diff --git a/Cargo.lock b/Cargo.lock
index e06ac75e7..65d1d777c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1151,6 +1151,12 @@ dependencies = [
  "wasip2",
 ]
 
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -2707,6 +2713,7 @@ dependencies = [
  "log-fastly",
  "serde",
  "serde_json",
+ "toml 1.0.7+spec-1.1.0",
  "trusted-server-core",
  "urlencoding",
 ]
@@ -2731,6 +2738,7 @@ dependencies = [
  "fastly",
  "flate2",
  "futures",
+ "glob",
  "hex",
  "hmac",
  "http",
diff --git a/Cargo.toml b/Cargo.toml
index 0b9f42309..6770ffebd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,6 +65,7 @@ fastly = "0.11.12"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
+glob = "0.3"
 hex = "0.4.3"
 hmac = "0.12.1"
 http = "1.4.0"
diff --git a/crates/js/lib/src/integrations/gpt/index.test.ts b/crates/js/lib/src/integrations/gpt/index.test.ts
new file mode 100644
index 000000000..e908a201e
--- /dev/null
+++ b/crates/js/lib/src/integrations/gpt/index.test.ts
@@ -0,0 +1,215 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+interface SlotRenderEvent {
+  isEmpty: boolean;
+  slot: {
+    getSlotElementId(): string;
+    getTargeting(key: string): string[];
+  };
+}
+
+type TestWindow = Window & {
+  googletag?: unknown;
+  __ts_ad_slots?: unknown;
+  __ts_bids?: unknown;
+  __tsAdInit?: () => void;
+};
+
+describe('installTsAdInit', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    delete (window as TestWindow).__ts_ad_slots;
+    delete (window as TestWindow).__ts_bids;
+    delete (window as TestWindow).__tsAdInit;
+    // jsdom does not implement navigator.sendBeacon; polyfill it for tests
+    if (!('sendBeacon' in navigator)) {
+      Object.defineProperty(navigator, 'sendBeacon', {
+        value: vi.fn().mockReturnValue(true),
+        writable: true,
+        configurable: true,
+      });
+    }
+  });
+
+  it('reads window.__ts_bids synchronously and applies bid targeting before refresh', async () => {
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('atf'),
+      getTargeting: vi.fn().mockReturnValue(['abc']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).__ts_ad_slots = [
+      {
+        id: 'atf',
+        gam_unit_path: '/123/atf',
+        div_id: 'atf',
+        formats: [[300, 250]],
+        targeting: { pos: 'atf' },
+      },
+    ];
+    (window as TestWindow).__ts_bids = {
+      atf: {
+        hb_pb: '1.00',
+        hb_bidder: 'kargo',
+        hb_adid: 'abc',
+        nurl: 'https://ssp/win',
+        burl: 'https://ssp/bill',
+      },
+    };
+
+    const fetchSpy = vi.spyOn(global, 'fetch');
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).__tsAdInit!();
+
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_pb', '1.00');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_bidder', 'kargo');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1');
+    expect(mockPubads.refresh).toHaveBeenCalled();
+
+    fetchSpy.mockRestore();
+  });
+
+  it('fires both nurl and burl via sendBeacon on slotRenderEnded when our bid won', async () => {
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    let capturedListener: ((e: SlotRenderEvent) => void) | undefined;
+
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('atf'),
+      getTargeting: vi.fn().mockReturnValue(['abc']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      refresh: vi.fn(),
+      addEventListener: vi.fn((event: string, fn: (e: SlotRenderEvent) => void) => {
+        if (event === 'slotRenderEnded') capturedListener = fn;
+      }),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).__ts_ad_slots = [
+      {
+        id: 'atf',
+        gam_unit_path: '/123/atf',
+        div_id: 'atf',
+        formats: [[300, 250]],
+        targeting: {},
+      },
+    ];
+    (window as TestWindow).__ts_bids = {
+      atf: {
+        hb_pb: '1.00',
+        hb_bidder: 'kargo',
+        hb_adid: 'abc',
+        nurl: 'https://ssp/win',
+        burl: 'https://ssp/bill',
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).__tsAdInit!();
+
+    expect(capturedListener).toBeDefined();
+    capturedListener!({ isEmpty: false, slot: mockSlot });
+
+    expect(beaconSpy).toHaveBeenCalledWith('https://ssp/win');
+    expect(beaconSpy).toHaveBeenCalledWith('https://ssp/bill');
+    beaconSpy.mockRestore();
+  });
+
+  it('does not fire nurl/burl when bid did not win GAM line item', async () => {
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    let capturedListener: ((e: SlotRenderEvent) => void) | undefined;
+
+    const mockSlotNoMatch = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('atf'),
+      getTargeting: vi.fn().mockReturnValue(['OTHER_BID_ID']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      refresh: vi.fn(),
+      addEventListener: vi.fn((event: string, fn: (e: SlotRenderEvent) => void) => {
+        if (event === 'slotRenderEnded') capturedListener = fn;
+      }),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlotNoMatch),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).__ts_ad_slots = [
+      {
+        id: 'atf',
+        gam_unit_path: '/123/atf',
+        div_id: 'atf',
+        formats: [[300, 250]],
+        targeting: {},
+      },
+    ];
+    (window as TestWindow).__ts_bids = {
+      atf: {
+        hb_pb: '1.00',
+        hb_bidder: 'kargo',
+        hb_adid: 'abc',
+        nurl: 'https://ssp/win',
+        burl: 'https://ssp/bill',
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).__tsAdInit!();
+    capturedListener!({ isEmpty: false, slot: mockSlotNoMatch });
+
+    expect(beaconSpy).not.toHaveBeenCalled();
+    beaconSpy.mockRestore();
+  });
+
+  it('calls refresh even when __ts_bids is empty (graceful fallback)', async () => {
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue({
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+      }),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).__ts_ad_slots = [];
+    (window as TestWindow).__ts_bids = {};
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).__tsAdInit!();
+
+    expect(mockPubads.refresh).toHaveBeenCalled();
+  });
+});
diff --git a/crates/js/lib/src/integrations/gpt/index.ts b/crates/js/lib/src/integrations/gpt/index.ts
index 0b9e30235..ffb4a687f 100644
--- a/crates/js/lib/src/integrations/gpt/index.ts
+++ b/crates/js/lib/src/integrations/gpt/index.ts
@@ -31,12 +31,21 @@ interface GoogleTagSlot {
   getAdUnitPath(): string;
   getSlotElementId(): string;
   setTargeting(key: string, value: string | string[]): GoogleTagSlot;
+  addService(service: GoogleTagPubAdsService): GoogleTagSlot;
+  getTargeting?(key: string): string[];
+}
+
+interface SlotRenderEndedEvent {
+  isEmpty: boolean;
+  slot: GoogleTagSlot;
 }
 
 interface GoogleTagPubAdsService {
   setTargeting(key: string, value: string | string[]): GoogleTagPubAdsService;
   getTargeting(key: string): string[];
   enableSingleRequest(): void;
+  addEventListener(event: string, fn: (e: SlotRenderEndedEvent) => void): void;
+  refresh(): void;
 }
 
 interface GoogleTag {
@@ -54,6 +63,7 @@ interface GoogleTag {
 
 type GptWindow = Window & {
   googletag?: Partial<GoogleTag>;
+  __tsjs_slim_prebid_url?: string;
 };
 
 // ------------------------------------------------------------------
@@ -105,7 +115,8 @@ function wrapCommand(fn: () => void): () => void {
  */
 function patchCommandQueue(tag: Partial<GoogleTag>): void {
   // Ensure the queue exists.
-  if (!Array.isArray(tag.cmd)) {
+  if (!tag.cmd) {
+    // Cast through unknown so an array satisfies the { push } type.
     tag.cmd = [];
   }
 
@@ -121,7 +132,9 @@ function patchCommandQueue(tag: Partial<GoogleTag>): void {
 
   // Override push on the *existing* array — preserves object identity so
   // GPT (if already loaded) keeps its reference.
-  queue.push = function (...callbacks: Array<() => void>): number {
+  (queue as { push: (...cbs: Array<() => void>) => unknown }).push = function (
+    ...callbacks: Array<() => void>
+  ): unknown {
     const wrapped = callbacks.map(wrapCommand);
     return originalPush(...wrapped);
   };
@@ -130,11 +143,15 @@ function patchCommandQueue(tag: Partial<GoogleTag>): void {
   (queue as { __tsPushed?: boolean }).__tsPushed = true;
 
   // Re-wrap any callbacks that were queued before we patched.
-  for (let i = 0; i < queue.length; i++) {
-    queue[i] = wrapCommand(queue[i]);
+  // Only applicable when cmd is an array (pre-GPT-load case).
+  if (Array.isArray(queue)) {
+    for (let i = 0; i < queue.length; i++) {
+      queue[i] = wrapCommand(queue[i]);
+    }
+    log.debug('GPT shim: command queue patched', { pendingCommands: queue.length });
+  } else {
+    log.debug('GPT shim: command queue patched');
   }
-
-  log.debug('GPT shim: command queue patched', { pendingCommands: queue.length });
 }
 
 /**
@@ -161,6 +178,110 @@ export function installGptShim(): boolean {
   return true;
 }
 
+// ------------------------------------------------------------------
+// Trusted Server ad-init types
+// ------------------------------------------------------------------
+
+interface TsAdSlot {
+  id: string;
+  gam_unit_path: string;
+  div_id: string;
+  formats: Array<number[]>;
+  targeting: Record<string, string>;
+}
+
+interface TsBidData {
+  hb_pb?: string;
+  hb_bidder?: string;
+  hb_adid?: string;
+  nurl?: string;
+  burl?: string;
+}
+
+type TsWindow = Window & {
+  __ts_ad_slots?: TsAdSlot[];
+  __ts_bids?: Record<string, TsBidData>;
+  __tsAdInit?: () => void;
+};
+
+/**
+ * Install `window.__tsAdInit`.
+ *
+ * Reads `window.__ts_ad_slots` (injected at head-open) and `window.__ts_bids`
+ * (injected before </body>) synchronously — no fetch, no Promise. Applies bid
+ * targeting to GPT slots, sets the `ts_initial` sentinel, registers
+ * `slotRenderEnded` to fire both nurl and burl via sendBeacon when our
+ * specific Prebid bid wins the GAM line item match, then calls refresh().
+ */
+export function installTsAdInit(): void {
+  const w = window as TsWindow;
+  w.__tsAdInit = function () {
+    const slots = w.__ts_ad_slots ?? [];
+    const bids = w.__ts_bids ?? {};
+    const g = (window as GptWindow).googletag;
+    if (!g) return;
+
+    g.cmd?.push(() => {
+      slots
+        .map((slot) => {
+          const gptSlot = g.defineSlot?.(
+            slot.gam_unit_path,
+            slot.formats as Array<number | number[]>,
+            slot.div_id
+          );
+          if (!gptSlot) return null;
+          gptSlot.addService(g.pubads!());
+          Object.entries(slot.targeting ?? {}).forEach(([k, v]) => gptSlot.setTargeting(k, v));
+          const bid = bids[slot.id] ?? {};
+          (['hb_pb', 'hb_bidder', 'hb_adid'] as const).forEach((key) => {
+            if (bid[key]) gptSlot.setTargeting(key, bid[key]!);
+          });
+          gptSlot.setTargeting('ts_initial', '1');
+          return { id: slot.id, gptSlot };
+        })
+        .filter(Boolean);
+
+      g.pubads!().enableSingleRequest();
+      g.enableServices?.();
+
+      g.pubads!().addEventListener?.('slotRenderEnded', (event: SlotRenderEndedEvent) => {
+        const slotId: string = event.slot?.getSlotElementId?.() ?? '';
+        const bid = bids[slotId] ?? {};
+        const ourBidWon =
+          !event.isEmpty &&
+          bid.hb_adid &&
+          event.slot?.getTargeting?.('hb_adid')?.[0] === bid.hb_adid;
+        if (ourBidWon) {
+          if (bid.nurl) navigator.sendBeacon(bid.nurl);
+          if (bid.burl) navigator.sendBeacon(bid.burl);
+        }
+      });
+
+      g.pubads!().refresh();
+    });
+  };
+}
+
+/**
+ * Register the slim-Prebid lazy loader. Fires after window.load — off the
+ * critical path. slim-Prebid handles refresh auctions and userID module
+ * warm-up (ID5, sharedID, LiveRamp ATS, Lockr). It skips initial-render slots
+ * (ts_initial=1) and registers as the GPT refresh handler for scroll/sticky auctions.
+ *
+ * Phase 1: no-op unless window.__tsjs_slim_prebid_url is set (it won't be until
+ * the slim-Prebid bundle build target ships in a later phase).
+ */
+export function installSlimPrebidLoader(): void {
+  const url = (window as GptWindow).__tsjs_slim_prebid_url;
+  if (!url) return;
+  window.addEventListener('load', () => {
+    const script = document.createElement('script');
+    script.src = url;
+    script.defer = true;
+    document.head.appendChild(script);
+  });
+}
+
 // Register the activation function on `window` so the server-injected inline
 // script can call it explicitly. The server emits:
 //   <script>window.__tsjs_gpt_enabled=true;
@@ -170,11 +291,13 @@ export function installGptShim(): boolean {
 // regardless of script order, the module also checks for a pre-set enable flag
 // immediately after registering the function.
 if (typeof window !== 'undefined') {
-  const win = window as Record<string, unknown>;
+  const win = window as unknown as Record<string, unknown>;
 
   win.__tsjs_installGptShim = installGptShim;
 
   if (win.__tsjs_gpt_enabled === true) {
     installGptShim();
   }
+
+  installTsAdInit();
 }
diff --git a/crates/trusted-server-adapter-fastly/Cargo.toml b/crates/trusted-server-adapter-fastly/Cargo.toml
index e483ea621..a730efcd6 100644
--- a/crates/trusted-server-adapter-fastly/Cargo.toml
+++ b/crates/trusted-server-adapter-fastly/Cargo.toml
@@ -20,6 +20,7 @@ log = { workspace = true }
 log-fastly = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+toml = { workspace = true }
 trusted-server-core = { workspace = true }
 urlencoding = { workspace = true }
 
diff --git a/crates/trusted-server-adapter-fastly/build.rs b/crates/trusted-server-adapter-fastly/build.rs
new file mode 100644
index 000000000..0ad1f2dd9
--- /dev/null
+++ b/crates/trusted-server-adapter-fastly/build.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("cargo:rerun-if-changed=../../../creative-opportunities.toml");
+}
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index 52c869d7f..74414220b 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -39,6 +39,8 @@ use crate::error::to_error_response;
 use crate::logging::init_logger;
 use crate::platform::{build_runtime_services, open_kv_store, UnavailableKvStore};
 
+const CREATIVE_OPPORTUNITIES_TOML: &str = include_str!("../../../creative-opportunities.toml");
+
 /// Entry point for the Fastly Compute program.
 ///
 /// Uses an undecorated `main()` with `Request::from_client()` instead of
@@ -80,6 +82,10 @@ fn main() {
         }
     };
 
+    let slots_file: trusted_server_core::creative_opportunities::CreativeOpportunitiesFile =
+        toml::from_str(CREATIVE_OPPORTUNITIES_TOML)
+            .expect("should parse creative-opportunities.toml");
+
     let integration_registry = match IntegrationRegistry::new(&settings) {
         Ok(r) => r,
         Err(e) => {
@@ -103,6 +109,7 @@ fn main() {
         &orchestrator,
         &integration_registry,
         &runtime_services,
+        &slots_file,
         req,
     )) {
         response.send_to_client();
@@ -114,6 +121,7 @@ async fn route_request(
     orchestrator: &AuctionOrchestrator,
     integration_registry: &IntegrationRegistry,
     runtime_services: &RuntimeServices,
+    slots_file: &trusted_server_core::creative_opportunities::CreativeOpportunitiesFile,
     mut req: Request,
 ) -> Option<Response> {
     // Strip client-spoofable forwarded headers at the edge.
@@ -221,8 +229,12 @@ async fn route_request(
                         settings,
                         integration_registry,
                         &publisher_services,
+                        orchestrator,
+                        slots_file,
                         req,
-                    ) {
+                    )
+                    .await
+                    {
                         Ok(PublisherResponse::Stream {
                             mut response,
                             body,
diff --git a/crates/trusted-server-adapter-fastly/src/route_tests.rs b/crates/trusted-server-adapter-fastly/src/route_tests.rs
index 0fd0113f8..06336a9b1 100644
--- a/crates/trusted-server-adapter-fastly/src/route_tests.rs
+++ b/crates/trusted-server-adapter-fastly/src/route_tests.rs
@@ -184,6 +184,8 @@ fn configured_missing_consent_store_only_breaks_consent_routes() {
     let orchestrator = build_orchestrator(&settings).expect("should build auction orchestrator");
     let integration_registry =
         IntegrationRegistry::new(&settings).expect("should create integration registry");
+    let slots_file =
+        trusted_server_core::creative_opportunities::CreativeOpportunitiesFile::default();
 
     let discovery_req = Request::get("https://test.com/.well-known/trusted-server.json");
     let discovery_services = test_runtime_services(&discovery_req);
@@ -192,6 +194,7 @@ fn configured_missing_consent_store_only_breaks_consent_routes() {
         &orchestrator,
         &integration_registry,
         &discovery_services,
+        &slots_file,
         discovery_req,
     ))
     .expect("should route discovery request");
@@ -208,6 +211,7 @@ fn configured_missing_consent_store_only_breaks_consent_routes() {
         &orchestrator,
         &integration_registry,
         &admin_services,
+        &slots_file,
         admin_req,
     ))
     .expect("should route admin request");
@@ -224,6 +228,7 @@ fn configured_missing_consent_store_only_breaks_consent_routes() {
         &orchestrator,
         &integration_registry,
         &auction_services,
+        &slots_file,
         auction_req,
     ))
     .expect("should return an error response for auction requests");
@@ -240,6 +245,7 @@ fn configured_missing_consent_store_only_breaks_consent_routes() {
         &orchestrator,
         &integration_registry,
         &publisher_services,
+        &slots_file,
         publisher_req,
     ))
     .expect("should return an error response for publisher fallback");
diff --git a/crates/trusted-server-core/Cargo.toml b/crates/trusted-server-core/Cargo.toml
index 9c69bd30b..909763ce4 100644
--- a/crates/trusted-server-core/Cargo.toml
+++ b/crates/trusted-server-core/Cargo.toml
@@ -25,6 +25,7 @@ error-stack = { workspace = true }
 fastly = { workspace = true }
 flate2 = { workspace = true }
 futures = { workspace = true }
+glob = { workspace = true }
 hex = { workspace = true }
 hmac = { workspace = true }
 http = { workspace = true }
diff --git a/crates/trusted-server-core/build.rs b/crates/trusted-server-core/build.rs
index 6f56e85a2..b21cb6845 100644
--- a/crates/trusted-server-core/build.rs
+++ b/crates/trusted-server-core/build.rs
@@ -3,6 +3,19 @@
 // in the build context, so `dead_code` is expected.
 #![allow(clippy::unwrap_used, clippy::panic, dead_code)]
 
+// Stub out dependencies for build.rs context
+mod glob {
+    pub struct Pattern;
+    impl Pattern {
+        pub fn new(_: &str) -> Result<Self, String> {
+            Ok(Pattern)
+        }
+        pub fn matches(&self, _: &str) -> bool {
+            false
+        }
+    }
+}
+
 #[path = "src/error.rs"]
 mod error;
 
@@ -15,6 +28,27 @@ mod redacted;
 #[path = "src/consent_config.rs"]
 mod consent_config;
 
+#[path = "src/price_bucket.rs"]
+mod price_bucket;
+
+// CreativeOpportunitiesConfig for build.rs deserialization only
+mod creative_opportunities {
+    use serde::{Deserialize, Serialize};
+
+    #[derive(Debug, Clone, Deserialize, Serialize)]
+    pub struct CreativeOpportunitiesConfig {
+        pub gam_network_id: String,
+        #[serde(default)]
+        pub auction_timeout_ms: Option<u32>,
+        #[serde(default = "default_price_granularity")]
+        pub price_granularity: String,
+    }
+
+    fn default_price_granularity() -> String {
+        "dense".to_string()
+    }
+}
+
 #[path = "src/settings.rs"]
 mod settings;
 
@@ -23,6 +57,7 @@ use std::path::Path;
 
 const TRUSTED_SERVER_INIT_CONFIG_PATH: &str = "../../trusted-server.toml";
 const TRUSTED_SERVER_OUTPUT_CONFIG_PATH: &str = "../../target/trusted-server-out.toml";
+const CREATIVE_OPPORTUNITIES_PATH: &str = "../../creative-opportunities.toml";
 
 fn main() {
     // Always rerun build.rs: integration settings are stored in a flat
@@ -51,4 +86,35 @@ fn main() {
         fs::write(dest_path, merged_toml)
             .unwrap_or_else(|_| panic!("Failed to write {dest_path:?}"));
     }
+
+    // Validate creative-opportunities.toml slot IDs at build time
+    println!("cargo:rerun-if-changed={}", CREATIVE_OPPORTUNITIES_PATH);
+
+    let co_path = Path::new(CREATIVE_OPPORTUNITIES_PATH);
+    if co_path.exists() {
+        let co_content =
+            fs::read_to_string(co_path).expect("should read creative-opportunities.toml");
+        let co_value: toml::Value =
+            toml::from_str(&co_content).expect("creative-opportunities.toml: invalid TOML");
+        let slot_id_re = regex::Regex::new(r"^[A-Za-z0-9_\-]+$").expect("should compile regex");
+        if let Some(slots) = co_value.get("slot").and_then(|v| v.as_array()) {
+            for slot in slots {
+                let id = slot
+                    .get("id")
+                    .and_then(|v| v.as_str())
+                    .expect("creative-opportunities.toml: slot missing 'id' field");
+                if !slot_id_re.is_match(id) {
+                    panic!(
+                        "creative-opportunities.toml: slot id '{}' is invalid; \
+                         only [A-Za-z0-9_-] allowed",
+                        id
+                    );
+                }
+            }
+            println!(
+                "cargo:warning=creative-opportunities.toml: {} slot(s) validated",
+                slots.len()
+            );
+        }
+    }
 }
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 9cbcd2b93..0a52b07c8 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -722,6 +722,7 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                ad_id: None,
                 metadata: HashMap::new(),
             },
         );
@@ -738,6 +739,7 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                ad_id: None,
                 metadata: HashMap::new(),
             },
         );
@@ -872,6 +874,7 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                ad_id: None,
                 metadata: {
                     let mut m = HashMap::new();
                     m.insert(
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index 17db59906..b50c6db5d 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -60,6 +60,14 @@ pub enum MediaType {
     Native,
 }
 
