Design mobile ad-rendering trace endpoint

[prk-Jr]

Summary

• establish a reviewable design boundary before implementing the mobile ad-rendering trace requested by Create debug endpoint for mobile user to trace ad rendering #1050
• define a mobile-first reproduction and export journey that does not require credentials, developer tools, a target URL, or a server-side report database
• separate privacy-safe server-auction, GPT delivery, and creative-rendering evidence so the report does not claim correlations it cannot prove

Changes

File	Change
docs/superpowers/specs/2026-09-01-mobile-ad-render-trace-endpoint-design.md	Defines UX, routing, configuration, schemas, live auction transport, opaque slot correlation, privacy, failure handling, testing, rollout, acceptance criteria, and implementation sequencing.

Closes

Closes #1108

Implementation remains tracked by #1050. Related observability and timing follow-ups remain tracked by #1081 and #1076.

Test plan

• cargo test-fastly && cargo test-axum — not run; documentation-only change
• cargo clippy-fastly && cargo clippy-axum — not required for the documentation-only change
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run — 45 files and 893 tests passed under pinned Node 24.12.0
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1 — not run; documentation-only change
• Manual testing via fastly compute serve — not applicable
• Other: independent adversarial design review approved; git diff --check main...HEAD passed

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — no production code changed
• Uses tracing macros (not println!) — no logging code changed
• New code has tests — no code added; the spec defines the required implementation test strategy
• No secrets or credentials committed

[jevansnyc]

Review of the design spec. No code changes here, so this is internal consistency plus whether the stated contracts hold against what is in the repo today (gpt_diagnostics.rs, publisher.rs, auth.rs, prebid_eids.rs, and the TS diagnostics store/types).

Seven issues inline. The first three change the design rather than the wording:

1. The ts-auc- token shape does not match the existing producer, so correlation never joins.
2. TraceGptDiagnosticsV1 as specified cannot satisfy acceptance criterion 8.
3. Trace paths terminate ahead of authentication, which carves an exemption out of the ^/_ts namespace that auth.rs says should not exist.

The remaining four are bounded-scope corrections to the cookie lifetime claim, the TSJS gate, a capture_status gap, and redaction consistency.

Mechanical checks came back clean: cookie names (ts-ec, ts-eids, ts-tester, __Host-ts-console), the 8 KiB ts-eids cap (MAX_EIDS_COOKIE_BYTES), and the callback-issue reason values all match what the spec assumes.