diff --git a/Cargo.lock b/Cargo.lock
index b1382659d..411618e8b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1427,7 +1427,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "toml",
 ]
@@ -1435,7 +1435,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-axum"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1463,7 +1463,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-cloudflare"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1486,7 +1486,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-fastly"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1515,7 +1515,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-spin"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1542,7 +1542,7 @@ dependencies = [
 [[package]]
 name = "edgezero-cli"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "chrono",
  "clap",
@@ -1567,7 +1567,7 @@ dependencies = [
 [[package]]
 name = "edgezero-core"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "anyhow",
  "async-compression",
@@ -1598,7 +1598,7 @@ dependencies = [
 [[package]]
 name = "edgezero-macros"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.7#5c9886e51d17e6969531356bacdf27f144ac8a2e"
+source = "git+https://github.com/stackpop/edgezero?rev=9c03cc59300363ae5339fc970dded08ede563e98#9c03cc59300363ae5339fc970dded08ede563e98"
 dependencies = [
  "log",
  "proc-macro2",
diff --git a/Cargo.toml b/Cargo.toml
index d6ecdb9ca..39462c7fb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -55,12 +55,14 @@ cssparser = "0.36"
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
-edgezero-cli = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7" }
-edgezero-core = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.7", default-features = false }
+# Temporary integration pin for EdgeZero PR #389. Before merging TS into main,
+# replace all six pins with the approved EdgeZero release tag and revalidate.
+edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", rev = "9c03cc59300363ae5339fc970dded08ede563e98", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", rev = "9c03cc59300363ae5339fc970dded08ede563e98", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", rev = "9c03cc59300363ae5339fc970dded08ede563e98", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", rev = "9c03cc59300363ae5339fc970dded08ede563e98", default-features = false }
+edgezero-cli = { git = "https://github.com/stackpop/edgezero", rev = "9c03cc59300363ae5339fc970dded08ede563e98" }
+edgezero-core = { git = "https://github.com/stackpop/edgezero", rev = "9c03cc59300363ae5339fc970dded08ede563e98", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
diff --git a/crates/trusted-server-adapter-axum/src/timing.rs b/crates/trusted-server-adapter-axum/src/timing.rs
index 315ebb5ef..bcf873b8f 100644
--- a/crates/trusted-server-adapter-axum/src/timing.rs
+++ b/crates/trusted-server-adapter-axum/src/timing.rs
@@ -1,9 +1,10 @@
 //! Terminal timing layer for the Axum dev server.
 //!
 //! [`TimingService`](crate::timing::TimingService) wraps the tower `Service`
-//! boundary the Axum dev server's router sits behind: it creates a
+//! boundary the Axum dev server's router sits behind: it reuses the generic
+//! handle in request extensions or creates one, exposing it through the
 //! [`RequestTimings`](trusted_server_core::request_timing::RequestTimings)
-//! collector per request, threads it through request extensions so
+//! facade so
 //! downstream core handlers can record into it, and on the way back stamps
 //! `mark_headers_ready` and appends the `Server-Timing` header via
 //! [`append_server_timing_if_private`](trusted_server_core::request_timing::append_server_timing_if_private).
@@ -21,8 +22,8 @@
 //!
 //! `/health` is excluded by path match before a
 //! [`RequestTimings`](trusted_server_core::request_timing::RequestTimings)
-//! collector is even created: health checks never carry timing data on any
-//! adapter.
+//! collector is even created: this wrapper bypasses timing for every method
+//! on that path, leaving any preinstalled handle unchanged.
 //!
 //! Unlike the Fastly adapter (state built per request, adding
 //! `Phase::AppBuild` to the rendered header), the Axum dev server builds its
@@ -40,7 +41,7 @@ use tower::Service;
 use trusted_server_core::request_timing::{RequestTimings, append_server_timing_if_private};
 
 /// Path excluded from timing collection and `Server-Timing` emission: health
-/// checks never carry timing data on any adapter.
+/// checks bypass this wrapper for every method.
 const HEALTH_PATH: &str = "/health";
 
 /// Wraps an inner Axum tower service with the request-phase timing freeze
@@ -78,15 +79,18 @@ where
     fn call(&mut self, mut req: Request<AxumBody>) -> Self::Future {
         let mut inner = self.inner.clone();
 
-        // Excluded before a collector is even created: `/health` never
-        // carries timing data, on any adapter.
+        // Bypass installation and finalization for `/health`, regardless of method.
+        // A preinstalled collector remains available to the inner service.
         if req.uri().path() == HEALTH_PATH {
             return Box::pin(async move { inner.call(req).await });
         }
 
         let server_timing_enabled = self.server_timing_enabled;
-        let timings = RequestTimings::new();
-        req.extensions_mut().insert(timings.clone());
+        let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_else(|| {
+            let timings = RequestTimings::new();
+            req.extensions_mut().insert(timings.handle().clone());
+            timings
+        });
 
         Box::pin(async move {
             let mut response = inner.call(req).await?;
@@ -132,6 +136,69 @@ mod tests {
             .map(ToOwned::to_owned)
     }
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn axum_preserves_preinstalled_collector_and_origin() {
+        let timings = RequestTimings::new();
+        timings.record(
+            trusted_server_core::request_timing::Phase::Filter,
+            std::time::Duration::from_millis(7),
+        );
+        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+        let router = RouterService::builder()
+            .get("/private", |ctx: RequestContext| async move {
+                let timings = RequestTimings::from_extensions(ctx.request().extensions())
+                    .expect("should receive preinstalled collector");
+                assert_eq!(
+                    timings.snapshot().filter_ms,
+                    Some(7),
+                    "should preserve upstream phase"
+                );
+                timings.mark_auction_dispatched();
+                assert!(
+                    timings
+                        .snapshot()
+                        .auction_dispatched_ms
+                        .expect("should mark dispatch")
+                        >= 20,
+                    "should preserve the pre-aged origin"
+                );
+                private_ok_response()
+            })
+            .build();
+        let terminal = TimingService::new(EdgeZeroAxumService::new(router), true);
+        let upstream_timings = timings.clone();
+        let mut upstream = service_fn(move |mut req: Request<AxumBody>| {
+            req.extensions_mut()
+                .insert(upstream_timings.handle().clone());
+            let mut service = terminal.clone();
+            async move { service.call(req).await }
+        });
+        let request = Request::builder()
+            .uri("/private")
+            .body(AxumBody::empty())
+            .expect("should build request");
+        let response = upstream
+            .ready()
+            .await
+            .expect("should be ready")
+            .call(request)
+            .await
+            .expect("should handle request");
+        let value = header(&response, "server-timing").expect("should render private timing");
+        assert!(
+            value.contains("ts-filter;dur=7.0"),
+            "should render upstream phase: {value}"
+        );
+        assert!(
+            timings
+                .snapshot()
+                .time_elapsed_ms
+                .expect("should stamp original handle")
+                >= 20,
+            "terminal rendering should use the original clock"
+        );
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn axum_emits_header_on_private_response() {
         let router = RouterService::builder()
@@ -201,7 +268,7 @@ mod tests {
         // here instead of silently losing every phase.
         let router = RouterService::builder()
             .get("/private", |ctx: RequestContext| async move {
-                if let Some(timings) = ctx.request().extensions().get::<RequestTimings>() {
+                if let Some(timings) = RequestTimings::from_extensions(ctx.request().extensions()) {
                     timings.record(
                         trusted_server_core::request_timing::Phase::Filter,
                         std::time::Duration::from_millis(7),
@@ -283,28 +350,50 @@ mod tests {
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn axum_health_is_excluded() {
-        let router = RouterService::builder()
-            .get("/health", |_ctx: RequestContext| async {
-                private_ok_response()
-            })
-            .build();
-        let mut service = TimingService::new(EdgeZeroAxumService::new(router), true);
-
-        let request = Request::builder()
-            .uri("/health")
-            .body(AxumBody::empty())
-            .expect("should build request");
-        let response = service
-            .ready()
-            .await
-            .expect("should be ready")
-            .call(request)
-            .await
-            .expect("should not fail");
-
-        assert!(
-            header(&response, "server-timing").is_none(),
-            "/health must never carry a server-timing header"
-        );
+        for method in [axum::http::Method::GET, axum::http::Method::POST] {
+            for path in ["/health", "/health?probe=1"] {
+                for preinstalled in [false, true] {
+                    let timings = RequestTimings::new();
+                    let inner = service_fn(move |req: Request<AxumBody>| async move {
+                        assert_eq!(
+                            RequestTimings::from_extensions(req.extensions()).is_some(),
+                            preinstalled,
+                            "health bypass should not install or remove a handle"
+                        );
+                        Ok::<_, Infallible>(
+                            Response::builder()
+                                .header("cache-control", "private")
+                                .body(AxumBody::empty())
+                                .expect("should build private response"),
+                        )
+                    });
+                    let mut service = TimingService::new(inner, true);
+                    let mut request = Request::builder()
+                        .method(method.clone())
+                        .uri(path)
+                        .body(AxumBody::empty())
+                        .expect("should build request");
+                    if preinstalled {
+                        request.extensions_mut().insert(timings.handle().clone());
+                    }
+                    let response = service
+                        .ready()
+                        .await
+                        .expect("should be ready")
+                        .call(request)
+                        .await
+                        .expect("should not fail");
+                    assert!(
+                        header(&response, "server-timing").is_none(),
+                        "health should not emit timing"
+                    );
+                    assert_eq!(
+                        timings.snapshot().time_elapsed_ms,
+                        None,
+                        "health bypass should not finalize timing"
+                    );
+                }
+            }
+        }
     }
 }
diff --git a/crates/trusted-server-adapter-cloudflare/src/app.rs b/crates/trusted-server-adapter-cloudflare/src/app.rs
index a3457ef7c..aab63514c 100644
--- a/crates/trusted-server-adapter-cloudflare/src/app.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/app.rs
@@ -34,6 +34,7 @@ use trusted_server_core::publisher::{
 use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
 };
+use trusted_server_core::request_timing::RequestTimingMiddleware;
 use trusted_server_core::settings::Settings;
 
 use crate::middleware::{AuthMiddleware, FinalizeResponseMiddleware, SanitizeRequestMiddleware};
@@ -467,6 +468,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // any middleware registered ahead of it would observe the
             // shared-secret authentication header.
             .middleware(SanitizeRequestMiddleware::new(Arc::clone(&state.settings)))
+            .middleware(RequestTimingMiddleware::default().with_excluded_paths(&["/health"]))
             .middleware(FinalizeResponseMiddleware::new(Arc::clone(&state.settings)))
             .middleware(AuthMiddleware::new(Arc::clone(&state.settings)))
             .get(
diff --git a/crates/trusted-server-adapter-cloudflare/src/middleware.rs b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
index 14efed56a..51a5956d1 100644
--- a/crates/trusted-server-adapter-cloudflare/src/middleware.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
@@ -56,9 +56,9 @@ impl Middleware for SanitizeRequestMiddleware {
 /// (injected by the Cloudflare Workers runtime). On the native host target the
 /// header is absent, so `X-Geo-Info-Available: false` is emitted.
 ///
-/// Registered directly inside [`SanitizeRequestMiddleware`] and ahead of
-/// [`AuthMiddleware`] so that every outgoing response — including auth-rejected
-/// ones — carries a consistent set of headers.
+/// Registered inside [`RequestTimingMiddleware`](trusted_server_core::request_timing::RequestTimingMiddleware) and ahead of [`AuthMiddleware`]
+/// so that every outgoing response — including auth-rejected ones — carries a
+/// consistent set of headers.
 pub struct FinalizeResponseMiddleware {
     settings: Arc<Settings>,
 }
@@ -161,6 +161,8 @@ pub(crate) fn apply_finalize_headers(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use edgezero_core::router::RouterService;
+    use trusted_server_core::request_timing::{RequestTimingMiddleware, RequestTimings};
 
     use std::collections::HashMap;
     use std::sync::Mutex;
@@ -180,10 +182,10 @@ mod tests {
             .expect("should build empty test response")
     }
 
-    fn empty_ctx() -> RequestContext {
+    fn ctx_for_path(path: &str) -> RequestContext {
         let req = request_builder()
             .method(Method::GET)
-            .uri("/test")
+            .uri(path)
             .header("x-reader-ip", "198.51.100.7")
             .header("x-reader-ip-auth", "fictional-shared-secret-0123456789")
             .body(Body::empty())
@@ -191,6 +193,10 @@ mod tests {
         RequestContext::new(req, PathParams::new(HashMap::new()))
     }
 
+    fn empty_ctx() -> RequestContext {
+        ctx_for_path("/test")
+    }
+
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
         // Build from explicit test settings: the settings baked into the
         // binary contain placeholder secrets that `get_settings()` rejects
@@ -289,6 +295,77 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_timing_middleware_preserves_shared_handle_and_health_policy() {
+        for method in [Method::GET, Method::POST] {
+            for path in ["/test", "/health", "/health?probe=1", "/health/child"] {
+                for preinstalled in [false, true] {
+                    let route_path = path.split('?').next().expect("should have path");
+                    let expected = preinstalled || route_path != "/health";
+                    let timings = RequestTimings::new();
+                    timings.record(
+                        trusted_server_core::request_timing::Phase::Filter,
+                        std::time::Duration::from_millis(7),
+                    );
+                    std::thread::sleep(std::time::Duration::from_millis(2));
+                    let router = RouterService::builder()
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .route(route_path, method.clone(), move |ctx: RequestContext| async move {
+                            let installed = RequestTimings::from_extensions(ctx.request().extensions());
+                            assert_eq!(installed.is_some(), expected, "should preserve exact health policy");
+                            if let Some(installed) = installed {
+                                if preinstalled {
+                                    assert_eq!(installed.snapshot().filter_ms, Some(7), "should retain upstream facts");
+                                    installed.mark_auction_dispatched();
+                                    assert!(installed.snapshot().auction_dispatched_ms.expect("should mark dispatch") >= 2,
+                                        "should retain upstream origin");
+                                } else {
+                                    assert_eq!(installed.snapshot(), trusted_server_core::request_timing::TimingSnapshot::default(),
+                                        "should install independent empty facts");
+                                }
+                                installed.record_auction_wait(
+                                    trusted_server_core::request_timing::AuctionWaitPlacement::PreHeader,
+                                    std::time::Duration::from_millis(3));
+                            }
+                            Ok::<Response, EdgeError>(empty_response())
+                        })
+                        .build();
+                    let mut request = request_builder()
+                        .method(method.clone())
+                        .uri(path)
+                        .body(Body::empty())
+                        .expect("should build request");
+                    if preinstalled {
+                        request.extensions_mut().insert(timings.handle().clone());
+                    }
+                    let response =
+                        block_on(router.oneshot(request)).expect("should dispatch request");
+                    assert!(
+                        response.headers().get("server-timing").is_none(),
+                        "attachment should not expose timing"
+                    );
+                    if preinstalled {
+                        assert_eq!(
+                            timings.snapshot().auction_wait_ms,
+                            Some(3),
+                            "should share handler updates"
+                        );
+                        assert_eq!(
+                            timings.snapshot().request_elapsed_ms,
+                            None,
+                            "should not fabricate completion"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn sanitize_middleware_strips_configured_trust_headers_before_routing() {
         let mut settings = settings_with_response_headers(vec![]);
diff --git a/crates/trusted-server-adapter-fastly/src/app.rs b/crates/trusted-server-adapter-fastly/src/app.rs
index b2221de8d..fdf84f762 100644
--- a/crates/trusted-server-adapter-fastly/src/app.rs
+++ b/crates/trusted-server-adapter-fastly/src/app.rs
@@ -440,11 +440,7 @@ fn build_ec_request_state(
     let eids_cookie = crate::extract_cookie_value(req, COOKIE_TS_EIDS);
     let sharedid_cookie = crate::extract_cookie_value(req, COOKIE_SHAREDID);
 
-    let timings = req
-        .extensions()
-        .get::<RequestTimings>()
-        .cloned()
-        .unwrap_or_default();
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
     let geo_info = {
         let _span = timings.span(Phase::Geo);
         services
@@ -529,11 +525,7 @@ async fn run_pre_route_filters(
 ) -> PreRoute {
     // Only recorded when a filter is actually registered, so unconfigured
     // deployments omit ts-filter from the Server-Timing header entirely.
-    let timings = req
-        .extensions()
-        .get::<RequestTimings>()
-        .cloned()
-        .unwrap_or_default();
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
     let _span = state
         .registry
         .has_request_filters()
@@ -609,11 +601,8 @@ async fn execute_named(
                     // Deliberately do not use an EC request-state graph: that
                     // copy is bot-gated, while operators use curl for this
                     // authenticated diagnostic.
-                    let timings = req
-                        .extensions()
-                        .get::<RequestTimings>()
-                        .cloned()
-                        .unwrap_or_default();
+                    let timings =
+                        RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
                     let kv = crate::identity_graph_with_timing(&state.settings, &timings);
                     handle_admin_ec_lookup(kv.as_ref(), &registry, &req)
                 }
@@ -685,11 +674,7 @@ async fn run_named_route(
             if req.method() == Method::OPTIONS {
                 cors_preflight_identify(&state.settings, &req)
             } else {
-                let timings = req
-                    .extensions()
-                    .get::<RequestTimings>()
-                    .cloned()
-                    .unwrap_or_default();
+                let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
                 let kv = crate::require_identity_graph_with_timing(&state.settings, &timings)?;
                 let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
                 handle_identify(
@@ -707,11 +692,7 @@ async fn run_named_route(
             // The auction reads consent data, so the consent KV store must be
             // available — fail closed with 503 when it is configured but
             // cannot be opened, matching legacy behavior.
-            let timings = req
-                .extensions()
-                .get::<RequestTimings>()
-                .cloned()
-                .unwrap_or_default();
+            let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
             let consent_services =
                 runtime_services_for_consent_route(&state.settings, services, &timings)?;
             let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
@@ -741,11 +722,7 @@ async fn run_named_route(
             // Like the auction, page-bids reads consent data, so the consent KV
             // store must be available — fail closed with 503 when configured but
             // unopenable, matching legacy.
-            let timings = req
-                .extensions()
-                .get::<RequestTimings>()
-                .cloned()
-                .unwrap_or_default();
+            let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
             let consent_services =
                 runtime_services_for_consent_route(&state.settings, services, &timings)?;
             let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
@@ -792,11 +769,7 @@ fn run_batch_sync(state: &AppState, services: &RuntimeServices, req: Request) ->
     let is_real_browser = device_signals.looks_like_browser();
     let eids_cookie = crate::extract_cookie_value(&req, COOKIE_TS_EIDS);
     let sharedid_cookie = crate::extract_cookie_value(&req, COOKIE_SHAREDID);
-    let timings = req
-        .extensions()
-        .get::<RequestTimings>()
-        .cloned()
-        .unwrap_or_default();
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
 
     let result =
         crate::require_identity_graph_with_timing(&state.settings, &timings).and_then(|kv| {
@@ -962,11 +935,7 @@ async fn dispatch_fallback(
         // Publisher pages read consent data, so the consent KV store must be
         // available — fail closed with 503 when it is configured but cannot
         // be opened, matching legacy behavior.
-        let timings = req
-            .extensions()
-            .get::<RequestTimings>()
-            .cloned()
-            .unwrap_or_default();
+        let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
         match runtime_services_for_consent_route(&state.settings, services, &timings) {
             Ok(publisher_services) => {
                 // Run the server-side auction with the configured creative-
@@ -3558,7 +3527,7 @@ mod tests {
             .build();
         let mut req = empty_request(Method::GET, "/some-page");
         let timings = RequestTimings::new();
-        req.extensions_mut().insert(timings.clone());
+        req.extensions_mut().insert(timings.handle().clone());
 