+impl MediaType {
+    /// Returns the Banner media type.
+    #[must_use]
+    pub fn banner() -> Self {
+        Self::Banner
+    }
+}
+
 /// Publisher information.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PublisherInfo {
@@ -152,6 +160,8 @@ pub struct Bid {
     pub nurl: Option<String>,
     /// Billing notification URL
     pub burl: Option<String>,
+    /// Ad ID from the bidder
+    pub ad_id: Option<String>,
     /// Provider-specific bid metadata
     /// For APS bids, contains encoded price in "amznbid" field
     pub metadata: HashMap<String, serde_json::Value>,
@@ -276,6 +286,7 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            ad_id: None,
             metadata: HashMap::new(),
         }
     }
@@ -387,4 +398,28 @@ mod tests {
             "should omit metadata field when empty"
         );
     }
+
+    #[test]
+    fn media_type_banner_fn_returns_banner() {
+        assert_eq!(MediaType::banner(), MediaType::Banner);
+    }
+
+    #[test]
+    fn bid_has_ad_id_field() {
+        let bid = Bid {
+            slot_id: "s".to_string(),
+            price: Some(1.0),
+            currency: "USD".to_string(),
+            creative: None,
+            adomain: None,
+            bidder: "kargo".to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            ad_id: Some("prebid-ad-id-abc".to_string()),
+            metadata: Default::default(),
+        };
+        assert_eq!(bid.ad_id.as_deref(), Some("prebid-ad-id-abc"));
+    }
 }
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
new file mode 100644
index 000000000..7a4a10df5
--- /dev/null
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -0,0 +1,370 @@
+//! Configuration types and URL matching for creative opportunity slots.
+//!
+//! A [`CreativeOpportunitySlot`] describes a single ad placement: which pages
+//! it appears on (via glob patterns), what ad formats it supports, and how it
+//! maps to provider-specific identifiers such as GAM unit paths and APS slot IDs.
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+
+use glob::Pattern;
+
+use crate::auction::types::{AdFormat, AdSlot, MediaType};
+use crate::price_bucket::PriceGranularity;
+
+/// Top-level configuration for the creative opportunities system.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct CreativeOpportunitiesConfig {
+    /// GAM network ID used to build default unit paths.
+    pub gam_network_id: String,
+    /// Auction timeout in milliseconds.
+    #[serde(default)]
+    pub auction_timeout_ms: Option<u32>,
+    /// Price granularity for header-bidding price bucketing.
+    #[serde(default = "PriceGranularity::dense")]
+    pub price_granularity: PriceGranularity,
+}
+
+/// A single ad placement opportunity on the publisher's site.
+#[derive(Debug, Clone, Deserialize)]
+pub struct CreativeOpportunitySlot {
+    /// Unique identifier for the slot (e.g., `"atf"`, `"below-fold-sidebar"`).
+    pub id: String,
+    /// Override for the GAM ad unit path.
+    ///
+    /// When absent, the path is derived as `/<gam_network_id>/<id>`.
+    pub gam_unit_path: Option<String>,
+    /// Override for the HTML `div` element ID that will hold the creative.
+    ///
+    /// Defaults to [`id`](Self::id) when absent.
+    pub div_id: Option<String>,
+    /// Glob patterns for page paths this slot should appear on.
+    pub page_patterns: Vec<String>,
+    /// Supported ad formats (size + media type combinations).
+    pub formats: Vec<CreativeOpportunityFormat>,
+    /// Optional floor price in CPM (USD).
+    pub floor_price: Option<f64>,
+    /// Slot-level targeting key–value pairs forwarded to the auction.
+    #[serde(default)]
+    pub targeting: HashMap<String, String>,
+    /// Provider-specific slot identifiers.
+    #[serde(default)]
+    pub providers: SlotProviders,
+}
+
+impl CreativeOpportunitySlot {
+    /// Returns `true` if `path` matches any of this slot's [`page_patterns`](Self::page_patterns).
+    ///
+    /// Patterns use glob syntax (e.g., `"/20**"` matches any path starting with `/20`,
+    /// `"/"` matches only the root). When a pattern contains `**` in a position that the
+    /// glob crate considers invalid (e.g., `b**`), the `**` is normalised to `*` before
+    /// matching. A single `*` matches any sequence of characters including path separators
+    /// because `require_literal_separator` is `false`.
+    ///
+    /// Patterns that cannot be compiled even after normalisation are silently skipped.
+    #[must_use]
+    pub fn matches_path(&self, path: &str) -> bool {
+        self.page_patterns
+            .iter()
+            .any(|pattern| match Pattern::new(pattern) {
+                Ok(p) => p.matches(path),
+                Err(_) => {
+                    let normalised = pattern.replace("**", "*");
+                    Pattern::new(&normalised)
+                        .map(|p| p.matches(path))
+                        .unwrap_or(false)
+                }
+            })
+    }
+
+    /// Returns the GAM ad unit path for this slot.
+    ///
+    /// Uses the explicit [`gam_unit_path`](Self::gam_unit_path) override when set,
+    /// otherwise constructs `/<gam_network_id>/<id>`.
+    #[must_use]
+    pub fn resolved_gam_unit_path(&self, gam_network_id: &str) -> String {
+        self.gam_unit_path
+            .clone()
+            .unwrap_or_else(|| format!("/{}/{}", gam_network_id, self.id))
+    }
+
+    /// Returns the div element ID for this slot.
+    ///
+    /// Returns the [`div_id`](Self::div_id) override when set, otherwise returns [`id`](Self::id).
+    #[must_use]
+    pub fn resolved_div_id(&self) -> &str {
+        self.div_id.as_deref().unwrap_or(&self.id)
+    }
+
+    /// Converts this slot into an [`AdSlot`] ready for use in an auction request.
+    ///
+    /// Provider-specific params (e.g., APS `slotID`, PBS bidder params) are wired
+    /// into the `bidders` map keyed by provider/bidder name.
+    #[must_use]
+    pub fn to_ad_slot(&self, gam_network_id: &str) -> AdSlot {
+        let _ = gam_network_id;
+        let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
+        if let Some(ref aps) = self.providers.aps {
+            bidders.insert(
+                "aps".to_string(),
+                serde_json::json!({ "slotID": aps.slot_id }),
+            );
+        }
+        if let Some(ref pbs) = self.providers.pbs {
+            for (bidder_name, params) in &pbs.bidders {
+                bidders.insert(bidder_name.clone(), params.clone());
+            }
+        }
+        AdSlot {
+            id: self.id.clone(),
+            formats: self
+                .formats
+                .iter()
+                .map(CreativeOpportunityFormat::to_ad_format)
+                .collect(),
+            floor_price: self.floor_price,
+            targeting: self
+                .targeting
+                .iter()
+                .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                .collect(),
+            bidders,
+        }
+    }
+}
+
+/// An ad format combining a media type with pixel dimensions.
+#[derive(Debug, Clone, Deserialize)]
+pub struct CreativeOpportunityFormat {
+    /// Creative width in pixels.
+    pub width: u32,
+    /// Creative height in pixels.
+    pub height: u32,
+    /// Media type for this format.
+    #[serde(default = "MediaType::banner")]
+    pub media_type: MediaType,
+}
+
+impl CreativeOpportunityFormat {
+    fn to_ad_format(&self) -> AdFormat {
+        AdFormat {
+            media_type: self.media_type.clone(),
+            width: self.width,
+            height: self.height,
+        }
+    }
+}
+
+/// Provider-specific slot identifiers for a [`CreativeOpportunitySlot`].
+#[derive(Debug, Clone, Default, Deserialize)]
+pub struct SlotProviders {
+    /// Amazon Publisher Services (APS/TAM) slot parameters.
+    pub aps: Option<ApsSlotParams>,
+    /// Prebid Server (PBS) slot parameters.
+    pub pbs: Option<PbsSlotParams>,
+}
+
+/// APS-specific parameters for a slot.
+#[derive(Debug, Clone, Deserialize)]
+pub struct ApsSlotParams {
+    /// The APS slot ID string used when making TAM bid requests.
+    pub slot_id: String,
+}
+
+/// PBS-specific parameters for a slot.
+///
+/// Bidder params are sent inline to Prebid Server so bidder credentials
+/// stay in `creative-opportunities.toml` rather than in PBS stored requests.
+#[derive(Debug, Clone, Default, Deserialize)]
+pub struct PbsSlotParams {
+    /// Per-bidder params keyed by bidder name (must match PBS adapter name).
+    ///
+    /// Example in TOML:
+    /// ```toml
+    /// [slot.providers.pbs.bidders]
+    /// mocktioneer = { bid = 2.00 }
+    /// criteo = { networkId = 123456, pubid = "123456" }
+    /// ```
+    #[serde(default)]
+    pub bidders: HashMap<String, serde_json::Value>,
+}
+
+/// TOML file structure for creative opportunity slot definitions.
+#[derive(Debug, Clone, Deserialize, Default)]
+pub struct CreativeOpportunitiesFile {
+    /// All slot definitions in the file (mapped from `[[slot]]` TOML arrays).
+    #[serde(rename = "slot", default)]
+    pub slots: Vec<CreativeOpportunitySlot>,
+}
+
+/// Validates that a slot ID contains only safe characters.
+///
+/// Allowed characters: ASCII alphanumerics, underscores (`_`), and hyphens (`-`).
+///
+/// # Errors
+///
+/// Returns an error string when the ID is empty or contains disallowed characters.
+pub fn validate_slot_id(id: &str) -> Result<(), String> {
+    if id.is_empty() {
+        return Err("slot id must not be empty".to_string());
+    }
+    if id
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+    {
+        Ok(())
+    } else {
+        Err(format!(
+            "slot id '{id}' contains invalid characters; only [A-Za-z0-9_-] allowed"
+        ))
+    }
+}
+
+/// Returns all slots whose [`page_patterns`](CreativeOpportunitySlot::page_patterns) match `path`.
+#[must_use]
+pub fn match_slots<'a>(
+    slots: &'a [CreativeOpportunitySlot],
+    path: &str,
+) -> Vec<&'a CreativeOpportunitySlot> {
+    slots.iter().filter(|s| s.matches_path(path)).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_slot(id: &str, patterns: Vec<&str>) -> CreativeOpportunitySlot {
+        CreativeOpportunitySlot {
+            id: id.to_string(),
+            gam_unit_path: None,
+            div_id: None,
+            page_patterns: patterns.into_iter().map(String::from).collect(),
+            formats: vec![CreativeOpportunityFormat {
+                width: 300,
+                height: 250,
+                media_type: crate::auction::types::MediaType::Banner,
+            }],
+            floor_price: Some(0.50),
+            targeting: Default::default(),
+            providers: Default::default(),
+        }
+    }
+
+    #[test]
+    fn glob_matches_article_path() {
+        let slot = make_slot("atf", vec!["/20**"]);
+        assert!(
+            slot.matches_path("/2024/01/my-article/"),
+            "should match article path"
+        );
+        assert!(!slot.matches_path("/"), "should not match root");
+    }
+
+    #[test]
+    fn exact_match_homepage() {
+        let slot = make_slot("home", vec!["/"]);
+        assert!(slot.matches_path("/"), "should match root");
+        assert!(!slot.matches_path("/about"), "should not match /about");
+    }
+
+    #[test]
+    fn slot_id_validates_alphanumeric() {
+        assert!(validate_slot_id("atf_sidebar_ad").is_ok());
+        assert!(validate_slot_id("below-content-0").is_ok());
+        assert!(validate_slot_id("").is_err(), "empty id should fail");
+        assert!(
+            validate_slot_id("xss<script>").is_err(),
+            "html in id should fail"
+        );
+        assert!(validate_slot_id("has space").is_err(), "spaces should fail");
+    }
+
+    #[test]
+    fn resolved_gam_unit_path_uses_default_when_absent() {
+        let slot = make_slot("atf", vec!["/"]);
+        assert_eq!(
+            slot.resolved_gam_unit_path("21765378893"),
+            "/21765378893/atf"
+        );
+    }
+
+    #[test]
+    fn resolved_gam_unit_path_uses_override_when_set() {
+        let mut slot = make_slot("atf", vec!["/"]);
+        slot.gam_unit_path = Some("/21765378893/publisher/atf-sidebar".to_string());
+        assert_eq!(
+            slot.resolved_gam_unit_path("21765378893"),
+            "/21765378893/publisher/atf-sidebar"
+        );
+    }
+
+    #[test]
+    fn resolved_div_id_defaults_to_slot_id() {
+        let slot = make_slot("atf", vec!["/"]);
+        assert_eq!(slot.resolved_div_id(), "atf");
+    }
+
+    #[test]
+    fn to_ad_slot_wires_aps_params_into_bidders() {
+        let mut slot = make_slot("atf", vec!["/"]);
+        slot.providers.aps = Some(ApsSlotParams {
+            slot_id: "aps-slot-atf".to_string(),
+        });
+        let ad_slot = slot.to_ad_slot("21765378893");
+        let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
+        assert_eq!(
+            aps_params.get("slotID").and_then(|v| v.as_str()),
+            Some("aps-slot-atf"),
+        );
+    }
+
+    #[test]
+    fn to_ad_slot_wires_pbs_bidder_params_into_bidders() {
+        let mut slot = make_slot("atf_sidebar_ad", vec!["/"]);
+        slot.providers.pbs = Some(PbsSlotParams {
+            bidders: [
+                (
+                    "mocktioneer".to_string(),
+                    serde_json::json!({ "bid": 2.00 }),
+                ),
+                (
+                    "criteo".to_string(),
+                    serde_json::json!({ "networkId": 123456, "pubid": "123456" }),
+                ),
+            ]
+            .into_iter()
+            .collect(),
+        });
+        let ad_slot = slot.to_ad_slot("88059007");
+        let mock_params = ad_slot
+            .bidders
+            .get("mocktioneer")
+            .expect("should have mocktioneer bidder");
+        assert_eq!(
+            mock_params.get("bid").and_then(serde_json::Value::as_f64),
+            Some(2.0),
+            "should wire mocktioneer bid param"
+        );
+        let criteo_params = ad_slot
+            .bidders
+            .get("criteo")
+            .expect("should have criteo bidder");
+        assert_eq!(
+            criteo_params
+                .get("networkId")
+                .and_then(serde_json::Value::as_i64),
+            Some(123456),
+            "should wire criteo networkId param"
+        );
+    }
+
+    #[test]
+    fn to_ad_slot_sets_floor_price_and_formats() {
+        let slot = make_slot("atf", vec!["/"]);
+        let ad_slot = slot.to_ad_slot("21765378893");
+        assert_eq!(ad_slot.id, "atf");
+        assert_eq!(ad_slot.floor_price, Some(0.50));
+        assert_eq!(ad_slot.formats.len(), 1);
+    }
+}
diff --git a/crates/trusted-server-core/src/html_processor.rs b/crates/trusted-server-core/src/html_processor.rs
index a201a59d3..86a8abe79 100644
--- a/crates/trusted-server-core/src/html_processor.rs
+++ b/crates/trusted-server-core/src/html_processor.rs
@@ -20,9 +20,14 @@
 use std::cell::Cell;
 use std::io;
 use std::rc::Rc;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 
-use lol_html::{element, html_content::ContentType, text, Settings as RewriterSettings};
+use lol_html::{
+    element,
+    html_content::{ContentType, EndTag},
+    text, EndTagHandler, Settings as RewriterSettings,
+};
 
 use crate::integrations::{
     AttributeRewriteOutcome, IntegrationAttributeContext, IntegrationDocumentState,
@@ -134,6 +139,13 @@ pub struct HtmlProcessorConfig {
     pub request_host: String,
     pub request_scheme: String,
     pub integrations: IntegrationRegistry,
+    /// Pre-computed `<script>window.__ts_ad_slots=...;</script>`.
+    /// Injected at `<head>` open. `None` when no slots matched.
+    pub ad_slots_script: Option<String>,
+    /// Shared auction result — written by auction task before HTML processing begins.
+    /// Handler reads this in `el.on_end_tag()` on the body element.
+    /// `None` means no auction ran; inject empty `__ts_bids = {}` as fallback.
+    pub ad_bids_state: std::sync::Arc<std::sync::RwLock<Option<String>>>,
 }
 
 impl HtmlProcessorConfig {
@@ -151,11 +163,18 @@ impl HtmlProcessorConfig {
             request_host: request_host.to_string(),
             request_scheme: request_scheme.to_string(),
             integrations: integrations.clone(),
+            ad_slots_script: None,
+            ad_bids_state: std::sync::Arc::new(std::sync::RwLock::new(None)),
         }
     }
 }
 
-/// Create an HTML processor with URL replacement and integration hooks
+/// Create an HTML processor with URL replacement and integration hooks.
+///
+/// # Panics
+///
+/// Panics if the `ad_bids_state` `RwLock` is poisoned. This cannot happen in
+/// normal operation since no code holds the write lock across a panic boundary.
 #[must_use]
 pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcessor {
     let post_processors = config.integrations.html_post_processors();
@@ -228,8 +247,11 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
     });
 
     let injected_tsjs = Rc::new(Cell::new(false));
+    let injected_bids = Arc::new(AtomicBool::new(false));
     let integration_registry = config.integrations.clone();
     let script_rewriters = integration_registry.script_rewriters();
+    let ad_slots_script = config.ad_slots_script.clone();
+    let ad_bids_state = config.ad_bids_state.clone();
 
     let mut element_content_handlers = vec![
         // Inject unified tsjs bundle once at the start of <head>
@@ -238,9 +260,14 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
             let integrations = integration_registry.clone();
             let patterns = patterns.clone();
             let document_state = document_state.clone();
+            let ad_slots_script = ad_slots_script.clone();
             move |el| {
                 if !injected_tsjs.get() {
                     let mut snippet = String::new();
+                    // Inject ad slots script first so it appears before tsjs bundle.
+                    if let Some(ref slots_script) = ad_slots_script {
+                        snippet.push_str(slots_script);
+                    }
                     let ctx = IntegrationHtmlContext {
                         request_host: &patterns.request_host,
                         request_scheme: &patterns.request_scheme,
@@ -265,6 +292,36 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
                 Ok(())
             }
         }),
+        // Inject __ts_bids before </body> via end_tag_handlers.
+        // Guard with AtomicBool so the script is only injected once even if
+        // the origin HTML contains multiple <body> elements (e.g. template fragments).
+        element!("body", {
+            let state = ad_bids_state.clone();
+            let injected_bids = injected_bids.clone();
+            move |el| {
+                let state = state.clone();
+                let injected_bids = injected_bids.clone();
+                if let Some(handlers) = el.end_tag_handlers() {
+                    let handler: EndTagHandler<'static> = Box::new(
+                        move |end_tag: &mut EndTag<'_>| {
+                            if injected_bids.swap(true, Ordering::SeqCst) {
+                                return Ok(());
+                            }
+                            let script_guard = state.read().expect("should read bid state");
+                            let bids_script = match &*script_guard {
+                                Some(s) => s.clone(),
+                                None => r#"<script>window.__ts_bids=JSON.parse("{}");if(typeof window.__tsAdInit==="function")window.__tsAdInit();</script>"#
+                                    .to_string(),
+                            };
+                            end_tag.before(&bids_script, ContentType::Html);
+                            Ok(())
+                        },
+                    );
+                    handlers.push(handler);
+                }
+                Ok(())
+            }
+        }),
         // Replace URLs in href attributes
         element!("[href]", {
             let patterns = patterns.clone();
@@ -540,6 +597,8 @@ mod tests {
             request_host: "test.example.com".to_string(),
             request_scheme: "https".to_string(),
             integrations: IntegrationRegistry::default(),
+            ad_slots_script: None,
+            ad_bids_state: std::sync::Arc::new(std::sync::RwLock::new(None)),
         }
     }
 
@@ -1185,4 +1244,111 @@ mod tests {
             "should contain post-processor mutation"
         );
     }
+
+    #[test]
+    fn injects_ad_slots_at_head_open() {
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: Some(
+                r#"<script>window.__ts_ad_slots=JSON.parse("[]");</script>"#.to_string(),
+            ),
+            ad_bids_state: std::sync::Arc::new(std::sync::RwLock::new(None)),
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(
+                b"<html><head><title>T</title></head><body>content</body></html>",
+                true,
+            )
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            html.contains("window.__ts_ad_slots"),
+            "should inject ad slots at head-open"
+        );
+        assert!(
+            !html.contains("__ts_request_id"),
+            "must NOT inject request_id"
+        );
+    }
+
+    #[test]
+    fn injects_ts_bids_before_body_close() {
+        let bids_script =
+            r#"<script>window.__ts_bids=JSON.parse("{\"atf\":{\"hb_pb\":\"1.00\"}}");</script>"#;
+        let state = std::sync::Arc::new(std::sync::RwLock::new(Some(bids_script.to_string())));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: None,
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(b"<html><head></head><body>content</body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            html.contains("window.__ts_bids"),
+            "should inject bids before </body>"
+        );
+        let bids_pos = html
+            .find("window.__ts_bids")
+            .expect("bids should be in output");
+        let body_close_pos = html.find("</body>").expect("</body> should be in output");
+        assert!(bids_pos < body_close_pos, "bids must appear before </body>");
+    }
+
+    #[test]
+    fn injects_ts_bids_only_once_with_multiple_body_elements() {
+        let bids_script =
+            r#"<script>window.__ts_bids=JSON.parse("{\"atf\":{\"hb_pb\":\"1.00\"}}");</script>"#;
+        let state = std::sync::Arc::new(std::sync::RwLock::new(Some(bids_script.to_string())));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: None,
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        // Malformed HTML with two <body> elements (common in CMS template pages)
+        let output = processor
+            .process_chunk(b"<html><body><body>content</body></body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert_eq!(
+            html.matches("window.__ts_bids").count(),
+            1,
+            "should inject __ts_bids exactly once even with multiple <body> elements"
+        );
+    }
+
+    #[test]
+    fn injects_empty_ts_bids_when_state_is_none() {
+        let state = std::sync::Arc::new(std::sync::RwLock::new(None));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: None,
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(b"<html><head></head><body>content</body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            html.contains("__ts_bids=JSON.parse(\"{}\")"),
+            "should inject empty bids on None state"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index f4ce745db..3a42ec2a0 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -133,36 +133,21 @@ impl AdServerMockProvider {
                     .bids
                     .iter()
                     .map(|bid| {
-                        // Check if this is an APS bid with encoded price (inferred from amznbid in metadata)
-                        let encoded_price = bid
-                            .metadata
-                            .get("amznbid")
-                            .and_then(|v| v.as_str())
-                            .map(String::from);
-
-                        if encoded_price.is_some() {
-                            // APS bid - send encoded price for mediation to decode
-                            json!({
-                                "imp_id": bid.slot_id,
-                                "encoded_price": encoded_price,
-                                "adm": bid.creative,
-                                "w": bid.width,
-                                "h": bid.height,
-                                "crid": format!("{}-creative", bid.bidder),
-                                "adomain": bid.adomain,
-                            })
-                        } else {
-                            // Regular bid with decoded price
-                            json!({
-                                "imp_id": bid.slot_id,
-                                "price": bid.price,
-                                "adm": bid.creative,
-                                "w": bid.width,
-                                "h": bid.height,
-                                "crid": format!("{}-creative", bid.bidder),
-                                "adomain": bid.adomain,
-                            })
-                        }
+                        // Mocktioneer mediator always requires a numeric `price` field.
+                        // APS bids carry price as an opaque encoded string (`amznbid`)
+                        // that cannot be decoded client-side; use `bid.price` when set
+                        // (a real decoded value) or fall back to a mock floor price for
+                        // test/demo purposes.
+                        let price = bid.price.unwrap_or(1.50);
+                        json!({
+                            "imp_id": bid.slot_id,
+                            "price": price,
+                            "adm": bid.creative,
+                            "w": bid.width,
+                            "h": bid.height,
+                            "crid": format!("{}-creative", bid.bidder),
+                            "adomain": bid.adomain,
+                        })
                     })
                     .collect();
 
@@ -256,6 +241,7 @@ impl AdServerMockProvider {
                     }),
                     nurl: None,
                     burl: None,
+                    ad_id: None,
                     metadata: HashMap::new(),
                 });
             }
@@ -507,6 +493,7 @@ mod tests {
                     adomain: Some(vec!["amazon.com".to_string()]),
                     nurl: None,
                     burl: None,
+                    ad_id: None,
                     metadata: HashMap::new(),
                 }],
                 response_time_ms: 150,
@@ -526,6 +513,7 @@ mod tests {
                     adomain: None,
                     nurl: None,
                     burl: None,
+                    ad_id: None,
                     metadata: HashMap::new(),
                 }],
                 response_time_ms: 120,
@@ -666,6 +654,7 @@ mod tests {
                 adomain: Some(vec!["amazon.com".to_string()]),
                 nurl: None,
                 burl: None,
+                ad_id: None,
                 metadata: aps_metadata,
             }],
             response_time_ms: 100,
@@ -686,20 +675,15 @@ mod tests {
         let bid = &bidder_resp["bids"][0];
         assert_eq!(bid["imp_id"], "slot-1");
 
-        // Key assertions for APS-style encoded price bids:
-        // 1. Should NOT have "price" field (or it should be null)
-        assert!(
-            bid["price"].is_null(),
-            "APS bids should not have decoded price, got: {:?}",
-            bid["price"]
-        );
-        // 2. Should have "encoded_price" field
+        // APS bids have no decoded price (bid.price == None), so the mock floor
+        // price (1.50) is used.  Mocktioneer requires a numeric price field and
+        // does not accept an opaque encoded_price string.
         assert_eq!(
-            bid["encoded_price"].as_str(),
-            Some("encoded-price-value"),
-            "APS bids should have encoded_price from metadata"
+            bid["price"].as_f64(),
+            Some(1.50),
+            "APS bids with no decoded price should fall back to mock floor price 1.50"
         );
-        // 3. adm should be null (not a string)
+        // adm should be null (not a string)
         assert!(
             bid["adm"].is_null(),
             "Creative-less bids should have null adm, got: {:?}",
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index af66dd064..ba6c14bbd 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -286,24 +286,46 @@ impl IntegrationConfig for ApsConfig {
 /// Amazon APS auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
+    // Maps APS slot ID → creative opportunity slot ID for the in-flight request.
+    // Written by request_bids before the async send; read by parse_response when the
+    // response arrives. Safe because Fastly Compute runs each request in an isolated
+    // single-threaded Wasm instance — the Mutex never contends in practice.
+    slot_id_map: std::sync::Mutex<HashMap<String, String>>,
 }
 
 impl ApsAuctionProvider {
     /// Create a new APS auction provider.
     #[must_use]
     pub fn new(config: ApsConfig) -> Self {
-        Self { config }
+        Self {
+            config,
+            slot_id_map: std::sync::Mutex::new(HashMap::new()),
+        }
     }
 
     /// Convert unified `AuctionRequest` to APS TAM bid request format.
     ///
+    /// Returns the serialisable `ApsBidRequest` and a map of APS slot ID →
+    /// creative-opportunity slot ID so the caller can remap bids in the response.
     /// Populates consent fields (GDPR, US Privacy, GPP) from the
     /// [`ConsentContext`](crate::consent::ConsentContext) attached to the request.
-    fn to_aps_request(&self, request: &AuctionRequest) -> ApsBidRequest {
+    fn to_aps_request(&self, request: &AuctionRequest) -> (ApsBidRequest, HashMap<String, String>) {
+        let mut slot_id_map: HashMap<String, String> = HashMap::new();
         let slots: Vec<ApsSlot> = request
             .slots
             .iter()
             .map(|slot| {
+                // Use the APS-specific slot ID from [slot.providers.aps] if configured;
+                // fall back to the creative-opportunity slot ID otherwise.
+                let aps_slot_id = slot
+                    .bidders
+                    .get("aps")
+                    .and_then(|p| p.get("slotID"))
+                    .and_then(|v| v.as_str())
+                    .unwrap_or(&slot.id)
+                    .to_string();
+                slot_id_map.insert(aps_slot_id.clone(), slot.id.clone());
+
                 // Extract sizes from banner formats
                 let sizes: Vec<[u32; 2]> = slot
                     .formats
@@ -313,7 +335,7 @@ impl ApsAuctionProvider {
                     .collect();
 
                 ApsSlot {
-                    slot_id: slot.id.clone(),
+                    slot_id: aps_slot_id,
                     sizes,
                     slot_name: Some(slot.id.clone()),
                 }
@@ -337,7 +359,7 @@ impl ApsAuctionProvider {
             })
         });
 
-        ApsBidRequest {
+        let bid_request = ApsBidRequest {
             pub_id: self.config.pub_id.clone(),
             slots,
             page_url: request.publisher.page_url.clone(),
@@ -347,7 +369,8 @@ impl ApsAuctionProvider {
             us_privacy,
             gpp,
             gpp_sid,
-        }
+        };
+        (bid_request, slot_id_map)
     }
 
     /// Parse size string (e.g., "300x250") into width and height.
@@ -417,6 +440,7 @@ impl ApsAuctionProvider {
             height,
             nurl: None, // Real APS uses client-side event tracking
             burl: None,
+            ad_id: None,
             metadata,
         })
     }
@@ -432,9 +456,19 @@ impl ApsAuctionProvider {
                 aps_response.contextual.slots.len()
             );
 
+            let slot_map = self
+                .slot_id_map
+                .lock()
+                .expect("should lock APS slot id map");
             for slot in aps_response.contextual.slots {
                 match self.parse_aps_slot(&slot) {
-                    Ok(bid) => {
+                    Ok(mut bid) => {
+                        // Remap APS slot ID (e.g. "aps-slot-atf-sidebar") back to the
+                        // creative-opportunity slot ID (e.g. "atf_sidebar_ad") so the
+                        // mediator and bid_map can match by creative slot ID.
+                        if let Some(creative_id) = slot_map.get(&bid.slot_id) {
+                            bid.slot_id = creative_id.clone();
+                        }
                         let encoded_price = bid
                             .metadata
                             .get("amznbid")
@@ -484,8 +518,13 @@ impl AuctionProvider for ApsAuctionProvider {
             self.config.pub_id
         );
 
-        // Transform to APS format
-        let aps_request = self.to_aps_request(request);
+        // Transform to APS format; store the APS-slot-ID → creative-slot-ID map so
+        // parse_response can remap bids back to the creative opportunity slot ID.
+        let (aps_request, slot_id_map) = self.to_aps_request(request);
+        *self
+            .slot_id_map
+            .lock()
+            .expect("should lock APS slot id map") = slot_id_map;
 
         // Serialize to JSON
         let aps_json =
@@ -702,7 +741,7 @@ mod tests {
 
         let provider = ApsAuctionProvider::new(config);
         let auction_request = create_test_auction_request();
-        let aps_request = provider.to_aps_request(&auction_request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&auction_request);
 
         // Verify basic fields
         assert_eq!(aps_request.pub_id, "5128");
@@ -728,6 +767,83 @@ mod tests {
         assert_eq!(slot2.sizes[0], [300, 250]);
     }
 
+    #[test]
+    fn aps_slot_id_from_bidders_map_used_in_request_and_remapped_in_response() {
+        use serde_json::json;
+
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: default_endpoint(),
+            timeout_ms: 800,
+        };
+        let provider = ApsAuctionProvider::new(config);
+
+        let mut bidders = HashMap::new();
+        bidders.insert(
+            "aps".to_string(),
+            json!({ "slotID": "aps-slot-atf-sidebar" }),
+        );
+        let request = AuctionRequest {
+            id: "test".to_string(),
+            slots: vec![AdSlot {
+                id: "atf_sidebar_ad".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: None,
+                targeting: HashMap::new(),
+                bidders,
+            }],
+            publisher: PublisherInfo {
+                domain: "example.com".to_string(),
+                page_url: None,
+            },
+            user: UserInfo {
+                id: "user-1".to_string(),
+                fresh_id: "fresh-1".to_string(),
+                consent: None,
+            },
+            device: None,
+            site: None,
+            context: HashMap::new(),
+        };
+
+        let (aps_request, slot_id_map) = provider.to_aps_request(&request);
+        assert_eq!(
+            aps_request.slots[0].slot_id, "aps-slot-atf-sidebar",
+            "should send configured APS slot ID to APS"
+        );
+        assert_eq!(
+            slot_id_map.get("aps-slot-atf-sidebar").map(String::as_str),
+            Some("atf_sidebar_ad"),
+            "should build reverse map from APS slot ID to creative slot ID"
+        );
+
+        *provider.slot_id_map.lock().expect("should lock") = slot_id_map;
+
+        let aps_response = json!({
+            "contextual": {
+                "slots": [{
+                    "slotID": "aps-slot-atf-sidebar",
+                    "size": "300x250",
+                    "fif": "1",
+                    "amznbid": "1gtm3q",
+                    "meta": ["slotID"]
+                }]
+            }
+        });
+
+        let response = provider.parse_aps_response(&aps_response, 100);
+        assert_eq!(response.bids.len(), 1, "should parse one bid");
+        assert_eq!(
+            response.bids[0].slot_id, "atf_sidebar_ad",
+            "bid slot_id should be remapped to creative slot ID"
+        );
+    }
+
     #[test]
     fn test_aps_response_parsing_success() {
         let config = ApsConfig {
@@ -956,7 +1072,7 @@ mod tests {
             ..Default::default()
         });
 
-        let aps_request = provider.to_aps_request(&request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&request);
 
         // Verify GDPR consent
         let gdpr = aps_request.gdpr.expect("should have gdpr");
@@ -985,7 +1101,7 @@ mod tests {
         let provider = ApsAuctionProvider::new(config);
         let request = create_test_auction_request(); // consent is None
 
-        let aps_request = provider.to_aps_request(&request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&request);
 
         assert!(aps_request.gdpr.is_none());
         assert!(aps_request.us_privacy.is_none());
@@ -1012,7 +1128,7 @@ mod tests {
             ..Default::default()
         });
 
-        let aps_request = provider.to_aps_request(&request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&request);
         let json = serde_json::to_value(&aps_request).expect("should serialize");
 
         // GDPR fields present
diff --git a/crates/trusted-server-core/src/integrations/gpt.rs b/crates/trusted-server-core/src/integrations/gpt.rs
index 40bcf7f2c..796d633e1 100644
--- a/crates/trusted-server-core/src/integrations/gpt.rs
+++ b/crates/trusted-server-core/src/integrations/gpt.rs
@@ -438,13 +438,42 @@ impl IntegrationHeadInjector for GptIntegration {
     }
 
     fn head_inserts(&self, _ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
-        // Set the enable flag and best-effort call the activation function
-        // registered by the GPT shim module. The bundle also auto-installs
-        // when it sees the pre-set flag, so this works regardless of whether
-        // the inline bootstrap runs before or after the TSJS bundle.
         vec![
-            "<script>window.__tsjs_gpt_enabled=true;window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
+            "<script>window.__tsjs_gpt_enabled=true;\
+             window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
                 .to_string(),
+            concat!(
+                "<script>",
+                "window.__tsAdInit=function(){",
+                  "var slots=window.__ts_ad_slots||[];",
+                  "var bids=window.__ts_bids||{};",
+                  "googletag.cmd.push(function(){",
+                    "var gptSlots=slots.map(function(slot){",
+                      "var s=googletag.defineSlot(slot.gam_unit_path,slot.formats,slot.div_id);",
+                      "if(!s)return null;",
+                      "s.addService(googletag.pubads());",
+                      "Object.entries(slot.targeting||{}).forEach(function(e){s.setTargeting(e[0],e[1]);});",
+                      "var b=bids[slot.id]||{};",
+                      "[\"hb_pb\",\"hb_bidder\",\"hb_adid\"].forEach(function(k){if(b[k])s.setTargeting(k,b[k]);});",
+                      "s.setTargeting(\"ts_initial\",\"1\");",
+                      "return{id:slot.id,gptSlot:s};",
+                    "}).filter(Boolean);",
+                    "googletag.pubads().enableSingleRequest();",
+                    "googletag.enableServices();",
+                    "googletag.pubads().addEventListener(\"slotRenderEnded\",function(ev){",
+                      "var id=ev.slot.getSlotElementId();",
+                      "var b=bids[id]||{};",
+                      "var ourBidWon=!ev.isEmpty&&b.hb_adid&&ev.slot.getTargeting(\"hb_adid\")[0]===b.hb_adid;",
+                      "if(ourBidWon){",
+                        "if(b.nurl)navigator.sendBeacon(b.nurl);",
+                        "if(b.burl)navigator.sendBeacon(b.burl);",
+                      "}",
+                    "});",
+                    "googletag.pubads().refresh();",
+                  "});",
+                "};",
+                "</script>"
+            ).to_string(),
         ]
     }
 }
@@ -1020,7 +1049,7 @@ mod tests {
 
         let inserts = integration.head_inserts(&ctx);
 
