Improve GPT auction diagnostics observability

[ChristianPavilonis]

Summary

• Link every creative badge to the same stable Ad #N in the TS Console panel and export.
• Add SSAT, SPA Trusted Server, client-side, and genuinely competing-auction classification with winning bidder and bucketed price facts.
• Surface session-gated server auction timings alongside clearly named GAM callback timings, and clean up 1×1 and size terminology.

This is stacked on #1076, which is stacked on #1074. Retarget this PR to main after those dependencies merge.

Changes

File	Change
crates/trusted-server-core/src/publisher.rs	Serialize initial and SPA auction timing facts, preserve generation safety, and gate SPA diagnostics on the active console session.
crates/trusted-server-js/lib/src/integrations/gpt/	Carry immutable auction facts through the initial scheduler and SPA page-bids path.
crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/	Validate, retain, classify, clone, and present auction diagnostics with stable slot numbering.
crates/trusted-server-js/lib/test/ and browser integration tests	Cover timing propagation, session gating, winner validation, classification, stable numbering, terminology, and export isolation.
docs/guide/integrations/gpt-diagnostics.md	Document auction labels, timing origins, winner/privacy boundaries, size behavior, and browser callback semantics.

Closes

Closes #1081

Test plan

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (898 passed, no type errors)
• JS lint/build: npm run lint && npm run build
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format/lint/build: cd docs && npm run format && npm run lint && npm run build
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Other: focused Next.js Playwright GPT diagnostics suite (3 passed)

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() added in production code
• Logging conventions preserved; no println! / eprintln! added
• New code has tests
• No secrets or credentials committed

[prk-Jr]

Summary

Solid, well-tested addition: stable Ad #N identity, auction classification, and server auction timings all land behind the existing activation gate, with a normalization boundary and tests for the malformed cases. No correctness, security, or WASM-compatibility problem found; all 14 CI checks pass. The findings below are all non-blocking — the substantive ones are about the SPA timing anchor and label accuracy in a tool whose value is precise facts.

1 of the inline comments below carries a one-click GitHub suggestion — use Commit suggestion to apply it as a commit on the PR branch. The remaining comments describe the fix in prose because the change touches test files, spans more than one hunk, or is a design choice rather than a mechanical edit.

Non-blocking

🤔 thinking

• SPA auctionDispatchedMs is always 0 by construction — see inline at crates/trusted-server-core/src/publisher.rs:6748
• Navigation T0 overstates the anchor — see inline at crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts:246
• The store infers ssat when auction facts are absent or malformed — see inline at crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts:1129
• 1x1 suppression conflates "GPT reported 1x1" with "GPT reported nothing" — see inline at crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts:9

♻️ refactor

• set_auction_diagnostics rebuilds the script cell and drops a debug prefix — see inline at crates/trusted-server-core/src/publisher.rs:3209 (suggestion)
• Placement wire string has two sources of truth — see inline at crates/trusted-server-core/src/publisher.rs:6767

⛏ nitpick

• Duplicated 5-arg / 6-arg recorder call — see inline at crates/trusted-server-js/lib/src/integrations/gpt/index.ts:1113
• Browser spec traded away its only non-1x1 fill-size case — see inline at crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts:223

👍 praise

• Stable Ad #N on re-entry, and fail-closed dispatch gating — see inline at crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts:1201

Cross-cutting / body-level findings

• 📝 Stacked base — this targets spec/auction-timeline-offsets (stacked on #1076 → #1074). Retarget to main after those land, as the description says. Nothing in the diff depends on that ordering beyond the base itself.
• 📝 Coverage of the server write path is complete — write_bids_to_state has exactly two production call sites (collect_non_html_auction, collect_stream_auction) and both are now paired with set_auction_diagnostics, so there is no document path that commits bids without the timing facts. Verified by grep rather than assumed.