         let _ = block_on(super::run_pre_route_filters(
             &state, &services, &mut req, None,
@@ -3586,7 +3555,7 @@ mod tests {
             .build();
         let mut req = empty_request(Method::GET, "/some-page");
         let timings = RequestTimings::new();
-        req.extensions_mut().insert(timings.clone());
+        req.extensions_mut().insert(timings.handle().clone());
 
         let _ = block_on(super::run_pre_route_filters(
             &state, &services, &mut req, None,
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index 8cd2b39d0..4b6230bf5 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -215,7 +215,7 @@ fn edgezero_main(mut req: FastlyRequest, env: &EnvConfig) {
             core_req.extensions_mut().insert(config_store);
             core_req.extensions_mut().insert(device_signals);
             core_req.extensions_mut().insert(client_info);
-            core_req.extensions_mut().insert(timings.clone());
+            core_req.extensions_mut().insert(timings.handle().clone());
             match futures::executor::block_on(app.router().oneshot(core_req)) {
                 Ok(response) => response,
                 Err(error) => edge_error_response(error),
@@ -1100,6 +1100,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn health_short_circuit_is_get_only_and_ignores_query() {
+        for path in ["/health", "/health?probe=1"] {
+            let url = format!("https://example.com{path}");
+            assert!(
+                health_response(&FastlyRequest::get(&url)).is_some(),
+                "should bypass GET health"
+            );
+            assert!(
+                health_response(&FastlyRequest::post(&url)).is_none(),
+                "should time non-GET health normally"
+            );
+        }
+    }
+
     #[test]
     fn health_response_ignores_non_health_paths() {
         let req = FastlyRequest::get("https://example.com/auction");
diff --git a/crates/trusted-server-adapter-fastly/src/middleware.rs b/crates/trusted-server-adapter-fastly/src/middleware.rs
index 7bd577363..17ed2abf3 100644
--- a/crates/trusted-server-adapter-fastly/src/middleware.rs
+++ b/crates/trusted-server-adapter-fastly/src/middleware.rs
@@ -72,12 +72,8 @@ impl Middleware for FinalizeResponseMiddleware {
             || FastlyRequestContext::get(ctx.request()).and_then(|c| c.client_ip),
             |info| info.client_ip,
         );
-        let timings = ctx
-            .request()
-            .extensions()
-            .get::<RequestTimings>()
-            .cloned()
-            .unwrap_or_default();
+        let timings =
+            RequestTimings::from_extensions(ctx.request().extensions()).unwrap_or_default();
 
         let mut response = match next.run(ctx).await {
             Ok(r) => r,
diff --git a/crates/trusted-server-adapter-spin/src/app.rs b/crates/trusted-server-adapter-spin/src/app.rs
index 8917f2a65..b21c94a2b 100644
--- a/crates/trusted-server-adapter-spin/src/app.rs
+++ b/crates/trusted-server-adapter-spin/src/app.rs
@@ -33,6 +33,7 @@ use trusted_server_core::publisher::{
 use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
 };
+use trusted_server_core::request_timing::RequestTimingMiddleware;
 use trusted_server_core::settings::Settings;
 
 use crate::middleware::{
@@ -773,6 +774,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
             // any middleware registered ahead of it would observe the
             // shared-secret authentication header.
             .middleware(SanitizeRequestMiddleware::new(Arc::clone(&state.settings)))
+            .middleware(RequestTimingMiddleware::default().with_excluded_paths(&["/health"]))
             .middleware(FinalizeResponseMiddleware::new(Arc::clone(&state.settings)))
             .middleware(AuthMiddleware::new(Arc::clone(&state.settings)))
             // Innermost middleware: normalize every routed request (strip
diff --git a/crates/trusted-server-adapter-spin/src/middleware.rs b/crates/trusted-server-adapter-spin/src/middleware.rs
index d7a09987a..418d63c88 100644
--- a/crates/trusted-server-adapter-spin/src/middleware.rs
+++ b/crates/trusted-server-adapter-spin/src/middleware.rs
@@ -55,9 +55,9 @@ impl Middleware for SanitizeRequestMiddleware {
 /// Spin does not expose geo headers to the application, so
 /// `X-Geo-Info-Available: false` is emitted for every response.
 ///
-/// Registered directly inside [`SanitizeRequestMiddleware`] and ahead of
-/// [`AuthMiddleware`] so that every outgoing response — including auth-rejected
-/// ones — carries a consistent set of headers.
+/// Registered inside [`RequestTimingMiddleware`](trusted_server_core::request_timing::RequestTimingMiddleware) and ahead of [`AuthMiddleware`]
+/// so that every outgoing response — including auth-rejected ones — carries a
+/// consistent set of headers.
 pub struct FinalizeResponseMiddleware {
     settings: Arc<Settings>,
 }
@@ -188,6 +188,8 @@ pub(crate) fn apply_finalize_headers(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use edgezero_core::router::RouterService;
+    use trusted_server_core::request_timing::{RequestTimingMiddleware, RequestTimings};
 
     use std::collections::HashMap;
     use std::sync::Mutex;
@@ -207,10 +209,10 @@ mod tests {
             .expect("should build empty test response")
     }
 
-    fn empty_ctx() -> RequestContext {
+    fn ctx_for_path(path: &str) -> RequestContext {
         let req = request_builder()
             .method(Method::GET)
-            .uri("/test")
+            .uri(path)
             .header("x-reader-ip", "198.51.100.7")
             .header("x-reader-ip-auth", "fictional-shared-secret-0123456789")
             .body(Body::empty())
@@ -218,6 +220,10 @@ mod tests {
         RequestContext::new(req, PathParams::new(HashMap::new()))
     }
 
+    fn empty_ctx() -> RequestContext {
+        ctx_for_path("/test")
+    }
+
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
         // Build from explicit test settings: the settings baked into the
         // binary contain placeholder secrets that `get_settings()` rejects
@@ -316,6 +322,77 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_timing_middleware_preserves_shared_handle_and_health_policy() {
+        for method in [Method::GET, Method::POST] {
+            for path in ["/test", "/health", "/health?probe=1", "/health/child"] {
+                for preinstalled in [false, true] {
+                    let route_path = path.split('?').next().expect("should have path");
+                    let expected = preinstalled || route_path != "/health";
+                    let timings = RequestTimings::new();
+                    timings.record(
+                        trusted_server_core::request_timing::Phase::Filter,
+                        std::time::Duration::from_millis(7),
+                    );
+                    std::thread::sleep(std::time::Duration::from_millis(2));
+                    let router = RouterService::builder()
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .middleware(
+                            RequestTimingMiddleware::default().with_excluded_paths(&["/health"]),
+                        )
+                        .route(route_path, method.clone(), move |ctx: RequestContext| async move {
+                            let installed = RequestTimings::from_extensions(ctx.request().extensions());
+                            assert_eq!(installed.is_some(), expected, "should preserve exact health policy");
+                            if let Some(installed) = installed {
+                                if preinstalled {
+                                    assert_eq!(installed.snapshot().filter_ms, Some(7), "should retain upstream facts");
+                                    installed.mark_auction_dispatched();
+                                    assert!(installed.snapshot().auction_dispatched_ms.expect("should mark dispatch") >= 2,
+                                        "should retain upstream origin");
+                                } else {
+                                    assert_eq!(installed.snapshot(), trusted_server_core::request_timing::TimingSnapshot::default(),
+                                        "should install independent empty facts");
+                                }
+                                installed.record_auction_wait(
+                                    trusted_server_core::request_timing::AuctionWaitPlacement::PreHeader,
+                                    std::time::Duration::from_millis(3));
+                            }
+                            Ok::<Response, EdgeError>(empty_response())
+                        })
+                        .build();
+                    let mut request = request_builder()
+                        .method(method.clone())
+                        .uri(path)
+                        .body(Body::empty())
+                        .expect("should build request");
+                    if preinstalled {
+                        request.extensions_mut().insert(timings.handle().clone());
+                    }
+                    let response =
+                        block_on(router.oneshot(request)).expect("should dispatch request");
+                    assert!(
+                        response.headers().get("server-timing").is_none(),
+                        "attachment should not expose timing"
+                    );
+                    if preinstalled {
+                        assert_eq!(
+                            timings.snapshot().auction_wait_ms,
+                            Some(3),
+                            "should share handler updates"
+                        );
+                        assert_eq!(
+                            timings.snapshot().request_elapsed_ms,
+                            None,
+                            "should not fabricate completion"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn sanitize_middleware_strips_configured_trust_headers_before_routing() {
         let mut settings = settings_with_response_headers(vec![]);
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index fe42fc6b7..9de8dbab9 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -151,11 +151,7 @@ pub async fn handle_auction(
     // fetch, and the commit mark lands once the OpenRTB response carrying the
     // targeting has been built. A defaulted handle records into nothing that
     // is ever read, so direct-handler tests are unaffected.
-    let timings = parts
-        .extensions
-        .get::<RequestTimings>()
-        .cloned()
-        .unwrap_or_default();
+    let timings = RequestTimings::from_extensions(&parts.extensions).unwrap_or_default();
     let body_bytes = body.into_bytes().unwrap_or_default();
     if body_bytes.len() > MAX_AUCTION_BODY_SIZE {
         return Response::builder()
diff --git a/crates/trusted-server-core/src/integrations/gpt_bootstrap.js b/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
index 2475c5082..4d887b970 100644
--- a/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
+++ b/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
@@ -117,7 +117,7 @@
   // and deliberately identical to the bundle scheduler — the impression is
   // spent on a viewed tab, and the post-hydration guarantee holds whenever
   // the request is actually issued.
-  ts.scheduleInitialAdInit = function (initialBids, initialSlots) {
+  ts.scheduleInitialAdInit = function (initialBids, initialSlots, initialAuctionDiagnostics) {
     // The bundle may replace this scheduler after the fallback claims the initial
     // pass. Keep the latch on the shared document API so replacement cannot reset it.
     if ((ts.navGeneration || 0) !== 0 || ts.initialAdInitScheduled) return;
@@ -127,6 +127,9 @@
     // would overwrite a committed SPA navigation's slots.
     if (initialSlots !== undefined) ts.adSlots = initialSlots;
     if (initialBids !== undefined) ts.bids = initialBids;
+    if (initialAuctionDiagnostics !== undefined) {
+      ts.auctionDiagnostics = initialAuctionDiagnostics;
+    }
     var fire = function () {
       if ((ts.navGeneration || 0) !== 0) return;
       if (typeof ts.adInit === "function") ts.adInit();
diff --git a/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs b/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs
index b4a188f2a..b98e3cbbb 100644
--- a/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs
+++ b/crates/trusted-server-core/src/integrations/gpt_diagnostics.rs
@@ -62,6 +62,7 @@ pub enum GptDiagnosticsCookieAction {
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct GptDiagnosticsRequestDecision {
     active: bool,
+    browser_session_active: bool,
     clean_browser_path_and_query: Option<String>,
     cookie_action: GptDiagnosticsCookieAction,
 }
@@ -73,6 +74,16 @@ impl GptDiagnosticsRequestDecision {
         self.active
     }
 
+    /// Whether this request came from an activated diagnostics browser session.
+    ///
+    /// Unlike [`Self::active`], this remains true for non-document requests such
+    /// as the SPA page-bids fetch. It is captured before the private activation
+    /// cookie is stripped from the request.
+    #[must_use]
+    pub(crate) fn browser_session_active(&self) -> bool {
+        self.browser_session_active
+    }
+
     /// Whether the response must be private and non-storeable.
     #[must_use]
     pub fn requires_private_no_store(&self) -> bool {
@@ -121,6 +132,7 @@ impl GptDiagnosticsRequestDecision {
     pub(crate) fn active_for_tests() -> Self {
         Self {
             active: true,
+            browser_session_active: true,
             clean_browser_path_and_query: None,
             cookie_action: GptDiagnosticsCookieAction::None,
         }
@@ -143,6 +155,7 @@ mod head_seam_invariant_tests {
                 ] {
                     out.push(GptDiagnosticsRequestDecision {
                         active,
+                        browser_session_active: active,
                         clean_browser_path_and_query: clean.clone(),
                         cookie_action,
                     });
@@ -279,12 +292,19 @@ pub fn prepare_request(
         replace_path_and_query(request, &clean_path)?;
     }
 
-    let mut decision = GptDiagnosticsRequestDecision::default();
+    let mut decision = GptDiagnosticsRequestDecision {
+        browser_session_active: integration_enabled
+            && directive == QueryDirective::Absent
+            && cookie_state.occurrences == 1
+            && cookie_state.canonical,
+        ..GptDiagnosticsRequestDecision::default()
+    };
     if integration_enabled && eligible_navigation && had_reserved_query {
         decision.clean_browser_path_and_query = Some(clean_path);
         match directive {
             QueryDirective::Enable => {
                 decision.active = true;
+                decision.browser_session_active = true;
                 decision.cookie_action = GptDiagnosticsCookieAction::SetSession;
             }
             QueryDirective::Disable => {
@@ -542,6 +562,22 @@ mod tests {
         assert_eq!(duplicate.headers()[header::COOKIE], "other=value");
     }
 
+    #[test]
+    fn active_cookie_marks_non_document_requests_without_activating_document_behavior() {
+        let mut request = Request::builder()
+            .method(Method::GET)
+            .uri("https://publisher.example/_ts/page-bids?path=/article")
+            .header(header::COOKIE, "__Host-ts-console=1; other=value")
+            .body(EdgeBody::empty())
+            .expect("should build page-bids request");
+
+        let decision = prepare_request(&settings(true), &mut request).expect("should prepare");
+
+        assert!(!decision.active());
+        assert!(decision.browser_session_active());
+        assert_eq!(request.headers()[header::COOKIE], "other=value");
+    }
+
     #[test]
     fn invalid_duplicate_and_disable_directives_fail_closed() {
         for query in [
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index e367552e8..03cafe266 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -3163,6 +3163,44 @@ fn request_origin(scheme: &str, host: &str) -> String {
 /// JSON for every non-empty map; `serde_json::from_str` failed and `unwrap_or_default()`
 /// turned the failure into `{}`. Shared modes therefore served **zero bids**, silently,
 /// on every request that had any. Every fixture had empty bids, so nothing caught it.
+#[derive(Clone, Debug, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+struct BrowserAuctionDiagnostics {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_dispatched_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_resolved_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_committed_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_wait_ms: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    auction_wait_placement: Option<&'static str>,
+}
+
+const fn auction_wait_placement_wire(placement: AuctionWaitPlacement) -> &'static str {
+    match placement {
+        AuctionWaitPlacement::PreHeader => "pre_header",
+        AuctionWaitPlacement::InStream => "in_stream",
+    }
+}
+
+impl BrowserAuctionDiagnostics {
+    fn from_request_timings(timings: &RequestTimings) -> Option<Self> {
+        let snapshot = timings.snapshot();
+        snapshot.auction_dispatched_ms?;
+        Some(Self {
+            auction_dispatched_ms: snapshot.auction_dispatched_ms,
+            auction_resolved_ms: snapshot.auction_resolved_ms,
+            auction_committed_ms: snapshot.auction_committed_ms,
+            auction_wait_ms: snapshot.auction_wait_ms,
+            auction_wait_placement: snapshot
+                .auction_wait_placement
+                .map(auction_wait_placement_wire),
+        })
+    }
+}
+
 #[derive(Clone, Default)]
 pub(crate) struct AdBidsState {
     /// Rendered bids `<script>`. Shared with the HTML processor's `</body>` handler,
@@ -3173,6 +3211,10 @@ pub(crate) struct AdBidsState {
     bids: Arc<Mutex<serde_json::Map<String, serde_json::Value>>>,
     /// Optional per-request diagnostics emitted before either bids-script shape.
     debug_prefix: Arc<Mutex<String>>,
+    /// Server auction facts handed to the generation-guarded client scheduler.
+    auction_diagnostics: Arc<Mutex<Option<BrowserAuctionDiagnostics>>>,
+    /// Whether this request activated the private diagnostics module.
+    diagnostics_active: bool,
 }
 
 #[cfg(test)]
@@ -3187,6 +3229,13 @@ impl AdBidsState {
 }
 
 impl AdBidsState {
+    fn with_diagnostics(diagnostics_active: bool) -> Self {
+        Self {
+            diagnostics_active,
+            ..Self::default()
+        }
+    }
+
     /// The cell the HTML processor reads at the `</body>` seam.
     pub(crate) fn script_cell(&self) -> &Arc<Mutex<Option<String>>> {
         &self.script
@@ -3195,11 +3244,38 @@ impl AdBidsState {
     /// Record one auction result, rendering the script from the same map that is
     /// stored, so the two representations cannot drift.
     fn set(&self, bid_map: serde_json::Map<String, serde_json::Value>) {
-        let bids_script = build_bids_script(&bid_map);
+        let auction_diagnostics = self
+            .auction_diagnostics
+            .lock()
+            .expect("should lock auction diagnostics")
+            .clone();
+        let bids_script =
+            build_bids_script_with_diagnostics(&bid_map, auction_diagnostics.as_ref());
         *self.script.lock().expect("should lock bid script") = Some(bids_script);
         *self.bids.lock().expect("should lock bid map") = bid_map;
     }
 
+    /// Attach server auction facts to the rendered bid script.
+    ///
+    /// This rebuilds the script cell, so callers must run it before
+    /// [`Self::prepend_to_script`] to preserve an existing debug prefix.
+    fn set_auction_diagnostics(&self, timings: &RequestTimings) {
+        if !self.diagnostics_active {
+            return;
+        }
+        let Some(diagnostics) = BrowserAuctionDiagnostics::from_request_timings(timings) else {
+            return;
+        };
+        let bids = self.bids();
+        *self.script.lock().expect("should lock bid script") = Some(
+            build_bids_script_with_diagnostics(&bids, Some(&diagnostics)),
+        );
+        *self
+            .auction_diagnostics
+            .lock()
+            .expect("should lock auction diagnostics") = Some(diagnostics);
+    }
+
     /// The structured bids the shared-template seam splices into the marker.
     ///
     /// Empty when no auction has been collected, which is the same payload the inline
@@ -3210,7 +3286,16 @@ impl AdBidsState {
 
     /// Build the shared-template seam, retaining the same debug prefix as inline.
     fn build_seam_script(&self, slots_json: &str) -> String {
-        let seam = build_seam_script(slots_json, &self.bids());
+        let auction_diagnostics = self
+            .auction_diagnostics
+            .lock()
+            .expect("should lock auction diagnostics")
+            .clone();
+        let seam = build_seam_script_with_diagnostics(
+            slots_json,
+            &self.bids(),
+            auction_diagnostics.as_ref(),
+        );
         let prefix = self
             .debug_prefix
             .lock()
@@ -4014,6 +4099,9 @@ async fn collect_non_html_auction(
     // T0-anchored timeline mark (spec section 18): winning bids are in page
     // state, available to the response pipeline.
     params.timings.mark_auction_committed();
+    params
+        .ad_bids_state
+        .set_auction_diagnostics(&params.timings);
     if let (Some(observation), Some(auction_request)) =
         (telemetry.observation, telemetry.auction_request.as_ref())
     {
@@ -4082,6 +4170,7 @@ async fn collect_stream_auction(
     // T0-anchored timeline mark (spec section 18): winning bids are in page
     // state, available to the response pipeline.
     timings.mark_auction_committed();
+    ad_bids_state.set_auction_diagnostics(timings);
     if let (Some(observation), Some(auction_request)) =
         (telemetry.observation, telemetry.auction_request.as_ref())
     {
@@ -4174,11 +4263,7 @@ pub async fn handle_publisher_request(
 