-        assert_eq!(inserts.len(), 1, "should emit exactly one head insert");
+        assert_eq!(inserts.len(), 2, "should emit exactly two head inserts");
         assert_eq!(
             inserts[0],
             "<script>window.__tsjs_gpt_enabled=true;window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>",
@@ -1028,6 +1057,54 @@ mod tests {
         );
     }
 
+    #[test]
+    fn head_inserts_includes_ts_ad_init_with_synchronous_bids_read() {
+        let config = test_config();
+        let integration = GptIntegration::new(config);
+        let doc_state = IntegrationDocumentState::default();
+        let ctx = IntegrationHtmlContext {
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "example.com",
+            document_state: &doc_state,
+        };
+        let inserts = integration.head_inserts(&ctx);
+        let combined = inserts.join("");
+        assert!(combined.contains("__tsAdInit"), "should define __tsAdInit");
+        assert!(
+            combined.contains("window.__ts_bids"),
+            "should read window.__ts_bids synchronously"
+        );
+        assert!(
+            combined.contains("ts_initial"),
+            "should set ts_initial sentinel"
+        );
+        assert!(
+            combined.contains("slotRenderEnded"),
+            "should register slotRenderEnded"
+        );
+        assert!(
+            combined.contains("sendBeacon"),
+            "should fire nurl and burl via sendBeacon"
+        );
+        assert!(
+            combined.contains("nurl"),
+            "should fire nurl on confirmed render"
+        );
+        assert!(
+            !combined.contains("/ts-bids"),
+            "must NOT fetch /ts-bids — bids are inline on the page"
+        );
+        assert!(
+            !combined.contains("bidsPromise"),
+            "must NOT use bidsPromise — bids are synchronous"
+        );
+        assert!(
+            !combined.contains("__ts_request_id"),
+            "must NOT reference request_id — no longer used"
+        );
+    }
+
     #[test]
     fn head_injector_integration_id() {
         let integration = GptIntegration::new(test_config());
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 6dfd1ca1a..46b87cc0e 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -26,8 +26,8 @@ use crate::integrations::{
 };
 use crate::openrtb::{
     to_openrtb_i32, Banner, ConsentedProvidersSettings, Device, Format, Geo, Imp, ImpExt,
-    OpenRtbRequest, PrebidExt, PrebidImpExt, Publisher, Regs, RegsExt, RequestExt, Site, ToExt,
-    TrustedServerExt, User, UserExt,
+    ImpStoredRequest, OpenRtbRequest, PrebidExt, PrebidImpExt, Publisher, Regs, RegsExt,
+    RequestExt, Site, ToExt, TrustedServerExt, User, UserExt,
 };
 use crate::platform::RuntimeServices;
 use crate::request_signing::{RequestSigner, SigningParams, SIGNING_VERSION};
@@ -119,6 +119,10 @@ pub struct PrebidIntegrationConfig {
     /// - `both` — consent in both cookies and body (default)
     #[serde(default)]
     pub consent_forwarding: ConsentForwardingMode,
+    /// When true, suppresses client-side nurl firing.
+    /// Use for PBS deployments that fire nurl internally.
+    #[serde(default)]
+    pub suppress_nurl: bool,
 }
 
 impl IntegrationConfig for PrebidIntegrationConfig {
@@ -525,22 +529,27 @@ impl PrebidAuctionProvider {
                 // Build the bidder map for PBS.
                 // The JS adapter sends "trustedServer" as the bidder (our orchestrator
                 // adapter name). Replace it with the real PBS bidders from config.
-                // Pass through any other bidders with their params as-is.
+                // Only pass through keys that are known PBS bidders — skip provider-specific
+                // keys like "aps" which belong to their own separate auction provider.
                 let mut bidder: HashMap<String, Json> = HashMap::new();
                 for (name, params) in &slot.bidders {
                     if name == TRUSTED_SERVER_BIDDER {
                         bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
-                    } else {
+                    } else if self.config.bidders.iter().any(|b| b == name) {
                         bidder.insert(name.clone(), params.clone());
                     }
                 }
 
-                // Fallback to config bidders if none provided
-                if bidder.is_empty() {
-                    for b in &self.config.bidders {
-                        bidder.insert(b.clone(), Json::Object(serde_json::Map::new()));
-                    }
-                }
+                // When no inline PBS bidder params exist (e.g. creative-opportunity slots
+                // whose PBS params live in stored requests), tell PBS to resolve bidder
+                // config from the stored request keyed by this slot ID.
+                let storedrequest = if bidder.is_empty() {
+                    Some(ImpStoredRequest {
+                        id: slot.id.clone(),
+                    })
+                } else {
+                    None
+                };
 
                 // Apply zone-specific bid param overrides when configured.
                 for (name, params) in &mut bidder {
@@ -578,7 +587,10 @@ impl PrebidAuctionProvider {
                     secure: Some(true), // require HTTPS creatives
                     tagid: Some(slot.id.clone()),
                     ext: ImpExt {
-                        prebid: PrebidImpExt { bidder },
+                        prebid: PrebidImpExt {
+                            bidder,
+                            storedrequest,
+                        },
                     }
                     .to_ext(),
                     ..Default::default()
@@ -966,6 +978,12 @@ impl PrebidAuctionProvider {
             .and_then(|v| v.as_str())
             .map(std::string::ToString::to_string);
 
+        let ad_id = bid_obj
+            .get("adid")
+            .or_else(|| bid_obj.get("id"))
+            .and_then(|v| v.as_str())
+            .map(String::from);
+
         let adomain = bid_obj
             .get("adomain")
             .and_then(|v| v.as_array())
@@ -986,6 +1004,7 @@ impl PrebidAuctionProvider {
             height,
             nurl,
             burl,
+            ad_id,
             metadata: std::collections::HashMap::new(),
         })
     }
@@ -1258,9 +1277,16 @@ mod tests {
             client_side_bidders: Vec::new(),
             bid_param_zone_overrides: HashMap::new(),
             consent_forwarding: ConsentForwardingMode::Both,
+            suppress_nurl: false,
         }
     }
 
+    #[test]
+    fn prebid_config_suppress_nurl_defaults_to_false() {
+        let config = base_config();
+        assert!(!config.suppress_nurl, "should not suppress nurl by default");
+    }
+
     fn create_test_auction_request() -> AuctionRequest {
         AuctionRequest {
             id: "auction-123".to_string(),
@@ -3026,4 +3052,90 @@ fixed_bottom = {placementId = "_s2sBottom"}
         assert_eq!(statuses[0]["bidder"], "kargo");
         assert_eq!(statuses[1]["status"], "timeout");
     }
+
+    // ========================================================================
+    // PBS stored request tests
+    // ========================================================================
+
+    #[test]
+    fn to_openrtb_uses_stored_request_when_slot_has_no_pbs_bidder_params() {
+        // Slot only has "aps" provider — not a PBS bidder
+        let slot = make_slot(
+            "atf_sidebar_ad",
+            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(base_config(), &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert!(
+            prebid.get("bidder").is_none(),
+            "should not send inline bidder params when using stored request"
+        );
+        assert_eq!(
+            prebid["storedrequest"]["id"], "atf_sidebar_ad",
+            "should use slot id as stored request id"
+        );
+    }
+
+    #[test]
+    fn to_openrtb_uses_stored_request_when_slot_has_empty_bidders() {
+        let slot = make_slot("homepage_header_ad", HashMap::new());
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(base_config(), &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert_eq!(
+            prebid["storedrequest"]["id"], "homepage_header_ad",
+            "should use slot id as stored request id for slot with no bidder map"
+        );
+    }
+
+    #[test]
+    fn to_openrtb_uses_inline_bidder_params_not_stored_request_for_trusted_server_slots() {
+        let mut config = base_config();
+        config.bidders = vec!["kargo".to_string()];
+
+        let slot = make_ts_slot(
+            "in_content_ad",
+            &json!({ "kargo": { "placementId": "client_123" } }),
+            None,
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(config, &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert!(
+            prebid.get("storedrequest").is_none(),
+            "should not use stored request when inline bidder params are present"
+        );
+        assert_eq!(
+            prebid["bidder"]["kargo"]["placementId"], "client_123",
+            "should use inline bidder params from trustedServer expansion"
+        );
+    }
+
+    #[test]
+    fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
+        let slot = make_slot(
+            "atf_sidebar_ad",
+            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(base_config(), &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert!(
+            prebid.get("bidder").is_none(),
+            "should not forward aps key into PBS imp.ext.prebid.bidder"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index 8b55493be..ffad78921 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -853,6 +853,14 @@ impl IntegrationRegistry {
             .collect()
     }
 
+    #[cfg(test)]
+    #[must_use]
+    pub fn empty_for_tests() -> Self {
+        Self {
+            inner: Arc::new(IntegrationRegistryInner::default()),
+        }
+    }
+
     #[cfg(test)]
     #[must_use]
     pub fn from_rewriters(
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 44fa108dd..4e5ef76bb 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -40,6 +40,7 @@ pub mod consent_config;
 pub mod constants;
 pub mod cookies;
 pub mod creative;
+pub mod creative_opportunities;
 pub mod edge_cookie;
 pub mod error;
 pub mod geo;
@@ -50,6 +51,7 @@ pub mod integrations;
 pub mod models;
 pub mod openrtb;
 pub mod platform;
+pub mod price_bucket;
 pub mod proxy;
 pub mod publisher;
 pub mod redacted;
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index 3c9be932e..eca5e70f5 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -162,9 +162,21 @@ pub struct ImpExt {
 
 impl ToExt for ImpExt {}
 
-#[derive(Debug, Serialize)]
+#[derive(Debug, Default, Serialize)]
 pub struct PrebidImpExt {
+    #[serde(skip_serializing_if = "std::collections::HashMap::is_empty")]
     pub bidder: std::collections::HashMap<String, Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub storedrequest: Option<ImpStoredRequest>,
+}
+
+/// PBS imp-level stored request reference.
+///
+/// PBS merges the stored imp JSON (keyed by `id`) into the outgoing request,
+/// populating bidder params that are not sent inline.
+#[derive(Debug, Serialize)]
+pub struct ImpStoredRequest {
+    pub id: String,
 }
 
 #[derive(Debug, Serialize)]
diff --git a/crates/trusted-server-core/src/price_bucket.rs b/crates/trusted-server-core/src/price_bucket.rs
new file mode 100644
index 000000000..b683020bf
--- /dev/null
+++ b/crates/trusted-server-core/src/price_bucket.rs
@@ -0,0 +1,128 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum PriceGranularity {
+    Low,
+    Medium,
+    #[default]
+    Dense,
+    High,
+    Auto,
+}
+
+impl PriceGranularity {
+    #[must_use]
+    pub fn dense() -> Self {
+        Self::Dense
+    }
+}
+
+#[must_use]
+pub fn price_bucket(cpm: f64, granularity: PriceGranularity) -> String {
+    if cpm <= 0.0 {
+        return "0.00".to_string();
+    }
+    match granularity {
+        PriceGranularity::Low => {
+            let capped = cpm.min(5.0);
+            let cents = (capped * 100.0).floor() as u64;
+            let bucketed_cents = (cents / 50) * 50;
+            format!("{:.2}", bucketed_cents as f64 / 100.0)
+        }
+        PriceGranularity::Medium => {
+            let capped = cpm.min(20.0);
+            let cents = (capped * 100.0).floor() as u64;
+            let bucketed_cents = (cents / 10) * 10;
+            format!("{:.2}", bucketed_cents as f64 / 100.0)
+        }
+        PriceGranularity::High => {
+            let capped = cpm.min(20.0);
+            let cents = (capped * 100.0).floor() as u64;
+            format!("{:.2}", cents as f64 / 100.0)
+        }
+        PriceGranularity::Dense | PriceGranularity::Auto => dense_bucket(cpm),
+    }
+}
+
+fn dense_bucket(cpm: f64) -> String {
+    if cpm >= 20.0 {
+        return "20.00".to_string();
+    }
+    if cpm >= 8.0 {
+        let cents = (cpm * 100.0).floor() as u64;
+        let bucketed_cents = (cents / 50) * 50;
+        return format!("{:.2}", bucketed_cents as f64 / 100.0);
+    }
+    if cpm >= 3.0 {
+        let cents = (cpm * 100.0).floor() as u64;
+        let bucketed_cents = (cents / 5) * 5;
+        return format!("{:.2}", bucketed_cents as f64 / 100.0);
+    }
+    let cents = (cpm * 100.0).floor() as u64;
+    format!("{:.2}", cents as f64 / 100.0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn dense_below_3_increments_by_0_01() {
+        assert_eq!(price_bucket(0.0, PriceGranularity::Dense), "0.00");
+        assert_eq!(price_bucket(0.01, PriceGranularity::Dense), "0.01");
+        assert_eq!(price_bucket(0.015, PriceGranularity::Dense), "0.01");
+        assert_eq!(price_bucket(1.23, PriceGranularity::Dense), "1.23");
+        assert_eq!(price_bucket(2.99, PriceGranularity::Dense), "2.99");
+    }
+
+    #[test]
+    fn dense_3_to_8_increments_by_0_05() {
+        assert_eq!(price_bucket(3.00, PriceGranularity::Dense), "3.00");
+        assert_eq!(price_bucket(3.03, PriceGranularity::Dense), "3.00");
+        assert_eq!(price_bucket(3.05, PriceGranularity::Dense), "3.05");
+        assert_eq!(price_bucket(7.99, PriceGranularity::Dense), "7.95");
+    }
+
+    #[test]
+    fn dense_8_to_20_increments_by_0_50() {
+        assert_eq!(price_bucket(8.00, PriceGranularity::Dense), "8.00");
+        assert_eq!(price_bucket(8.49, PriceGranularity::Dense), "8.00");
+        assert_eq!(price_bucket(8.50, PriceGranularity::Dense), "8.50");
+        assert_eq!(price_bucket(19.99, PriceGranularity::Dense), "19.50");
+    }
+
+    #[test]
+    fn dense_above_20_caps_at_20() {
+        assert_eq!(price_bucket(20.00, PriceGranularity::Dense), "20.00");
+        assert_eq!(price_bucket(50.00, PriceGranularity::Dense), "20.00");
+    }
+
+    #[test]
+    fn low_increments_by_0_50_capped_at_5() {
+        assert_eq!(price_bucket(0.49, PriceGranularity::Low), "0.00");
+        assert_eq!(price_bucket(0.50, PriceGranularity::Low), "0.50");
+        assert_eq!(price_bucket(5.01, PriceGranularity::Low), "5.00");
+    }
+
+    #[test]
+    fn medium_increments_by_0_10_capped_at_20() {
+        assert_eq!(price_bucket(1.05, PriceGranularity::Medium), "1.00");
+        assert_eq!(price_bucket(1.10, PriceGranularity::Medium), "1.10");
+        assert_eq!(price_bucket(20.5, PriceGranularity::Medium), "20.00");
+    }
+
+    #[test]
+    fn high_increments_by_0_01_capped_at_20() {
+        assert_eq!(price_bucket(1.234, PriceGranularity::High), "1.23");
+        assert_eq!(price_bucket(20.5, PriceGranularity::High), "20.00");
+    }
+
+    #[test]
+    fn auto_routes_through_dense() {
+        assert_eq!(
+            price_bucket(2.53, PriceGranularity::Auto),
+            price_bucket(2.53, PriceGranularity::Dense)
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 5bcef6941..c7744ed2e 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -12,11 +12,16 @@
 //! content-rewriting concern.
 
 use std::io::Write;
+use std::sync::{Arc, RwLock};
 
 use error_stack::{Report, ResultExt};
 use fastly::http::{header, StatusCode};
 use fastly::{Body, Request, Response};
 
+use crate::auction::orchestrator::AuctionOrchestrator;
+use crate::auction::types::{
+    AuctionContext, AuctionRequest, Bid, PublisherInfo, SiteInfo, UserInfo,
+};
 use crate::backend::BackendConfig;
 use crate::consent::{allows_ec_creation, build_consent_context, ConsentPipelineInput};
 use crate::constants::{COOKIE_TS_EC, HEADER_X_COMPRESS_HINT, HEADER_X_TS_EC};
@@ -26,6 +31,7 @@ use crate::error::TrustedServerError;
 use crate::http_util::{serve_static_with_etag, RequestInfo};
 use crate::integrations::IntegrationRegistry;
 use crate::platform::RuntimeServices;
+use crate::price_bucket::price_bucket;
 use crate::rsc_flight::RscFlightUrlRewriter;
 use crate::settings::Settings;
 use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
@@ -182,6 +188,8 @@ struct ProcessResponseParams<'a> {
     settings: &'a Settings,
     content_type: &'a str,
     integration_registry: &'a IntegrationRegistry,
+    ad_slots_script: Option<&'a str>,
+    ad_bids_state: &'a Arc<RwLock<Option<String>>>,
 }
 
 /// Process response body through the streaming pipeline.
@@ -224,6 +232,8 @@ fn process_response_streaming<W: Write>(
             params.request_scheme,
             params.settings,
             params.integration_registry,
+            params.ad_slots_script.map(str::to_string),
+            params.ad_bids_state.clone(),
         )?;
         StreamingPipeline::new(config, processor).process(body, output)?;
     } else if is_rsc_flight {
@@ -252,18 +262,21 @@ fn create_html_stream_processor(
     origin_host: &str,
     request_host: &str,
     request_scheme: &str,
-    settings: &Settings,
+    _settings: &Settings,
     integration_registry: &IntegrationRegistry,
+    ad_slots_script: Option<String>,
+    ad_bids_state: Arc<RwLock<Option<String>>>,
 ) -> Result<impl StreamProcessor, Report<TrustedServerError>> {
     use crate::html_processor::{create_html_processor, HtmlProcessorConfig};
 
-    let config = HtmlProcessorConfig::from_settings(
-        settings,
-        integration_registry,
-        origin_host,
-        request_host,
-        request_scheme,
-    );
+    let config = HtmlProcessorConfig {
+        origin_host: origin_host.to_string(),
+        request_host: request_host.to_string(),
+        request_scheme: request_scheme.to_string(),
+        integrations: integration_registry.clone(),
+        ad_slots_script,
+        ad_bids_state,
+    };
 
     Ok(create_html_processor(config))
 }
@@ -392,6 +405,8 @@ pub struct OwnedProcessResponseParams {
     pub(crate) request_host: String,
     pub(crate) request_scheme: String,
     pub(crate) content_type: String,
+    pub(crate) ad_slots_script: Option<String>,
+    pub(crate) ad_bids_state: Arc<RwLock<Option<String>>>,
 }
 
 /// Stream the publisher response body through the processing pipeline.
@@ -420,6 +435,8 @@ pub fn stream_publisher_body<W: Write>(
         settings,
         content_type: &params.content_type,
         integration_registry,
+        ad_slots_script: params.ad_slots_script.as_deref(),
+        ad_bids_state: &params.ad_bids_state,
     };
     process_response_streaming(body, output, &borrowed)
 }
@@ -441,10 +458,18 @@ pub fn stream_publisher_body<W: Write>(
 ///
 /// Returns a [`TrustedServerError`] if the proxy request fails or the
 /// origin backend is unreachable.
-pub fn handle_publisher_request(
+///
+/// # Panics
+///
+/// Panics if `should_run_auction` is `true` but `settings.creative_opportunities` is `None`.
+/// This is a logic invariant: `should_run_auction` is only set when creative opportunities
+/// are configured, so this state is unreachable in practice.
+pub async fn handle_publisher_request(
     settings: &Settings,
     integration_registry: &IntegrationRegistry,
     services: &RuntimeServices,
+    orchestrator: &AuctionOrchestrator,
+    slots_file: &crate::creative_opportunities::CreativeOpportunitiesFile,
     mut req: Request,
 ) -> Result<PublisherResponse, Report<TrustedServerError>> {
     log::debug!("Proxying request to publisher_origin");
@@ -520,14 +545,111 @@ pub fn handle_publisher_request(
         backend_name,
         settings.publisher.origin_url
     );
+
+    let request_path = req.get_path().to_string();
+    let is_get = req.get_method() == fastly::http::Method::GET;
+
+    let is_prefetch = req
+        .get_header_str("sec-purpose")
+        .is_some_and(|v| v.contains("prefetch"))
+        || req
+            .get_header_str("purpose")
+            .is_some_and(|v| v.contains("prefetch"));
+
+    let user_agent = req.get_header_str("user-agent").unwrap_or("");
+    let is_bot = ["Googlebot", "Bingbot", "AhrefsBot", "SemrushBot", "DotBot"]
+        .iter()
+        .any(|bot| user_agent.contains(bot));
+
+    let matched_slots: Vec<_> = if settings.creative_opportunities.is_some() && is_get {
+        crate::creative_opportunities::match_slots(&slots_file.slots, &request_path)
+            .into_iter()
+            .cloned()
+            .collect()
+    } else {
+        Vec::new()
+    };
+
+    let consent_allows_auction = consent_context
+        .tcf
+        .as_ref()
+        .is_some_and(|tcf| tcf.has_purpose_consent(1));
+
+    let should_run_auction =
+        is_get && !is_prefetch && !is_bot && !matched_slots.is_empty() && consent_allows_auction;
+
+    let auction_timeout_ms = settings
+        .creative_opportunities
+        .as_ref()
+        .and_then(|co| co.auction_timeout_ms)
+        .unwrap_or(settings.auction.timeout_ms);
+
+    let ad_bids_state: Arc<RwLock<Option<String>>> = Arc::new(RwLock::new(None));
+
     // Only advertise encodings the rewrite pipeline can decode and re-encode.
     restrict_accept_encoding(&mut req);
     req.set_header("host", &origin_host);
 
-    let mut response = req
-        .send(&backend_name)
+    let pending_origin =
+        req.send_async(&backend_name)
+            .change_context(TrustedServerError::Proxy {
+                message: "Failed to dispatch async origin request".to_string(),
+            })?;
+
+    let auction_result = if should_run_auction {
+        let co_config = settings
+            .creative_opportunities
+            .as_ref()
+            .expect("should be present when should_run_auction is true");
+        let auction_request = build_auction_request(
+            &matched_slots,
+            &ec_id,
+            &consent_context,
+            &request_info,
+            co_config,
+        );
+        let placeholder_req = fastly::Request::get("https://placeholder.invalid/");
+        let auction_context = AuctionContext {
+            settings,
+            request: &placeholder_req,
+            client_info: services.client_info(),
+            timeout_ms: auction_timeout_ms,
+            provider_responses: None,
+            services,
+        };
+        match orchestrator
+            .run_auction(&auction_request, &auction_context, services)
+            .await
+        {
+            Ok(result) => Some(result),
+            Err(e) => {
+                log::warn!("server-side auction failed, proceeding without bids: {e:?}");
+                None
+            }
+        }
+    } else {
+        None
+    };
+
+    if should_run_auction {
+        let co_config = settings
+            .creative_opportunities
+            .as_ref()
+            .expect("should be present");
+        let empty: std::collections::HashMap<String, Bid> = std::collections::HashMap::new();
+        let winning_bids = auction_result
+            .as_ref()
+            .map(|r| &r.winning_bids)
+            .unwrap_or(&empty);
+        let bid_map = build_bid_map(winning_bids, co_config.price_granularity);
+        let bids_script = build_bids_script(&bid_map);
+        *ad_bids_state.write().expect("should write bid state") = Some(bids_script);
+    }
+
+    let mut response = pending_origin
+        .wait()
         .change_context(TrustedServerError::Proxy {
-            message: "Failed to proxy request to origin".to_string(),
+            message: "Failed to await origin response".to_string(),
         })?;
 
     log::debug!("Response headers:");
@@ -535,6 +657,22 @@ pub fn handle_publisher_request(
         log::debug!("  {}: {:?}", name, value);
     }
 
+    let ad_slots_script = if let Some(co_config) = &settings.creative_opportunities {
+        if !matched_slots.is_empty() {
+            Some(build_ad_slots_script(&matched_slots, co_config))
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+
+    if ad_slots_script.is_some() {
+        response.set_header(header::CACHE_CONTROL, "private, no-store");
+        response.remove_header("surrogate-control");
+        response.remove_header("fastly-surrogate-control");
+    }
+
     // Set EC ID / cookie headers BEFORE body processing.
     // These are body-independent (computed from request cookies + consent).
     apply_ec_headers(
@@ -623,6 +761,8 @@ pub fn handle_publisher_request(
                     request_host: request_host.to_string(),
                     request_scheme: request_scheme.to_string(),
                     content_type,
+                    ad_slots_script: ad_slots_script.clone(),
+                    ad_bids_state: ad_bids_state.clone(),
                 },
             })
         }
@@ -642,6 +782,8 @@ pub fn handle_publisher_request(
                 settings,
                 content_type: &content_type,
                 integration_registry,
+                ad_slots_script: ad_slots_script.as_deref(),
+                ad_bids_state: &ad_bids_state,
             };
             let mut output = Vec::new();
             process_response_streaming(body, &mut output, &params)?;
@@ -654,6 +796,138 @@ pub fn handle_publisher_request(
     }
 }
 