CI Status

• browser integration tests: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• prepare integration artifacts: PASS
• cargo test: PASS
• cargo test (axum native): PASS
• cargo test (ts CLI, native): PASS
• cargo test (cross-adapter parity): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo fmt: PASS
• vitest: PASS
• format-typescript: PASS
• format-docs: PASS

gh pr checks --required returned no names for this base, so none of the above are annotated as branch-protection-required; all of them are gates CLAUDE.md treats as PR gates, and all pass.

[prk-Jr]

Verdict: APPROVE

Follow-up to the detailed review above, correcting its verdict: none of its findings are blocking (no 🔧 wrench, no ❓ question), and all 14 CI checks pass, so this should have been submitted as an approval rather than a comment.

Every inline comment there stands as written and remains worth reading — 4 🤔 thinking, 2 ♻️ refactor (one as a one-click suggestion), 2 ⛏ nitpick, 1 👍 praise — but each is a merge-can-proceed observation. The two most substantive, if you want to pick any of them up here rather than in a follow-up:

• SPA auctionDispatchedMs is a structural 0 (the clock is read on the line after it starts), which also makes auctionWaitMs a duplicate of auctionResolvedMs — crates/trusted-server-core/src/publisher.rs:6748.
• Navigation T0 in the panel is the edge request-receipt offset, not the browser's navigationStart — crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts:246.

Approved on ffc0438dd5f872e68c3ccad36d5c35bde47101d2.

[aram356]

@ChristianPavilonis please assign issue to this PR

[aram356]

Summary

Solid, well-tested expansion of the GPT diagnostics console: stable Ad #N identity across badge/panel/export, auction classification, winner and bucketed-price facts, and server auction timings. The privacy boundary is careful — bounded string lengths, a validated price-bucket shape, and timing normalization at the diagnostics boundary.

Two blocking issues: the SPA timing origin can be derived wrongly after a failed or superseded navigation, labelling navigation-T0 offsets as SPA-auction offsets; and the browser spec loses its only normal-fill-size coverage.

None of the inline comments below carry a one-click GitHub suggestion. Every fix either lands outside the diff hunks or spans a second file, so each is described in prose with the proposed code.

Blocking

🔧 wrench

• Stale navigation-T0 timings relabelled as SPA-auction timings — see inline at crates/trusted-server-js/lib/src/integrations/gpt/index.ts:1467
• Browser spec loses all normal-fill-size coverage — see inline at crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts:223

Non-blocking

🤔 thinking

• auctionDispatchedMs is structurally always 0 on the page-bids path — see inline at crates/trusted-server-core/src/publisher.rs:6748
• Page-bids hardcodes auctionWaitPlacement as a bare string literal — see inline at crates/trusted-server-core/src/publisher.rs:6766
• browser_session_active drops more eligibility guards than it needs to — see inline at crates/trusted-server-core/src/integrations/gpt_diagnostics.rs:296

♻️ refactor

• Redundant if/else around recordTrustedServerOpportunity — see inline at crates/trusted-server-js/lib/src/integrations/gpt/index.ts:1115-1132

📝 note

• Dead timing-origin fallback in the overlay — see inline at crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts:239

Cross-cutting / body-level findings

• 📝 Verified during review, no action needed — the following were checked against a scratch worktree at this head and are correct: slot-number reuse across eviction produces no slotOrder/slotActivityOrder duplicates at the MAX_DIAGNOSTIC_SLOTS boundary; set_auction_diagnostics cannot clobber the auction debug prefix (prepend_auction_debug_comment runs after it in collect_stream_auction, and collect_non_html_auction has no prepend); stripping the console cookie before handle_request_cookies is correctly ordered for the stated privacy goal; the added prepare_request call in handle_page_bids is genuinely idempotent via the extension cache, and all four adapters already call it pre-routing; the normalization boundary correctly rejects -1.00, 1e3, 1., .5 for priceBucket and negatives / NaN / > u32::MAX for timings; and elapsed_millis saturation (~49.7 days) is not a practical edge concern.

CI Status

• browser integration tests: PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo fmt: PASS
• cargo test: PASS
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native): PASS
• format-docs: PASS
• format-typescript: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• prepare integration artifacts: PASS
• vitest: PASS

Branch protection reports no required checks on this branch, so none of the above are marked (required).