     // A defaulted handle records into nothing that ever renders, so tests
     // that don't populate the request extension are unaffected.
-    let timings = req
-        .extensions()
-        .get::<RequestTimings>()
-        .cloned()
-        .unwrap_or_default();
+    let timings = RequestTimings::from_extensions(req.extensions()).unwrap_or_default();
 
     // Adapter fallbacks prepare this before EC/cookie handling. Keep this
     // idempotent call as a direct-handler safety net and for focused tests.
@@ -4335,7 +4420,7 @@ pub async fn handle_publisher_request(
         .and_then(|co| co.auction_timeout_ms)
         .unwrap_or(settings.auction.timeout_ms);
 
-    let ad_bids_state = AdBidsState::default();
+    let ad_bids_state = AdBidsState::with_diagnostics(gpt_diagnostics.active());
 
     let price_granularity = settings
         .creative_opportunities
@@ -5580,6 +5665,13 @@ pub(crate) fn build_bid_map_with_auction_id(
 /// The JSON is embedded via `JSON.parse(…)` so the browser parser never sees
 /// raw `</script>` sequences inside the string.
 pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Value>) -> String {
+    build_bids_script_with_diagnostics(bid_map, None)
+}
+
+fn build_bids_script_with_diagnostics(
+    bid_map: &serde_json::Map<String, serde_json::Value>,
+    auction_diagnostics: Option<&BrowserAuctionDiagnostics>,
+) -> String {
     let json = serde_json::to_string(bid_map)
         .expect("serde_json::to_string of Map<String,Value> should be infallible");
     let escaped = html_escape_for_script(&json);
@@ -5614,6 +5706,23 @@ pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Va
     // payload. Only when no scheduler exists at all (GPT integration active
     // without its head bootstrap — not an expected deployment) does the script
     // fall back to a plain assignment, where no SPA hook exists to race with.
+    if let Some(auction_diagnostics) = auction_diagnostics {
+        let diagnostics = serde_json::to_string(auction_diagnostics)
+            .expect("BrowserAuctionDiagnostics should serialize");
+        return format!(
+            "<script>(function(){{\
+var t=window.tsjs=window.tsjs||{{}};\
+var b=JSON.parse(\"{}\");\
+var d=JSON.parse(\"{}\");\
+var s=t.scheduleInitialAdInit;\
+if(typeof s===\"function\")s(b,void 0,d);\
+else{{t.bids=b;t.auctionDiagnostics=d;}}\
+}})();</script>",
+            escaped,
+            html_escape_for_script(&diagnostics)
+        );
+    }
+
     format!(
         "<script>(function(){{\
 var t=window.tsjs=window.tsjs||{{}};\
@@ -5645,15 +5754,43 @@ else t.bids=b;\
 ///
 /// Slots are applied before bids inside the scheduler, because the scheduler may fire
 /// `adInit` and `adInit` reads `ts.adSlots`.
+#[cfg(test)]
 pub(crate) fn build_seam_script(
     slots_json: &str,
     bid_map: &serde_json::Map<String, serde_json::Value>,
+) -> String {
+    build_seam_script_with_diagnostics(slots_json, bid_map, None)
+}
+
+fn build_seam_script_with_diagnostics(
+    slots_json: &str,
+    bid_map: &serde_json::Map<String, serde_json::Value>,
+    auction_diagnostics: Option<&BrowserAuctionDiagnostics>,
 ) -> String {
     // The local test script probes the minified `var a=JSON.parse`,
     // `var b=JSON.parse`, and `s(b,a)` literals below. Update the harness with any
     // semantically equivalent rewrite so its black-box checks keep matching output.
     let bids = serde_json::to_string(bid_map)
         .expect("serde_json::to_string of Map<String,Value> should be infallible");
+    if let Some(auction_diagnostics) = auction_diagnostics {
+        let diagnostics = serde_json::to_string(auction_diagnostics)
+            .expect("BrowserAuctionDiagnostics should serialize");
+        return format!(
+            "<script>(function(){{\
+var t=window.tsjs=window.tsjs||{{}};\
+var a=JSON.parse(\"{}\");\
+var b=JSON.parse(\"{}\");\
+var d=JSON.parse(\"{}\");\
+var s=t.scheduleInitialAdInit;\
+if(typeof s===\"function\")s(b,a,d);\
+else{{t.adSlots=a;t.bids=b;t.auctionDiagnostics=d;}}\
+}})();</script>",
+            html_escape_for_script(slots_json),
+            html_escape_for_script(&bids),
+            html_escape_for_script(&diagnostics)
+        );
+    }
+
     format!(
         "<script>(function(){{\
 var t=window.tsjs=window.tsjs||{{}};\
@@ -6538,15 +6675,21 @@ pub async fn handle_page_bids(
     kv: Option<&KvIdentityGraph>,
     auction: AuctionDispatch<'_>,
     ec_context: &mut EcContext,
-    req: Request<EdgeBody>,
+    mut req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    // Same defaulted-handle rule as `handle_publisher_request`: a request
-    // without the extension records into a collector nothing reads.
-    let timings = req
-        .extensions()
-        .get::<RequestTimings>()
-        .cloned()
-        .unwrap_or_default();
+    // Keep a local collector for direct-handler callers, but only expose
+    // browser timings from an adapter-attached request clock. Otherwise an
+    // adapter that forgets the extension would silently report a different
+    // handler-entry timing origin.
+    let request_timings = RequestTimings::from_extensions(req.extensions());
+    let has_request_timings = request_timings.is_some();
+    let timings = request_timings.unwrap_or_default();
+
+    // Adapter fallbacks prepare this before routing. Keep this idempotent call as
+    // a direct-handler safety net and retain the session decision after the
+    // private activation cookie is stripped.
+    let gpt_diagnostics =
+        crate::integrations::gpt_diagnostics::prepare_request(settings, &mut req)?;
 
     // CSRF-style gate: refuse cross-site invocations before any other work —
     // including the not-configured 404 below, which would otherwise tell a
@@ -6695,6 +6838,7 @@ pub async fn handle_page_bids(
     // unchanged) but skip the live auction, matching the existing behavior.
     let ad_stack_enabled = ad_templates_enabled && auction_enabled && consent_allows_auction;
 
+    let mut auction_diagnostics = None;
     let (winning_bids, prebuilt_bid_map) = if matched_slots.is_empty() {
         (std::collections::HashMap::new(), None)
     } else {
@@ -6767,13 +6911,31 @@ pub async fn handle_page_bids(
                 services,
             };
             timings.mark_auction_dispatched();
-            match auction
+            let result = auction
                 .orchestrator
                 .run_auction(&auction_request, &auction_context)
-                .await
-            {
+                .await;
+            timings.mark_auction_resolved();
+            match result {
                 Ok(result) => {
-                    timings.mark_auction_resolved();
+                    // A successful result proves at least one pending or immediate
+                    // provider outcome. Failures can occur before any request leaves
+                    // the edge, so they must not fabricate dispatch timing evidence.
+                    if gpt_diagnostics.browser_session_active() && has_request_timings {
+                        let timing_snapshot = timings.snapshot();
+                        auction_diagnostics = Some(BrowserAuctionDiagnostics {
+                            auction_dispatched_ms: timing_snapshot.auction_dispatched_ms,
+                            auction_resolved_ms: timing_snapshot.auction_resolved_ms,
+                            auction_committed_ms: None,
+                            auction_wait_ms: timing_snapshot
+                                .auction_resolved_ms
+                                .zip(timing_snapshot.auction_dispatched_ms)
+                                .map(|(resolved, dispatched)| resolved.saturating_sub(dispatched)),
+                            auction_wait_placement: Some(auction_wait_placement_wire(
+                                AuctionWaitPlacement::PreHeader,
+                            )),
+                        });
+                    }
                     let winning_bids = result.winning_bids.clone();
                     let auction_id = diagnostics_auction_id(settings);
                     let bid_map = build_bid_map_with_auction_id(
@@ -6786,6 +6948,9 @@ pub async fn handle_page_bids(
                     );
                     // Targeting is available to the response pipeline.
                     timings.mark_auction_committed();
+                    if let Some(diagnostics) = auction_diagnostics.as_mut() {
+                        diagnostics.auction_committed_ms = timings.snapshot().auction_committed_ms;
+                    }
                     let delivered_winner_slots = bid_map.keys().cloned().collect();
                     emit_auction_events_best_effort_lazy(services, || {
                         build_auction_events(
@@ -6801,7 +6966,6 @@ pub async fn handle_page_bids(
                     (winning_bids, Some(bid_map))
                 }
                 Err(e) => {
-                    timings.mark_auction_resolved();
                     log::warn!("page-bids auction failed: {e:?}");
                     let elapsed_ms = observation.elapsed_ms();
                     emit_auction_events_best_effort_lazy(services, || {
@@ -6871,10 +7035,18 @@ pub async fn handle_page_bids(
         Vec::new()
     };
 
-    let body = serde_json::json!({
-        "slots": slots_json,
-        "bids": bid_map,
-    });
+    let body = if let Some(auction_diagnostics) = auction_diagnostics {
+        serde_json::json!({
+            "slots": slots_json,
+            "bids": bid_map,
+            "auctionDiagnostics": auction_diagnostics,
+        })
+    } else {
+        serde_json::json!({
+            "slots": slots_json,
+            "bids": bid_map,
+        })
+    };
     let body = serde_json::to_string(&body).change_context(TrustedServerError::Proxy {
         message: "Failed to serialize page-bids response".to_string(),
     })?;
@@ -8525,7 +8697,7 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build request");
         let timings = RequestTimings::new();
-        request.extensions_mut().insert(timings.clone());
+        request.extensions_mut().insert(timings.handle().clone());
 
         let _response = run_publisher_proxy(&settings, &services, request).await;
 
@@ -8555,7 +8727,7 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build request");
         let timings = RequestTimings::new();
-        request.extensions_mut().insert(timings.clone());
+        request.extensions_mut().insert(timings.handle().clone());
 
         let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
         let mut ec_context = EcContext::read_from_request(&settings, &request, &services)
@@ -9890,7 +10062,7 @@ mod tests {
             let inline_timings = RequestTimings::new();
             inline_request
                 .extensions_mut()
-                .insert(inline_timings.clone());
+                .insert(inline_timings.handle().clone());
 
             let _inline_response =
                 run_publisher_proxy(&inline_settings, &inline_services, inline_request).await;
@@ -9910,7 +10082,7 @@ mod tests {
             queue_shareable_html(&stub);
             let mut request = navigation_request();
             let timings = RequestTimings::new();
-            request.extensions_mut().insert(timings.clone());
+            request.extensions_mut().insert(timings.handle().clone());
 
             let _response = run(&settings, &services, request).await;
 
@@ -18932,8 +19104,10 @@ mod tests {
         };
         use crate::http_util::RequestInfo;
         use crate::price_bucket::PriceGranularity;
+        use crate::request_timing::{AuctionWaitPlacement, RequestTimings};
         use crate::settings::Settings;
         use std::collections::HashMap;
+        use std::time::Duration;
 
         // Default settings are enough for the creative boundary: the sanitize
         // pass needs no config, and `rewrite_creative_html` only signs URLs it
@@ -20262,6 +20436,53 @@ mod tests {
             );
         }
 
+        #[test]
+        fn active_diagnostics_hands_auction_timing_to_the_generation_guarded_scheduler() {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.record_auction_wait(AuctionWaitPlacement::InStream, Duration::from_millis(12));
+            timings.mark_auction_resolved();
+            timings.mark_auction_committed();
+            let state = AdBidsState::with_diagnostics(true);
+            state.set(serde_json::Map::new());
+
+            state.set_auction_diagnostics(&timings);
+
+            let script = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render bid script");
+            assert!(script.contains("s(b,void 0,d)"));
+            assert!(script.contains("auctionDispatchedMs"));
+            assert!(script.contains("auctionResolvedMs"));
+            assert!(script.contains("auctionCommittedMs"));
+            assert!(script.contains("auctionWaitMs"));
+            assert!(script.contains("in_stream"));
+        }
+
+        #[test]
+        fn inactive_diagnostics_omits_auction_timing_from_the_bid_script() {
+            let timings = RequestTimings::new();
+            timings.mark_auction_dispatched();
+            timings.mark_auction_resolved();
+            timings.mark_auction_committed();
+            let state = AdBidsState::default();
+            state.set(serde_json::Map::new());
+
+            state.set_auction_diagnostics(&timings);
+
+            let script = state
+                .script_cell()
+                .lock()
+                .expect("should lock bid script")
+                .clone()
+                .expect("should render bid script");
+            assert!(!script.contains("auctionDiagnostics"));
+            assert!(!script.contains("auctionDispatchedMs"));
+        }
+
         #[test]
         fn bids_script_defers_ad_init_until_after_hydration() {
             let mut map = serde_json::Map::new();
@@ -20710,6 +20931,12 @@ mod tests {
             make_page_bids_request_on(PAGE_BIDS_PATH, path)
         }
 
+        fn make_active_page_bids_request(path: &str) -> Request<EdgeBody> {
+            let mut req = make_page_bids_request(path);
+            set_test_header(&mut req, "cookie", "__Host-ts-console=1");
+            req
+        }
+
         #[tokio::test]
         async fn page_bids_format_absent_or_json_returns_json() {
             let settings = settings_with_co();
@@ -20832,6 +21059,76 @@ mod tests {
             orchestrator
         }
 
+        #[tokio::test]
+        async fn active_page_bids_omits_timings_when_no_provider_dispatches() {
+            let mut settings = settings_with_co();
+            settings.auction.providers = vec!["missing-provider".to_string()];
+            settings
+                .integrations
+                .insert_config("gpt_diagnostics", &serde_json::json!({ "enabled": true }))
+                .expect("should enable diagnostics");
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+
+            let body = run_page_bids_consent_allowed(
+                &settings,
+                &orchestrator,
+                &article_slot(),
+                make_active_page_bids_request("/2024/01/my-article/"),
+            )
+            .await;
+
+            assert!(
+                body.get("auctionDiagnostics").is_none(),
+                "a failed launch must not fabricate auction dispatch timings"
+            );
+        }
+
+        #[tokio::test]
+        async fn active_page_bids_omits_timings_without_adapter_collector() {
+            let mut settings = settings_with_co();
+            settings.auction.providers = vec![AUCTION_ID_TEST_PROVIDER.to_string()];
+            settings
+                .integrations
+                .insert_config("gpt_diagnostics", &serde_json::json!({ "enabled": true }))
+                .expect("should enable diagnostics");
+            let slots = article_slot();
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"winner".to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            let orchestrator =
+                auction_id_test_orchestrator(&settings, Arc::new(Mutex::new(None)), true);
+            let mut ec_context = consent_allowing_ec_context();
+
+            let response = handle_page_bids(
+                &settings,
+                &services,
+                None,
+                AuctionDispatch {
+                    orchestrator: &orchestrator,
+                    slots: &slots,
+                    registry: None,
+                },
+                &mut ec_context,
+                make_active_page_bids_request("/2024/01/my-article/"),
+            )
+            .await
+            .expect("should return page-bids response");
+            let body: serde_json::Value = serde_json::from_slice(
+                &response
+                    .into_body()
+                    .into_bytes()
+                    .expect("should read page-bids response body"),
+            )
+            .expect("should serialize page-bids response as JSON");
+
+            assert!(
+                body.get("auctionDiagnostics").is_none(),
+                "missing adapter timing context must not emit handler-local timing facts"
+            );
+        }
+
         #[tokio::test]
         async fn page_bids_response_includes_auction_id_only_for_winning_bids() {
             let mut settings = settings_with_co();
@@ -20843,6 +21140,7 @@ mod tests {
             let slots = article_slot();
             let winning_stub = Arc::new(StubHttpClient::new());
             winning_stub.push_response(200, b"winner".to_vec());
+            winning_stub.push_response(200, b"winner".to_vec());
             let winning_services = build_services_with_http_client(
                 Arc::clone(&winning_stub) as Arc<dyn crate::platform::PlatformHttpClient>
             );
@@ -20857,6 +21155,14 @@ mod tests {
                 },
             );
 
+            let mut winning_page_bids_request =
+                make_active_page_bids_request("/2024/01/my-article/");
+            let request_timings = RequestTimings::new();
+            winning_page_bids_request
+                .extensions_mut()
+                .insert(request_timings.handle().clone());
+            std::thread::sleep(std::time::Duration::from_millis(2));
+
             let winning_response = handle_page_bids(
                 &settings,
                 &winning_services,
@@ -20867,7 +21173,7 @@ mod tests {
                     registry: None,
                 },
                 &mut ec_context,
-                make_page_bids_request("/2024/01/my-article/"),
+                winning_page_bids_request,
             )
             .await
             .expect("should return winning page-bids response");
@@ -20892,6 +21198,33 @@ mod tests {
                 .as_str()
                 .expect("page-bids should expose an auction ID on the winner")
                 .to_string();
+            let auction_diagnostics = winning_body["auctionDiagnostics"]
+                .as_object()
+                .expect("an active session should expose page-bids auction diagnostics");
+            let timing = |field| {
+                auction_diagnostics
+                    .get(field)
+                    .and_then(serde_json::Value::as_u64)
+                    .unwrap_or_else(|| panic!("page-bids diagnostics should include {field}"))
+            };
+            let dispatched_ms = timing("auctionDispatchedMs");
+            let resolved_ms = timing("auctionResolvedMs");
+            let committed_ms = timing("auctionCommittedMs");
+            let wait_ms = timing("auctionWaitMs");
+            assert!(
+                dispatched_ms > 0,
+                "page-bids dispatch should include time since adapter request entry"
+            );
+            assert!(
+                dispatched_ms <= resolved_ms && resolved_ms <= committed_ms,
+                "page-bids auction milestones should be monotonic"
+            );
+            assert_eq!(
+                wait_ms,
+                resolved_ms.saturating_sub(dispatched_ms),
+                "auction wait should exclude page-bids pre-dispatch work"
+            );
+            assert_eq!(auction_diagnostics["auctionWaitPlacement"], "pre_header");
             assert!(
                 winning_auction_id.starts_with("ts-auc-"),
                 "page-bids should expose a freshly minted diagnostics token, got `{winning_auction_id}`"
@@ -20905,6 +21238,32 @@ mod tests {
                 "browser-visible auction ID must not embed the EC ID"
             );
 
+            let inactive_winning_response = handle_page_bids(
+                &settings,
+                &winning_services,
+                None,
+                AuctionDispatch {
+                    orchestrator: &winning_orchestrator,
+                    slots: &slots,
+                    registry: None,
+                },
+                &mut ec_context,
+                make_page_bids_request("/2024/01/my-article/"),
+            )
+            .await
+            .expect("should return inactive winning page-bids response");
+            let inactive_winning_body: serde_json::Value = serde_json::from_slice(
+                &inactive_winning_response
+                    .into_body()
+                    .into_bytes()
+                    .expect("should read inactive winning page-bids response body"),
+            )
+            .expect("should serialize inactive winning page-bids response as JSON");
+            assert!(
+                inactive_winning_body.get("auctionDiagnostics").is_none(),
+                "an inactive session should not receive successful auction diagnostics"
+            );
+
             let no_winner_stub = Arc::new(StubHttpClient::new());
             no_winner_stub.push_response(200, b"no-bid".to_vec());
             let no_winner_services = build_services_with_http_client(
@@ -20941,6 +21300,10 @@ mod tests {
                     .is_empty(),
                 "page-bids should not fabricate auction metadata without a winner"
             );
+            assert!(
+                no_winner_body.get("auctionDiagnostics").is_none(),
+                "an inactive session should not receive page-bids auction diagnostics"
+            );
         }
 
         /// The browser-visible auction ID is minted per auction and only for
diff --git a/crates/trusted-server-core/src/request_timing.rs b/crates/trusted-server-core/src/request_timing.rs
index 899674d7d..c396011ff 100644
--- a/crates/trusted-server-core/src/request_timing.rs
+++ b/crates/trusted-server-core/src/request_timing.rs
@@ -1,20 +1,16 @@
 //! Per-request phase timing collection and Server-Timing rendering.
 //!
-//! Collection is always-on and infallible: saturating math, no panics. A
-//! contended lock drops the one sample; a poisoned lock recovers (the
-//! guarded data are plain counters), so a panic elsewhere cannot silence
-//! the rest of the request's timing. See the design spec
+//! Collection delegates to `EdgeZero` with saturating math and nonblocking
+//! updates. Contention drops the whole sample; poisoned locks recover
+//! best-effort without rollback. TS callbacks only assign plain optional facts
+//! under the shared clock and mutex. Rendering and exposure remain TS policy.
+//! See the design spec
 //! `docs/superpowers/specs/2026-08-24-request-phase-timing-design.md`.
 