+/// Build an [`AuctionRequest`] from matched creative opportunity slots.
+pub(crate) fn build_auction_request(
+    matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+    ec_id: &str,
+    consent_context: &crate::consent::ConsentContext,
+    request_info: &crate::http_util::RequestInfo,
+    co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+) -> AuctionRequest {
+    let slots = matched_slots
+        .iter()
+        .map(|s| s.to_ad_slot(&co_config.gam_network_id))
+        .collect();
+    AuctionRequest {
+        id: format!("ts-{}", ec_id),
+        slots,
+        publisher: PublisherInfo {
+            domain: request_info.host.clone(),
+            page_url: None,
+        },
+        user: UserInfo {
+            id: ec_id.to_string(),
+            fresh_id: ec_id.to_string(),
+            consent: Some(consent_context.clone()),
+        },
+        device: None,
+        site: Some(SiteInfo {
+            domain: request_info.host.clone(),
+            page: String::new(),
+        }),
+        context: std::collections::HashMap::new(),
+    }
+}
+
+/// Escape a JSON string so it is safe to embed inside a JS double-quoted string literal.
+///
+/// Backslashes are doubled first (so they survive the next pass), then
+/// double-quotes are escaped so they do not terminate the JS string.
+/// The result is always valid to write as `JSON.parse("…")`.
+fn html_escape_for_script(s: &str) -> String {
+    s.replace('\\', "\\\\").replace('"', "\\\"")
+}
+
+/// Build a price-bucketed bid map from winning bids.
+///
+/// Returns a JSON object map of slot ID → bid metadata including the bucketed
+/// CPM (`hb_pb`), bidder (`hb_bidder`), and optional ad ID, nurl, and burl.
+pub(crate) fn build_bid_map(
+    winning_bids: &std::collections::HashMap<String, Bid>,
+    granularity: crate::price_bucket::PriceGranularity,
+) -> serde_json::Map<String, serde_json::Value> {
+    winning_bids
+        .iter()
+        .filter_map(|(slot_id, bid)| {
+            bid.price.map(|cpm| {
+                let bucket = price_bucket(cpm, granularity);
+                let mut obj = serde_json::Map::new();
+                obj.insert("hb_pb".to_string(), serde_json::Value::String(bucket));
+                obj.insert(
+                    "hb_bidder".to_string(),
+                    serde_json::Value::String(bid.bidder.clone()),
+                );
+                if let Some(ref ad_id) = bid.ad_id {
+                    obj.insert(
+                        "hb_adid".to_string(),
+                        serde_json::Value::String(ad_id.clone()),
+                    );
+                }
+                if let Some(ref nurl) = bid.nurl {
+                    obj.insert("nurl".to_string(), serde_json::Value::String(nurl.clone()));
+                }
+                if let Some(ref burl) = bid.burl {
+                    obj.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
+                }
+                (slot_id.clone(), serde_json::Value::Object(obj))
+            })
+        })
+        .collect()
+}
+
+/// Build the `__ts_bids` `<script>` tag from a bucketed bid map.
+///
+/// The JSON is embedded via `JSON.parse(…)` so the browser parser never sees
+/// raw `</script>` sequences inside the string.
+pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Value>) -> String {
+    let json = serde_json::to_string(bid_map).unwrap_or_else(|_| "{}".to_string());
+    let escaped = html_escape_for_script(&json);
+    format!(
+        "<script>window.__ts_bids=JSON.parse(\"{}\");if(typeof window.__tsAdInit===\"function\")window.__tsAdInit();</script>",
+        escaped
+    )
+}
+
+/// Build the `__ts_ad_slots` `<script>` tag from matched slots.
+///
+/// Property names match what the client-side TSJS bundle expects:
+/// `gam_unit_path`, `div_id`, `formats`, and `targeting`.
+pub(crate) fn build_ad_slots_script(
+    matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+    co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+) -> String {
+    let slots: Vec<serde_json::Value> = matched_slots
+        .iter()
+        .map(|slot| {
+            let gam_path = slot.resolved_gam_unit_path(&co_config.gam_network_id);
+            let div_id = slot.resolved_div_id();
+            let formats: Vec<serde_json::Value> = slot
+                .formats
+                .iter()
+                .map(|f| serde_json::json!([f.width, f.height]))
+                .collect();
+            let targeting: serde_json::Map<String, serde_json::Value> = slot
+                .targeting
+                .iter()
+                .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                .collect();
+            serde_json::json!({
+                "id": slot.id,
+                "gam_unit_path": gam_path,
+                "div_id": div_id,
+                "formats": formats,
+                "targeting": targeting,
+            })
+        })
+        .collect();
+    let json = serde_json::to_string(&slots).unwrap_or_else(|_| "[]".to_string());
+    let escaped = html_escape_for_script(&json);
+    format!(
+        "<script>window.__ts_ad_slots=JSON.parse(\"{}\");</script>",
+        escaped
+    )
+}
+
 /// Whether the content type requires processing (URL rewriting, HTML injection).
 ///
 /// Text-based and JavaScript/JSON responses are processable; binary types
@@ -1366,6 +1640,8 @@ mod tests {
             request_host: "proxy.example.com".to_string(),
             request_scheme: "https".to_string(),
             content_type: "text/css".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(RwLock::new(None)),
         };
 
         let mut output = Vec::new();
@@ -1407,6 +1683,8 @@ mod tests {
             request_host: "proxy.example.com".to_string(),
             request_scheme: "https".to_string(),
             content_type: "text/html; charset=utf-8".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(RwLock::new(None)),
         };
 
         let mut output = Vec::new();
@@ -1439,6 +1717,8 @@ mod tests {
             request_host: "proxy.example.com".to_string(),
             request_scheme: "https".to_string(),
             content_type: "text/html".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(RwLock::new(None)),
         };
 
         let bogus_body = Body::from(b"<html>not gzip</html>".to_vec());
@@ -1538,6 +1818,8 @@ mod tests {
             request_host: "proxy.example.com".to_string(),
             request_scheme: "https".to_string(),
             content_type: "text/html; charset=utf-8".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(RwLock::new(None)),
         };
         let mut output = Vec::new();
         stream_publisher_body(body, &mut output, &params, &settings, &registry)
@@ -1588,6 +1870,8 @@ mod tests {
             request_host: "proxy.example.com".to_string(),
             request_scheme: "https".to_string(),
             content_type: "text/html".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(RwLock::new(None)),
         };
 
         let mut output = Vec::new();
@@ -1614,4 +1898,204 @@ mod tests {
             "origin host must not leak. Got: {processed}"
         );
     }
+
+    #[cfg(test)]
+    mod creative_opportunities_tests {
+        use super::super::{
+            build_ad_slots_script, build_bid_map, build_bids_script, html_escape_for_script,
+        };
+        use crate::auction::types::{Bid, MediaType};
+        use crate::creative_opportunities::{
+            CreativeOpportunitiesConfig, CreativeOpportunityFormat, CreativeOpportunitySlot,
+        };
+        use crate::price_bucket::PriceGranularity;
+        use std::collections::HashMap;
+
+        fn make_config() -> CreativeOpportunitiesConfig {
+            CreativeOpportunitiesConfig {
+                gam_network_id: "21765378893".to_string(),
+                auction_timeout_ms: Some(500),
+                price_granularity: PriceGranularity::Dense,
+            }
+        }
+
+        fn make_slot() -> CreativeOpportunitySlot {
+            CreativeOpportunitySlot {
+                id: "atf_sidebar_ad".to_string(),
+                gam_unit_path: Some("/21765378893/publisher/atf-sidebar".to_string()),
+                div_id: Some("div-atf-sidebar".to_string()),
+                page_patterns: vec!["/20**".to_string()],
+                formats: vec![CreativeOpportunityFormat {
+                    width: 300,
+                    height: 250,
+                    media_type: MediaType::Banner,
+                }],
+                floor_price: Some(0.50),
+                targeting: [("pos".to_string(), "atf".to_string())]
+                    .into_iter()
+                    .collect(),
+                providers: Default::default(),
+            }
+        }
+
+        fn make_bid(
+            slot_id: &str,
+            price: f64,
+            bidder: &str,
+            ad_id: &str,
+            nurl: &str,
+            burl: &str,
+        ) -> Bid {
+            Bid {
+                slot_id: slot_id.to_string(),
+                price: Some(price),
+                currency: "USD".to_string(),
+                creative: None,
+                adomain: None,
+                bidder: bidder.to_string(),
+                width: 300,
+                height: 250,
+                nurl: Some(nurl.to_string()),
+                burl: Some(burl.to_string()),
+                ad_id: Some(ad_id.to_string()),
+                metadata: Default::default(),
+            }
+        }
+
+        #[test]
+        fn ad_slots_script_contains_slot_data() {
+            let slots = vec![make_slot()];
+            let config = make_config();
+            let script = build_ad_slots_script(&slots, &config);
+            assert!(
+                script.contains("window.__ts_ad_slots=JSON.parse"),
+                "should use JSON.parse"
+            );
+            assert!(script.contains("atf_sidebar_ad"), "should include slot id");
+            assert!(!script.contains("__ts_bids"), "must NOT contain bids");
+            assert!(
+                !script.contains("__ts_request_id"),
+                "must NOT contain request_id"
+            );
+        }
+
+        #[test]
+        fn ad_slots_script_is_xss_safe() {
+            let slots = vec![make_slot()];
+            let config = make_config();
+            let script = build_ad_slots_script(&slots, &config);
+            let inner = script
+                .trim_start_matches("<script>")
+                .trim_end_matches("</script>");
+            assert!(!inner.contains('<'), "no unescaped < in script content");
+            assert!(!inner.contains('>'), "no unescaped > in script content");
+        }
+
+        #[test]
+        fn bid_map_includes_nurl_and_burl() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                make_bid(
+                    "atf_sidebar_ad",
+                    1.50,
+                    "kargo",
+                    "abc123",
+                    "https://ssp/win",
+                    "https://ssp/bill",
+                ),
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+            let entry = map.get("atf_sidebar_ad").expect("should have bid entry");
+            let obj = entry.as_object().expect("should be object");
+            assert_eq!(
+                obj.get("hb_pb").and_then(|v| v.as_str()),
+                Some("1.50"),
+                "should bucket price with dense granularity"
+            );
+            assert_eq!(
+                obj.get("hb_bidder").and_then(|v| v.as_str()),
+                Some("kargo"),
+                "should include bidder"
+            );
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("abc123"),
+                "should include ad_id"
+            );
+            assert_eq!(
+                obj.get("nurl").and_then(|v| v.as_str()),
+                Some("https://ssp/win"),
+                "should include nurl"
+            );
+            assert_eq!(
+                obj.get("burl").and_then(|v| v.as_str()),
+                Some("https://ssp/bill"),
+                "should include burl"
+            );
+        }
+
+        #[test]
+        fn bid_map_excludes_slot_when_price_is_none() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "no-price-slot".to_string(),
+                Bid {
+                    slot_id: "no-price-slot".to_string(),
+                    price: None,
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "kargo".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    ad_id: None,
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+            assert!(
+                map.is_empty(),
+                "slot with no price should be excluded from bid map"
+            );
+        }
+
+        #[test]
+        fn bids_script_is_xss_safe() {
+            let mut map = serde_json::Map::new();
+            map.insert("atf".to_string(), serde_json::json!({"hb_pb": "1.00"}));
+            let script = build_bids_script(&map);
+            let inner = script
+                .trim_start_matches("<script>")
+                .trim_end_matches("</script>");
+            assert!(!inner.contains('<'), "no unescaped < in bids script");
+            assert!(!inner.contains('>'), "no unescaped > in bids script");
+        }
+
+        #[test]
+        fn html_escape_encodes_special_chars() {
+            assert_eq!(
+                html_escape_for_script("text\\with\\backslash"),
+                "text\\\\with\\\\backslash",
+                "should escape backslashes"
+            );
+            assert_eq!(
+                html_escape_for_script("string\"with\"quotes"),
+                "string\\\"with\\\"quotes",
+                "should escape quotes"
+            );
+            assert_eq!(
+                html_escape_for_script("simple"),
+                "simple",
+                "should not change simple text"
+            );
+            assert_eq!(
+                html_escape_for_script("both\\\"mixed"),
+                "both\\\\\\\"mixed",
+                "should escape both backslashes and quotes"
+            );
+        }
+    }
 }
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 785492620..517c09550 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -11,6 +11,7 @@ use validator::{Validate, ValidationError};
 
 use crate::auction_config_types::AuctionConfig;
 use crate::consent_config::ConsentConfig;
+use crate::creative_opportunities::CreativeOpportunitiesConfig;
 use crate::error::TrustedServerError;
 use crate::redacted::Redacted;
 
@@ -423,6 +424,8 @@ pub struct Settings {
     pub consent: ConsentConfig,
     #[serde(default)]
     pub proxy: Proxy,
+    #[serde(default)]
+    pub creative_opportunities: Option<CreativeOpportunitiesConfig>,
 }
 
