" \
+        --package trusted-server-adapter-spin \
+        --target wasm32-wasip1 \
+        --features spin \
+        --release
+fi
+[ -f "$SPIN_WASM" ] || smoke_die "Spin Wasm artifact not found: $SPIN_WASM"
+
+smoke_start_origin "$WORKSPACE" "$ORIGIN_PORT"
+ORIGIN_PID=$SMOKE_ORIGIN_PID
+smoke_initialize_config "$REPO_ROOT" "$WORKSPACE" "$ORIGIN_PORT"
+
+SPIN_WORK="$WORKSPACE/spin"
+mkdir -p "$SPIN_WORK"
+sed \
+    "s|source = \"../../target/wasm32-wasip1/release/trusted_server_adapter_spin.wasm\"|source = \"$SPIN_WASM\"|" \
+    "$REPO_ROOT/crates/trusted-server-adapter-spin/spin.toml" >"$SPIN_WORK/spin.toml"
+sed \
+    -e "s|= \"crates/|= \"$REPO_ROOT/crates/|g" \
+    -e "s|manifest = \"fastly.toml\"|manifest = \"$REPO_ROOT/fastly.toml\"|" \
+    -e "s|manifest = \"$REPO_ROOT/crates/trusted-server-adapter-spin/spin.toml\"|manifest = \"$SPIN_WORK/spin.toml\"|" \
+    "$REPO_ROOT/edgezero.toml" >"$WORKSPACE/edgezero.toml"
+
+SPIN_HANDLER_VAR=v_trusted_x5fserver_x5fsecrets_v_handler_x5fpassword
+SPIN_PROXY_VAR=v_trusted_x5fserver_x5fsecrets_v_publisher_x5fproxy_x5fsecret
+SPIN_EC_VAR=v_trusted_x5fserver_x5fsecrets_v_ec_x5fpassphrase
+
+run_case() {
+    local case_name="$1"
+    local port="$2"
+    local missing_variable="$3"
+    local expected_status="$4"
+    local expected_diagnostic="${5:-}"
+    local log_path="$WORKSPACE/$case_name.log"
+    local body_path="$WORKSPACE/$case_name.body"
+    local headers_path="$WORKSPACE/$case_name.headers"
+    local component_log_dir="$WORKSPACE/$case_name-component-logs"
+    local spin_args=(
+        spin up
+        --from "$SPIN_WORK"
+        --listen "127.0.0.1:$port"
+        --log-dir "$component_log_dir"
+        --truncate-logs
+    )
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+    if [ "$missing_variable" != "$SPIN_HANDLER_VAR" ]; then
+        spin_args+=(--variable "$SPIN_HANDLER_VAR=$SMOKE_HANDLER_VALUE")
+    fi
+    if [ "$missing_variable" != "$SPIN_PROXY_VAR" ]; then
+        spin_args+=(--variable "$SPIN_PROXY_VAR=$SMOKE_PROXY_VALUE")
+    fi
+    if [ "$missing_variable" != "$SPIN_EC_VAR" ]; then
+        spin_args+=(--variable "$SPIN_EC_VAR=$SMOKE_EC_VALUE")
+    fi
+
+    "${spin_args[@]}" >"$log_path" 2>&1 &
+    APP_PID=$!
+    smoke_wait_http "http://127.0.0.1:$port/" "$expected_status" \
+        "$body_path" "$headers_path"
+    smoke_assert_process_alive "$APP_PID" "Spin" "$log_path"
+    smoke_assert_process_alive "$ORIGIN_PID" "stub origin" "$WORKSPACE/origin.log"
+    smoke_stop_process "$APP_PID"
+    APP_PID=""
+
+    if [ -n "$expected_diagnostic" ]; then
+        grep --fixed-strings --quiet "Serving http://127.0.0.1:$port" "$log_path" ||
+            smoke_die "Spin launcher did not reach the requested listener"
+        if [ "$case_name" = "missing-config" ]; then
+            [ "$CONFIG_PUSHED" = false ] ||
+                smoke_die "missing-config case ran after the config push"
+        else
+            [ "$CONFIG_PUSHED" = true ] ||
+                smoke_die "missing-secret case ran before the config push"
+        fi
+        smoke_assert_failure \
+            "$expected_status" \
+            "$expected_diagnostic" \
+            "$component_log_dir/trusted-server_stderr.txt"
+    else
+        smoke_assert_success "$body_path" "$ORIGIN_PORT" "$port"
+    fi
+}
+
+run_case missing-config "$BASE_PORT" "" 503 \
+    'failed to read Spin Trusted Server app-config blob'
+
+EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME=default \
+    "$SMOKE_TS_BIN" config push \
+    --adapter spin \
+    --local \
+    --manifest "$WORKSPACE/edgezero.toml" \
+    --app-config "$SMOKE_APP_CONFIG" \
+    --yes \
+    --no-diff
+CONFIG_PUSHED=true
+
+run_case missing-handler "$((BASE_PORT + 1))" "$SPIN_HANDLER_VAR" 503 \
+    "resolved secret at \`handlers[0].password\` must not be empty"
+run_case missing-proxy "$((BASE_PORT + 2))" "$SPIN_PROXY_VAR" 503 \
+    "resolved secret at \`publisher.proxy_secret\` must not be empty"
+run_case missing-ec "$((BASE_PORT + 3))" "$SPIN_EC_VAR" 503 \
+    "resolved secret at \`ec.passphrase\` must not be empty"
+run_case positive "$((BASE_PORT + 4))" "" 200
+
+echo "Spin first-success smoke passed"
diff --git a/tinybird/README.md b/tinybird/README.md
new file mode 100644
index 000000000..ee47b14f0
--- /dev/null
+++ b/tinybird/README.md
@@ -0,0 +1,27 @@
+# Tinybird project
+
+This directory is the tracked Tinybird resource project for Trusted Server
+auction telemetry.
+
+- `datasources/auction_events_raw.datasource` is the runtime ingest target.
+- The auction overview, provider, and bid-stat rollups are materialized
+  datasource outputs.
+- `pipes/` contains summary, health, latency, freshness, quarantine, and seat
+  yield endpoints or materialized views.
+- `fixtures/auction_events_raw.ndjson` is test data only.
+- `tests/` checks auction summary, provider health, and seat-yield results.
+- `datasources/access_logs_raw.datasource` is reserved; Trusted Server does
+  not currently emit access logs.
+
+Authenticate the Tinybird CLI against the intended workspace, change to this
+directory, run `tb test`, inspect `tb deploy --dry-run`, and deploy with
+`tb deploy`. Do not commit workspace tokens or generated local credentials.
+
+Create an APPEND token scoped to `auction_events_raw`, store its value in the
+platform secret store, and put only its key name in
+`tinybird.auction_token_secret`. The runtime sends directly to the regional
+Events API host configured by `tinybird.api_host`.
+
+For runtime behavior, limits, privacy properties, and the Fastly-only emission
+boundary, see [Auction Telemetry](../docs/guide/telemetry.md). For exact
+configuration fields, see [Configuration](../docs/guide/configuration.md).