-use std::sync::{Arc, Mutex, TryLockError};
 use std::time::Duration;
 
-use http::{HeaderName, HeaderValue, Response};
+use http::{Extensions, HeaderName, HeaderValue, Response};
 use uuid::Uuid;
-// `std::time::Instant::now()` panics on `wasm32-unknown-unknown` (the
-// Cloudflare adapter's target); `web_time` re-exports std's `Instant` on
-// every other target.
-use web_time::Instant;
 
 use crate::cache_policy::cache_control_headers_are_private_or_no_store;
 
@@ -25,7 +21,7 @@ use crate::cache_policy::cache_control_headers_are_private_or_no_store;
 const HEADER_SERVER_TIMING: HeaderName = HeaderName::from_static("server-timing");
 
 /// Number of [`Phase`] variants; sizes the fixed-slot duration array in
-/// [`Inner`].
+/// the shared `EdgeZero` collector.
 const PHASE_COUNT: usize = 8;
 
 /// A distinct stage of request handling that duration can be attributed to.
@@ -55,7 +51,7 @@ pub enum Phase {
 }
 
 impl Phase {
-    /// Maps this variant to its fixed slot in the [`Inner::phases`] array.
+    /// Maps this variant to its fixed slot in the generic phase array.
     fn index(self) -> usize {
         match self {
             Self::AppBuild => 0,
@@ -92,71 +88,52 @@ pub enum AuctionWaitPlacement {
     InStream,
 }
 
-/// Mutable state behind [`RequestTimings`], guarded by a [`Mutex`].
-struct Inner {
-    /// Instant the collector was constructed; the reference point for
-    /// elapsed marks. Adapters construct the collector after their own
-    /// prologue (client-request acquisition, logger init, and any
-    /// short-circuit routes on Fastly), so `ts-total` and
-    /// `time_elapsed_ms` exclude that prologue rather than measuring
-    /// wall-clock-from-accept.
-    t0: Instant,
-    /// Accumulated duration per [`Phase`], indexed by [`Phase::index`].
-    phases: [Option<Duration>; PHASE_COUNT],
-    /// Elapsed time at the first [`RequestTimings::mark_headers_ready`] call.
-    headers_ready_total: Option<Duration>,
-    /// Elapsed time at the first [`RequestTimings::mark_request_elapsed`]
-    /// call.
-    request_elapsed: Option<Duration>,
-    /// Placement recorded by the most recent
-    /// [`RequestTimings::record_auction_wait`] call.
+/// Auction facts sharing the generic collector's origin and mutex.
+///
+/// Updates only assign plain optional facts, preserving validity on unwind.
+#[derive(Default)]
+pub struct AuctionTimingData {
     auction_wait_placement: Option<AuctionWaitPlacement>,
-    /// Response body size in bytes, set via
-    /// [`RequestTimings::set_resp_bytes`].
-    resp_bytes: Option<u64>,
-    /// Elapsed time at the first
-    /// [`RequestTimings::mark_auction_dispatched`] call.
     auction_dispatched: Option<Duration>,
-    /// Elapsed time at the first
-    /// [`RequestTimings::mark_auction_resolved`] call.
     auction_resolved: Option<Duration>,
-    /// Elapsed time at the first
-    /// [`RequestTimings::mark_auction_committed`] call.
     auction_committed: Option<Duration>,
-    /// Telemetry auction UUID recorded by the first
-    /// [`RequestTimings::set_auction_id`] call; joins the access row to the
-    /// per-bidder auction dataset. Set when the auction observation is
-    /// built, so it is present even for an auction that was skipped or
-    /// failed to dispatch, matching the row those outcomes emit to
-    /// `auction_events_raw`.
     auction_id: Option<Uuid>,
 }
 
-/// Per-request phase timing collector.
+/// The sole timing type installed in request extensions on every adapter.
+pub type RequestTimingHandle =
+    edgezero_core::request_timing::RequestTimings<PHASE_COUNT, AuctionTimingData>;
+
+/// Shared attachment middleware specialized to Trusted Server's timing payload.
+/// Exclusion policy belongs at each adapter's registration site.
+pub type RequestTimingMiddleware =
+    edgezero_core::middleware::RequestTimingMiddleware<PHASE_COUNT, AuctionTimingData>;
+
+/// Typed application facade over the installed `EdgeZero` handle, not an extension.
 ///
-/// Cheap to clone (an [`Arc`] handle) and safe to share across threads and
-/// async tasks handling the same request. Every method is infallible:
-/// contention silently drops the one sample rather than blocking, and a
-/// poisoned lock is recovered rather than treated as permanent loss.
+/// Clones share one origin and mutex. Contention drops samples or yields missing
+/// facts. `EdgeZero` recovers poisoned locks best-effort, without rollback; the
+/// callbacks here only update plain optional facts and cannot invalidate payloads.
 #[derive(Clone)]
-pub struct RequestTimings(Arc<Mutex<Inner>>);
+pub struct RequestTimings(RequestTimingHandle);
 
 impl RequestTimings {
     /// Starts a new collector with its clock reference (`t0`) set to now.
     #[must_use]
     pub fn new() -> Self {
-        Self(Arc::new(Mutex::new(Inner {
-            t0: Instant::now(),
-            phases: [None; PHASE_COUNT],
-            headers_ready_total: None,
-            request_elapsed: None,
-            auction_wait_placement: None,
-            resp_bytes: None,
-            auction_dispatched: None,
-            auction_resolved: None,
-            auction_committed: None,
-            auction_id: None,
-        })))
+        Self(RequestTimingHandle::new())
+    }
+
+    /// Wraps the installed generic handle without creating a clock or copying facts.
+    #[must_use]
+    pub fn from_extensions(extensions: &Extensions) -> Option<Self> {
+        extensions.get::<RequestTimingHandle>().cloned().map(Self)
+    }
+
+    /// Returns the shared generic handle for insertion into request extensions.
+    #[must_use]
+    pub fn handle(&self) -> &RequestTimingHandle {
+        &self.0
     }
 
     /// Accumulates `dur` into `phase`'s running total.
@@ -164,20 +141,7 @@ impl RequestTimings {
     /// Repeated calls for the same phase saturate-add rather than overwrite.
     /// Drops the sample silently on lock contention; a poisoned lock is recovered.
     pub fn record(&self, phase: Phase, dur: Duration) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        let index = phase.index();
-        let accumulated = inner.phases[index]
-            .unwrap_or(Duration::ZERO)
-            .saturating_add(dur);
-        inner.phases[index] = Some(accumulated);
+        let _ = self.0.record(phase.index(), dur);
     }
 
     /// Records an auction wait duration under [`Phase::AuctionWait`] and
@@ -185,71 +149,39 @@ impl RequestTimings {
     ///
     /// Drops the sample silently on lock contention; a poisoned lock is recovered.
     pub fn record_auction_wait(&self, placement: AuctionWaitPlacement, dur: Duration) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        let index = Phase::AuctionWait.index();
-        let accumulated = inner.phases[index]
-            .unwrap_or(Duration::ZERO)
-            .saturating_add(dur);
-        inner.phases[index] = Some(accumulated);
-        inner.auction_wait_placement = Some(placement);
+        let _ = self
+            .0
+            .record_with(Phase::AuctionWait.index(), dur, |data, _| {
+                data.auction_wait_placement = Some(placement);
+            });
     }
 
     /// Starts a guard that records elapsed time into `phase` when dropped.
-    #[must_use]
+    ///
+    /// # Panics
+    /// Panics only if the internal exhaustive phase-to-slot mapping is invalid.
     pub fn span(&self, phase: Phase) -> PhaseSpan {
-        PhaseSpan {
-            timings: self.clone(),
-            phase,
-            started: Instant::now(),
-        }
+        self.0
+            .span(phase.index())
+            .expect("should map every Phase to a valid slot")
     }
 
     /// Stamps the elapsed time since `t0` as `headers_ready_total`, the
     /// first time this is called.
     ///
     /// Subsequent calls are no-ops (first call wins). Drops the sample
-    /// silently on lock contention or poisoning.
+    /// silently on lock contention; a poisoned lock is recovered.
     pub fn mark_headers_ready(&self) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        if inner.headers_ready_total.is_none() {
-            inner.headers_ready_total = Some(inner.t0.elapsed());
-        }
+        let _ = self.0.mark_headers_ready();
     }
 
     /// Stamps the elapsed time since `t0` as `request_elapsed`, the first
     /// time this is called.
     ///
     /// Subsequent calls are no-ops (first call wins). Drops the sample
-    /// silently on lock contention or poisoning.
+    /// silently on lock contention; a poisoned lock is recovered.
     pub fn mark_request_elapsed(&self) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        if inner.request_elapsed.is_none() {
-            inner.request_elapsed = Some(inner.t0.elapsed());
-        }
+        let _ = self.0.mark_request_elapsed();
     }
 
     /// Records the telemetry auction id, the first time this is called.
@@ -263,18 +195,9 @@ impl RequestTimings {
     /// (first call wins). Drops the sample silently on lock contention; a
     /// poisoned lock is recovered.
     pub fn set_auction_id(&self, auction_id: Uuid) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        if inner.auction_id.is_none() {
-            inner.auction_id = Some(auction_id);
-        }
+        let _ = self.0.update_data(|data, _| {
+            data.auction_id.get_or_insert(auction_id);
+        });
     }
 
     /// Stamps the elapsed time since `t0` as the auction dispatch offset,
@@ -287,18 +210,9 @@ impl RequestTimings {
     /// Drops the sample silently on lock contention; a poisoned lock is
     /// recovered.
     pub fn mark_auction_dispatched(&self) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        if inner.auction_dispatched.is_none() {
-            inner.auction_dispatched = Some(inner.t0.elapsed());
-        }
+        let _ = self.0.update_data(|data, elapsed| {
+            data.auction_dispatched.get_or_insert(elapsed);
+        });
     }
 
     /// Stamps the elapsed time since `t0` as the auction resolve offset (the
@@ -312,18 +226,9 @@ impl RequestTimings {
     /// no-ops (first call wins). Drops the sample silently on lock
     /// contention; a poisoned lock is recovered.
     pub fn mark_auction_resolved(&self) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        if inner.auction_resolved.is_none() {
-            inner.auction_resolved = Some(inner.t0.elapsed());
-        }
+        let _ = self.0.update_data(|data, elapsed| {
+            data.auction_resolved.get_or_insert(elapsed);
+        });
     }
 
     /// Stamps the elapsed time since `t0` as the auction commit offset
@@ -333,34 +238,16 @@ impl RequestTimings {
     /// Subsequent calls are no-ops (first call wins). Drops the sample
     /// silently on lock contention; a poisoned lock is recovered.
     pub fn mark_auction_committed(&self) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        if inner.auction_committed.is_none() {
-            inner.auction_committed = Some(inner.t0.elapsed());
-        }
+        let _ = self.0.update_data(|data, elapsed| {
+            data.auction_committed.get_or_insert(elapsed);
+        });
     }
 
     /// Records the response body size in bytes.
     ///
     /// Drops the sample silently on lock contention; a poisoned lock is recovered.
     pub fn set_resp_bytes(&self, bytes: u64) {
-        let mut inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            // Poisoning is recoverable here: the guarded data are plain
-            // counters with no invariant a panic can break, so recording
-            // keeps working for the rest of the request instead of going
-            // silently dark. Contention still drops the one sample.
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return,
-        };
-        inner.resp_bytes = Some(bytes);
+        let _ = self.0.set_resp_bytes(bytes);
     }
 
     /// Renders a `Server-Timing` header value, or `None` before
@@ -371,56 +258,53 @@ impl RequestTimings {
     /// `ts-geo`, `ts-kv`, `ts-origin`, `ts-template-cache`) in enum
     /// declaration order. Unrecorded phases are omitted. Durations are
     /// rendered as milliseconds with one decimal place. Drops the sample
-    /// silently (returning `None`) on lock contention or poisoning.
+    /// silently (returning `None`) on lock contention; poison is recovered.
     #[must_use]
     pub fn server_timing_value(&self) -> Option<String> {
-        let inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return None,
-        };
-        let total = inner.headers_ready_total?;
-        let mut entries = vec![format_entry("ts-total", total)];
-        for phase in HEADER_PHASES {
-            let Some(name) = phase.header_name() else {
-                continue;
-            };
-            if let Some(dur) = inner.phases[phase.index()] {
-                entries.push(format_entry(name, dur));
-            }
-        }
-        Some(entries.join(", "))
+        self.0
+            .snapshot(|inner| {
+                let total = inner.headers_ready_total?;
+                let mut entries = vec![format_entry("ts-total", total)];
+                for phase in HEADER_PHASES {
+                    let Some(name) = phase.header_name() else {
+                        continue;
+                    };
+                    if let Some(dur) = inner.phases[phase.index()] {
+                        entries.push(format_entry(name, dur));
+                    }
+                }
+                Some(entries.join(", "))
+            })
+            .ok()
+            .flatten()
     }
 
     /// Captures the current state as a [`TimingSnapshot`].
     ///
-    /// Returns an all-`None` snapshot on lock contention or poisoning,
+    /// Returns an all-`None` snapshot on lock contention,
     /// consistent with the infallibility of every other method.
     #[must_use]
     pub fn snapshot(&self) -> TimingSnapshot {
-        let inner = match self.0.try_lock() {
-            Ok(guard) => guard,
-            Err(TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
-            Err(TryLockError::WouldBlock) => return TimingSnapshot::default(),
-        };
-        TimingSnapshot {
-            time_elapsed_ms: duration_ms(inner.headers_ready_total),
-            request_elapsed_ms: duration_ms(inner.request_elapsed),
-            appbuild_ms: duration_ms(inner.phases[Phase::AppBuild.index()]),
-            filter_ms: duration_ms(inner.phases[Phase::Filter.index()]),
-            geo_ms: duration_ms(inner.phases[Phase::Geo.index()]),
-            kv_ms: duration_ms(inner.phases[Phase::EcKv.index()]),
-            origin_ms: duration_ms(inner.phases[Phase::Origin.index()]),
-            template_cache_ms: duration_ms(inner.phases[Phase::TemplateCacheLookup.index()]),
-            auction_wait_ms: duration_ms(inner.phases[Phase::AuctionWait.index()]),
-            stream_ms: duration_ms(inner.phases[Phase::Stream.index()]),
-            auction_wait_placement: inner.auction_wait_placement,
-            resp_bytes: inner.resp_bytes,
-            auction_dispatched_ms: duration_ms(inner.auction_dispatched),
-            auction_resolved_ms: duration_ms(inner.auction_resolved),
-            auction_committed_ms: duration_ms(inner.auction_committed),
-            auction_id: inner.auction_id,
-        }
+        self.0
+            .snapshot(|inner| TimingSnapshot {
+                time_elapsed_ms: duration_ms(inner.headers_ready_total),
+                request_elapsed_ms: duration_ms(inner.request_elapsed),
+                appbuild_ms: duration_ms(inner.phases[Phase::AppBuild.index()]),
+                filter_ms: duration_ms(inner.phases[Phase::Filter.index()]),
+                geo_ms: duration_ms(inner.phases[Phase::Geo.index()]),
+                kv_ms: duration_ms(inner.phases[Phase::EcKv.index()]),
+                origin_ms: duration_ms(inner.phases[Phase::Origin.index()]),
+                template_cache_ms: duration_ms(inner.phases[Phase::TemplateCacheLookup.index()]),
+                auction_wait_ms: duration_ms(inner.phases[Phase::AuctionWait.index()]),
+                stream_ms: duration_ms(inner.phases[Phase::Stream.index()]),
+                auction_wait_placement: inner.data.auction_wait_placement,
+                resp_bytes: inner.resp_bytes,
+                auction_dispatched_ms: duration_ms(inner.data.auction_dispatched),
+                auction_resolved_ms: duration_ms(inner.data.auction_resolved),
+                auction_committed_ms: duration_ms(inner.data.auction_committed),
+                auction_id: inner.data.auction_id,
+            })
+            .unwrap_or_default()
     }
 }
 
@@ -494,20 +378,7 @@ fn duration_ms(dur: Option<Duration>) -> Option<u32> {
 
 /// RAII guard returned by [`RequestTimings::span`] that records its own
 /// elapsed lifetime into the originating phase when dropped.
-pub struct PhaseSpan {
-    /// The collector this span reports into on drop.
-    timings: RequestTimings,
-    /// The phase this span's elapsed time is recorded under.
-    phase: Phase,
-    /// The instant the span was created.
-    started: Instant,
-}
-
-impl Drop for PhaseSpan {
-    fn drop(&mut self) {
-        self.timings.record(self.phase, self.started.elapsed());
-    }
-}
+pub type PhaseSpan = edgezero_core::request_timing::PhaseSpan<PHASE_COUNT, AuctionTimingData>;
 
 /// A point-in-time, plain-data view of a [`RequestTimings`] collector.
 ///
@@ -565,13 +436,116 @@ pub struct TimingSnapshot {
 mod tests {
     use super::*;
 