 #[allow(unused)]
@@ -1920,6 +1923,32 @@ mod tests {
     ///
     /// If this test fails, a route was added or removed in the Fastly
     /// router without updating `ADMIN_ENDPOINTS` (or vice versa).
+    #[test]
+    fn settings_parses_creative_opportunities_section() {
+        let toml = r#"
+[[handlers]]
+path = "^/admin"
+username = "admin"
+password = "changeme"
+
+[publisher]
+domain = "example.com"
+cookie_domain = ".example.com"
+origin_url = "https://origin.example.com"
+proxy_secret = "secret"
+
+[creative_opportunities]
+gam_network_id = "21765378893"
+auction_timeout_ms = 500
+"#;
+        let settings = Settings::from_toml(toml).expect("should parse");
+        let co = settings
+            .creative_opportunities
+            .expect("should have creative_opportunities");
+        assert_eq!(co.gam_network_id, "21765378893");
+        assert_eq!(co.auction_timeout_ms, Some(500));
+    }
+
     #[test]
     fn admin_endpoints_match_fastly_router() {
         let router_source = include_str!("../../trusted-server-adapter-fastly/src/main.rs");
diff --git a/creative-opportunities.toml b/creative-opportunities.toml
new file mode 100644
index 000000000..3cd27f2b1
--- /dev/null
+++ b/creative-opportunities.toml
@@ -0,0 +1,40 @@
+# Slot templates for server-side ad auction.
+# Empty file = feature disabled (no auction fired, no globals injected).
+
+[[slot]]
+id = "atf_sidebar_ad"
+gam_unit_path = "/88059007/autoblog/news"
+div_id = "ad-atf_sidebar-0-_r_2_"
+page_patterns = ["/20**", "/news/**"]
+formats = [{ width = 300, height = 250 }]
+floor_price = 0.50
+
+[slot.targeting]
+pos = "atf"
+zone = "atfSidebar"
+
+[slot.providers.aps]
+slot_id = "aps-slot-atf-sidebar"
+
+[slot.providers.pbs.bidders]
+mocktioneer = { bid = 2.00 }
+criteo = { networkId = 123456, pubid = "123456" }
+
+[[slot]]
+id = "homepage_header_ad"
+gam_unit_path = "/88059007/autoblog/homepage"
+div_id = "ad-header-0-_R_jpalubtak5lb_"
+page_patterns = ["/"]
+formats = [{ width = 970, height = 90 }, { width = 728, height = 90 }, { width = 970, height = 250 }]
+floor_price = 0.50
+
+[slot.targeting]
+pos = "atf"
+zone = "header"
+
+[slot.providers.aps]
+slot_id = "aps-slot-homepage-header"
+
+[slot.providers.pbs.bidders]
+mocktioneer = { bid = 2.00 }
+criteo = { networkId = 123456, pubid = "123456" }
diff --git a/docs/superpowers/plans/2026-04-30-server-side-ad-templates.md b/docs/superpowers/plans/2026-04-30-server-side-ad-templates.md
new file mode 100644
index 000000000..0429bd9ac
--- /dev/null
+++ b/docs/superpowers/plans/2026-04-30-server-side-ad-templates.md
@@ -0,0 +1,2004 @@
+# Server-Side Ad Templates Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Enable the Fastly edge to fire a full header-bidding auction (PBS + APS) in parallel with the origin fetch, inject `window.__ts_ad_slots` into `<head>`, then inject `window.__ts_bids` inline before `</body>` so the client drives GPT directly — without Prebid.js and without blocking FCP.
+
+**Architecture:** A new `creative-opportunities.toml` holds per-URL slot templates. At request time the publisher path matches the URL and fires the auction + origin fetch concurrently via `send_async()`. `window.__ts_ad_slots` is injected at `<head>` open with no auction wait. The `</body>` close tag is held — bounded by `A_deadline` — until the auction completes or times out; `window.__ts_bids` is then injected inline before the close tag so bids and HTML travel together in a single response. The client's `__tsAdInit` reads `window.__ts_bids` synchronously (no fetch, no Promise) and drives GPT. Both `nurl` and `burl` fire client-side from `slotRenderEnded` to avoid billing inflation. A slim-Prebid bundle lazy-loads post-`window.load` for refresh auctions and identity warm-up.
+
+**Tech Stack:** Rust 2024, `lol_html` 2.7.2 (existing), `glob` crate (new workspace dep), `serde`/`toml` (existing), `std::sync::{Arc, RwLock}` for within-request shared auction state, `AuctionOrchestrator::run_auction` (existing `async fn`), TypeScript for GPT shim extension.
+
+> **Phase 1 streaming note:** The spec describes true streaming where body content above `</body>` paints before the auction completes. Implementing this with lol_html's synchronous callback model requires a complex outer streaming loop (emit chunks as they arrive from origin; hold only the `</body>` chunk until auction resolves). Phase 1 uses a simpler approach: await the auction (or `A_deadline`) before processing origin HTML through lol_html, then send the fully assembled response. This still delivers the server-side auction benefit and achieves the same ad-visible latency target (~870ms cache hit). The FCP claim (~80ms) of the spec requires the streaming approach and is tracked as a Phase 2 optimization. The shared `Arc<RwLock<Option<String>>>` is the correct coordination primitive either way — the Phase 2 upgrade path only changes when the auction is awaited relative to lol_html processing.
+
+---
+
+## File Map
+
+### New files
+
+| File                                                       | Responsibility                                                                              |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `creative-opportunities.toml`                              | Slot template definitions (page patterns, formats, floor prices, per-provider params)       |
+| `crates/trusted-server-core/src/creative_opportunities.rs` | Config types, TOML parsing, URL glob matching, slot→`AdSlot` conversion, startup validation |
+| `crates/trusted-server-core/src/price_bucket.rs`           | Prebid price granularity tables; converts `f64` CPM to `hb_pb` string                       |
+
+### Modified files
+
+| File                                                    | Change summary                                                                                                                                                                                                       |
+| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Cargo.toml`                                            | Add `glob = "0.3"` to `[workspace.dependencies]`                                                                                                                                                                     |
+| `crates/trusted-server-core/Cargo.toml`                 | Add `glob = { workspace = true }`                                                                                                                                                                                    |
+| `crates/trusted-server-core/Cargo.toml` (build-deps)    | Verify `regex` is listed under `[build-dependencies]` (needed for slot-ID validation in `build.rs`)                                                                                                                  |
+| `crates/trusted-server-core/src/auction/types.rs`       | Add `MediaType::banner()` constructor; add `ad_id: Option<String>` to `Bid`                                                                                                                                          |
+| `crates/trusted-server-core/src/settings.rs`            | Add `creative_opportunities: Option<CreativeOpportunitiesConfig>` to `Settings`                                                                                                                                      |
+| `trusted-server.toml`                                   | Add `[creative_opportunities]` section                                                                                                                                                                               |
+| `crates/trusted-server-core/build.rs`                   | Validate slot IDs at build time using inline TOML parse; `rerun-if-changed` for `creative-opportunities.toml`                                                                                                        |
+| `crates/trusted-server-core/src/html_processor.rs`      | Add `ad_slots_script: Option<String>` (head) and `ad_bids_script: Arc<RwLock<Option<String>>>` (body) to `HtmlProcessorConfig`; inject at `<head>` open and via `el.on_end_tag()` on body element                    |
+| `crates/trusted-server-core/src/publisher.rs`           | Convert to `async fn`; add eligibility gates (bot UA, prefetch, HEAD); EID decoration; shared `AuctionBidState`; inject `__ts_bids` before `</body>`; `Cache-Control: private, max-age=0`; strip `Surrogate-Control` |
+| `crates/trusted-server-adapter-fastly/src/main.rs`      | Await the now-async handler; pass orchestrator reference; no `/ts-bids` route                                                                                                                                        |
+| `crates/trusted-server-core/src/integrations/gpt.rs`    | Extend `head_inserts()` to emit `__tsAdInit` that reads `window.__ts_bids` synchronously; `ts_initial=1` sentinel; nurl+burl from `slotRenderEnded`                                                                  |
+| `crates/js/lib/src/integrations/gpt/index.ts`           | Synchronous `__tsAdInit` with `window.__ts_bids` read; nurl+burl `sendBeacon`; lazy slim-Prebid loader post-`window.load`                                                                                            |
+| `crates/trusted-server-core/src/integrations/prebid.rs` | Add `suppress_nurl: bool` config (default `false`) as per-bidder escape hatch; remove server-side nurl firing                                                                                                        |
+
+### Deleted (relative to prior revision of this spec)
+
+- `crates/trusted-server-core/src/bid_cache.rs` — never created; in-process cache rejected because Fastly Compute per-request Wasm isolates are not pinned across requests
+- `/ts-bids` endpoint — never created; body-injection replaces the fetch pattern
+
+---
+
+## Task 1: Add `glob` workspace dependency
+
+**Files:**
+
+- Modify: `Cargo.toml`
+- Modify: `crates/trusted-server-core/Cargo.toml`
+
+- [ ] **Step 1: Write a failing compile test**
+
+  In `crates/trusted-server-core/src/lib.rs`, temporarily add:
+
+  ```rust
+  // Compilation test — remove after Step 4
+  use glob::Pattern as _;
+  ```
+
+  Run: `cargo check --package trusted-server-core`
+  Expected: error `use of undeclared crate or module 'glob'`
+
+- [ ] **Step 2: Add glob to workspace `Cargo.toml`**
+
+  Under `[workspace.dependencies]`, add:
+
+  ```toml
+  glob = "0.3"
+  ```
+
+- [ ] **Step 3: Add glob to core crate**
+
+  In `crates/trusted-server-core/Cargo.toml` under `[dependencies]`, add:
+
+  ```toml
+  glob = { workspace = true }
+  ```
+
+- [ ] **Step 4: Remove temp import, verify compile**
+
+  Remove the temp `use glob::Pattern as _;` from `lib.rs`.
+  Run: `cargo check --package trusted-server-core`
+  Expected: clean compile
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add Cargo.toml crates/trusted-server-core/Cargo.toml
+  git commit -m "Add glob workspace dependency for URL pattern matching"
+  ```
+
+---
+
+## Task 2: `price_bucket.rs` — Prebid price granularity
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/price_bucket.rs`
+- Modify: `crates/trusted-server-core/src/lib.rs`
+
+The `hb_pb` value in bid responses is a discretized bucket string from Prebid's granularity tables. "Dense" is the default used in most Prebid deployments.
+
+- [ ] **Step 1: Write failing tests**
+
+  Create `crates/trusted-server-core/src/price_bucket.rs` with only the tests:
+
+  ```rust
+  #[cfg(test)]
+  mod tests {
+      use super::*;
+
+      #[test]
+      fn dense_below_3_increments_by_0_01() {
+          assert_eq!(price_bucket(0.0, PriceGranularity::Dense), "0.00");
+          assert_eq!(price_bucket(0.01, PriceGranularity::Dense), "0.01");
+          assert_eq!(price_bucket(0.015, PriceGranularity::Dense), "0.01");
+          assert_eq!(price_bucket(1.23, PriceGranularity::Dense), "1.23");
+          assert_eq!(price_bucket(2.99, PriceGranularity::Dense), "2.99");
+      }
+
+      #[test]
+      fn dense_3_to_8_increments_by_0_05() {
+          assert_eq!(price_bucket(3.00, PriceGranularity::Dense), "3.00");
+          assert_eq!(price_bucket(3.03, PriceGranularity::Dense), "3.00");
+          assert_eq!(price_bucket(3.05, PriceGranularity::Dense), "3.05");
+          assert_eq!(price_bucket(7.99, PriceGranularity::Dense), "7.95");
+      }
+
+      #[test]
+      fn dense_8_to_20_increments_by_0_50() {
+          assert_eq!(price_bucket(8.00, PriceGranularity::Dense), "8.00");
+          assert_eq!(price_bucket(8.49, PriceGranularity::Dense), "8.00");
+          assert_eq!(price_bucket(8.50, PriceGranularity::Dense), "8.50");
+          assert_eq!(price_bucket(19.99, PriceGranularity::Dense), "19.50");
+      }
+
+      #[test]
+      fn dense_above_20_caps_at_20() {
+          assert_eq!(price_bucket(20.00, PriceGranularity::Dense), "20.00");
+          assert_eq!(price_bucket(50.00, PriceGranularity::Dense), "20.00");
+      }
+
+      #[test]
+      fn low_increments_by_0_50_capped_at_5() {
+          assert_eq!(price_bucket(0.49, PriceGranularity::Low), "0.00");
+          assert_eq!(price_bucket(0.50, PriceGranularity::Low), "0.50");
+          assert_eq!(price_bucket(5.01, PriceGranularity::Low), "5.00");
+      }
+
+      #[test]
+      fn medium_increments_by_0_10_capped_at_20() {
+          assert_eq!(price_bucket(1.05, PriceGranularity::Medium), "1.00");
+          assert_eq!(price_bucket(1.10, PriceGranularity::Medium), "1.10");
+          assert_eq!(price_bucket(20.5, PriceGranularity::Medium), "20.00");
+      }
+
+      #[test]
+      fn high_increments_by_0_01_capped_at_20() {
+          assert_eq!(price_bucket(1.234, PriceGranularity::High), "1.23");
+          assert_eq!(price_bucket(20.5, PriceGranularity::High), "20.00");
+      }
+
+      #[test]
+      fn auto_routes_through_dense() {
+          assert_eq!(
+              price_bucket(2.53, PriceGranularity::Auto),
+              price_bucket(2.53, PriceGranularity::Dense)
+          );
+      }
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core price_bucket`
+  Expected: compile error (module not yet exported from lib.rs)
+
+- [ ] **Step 2: Implement price_bucket.rs**
+
+  ```rust
+  use serde::{Deserialize, Serialize};
+
+  #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+  #[serde(rename_all = "lowercase")]
+  pub enum PriceGranularity {
+      Low,
+      Medium,
+      #[default]
+      Dense,
+      High,
+      Auto,
+  }
+
+  impl PriceGranularity {
+      pub fn dense() -> Self {
+          Self::Dense
+      }
+  }
+
+  pub fn price_bucket(cpm: f64, granularity: PriceGranularity) -> String {
+      if cpm <= 0.0 {
+          return "0.00".to_string();
+      }
+      match granularity {
+          PriceGranularity::Low => {
+              let capped = cpm.min(5.0);
+              format!("{:.2}", (capped / 0.50).floor() * 0.50)
+          }
+          PriceGranularity::Medium => {
+              let capped = cpm.min(20.0);
+              format!("{:.2}", (capped / 0.10).floor() * 0.10)
+          }
+          PriceGranularity::High => {
+              let capped = cpm.min(20.0);
+              format!("{:.2}", (capped / 0.01).floor() * 0.01)
+          }
+          PriceGranularity::Dense | PriceGranularity::Auto => dense_bucket(cpm),
+      }
+  }
+
+  fn dense_bucket(cpm: f64) -> String {
+      if cpm >= 20.0 {
+          return "20.00".to_string();
+      }
+      if cpm >= 8.0 {
+          return format!("{:.2}", (cpm / 0.50).floor() * 0.50);
+      }
+      if cpm >= 3.0 {
+          return format!("{:.2}", (cpm / 0.05).floor() * 0.05);
+      }
+      format!("{:.2}", (cpm / 0.01).floor() * 0.01)
+  }
+  ```
+
+- [ ] **Step 3: Export from lib.rs**
+
+  ```rust
+  pub mod price_bucket;
+  ```
+
+- [ ] **Step 4: Run tests**
+
+  Run: `cargo test -p trusted-server-core price_bucket`
+  Expected: all tests pass
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/price_bucket.rs \
+          crates/trusted-server-core/src/lib.rs
+  git commit -m "Add Prebid price granularity bucketing (dense default, auto = dense)"
+  ```
+
+---
+
+## Task 3: Extend `auction::types` — `MediaType::banner()` and `Bid::ad_id`
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs`
+- Modify: `crates/trusted-server-core/src/integrations/prebid.rs`
+
+`CreativeOpportunityFormat` uses `#[serde(default = "MediaType::banner")]` which requires a free function. Add `ad_id: Option<String>` to `Bid` for `hb_adid` targeting. The `suppress_nurl` config escape hatch is also added here to `PrebidConfig`.
+
+- [ ] **Step 1: Write failing tests**
+
+  In `auction/types.rs` test module:
+
+  ```rust
+  #[test]
+  fn media_type_banner_fn_returns_banner() {
+      assert_eq!(MediaType::banner(), MediaType::Banner);
+  }
+
+  #[test]
+  fn bid_has_ad_id_field() {
+      let bid = Bid {
+          slot_id: "s".to_string(),
+          price: Some(1.0),
+          currency: "USD".to_string(),
+          creative: None,
+          adomain: None,
+          bidder: "kargo".to_string(),
+          width: 300,
+          height: 250,
+          nurl: None,
+          burl: None,
+          ad_id: Some("prebid-ad-id-abc".to_string()),
+          metadata: Default::default(),
+      };
+      assert_eq!(bid.ad_id.as_deref(), Some("prebid-ad-id-abc"));
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core auction::types::tests`
+  Expected: compile error (`MediaType::banner` not found, `ad_id` field missing)
+
+- [ ] **Step 2: Add `MediaType::banner()` and `Bid::ad_id`**
+
+  In `auction/types.rs`, add to `MediaType`:
+
+  ```rust
+  impl MediaType {
+      pub fn banner() -> Self {
+          Self::Banner
+      }
+  }
+  ```
+
+  Add `ad_id: Option<String>` field to `Bid`. Update the `make_bid` test helper to include `ad_id: None`.
+
+- [ ] **Step 3: Run tests**
+
+  Run: `cargo test -p trusted-server-core auction`
+  Expected: all tests pass
+
+- [ ] **Step 4: Populate `ad_id` in prebid.rs**
+
+  In `crates/trusted-server-core/src/integrations/prebid.rs`, in the `Bid` construction, find where `nurl` and `burl` are set and add:
+
+  ```rust
+  ad_id: bid_obj.get("adid")
+      .or_else(|| bid_obj.get("id"))
+      .and_then(|v| v.as_str())
+      .map(String::from),
+  ```
+
+  (Prebid Server uses lowercase `adid`. Fall back to `id` if absent.)
+
+- [ ] **Step 5: Add `suppress_nurl` to `PrebidConfig`**
+
+  In `prebid.rs`, add to the `PrebidConfig` struct:
+
+  ```rust
+  #[serde(default)]
+  pub suppress_nurl: bool,
+  ```
+
+  Write a test:
+
+  ```rust
+  #[test]
+  fn prebid_config_suppress_nurl_defaults_to_false() {
+      let config = PrebidConfig::default();
+      assert!(!config.suppress_nurl, "should not suppress nurl by default");
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core integrations::prebid`
+  Expected: passes
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/auction/types.rs \
+          crates/trusted-server-core/src/integrations/prebid.rs
+  git commit -m "Add MediaType::banner(), Bid::ad_id, and suppress_nurl config to PrebidConfig"
+  ```
+
+---
+
+## Task 4: `creative_opportunities.rs` — Config types and URL matching
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/creative_opportunities.rs`
+- Modify: `crates/trusted-server-core/src/lib.rs`
+
+- [ ] **Step 1: Write failing tests**
+
+  Create `crates/trusted-server-core/src/creative_opportunities.rs` with only tests:
+
+  ```rust
+  #[cfg(test)]
+  mod tests {
+      use super::*;
+
+      fn make_slot(id: &str, patterns: Vec<&str>) -> CreativeOpportunitySlot {
+          CreativeOpportunitySlot {
+              id: id.to_string(),
+              gam_unit_path: None,
+              div_id: None,
+              page_patterns: patterns.into_iter().map(String::from).collect(),
+              formats: vec![CreativeOpportunityFormat {
+                  width: 300,
+                  height: 250,
+                  media_type: crate::auction::types::MediaType::Banner,
+              }],
+              floor_price: Some(0.50),
+              targeting: Default::default(),
+              providers: Default::default(),
+          }
+      }
+
+      #[test]
+      fn glob_matches_article_path() {
+          let slot = make_slot("atf", vec!["/20**"]);
+          assert!(slot.matches_path("/2024/01/my-article/"), "should match article path");
+          assert!(!slot.matches_path("/"), "should not match root");
+      }
+
+      #[test]
+      fn exact_match_homepage() {
+          let slot = make_slot("home", vec!["/"]);
+          assert!(slot.matches_path("/"), "should match root");
+          assert!(!slot.matches_path("/about"), "should not match /about");
+      }
+
+      #[test]
+      fn slot_id_validates_alphanumeric() {
+          assert!(validate_slot_id("atf_sidebar_ad").is_ok());
+          assert!(validate_slot_id("below-content-0").is_ok());
+          assert!(validate_slot_id("").is_err(), "empty id should fail");
+          assert!(validate_slot_id("xss<script>").is_err(), "html in id should fail");
+          assert!(validate_slot_id("has space").is_err(), "spaces should fail");
+      }
+
+      #[test]
+      fn resolved_gam_unit_path_uses_default_when_absent() {
+          let slot = make_slot("atf", vec!["/"]);
+          assert_eq!(slot.resolved_gam_unit_path("21765378893"), "/21765378893/atf");
+      }
+
+      #[test]
+      fn resolved_gam_unit_path_uses_override_when_set() {
+          let mut slot = make_slot("atf", vec!["/"]);
+          slot.gam_unit_path = Some("/21765378893/publisher/atf-sidebar".to_string());
+          assert_eq!(
+              slot.resolved_gam_unit_path("21765378893"),
+              "/21765378893/publisher/atf-sidebar"
+          );
+      }
+
+      #[test]
+      fn resolved_div_id_defaults_to_slot_id() {
+          let slot = make_slot("atf", vec!["/"]);
+          assert_eq!(slot.resolved_div_id(), "atf");
+      }
+
+      #[test]
+      fn to_ad_slot_wires_aps_params_into_bidders() {
+          let mut slot = make_slot("atf", vec!["/"]);
+          slot.providers.aps = Some(ApsSlotParams { slot_id: "aps-slot-atf".to_string() });
+          let ad_slot = slot.to_ad_slot("21765378893");
+          let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
+          assert_eq!(
+              aps_params.get("slotID").and_then(|v| v.as_str()),
+              Some("aps-slot-atf"),
+          );
+      }
+
+      #[test]
+      fn to_ad_slot_sets_floor_price_and_formats() {
+          let slot = make_slot("atf", vec!["/"]);
+          let ad_slot = slot.to_ad_slot("21765378893");
+          assert_eq!(ad_slot.id, "atf");
+          assert_eq!(ad_slot.floor_price, Some(0.50));
+          assert_eq!(ad_slot.formats.len(), 1);
+      }
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core creative_opportunities`
+  Expected: compile error (module not yet exported)
+
+- [ ] **Step 2: Implement creative_opportunities.rs**
+
+  ```rust
+  use std::collections::HashMap;
+
+  use glob::Pattern;
+  use serde::{Deserialize, Serialize};
+
+  use crate::auction::types::{AdFormat, AdSlot, MediaType};
+  use crate::price_bucket::PriceGranularity;
+
+  #[derive(Debug, Clone, Deserialize, Serialize)]
+  pub struct CreativeOpportunitiesConfig {
+      pub gam_network_id: String,
+      #[serde(default)]
+      pub auction_timeout_ms: Option<u32>,
+      #[serde(default = "PriceGranularity::dense")]
+      pub price_granularity: PriceGranularity,
+  }
+
+  #[derive(Debug, Clone, Deserialize)]
+  pub struct CreativeOpportunitySlot {
+      pub id: String,
+      pub gam_unit_path: Option<String>,
+      pub div_id: Option<String>,
+      pub page_patterns: Vec<String>,
+      pub formats: Vec<CreativeOpportunityFormat>,
+      pub floor_price: Option<f64>,
+      #[serde(default)]
+      pub targeting: HashMap<String, String>,
+      #[serde(default)]
+      pub providers: SlotProviders,
+  }
+
+  impl CreativeOpportunitySlot {
+      pub fn matches_path(&self, path: &str) -> bool {
+          self.page_patterns.iter().any(|pattern| {
+              Pattern::new(pattern)
+                  .map(|p| p.matches(path))
+                  .unwrap_or(false)
+          })
+      }
+
+      pub fn resolved_gam_unit_path(&self, gam_network_id: &str) -> String {
+          self.gam_unit_path
+              .clone()
+              .unwrap_or_else(|| format!("/{}/{}", gam_network_id, self.id))
+      }
+
+      pub fn resolved_div_id(&self) -> &str {
+          self.div_id.as_deref().unwrap_or(&self.id)
+      }
+
+      pub fn to_ad_slot(&self, gam_network_id: &str) -> AdSlot {
+          let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
+          if let Some(ref aps) = self.providers.aps {
+              bidders.insert("aps".to_string(), serde_json::json!({ "slotID": aps.slot_id }));
+          }
+          AdSlot {
+              id: self.id.clone(),
+              formats: self.formats.iter().map(CreativeOpportunityFormat::to_ad_format).collect(),
+              floor_price: self.floor_price,
+              targeting: self.targeting.iter()
+                  .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                  .collect(),
+              bidders,
+          }
+      }
+  }
+
+  #[derive(Debug, Clone, Deserialize)]
+  pub struct CreativeOpportunityFormat {
+      pub width: u32,
+      pub height: u32,
+      #[serde(default = "MediaType::banner")]
+      pub media_type: MediaType,
+  }
+
+  impl CreativeOpportunityFormat {
+      fn to_ad_format(&self) -> AdFormat {
+          AdFormat { media_type: self.media_type.clone(), width: self.width, height: self.height }
+      }
+  }
+
+  #[derive(Debug, Clone, Default, Deserialize)]
+  pub struct SlotProviders {
+      pub aps: Option<ApsSlotParams>,
+  }
+
+  #[derive(Debug, Clone, Deserialize)]
+  pub struct ApsSlotParams {
+      pub slot_id: String,
+  }
+
+  #[derive(Debug, Clone, Deserialize, Default)]
+  pub struct CreativeOpportunitiesFile {
+      #[serde(rename = "slot", default)]
+      pub slots: Vec<CreativeOpportunitySlot>,
+  }
+
+  pub fn validate_slot_id(id: &str) -> Result<(), String> {
+      if id.is_empty() {
+          return Err("slot id must not be empty".to_string());
+      }
+      if id.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-') {
+          Ok(())
+      } else {
+          Err(format!("slot id '{id}' contains invalid characters; only [A-Za-z0-9_-] allowed"))
+      }
+  }
+
+  pub fn match_slots<'a>(
+      slots: &'a [CreativeOpportunitySlot],
+      path: &str,
+  ) -> Vec<&'a CreativeOpportunitySlot> {
+      slots.iter().filter(|s| s.matches_path(path)).collect()
+  }
+  ```
+
+- [ ] **Step 3: Export from lib.rs**
+
+  ```rust
+  pub mod creative_opportunities;
+  ```
+
+- [ ] **Step 4: Run tests**
+
+  Run: `cargo test -p trusted-server-core creative_opportunities`
+  Expected: all tests pass
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/creative_opportunities.rs \
+          crates/trusted-server-core/src/lib.rs
+  git commit -m "Add creative_opportunities config types, URL glob matching, APS params wiring"
+  ```
+
+---
+
+## Task 5: Settings integration and `creative-opportunities.toml`
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs`
+- Create: `creative-opportunities.toml`
+- Modify: `trusted-server.toml`
+
+- [ ] **Step 1: Write failing test**
+
+  In `settings.rs` test module:
+
+  ```rust
+  #[test]
+  fn settings_parses_creative_opportunities_section() {
+      let toml = r#"
+  [publisher]
+  domain = "example.com"
+  cookie_domain = ".example.com"
+  origin_url = "https://origin.example.com"
+  proxy_secret = "secret"
+
+  [creative_opportunities]
+  gam_network_id = "21765378893"
+  auction_timeout_ms = 500
+  "#;
+      let settings = Settings::from_toml(toml).expect("should parse");
+      let co = settings.creative_opportunities.expect("should have creative_opportunities");
+      assert_eq!(co.gam_network_id, "21765378893");
+      assert_eq!(co.auction_timeout_ms, Some(500));
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core settings_parses_creative_opportunities`
+  Expected: compile error (`Settings` has no field `creative_opportunities`)
+
+- [ ] **Step 2: Add to `Settings`**
+
+  In `settings.rs`, add import:
+
+  ```rust
+  use crate::creative_opportunities::CreativeOpportunitiesConfig;
+  ```
+
+  In the `Settings` struct:
+
+  ```rust
+  #[serde(default)]
+  pub creative_opportunities: Option<CreativeOpportunitiesConfig>,
+  ```
+
+- [ ] **Step 3: Run test**
+
+  Run: `cargo test -p trusted-server-core settings_parses_creative_opportunities`
+  Expected: passes
+
+- [ ] **Step 4: Create `creative-opportunities.toml`**
+
+  At repo root alongside `trusted-server.toml`:
+
+  ```toml
+  # Slot templates for server-side ad auction.
+  # Empty file = feature disabled (no auction fired, no globals injected).
+
+  [[slot]]
+  id = "atf_sidebar_ad"
+  gam_unit_path = "/21765378893/publisher/atf-sidebar"
+  div_id = "div-atf-sidebar"
+  page_patterns = ["/20**"]
+  formats = [{ width = 300, height = 250 }]
+  floor_price = 0.50
+
+  [slot.targeting]
+  pos = "atf"
+  zone = "atfSidebar"
+
+  [slot.providers.aps]
+  slot_id = "aps-slot-atf-sidebar"
+  ```
+
+- [ ] **Step 5: Add `[creative_opportunities]` to `trusted-server.toml`**
+
+  ```toml
+  [creative_opportunities]
+  gam_network_id = "21765378893"
+  auction_timeout_ms = 500
+  price_granularity = "dense"
+  ```
+
+- [ ] **Step 6: Run full workspace tests**
+
+  Run: `cargo test --workspace`
+  Expected: all pass
+
+- [ ] **Step 7: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/settings.rs \
+          creative-opportunities.toml \
+          trusted-server.toml
+  git commit -m "Wire CreativeOpportunitiesConfig into Settings; add creative-opportunities.toml"
+  ```
+
+---
+
+## Task 6: Build-time slot-ID validation
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/build.rs`
+- Modify (or create): `crates/trusted-server-adapter-fastly/build.rs`
+
+- [ ] **Step 1: Add slot-ID validation to `build.rs`**
+
+  In `crates/trusted-server-core/build.rs`, add after the existing settings validation.
+
+  > **Note:** `build.rs` runs in a separate compilation context and cannot import `creative_opportunities::validate_slot_id`. Reimplement the same `[A-Za-z0-9_-]+` check inline using the `regex` crate (build-dependency only — not in the wasm binary). This is an intentional duplication boundary.
+
+  ```rust
+  const CREATIVE_OPPORTUNITIES_PATH: &str = "../../creative-opportunities.toml";
+
+  println!("cargo:rerun-if-changed={}", CREATIVE_OPPORTUNITIES_PATH);
+
+  let co_path = std::path::Path::new(CREATIVE_OPPORTUNITIES_PATH);
+  if co_path.exists() {
+      let co_content = std::fs::read_to_string(co_path)
+          .expect("should read creative-opportunities.toml");
+      let co_value: toml::Value = toml::from_str(&co_content)
+          .expect("creative-opportunities.toml: invalid TOML");
+      let slot_id_re = regex::Regex::new(r"^[A-Za-z0-9_\-]+$").expect("should compile");
+      if let Some(slots) = co_value.get("slot").and_then(|v| v.as_array()) {
+          for slot in slots {
+              let id = slot.get("id")
+                  .and_then(|v| v.as_str())
+                  .expect("creative-opportunities.toml: slot missing 'id' field");
+              if !slot_id_re.is_match(id) {
+                  panic!(
+                      "creative-opportunities.toml: slot id '{}' is invalid; \
+                       only [A-Za-z0-9_-] allowed",
+                      id
+                  );
+              }
+          }
+          println!(
+              "cargo:warning=creative-opportunities.toml: {} slot(s) validated",
+              slots.len()
+          );
+      }
+  }
+  ```
+
+- [ ] **Step 2: Verify `regex` is in build-dependencies**
+
+  In `crates/trusted-server-core/Cargo.toml`, under `[build-dependencies]`, ensure `regex` is listed:
+
+  ```toml
+  [build-dependencies]
+  regex = "1"
+  # ... other build deps
+  ```
+
+  Add if absent. This is a build-only dependency — does not enter the WASM binary.
+
+- [ ] **Step 3: Run build to verify**
+
+  Run: `cargo build --package trusted-server-core`
+  Expected: builds, warning `creative-opportunities.toml: 1 slot(s) validated`
+
+- [ ] **Step 4: Test the guard**
+
+  Temporarily add to `creative-opportunities.toml`:
+
+  ```toml
+  [[slot]]
+  id = "bad slot!"
+  page_patterns = ["/"]
+  formats = []
+  ```
+
+  Run: `cargo build --package trusted-server-core`
+  Expected: panics with invalid slot ID message. Revert the change.
+
+- [ ] **Step 5: Add `rerun-if-changed` for adapter crate**
+
+  Check whether `crates/trusted-server-adapter-fastly/build.rs` exists. If it does, add:
+
+  ```rust
+  println!("cargo:rerun-if-changed=../../../creative-opportunities.toml");
+  ```
+
+  If no `build.rs` exists in the adapter crate, create one:
+
+  ```rust
+  fn main() {
+      println!("cargo:rerun-if-changed=../../../creative-opportunities.toml");
+  }
+  ```
+
+  Run: `cargo build --package trusted-server-adapter-fastly`
+  Expected: clean build.
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/build.rs \
+          crates/trusted-server-adapter-fastly/build.rs
+  git commit -m "Validate creative-opportunities.toml slot IDs at build time using inline TOML parse"
+  ```
+
+---
+
+## Task 7: HTML processor — head injection and body-end injection
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/html_processor.rs`
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs`
+
+TS injects two `<script>` blocks:
+
+1. `window.__ts_ad_slots` — at `<head>` open, no wait, via existing `el.prepend()`.
+2. `window.__ts_bids` — before `</body>`, via `el.on_end_tag()` on the body element. The handler reads from a shared `Arc<RwLock<Option<String>>>` written by the auction task (Task 9). By the time `</body>` is reached in the HTML stream, Task 9 has already awaited the auction (or its deadline), so the shared state is always populated.
+
+> **Critical design constraint:** `</head>` must never be held. Only `</body>` is held (by the outer streaming mechanism in Task 9). `HtmlProcessorConfig` receives the ready-to-inject script strings; it does not decide when to wait.
+
+- [ ] **Step 1: Write failing tests**
+
+  In `html_processor.rs` tests:
+
+  ```rust
+  #[test]
+  fn injects_ad_slots_at_head_open() {
+      let config = HtmlProcessorConfig {
+          origin_host: "origin.example.com".to_string(),
+          request_host: "example.com".to_string(),
+          request_scheme: "https".to_string(),
+          integrations: IntegrationRegistry::empty_for_tests(),
+          ad_slots_script: Some(
+              r#"<script>window.__ts_ad_slots=JSON.parse("[]");</script>"#.to_string()
+          ),
+          ad_bids_state: std::sync::Arc::new(std::sync::RwLock::new(None)),
+      };
+      let mut processor = create_html_processor(config);
+      let output = processor
+          .process_chunk(b"<html><head><title>T</title></head><body>content</body></html>", true)
+          .expect("should process");
+      let html = std::str::from_utf8(&output).expect("should be utf8");
+      assert!(html.contains("window.__ts_ad_slots"), "should inject ad slots at head-open");
+      assert!(!html.contains("__ts_request_id"), "must NOT inject request_id — body-injection arch has no request_id");
+  }
+
+  #[test]
+  fn injects_ts_bids_before_body_close() {
+      let bids_script = r#"<script>window.__ts_bids=JSON.parse("{\"atf\":{\"hb_pb\":\"1.00\"}}");</script>"#;
+      let state = std::sync::Arc::new(std::sync::RwLock::new(
+          Some(bids_script.to_string())
+      ));
+      let config = HtmlProcessorConfig {
+          origin_host: "origin.example.com".to_string(),
+          request_host: "example.com".to_string(),
+          request_scheme: "https".to_string(),
+          integrations: IntegrationRegistry::empty_for_tests(),
+          ad_slots_script: None,
+          ad_bids_state: state,
+      };
+      let mut processor = create_html_processor(config);
+      let output = processor
+          .process_chunk(b"<html><head></head><body>content</body></html>", true)
+          .expect("should process");
+      let html = std::str::from_utf8(&output).expect("should be utf8");
+      assert!(html.contains("window.__ts_bids"), "should inject bids before </body>");
+      let bids_pos = html.find("window.__ts_bids").expect("bids should be in output");
+      let body_close_pos = html.find("</body>").expect("</body> should be in output");
+      assert!(bids_pos < body_close_pos, "bids must appear before </body>");
+  }
+
+  #[test]
+  fn injects_empty_ts_bids_when_state_is_none() {
+      let state = std::sync::Arc::new(std::sync::RwLock::new(None));
+      let config = HtmlProcessorConfig {
+          origin_host: "origin.example.com".to_string(),
+          request_host: "example.com".to_string(),
+          request_scheme: "https".to_string(),
+          integrations: IntegrationRegistry::empty_for_tests(),
+          ad_slots_script: None,
+          ad_bids_state: state,
+      };
+      let mut processor = create_html_processor(config);
+      let output = processor
+          .process_chunk(b"<html><head></head><body>content</body></html>", true)
+          .expect("should process");
+      let html = std::str::from_utf8(&output).expect("should be utf8");
+      assert!(html.contains("__ts_bids=JSON.parse(\"{}\""), "should inject empty bids on None state");
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core html_processor`
+  Expected: compile error (no `ad_bids_state` field yet)
+
+- [ ] **Step 2: Add `empty_for_tests()` to `IntegrationRegistry`**
+
+  In `registry.rs`, add:
+
+  ```rust
+  #[cfg(test)]
+  impl IntegrationRegistry {
+      pub fn empty_for_tests() -> Self {
+          Self {
+              inner: Arc::new(RegistryInner {
+                  proxies: Default::default(),
+                  attribute_rewriters: Default::default(),
+                  script_rewriters: Vec::new(),
+                  html_post_processors: Vec::new(),
+                  head_injectors: Vec::new(),
+                  metadata: Default::default(),
+              })
+          }
+      }
+  }
+  ```
+
+  (Adjust field names to match the actual `RegistryInner` struct.)
+
+- [ ] **Step 3: Update `HtmlProcessorConfig`**
+
+  ```rust
+  pub struct HtmlProcessorConfig {
+      pub origin_host: String,
+      pub request_host: String,
+      pub request_scheme: String,
+      pub integrations: IntegrationRegistry,
+      /// Pre-computed `<script>window.__ts_ad_slots=...;</script>`.
+      /// Injected at `<head>` open. `None` when no slots matched.
+      pub ad_slots_script: Option<String>,
+      /// Shared auction result script — written by the auction task before HTML processing
+      /// begins. Handler reads this in `el.on_end_tag()` on the body element.
+      /// `None` means no auction ran (consent denied, bot UA, no slot match, etc.);
+      /// inject empty `__ts_bids = {}` as graceful fallback.
+      pub ad_bids_state: std::sync::Arc<std::sync::RwLock<Option<String>>>,
+  }
+  ```
+
+  Update `from_settings` (or wherever `HtmlProcessorConfig` is constructed) to initialize `ad_bids_state: Arc::new(RwLock::new(None))`.
+
+- [ ] **Step 4: Inject `ad_slots_script` at head-open**
+
+  In `create_html_processor`, within the existing `element!("head", ...)` handler:
+
+  ```rust
+  let ad_slots_script = config.ad_slots_script.clone();
+  // existing captures...
+
+  element!("head", |el| {
+      let mut snippet = String::new();
+      if let Some(ref slots_script) = ad_slots_script {
+          snippet.push_str(slots_script);
+      }
+      // existing integration head inserts...
+      if !snippet.is_empty() {
+          el.prepend(&snippet, ContentType::Html);
+      }
+      // DO NOT register on_end_tag — </head> flushes immediately
+      Ok(())
+  })
+  ```
+
+- [ ] **Step 5: Inject `__ts_bids` before `</body>` via `el.on_end_tag()`**
+
+  Add a new handler in `create_html_processor`. The shared state is already populated by the time lol_html reaches `</body>` (Task 9 awaits the auction before starting HTML processing):
+
+  ```rust
+  let ad_bids_state = config.ad_bids_state.clone();
+
+  element!("body", |el| {
+      let state = ad_bids_state.clone();
+      el.on_end_tag(move |end_tag| {
+          let script = state.read().expect("should read bid state");
+          let bids_script = match &*script {
+              Some(s) => s.clone(),
+              None => {
+                  r#"<script>window.__ts_bids=JSON.parse("{}");</script>"#.to_string()
+              }
+          };
+          end_tag.before(&bids_script, ContentType::Html);
+          Ok(())
+      })?;
+      Ok(())
+  })
+  ```
+
+- [ ] **Step 6: Run tests**
+
+  Run: `cargo test -p trusted-server-core html_processor`
+  Expected: all tests pass
+
+- [ ] **Step 7: Run full suite**
+
+  Run: `cargo test --workspace`
+  Expected: clean
+
+- [ ] **Step 8: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/html_processor.rs \
+          crates/trusted-server-core/src/integrations/registry.rs
+  git commit -m "Inject __ts_ad_slots at head-open and __ts_bids before </body> via shared auction state"
+  ```
+
+---
+
+## Task 8: `handle_publisher_request` async restructuring
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs`
+
+> **Key constraint from spec §4.3 and §3:** No `bid_cache`. No `/ts-bids`. No `request_id`. Bids travel inline with the HTML response via body injection. The `Arc<RwLock<Option<String>>>` is the coordination mechanism within a single request's lifetime — it is written before HTML processing and read by the lol_html `</body>` handler.
+
+> **Eligibility gating (spec §4.3):** Auctions fire only for real GET requests from non-bot, non-prefetch clients with TCF Purpose 1 consent and at least one matching slot. All other requests proceed with no auction and no `__ts_bids` injection.
+
+> **Cache-Control (spec §4.7):** Set `Cache-Control: private, max-age=0` (not `no-store`) to preserve BFCache eligibility. Strip `Surrogate-Control` and `Fastly-Surrogate-Control`.
+
+- [ ] **Step 1: Update function signature**
+
+  Change `handle_publisher_request` in `publisher.rs`:
+
+  > **Existing context:** The existing `publisher.rs` function body already computes `consent_context`, `ec_id`, `request_info`, `origin_host`, and `backend_name` before the origin fetch. Steps below insert new logic between those existing computations and the origin fetch — they do not replace them.
+
+  ```rust
+  pub async fn handle_publisher_request(
+      settings: &Settings,
+      integration_registry: &IntegrationRegistry,
+      services: &RuntimeServices,
+      orchestrator: &crate::auction::orchestrator::AuctionOrchestrator,
+      slots_file: &crate::creative_opportunities::CreativeOpportunitiesFile,
+      mut req: Request,
+  ) -> Result<PublisherResponse, Report<TrustedServerError>>
+  ```
+
+  Add imports at top of file:
+
+  ```rust
+  use std::sync::{Arc, RwLock};
+  use fastly::http::header;
+  use crate::auction::orchestrator::AuctionOrchestrator;
+  use crate::auction::types::{AuctionContext, AuctionRequest, PublisherInfo, UserInfo, SiteInfo};
+  use crate::creative_opportunities::{CreativeOpportunitiesFile, match_slots};
+  use crate::price_bucket::price_bucket;
+  ```
+
+  > **`send_async` return type:** `req.send_async()` returns `fastly::handle::PendingRequestHandle` (re-exported as `fastly::PendingRequest` in recent versions). Confirm the exact type from the `fastly` crate version in `Cargo.toml`; `.wait()` is the blocking resolve method on whichever type is returned.
+
+- [ ] **Step 2: Apply auction-eligibility gates**
+
+  At the top of the function body, before origin fetch:
+
+  ```rust
+  let request_path = req.get_path().to_string();
+  let request_method = req.get_method().clone();
+
+  // Gate 1: Only GET triggers auctions. HEAD skips everything.
+  let is_get = request_method == fastly::http::Method::GET;
+
+  // Gate 2: Skip prefetch hints (Sec-Purpose: prefetch or Purpose: prefetch).
+  let is_prefetch = req.get_header_str("sec-purpose")
+      .map_or(false, |v| v.contains("prefetch"))
+      || req.get_header_str("purpose")
+      .map_or(false, |v| v.contains("prefetch"));
+
+  // Gate 3: Skip well-known crawler UAs (protects SSP QPS budget).
+  let user_agent = req.get_header_str("user-agent").unwrap_or("");
+  let is_bot = ["Googlebot", "Bingbot", "AhrefsBot", "SemrushBot", "DotBot"]
+      .iter()
+      .any(|bot| user_agent.contains(bot));
+
+  // Gate 4: Slot match.
+  let matched_slots: Vec<_> = if settings.creative_opportunities.is_some() && is_get {
+      match_slots(&slots_file.slots, &request_path)
+          .into_iter()
+          .cloned()
+          .collect()
+  } else {
+      Vec::new()
+  };
+
+  // Gate 5: TCF Purpose 1 consent.
+  let consent_allows_auction = consent_context
+      .tcf
+      .as_ref()
+      .map_or(false, |tcf| tcf.has_purpose_consent(1));
+
+  let should_run_auction = is_get
+      && !is_prefetch
+      && !is_bot
+      && !matched_slots.is_empty()
+      && consent_allows_auction;
+
+  let auction_timeout_ms = settings
+      .creative_opportunities
+      .as_ref()
+      .and_then(|co| co.auction_timeout_ms)
+      .unwrap_or(settings.auction.timeout_ms);
+  ```
+
+- [ ] **Step 3: Create shared bid state, fire origin + auction concurrently**
+
+  ```rust
+  // Shared state: auction task writes the ready-to-inject script; lol_html </body>
+  // handler reads it. Both within the same request — no cross-request sharing.
+  let ad_bids_state: Arc<RwLock<Option<String>>> = Arc::new(RwLock::new(None));
+
+  restrict_accept_encoding(&mut req);
+  req.set_header("host", &origin_host);
+
+  // Fire origin immediately — both origin and auction SSP calls overlap on the network.
+  let pending_origin = req
+      .send_async(&backend_name)
+      .change_context(TrustedServerError::Proxy {
+          message: "Failed to dispatch async origin request".to_string(),
+      })?;
+
+  // Run auction. Internal SSP calls use send_async and overlap with origin fetch.
+  let auction_result = if should_run_auction {
+      let co_config = settings.creative_opportunities.as_ref()
+          .expect("should be present when should_run_auction is true");
+      let auction_request = build_auction_request(
+          &matched_slots,
+          &ec_id,
+          &consent_context,
+          &request_info,
+          co_config,
+      );
+      let placeholder_req = fastly::Request::new();
+      let auction_context = AuctionContext {
+          settings,
+          request: &placeholder_req,
+          client_info: &services.client_info,
+          timeout_ms: auction_timeout_ms,
+          provider_responses: None,
+      };
+      match orchestrator.run_auction(&auction_request, &auction_context, services).await {
+          Ok(result) => Some(result),
+          Err(e) => {
+              log::warn!("server-side auction failed, proceeding without bids: {e:?}");
+              None
+          }
+      }
+  } else {
+      None
+  };
+
+  // Write auction result to shared state before HTML processing begins.
+  // The lol_html </body> handler reads this synchronously — it is always populated here.
+  // `build_bid_map` returns `serde_json::Map<String, serde_json::Value>`.
+  if should_run_auction {
+      let co_config = settings.creative_opportunities.as_ref()
+          .expect("should be present");
+      let empty_bids: std::collections::HashMap<String, crate::auction::types::Bid> =
+          std::collections::HashMap::new();
+      let winning_bids = auction_result.as_ref()
+          .map(|r| &r.winning_bids)
+          .unwrap_or(&empty_bids);
+      let bid_map = build_bid_map(winning_bids, co_config.price_granularity);
+      let bids_script = build_bids_script(&bid_map);
+      *ad_bids_state.write().expect("should write bid state") = Some(bids_script);
+  }
+
+  // Await origin response (may already be buffered since we started it before the auction).
+  let mut response = pending_origin
+      .wait()
+      .change_context(TrustedServerError::Proxy {
+          message: "Failed to await origin response".to_string(),
+      })?;
+  ```
+
+- [ ] **Step 4: Build head injection script, set cache headers, force chunked encoding**
+
+  After acquiring `response`:
+
+  ```rust
+  let ad_slots_script = if let Some(co_config) = &settings.creative_opportunities {
+      if !matched_slots.is_empty() {
+          Some(build_ad_slots_script(&matched_slots, co_config))
+      } else {
+          None
+      }
+  } else {
+      None
+  };
+
+  // Set cache headers when slots matched. private, max-age=0 (not no-store) preserves
+  // BFCache eligibility — browser back/forward cache restores the already-rendered ad
+  // without firing a new GAM call, which is the desired behavior.
+  if ad_slots_script.is_some() {
+      response.set_header(header::CACHE_CONTROL, "private, max-age=0");
+      response.remove_header("surrogate-control");
+      response.remove_header("fastly-surrogate-control");
+  }
+
+  // Force chunked encoding so </head> reaches the browser immediately as chunks arrive.
+  // Sending both Content-Length and Transfer-Encoding is invalid HTTP/1.1.
+  response.remove_header(header::CONTENT_LENGTH);
+  response.set_header("transfer-encoding", "chunked");
+  ```
+
+- [ ] **Step 5: Thread shared state into `OwnedProcessResponseParams`**
+
+  Update `OwnedProcessResponseParams`:
+
+  ```rust
+  pub struct OwnedProcessResponseParams {
+      // existing fields...
+      pub(crate) ad_slots_script: Option<String>,
+      pub(crate) ad_bids_state: Arc<RwLock<Option<String>>>,
+  }
+  ```
+
+  Pass both through to `create_html_stream_processor` and into `HtmlProcessorConfig`.
+
+- [ ] **Step 6: Add `pub(crate)` helper functions**
+
+  > **`BidMap` type:** Use `serde_json::Map<String, serde_json::Value>` directly — no separate module needed.
+
+  Add helpers in this order (each function is used by the one below it, so define leaf functions first):
+
+  ```rust
+  /// HTML-escape a JSON string for safe inline `<script>` injection via `JSON.parse`.
+  /// Unicode-escapes `<`, `>`, `&`, U+2028, U+2029 to prevent markup breakout.
+  fn html_escape_for_script(json: &str) -> String {
+      json.replace('&', "\\u0026")
+          .replace('<', "\\u003c")
+          .replace('>', "\\u003e")
+          .replace('\u{2028}', "\\u2028")
+          .replace('\u{2029}', "\\u2029")
+  }
+
+  /// Build the `BidMap` written to shared state and injected before `</body>`.
+  /// Keyed by slot ID. Values: hb_pb, hb_bidder, hb_adid, nurl (optional), burl (optional).
+  pub(crate) fn build_bid_map(
+      winning_bids: &std::collections::HashMap<String, crate::auction::types::Bid>,
+      price_granularity: crate::price_bucket::PriceGranularity,
+  ) -> serde_json::Map<String, serde_json::Value> {
+      winning_bids
+          .iter()
+          .filter_map(|(slot_id, bid)| {
+              let cpm = bid.price?;
+              let mut entry = serde_json::Map::new();
+              entry.insert("hb_pb".to_string(), serde_json::Value::String(price_bucket(cpm, price_granularity)));
+              entry.insert("hb_bidder".to_string(), serde_json::Value::String(bid.bidder.clone()));
+              entry.insert("hb_adid".to_string(), serde_json::Value::String(
+                  bid.ad_id.as_deref().unwrap_or("").to_string()
+              ));
+              if let Some(ref nurl) = bid.nurl {
+                  entry.insert("nurl".to_string(), serde_json::Value::String(nurl.clone()));
+              }
+              if let Some(ref burl) = bid.burl {
+                  entry.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
+              }
+              Some((slot_id.clone(), serde_json::Value::Object(entry)))
+          })
+          .collect()
+  }
+
+  /// Build the `<script>` block injected before `</body>`.
+  /// Contains `window.__ts_bids` keyed by slot ID.
+  pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Value>) -> String {
+      let bids_str = serde_json::to_string(bid_map).expect("should serialize bids");
+      let escaped = html_escape_for_script(&bids_str);
+      format!(r#"<script>window.__ts_bids=JSON.parse("{escaped}");</script>"#)
+  }
+
+  /// Build the `<script>` block injected at `<head>` open.
+  /// Contains `window.__ts_ad_slots` only — no request ID, no bids.
+  pub(crate) fn build_ad_slots_script(
+      matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+      co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+  ) -> String {
+      let slots_json: Vec<_> = matched_slots.iter().map(|slot| {
+          serde_json::json!({
+              "id": slot.id,
+              "gam_unit_path": slot.resolved_gam_unit_path(&co_config.gam_network_id),
+              "div_id": slot.resolved_div_id(),
+              "formats": slot.formats.iter()
+                  .map(|f| serde_json::json!([f.width, f.height]))
+                  .collect::<Vec<_>>(),
+              "targeting": slot.targeting,
+          })
+      }).collect();
+      let slots_json_str = serde_json::to_string(&slots_json).expect("should serialize ad slots");
+      let escaped = html_escape_for_script(&slots_json_str);
+      format!(r#"<script>window.__ts_ad_slots=JSON.parse("{escaped}");</script>"#)
+  }
+
+  fn build_auction_request(
+      matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+      ec_id: &str,
+      consent_context: &crate::consent::ConsentContext,
+      request_info: &crate::http_util::RequestInfo,
+      co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+  ) -> AuctionRequest {
+      AuctionRequest {
+          id: uuid::Uuid::new_v4().to_string(),
+          slots: matched_slots.iter()
+              .map(|s| s.to_ad_slot(&co_config.gam_network_id))
+              .collect(),
+          publisher: PublisherInfo {
+              domain: request_info.host.clone(),
+              page_url: Some(format!("{}://{}", request_info.scheme, request_info.host)),
+          },
+          user: UserInfo {
+              id: ec_id.to_string(),
+              fresh_id: uuid::Uuid::new_v4().to_string(),
+              consent: Some(consent_context.clone()),
+          },
+          device: None,
+          site: Some(SiteInfo {
+              domain: request_info.host.clone(),
+              page: request_info.host.clone(),
+          }),
+          context: Default::default(),
+      }
+  }
+  ```
+
+  > **Type note:** All helper signatures use `serde_json::Map<String, serde_json::Value>` directly. Do not create a `BidMap` type alias or `bid_types.rs` module.
+
+- [ ] **Step 7: Update `main.rs` call site**
+
+  In `crates/trusted-server-adapter-fastly/src/main.rs`:
+
+  ```rust
+  // At startup (top of main() / request handler setup, before the request dispatch loop).
+  // include_str! embeds the file at compile time — no runtime file I/O.
+  const CREATIVE_OPPORTUNITIES_TOML: &str =
+      include_str!("../../../creative-opportunities.toml");
+
+  let slots_file: trusted_server_core::creative_opportunities::CreativeOpportunitiesFile =
+      toml::from_str(CREATIVE_OPPORTUNITIES_TOML)
+          .expect("should parse creative-opportunities.toml");
+  ```
+
+  `slots_file` is a local in the startup/handler scope and passed by reference into `handle_publisher_request` on each request — no `Arc` needed since it's immutable and the handler borrows it.
+
+  Update the call to `handle_publisher_request`:
+
+  ```rust
+  match handle_publisher_request(
+      settings,
+      integration_registry,
+      &publisher_services,
+      orchestrator,   // existing
+      &slots_file,    // new
+      req,
+  ).await {
+      // existing match arms unchanged
+  }
+  ```
+
+  There is **no `/ts-bids` route** to add. The body injection is complete within `handle_publisher_request`.
+
+- [ ] **Step 8: Compile check**
+
+  Run: `cargo check --workspace`
+  Expected: clean compile
+
+- [ ] **Step 9: Run full tests**
+
+  Run: `cargo test --workspace`
+  Expected: all pass
+
+- [ ] **Step 10: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/publisher.rs \
+          crates/trusted-server-adapter-fastly/src/main.rs
+  git commit -m "Convert handle_publisher_request to async; body-inject __ts_bids; eligibility gates; max-age=0"
+  ```
+
+---
+
+## Task 9: GPT head injector — emit `__tsAdInit` with synchronous bid read
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/gpt.rs`
+
+> **Critical:** `__tsAdInit` reads `window.__ts_bids` **synchronously** — no fetch, no Promise. `window.__ts_bids` is already on the page (injected before `</body>`) when `__tsAdInit` runs (it executes post-DCL, after `</body>` is received). Both `nurl` and `burl` fire client-side from `slotRenderEnded`; neither is fired server-side.
+
+- [ ] **Step 1: Write failing test**
+
+  ```rust
+  #[test]
+  fn head_inserts_includes_ts_ad_init_with_synchronous_bids_read() {
+      let config = test_config();
+      let integration = GptIntegration::new(config);
+      let ctx = make_test_context();
+      let inserts = integration.head_inserts(&ctx);
+      let combined = inserts.join("");
+      assert!(combined.contains("__tsAdInit"), "should define __tsAdInit");
+      assert!(combined.contains("window.__ts_bids"), "should read window.__ts_bids synchronously");
+      assert!(combined.contains("ts_initial"), "should set ts_initial sentinel");
+      assert!(combined.contains("slotRenderEnded"), "should register slotRenderEnded");
+      assert!(combined.contains("sendBeacon"), "should fire nurl and burl via sendBeacon");
+      assert!(combined.contains("nurl"), "should fire nurl on confirmed render");
+      assert!(!combined.contains("/ts-bids"), "must NOT fetch /ts-bids — bids are inline on the page");
+      assert!(!combined.contains("bidsPromise"), "must NOT use bidsPromise — bids are synchronous");
+      assert!(!combined.contains("__ts_request_id"), "must NOT reference request_id — no longer used");
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core integrations::gpt`
+  Expected: FAIL
+
+- [ ] **Step 2: Replace `head_inserts()` in gpt.rs**
+
+  ```rust
+  impl IntegrationHeadInjector for GptIntegration {
+      fn integration_id(&self) -> &'static str {
+          GPT_INTEGRATION_ID
+      }
+
+      fn head_inserts(&self, _ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
+          vec![
+              "<script>window.__tsjs_gpt_enabled=true;\
+               window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
+                  .to_string(),
+              // __tsAdInit: reads window.__ts_bids synchronously (injected before </body>).
+              // No fetch, no Promise. Executes post-DCL when </body> has already arrived.
+              // Both nurl and burl fire client-side from slotRenderEnded — never server-side.
+              // Note: window.__tsjs_installGptShim above is an EXISTING function in the
+              // tsjs-core bundle that stubs googletag.cmd before the real GPT loads.
+              concat!(
+                  "<script>",
+                  "window.__tsAdInit=function(){",
+                    "var slots=window.__ts_ad_slots||[];",
+                    "var bids=window.__ts_bids||{};",
+                    "googletag.cmd.push(function(){",
+                      "var gptSlots=slots.map(function(slot){",
+                        "var s=googletag.defineSlot(slot.gam_unit_path,slot.formats,slot.div_id);",
+                        "if(!s)return null;",
+                        "s.addService(googletag.pubads());",
+                        "Object.entries(slot.targeting||{}).forEach(function(e){s.setTargeting(e[0],e[1]);});",
+                        "var b=bids[slot.id]||{};",
+                        "[\"hb_pb\",\"hb_bidder\",\"hb_adid\"].forEach(function(k){if(b[k])s.setTargeting(k,b[k]);});",
+                        "s.setTargeting(\"ts_initial\",\"1\");",
+                        "return{id:slot.id,gptSlot:s};",
+                      "}).filter(Boolean);",
+                      "googletag.pubads().enableSingleRequest();",
+                      "googletag.enableServices();",
+                      "googletag.pubads().addEventListener(\"slotRenderEnded\",function(ev){",
+                        "var id=ev.slot.getSlotElementId();",
+                        "var b=bids[id]||{};",
+                        "var ourBidWon=!ev.isEmpty&&b.hb_adid&&ev.slot.getTargeting(\"hb_adid\")[0]===b.hb_adid;",
+                        "if(ourBidWon){",
+                          "if(b.nurl)navigator.sendBeacon(b.nurl);",
+                          "if(b.burl)navigator.sendBeacon(b.burl);",
+                        "}",
+                      "});",
+                      "googletag.pubads().refresh();",
+                    "});",
+                  "};",
+                  "</script>"
+              ).to_string(),
+          ]
+      }
+  }
+  ```
+
+- [ ] **Step 3: Run tests**
+
+  Run: `cargo test -p trusted-server-core integrations::gpt`
+  Expected: all pass including new test
+
+- [ ] **Step 4: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/integrations/gpt.rs
+  git commit -m "Emit __tsAdInit with synchronous window.__ts_bids read; nurl+burl from slotRenderEnded"
+  ```
+
+---
+
+## Task 10: `gpt/index.ts` — TypeScript `__tsAdInit` with slim-Prebid lazy loader
+
+**Files:**
+
+- Modify: `crates/js/lib/src/integrations/gpt/index.ts`
+
+The TypeScript version mirrors the Rust inline string from Task 9 and adds the lazy slim-Prebid loader. Slim-Prebid loads post-`window.load` and handles two things: refresh auctions (via existing GPT refresh triggers) and userID module warm-up to enrich the EC graph for the next request.
+
+- [ ] **Step 1: Write failing tests**
+
+  In `crates/js/lib/src/integrations/gpt/index.test.ts`:
+
+  ```typescript
+  import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+  describe('installTsAdInit', () => {
+    beforeEach(() => {
+      delete (window as any).__ts_ad_slots
+      delete (window as any).__ts_bids
+      delete (window as any).__tsAdInit
+    })
+
+    it('reads window.__ts_bids synchronously and applies bid targeting before refresh', async () => {
+      const mockSlot = {
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+        getSlotElementId: vi.fn().mockReturnValue('atf'),
+        getTargeting: vi.fn().mockReturnValue(['abc']),
+      }
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        addEventListener: vi.fn(),
+        refresh: vi.fn(),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue(mockSlot),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = [
+        {
+          id: 'atf',
+          gam_unit_path: '/123/atf',
+          div_id: 'atf',
+          formats: [[300, 250]],
+          targeting: { pos: 'atf' },
+        },
+      ]
+      ;(window as any).__ts_bids = {
+        atf: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      }
+
+      const fetchSpy = vi.spyOn(global, 'fetch')
+
+      const { installTsAdInit } = await import('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+
+      expect(fetchSpy).not.toHaveBeenCalled()
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_pb', '1.00')
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_bidder', 'kargo')
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1')
+      expect(mockPubads.refresh).toHaveBeenCalled()
+
+      fetchSpy.mockRestore()
+    })
+
+    it('fires both nurl and burl via sendBeacon on slotRenderEnded when our bid won', async () => {
+      const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true)
+      let capturedListener: ((e: any) => void) | undefined
+
+      const mockSlot = {
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+        getSlotElementId: vi.fn().mockReturnValue('atf'),
+        getTargeting: vi.fn().mockReturnValue(['abc']),
+      }
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        refresh: vi.fn(),
+        addEventListener: vi.fn((event: string, fn: (e: any) => void) => {
+          if (event === 'slotRenderEnded') capturedListener = fn
+        }),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue(mockSlot),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = [
+        {
+          id: 'atf',
+          gam_unit_path: '/123/atf',
+          div_id: 'atf',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ]
+      ;(window as any).__ts_bids = {
+        atf: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      }
+
+      const { installTsAdInit } = await import('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+
+      expect(capturedListener).toBeDefined()
+      capturedListener!({ isEmpty: false, slot: mockSlot })
+
+      expect(beaconSpy).toHaveBeenCalledWith('https://ssp/win')
+      expect(beaconSpy).toHaveBeenCalledWith('https://ssp/bill')
+      beaconSpy.mockRestore()
+    })
+
+    it('does not fire nurl/burl when bid did not win GAM line item', async () => {
+      const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true)
+      let capturedListener: ((e: any) => void) | undefined
+
+      const mockSlotNoMatch = {
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+        getSlotElementId: vi.fn().mockReturnValue('atf'),
+        getTargeting: vi.fn().mockReturnValue(['OTHER_BID_ID']),
+      }
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        refresh: vi.fn(),
+        addEventListener: vi.fn((event: string, fn: (e: any) => void) => {
+          if (event === 'slotRenderEnded') capturedListener = fn
+        }),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue(mockSlotNoMatch),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = [
+        {
+          id: 'atf',
+          gam_unit_path: '/123/atf',
+          div_id: 'atf',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ]
+      ;(window as any).__ts_bids = {
+        atf: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      }
+
+      const { installTsAdInit } = await import('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+      capturedListener!({ isEmpty: false, slot: mockSlotNoMatch })
+
+      expect(beaconSpy).not.toHaveBeenCalled()
+      beaconSpy.mockRestore()
+    })
+
+    it('calls refresh even when __ts_bids is empty (graceful fallback)', () => {
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        addEventListener: vi.fn(),
+        refresh: vi.fn(),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue({
+          addService: vi.fn().mockReturnThis(),
+          setTargeting: vi.fn().mockReturnThis(),
+        }),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = []
+      ;(window as any).__ts_bids = {}
+
+      const { installTsAdInit } = require('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+
+      expect(mockPubads.refresh).toHaveBeenCalled()
+    })
+  })
+  ```
+
+  Run: `cd crates/js/lib && npx vitest run`
+  Expected: FAIL — `installTsAdInit` not defined or assertions fail
+
+- [ ] **Step 2: Implement `installTsAdInit` in `index.ts`**
+
+  Replace the old `/ts-bids` fetch implementation with:
+
+  ```typescript
+  interface TsAdSlot {
+    id: string
+    gam_unit_path: string
+    div_id: string
+    formats: Array<number[]>
+    targeting: Record<string, string>
+  }
+
+  interface TsBidData {
+    hb_pb?: string
+    hb_bidder?: string
+    hb_adid?: string
+    nurl?: string
+    burl?: string
+  }
+
+  type TsWindow = Window & {
+    __ts_ad_slots?: TsAdSlot[]
+    __ts_bids?: Record<string, TsBidData>
+    __tsAdInit?: () => void
+  }
+
+  /**
+   * Install `window.__tsAdInit`.
+   *
+   * Reads `window.__ts_ad_slots` (injected at head-open) and `window.__ts_bids`
+   * (injected before </body>) synchronously — no fetch, no Promise. Applies bid
+   * targeting to GPT slots, sets the `ts_initial` sentinel, registers
+   * `slotRenderEnded` to fire both nurl and burl via sendBeacon when our
+   * specific Prebid bid wins the GAM line item match, then calls refresh().
+   */
+  export function installTsAdInit(): void {
+    const w = window as TsWindow
+    w.__tsAdInit = function () {
+      const slots = w.__ts_ad_slots ?? []
+      const bids = w.__ts_bids ?? {}
+      const g = (window as GptWindow).googletag
+      if (!g) return
+
+      g.cmd.push(() => {
+        const gptSlots = slots
+          .map((slot) => {
+            const gptSlot = g.defineSlot?.(
+              slot.gam_unit_path,
+              slot.formats,
+              slot.div_id
+            )
+            if (!gptSlot) return null
+            gptSlot.addService(g.pubads())
+            Object.entries(slot.targeting ?? {}).forEach(([k, v]) =>
+              gptSlot.setTargeting(k, v)
+            )
+            const bid = bids[slot.id] ?? {}
+            ;(['hb_pb', 'hb_bidder', 'hb_adid'] as const).forEach((key) => {
+              if (bid[key]) gptSlot.setTargeting(key, bid[key]!)
+            })
+            gptSlot.setTargeting('ts_initial', '1')
+            return { id: slot.id, gptSlot }
+          })
+          .filter(Boolean) as Array<{
+          id: string
+          gptSlot: NonNullable<ReturnType<typeof g.defineSlot>>
+        }>
+
+        g.pubads().enableSingleRequest()
+        g.enableServices()
+
+        g.pubads().addEventListener?.('slotRenderEnded', (event: any) => {
+          const slotId: string = event.slot?.getSlotElementId?.() ?? ''
+          const bid = bids[slotId] ?? {}
+          const ourBidWon =
+            !event.isEmpty &&
+            bid.hb_adid &&
+            event.slot?.getTargeting?.('hb_adid')?.[0] === bid.hb_adid
+          if (ourBidWon) {
+            if (bid.nurl) navigator.sendBeacon(bid.nurl)
+            if (bid.burl) navigator.sendBeacon(bid.burl)
+          }
+        })
+
+        g.pubads().refresh()
+      })
+    }
+  }
+  ```
+
+- [ ] **Step 3: Add lazy slim-Prebid loader (post-`window.load`)**
+
+  After `installTsAdInit`, add:
+
+  ```typescript
+  /**
+   * Register the slim-Prebid lazy loader. Fires after window.load — off the
+   * critical path. slim-Prebid handles refresh auctions and userID module
+   * warm-up (ID5, sharedID, LiveRamp ATS, Lockr). It skips initial-render slots
+   * (ts_initial=1) and registers as the GPT refresh handler for scroll/sticky auctions.
+   *
+   * Phase 1: no-op unless window.__tsjs_slim_prebid_url is set (it won't be until
+   * the slim-Prebid bundle build target ships in a later phase).
+   */
+  export function installSlimPrebidLoader(): void {
+    const url = (window as any).__tsjs_slim_prebid_url as string | undefined
+    if (!url) return
+    window.addEventListener('load', () => {
+      const script = document.createElement('script')
+      script.src = url
+      script.defer = true
+      document.head.appendChild(script)
+    })
+  }
+  ```
+
+  Call `installTsAdInit()` from the integration's existing initialization path — wherever the module's init function runs at page load (look for the existing `init()` or module-level call that sets up the GPT integration). Add:
+
+  ```typescript
+  // In the integration's init / module entry point:
+  installTsAdInit()
+  ```
+
+  `window.__tsAdInit()` itself is called by `__tsAdInit` being invoked from the `<script>` block at the bottom of `</body>` (the same script block that calls `window.__tsAdInit()` after the browser receives it).
+
+- [ ] **Step 4: Run JS tests**
+
+  Run: `cd crates/js/lib && npx vitest run`
+  Expected: new tests pass
+
+- [ ] **Step 5: Build JS bundle**
+
+  Run: `cd crates/js/lib && node build-all.mjs`
+  Expected: clean build
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add crates/js/lib/src/integrations/gpt/
+  git commit -m "Add synchronous __tsAdInit (reads window.__ts_bids inline); nurl+burl from slotRenderEnded; slim-Prebid lazy loader"
+  ```
+
+---
+
+## Task 11: End-to-end integration tests
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs` (test module)
+
+Tests use `pub(crate)` helpers from Task 8 directly.
+
+- [ ] **Step 1: Write tests**
+
+  In `publisher.rs` test module:
+
+  ```rust
+  #[cfg(test)]
+  mod creative_opportunities_tests {
+      use super::{build_ad_slots_script, build_bids_script, build_bid_map, html_escape_for_script};
+      use crate::creative_opportunities::{
+          CreativeOpportunitiesConfig, CreativeOpportunitySlot, CreativeOpportunityFormat,
+      };
+      use crate::auction::types::{Bid, MediaType};
+      use crate::price_bucket::PriceGranularity;
+      use std::collections::HashMap;
+
+      fn make_config() -> CreativeOpportunitiesConfig {
+          CreativeOpportunitiesConfig {
+              gam_network_id: "21765378893".to_string(),
+              auction_timeout_ms: Some(500),
+              price_granularity: PriceGranularity::Dense,
+          }
+      }
+
+      fn make_slot() -> CreativeOpportunitySlot {
+          CreativeOpportunitySlot {
+              id: "atf_sidebar_ad".to_string(),
+              gam_unit_path: Some("/21765378893/publisher/atf-sidebar".to_string()),
+              div_id: Some("div-atf-sidebar".to_string()),
+              page_patterns: vec!["/20**".to_string()],
+              formats: vec![CreativeOpportunityFormat {
+                  width: 300, height: 250, media_type: MediaType::Banner,
+              }],
+              floor_price: Some(0.50),
+              targeting: [("pos".to_string(), "atf".to_string())].into_iter().collect(),
+              providers: Default::default(),
+          }
+      }
+
+      #[test]
+      fn ad_slots_script_contains_slot_data() {
+          let slots = vec![make_slot()];
+          let config = make_config();
+          let script = build_ad_slots_script(&slots, &config);
+          assert!(script.contains("window.__ts_ad_slots=JSON.parse"), "should use JSON.parse");
+          assert!(script.contains("atf_sidebar_ad"), "should include slot id");
+          assert!(!script.contains("__ts_bids"), "must NOT contain bids");
+          assert!(!script.contains("__ts_request_id"), "must NOT contain request_id");
+      }
+
+      #[test]
+      fn ad_slots_script_is_xss_safe() {
+          let slots = vec![make_slot()];
+          let config = make_config();
+          let script = build_ad_slots_script(&slots, &config);
+          let inner = script
+              .trim_start_matches("<script>")
+              .trim_end_matches("</script>");
+          assert!(!inner.contains('<'), "no unescaped < in script content");
+          assert!(!inner.contains('>'), "no unescaped > in script content");
+      }
+
+      #[test]
+      fn bid_map_includes_nurl_and_burl() {
+          let mut winning_bids = HashMap::new();
+          winning_bids.insert("atf_sidebar_ad".to_string(), Bid {
+              slot_id: "atf_sidebar_ad".to_string(),
+              price: Some(2.53),
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "kargo".to_string(),
+              width: 300,
+              height: 250,
+              nurl: Some("https://ssp/win".to_string()),
+              burl: Some("https://ssp/bill".to_string()),
+              ad_id: Some("abc123".to_string()),
+              metadata: Default::default(),
+          });
+          let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+          let entry = map.get("atf_sidebar_ad").expect("should have bid entry");
+          assert_eq!(entry.get("hb_pb").and_then(|v| v.as_str()), Some("2.50"));
+          assert_eq!(entry.get("hb_bidder").and_then(|v| v.as_str()), Some("kargo"));
+          assert_eq!(entry.get("hb_adid").and_then(|v| v.as_str()), Some("abc123"));
+          assert_eq!(entry.get("nurl").and_then(|v| v.as_str()), Some("https://ssp/win"));
+          assert_eq!(entry.get("burl").and_then(|v| v.as_str()), Some("https://ssp/bill"));
+      }
+
+      #[test]
+      fn bid_map_excludes_slot_when_price_is_none() {
+          let mut winning_bids = HashMap::new();
+          winning_bids.insert("no-price-slot".to_string(), Bid {
+              slot_id: "no-price-slot".to_string(),
+              price: None,
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "kargo".to_string(),
+              width: 300,
+              height: 250,
+              nurl: None,
+              burl: None,
+              ad_id: None,
+              metadata: Default::default(),
+          });
+          let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+          assert!(map.is_empty(), "slot with no price should be excluded from bid map");
+      }
+
+      #[test]
+      fn bids_script_is_xss_safe() {
+          let mut map = serde_json::Map::new();
+          map.insert("atf".to_string(), serde_json::json!({"hb_pb": "1.00"}));
+          let script = build_bids_script(&map);
+          let inner = script
+              .trim_start_matches("<script>")
+              .trim_end_matches("</script>");
+          assert!(!inner.contains('<'), "no unescaped < in bids script");
+          assert!(!inner.contains('>'), "no unescaped > in bids script");
+      }
+
+      #[test]
+      fn html_escape_encodes_special_chars() {
+          assert_eq!(html_escape_for_script("<script>"), "\\u003cscript\\u003e");
+          assert_eq!(html_escape_for_script("&"), "\\u0026");
+          assert_eq!(html_escape_for_script("\u{2028}"), "\\u2028");
+      }
+  }
+  ```
+
+- [ ] **Step 2: Run tests**
+
+  Run: `cargo test -p trusted-server-core creative_opportunities_tests`
+  Expected: all pass
+
+- [ ] **Step 3: Run full workspace tests**
+
+  Run: `cargo test --workspace`
+  Expected: all pass
+
+- [ ] **Step 4: Run JS tests**
+
+  Run: `cd crates/js/lib && npx vitest run`
+  Expected: all pass
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/publisher.rs
+  git commit -m "Add end-to-end publisher helper tests for body-injection architecture"
+  ```
diff --git a/docs/superpowers/specs/2026-04-15-server-side-ad-templates-design.md b/docs/superpowers/specs/2026-04-15-server-side-ad-templates-design.md
new file mode 100644
index 000000000..94fe1999a
--- /dev/null
+++ b/docs/superpowers/specs/2026-04-15-server-side-ad-templates-design.md
@@ -0,0 +1,1195 @@
+# Server-Side Ad Templates Design
+
+_Author · 2026-04-15_
+_Revised · 2026-05-04 (body-injection rework)_
+
+---
+
+## 1. Problem Statement
+
+Today's display ad pipeline on most publisher sites is structurally sequential and
+browser-bound:
+
+1. Page HTML arrives at browser
+2. Prebid.js (~300KB) downloads and parses
+3. Smart Slots SDK scans the DOM to discover ad placements
+4. `addAdUnits()` registers slot definitions
+5. Prebid auction fires from the browser (~80–150ms RTT to SSPs)
+6. Bids return (~1,000–1,500ms window)
+7. GPT `setTargeting()` + `refresh()` fires
+8. GAM creative renders
+
+**Total time to ad visible: ~3,100ms.**
+
+The browser is the slowest possible place to run an auction. It must first download and
+parse multiple SDKs, scan the DOM to discover what ad slots exist, and then fire SSP
+requests over a consumer internet connection with high and variable latency.
+
+Trusted Server sits at the Fastly edge — milliseconds from the user, with
+data-center-to-data-center RTT to Prebid Server (~20–30ms vs ~80–150ms from a browser).
+The server knows, from the request URL alone, exactly which ad slots are available on any
+given page. There is no reason to wait for the browser.
+
+---
+
+## 2. Goal
+
+Enable Trusted Server to:
+
+1. Match an incoming page request URL against a set of pre-configured slot templates.
+2. Immediately fire the full server-side auction (all providers: PBS, APS, future
+   wrappers) in parallel with the origin HTML fetch — before the browser receives a
+   single byte.
+3. Inject GPT slot definitions into `<head>` so the client can define slots without any
+   SDK.
+4. Inject the auction result inline before `</body>`, so bids and HTML travel together
+   in a single response. The auction runs in parallel with origin fetch and body
+   streaming; the close-of-body tag is held only until the auction completes or
+   `A_deadline` fires, whichever is first. **FCP is unaffected** — body content above
+   `</body>` has already streamed and painted by the time the close tag is held.
+5. Eliminate Prebid.js from the page-load critical path. A stripped-down Prebid bundle
+   (_slim-Prebid_) is lazy-loaded post-`window.load` to handle scroll/refresh auctions
+   and to run userID modules that enrich the EC identity graph for the next request.
+
+**Target time to ad visible: ~870ms (cache hit) / ~1,020ms (cache miss). FCP unchanged
+from a no-TS baseline.** Net saving on ad-visible: ~2,200–2,400ms vs today, compounded
+across every navigation in the user's clickstream rather than once per session.
+
+> **Note:** The latency numbers in this document are modeled estimates based on known
+> edge→PBS RTT ranges and typical origin response times. They should be validated with
+> production measurements after Phase 1 ships. Quantitative claims in §6 are tagged with
+> the assumptions they depend on.
+
+---
+
+## 3. Non-Goals
+
+- Eliminating client-side GPT / Google Ad Manager — GAM remains in the rendering
+  pipeline. The GAM call (`securepubads.g.doubleclick.net`) moving server-side is
+  aspirational, contingent on Google agreement, and is not committed for any phase
+  (see §9.6).
+- Eliminating Prebid entirely — a stripped-down Prebid bundle (_slim-Prebid_) is
+  lazy-loaded post-`window.load` to handle scroll/refresh auctions and userID
+  enrichment. **TS owns the first impression; Prebid owns subsequent refresh
+  auctions.**
+- Dynamic slot discovery (reading the DOM) — this design commits to pre-defined,
+  URL-matched slot templates. Smart Slots' dynamic injection behavior is replaced by
+  server knowledge.
+- Changing the `AuctionOrchestrator` internally — the orchestrator already handles
+  parallel provider fan-out. This design adds a new trigger point, not new auction
+  logic.
+- A separate `/ts-bids` endpoint — an earlier revision of this spec proposed a fetch
+  endpoint backed by an in-process `bid_cache`. That design was rejected because
+  in-process caches don't survive Fastly Compute's per-request Wasm isolate model:
+  isolates are not pinned across requests, and there is no documented contract for
+  cross-request shared state. Body-injection achieves the same FCP property with a
+  single response and no shared-state requirement.
+
+---
+
+## 4. Architecture
+
+### 4.1 New File: `creative-opportunities.toml`
+
+A new config file at the repo root, alongside `trusted-server.toml`. It holds all slot
+templates: page pattern matching rules, ad formats, floor prices, GAM targeting
+key-values, and per-provider bidder params. PBS bidder-level params (placement IDs,
+account IDs) live in Prebid Server stored requests, keyed by slot ID. APS params are
+specified inline per slot under `[slot.providers.aps]`.
+
+Loaded at build time via `include_str!()` and compiled into the WASM binary. Slot
+changes require a redeploy; this is intentional (fast reads, no KV overhead, no
+per-request cost). A migration path to KV-backed config is tracked in §9.5.
+
+`floor_price` is the publisher-owned hard floor per slot — the source of truth for the
+minimum acceptable bid price, enforced at the edge before bids reach the ad server. Any
+bid below the floor is discarded at the orchestrator level before it enters `__ts_bids`.
+SSPs may apply their own dynamic floors independently within their platforms; this floor
+is the publisher's baseline that supersedes all other floor logic by virtue of being
+enforced earliest in the pipeline.
+
+#### Top-level config (in `trusted-server.toml`)
+
+```toml
+[creative_opportunities]
+# GAM network ID used to construct default ad-unit paths.
+gam_network_id = "21765378893"
+
+# Optional. Defaults to [auction].timeout_ms if not set.
+# Recommended: 500ms (vs client-side 1000–1500ms) due to lower edge→PBS RTT.
+# This value is also the upper bound on the </body>-close hold; once A_deadline
+# fires, TS injects an empty __ts_bids and emits </body> regardless.
+auction_timeout_ms = 500
+
+# Granularity table for hb_pb price bucket strings.
+# Options: "low" | "medium" | "high" | "auto" | "dense" | "custom"
+# Defaults to "dense" if not set.
+price_granularity = "dense"
+```
+
+#### `creative-opportunities.toml` schema
+
+```toml
+[[slot]]
+id = "atf_sidebar_ad"
+# Optional. Defaults to "/{gam_network_id}/{id}".
+# Override for non-standard GAM ad-unit paths.
+gam_unit_path = "/21765378893/publisher/atf-sidebar"
+# Optional. DOM container element ID. Defaults to slot id.
+div_id = "div-atf-sidebar"
+page_patterns = ["/20**"]
+formats = [{ width = 300, height = 250 }]
+floor_price = 0.50
+
+[slot.targeting]
+pos = "atf"
+zone = "atfSidebar"
+
+[slot.providers.aps]
+slot_id = "aps-slot-atf-sidebar"
+
+[[slot]]
+id = "below-content-ad"
+page_patterns = ["/20**"]
+formats = [{ width = 300, height = 250 }, { width = 728, height = 90 }]
+floor_price = 0.25
+
+[slot.targeting]
+pos = "btf"
+zone = "belowContent"
+
+[slot.providers.aps]
+slot_id = "aps-slot-below-content"
+
+[[slot]]
+id = "ad-homepage-0"
+page_patterns = ["/", "/index.html"]
+formats = [{ width = 970, height = 250 }, { width = 728, height = 90 }]
+floor_price = 1.00
+
+[slot.targeting]
+pos = "atf"
+zone = "homepage"
+slot_index = "0"
+
+[slot.providers.aps]
+slot_id = "aps-slot-homepage-0"
+```
+
+#### Rust types
+
+```rust
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct CreativeOpportunitiesConfig {
+    pub gam_network_id: String,
+    #[serde(default = "default_auction_timeout_ms")]
+    pub auction_timeout_ms: Option<u32>,
+    #[serde(default = "PriceGranularity::dense")]
+    pub price_granularity: PriceGranularity,
+}
+
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct CreativeOpportunitySlot {
+    pub id: String,
+    pub gam_unit_path: Option<String>,   // defaults to /{gam_network_id}/{id}
+    pub div_id: Option<String>,           // defaults to id
+    pub page_patterns: Vec<String>,
+    pub formats: Vec<CreativeOpportunityFormat>,
+    pub floor_price: Option<f64>,
+    #[serde(default)]
+    pub targeting: HashMap<String, String>, // strings only — validated at startup
+    #[serde(default)]
+    pub providers: SlotProviders,
+}
+
+/// Separate from auction::AdFormat so media_type can default to Banner
+/// without requiring it in the TOML. Converted to AdFormat at auction time.
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct CreativeOpportunityFormat {
+    pub width: u32,
+    pub height: u32,
+    #[serde(default = "MediaType::banner")]
+    pub media_type: MediaType,
+}
+
+#[derive(Debug, Clone, Default, serde::Deserialize)]
+pub struct SlotProviders {
+    pub aps: Option<ApsSlotParams>,
+}
+
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct ApsSlotParams {
+    pub slot_id: String,
+}
+```
+
+> **Targeting value types:** `targeting` values are `String`-only (not
+> `serde_json::Value`). GPT's `setTargeting()` only accepts `string | string[]`;
+> non-string values are silently dropped by the browser. Validated at startup — a
+> non-string targeting value is a startup error.
+
+> **Slot ID validation:** Slot IDs are validated at startup against a strict allowlist
+> (`[A-Za-z0-9_-]+`). IDs outside this set fail startup. This prevents XSS via crafted
+> IDs appearing in the injected `<script>` block.
+
+### 4.2 URL Pattern Matching
+
+At request time, TS matches the request path against each slot's `page_patterns`.
+Patterns use the `glob` crate (WASM-compatible):
+
+- `/20**` — matches all date-prefixed article paths (e.g., `/2024/01/my-article/`). Note:
+  `**` matches across path separators; `*` stops at `/`. Use `**` for multi-segment
+  patterns.
+- `/` — matches the homepage exactly
+- `/index.html` — exact match
+
+Multiple slots can match a single URL. All matching slots are collected and fed into a
+single auction as separate impressions. Pattern matching is purely in-memory against the
+pre-parsed config — sub-millisecond. The pattern-match cost is O(slots × patterns);
+startup logs the compiled pattern count.
+
+### 4.3 Auction Trigger and the Bounded Body-End Hold
+
+#### Async restructuring of the publisher path
+
+The current `handle_publisher_request` is a synchronous `fn`. Running the auction in
+parallel with the origin fetch requires:
+
+1. Converting `handle_publisher_request` to `async fn`
+2. Switching the origin fetch from blocking `.send()` to `.send_async()` (returns
+   `PlatformPendingRequest`)
+3. Adding `orchestrator: &AuctionOrchestrator` as a parameter
+4. Awaiting both the auction future and the pending origin request
+
+This is an explicit structural change to the publisher request path. It is listed in §7
+as a required migration, not a minor modification.
+
+#### Auction-eligibility gating
+
+Auctions fire on **real first-page-load impressions only**, not on every TS-matched
+request. Before firing, TS gates on:
+
+- **Consent** — TCF Purpose 1 (storage access) is the minimum. If consent is absent or
+  denied, no auction. The page renders normally; GAM falls back to its own auction.
+- **Bot / crawler User-Agent** — well-known crawler UAs (Googlebot, Bingbot,
+  AhrefsBot, etc.) skip the auction. SSP QPS budgets are finite; burning them on
+  crawler hits is a real cost.
+- **Prefetch hints** — requests carrying `Sec-Purpose: prefetch` or `Purpose: prefetch`
+  skip the auction. Avoids spending auction inventory on speculative navigations that
+  may never paint.
+- **Method** — only `GET` requests trigger auctions. `HEAD` requests skip.
+- **Slot match** — at least one slot in `creative-opportunities.toml` must match the
+  request path. Empty match = no auction.
+
+Skipped auctions emit no `__ts_bids` and let the page proceed unmodified by the ad
+stack. Skipped requests still benefit from the EC cookie set / KV identity update
+paths that run independently of the auction.
+
+#### Consent and EC ID
+
+Before firing the auction, TS reads consent signals and the EC ID from the incoming
+page request. EC ID resolution → KV lookup → enriched EID set retrieval is part of the
+existing EC pipeline and is the load-bearing identity input to the auction (see §4.8).
+
+Consent gating:
+
+- If consent is **absent or denied** (no TCF consent string, or purpose 1 not consented):
+  the auction is not fired. `__ts_bids` is omitted from the page. GPT falls back to its
+  own auction. This is treated as a first-class edge case in §8.
+- **Mid-page consent revocation** is out of scope for Phase 1; bids already injected
+  remain. Phase 2 will address consent event propagation.