+    #[test]
+    fn snapshot_and_header_compatibility_fixture() {
+        let timings = RequestTimings::new();
+        let clone = timings.clone();
+        clone.record(Phase::AppBuild, Duration::ZERO);
+        clone.record(Phase::Filter, Duration::from_micros(9_100));
+        clone.record(Phase::Geo, Duration::MAX);
+        clone.record(Phase::Geo, Duration::from_secs(1));
+        clone.record(Phase::EcKv, Duration::from_millis(3));
+        clone.record(Phase::Origin, Duration::from_millis(4));
+        clone.record(Phase::TemplateCacheLookup, Duration::from_millis(5));
+        clone.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::from_millis(6));
+        clone.record_auction_wait(AuctionWaitPlacement::InStream, Duration::from_millis(7));
+        clone.record(Phase::Stream, Duration::from_millis(8));
+        clone.set_resp_bytes(42);
+        clone.set_resp_bytes(99);
+        let snapshot = timings.snapshot();
+        assert_eq!(snapshot.appbuild_ms, Some(0));
+        assert_eq!(snapshot.filter_ms, Some(9));
+        assert_eq!(snapshot.geo_ms, Some(u32::MAX));
+        assert_eq!(snapshot.auction_wait_ms, Some(13));
+        assert_eq!(
+            snapshot.auction_wait_placement,
+            Some(AuctionWaitPlacement::InStream)
+        );
+        assert_eq!(snapshot.stream_ms, Some(8));
+        assert_eq!(snapshot.resp_bytes, Some(99));
+        assert_eq!(snapshot.request_elapsed_ms, None);
+        assert_eq!(RequestTimings::new().snapshot(), TimingSnapshot::default());
+        timings.mark_headers_ready();
+        let value = timings
+            .server_timing_value()
+            .expect("should render fixture");
+        let entries: Vec<_> = value.split(", ").collect();
+        assert_eq!(entries.len(), 7, "should omit row-only phases");
+        assert!(entries[0].starts_with("ts-total;dur="));
+        assert_eq!(entries[1], "ts-appbuild;dur=0.0");
+        assert_eq!(entries[2], "ts-filter;dur=9.1");
+        assert_eq!(entries[3], format_entry("ts-geo", Duration::MAX));
+        assert_eq!(
+            &entries[4..],
+            &[
+                "ts-kv;dur=3.0",
+                "ts-origin;dur=4.0",
+                "ts-template-cache;dur=5.0"
+            ]
+        );
+    }
+
+    #[test]
+    fn contention_drops_compound_update_and_omits_reads() {
+        let timings = RequestTimings::new();
+        timings.record_auction_wait(AuctionWaitPlacement::PreHeader, Duration::from_millis(3));
+        timings.mark_headers_ready();
+        assert!(timings.server_timing_value().is_some());
+        let before = timings.snapshot();
+        // Deliberately hold the lock while probing unavailable operations in this
+        // test. Production callbacks only assign facts and never reenter.
+        timings
+            .0
+            .update_data(|_, _| {
+                timings
+                    .record_auction_wait(AuctionWaitPlacement::InStream, Duration::from_millis(7));
+                timings.mark_request_elapsed();
+                assert_eq!(timings.snapshot(), TimingSnapshot::default());
+                assert_eq!(timings.server_timing_value(), None);
+            })
+            .expect("should hold collector lock");
+        assert_eq!(
+            timings.snapshot(),
+            before,
+            "should drop entire compound update"
+        );
+    }
+
+    #[test]
+    fn request_completion_is_first_write_and_header_append_preserves_upstream() {
+        let timings = RequestTimings::new();
+        timings.mark_request_elapsed();
+        let first = timings.snapshot().request_elapsed_ms;
+        std::thread::sleep(Duration::from_millis(5));
+        timings.mark_request_elapsed();
+        assert_eq!(timings.snapshot().request_elapsed_ms, first);
+        let mut response = Response::builder()
+            .header("cache-control", "private")
+            .header("server-timing", "upstream;dur=1.0")
+            .body(())
+            .expect("should build private response");
+        append_server_timing_if_private(&mut response, &timings, false);
+        assert!(
+            timings.snapshot().time_elapsed_ms.is_some(),
+            "should mark even when disabled"
+        );
+        assert_eq!(
+            response.headers().get_all("server-timing").iter().count(),
+            1
+        );
+        append_server_timing_if_private(&mut response, &timings, true);
+        let values: Vec<_> = response.headers().get_all("server-timing").iter().collect();
+        assert_eq!(values.len(), 2);
+        assert_eq!(values[0], "upstream;dur=1.0");
+        assert_eq!(response.headers()["cache-control"], "private");
+    }
+
     #[test]
     fn every_phase_index_is_unique_and_in_bounds() {
         // `PHASE_COUNT` and `Phase::index()` are hand-synced; nothing at
         // compile time ties them together. A new variant whose `index()`
-        // returns `PHASE_COUNT` would panic at runtime on first `record`,
-        // contradicting the module's no-panics claim, so this test fails
-        // first instead. (A variant missing from this list is a compile
+        // returns `PHASE_COUNT` would silently lose records or panic when
+        // starting a span, so this test fails first instead. (A variant missing from this list is a compile
         // error via the exhaustive `match` in `index()` once added there.)
         let phases = [
             Phase::AppBuild,
diff --git a/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts b/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts
index 55996306a..0c65eaee2 100644
--- a/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts
+++ b/crates/trusted-server-integration-tests/browser/tests/nextjs/gpt-diagnostics.spec.ts
@@ -24,6 +24,32 @@ async function waitForApi(page: Page): Promise<void> {
     );
 }
 
+async function captureClosedShadowRoots(page: Page): Promise<void> {
+    await page.addInitScript(() => {
+        const roots = new WeakMap<Element, ShadowRoot>();
+        const attachShadow = Element.prototype.attachShadow;
+        Object.defineProperty(Element.prototype, "attachShadow", {
+            configurable: true,
+            value(this: Element, init: ShadowRootInit): ShadowRoot {
+                const root = attachShadow.call(this, init);
+                roots.set(this, root);
+                return root;
+            },
+        });
+        (window as any).__gptDiagnosticsClosedRoots = roots;
+    });
+}
+
+async function diagnosticsText(page: Page): Promise<string> {
+    return page.evaluate((hostId) => {
+        const host = document.getElementById(hostId);
+        const roots = (window as any).__gptDiagnosticsClosedRoots as
+            | WeakMap<Element, ShadowRoot>
+            | undefined;
+        return host && roots ? (roots.get(host)?.textContent ?? "") : "";
+    }, HOST_ID);
+}
+
 async function emit(
     page: Page,
     name: string,
@@ -188,6 +214,7 @@ test.describe("GPT runtime diagnostics", () => {
     }, testInfo) => {
         const pageErrors: string[] = [];
         const diagnosticNetworkRequests: string[] = [];
+        await captureClosedShadowRoots(page);
         page.on("pageerror", (error) => pageErrors.push(error.message));
         page.on("request", (request) => {
             if (
@@ -224,6 +251,9 @@ test.describe("GPT runtime diagnostics", () => {
             isBackfill: true,
             slotContentChanged: true,
         });
+        await expect
+            .poll(() => diagnosticsText(page))
+            .toContain("Fill 300×250");
         await emit(page, "slotOnload", "gpt-diagnostics-slot-primary");
         await emit(page, "impressionViewable", "gpt-diagnostics-slot-primary");
         await emit(
@@ -271,6 +301,9 @@ test.describe("GPT runtime diagnostics", () => {
                 slot.slotElementId === "gpt-diagnostics-slot-secondary",
         );
         expect(primary.binding).toEqual({ status: "bound" });
+        expect(snapshot.slots.map((slot: any) => slot.runtimeSlotNumber)).toEqual([
+            1, 2,
+        ]);
         expect(
             primary.requests.map((cycle: any) => cycle.requestNumber),
         ).toEqual([1, 2, 3]);
@@ -331,17 +364,38 @@ test.describe("GPT runtime diagnostics", () => {
         await page.evaluate(() => (window as any).tsjs.gptDiagnostics.hide());
         await expect(page.locator(`#${HOST_ID}`)).toHaveCount(0);
         await emit(page, "slotRequested", "gpt-diagnostics-slot-secondary");
+        await emit(
+            page,
+            "slotResponseReceived",
+            "gpt-diagnostics-slot-secondary",
+        );
+        await emit(page, "slotRenderEnded", "gpt-diagnostics-slot-secondary", {
+            isEmpty: false,
+            size: [1, 1],
+        });
         await page.evaluate(() => (window as any).tsjs.gptDiagnostics.show());
         await expect(page.locator(`#${HOST_ID}`)).toHaveCount(1);
         const hiddenPeriodSnapshot = await page.evaluate(() =>
             (window as any).tsjs.gptDiagnostics.snapshot(),
         );
-        expect(
-            hiddenPeriodSnapshot.slots.find(
-                (slot: any) =>
-                    slot.slotElementId === "gpt-diagnostics-slot-secondary",
-            ).requests,
-        ).toHaveLength(2);
+        const secondaryRequests = hiddenPeriodSnapshot.slots.find(
+            (slot: any) =>
+                slot.slotElementId === "gpt-diagnostics-slot-secondary",
+        ).requests;
+        expect(secondaryRequests).toHaveLength(2);
+        expect(secondaryRequests[1]).toMatchObject({
+            isEmpty: false,
+            size: [1, 1],
+        });
+        await page.evaluate(
+            () =>
+                new Promise<void>((resolve) =>
+                    requestAnimationFrame(() =>
+                        requestAnimationFrame(() => resolve()),
+                    ),
+                ),
+        );
+        expect(await diagnosticsText(page)).not.toContain("1×1");
 
         const downloadPromise = page.waitForEvent("download");
         await page.evaluate(() => (window as any).tsjs.gptDiagnostics.export());
@@ -355,6 +409,16 @@ test.describe("GPT runtime diagnostics", () => {
         const exported = JSON.parse(Buffer.concat(chunks).toString("utf8"));
         expect(exported.version).toBe(1);
         expect(exported.slots).toHaveLength(hiddenPeriodSnapshot.slots.length);
+        const exportedPrimary = exported.slots.find(
+            (slot: any) =>
+                slot.slotElementId === "gpt-diagnostics-slot-primary",
+        );
+        const exportedSecondary = exported.slots.find(
+            (slot: any) =>
+                slot.slotElementId === "gpt-diagnostics-slot-secondary",
+        );
+        expect(exportedPrimary.requests[0].size).toEqual([300, 250]);
+        expect(exportedSecondary.requests[1].size).toEqual([1, 1]);
         expect(exported.callbackIssues).toHaveLength(
             hiddenPeriodSnapshot.callbackIssues.length,
         );
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 03ff0aca2..8322d4e88 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -108,6 +108,34 @@ export interface AuctionBidData {
   debug_bid?: AuctionDebugBidData;
 }
 
+/** Server-measured auction timings relative to their documented server-side origin. */
+export interface AuctionDiagnosticsData {
+  auctionDispatchedMs?: number;
+  auctionResolvedMs?: number;
+  auctionCommittedMs?: number;
+  auctionWaitMs?: number;
+  auctionWaitPlacement?: 'pre_header' | 'in_stream';
+}
+
+/** Auction path presented by GPT diagnostics. */
+export type GptDiagnosticsAuctionType = 'ssat' | 'trusted_server' | 'client_side' | 'competing';
+
+/** Clock origin for server auction timings, independent of aggregate auction classification. */
+export type GptDiagnosticsServerAuctionTimingOrigin = 'navigation' | 'spa_auction';
+
+/** Sanitized winning-bid facts already exposed in GPT targeting. */
+export interface GptDiagnosticsAuctionWinner {
+  bidder: string;
+  priceBucket: string;
+}
+
+/** Internal Trusted Server auction evidence attached to the next GPT request. */
+export interface GptDiagnosticsAuctionFacts {
+  auctionType?: Extract<GptDiagnosticsAuctionType, 'ssat' | 'trusted_server'>;
+  winner?: GptDiagnosticsAuctionWinner;
+  serverTimings?: AuctionDiagnosticsData;
+}
+
 export type GptDiagnosticsCallbackKind =
   | 'slotRequested'
   | 'slotResponseReceived'
@@ -224,6 +252,11 @@ export interface GptDiagnosticsRequestCycle {
   requestPath?: GptDiagnosticsRequestPath;
   requestIntentId?: number;
   trustedServerAuctionId?: string;
+  auctionType?: GptDiagnosticsAuctionType;
+  auctionWinner?: GptDiagnosticsAuctionWinner;
+  serverAuctionTimings?: AuctionDiagnosticsData;
+  /** Retained separately because `auctionType` can become `competing`. */
+  serverAuctionTimingOrigin?: GptDiagnosticsServerAuctionTimingOrigin;
   opportunityToRequestMs?: number;
   replacedRequestNumber?: number;
   previousRenderToRequestMs?: number;
@@ -332,7 +365,8 @@ export interface GptDiagnosticsRecorder {
     auctionSlotId: string,
     opportunity: GptDiagnosticsTrustedServerOpportunity,
     trustedServerAuctionId?: string,
-    requestedSlotSizes?: ReadonlyArray<Size>
+    requestedSlotSizes?: ReadonlyArray<Size>,
+    auctionFacts?: GptDiagnosticsAuctionFacts
   ): void;
   /** Mark slots whose next observed GPT request follows the Prebid refresh path. */
   recordPrebidRefresh(slots: GptDiagnosticsSlotHandle[]): void;
@@ -392,6 +426,8 @@ export interface TsjsApi {
   adSlots?: AuctionSlot[];
   /** Winning bid targeting data injected before </body>. */
   bids?: Record<string, AuctionBidData>;
+  /** Server-measured timing evidence for the auction that populated `bids`. */
+  auctionDiagnostics?: AuctionDiagnosticsData;
   /**
    * Bounded client-side Prebid APS renderer capabilities keyed by Prebid's generated
    * `hb_adid`. The Universal Creative bridge consumes each entry at most once.
@@ -473,7 +509,8 @@ export interface TsjsApi {
    */
   scheduleInitialAdInit?: (
     initialBids?: Record<string, AuctionBidData>,
-    initialSlots?: AuctionSlot[]
+    initialSlots?: AuctionSlot[],
+    initialAuctionDiagnostics?: AuctionDiagnosticsData
   ) => void;
   /** Read-only GPT lifecycle diagnostics API, present only in an activated tab. */
   gptDiagnostics?: GptDiagnosticsApi;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index 89b480c6f..5b771f738 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -2,6 +2,8 @@ import { log } from '../../core/log';
 import type {
   AuctionSlot,
   AuctionBidData,
+  AuctionDiagnosticsData,
+  GptDiagnosticsAuctionFacts,
   GptDiagnosticsCreativeFailure,
   GptDiagnosticsTrustedServerOpportunity,
   GptSlotHandoff,
@@ -65,6 +67,24 @@ function trustedServerOpportunity(bid: AuctionBidData): GptDiagnosticsTrustedSer
   return hasAdId && (hasInline || hasCache) ? 'renderable_candidate' : 'unrenderable_candidate';
 }
 
+function diagnosticsAuctionFacts(
+  generation: number,
+  auctionDiagnostics: AuctionDiagnosticsData | undefined,
+  bid: AuctionBidData
+): GptDiagnosticsAuctionFacts {
+  const isSpaAuction = generation > 0;
+  const winner =
+    isNonEmptyString(bid.hb_bidder) && isNonEmptyString(bid.hb_pb)
+      ? { bidder: bid.hb_bidder, priceBucket: bid.hb_pb }
+      : undefined;
+
+  return {
+    auctionType: isSpaAuction ? 'trusted_server' : 'ssat',
+    ...(winner ? { winner } : {}),
+    ...(auctionDiagnostics ? { serverTimings: auctionDiagnostics } : {}),
+  };
+}
+
 // ------------------------------------------------------------------
 // googletag type stubs (minimal surface needed by the shim)
 // ------------------------------------------------------------------
@@ -712,12 +732,16 @@ function installInitialLoadDetector(ts: TsjsApi): void {
 function installScheduleInitialAdInit(ts: TsjsApi): void {
   ts.scheduleInitialAdInit = function (
     initialBids?: Record<string, AuctionBidData>,
-    initialSlots?: AuctionSlot[]
+    initialSlots?: AuctionSlot[],
+    initialAuctionDiagnostics?: AuctionDiagnosticsData
   ) {
     if ((ts.navGeneration ?? 0) !== 0 || ts.initialAdInitScheduled) return;
     ts.initialAdInitScheduled = true;
     if (initialSlots !== undefined) ts.adSlots = initialSlots;
     if (initialBids !== undefined) ts.bids = initialBids;
+    if (initialAuctionDiagnostics !== undefined) {
+      ts.auctionDiagnostics = initialAuctionDiagnostics;
+    }
     const runUnlessNavigated = (): void => {
       if ((ts.navGeneration ?? 0) !== 0) return;
       ts.adInit?.();
@@ -949,6 +973,7 @@ export function installTsAdInit(): void {
     // first act and stands down rather than applying this invocation's
     // slots/bids to the newer route's DOM and double-requesting it.
     const generation = ts.navGeneration ?? 0;
+    const auctionDiagnostics = ts.auctionDiagnostics ? { ...ts.auctionDiagnostics } : undefined;
     const g = (window as GptWindow).googletag;
     if (!g) return;
     const warnedResolutionFailures = new Set<string>();
@@ -1084,12 +1109,14 @@ export function installTsAdInit(): void {
         try {
           const requestedSlotSizes = ts.gptSlotHandoffs?.[slotDivId2]?.formats;
           const opportunity = trustedServerOpportunity(bid);
+          const auctionFacts = diagnosticsAuctionFacts(generation, auctionDiagnostics, bid);
           ts.gptDiagnosticsRecorder?.recordTrustedServerOpportunity(
             gptSlot,
             slot.id,
             opportunity,
             bid.hb_auction_id,
-            requestedSlotSizes
+            requestedSlotSizes,
+            auctionFacts
           );
         } catch {
           // Diagnostics must not alter ad delivery.
@@ -1193,6 +1220,7 @@ export function installTsAdInit(): void {
 interface PageBidsResponse {
   slots: AuctionSlot[];
   bids: Record<string, AuctionBidData>;
+  auctionDiagnostics?: AuctionDiagnosticsData;
 }
 
 /** Canonical SPA re-auction endpoint. Mirrors `PAGE_BIDS_PATH` in Rust. */
@@ -1398,6 +1426,9 @@ export function installSpaAuctionHook(): void {
     if (path === currentPath) return;
     currentPath = path;
     ts.navGeneration = (ts.navGeneration ?? 0) + 1;
+    // Server timings belong to the route that produced them. Clear them before
+    // page-bids starts so failure or supersession cannot relabel stale offsets.
+    ts.auctionDiagnostics = undefined;
     // A route change invalidates hydration aliases before the new route's
     // publisher can define a same-prefix slot while page-bids is in flight.
     for (const [elementId, handoff] of Object.entries(ts.gptSlotHandoffs ?? {})) {
@@ -1424,6 +1455,7 @@ export function installSpaAuctionHook(): void {
       if (inflight !== controller) return;
       ts.adSlots = data.slots;
       ts.bids = data.bids;
+      ts.auctionDiagnostics = data.auctionDiagnostics;
       // This route is now the committed, loaded state — a later failed
       // navigation rolls back here, and a return trip no-ops correctly.
       lastAppliedPath = path;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
index 475bc7f93..cbd2b82e2 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/api.ts
@@ -1,5 +1,6 @@
 import type {
   GptDiagnosticsApi,
+  GptDiagnosticsAuctionFacts,
   GptDiagnosticsCreativeFailure,
   GptDiagnosticsExportV1,
   GptDiagnosticsRecorder,
@@ -18,7 +19,8 @@ interface ApiStore {
     auctionSlotId: string,
     opportunity: GptDiagnosticsTrustedServerOpportunity,
     trustedServerAuctionId?: string,
-    requestedSlotSizes?: ReadonlyArray<readonly [number, number]>
+    requestedSlotSizes?: ReadonlyArray<readonly [number, number]>,
+    auctionFacts?: GptDiagnosticsAuctionFacts
   ): void;
   recordPrebidRefresh(slots: GptDiagnosticsSlotHandle[]): void;
   recordTrustedServerCreativeRequest(auctionSlotId: string): number | undefined;
@@ -67,6 +69,10 @@ function cloneExportSnapshot(snapshot: GptDiagnosticsExportV1): GptDiagnosticsEx
         requestedSlotSizes: cycle.requestedSlotSizes?.map((size) => [...size]),
         size: cycle.size ? [...cycle.size] : undefined,
         observedSlotSize: cycle.observedSlotSize ? [...cycle.observedSlotSize] : undefined,
+        ...(cycle.auctionWinner ? { auctionWinner: { ...cycle.auctionWinner } } : {}),
+        ...(cycle.serverAuctionTimings
+          ? { serverAuctionTimings: { ...cycle.serverAuctionTimings } }
+          : {}),
         adManager: cycle.adManager
           ? {
               ...cycle.adManager,
@@ -157,7 +163,8 @@ export class GptDiagnosticsApiController {
         auctionSlotId,
         opportunity,
         trustedServerAuctionId,
-        requestedSlotSizes
+        requestedSlotSizes,
+        auctionFacts
       ) =>
         safelyRecord(() => {
           this.store.recordTrustedServerOpportunity(
@@ -165,7 +172,8 @@ export class GptDiagnosticsApiController {
             auctionSlotId,
             opportunity,
             trustedServerAuctionId,
-            requestedSlotSizes
+            requestedSlotSizes,
+            auctionFacts
           );
         }),
       recordPrebidRefresh: (slots) => safelyRecord(() => this.store.recordPrebidRefresh(slots)),
@@ -200,6 +208,10 @@ export class GptDiagnosticsApiController {
           requestedSlotSizes: cycle.requestedSlotSizes?.map((size) => [...size]),
           size: cycle.size ? [...cycle.size] : undefined,
           observedSlotSize: cycle.observedSlotSize ? [...cycle.observedSlotSize] : undefined,
+          ...(cycle.auctionWinner ? { auctionWinner: { ...cycle.auctionWinner } } : {}),
+          ...(cycle.serverAuctionTimings
+            ? { serverAuctionTimings: { ...cycle.serverAuctionTimings } }
+            : {}),
           adManager: cycle.adManager
             ? {
                 ...cycle.adManager,
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts
index 643dc355a..86dddd223 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/badges.ts
@@ -2,7 +2,12 @@ import type { GptDiagnosticsRequestCycle } from '../../core/types';
 