+
+#### Auction execution
+
+When the gates above are satisfied, TS calls `AuctionOrchestrator::run_auction()` with
+the matched slots converted to `AdSlot` objects, decorated with `user.eids` from the
+EC graph. This happens at request receipt time, in parallel with the origin fetch via
+`send_async()`.
+
+The orchestrator's existing behavior is unchanged:
+
+- All providers (PBS, APS) are dispatched simultaneously
+- Per-provider timeout budgets are enforced from the remaining auction deadline
+  (`creative_opportunities.auction_timeout_ms`, falling back to `[auction].timeout_ms`)
+- Floor price filtering, bid unification, and winning bid selection are applied as today
+- PBS resolves bidder params from its stored requests by slot ID
+- APS bidder params are read from `[slot.providers.aps]` in
+  `creative-opportunities.toml`
+
+#### The bounded `</body>` hold
+
+Bids are injected into the page inline before `</body>`. This requires holding the
+close-of-body tag until the auction completes. The hold is **bounded by `A_deadline`**
+and **invisible to FCP** because all body content above `</body>` has already streamed
+and painted by the time the close tag is held.
+
+**Timing definitions:**
+
+- `T₀` = request receipt at the edge
+- `A_deadline` = `T₀ + auction_timeout_ms`
+- `origin_drain_time` = wall-clock when the origin response (or its `</body>` chunk in
+  the streaming case) reaches the edge
+
+**Body-close emission time:**
+
+```
+body_close_emit_time = max(origin_drain_time, min(A_deadline, auction_complete_time))
+```
+
+In English:
+
+- If the auction completes before origin drains: body close tag flushes when origin
+  emits it, with bid data injected. **No hold.** Typical cache-hit path where origin is
+  ~5ms and auction is ~500ms — the auction is the long pole, but it has already
+  finished by the time we need it because we waited for origin too.
+- If origin drains before the auction completes: body close held until either auction
+  completes or `A_deadline` fires. Hold is bounded by `A_deadline`.
+- If `A_deadline` fires first: TS injects `__ts_bids = {}` (graceful no-bid fallback)
+  and emits the close tag. GPT proceeds without bid targeting; GAM runs its own auction.
+  This is the **soft inner deadline watchdog** — auction overrun never blocks the page
+  past `A_deadline`.
+
+**Why this works without hurting FCP:** body content above `</body>` has already
+streamed and painted. Holding `</body>` delays `DOMContentLoaded` and `window.load`
+events but not FCP. Third-party scripts hooked on DCL fire later by at most the hold
+duration; this is a real cost on cache-hit pages where origin drains in <50ms but
+auction takes ~500ms. The publisher decides this trade-off via `auction_timeout_ms` —
+500ms is the recommended default and the hard upper bound on DCL slip.
+
+**FCP is unaffected by the auction.** First Contentful Paint is bounded by origin time
+and resource load time, exactly the same as a page without TS in the path.
+
+> **Implementation mechanic:** lol_html's `el.on_end_tag()` registers a synchronous
+> handler against the body element. Coordinating an async auction result into a
+> synchronous handler requires shared state (e.g., `Arc<RwLock<Option<BidResult>>>`)
+> that the auction task writes when complete and the close-tag handler reads, plus an
+> outer flow-control mechanism that holds chunk emission past `</body>` until the
+> shared state is populated or `A_deadline` fires. Detailed mechanics are part of the
+> implementation plan (see §7).
+
+### 4.4 Head and Body Injection
+
+TS injects two `<script>` blocks into the HTML response:
+
+1. **`window.__ts_ad_slots`** — at `<head>` open, immediately from config. No auction
+   wait. Available to GPT the moment the browser parses `<head>`.
+2. **`window.__ts_bids`** — before `</body>`, after the bounded hold described in §4.3.
+   Carries the per-slot Prebid targeting and `nurl`/`burl` for billing.
+
+#### `__ts_ad_slots` (at `<head>` open)
+
+Owned by the `gpt` integration head injector:
+
+```json
+[
+  {
+    "id": "atf_sidebar_ad",
+    "gam_unit_path": "/21765378893/publisher/atf-sidebar",
+    "div_id": "div-atf-sidebar",
+    "formats": [[300, 250]],
+    "targeting": { "pos": "atf", "zone": "atfSidebar" }
+  },
+  {
+    "id": "below-content-ad",
+    "gam_unit_path": "/21765378893/below-content-ad",
+    "div_id": "below-content-ad",
+    "formats": [
+      [300, 250],
+      [728, 90]
+    ],
+    "targeting": { "pos": "btf", "zone": "belowContent" }
+  }
+]
+```
+
+#### `__ts_bids` (before `</body>`)
+
+JSON object keyed by slot ID:
+
+```json
+{
+  "atf_sidebar_ad": {
+    "hb_pb": "2.50",
+    "hb_bidder": "kargo",
+    "hb_adid": "abc123",
+    "nurl": "https://ssp.example/win?id=abc123",
+    "burl": "https://ssp.example/billing?id=abc123"
+  },
+  "below-content-ad": {
+    "hb_pb": "1.00",
+    "hb_bidder": "appnexus",
+    "hb_adid": "def456",
+    "nurl": "https://appnexus.example/win?id=def456",
+    "burl": "https://appnexus.example/billing?id=def456"
+  }
+}
+```
+
+`hb_pb` is computed using the **dense** granularity table (publisher-configurable via
+`price_granularity` in `[creative_opportunities]`). Per-slot keys are `hb_pb`,
+`hb_bidder`, `hb_adid`, `nurl`, `burl` — both `nurl` and `burl` ride into the page
+because both are fired client-side from `slotRenderEnded` (see §4.5).
+
+#### Injection mechanic
+
+`__ts_ad_slots` is emitted via the existing `el.prepend()` head handler (already used
+by integrations for head-tag injection).
+
+`__ts_bids` is emitted via lol_html's `el.on_end_tag()` registered against the body
+element. The handler reads from a shared auction-result state (resolved by the auction
+task, fallback to `{}` on watchdog) and calls
+`end_tag.before(<script>...</script>, ContentType::Html)`.
+
+> **Security:** All string values are JSON-serialized via `serde_json` and HTML-escaped
+> before insertion into the `<script>` block. The wrapper uses
+> `JSON.parse(<escaped string>)`, never raw string interpolation. `<`, `>`, `&`, U+2028,
+> U+2029 are unicode-escaped to neutralize any markup that could break out of the
+> `<script>` context.
+
+> **Cache contract (load-bearing invariant):** The HTML response with `__ts_bids`
+> contains per-user bid data inline. TS sets **`Cache-Control: private, max-age=0`** on
+> the browser-facing response. **`Surrogate-Control` and `Fastly-Surrogate-Control`
+> are stripped** so downstream Fastly-aware caches do not override the directive. The
+> Fastly edge cache for the **origin** response is unaffected — TS reads the cached
+> origin HTML and assembles a fresh per-request response on every hit. **The
+> assembled response must never be re-cached** by any intermediate proxy or shared
+> cache. See §4.7 for the full caching rationale, including why `no-store` was
+> rejected in favor of `max-age=0` (BFCache eligibility).
+
+### 4.5 Win Notifications — Both `nurl` and `burl` Client-Side
+
+Win notification responsibilities are split by where the truth lives. **Both `nurl`
+and `burl` fire client-side from the GPT `slotRenderEnded` event after `hb_adid`
+match.** Server-side firing is rejected for both because it would report wins for
+auctions whose bids never actually rendered (direct deal won the GAM line item, GAM
+backfill won, user navigated away before tsjs loaded, etc.) — that's billing inflation
+and a violation of MRC counting standards.
+
+**Render-confirmed firing pattern (registered in `__tsAdInit`):**
+
+```javascript
+googletag.pubads().addEventListener('slotRenderEnded', function (event) {
+  var slotId = event.slot.getSlotElementId()
+  var bidData = (window.__ts_bids || {})[slotId] || {}
+  var ourBidWon =
+    !event.isEmpty &&
+    bidData.hb_adid &&
+    event.slot.getTargeting('hb_adid')[0] === bidData.hb_adid
+
+  if (ourBidWon) {
+    if (bidData.nurl) navigator.sendBeacon(bidData.nurl)
+    if (bidData.burl) navigator.sendBeacon(bidData.burl)
+  }
+})
+```
+
+The `hb_adid` match confirms two things: that the slot was filled (`!event.isEmpty`)
+**and** that **our** Prebid bid (not a direct deal or backfill) won the GAM line item
+match. Only then are SSP win/billing pixels fired.
+
+**Per-bidder suppression** (`[integrations.<bidder>].suppress_nurl`, default `false`)
+is retained as an escape hatch in case a specific PBS deployment fires `nurl`
+internally and wants to avoid double-firing. APS `burl` follows the same client-side
+path.
+
+> **Operational note:** Client-side firing introduces a small (~50–200ms) delay in
+> win-pixel arrival vs server-side firing. SSPs accept this — it's identical to
+> conventional client-side Prebid integrations today. Server-side firing would arrive
+> faster but would inflate counts on impressions that never rendered.
+
+### 4.6 Client Residual
+
+Prebid.js is removed from the page-load critical path. A small inline shim
+(`__tsAdInit`) reads `window.__ts_bids` synchronously from the page, drives GPT
+directly, and registers the `slotRenderEnded` listener for win/billing pixels. **No
+fetch, no Promise, no second round-trip — bids are already on the page.**
+
+```javascript
+window.__tsAdInit = function () {
+  var slots = window.__ts_ad_slots || []
+  var bids = window.__ts_bids || {}
+
+  googletag.cmd.push(function () {
+    slots.forEach(function (slot) {
+      var gptSlot = googletag
+        .defineSlot(slot.gam_unit_path, slot.formats, slot.div_id)
+        .addService(googletag.pubads())
+
+      // Apply config-defined targeting
+      Object.entries(slot.targeting || {}).forEach(function ([k, v]) {
+        gptSlot.setTargeting(k, v)
+      })
+
+      // Apply auction-result targeting
+      var bidData = bids[slot.id] || {}
+      ;['hb_pb', 'hb_bidder', 'hb_adid'].forEach(function (key) {
+        if (bidData[key]) gptSlot.setTargeting(key, bidData[key])
+      })
+
+      // Slot-ownership sentinel — slim-Prebid skips initial-rendered slots and
+      // clears this key when running its own auction on refresh.
+      gptSlot.setTargeting('ts_initial', '1')
+    })
+
+    googletag.pubads().enableSingleRequest()
+    googletag.enableServices()
+
+    // Fire win/billing pixels on confirmed render (see §4.5)
+    googletag.pubads().addEventListener('slotRenderEnded', function (event) {
+      var slotId = event.slot.getSlotElementId()
+      var bidData = bids[slotId] || {}
+      if (
+        !event.isEmpty &&
+        bidData.hb_adid &&
+        event.slot.getTargeting('hb_adid')[0] === bidData.hb_adid
+      ) {
+        if (bidData.nurl) navigator.sendBeacon(bidData.nurl)
+        if (bidData.burl) navigator.sendBeacon(bidData.burl)
+      }
+    })
+
+    googletag.pubads().refresh()
+  })
+}
+```
+
+#### Phase B: lazy slim-Prebid for refresh and identity warm-up
+
+After `window.load`, tsjs lazy-loads a stripped-down Prebid bundle (_slim-Prebid_) in
+the background. This bundle has two responsibilities, neither on the user's critical
+path:
+
+- Run **userID modules** to refresh identity provider tokens (ID5, sharedID, LiveRamp,
+  etc.). Tokens are written to first-party cookies that subsequent TS requests
+  harvest server-side and merge into the EC graph (see §4.8).
+- Register as the **auction handler for GPT scroll/refresh events**. When the
+  publisher's refresh policy fires (sticky-anchor refresh, viewability dwell, infinite
+  scroll), slim-Prebid runs a fresh client-side auction on refreshing slots and
+  applies new `hb_*` targeting before the publisher's `refresh()` trigger.
+
+Slim-Prebid is a **custom Prebid build** with bid adapters that TS handles
+server-side removed. Realistic bundle size with the major userID modules (ID5,
+sharedID, LiveRamp ATS, Lockr) and a minimal auction wrapper is ~80–120KB minified —
+meaningfully smaller than full Prebid (~250KB+) but not as small as a pure shim.
+Bundle composition is open (see §9.8).
+
+**Slot ownership signal:** `ts_initial=1` on initial-rendered slots distinguishes
+TS-served impressions from Prebid-served refresh impressions. Slim-Prebid checks for
+this key on refresh; it clears the key when re-targeting (the refresh impression is
+Prebid-served, not TS-served) and runs its own client-side auction. GAM line-item
+attribution and reporting can use this sentinel to separate the two streams.
+
+This script is part of the existing `gpt` integration bundle
+(`crates/js/lib/src/integrations/gpt/index.ts`). The lazy slim-Prebid loader is a new
+sibling module loaded post-`window.load`.
+
+#### Failure modes
+
+- **`__ts_bids = {}`** (auction watchdog fired or zero bids above floor): GPT runs
+  without bid targeting; GAM falls back to its own auction. Same graceful degradation
+  path as a no-bid scenario today.
+- **`__ts_bids` missing entirely** (consent denied, bot UA, no slot match): same
+  fallback, plus the page proceeds with no TS ad stack at all.
+- **slim-Prebid fails to load:** refresh auctions don't fire; initial-render
+  impressions unaffected. Publisher's existing GPT refresh logic (if any) takes over.
+- **`__tsAdInit` not yet defined when `</body>` script executes:** the shim is loaded
+  via the `gpt` integration bundle which is part of the head injection — this is a
+  build-time invariant, not a runtime risk.
+
+### 4.7 Caching Behavior
+
+Page assets and bid results have very different cacheability properties. The
+architecture is designed so that everything that can be cached, is.
+
+**What gets cached where:**
+
+| Asset                   | Cached at                          | Cacheability                                              |
+| ----------------------- | ---------------------------------- | --------------------------------------------------------- |
+| Origin HTML             | Fastly edge HTTP cache             | Yes, if origin sends `Cache-Control: public, max-age=...` |
+| Origin CSS / fonts / JS | Fastly edge + browser              | Yes (typically hashed URLs, immutable)                    |
+| `tsjs` bundle           | Fastly edge + browser              | Yes (already content-hashed via `bundle.rs`, immutable)   |
+| `__ts_ad_slots` payload | Computed per-request               | Sub-millisecond match — not worth caching                 |
+| `__ts_bids` payload     | Live result of per-request auction | Per-user, never shared                                    |
+| Assembled HTML response | Browser disk cache + BFCache only  | `private, max-age=0` — same-user only, never shared       |
+
+**Architecture:**
+
+1. Fastly's built-in HTTP cache stores the **origin response** keyed by URL, governed
+   by the origin's own `Cache-Control` headers. TS does not implement its own HTML
+   caching layer — it leverages the existing Fastly cache.
+2. On request: TS reads from cache (cache hit, ~5ms) or fetches from origin (cache
+   miss, ~150ms typical).
+3. TS injects `__ts_ad_slots` at `<head>` open and `__ts_bids` before `</body>` per
+   request. **The cached origin entry is never modified** — modifications happen on
+   the per-request assembled response only.
+4. The auction runs in parallel regardless of HTML cache state.
+
+**`Cache-Control` directive on the assembled response:**
+
+TS sets **`Cache-Control: private, max-age=0`** on the browser-facing response. This:
+
+- **`private`** prevents intermediate-cache leaks. Per-user bid data must never be
+  served from a shared cache to a different user.
+- **`max-age=0`** forces revalidation on hard reload. A fresh request gets a fresh
+  auction.
+- **(deliberately not `no-store`)** preserves browser BFCache eligibility. Chrome and
+  Firefox treat `no-store` as a hard ineligibility signal for the back/forward cache,
+  which provides instant restore on back-button navigation. Losing BFCache is a real
+  UX downgrade for navigation-heavy sites (news, recirculation, "next article"
+  flows).
+
+**Why `no-store` was rejected:** the threats `no-store` would mitigate beyond
+`private` are (a) browser disk cache cross-OS-user leaks (rare; same exposure as any
+per-user HTML today, e.g., logged-in pages) and (b) BFCache restoration showing stale
+bid data — but BFCache restoration replays the already-rendered ad without firing a
+new GAM call, so stale bids are inert. Trading BFCache instant-restore for these two
+marginal threats is a net loss.
+
+**Headers stripped on the way out:**
+
+- `Surrogate-Control` and `Fastly-Surrogate-Control` from origin — these would
+  override `Cache-Control` for downstream Fastly-aware caches.
+
+`Cache-Control` from origin on the **origin response stored in the Fastly edge cache**
+is preserved — that's how Fastly knows when to serve cached origin HTML to the next
+request. Only the **browser-facing assembled response** carries `private, max-age=0`.
+
+The `bid_cache` and `request_id` machinery from the prior revision is **gone** — bids
+travel inline with the HTML response, not via a separate fetch.
+
+**When caching doesn't apply (origin-side):**
+
+- **Logged-in users** — origin typically returns `Cache-Control: private`. Falls back
+  to cache-miss timing (full origin fetch).
+- **Personalized SSR** — same.
+- **Dynamic NextJS routes without ISR** — origin sends `Cache-Control: no-store` or
+  short max-age. Falls back to cache-miss timing.
+- **First request after deploy or cache purge** — cold cache, full origin fetch.
+- **Long-tail URLs** — low cache hit rate, treat as cache-miss case.
+
+For typical news / content publisher sites with anonymous visitors on stable content
+pages, expect 70–90%+ Fastly edge cache hit rate. The cache-hit timing in §5 is the
+realistic common case.
+
+### 4.8 Identity Model
+
+The server-side auction's CPM uplift depends materially on the identity decoration of
+`user.eids` in the bid stream. **TS does not collect identity in the auction critical
+path** — identity is _retrieved_ from the EC KV graph at request time and _enriched_
+asynchronously through three sync paths.
+
+> **Reference:** This section summarizes the identity dependency for auction purposes.
+> Full identity architecture, partner sync flows, and Phase A/B tier model live in the
+> separate _Identity Resolution_ design (forthcoming).
+
+#### EC graph as load-bearing input
+
+At request time, before firing the auction:
+
+1. TS resolves the `ts-ec` cookie or generates a new EC ID
+   (HMAC-SHA256(IP, publisher_passphrase)).
+2. KV lookup against `ec_store` retrieves the enriched EID set bound to the EC ID
+   (partner UIDs from sync paths described below).
+3. EIDs are decorated into `AuctionRequest.user.eids` and forwarded to PBS + APS.
+
+The EC graph is populated by three sync paths (all running off the auction critical
+path):
+
+- **Pixel sync (browser → TS)** — `/identify` endpoint receives partner-resolved IDs
+  via image-pixel or postMessage flows from the publisher's site.
+- **S2S batch push (partner → TS)** — partners push EID sets keyed by IP or hashed
+  email to TS via authenticated S2S endpoints.
+- **S2S pull (TS → partner)** — TS resolves EC IDs against partner databases (IP graph,
+  bid-stream history) on a scheduled batch interval.
+
+#### Phase A vs Phase B identity
+
+| Phase   | When                          | Source                                                                                                | Effect                               |
+| ------- | ----------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------ |
+| Phase A | Auction critical path         | EC + KV + Tier 1 server-side providers (SharedID 1P cookie, UID2 server SDK, LiveRamp ATS API, Lockr) | Decorates _this_ auction             |
+| Phase B | Post-`window.load` (off path) | slim-Prebid userID modules (ID5, ATSv2 envelope, Criteo ID, etc.)                                     | Enriches EC graph for _next_ request |
+
+Phase A adds **no auction latency** — KV lookup happens in parallel with origin
+fetch and slot match, sub-millisecond once the EC ID is resolved. Phase B is
+fire-and-forget after first paint and benefits subsequent navigations.
+
+#### Bare-EC first-impression caveat
+
+A user with no prior interaction with the EC graph (truly new EC, no federated
+consortium hit, no prior partner sync) gets an auction with **bare identity** on the
+very first impression of the EC's lifetime. Subsequent impressions are enriched as
+Phase B and partner sync paths populate the graph. The duration of the bare window
+depends on partner sync cadence:
+
+- Pixel sync fires on next `/identify` call — usually within seconds of first paint.
+- S2S batch push is partner-scheduled — minutes to hours.
+- S2S pull is TS-scheduled — minutes to hours.
+
+**Measurement:** the auction emits an `auction_eid_count` metric (number of EIDs
+decorated per auction). Distribution of this metric vs revenue uplift validates the
+identity coverage / CPM relationship in production. A high-volume zero-EID tail
+signals that partner sync paths need acceleration.
+
+#### Federated-consortium passphrase
+
+EC = HMAC(IP, passphrase). Publishers sharing a passphrase share an EC graph. A user
+new to publisher A but known to publisher B (using the shared passphrase) hits a
+**populated graph** on first request to A. This shrinks the bare-EC cohort
+meaningfully for publishers participating in a consortium. Operationally, this
+requires data-sharing agreements between consortium members — a contractual surface,
+not a technical one.
+
+#### Clickstream-compounding property
+
+Every full page navigation in a user's session is an independent TS-accelerated
+server-side auction. A user reading article 1 → article 2 → article 3 gets three
+independent auctions, each decorated with the EID set the EC graph held at that
+moment. The speed win and the identity decoration **compound across the clickstream**
+rather than being a session-start one-time benefit.
+
+**SPA caveat:** pure client-side SPAs that route via `pushState` without issuing an
+HTML request do not re-trigger TS. All slots on SPA-routed views rely on slim-Prebid
+for both auction and identity. Streaming-SSR setups (Next.js App Router, etc.) that
+emit HTTP requests on route changes get the full TS-accelerated auction per route.
+See §8.
+
+---
+
+## 5. Request-Time Sequence
+
+Sequence applies to all origins (WordPress, Drupal, Rails, NextJS 14/16, static sites).
+TS forces chunked encoding on every response, so origin format is invisible from the
+browser's perspective.
+
+### 5.1 Visual Sequence (full content + creative flow)
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant B as Browser
+    participant E as TS Edge<br/>(Fastly)
+    participant C as Fastly HTTP Cache
+    participant O as Publisher Origin<br/>(WP / NextJS / etc)
+    participant A as Auction<br/>(PBS + APS)
+    participant S as SSPs<br/>(Kargo / Index / etc)
+    participant G as GAM<br/>(securepubads)
+
+    Note over B,G: t=0ms — Navigation start
+
+    B->>E: GET ts.publisher.com/article
+
+    Note over E: t=1ms — URL → slots match<br/>EC cookie → KV EID enrichment<br/>Consent + bot/prefetch gating
+
+    par Auction kicks off server-side
+        E->>A: POST bid requests<br/>(PBS + APS in parallel)<br/>user.eids decorated from KV
+        A->>S: Fan out to all SSPs
+        S-->>A: Bids return
+        A-->>E: Aggregated bid responses<br/>(t≤A_deadline, ~502ms)
+    and Origin HTML lookup
+        E->>C: Lookup origin HTML by URL
+        alt Cache HIT (typical for content pages)
+            C-->>E: Cached HTML (~5ms)
+        else Cache MISS (cold / dynamic / logged-in)
+            C->>O: GET origin HTML
+            O-->>C: HTML response (~150ms)
+            C-->>E: HTML response
+        end
+    end
+
+    Note over E: Force Transfer-Encoding: chunked<br/>Inject __ts_ad_slots at <head> open<br/>Cache-Control: private, max-age=0
+
+    E-->>B: Stream <head> + body chunks (no hold)
+
+    Note over B: TTFB: ~10ms (hit) / ~155ms (miss)<br/></head> flushes immediately<br/>Body parsing begins
+
+    Note over B: 🎨 FCP: ~80ms (hit) / ~250ms (miss)
+
+    Note over E: At </body>: hold close tag until<br/>auction_complete OR A_deadline<br/>(bounded by auction_timeout_ms)
+
+    alt Auction completes before A_deadline
+        Note over E: Inject __ts_bids JSON before </body><br/>Emit </body>
+    else A_deadline fires first (auction overrun)
+        Note over E: Inject __ts_bids = {} (graceful fallback)<br/>Emit </body>
+    end
+
+    E-->>B: </body> chunk arrives
+
+    Note over B: tsjs executes (DCL fires)<br/>__tsAdInit reads __ts_bids inline<br/>Defines GPT slots + applies hb_* targeting<br/>Sets ts_initial=1 sentinel<br/>Registers slotRenderEnded listener<br/>googletag.pubads().refresh() fires
+
+    B->>G: GET /gampad/ads<br/>with hb_* key-values
+
+    Note over G: GAM matches hb_pb against<br/>Prebid line items, selects winner
+
+    G-->>B: Ad markup<br/>(iframe HTML or creative URL)
+
+    Note over B: Creative iframe loads in slot<br/>Fetches sub-resources<br/>(images, scripts, viewability pixels)
+
+    Note over B: 🎯 Creative paints<br/>slotRenderEnded event fires<br/>__tsAdInit checks hb_adid match
+
+    alt Our Prebid bid won the GAM line item match
+        B->>S: navigator.sendBeacon(nurl)<br/>navigator.sendBeacon(burl)
+    else Direct deal / backfill won (hb_adid mismatch or empty)
+        Note over B: No nurl/burl fired (correct — different creative rendered)
+    end
+
+    Note over B: window.load fires
+    Note over B: Phase B: lazy slim-Prebid loads<br/>(userID modules + refresh handler)<br/>(off critical path)
+
+    Note over B,G: ✅ AD VISIBLE<br/>Cache hit: ~870ms total<br/>Cache miss: ~1,020ms total<br/>FCP: ~80ms (hit) / ~250ms (miss)<br/><br/>vs client-side today: ~3,250ms ad-visible / FCP ~500ms+
+```
+
+### 5.2 Cache-Hit Sequence (typical for content publisher pages)
+
+This is the common case for anonymous visitors on cacheable content pages.
+
+```
+t=0ms     GET ts.publisher.com/article arrives at Fastly edge
+
+t=1ms     URL matched against creative-opportunities.toml
+          Slots matched: [atf_sidebar_ad, below-content-ad, section_ad]
+          EC cookie resolved → KV lookup for EID enrichment
+          Consent: TCF Purpose 1 present → auction proceeds
+          Bot/prefetch gates: pass
+
+t=2ms     AuctionOrchestrator.run_auction() dispatched (parallel)
+          PBS + APS dispatched in parallel via send_async()
+          user.eids decorated from KV graph
+          Edge→PBS RTT: ~20–30ms
+          Fastly cache lookup dispatched in parallel
+          __ts_ad_slots <script> assembled from config
+
+t=5ms     Cache HIT — origin HTML retrieved from Fastly edge cache
+          TS forces Transfer-Encoding: chunked
+          __ts_ad_slots injected at <head> open
+          Cache-Control: private, max-age=0 set on response
+          Stream begins to browser
+
+t=10ms    Browser TTFB ~10ms
+          CSS, fonts, framework JS, tsjs all begin downloading
+          (most also from Fastly cache + browser cache)
+
+t=60ms    </head> chunk reaches browser (no hold)
+          Body parsing begins immediately
+
+t=80ms    FIRST CONTENTFUL PAINT ✨ (auction never blocked rendering)
+
+t=502ms   Server-side auction completes (≤500ms budget) or A_deadline fires
+          Winning bids selected; nurl/burl per slot included in __ts_bids
+          __ts_bids JSON injected before </body>
+          </body> emitted
+          (origin drained at t=5ms, so </body> was held ~497ms — DCL slip)
+
+t=510ms   </body> reaches browser
+          tsjs executes (DCL fires)
+          __tsAdInit reads __ts_bids inline (no fetch)
+          GPT slots defined; hb_* + ts_initial=1 targeting applied
+          slotRenderEnded listener registered
+          googletag.pubads().refresh() fires
+
+t=620ms   GET /gampad/ads (GAM RTT ~110ms)
+
+t=720ms   Creative fetch begins
+
+t=870ms   Creative sub-resources + paint
+          slotRenderEnded fires; nurl + burl fired via sendBeacon
+
+          AD VISIBLE ~870ms
+          FIRST CONTENTFUL PAINT ~80ms
+
+(post window.load — off critical path)
+~t=1,500ms   slim-Prebid lazy-loads
+             userID modules run, refresh 1P identity cookies
+             GPT refresh handler registered (off critical path)
+```
+
+### 5.3 Cache-Miss Sequence (cold cache, dynamic page, logged-in user)
+
+Worst case — first request to a URL after a deploy or cache purge, or a page marked
+uncacheable by origin (`Cache-Control: private`).
+
+```
+t=0ms     GET ts.publisher.com/article arrives at Fastly edge
+t=1ms     URL matched, EC lookup, consent + gate checks
+t=2ms     Auction dispatched, origin fetch dispatched in parallel
+
+t=150ms   Origin HTML arrives at edge (cache miss — full origin RTT)
+          TS forces chunked encoding, injects __ts_ad_slots at <head> open
+          Stream begins to browser
+
+t=200ms   </head> reaches browser (no hold)
+t=250ms   FIRST CONTENTFUL PAINT
+t=502ms   Auction completes; __ts_bids injected; </body> emitted
+          (origin drained at 150ms, auction at 502ms — </body> held ~352ms)
+t=512ms   </body> reaches browser; tsjs runs; refresh() fires
+t=622ms   GET /gampad/ads
+t=722ms   Creative fetch
+t=1,020ms AD VISIBLE
+```
+
+### 5.4 Key Timing Properties
+
+| Metric     | Cache hit | Cache miss | Client-side today |
+| ---------- | --------- | ---------- | ----------------- |
+| TTFB       | ~10ms     | ~155ms     | ~150–500ms        |
+| FCP        | ~80ms     | ~250ms     | ~500ms+           |
+| DCL        | ~510ms    | ~512ms     | ~700ms+           |
+| Ad visible | ~870ms    | ~1,020ms   | ~3,250ms          |
+
+- **The auction never blocks FCP.** FCP is bounded by origin time and browser parsing
+  only — same as a page without TS in the ad path.
+- **Body content paints first; ads slot in after.** The page is responsive and
+  readable while ads finish loading.
+- **DCL is delayed by the auction hold** (up to `auction_timeout_ms`). Third-party
+  scripts hooked on DCL fire later by at most the hold duration. This is the explicit
+  trade-off for the speed win on ad-visible.
+- **Cache-hit FCP under 100ms is achievable** for anonymous visitors on stable content.
+  The typical case for news publisher article pages.
+- **Ad-visible converges across cache hit/miss** because the auction is the long pole
+  in both cases. Cache miss costs FCP, not ad-visible.
+
+---
+
+## 6. Performance Summary
+
+| Stage                      | Client-side today | TS cache hit | TS cache miss | Saving (cache hit)  |
+| -------------------------- | ----------------- | ------------ | ------------- | ------------------- |
+| Origin HTML to browser     | ~150ms            | ~10ms TTFB   | ~155ms TTFB   | parallel w/ auction |
+| Script load chain          | ~700ms            | ~40ms        | ~40ms         | -660ms              |
+| Script parse/JIT           | ~280ms            | ~10ms        | ~10ms         | -270ms              |
+| Sequential SDK hops        | ~200ms            | 0            | 0             | -200ms              |
+| Auction window             | ~1,500ms          | ~500ms       | ~500ms        | -1,000ms            |
+| GAM + creative             | ~570ms            | ~360ms       | ~360ms        | -210ms              |
+| **Ad visible (wall)**      | **~3,250ms**      | **~870ms**   | **~1,020ms**  | **~2,380ms**        |
+| **First Contentful Paint** | ~500ms+           | **~80ms**    | **~250ms**    | **-420ms**          |
+
+> Components don't sum cleanly because of parallelism — auction + origin fetch run
+> concurrently, and the GAM + creative leg is post-body-close. The wall-clock totals
+> are what matter.
+
+**Compounding across the clickstream.** Every full page navigation in a user's session
+is an independent TS-accelerated server-side auction. The speed win and identity
+decoration compound across the clickstream rather than being a session-start one-time
+benefit. Modern engagement patterns (multi-article reads, recirculation modules,
+auto-advance "next article") mean a meaningful share of impressions are
+initial-slot impressions, not refresh impressions — exactly the surface this design
+optimizes.
+
+**Auction RTT improvement.** Browser fires SSP requests at 80–150ms RTT; edge fires at
+20–30ms. Auction timeout can drop from 1,000–1,500ms to 500ms while still collecting
+more complete results, because edge→PBS latency is ~5–7x lower.
+
+**TS edge overhead.** TS adds processing on the request path: URL match, UUID-free
+gating, EC/KV lookup, head-script assembly, header rewrite, force-chunk. Estimated at
+≤5ms on warm Wasm isolates; to be measured in production. The §6 cache-hit numbers
+include this overhead.
+
+**Identity coverage caveat.** First-time visitors with no prior EC graph hit get a
+bare-identity auction on impression #1. CPM uplift on Tier 3 (browser-coupled) ID
+providers — ID5, ATSv2 envelope, Criteo ID, etc. — only lands on impression #2+ within
+an EC lifetime, after Phase B has populated 1P cookies for next-request harvest. The
+clickstream-compounding property means this dilution mostly resolves within the first
+few navigations of a new EC.
+
+**Confidence intervals.** The numbers above are point estimates against modeled
+assumptions (origin RTT, edge→PBS RTT, GAM RTT, creative weight). p95 ad-visible is
+likely 1.3–1.5x the median for slow networks and tail GAM/creative RTTs. Production
+measurement plan is to instrument each leg independently before claiming the headline
+saving.
+
+---
+
+## 7. Implementation Scope
+
+### New
+
+- `creative-opportunities.toml` — slot template config file at repo root
+- `crates/trusted-server-core/src/creative_opportunities.rs` — config types, TOML
+  parsing, URL glob matching, slot-to-`AdSlot` conversion
+- `crates/trusted-server-core/src/price_bucket.rs` — Prebid price granularity tables
+  (dense default; publisher-configurable); converts raw CPM `f64` to `hb_pb` string
+- `crates/trusted-server-core/build.rs` updates — `include_str!()` for
+  `creative-opportunities.toml`; startup slot-ID validation
+- **slim-Prebid bundle build target** — custom Prebid build with TS-handled bid
+  adapters removed; bundled with `crates/js/lib/src/integrations/gpt/` and lazy-loaded
+  post-`window.load`. Bundle composition tracked in §9.8.
+- **Auction-eligibility gating** — bot UA list, prefetch hint detection, HEAD-method
+  short-circuit; runs before any auction work
+
+### Modified
+
+- **`crates/trusted-server-core/src/publisher.rs`** — primary structural change:
+  - Convert `handle_publisher_request` from `fn` to `async fn`
+  - Switch origin fetch from `.send()` to `.send_async()` (returns
+    `PlatformPendingRequest`)
+  - Add `orchestrator: &AuctionOrchestrator` parameter
+  - Apply auction-eligibility gates (consent, bot UA, prefetch, method, slot match)
+  - Resolve EC cookie → KV lookup for EID enrichment; decorate `user.eids` on
+    `AuctionRequest`
+  - Match slots, fire auction (returns a future), origin fetch in parallel
+  - Coordinate the `</body>` hold: shared auction-result state populated by the
+    auction task; close-tag handler reads from it; outer flow holds chunk emission
+    past `</body>` until the state is populated or `A_deadline` fires
+  - Force chunked encoding on the response (strip `Content-Length`, set
+    `Transfer-Encoding: chunked`)
+- **`crates/trusted-server-adapter-fastly/src/main.rs`** — `.await` the now-async
+  publisher handler; pass orchestrator reference
+- **`crates/trusted-server-core/src/html_processor.rs`**:
+  - Inject `window.__ts_ad_slots` at `<head>` open via existing `el.prepend()` head
+    handler (no hold)
+  - Inject `window.__ts_bids` before `</body>` via lol_html's `el.on_end_tag()` on
+    the body element, reading from shared auction-result state
+  - Set `Cache-Control: private, max-age=0` on the assembled response
+  - Strip `Surrogate-Control` and `Fastly-Surrogate-Control` from the response
+- **`crates/trusted-server-core/src/integrations/gpt.rs`** — extend head injector to
+  emit `window.__ts_ad_slots` from matched slots; emit `__tsAdInit` bootstrap script
+- **`crates/js/lib/src/integrations/gpt/index.ts`** — add `__tsAdInit` function with
+  synchronous bid read, `slotRenderEnded` nurl + burl firing, `ts_initial` sentinel;
+  add lazy slim-Prebid loader scheduled for post-`window.load`
+- **`crates/trusted-server-core/src/integrations/prebid.rs`** — add
+  `suppress_nurl` per-bidder config (default `false`); **no server-side nurl firing
+  in the page-load path** (firing is client-side from `slotRenderEnded`)
+- **`trusted-server.toml`** — add `[creative_opportunities]` section
+- **`crates/trusted-server-core/src/settings.rs`** — add `CreativeOpportunitiesConfig`
+  to `Settings`
+
+### Deleted (relative to prior revision of this spec)
+
+- `crates/trusted-server-core/src/bid_cache.rs` — never created; in-process cache
+  approach was rejected
+- `/ts-bids` endpoint — never created
+- `request_id` UUID minting and `__ts_request_id` page injection — never created
+
+### Unchanged
+
+- `AuctionOrchestrator` internals — no changes; new call site only
+- PBS stored request configuration — bidder params remain in PBS, keyed by slot ID
+- GAM line item configuration — targeting key-values pass through unchanged
+
+---
+
+## 8. Edge Cases
+
+**No slots match the URL** — auction is not fired. `__ts_bids` is omitted. The page
+renders with `__ts_ad_slots` still absent (no slots = no slot config to inject); no
+`</body>` hold. Existing client-side Prebid/GPT flow runs unmodified (for publishers
+in dual-mode rollout).
+
+**Consent absent or denied** — auction is not fired. `__ts_bids` is omitted; `</body>`
+flushes immediately on origin emit. `Cache-Control: private, max-age=0` is still set.
+Page loads normally; GAM runs its own auction without TS targeting.
+
+**Bot / crawler User-Agent** — auction skipped. `__ts_bids` omitted; `</body>` flushes
+immediately. SSP QPS budget preserved. Crawlers typically don't render JS, but if they
+do, GPT runs without TS targeting.
+
+**Prefetch hint (`Sec-Purpose: prefetch` or `Purpose: prefetch`)** — auction skipped.
+Avoids burning auction inventory on speculative navigations that may never paint. If
+the user does click through, the actual click navigation is a fresh request and
+triggers a real auction.
+
+**HEAD request** — auction skipped; response carries headers only.
+
+**Auction times out with partial results (watchdog)** — `__ts_bids` includes whatever
+bids arrived before `A_deadline`. Slots with no bid are omitted. GPT fires without
+pre-set targeting for those slots; GAM falls back to its own auction.
+
+**Auction times out with zero results** — `__ts_bids = {}` injected. All slots fire
+GAM without bid targeting. No revenue impact beyond the timeout scenario itself.
+
+**Buffered origin (WordPress, Drupal, Rails, NextJS 14, static sites)** — origin
+returns full HTML in one response. TS strips `Content-Length`, sets
+`Transfer-Encoding: chunked`, and feeds the response through the streaming pipeline
+as chunks. From the browser's perspective, behavior is identical to a streaming
+origin. The `</body>` hold mechanic is identical. Auction runs in parallel with
+origin response; usually completes around the same time origin drains.
+
+**Streaming origin (NextJS 16, Remix, SvelteKit with streaming)** — origin emits HTML
+chunks progressively. TS forwards them through the streaming pipeline directly. No
+buffering at the edge before `</body>`. The `</body>` hold mechanic is identical.
+
+**SPA / pushState navigation** — pure client-side SPAs (CSR React/Vue, hashbang
+routing) don't issue an HTML request on route change, so TS never sees the
+navigation and no server-side auction fires for the new "page." All slots on
+SPA-routed views rely on slim-Prebid for both auction and identity. Streaming-SSR
+setups (Next.js App Router, etc.) that emit HTTP requests on route changes get the
+full TS-accelerated auction per route. The speed-win story differs by publisher
+architecture and should be confirmed during onboarding.
+
+**Bare-EC first impression** — a new EC with no prior partner sync hits the auction
+with `user.eids = []`. Bid stream lacks Tier 3 identity; CPMs may be 10–30% lower than
+enriched impressions. Subsequent navigations populate the EC graph. Measure via the
+`auction_eid_count` distribution.
+
+**BFCache restoration** — user navigates back to a TS-served page. Browser restores
+the page from BFCache (eligible because we set `private, max-age=0`, not `no-store`).
+Already-rendered ads display from the BFCache snapshot; no new GAM call fires; no new
+auction needed. `__ts_bids` in JS heap is stale but inert. This is the desired
+behavior — instant back-button restore for the user.
+
+**Slow origin (origin drain > A_deadline)** — `</body>` waits for origin regardless
+of auction state. Auction has more wall-clock budget; results more likely complete by
+the time origin drains. No extra hold beyond origin drain.
+
+**Slim-Prebid fails to load** — refresh auctions don't fire; initial-render
+impressions are unaffected. Publisher's existing GPT refresh logic (if any) takes
+over. Phase B identity refresh doesn't happen for that session — EC graph staleness
+shifts to next session's S2S sync.
+
+**`creative-opportunities.toml` missing or malformed** — startup fails with a clear
+error. No silent degradation.
+
+**Config empty (zero slots)** — treated as "no match" for all URLs; auction never
+fires. No error. Useful as a kill-switch: deploying an empty
+`creative-opportunities.toml` disables the feature without a code change.
+
+**Slot ID not found in PBS stored requests** — PBS returns a no-bid for that slot.
+Slot is omitted from `__ts_bids`. The remaining slots proceed normally.
+
+---
+
+## 9. Open Questions
+
+1. **URL pattern coverage** — does `/20**` cover all article paths, or are there
+   non-date-prefixed article URLs? Publisher to confirm per onboarding.
+2. **PBS stored request setup** — slot IDs in `creative-opportunities.toml` must have
+   corresponding stored requests configured in the publisher's PBS instance before
+   this goes live. Recommend a CI check or startup probe to PBS that lists stored
+   requests and diffs against the toml; tracked as a Phase 1 implementation item.
+3. **Homepage slot count** — the example shows slots 0 and 1. Are there additional
+   slots following the same pattern? Slot IDs and count to be confirmed with ad ops.
+4. **Auction timeout** — ✅ Resolved: dedicated key
+   `[creative_opportunities].auction_timeout_ms` with fallback to
+   `[auction].timeout_ms`. This value is also the upper bound on the `</body>` hold.
+   Per-provider ceilings (`[integrations.prebid].timeout_ms`,
+   `[integrations.aps].timeout_ms`) remain unchanged; the orchestrator's existing
+   `min(remaining_budget, provider_timeout)` logic applies.
+5. **KV-backed config migration path** — Phase 1 ships with `include_str!()` for
+   simplicity and cost. When ad ops require live slot edits between deploys, the
+   migration path is: load from `services.kv_store()` at request time with a
+   compiled-in fallback. Design tracked as a follow-up.
+6. **Server-side GAM** — the real latency ceiling beyond the auction is the GAM call
+   (`securepubads.g.doubleclick.net`, ~110ms RTT). Routing GAM through the edge would
+   eliminate that hop, but it requires Google agreement which is a business
+   negotiation, not an engineering decision. **Aspirational, not committed for any
+   phase.** The current architecture is shape-compatible (`__ts_ad_slots` gives the
+   edge full slot inventory) so no rework would be required if Google agrees later.
+7. **`tsjs-gpt` bootstrap delivery** — ✅ Resolved: `__tsAdInit` is part of the
+   existing `gpt` integration bundle, not a new integration. Injection order:
+   `window.__ts_ad_slots` (head) → existing GPT shim → `__tsAdInit` (head) →
+   `window.__ts_bids` (body close). Bid script can rely on `__tsAdInit` and slot
+   config being defined.
+8. **slim-Prebid bundle composition** — which userID modules ship in the lazy bundle?
+   Default candidates: ID5, sharedID, LiveRamp ATS, Lockr. Each adds bundle weight
+   (~10–25KB each). Publisher per-deployment override should be possible. Bundle
+   target size is "as small as possible while covering the publisher's enabled
+   identity providers." Tracked as a slim-Prebid build-system item.
+9. **Privacy Sandbox interaction** — Topics API (`Sec-Browsing-Topics`) can be read at
+   the edge and decorated into the bid stream as a future enhancement. Protected
+   Audience (FLEDGE) is on-device by design and cannot move server-side; it runs in
+   parallel client-side via slim-Prebid (when supported). Out of scope for Phase 1
+   beyond this acknowledgment.
+10. **Per-bidder consent resolution** — Phase 1 gates on TCF Purpose 1 globally.
+    Real-world consent is per-vendor, per-purpose, and interacts with Google Consent
+    Mode, USP_v2, and GPP. A bidder may be allowed for some purposes but not others.
+    Phase 2 should specify per-bidder consent-resolution rules and partial-consent
+    behavior. Tracked as a follow-up before Phase 2.
diff --git a/trusted-server.toml b/trusted-server.toml
index d9189aaa2..43e090fea 100644
--- a/trusted-server.toml
+++ b/trusted-server.toml
@@ -161,16 +161,16 @@ rewrite_script = true
 
 [auction]
 enabled = true
-providers = ["prebid"]
-# mediator = "adserver_mock"  # will use mediator when set
+providers = ["prebid", "aps"]
+mediator = "adserver_mock"
 timeout_ms = 2000
 # Context keys the JS client is allowed to forward into auction requests.
 # Keys not in this list are silently dropped. An empty list blocks all keys.
 allowed_context_keys = ["permutive_segments"]
 
 [integrations.aps]
-enabled = false
-pub_id = "your-aps-publisher-id"
+enabled = true
+pub_id = "test-pub"
 endpoint = "https://origin-mocktioneer.cdintel.com/e/dtb/bid"
 timeout_ms = 1000
 
@@ -180,7 +180,7 @@ container_id = "GTM-XXXXXX"
 # upstream_url = "https://www.googletagmanager.com"
 
 [integrations.adserver_mock]
-enabled = false
+enabled = true
 endpoint = "https://origin-mocktioneer.cdintel.com/adserver/mediate"
 timeout_ms = 1000
 
@@ -190,4 +190,8 @@ timeout_ms = 1000
 [integrations.adserver_mock.context_query_params]
 permutive_segments = "permutive"
 
+[creative_opportunities]
+gam_network_id = "88059007"
+auction_timeout_ms = 1500
+price_granularity = "dense"