 import type { GptDiagnosticsBindingManager } from './binding';
 import { unhandledCase } from './exhaustive';
-import { formatSizes, scheduleFrame } from './presentation_helpers';
+import {
+  auctionTypeLabel,
+  displayableGptFillSize,
+  formatSizes,
+  scheduleFrame,
+} from './presentation_helpers';
 import type {
   GptDiagnosticsBindingInput,
   GptDiagnosticsStoreSlotSnapshot,
@@ -106,9 +111,12 @@ function badgeText(cycle: GptDiagnosticsRequestCycle): string {
   else if (cycle.isEmpty === false) firstLine.push('Filled');
   else if (cycle.renderAtMs !== undefined) firstLine.push('Rendered (fill unknown)');
   else firstLine.push('Pending');
+  if (cycle.auctionType) firstLine.push(auctionTypeLabel(cycle.auctionType));
   const delivery = deliveryLabel(cycle);
   if (delivery) firstLine.push(delivery);
-  if (cycle.requestPath === 'competing') firstLine.push('Competing paths');
+  if (cycle.requestPath === 'competing' && cycle.auctionType !== 'competing') {
+    firstLine.push('Competing paths');
+  }
   if (cycle.requestedSlotSizes) {
     const displayedSizes = cycle.requestedSlotSizes.slice(0, MAX_BADGE_REQUESTED_SLOT_SIZES);
     const remainingSizeCount = cycle.requestedSlotSizes.length - displayedSizes.length;
@@ -116,16 +124,17 @@ function badgeText(cycle: GptDiagnosticsRequestCycle): string {
       `Req ${formatSizes(displayedSizes)}${remainingSizeCount > 0 ? ` +${remainingSizeCount}` : ''}`
     );
   }
-  if (cycle.size) firstLine.push(`Fill ${cycle.size[0]}×${cycle.size[1]}`);
+  const fillSize = displayableGptFillSize(cycle.size);
+  if (fillSize) firstLine.push(`Fill ${fillSize[0]}×${fillSize[1]}`);
   if (cycle.observedSlotSize) {
-    firstLine.push(`Box ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
+    firstLine.push(`Size filled ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
   }
 
   const timingLine: string[] = [];
   const response = formatMilliseconds(cycle.durations.requestToResponseMs);
   const render = formatMilliseconds(cycle.durations.responseToRenderMs);
-  if (response) timingLine.push(`Response ${response}`);
-  if (render) timingLine.push(`Render ${render}`);
+  if (response) timingLine.push(`GAM request → response ${response}`);
+  if (render) timingLine.push(`GAM response → render ${render}`);
 
   const lines = [firstLine.join(' · ')];
   if (timingLine.length > 0) lines.push(timingLine.join(' · '));
@@ -204,7 +213,7 @@ export class GptDiagnosticsBadgeManager {
       const badge = this.document.createElement('div');
       badge.className = 'tsgd-badge';
       badge.dataset.runtimeSlot = String(slot.runtimeSlotNumber);
-      badge.textContent = badgeText(cycle);
+      badge.textContent = `Ad #${slot.runtimeSlotNumber} · ${badgeText(cycle)}`;
       badge.style.maxWidth = `${BADGE_MAX_WIDTH_PX}px`;
       badge.style.left = `${Math.max(
         BADGE_EDGE_GUTTER_PX,
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
index 63c0b6fb3..35aed65a7 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/overlay.ts
@@ -3,7 +3,12 @@ import type { GptDiagnosticsRequestCycle } from '../../core/types';
 
 import type { GptDiagnosticsBindingManager } from './binding';
 import { unhandledCase } from './exhaustive';
-import { formatSizes, scheduleFrame } from './presentation_helpers';
+import {
+  auctionTypeLabel,
+  displayableGptFillSize,
+  formatSizes,
+  scheduleFrame,
+} from './presentation_helpers';
 import type { GptDiagnosticsStoreSlotSnapshot, GptDiagnosticsStoreSnapshot } from './store';
 
 export const GPT_DIAGNOSTICS_HOST_ID = 'trusted-server-gpt-diagnostics';
@@ -229,6 +234,37 @@ function cycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
   if (typeof cycle.trustedServerAuctionId === 'string' && cycle.trustedServerAuctionId.length > 0) {
     facts.push(`Trusted Server auction: ${cycle.trustedServerAuctionId}`);
   }
+  if (cycle.auctionType) facts.push(`Auction type: ${auctionTypeLabel(cycle.auctionType)}`);
+  if (cycle.auctionWinner) {
+    facts.push(`Winning bidder: ${cycle.auctionWinner.bidder}`);
+    facts.push(`Winning bid price bucket: ${cycle.auctionWinner.priceBucket}`);
+  }
+  if (cycle.serverAuctionTimings) {
+    const timingOrigin =
+      cycle.serverAuctionTimingOrigin ??
+      (cycle.auctionType === 'trusted_server' ? 'spa_auction' : 'navigation');
+    const timingAnchor =
+      timingOrigin === 'spa_auction' ? 'SPA page-bids request T0' : 'Initial document request T0';
+    const serverTimings = [
+      [`${timingAnchor} → auction dispatched`, cycle.serverAuctionTimings.auctionDispatchedMs],
+      [`${timingAnchor} → auction resolved`, cycle.serverAuctionTimings.auctionResolvedMs],
+      [`${timingAnchor} → bids committed`, cycle.serverAuctionTimings.auctionCommittedMs],
+    ] as const;
+    for (const [label, timing] of serverTimings) {
+      const formatted = formatMilliseconds(timing);
+      if (formatted) facts.push(`${label} ${formatted}`);
+    }
+    const wait = formatMilliseconds(cycle.serverAuctionTimings.auctionWaitMs);
+    if (wait) {
+      const placement =
+        cycle.serverAuctionTimings.auctionWaitPlacement === 'pre_header'
+          ? 'pre-header'
+          : cycle.serverAuctionTimings.auctionWaitPlacement === 'in_stream'
+            ? 'in stream'
+            : 'placement unknown';
+      facts.push(`Auction wait (${placement}) ${wait}`);
+    }
+  }
   const opportunityToRequest = formatMilliseconds(cycle.opportunityToRequestMs);
   if (opportunityToRequest) facts.push(`Opportunity → request ${opportunityToRequest}`);
   const previousRenderToRequest = formatMilliseconds(cycle.previousRenderToRequestMs);
@@ -273,9 +309,10 @@ function cycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
   if (cycle.requestedSlotSizes) {
     facts.push(`Requested slot sizes ${formatSizes(cycle.requestedSlotSizes)}`);
   }
-  if (cycle.size) facts.push(`GPT-reported fill size ${cycle.size[0]}×${cycle.size[1]}`);
+  const fillSize = displayableGptFillSize(cycle.size);
+  if (fillSize) facts.push(`GPT-reported fill size ${fillSize[0]}×${fillSize[1]}`);
   if (cycle.observedSlotSize) {
-    facts.push(`Observed outer slot box ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
+    facts.push(`Size filled ${cycle.observedSlotSize[0]}×${cycle.observedSlotSize[1]}`);
   }
   if (cycle.isBackfill !== undefined) facts.push(`Backfill ${cycle.isBackfill ? 'yes' : 'no'}`);
   if (cycle.slotContentChanged !== undefined) {
@@ -283,9 +320,9 @@ function cycleFacts(cycle: GptDiagnosticsRequestCycle): string[] {
   }
 
   const durations = [
-    ['Request → response', cycle.durations.requestToResponseMs],
-    ['Response → render', cycle.durations.responseToRenderMs],
-    ['Request → render', cycle.durations.requestToRenderMs],
+    ['GAM request → response', cycle.durations.requestToResponseMs],
+    ['GAM response → render', cycle.durations.responseToRenderMs],
+    ['GAM request → render', cycle.durations.requestToRenderMs],
     ['Render → load', cycle.durations.renderToLoadMs],
     ['Render → viewable', cycle.durations.renderToViewableMs],
   ] as const;
@@ -599,7 +636,7 @@ export class GptDiagnosticsOverlay {
     const title = this.document.createElement('div');
     title.className = 'tsgd-slot-title';
     const name = this.document.createElement('strong');
-    name.textContent = slot.slotElementId ?? `Unbound GPT slot ${slot.runtimeSlotNumber}`;
+    name.textContent = `Ad #${slot.runtimeSlotNumber} · ${slot.slotElementId ?? 'Unbound GPT slot'}`;
     const latest = latestCycle(slot);
     const state = this.document.createElement('span');
     state.className = 'tsgd-state';
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts
index b601833b8..7e26778d1 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/presentation_helpers.ts
@@ -1,10 +1,29 @@
-import type { Size } from '../../core/types';
+import type { GptDiagnosticsAuctionType, Size } from '../../core/types';
 
 /** Formats CSS sizes consistently across diagnostics presentation surfaces. */
 export function formatSizes(sizes: ReadonlyArray<Size>): string {
   return sizes.map((size) => `${size[0]}×${size[1]}`).join(', ');
 }
 
+/** Hide GPT's ubiquitous 1×1 placeholder from presentation while retaining it in exports. */
+export function displayableGptFillSize(size: Size | undefined): Size | undefined {
+  return size?.[0] === 1 && size[1] === 1 ? undefined : size;
+}
+
+/** Human-readable auction classification shared by the badge and side panel. */
+export function auctionTypeLabel(type: GptDiagnosticsAuctionType): string {
+  switch (type) {
+    case 'ssat':
+      return 'SSAT';
+    case 'trusted_server':
+      return 'TS auction';
+    case 'client_side':
+      return 'Client-side auction';
+    case 'competing':
+      return 'Competing auctions';
+  }
+}
+
 /** Schedules presentation work in the target window's next animation frame. */
 export function scheduleFrame(
   window: Pick<Window, 'requestAnimationFrame'>,
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts
index ca3348ae9..f0e006cac 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/store.ts
@@ -1,4 +1,5 @@
 import type {
+  AuctionDiagnosticsData,
   GptDiagnosticsAdManagerIdentity,
   GptDiagnosticsAttributionIssue,
   GptDiagnosticsAttributionIssueReason,
@@ -8,10 +9,14 @@ import type {
   GptDiagnosticsCoverageCounters,
   GptDiagnosticsCreativeFailure,
   GptDiagnosticsDelivery,
+  GptDiagnosticsAuctionFacts,
+  GptDiagnosticsAuctionType,
+  GptDiagnosticsAuctionWinner,
   GptDiagnosticsDurations,
   GptDiagnosticsRequestCycle,
   GptDiagnosticsRequestPath,
   GptDiagnosticsResponseClass,
+  GptDiagnosticsServerAuctionTimingOrigin,
   GptDiagnosticsSlotHandle,
   GptDiagnosticsTrustedServerOpportunity,
   Size,
@@ -108,6 +113,9 @@ interface PendingSourceEvidence {
   trustedServerOpportunity?: GptDiagnosticsTrustedServerOpportunity;
   trustedServerAuctionId?: string;
   requestedSlotSizes?: ReadonlyArray<Size>;
+  auctionType?: Extract<GptDiagnosticsAuctionType, 'ssat' | 'trusted_server'>;
+  auctionWinner?: GptDiagnosticsAuctionWinner;
+  serverAuctionTimings?: AuctionDiagnosticsData;
 }
 
 interface PendingRequestIntent {
@@ -230,6 +238,73 @@ function normalizedRequestedSlotSizes(value: unknown): ReadonlyArray<Size> | und
   return requestedSlotSizes.length > 0 ? Object.freeze(requestedSlotSizes) : undefined;
 }
 
+function normalizedBoundedString(value: unknown, maxBytes: number): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || new TextEncoder().encode(trimmed).length > maxBytes) return undefined;
+  return trimmed;
+}
+
+function normalizedAuctionWinner(value: unknown): GptDiagnosticsAuctionWinner | undefined {
+  if (typeof value !== 'object' || value === null) return undefined;
+  const candidate = value as Partial<GptDiagnosticsAuctionWinner>;
+  const bidder = normalizedBoundedString(candidate.bidder, 128);
+  const priceBucket = normalizedBoundedString(candidate.priceBucket, 64);
+  if (!bidder || !priceBucket || !/^\d+(?:\.\d+)?$/.test(priceBucket)) return undefined;
+  return Object.freeze({ bidder, priceBucket });
+}
+
+const MAX_SERVER_AUCTION_TIMING_MS = 0xffffffff;
+
+function normalizedTiming(value: unknown): number | undefined {
+  return typeof value === 'number' &&
+    Number.isFinite(value) &&
+    value >= 0 &&
+    value <= MAX_SERVER_AUCTION_TIMING_MS
+    ? value
+    : undefined;
+}
+
+function normalizedServerAuctionTimings(value: unknown): AuctionDiagnosticsData | undefined {
+  if (typeof value !== 'object' || value === null) return undefined;
+  const candidate = value as AuctionDiagnosticsData;
+  const timings: AuctionDiagnosticsData = {
+    auctionDispatchedMs: normalizedTiming(candidate.auctionDispatchedMs),
+    auctionResolvedMs: normalizedTiming(candidate.auctionResolvedMs),
+    auctionCommittedMs: normalizedTiming(candidate.auctionCommittedMs),
+    auctionWaitMs: normalizedTiming(candidate.auctionWaitMs),
+    auctionWaitPlacement:
+      candidate.auctionWaitPlacement === 'pre_header' ||
+      candidate.auctionWaitPlacement === 'in_stream'
+        ? candidate.auctionWaitPlacement
+        : undefined,
+  };
+  return Object.values(timings).some((entry) => entry !== undefined)
+    ? Object.freeze(timings)
+    : undefined;
+}
+
+function normalizedAuctionFacts(
+  value: unknown
+): Omit<
+  PendingSourceEvidence,
+  'observedAtMs' | 'trustedServerOpportunity' | 'trustedServerAuctionId' | 'requestedSlotSizes'
+> {
+  if (typeof value !== 'object' || value === null) return {};
+  const candidate = value as GptDiagnosticsAuctionFacts;
+  const auctionType =
+    candidate.auctionType === 'ssat' || candidate.auctionType === 'trusted_server'
+      ? candidate.auctionType
+      : undefined;
+  const auctionWinner = normalizedAuctionWinner(candidate.winner);
+  const serverAuctionTimings = normalizedServerAuctionTimings(candidate.serverTimings);
+  return {
+    ...(auctionType ? { auctionType } : {}),
+    ...(auctionWinner ? { auctionWinner } : {}),
+    ...(serverAuctionTimings ? { serverAuctionTimings } : {}),
+  };
+}
+
 function responseClass(cycle: MutableRequestCycle): GptDiagnosticsResponseClass | undefined {
   if (cycle.renderAtMs === undefined) return undefined;
   if (cycle.isEmpty === true) return 'empty';
@@ -285,6 +360,10 @@ function copyCycle(cycle: MutableRequestCycle, nowMs: number): GptDiagnosticsReq
           companyIds: cycle.adManager.companyIds ? [...cycle.adManager.companyIds] : undefined,
         }
       : undefined,
+    ...(cycle.auctionWinner ? { auctionWinner: { ...cycle.auctionWinner } } : {}),
+    ...(cycle.serverAuctionTimings
+      ? { serverAuctionTimings: { ...cycle.serverAuctionTimings } }
+      : {}),
     trustedServerCreativeFailures: cycle.trustedServerCreativeFailures
       ? [...cycle.trustedServerCreativeFailures]
       : undefined,
@@ -337,7 +416,8 @@ export class GptDiagnosticsStore {
     auctionSlotId: string,
     opportunity: GptDiagnosticsTrustedServerOpportunity,
     trustedServerAuctionId?: string,
-    requestedSlotSizes?: ReadonlyArray<Size>
+    requestedSlotSizes?: ReadonlyArray<Size>,
+    auctionFacts?: GptDiagnosticsAuctionFacts
   ): void {
     if (
       !isSlotObject(slot) ||
@@ -360,6 +440,7 @@ export class GptDiagnosticsStore {
       trustedServerOpportunity: opportunity,
       trustedServerAuctionId: normalizedAuctionId(trustedServerAuctionId),
       requestedSlotSizes: normalizedRequestedSlotSizes(requestedSlotSizes),
+      ...normalizedAuctionFacts(auctionFacts),
     });
   }
 
@@ -594,6 +675,13 @@ export class GptDiagnosticsStore {
     const intent = this.consumeRequestIntent(slot, timestampMs);
     const trustedServerEvidence = intent?.sources.get('trusted_server_direct');
     const requestPath = this.requestPath(intent);
+    const auctionType = this.auctionType(intent, trustedServerEvidence);
+    const serverAuctionTimingOrigin: GptDiagnosticsServerAuctionTimingOrigin | undefined =
+      trustedServerEvidence?.serverAuctionTimings === undefined
+        ? undefined
+        : trustedServerEvidence.auctionType === 'trusted_server'
+          ? 'spa_auction'
+          : 'navigation';
     record.requests.push({
       requestNumber,
       requestedAtMs: timestampMs,
@@ -607,6 +695,14 @@ export class GptDiagnosticsStore {
       ...(trustedServerEvidence?.trustedServerAuctionId !== undefined
         ? { trustedServerAuctionId: trustedServerEvidence.trustedServerAuctionId }
         : {}),
+      ...(auctionType !== undefined ? { auctionType } : {}),
+      ...(trustedServerEvidence?.auctionWinner !== undefined
+        ? { auctionWinner: trustedServerEvidence.auctionWinner }
+        : {}),
+      ...(trustedServerEvidence?.serverAuctionTimings !== undefined
+        ? { serverAuctionTimings: trustedServerEvidence.serverAuctionTimings }
+        : {}),
+      ...(serverAuctionTimingOrigin !== undefined ? { serverAuctionTimingOrigin } : {}),
       ...(trustedServerEvidence?.requestedSlotSizes !== undefined
         ? { requestedSlotSizes: trustedServerEvidence.requestedSlotSizes }
         : {}),
@@ -934,10 +1030,7 @@ export class GptDiagnosticsStore {
   private recordRequestIntentSource(
     slot: object,
     source: RequestIntentSource,
-    facts: Pick<
-      PendingSourceEvidence,
-      'trustedServerOpportunity' | 'trustedServerAuctionId' | 'requestedSlotSizes'
-    > = {}
+    facts: Omit<PendingSourceEvidence, 'observedAtMs'> = {}
   ): void {
     const observedAtMs = this.now();
     let intent = this.pendingRequestIntents.get(slot);
@@ -1025,6 +1118,18 @@ export class GptDiagnosticsStore {
     return source ?? 'unattributed';
   }
 
+  private auctionType(
+    intent: PendingRequestIntent | undefined,
+    trustedServerEvidence: PendingSourceEvidence | undefined
+  ): GptDiagnosticsAuctionType | undefined {
+    const hasTrustedServerAuction = intent?.sources.has('trusted_server_direct') === true;
+    const hasClientSideAuction = intent?.sources.has('prebid_refresh') === true;
+    if (hasTrustedServerAuction && hasClientSideAuction) return 'competing';
+    if (hasClientSideAuction) return 'client_side';
+    if (hasTrustedServerAuction) return trustedServerEvidence?.auctionType;
+    return undefined;
+  }
+
   private recordReplacement(record: MutableSlotRecord, cycle: MutableRequestCycle): void {
     const currentIndex = record.requests.indexOf(cycle);
     if (currentIndex <= 0) return;
@@ -1093,13 +1198,15 @@ export class GptDiagnosticsStore {
       }
     }
 
-    const runtimeSlotNumber = this.nextRuntimeSlotNumber;
-    this.nextRuntimeSlotNumber += 1;
+    const runtimeSlotNumber = existingNumber ?? this.nextRuntimeSlotNumber;
+    if (existingNumber === undefined) {
+      this.nextRuntimeSlotNumber += 1;
+      this.slotNumbers.set(slot, runtimeSlotNumber);
+    }
     const record: MutableSlotRecord = {
       runtimeSlotNumber,
       requests: [],
     };
-    this.slotNumbers.set(slot, runtimeSlotNumber);
     this.refreshSlotMetadata(record, slot);
     this.slots.set(runtimeSlotNumber, record);
     this.slotOrder.push(runtimeSlotNumber);
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index b7186518b..fd318caee 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -332,7 +332,8 @@ describe('installTsAdInit', () => {
         'atf_sidebar_ad',
         expectedOpportunity,
         undefined,
-        undefined
+        undefined,
+        { auctionType: 'ssat' }
       );
     }
   );
@@ -358,7 +359,67 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'unrenderable_candidate',
       'auction-123',
-      undefined
+      undefined,
+      {
+        auctionType: 'ssat',
+        winner: { bidder: 'example', priceBucket: '1.00' },
+      }
+    );
+  });
+
+  it('snapshots auction timing with the bids before queued GPT work runs', async () => {
+    const recordTrustedServerOpportunity = vi.fn();
+    const { mockSlot } = configureOpportunityDiagnostics(
+      { hb_pb: '1.00', hb_bidder: 'example', hb_adid: 'creative-1' },
+      recordTrustedServerOpportunity
+    );
+    const ts = (window as TestWindow).tsjs!;
+    ts.auctionDiagnostics = { auctionResolvedMs: 84 };
+
+    const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+    installTsAdInit();
+    let queued: (() => void) | undefined;
+    const googletag = (window as TestWindow).googletag as {
+      cmd: { push(callback: () => void): void };
+    };
+    googletag.cmd.push = (callback) => {
+      queued = callback;
+    };
+
+    ts.adInit!();
+    ts.auctionDiagnostics.auctionResolvedMs = 99;
+    queued?.();
+
+    expect(recordTrustedServerOpportunity).toHaveBeenCalledWith(
+      mockSlot,
+      'atf_sidebar_ad',
+      'unrenderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'ssat',
+        winner: { bidder: 'example', priceBucket: '1.00' },
+        serverTimings: { auctionResolvedMs: 84 },
+      }
+    );
+  });
+
+  it('forwards SPA auction classification without inventing a winner', async () => {
+    const recordTrustedServerOpportunity = vi.fn();
+    const { mockSlot } = configureOpportunityDiagnostics(undefined, recordTrustedServerOpportunity);
+    (window as TestWindow).tsjs!.navGeneration = 1;
+
+    const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(recordTrustedServerOpportunity).toHaveBeenCalledWith(
+      mockSlot,
+      'atf_sidebar_ad',
+      'no_candidate',
+      undefined,
+      undefined,
+      { auctionType: 'trusted_server' }
     );
   });
 
@@ -395,7 +456,8 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'no_candidate',
       undefined,
-      formats
+      formats,
+      { auctionType: 'ssat' }
     );
   });
 
@@ -421,7 +483,8 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'no_candidate',
       undefined,
-      formats
+      formats,
+      { auctionType: 'ssat' }
     );
   });
 
@@ -461,7 +524,8 @@ describe('installTsAdInit', () => {
       'atf_sidebar_ad',
       'no_candidate',
       undefined,
-      undefined
+      undefined,
+      { auctionType: 'ssat' }
     );
   });
 
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts
index ab6d646f2..295fe2581 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/gpt_bootstrap.test.ts
@@ -348,10 +348,14 @@ describe('gpt_bootstrap.js fallback', () => {
     const adInit = vi.fn();
     ts.adInit = adInit;
     ts.bids = { live_slot: { hb_pb: '2.50' } };
+    ts.auctionDiagnostics = { auctionResolvedMs: 10 };
     ts.navGeneration = 1;
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } });
+    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, undefined, {
+      auctionResolvedMs: 99,
+    });
     expect(ts.bids).toEqual({ live_slot: { hb_pb: '2.50' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 10 });
 
     window.dispatchEvent(new Event('load'));
     flushFrame();
@@ -380,8 +384,10 @@ describe('gpt_bootstrap.js fallback', () => {
       formats: [[728, 90]] as Array<[number, number]>,
     };
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, [ssrSlot]);
+    const auctionDiagnostics = { auctionResolvedMs: 84 };
+    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, [ssrSlot], auctionDiagnostics);
     expect(ts.adSlots).toEqual([ssrSlot]);
+    expect(ts.auctionDiagnostics).toEqual(auctionDiagnostics);
 
     ts.adSlots = [liveSlot];
     ts.navGeneration = 1;
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
index 727300aa1..03835a3c3 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/schedule_initial_ad_init.test.ts
@@ -325,9 +325,13 @@ describe('scheduleInitialAdInit', () => {
     await flushAsync();
     expect(ts.navGeneration).toBe(1);
     ts.bids = { live_slot: { hb_pb: '2.50' } };
+    ts.auctionDiagnostics = { auctionResolvedMs: 10 };
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } });
+    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, undefined, {
+      auctionResolvedMs: 99,
+    });
     expect(ts.bids).toEqual({ live_slot: { hb_pb: '2.50' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 10 });
 
     window.dispatchEvent(new Event('load'));
     flushFrame();
@@ -346,6 +350,7 @@ describe('scheduleInitialAdInit', () => {
       json: async () => ({
         slots: [{ id: 's1', div_id: 'div-s1' }],
         bids: { s1: { hb_pb: '3.00' } },
+        auctionDiagnostics: { auctionResolvedMs: 84 },
       }),
     });
     await importGptModule();
@@ -356,6 +361,7 @@ describe('scheduleInitialAdInit', () => {
     history.pushState({}, '', '/b');
     await flushAsync();
     expect(ts.bids).toEqual({ s1: { hb_pb: '3.00' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 84 });
     expect(adInit).toHaveBeenCalledTimes(1);
 
     ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } });
@@ -364,6 +370,7 @@ describe('scheduleInitialAdInit', () => {
     flushFrame();
 
     expect(ts.bids).toEqual({ s1: { hb_pb: '3.00' } });
+    expect(ts.auctionDiagnostics).toEqual({ auctionResolvedMs: 84 });
     expect(adInit).toHaveBeenCalledTimes(1);
   });
 
@@ -381,10 +388,18 @@ describe('scheduleInitialAdInit', () => {
       formats: [[728, 90]] as Array<[number, number]>,
     };
 
-    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, [ssrSlot]);
+    const auctionDiagnostics = {
+      auctionDispatchedMs: 4,
+      auctionResolvedMs: 84,
+      auctionCommittedMs: 85,
+      auctionWaitMs: 80,
+      auctionWaitPlacement: 'pre_header' as const,
+    };
+    ts.scheduleInitialAdInit!({ ssr_slot: { hb_pb: '1.00' } }, [ssrSlot], auctionDiagnostics);
 
     expect(ts.adSlots).toEqual([ssrSlot]);
     expect(ts.bids).toEqual({ ssr_slot: { hb_pb: '1.00' } });
+    expect(ts.auctionDiagnostics).toEqual(auctionDiagnostics);
   });
 
   it('preserves head-injected slots when initialSlots is omitted', async () => {
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 314348fa8..f2ab30573 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -513,9 +513,13 @@ describe('installSpaAuctionHook', () => {
     const ts = (window as TestWindow).tsjs!;
     const adInit = vi.fn();
     ts.adInit = adInit;
+    ts.auctionDiagnostics = { auctionResolvedMs: 84 };
 
     history.pushState({}, '', '/first');
+    expect(ts.auctionDiagnostics).toBeUndefined();
+    ts.auctionDiagnostics = { auctionResolvedMs: 40 };
     history.pushState({}, '', '/second');
+    expect(ts.auctionDiagnostics).toBeUndefined();
     await flushAsync();
 
     expect(ts.adSlots).toEqual([{ id: 'newer', div_id: 'div-newer' }]);
@@ -539,13 +543,16 @@ describe('installSpaAuctionHook', () => {
     installSpaAuctionHook();
     const ts = (window as TestWindow).tsjs!;
     ts.adSlots = [{ id: 'existing' } as never];
+    ts.auctionDiagnostics = { auctionResolvedMs: 84 };
     const adInit = vi.fn();
     ts.adInit = adInit;
 
     history.pushState({}, '', '/error-page');
+    expect(ts.auctionDiagnostics).toBeUndefined();
     await flushAsync();
 
     expect(ts.adSlots).toEqual([{ id: 'existing' }]);
+    expect(ts.auctionDiagnostics).toBeUndefined();
     expect(adInit).not.toHaveBeenCalled();
   });
 
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts
index abbdeca69..974f5d64e 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/api.test.ts
@@ -112,7 +112,10 @@ describe('GptDiagnosticsApiController', () => {
     controller.recorder.recordTrustedServerOpportunity(
       slot,
       'auction-slot-example',
-      'renderable_candidate'
+      'renderable_candidate',
+      undefined,
+      undefined,
+      { auctionType: 'ssat' }
     );
     controller.recorder.recordPrebidRefresh(slots);
     const attemptId =
@@ -126,7 +129,8 @@ describe('GptDiagnosticsApiController', () => {
       'auction-slot-example',
       'renderable_candidate',
       undefined,
-      undefined
+      undefined,
+      { auctionType: 'ssat' }
     );
     expect(store.recordPrebidRefresh).toHaveBeenCalledTimes(1);
     expect(store.recordPrebidRefresh).toHaveBeenCalledWith(slots);
@@ -159,6 +163,7 @@ describe('GptDiagnosticsApiController', () => {
       'auction-slot-example',
       'renderable_candidate',
       'auction-123',
+      undefined,
       undefined
     );
   });
@@ -225,6 +230,9 @@ describe('GptDiagnosticsApiController', () => {
                 yieldGroupIds: [10],
                 companyIds: [20],
               },
+              auctionWinner: { bidder: 'example', priceBucket: '1.20' },
+              serverAuctionTimings: { auctionResolvedMs: 84 },
+              serverAuctionTimingOrigin: 'spa_auction' as const,
               trustedServerCreativeFailures: ['cache_fetch_failed' as const],
             },
           ],
@@ -280,6 +288,13 @@ describe('GptDiagnosticsApiController', () => {
     expect(cycle?.adManager?.companyIds).not.toBe(
       source.slots[0]?.requests[0]?.adManager.companyIds
     );
+    expect(cycle?.auctionWinner).toEqual({ bidder: 'example', priceBucket: '1.20' });
+    expect(cycle?.auctionWinner).not.toBe(source.slots[0]?.requests[0]?.auctionWinner);
+    expect(cycle?.serverAuctionTimings).toEqual({ auctionResolvedMs: 84 });
+    expect(cycle?.serverAuctionTimings).not.toBe(
+      source.slots[0]?.requests[0]?.serverAuctionTimings
+    );
+    expect(cycle?.serverAuctionTimingOrigin).toBe('spa_auction');
     expect(snapshot.metadata).not.toBe(source.metadata);
     expect(snapshot.metadata.droppedAttributionIssues).toBe(2);
   });
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts
index 329c4d299..a26683d3a 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/badges.test.ts
@@ -112,6 +112,7 @@ describe('GptDiagnosticsBadgeManager', () => {
 
     expect(layer.querySelectorAll('.tsgd-badge')).toHaveLength(1);
     expect(layer.querySelector<HTMLElement>('.tsgd-badge')?.dataset.runtimeSlot).toBe('1');
+    expect(layer.querySelector<HTMLElement>('.tsgd-badge')?.textContent).toContain('Ad #1');
     manager.destroy();
   });
 
@@ -266,7 +267,7 @@ describe('GptDiagnosticsBadgeManager', () => {
         },
       })
     ).toBe(
-      'Filled · Req 728×90, 970×250 · Fill 728×90 · Box 980×270\nResponse 276 ms · Render 42 ms\nViewable after 1 s'
+      'Filled · Req 728×90, 970×250 · Fill 728×90 · Size filled 980×270\nGAM request → response 276 ms · GAM response → render 42 ms\nViewable after 1 s'
     );
     expect(
       gptDiagnosticsBadgeTextForTest({
@@ -282,6 +283,17 @@ describe('GptDiagnosticsBadgeManager', () => {
         durations: {},
       })
     ).toBe('Filled · Req 300×250, 320×50, 728×90 +1');
+    expect(
+      gptDiagnosticsBadgeTextForTest({
+        requestNumber: 1,
+        isEmpty: false,
+        size: [1, 1],
+        observedSlotSize: [728, 90],
+        auctionType: 'ssat',
+        incompleteSequence: false,
+        durations: {},
+      })
+    ).toBe('Filled · SSAT · Size filled 728×90');
     expect(
       gptDiagnosticsBadgeTextForTest({
         requestNumber: 1,
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts
index 41cad667a..c20d6d7f5 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/overlay.test.ts
@@ -110,7 +110,7 @@ describe('GptDiagnosticsOverlay', () => {
     overlay.destroy();
   });
 
-  it('presents the request path and Trusted Server delivery evidence without winner claims', () => {
+  it('presents request-path, auction, winner, timing, and delivery evidence', () => {
     const frames: Array<() => void> = [];
     let now = 10;
     const store = new GptDiagnosticsStore({
@@ -125,7 +125,19 @@ describe('GptDiagnosticsOverlay', () => {
       responseSentSlot,
       'auction-response-sent',
       'renderable_candidate',
-      'auction-123'
+      'auction-123',
+      undefined,
+      {
+        auctionType: 'ssat',
+        winner: { bidder: 'example-bidder', priceBucket: '1.20' },
+        serverTimings: {
+          auctionDispatchedMs: 4,
+          auctionResolvedMs: 84,
+          auctionCommittedMs: 85,
+          auctionWaitMs: 80,
+          auctionWaitPlacement: 'in_stream',
+        },
+      }
     );
     store.recordSlotRequested(responseSentSlot);
     now = 11;
@@ -162,7 +174,19 @@ describe('GptDiagnosticsOverlay', () => {
     store.recordTrustedServerOpportunity(
       selectedSlot,
       'auction-selected',
-      'unrenderable_candidate'
+      'unrenderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        serverTimings: {
+          auctionDispatchedMs: 0,
+          auctionResolvedMs: 40,
+          auctionCommittedMs: 41,
+          auctionWaitMs: 40,
+          auctionWaitPlacement: 'pre_header',
+        },
+      }
     );
     store.recordPrebidRefresh([selectedSlot]);
     store.recordSlotRequested(selectedSlot);
@@ -248,6 +272,13 @@ describe('GptDiagnosticsOverlay', () => {
     expect(responseSentArticle).toContain('Request path: Trusted Server direct');
     expect(responseSentArticle).toContain('Request intent: 1');
     expect(responseSentArticle).toContain('Trusted Server auction: auction-123');
+    expect(responseSentArticle).toContain('Auction type: SSAT');
+    expect(responseSentArticle).toContain('Winning bidder: example-bidder');
+    expect(responseSentArticle).toContain('Winning bid price bucket: 1.20');
+    expect(responseSentArticle).toContain('Initial document request T0 → auction dispatched 4 ms');
+    expect(responseSentArticle).toContain('Initial document request T0 → auction resolved 84 ms');
+    expect(responseSentArticle).toContain('Initial document request T0 → bids committed 85 ms');
+    expect(responseSentArticle).toContain('Auction wait (in stream) 80 ms');
     expect(responseSentArticle).toContain('Opportunity → request 0 ms');
     expect(responseSentArticle).toContain('Direct opportunity: Renderable candidate');
     expect(responseSentArticle).toContain('Trusted Server creative request observed at 13 ms');
@@ -271,6 +302,9 @@ describe('GptDiagnosticsOverlay', () => {
 
     const selectedArticle = slotArticle(root!, 'selected-slot').textContent ?? '';
     expect(selectedArticle).toContain('Request path: Competing paths');
+    expect(selectedArticle).toContain('Auction type: Competing auctions');
+    expect(selectedArticle).toContain('SPA page-bids request T0 → auction dispatched 0 ms');
+    expect(selectedArticle).toContain('SPA page-bids request T0 → auction resolved 40 ms');
     expect(selectedArticle).toContain('Direct opportunity: Unrenderable candidate');
     expect(selectedArticle).toContain('Trusted Server creative request observed at 23 ms');
     expect(selectedArticle).not.toContain('Trusted Server markup response sent');
@@ -466,17 +500,17 @@ describe('GptDiagnosticsOverlay', () => {
     expect(root!.textContent).toContain('GPT observed');
     expect(root!.textContent).toContain('callback issues');
     expect(root!.textContent).toContain('attribution issues');
-    expect(root!.textContent).toContain('filled-slot');
+    expect(root!.textContent).toContain('Ad #1 · filled-slot');
     expect(root!.textContent).toContain('/example/site/filled-slot');
     expect(root!.textContent).toContain('Empty');
     expect(root!.textContent).toContain('Previous requests (1)');
     expect(root!.textContent).toContain('Requested slot sizes 300×250, 728×90, 320×50, 970×250');
     expect(root!.textContent).toContain('GPT-reported fill size 300×250');
-    expect(root!.textContent).toContain('Observed outer slot box 320×270');
+    expect(root!.textContent).toContain('Size filled 320×270');
     expect(root!.textContent).toContain('Backfill yes');
     expect(root!.textContent).toContain('GPT slot onload observed');
     expect(root!.textContent).toContain('GPT impressionViewable observed');
-    expect(root!.textContent).toContain('Request → response 10 ms');
+    expect(root!.textContent).toContain('GAM request → response 10 ms');
     expect(root!.textContent).toContain('GPT visibility 60%');
     expect(root!.textContent).toContain('Requesting');
     expect(root!.textContent).toContain('Ambiguous binding');
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts
index 52aef6a7f..d92fcf23c 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt_diagnostics/store.test.ts
@@ -420,7 +420,7 @@ describe('GptDiagnosticsStore', () => {
     assertCoverageEquation(store);
   });
 
-  it('evicts least-recently-active slots and re-enters only on a new request', () => {
+  it('evicts least-recently-active slots and preserves their number on re-entry', () => {
     let now = 0;
     const store = new GptDiagnosticsStore({ now: () => ++now });
     const slots = Array.from({ length: MAX_DIAGNOSTIC_SLOTS + 1 }, (_, index) =>
@@ -444,7 +444,7 @@ describe('GptDiagnosticsStore', () => {
     store.recordSlotRequested(slots[1]);
     store.recordSlotResponseReceived(slots[1]);
     const reentered = store.snapshot().slots.find((slot) => slot.slotElementId === 'lru-1');
-    expect(reentered).toMatchObject({ runtimeSlotNumber: 66 });
+    expect(reentered).toMatchObject({ runtimeSlotNumber: 2 });
     expect(reentered?.requests[0]).toMatchObject({ requestNumber: 2 });
     expect(reentered?.requests[0].responseAtMs).toBeDefined();
     expect(store.snapshot().slots).toHaveLength(MAX_DIAGNOSTIC_SLOTS);
@@ -572,6 +572,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'trusted_server_direct',
       expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: 'ssat',
     },
     {
       name: 'a direct unrenderable candidate',
@@ -580,6 +581,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'trusted_server_direct',
       expectedOpportunity: 'unrenderable_candidate',
+      expectedAuctionType: 'ssat',
     },
     {
       name: 'a direct request without a candidate',
@@ -588,6 +590,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'trusted_server_direct',
       expectedOpportunity: 'no_candidate',
+      expectedAuctionType: 'ssat',
     },
     {
       name: 'a Prebid refresh',
@@ -596,6 +599,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'prebid_refresh',
       expectedOpportunity: undefined,
+      expectedAuctionType: 'client_side',
     },
     {
       name: 'competing direct and Prebid evidence',
@@ -604,6 +608,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'competing',
       expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: 'competing',
     },
     {
       name: 'an unattributed request',
@@ -612,6 +617,7 @@ describe('GptDiagnosticsStore', () => {
       publisher: false,
       expectedPath: 'unattributed',
       expectedOpportunity: undefined,
+      expectedAuctionType: undefined,
     },
     {
       name: 'a publisher refresh',
@@ -620,14 +626,25 @@ describe('GptDiagnosticsStore', () => {
       publisher: true,
       expectedPath: 'publisher_refresh',
       expectedOpportunity: undefined,
+      expectedAuctionType: undefined,
     },
     {
-      name: 'competing Prebid and publisher evidence',
+      name: 'direct auction with publisher refresh evidence',
+      direct: 'renderable_candidate',
+      prebid: false,
+      publisher: true,
+      expectedPath: 'competing',
+      expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: 'ssat',
+    },
+    {
+      name: 'client-side auction with publisher refresh evidence',
       direct: undefined,
       prebid: true,
       publisher: true,
       expectedPath: 'competing',
       expectedOpportunity: undefined,
+      expectedAuctionType: 'client_side',
     },
     {
       name: 'competing all source evidence',
@@ -636,15 +653,18 @@ describe('GptDiagnosticsStore', () => {
       publisher: true,
       expectedPath: 'competing',
       expectedOpportunity: 'renderable_candidate',
+      expectedAuctionType: 'competing',
     },
   ] as const)(
     'attributes $name without inferring demand ownership',
-    ({ direct, prebid, publisher, expectedPath, expectedOpportunity }) => {
+    ({ direct, prebid, publisher, expectedPath, expectedOpportunity, expectedAuctionType }) => {
       const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
       const slot = fakeSlot('path-slot');
 
       if (direct !== undefined) {
-        store.recordTrustedServerOpportunity(slot, 'auction-slot', direct);
+        store.recordTrustedServerOpportunity(slot, 'auction-slot', direct, undefined, undefined, {
+          auctionType: 'ssat',
+        });
       }
       if (prebid) store.recordPrebidRefresh([slot]);
       if (publisher) store.recordPublisherRefresh([slot]);
@@ -653,9 +673,101 @@ describe('GptDiagnosticsStore', () => {
       const cycle = store.snapshot().slots[0].requests[0];
       expect(cycle.requestPath).toBe(expectedPath);
       expect(cycle.trustedServerOpportunity).toBe(expectedOpportunity);
+      expect(cycle.auctionType).toBe(expectedAuctionType);
     }
   );
 
+  it('retains bounded winner and server timing facts for a Trusted Server auction', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('auction-facts');
+
+    store.recordTrustedServerOpportunity(
+      slot,
+      'auction-slot',
+      'renderable_candidate',
+      'auction-123',
+      [[300, 250]],
+      {
+        auctionType: 'trusted_server',
+        winner: { bidder: ' example-bidder ', priceBucket: '1.20' },
+        serverTimings: {
+          auctionDispatchedMs: 4,
+          auctionResolvedMs: 84,
+          auctionCommittedMs: 85,
+          auctionWaitMs: 80,
+          auctionWaitPlacement: 'pre_header',
+        },
+      }
+    );
+    store.recordSlotRequested(slot);
+
+    expect(store.snapshot().slots[0].requests[0]).toMatchObject({
+      auctionType: 'trusted_server',
+      auctionWinner: { bidder: 'example-bidder', priceBucket: '1.20' },
+      serverAuctionTimings: {
+        auctionDispatchedMs: 4,
+        auctionResolvedMs: 84,
+        auctionCommittedMs: 85,
+        auctionWaitMs: 80,
+        auctionWaitPlacement: 'pre_header',
+      },
+    });
+  });
+
+  it('retains the SPA timing origin when direct and Prebid auctions compete', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('competing-spa-auction');
+
+    store.recordTrustedServerOpportunity(
+      slot,
+      'auction-slot',
+      'renderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'trusted_server',
+        serverTimings: { auctionDispatchedMs: 0, auctionResolvedMs: 84 },
+      }
+    );
+    store.recordPrebidRefresh([slot]);
+    store.recordSlotRequested(slot);
+
+    expect(store.snapshot().slots[0].requests[0]).toMatchObject({
+      auctionType: 'competing',
+      serverAuctionTimingOrigin: 'spa_auction',
+      serverAuctionTimings: { auctionDispatchedMs: 0, auctionResolvedMs: 84 },
+    });
+  });
+
+  it('drops malformed winner and auction timing fields at the diagnostics boundary', () => {
+    const store = new GptDiagnosticsStore({ now: () => 10, defer: () => undefined });
+    const slot = fakeSlot('invalid-auction-facts');
+
+    store.recordTrustedServerOpportunity(
+      slot,
+      'auction-slot',
+      'renderable_candidate',
+      undefined,
+      undefined,
+      {
+        auctionType: 'invalid' as never,
+        winner: { bidder: 'example-bidder', priceBucket: 'not-a-price' },
+        serverTimings: {
+          auctionDispatchedMs: -1,
+          auctionResolvedMs: Number.NaN,
+          auctionCommittedMs: 0x1_0000_0000,
+          auctionWaitPlacement: 'elsewhere' as never,
+        },
+      }
+    );
+    store.recordSlotRequested(slot);
+
+    const cycle = store.snapshot().slots[0].requests[0];
+    expect(cycle.auctionType).toBeUndefined();
+    expect(cycle.auctionWinner).toBeUndefined();
+    expect(cycle.serverAuctionTimings).toBeUndefined();
+  });
+
   it('consumes direct and Prebid markers exactly once', () => {
     let now = 10;
     const store = new GptDiagnosticsStore({ now: () => now, defer: () => undefined });
diff --git a/docs/guide/integrations/gpt-diagnostics.md b/docs/guide/integrations/gpt-diagnostics.md
index e419a1a79..d8273174e 100644
--- a/docs/guide/integrations/gpt-diagnostics.md
+++ b/docs/guide/integrations/gpt-diagnostics.md
@@ -9,9 +9,9 @@
 
 GPT Runtime Diagnostics is an opt-in browser console for documented Google
 Publisher Tag (GPT) lifecycle callbacks and Trusted Server integration evidence.
-It groups observations into per-slot request cycles, shows timings and source-neutral
-GAM facts, binds slots to exact DOM elements, and downloads the same allowlisted data
-as versioned JSON.
+It groups observations into per-slot request cycles, shows auction and GPT timings,
+links each page badge to the same stable `Ad #N` in the side panel, binds slots to exact
+DOM elements, and downloads the same allowlisted data as versioned JSON.
 
 The console reports positive observations, not inferred ownership. A filled result
 means only that GPT emitted `slotRenderEnded` with `isEmpty === false`. A Trusted
@@ -109,8 +109,12 @@ Visible, Filled, Empty, Pending/Incomplete, and Unbound/Ambiguous slots.
 
 Each request cycle can show:
 
+- The same stable `Ad #N` used by the creative's page badge.
 - The observed request path, request-intent ID, and direct Trusted Server opportunity.
+- Auction classification: SSAT, TS auction, client-side auction, or competing auctions.
 - Opaque Trusted Server auction-ID correlation and opportunity-to-request latency when available.
+- The winning bidder and bucketed bid price from the existing `hb_bidder` and `hb_pb` bid fields.
+- Server-measured auction dispatch, resolution, commit, and wait timing when available.
 - Observed replacement of an earlier retained filled render, including GPT creative-ID transitions.
 - Requesting, Response received, Filled, Empty, or Rendered (fill unknown) GPT
   lifecycle state.
@@ -118,9 +122,11 @@ Each request cycle can show:
 - Safe, deduplicated creative-bridge failure categories.
 - Source-neutral GAM response class and identifiers reported by GPT.
 - GPT slot-onload, impression-viewable, and visibility observations.
-- Non-negative request-to-response, response-to-render, render-to-load, and
+- Non-negative GAM request-to-response, GAM response-to-render, render-to-load, and
   render-to-viewable durations.
-- GPT-reported rendered size, a separately labelled observed outer slot box when safely bound, backfill, and slot-content-change facts.
+- GPT-reported rendered size, a separately labelled `Size filled` outer-slot measurement
+  when safely bound, backfill, and slot-content-change facts. GPT's ubiquitous `1×1`
+  placeholder stays in the JSON evidence but is hidden from the panel and badge.
 - Current DOM binding status and viewport intersection.
 
 Elapsed time alone never changes a pending GPT request to Incomplete. Incomplete
@@ -129,6 +135,60 @@ step. When `slotRenderEnded` omits `isEmpty`, the result stays Rendered (fill un
 and `responseClass` remains absent. `unclassified_non_empty` requires an explicit
 `isEmpty === false` observation.
 
+## Auction Classification and Timing
+
+Auction labels describe the path observed for that GPT request cycle:
+
+| Label               | Meaning                                                                                                    |
+| ------------------- | ---------------------------------------------------------------------------------------------------------- |
+| SSAT                | The initial document's server-side auction populated the direct request.                                   |
+| TS auction          | The SPA `/_ts/page-bids` server auction populated the direct request.                                      |
+| Client-side auction | The installed Prebid refresh path was the only auction path observed.                                      |
+| Competing auctions  | Trusted Server direct and client-side Prebid auction evidence were both observed for the same GPT request. |
+
+Publisher refresh evidence does not by itself establish another auction. It remains
+visible in the request-path classification but does not turn an SSAT, TS auction, or
+client-side auction label into “Competing auctions.” Publisher-only refreshes and
+unattributed requests have no auction label because the available evidence does not
+establish an auction implementation.
+
+Server auction timing and browser GPT timing use separate clocks and are never
+subtracted from each other. Both initial SSAT and SPA TS auction offsets use the
+adapter's server-request clock. Initial offsets belong to the document request, while
+SPA offsets belong to the later `/_ts/page-bids` request. Diagnostics retain that
+request origin separately from the aggregate auction classification, so a request marked
+`competing` still labels SPA offsets from the SPA page-bids request T0. Neither server
+clock is the browser's navigation clock. The server facts are:
+
+- `auctionDispatchedMs`: bid dispatch offset from that timing origin.
+- `auctionResolvedMs`: final bid or timeout offset from the same timing origin.
+- `auctionCommittedMs`: offset when winning bids were available to page state.
+- `auctionWaitMs`: time spent awaiting the auction.
+- `auctionWaitPlacement`: whether that wait completed before HTTP response headers or
+  occurred while a document response was streaming.
+
+The SPA page-bids response includes these server timings only for an activated
+console session and a successfully dispatched auction. Failures before any provider
+dispatch do not emit timing evidence. The activation cookie is still removed before
+auction and publisher processing; the server retains only the request-scoped activation
+decision needed to gate this diagnostics field.
+
+Browser timings have different boundaries. **GAM request → response** starts at GPT's
+`slotRequested` callback and ends at `slotResponseReceived`. **GAM response → render**
+starts at `slotResponseReceived` and ends at `slotRenderEnded`. “Render” therefore
+means that GPT emitted its render-ended callback; it does not prove inner-iframe pixels
+executed or became visible.
+
+```mermaid
+flowchart TB
+    A[Server timing origin] --> B[Auction dispatched]
+    B --> C[Auction resolved]
+    C --> D[Bids committed to page state]
+    E[GPT slotRequested] --> F[GPT slotResponseReceived]
+    F --> G[GPT slotRenderEnded]
+    G --> H[GPT slotOnload / impressionViewable]
+```
+
 ## Request Paths
 
 Request-path labels describe integration paths observed immediately before one GPT
@@ -162,8 +222,10 @@ context even when the delegated refresh throws, and the Prebid wrapper restores
 exact prior value. Diagnostics never suppresses or changes a GPT request.
 
 For a direct observation, the optional opaque auction ID is retained only after
-trimming to a non-empty value no longer than 256 UTF-8 bytes. No auction payload,
-targeting map, bid price, markup, network body, or stack trace is exported. The
+trimming to a non-empty value no longer than 256 UTF-8 bytes. Winning bidder names are
+limited to 128 UTF-8 bytes, and numeric price-bucket strings to 64 bytes. The console
+exports only those winning-bid fields and the bounded timing object—not a raw auction
+payload, targeting map, exact unbucketed CPM, markup, network body, or stack trace. The
 reported opportunity-to-request duration is browser-observed only and is omitted for
 invalid or negative timing.
 
@@ -309,11 +371,12 @@ A concise viewport badge appears only when a slot:
 - Has a unique, connected exact binding.
 - Has a non-zero rectangle intersecting the viewport.
 
-A badge summarizes the slot's most recent request cycle: the GPT result (Filled, Empty,
-Rendered (fill unknown), or Pending), a short delivery label, a `Competing paths`
-marker when the request path is `competing`, the rendered size, and the request-to-
-response, response-to-render, and render-to-viewable durations that are available. It
-adds `Incomplete sequence` when a callback proved a missing or invalid earlier step.
+A badge starts with the slot's stable `Ad #N`, matching the side-panel heading. It then
+summarizes the most recent request cycle: the GPT result (Filled, Empty, Rendered (fill
+unknown), or Pending), auction type, a short delivery label, a `Competing paths` marker
+when the request path is `competing`, sizes, and the GAM request-to-response, GAM
+response-to-render, and render-to-viewable durations that are available. It adds
+`Incomplete sequence` when a callback proved a missing or invalid earlier step.
 
 Badge delivery labels are the same derived states the panel and export report, shortened
 to fit:
@@ -354,10 +417,11 @@ becomes unbound or ambiguous, the last successful sample remains as request-cycl
 evidence while the binding status reports the current DOM state. It is displayed
 separately from `size`, which remains the exact GPT-reported `slotRenderEnded.size`
 fill-size fact. The panel labels the three separate facts as requested slot sizes,
-GPT-reported fill size, and observed outer slot box; the badge abbreviates them as
-`Req`, `Fill`, and `Box`. The observed box may differ from GPT's reported size (for
-example, a flexible APS creative can report `1×1` while its allocated outer slot box
-is larger). The measurement describes publisher-page layout, not universal internal
+GPT-reported fill size, and `Size filled`; the badge abbreviates the first two as `Req`
+and `Fill` and uses `Size filled` for the observed outer box. The observed box may
+differ from GPT's reported size. A flexible APS creative, for example, can report GPT's
+uninformative `1×1` placeholder while its allocated outer slot box is larger; the UI
+suppresses that `1×1` text but the export retains the original `size: [1, 1]` evidence. The measurement describes publisher-page layout, not universal internal
 creative-pixel dimensions. A collapsed or hidden bound element can report `0×0`, which records the
 page layout state rather than an invalid measurement. Empty, unbound, missing, or
 ambiguous slots do not report an observed box; delayed measurements from an older cycle
@@ -419,8 +483,10 @@ The allowlisted export contains:
 - Retained slots, binding facts, visibility, and request cycles.
 - `requestedSlotSizes` when Trusted Server supplied configured formats for that exact
   request, plus GPT-reported fill `size` and an optional observed outer `observedSlotSize`.
-- Request path, request intent ID, opportunity, creative-progress timestamps, and
-  safe failure enums.
+- Request path, auction type, request intent ID, opportunity, creative-progress
+  timestamps, and safe failure enums.
+- The bounded winning bidder and bucketed price plus server auction timing fields and
+  their `navigation` or `spa_auction` origin when direct auction evidence was observed.
 - The per-auction diagnostics token (`trustedServerAuctionId`) and the
   opportunity-to-request duration, when a direct opportunity was observed.
 - Replacement facts for a re-rendered slot: `replacedRequestNumber`,
@@ -431,9 +497,10 @@ The allowlisted export contains:
 - Separate callback issues, attribution issues, coverage counters, and retention
   counters.
 
-It does not contain raw targeting, bid IDs, bid prices, bidder identity, creative
-markup, cache URLs, cache payloads, cache or bridge error details, cookies, user
-identifiers, query strings, or URL fragments. The exported `trustedServerAuctionId`
+It does not contain raw targeting, bid IDs, exact unbucketed bid prices, losing bidder
+identity, creative markup, cache URLs, cache payloads, cache or bridge error details,
+cookies, user identifiers, query strings, or URL fragments. It does contain the winning
+bidder and bucketed `hb_pb` value described above. The exported `trustedServerAuctionId`
 is the `hb_auction_id` value described in
 [Auction correlation token](#auction-correlation-token): minted fresh for each
 server-side auction, not derived from the Edge Cookie ID or any other visitor
@@ -463,8 +530,9 @@ inaccessible to JavaScript.
 - Retained attribution issues: 128.
 
 The least-recently-active slot is evicted when the slot bound is exceeded. An evicted
-GPT slot can re-enter retention only after a future `slotRequested`; request numbers
-remain monotonic. The oldest request cycle or issue is removed at its own bound.
+GPT slot can re-enter retention only after a future `slotRequested`; its `Ad #N` identity
+and request numbers remain stable and monotonic for the console lifetime. The oldest
+request cycle or issue is removed at its own bound.
 Export metadata reports `evictedSlots`, `evictedRequestCycles`, `droppedCallbacks`,
 and `droppedAttributionIssues`.
 
diff --git a/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md b/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md
index 61d43e273..0d510971c 100644
--- a/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md
+++ b/docs/superpowers/specs/2026-08-24-request-phase-timing-design.md
@@ -271,7 +271,8 @@ structurally and its emissions are defined accordingly rather than pretending pa
   by path match inside the wrapper.
 - Axum emits the header only; no Tinybird rows in v1 (unchanged).
 
-Cloudflare and Spin: collection compiles, no emission wiring in v1 (unchanged).
+Cloudflare and Spin attach the per-request collector so core request-scoped consumers
+share the adapter clock, but have no header or telemetry emission wiring in v1.
 
 ## 9. Access telemetry row
 
@@ -750,11 +751,11 @@ the auction dataset as the authority on per-bidder duration.
 
 ### Scope
 
-- Fastly emits. Axum attaches a collector and records the marks but does not
-  emit them. Cloudflare and Spin attach no collector at all: `handle_publisher_request`
-  falls back to `RequestTimings::default()`, so the marks land in a throwaway
-  handle and are dropped with it. That is pre-existing for every phase, not new
-  to these marks, and it matches section 8a adapter semantics.
+- Fastly emits. Axum, Cloudflare, and Spin attach a collector and record the marks but
+  do not emit them. Cloudflare and Spin added collection when GPT diagnostics began
+  exposing request-scoped auction offsets; without an adapter collector those offsets
+  silently used a different handler-entry clock. This matches section 8a adapter
+  semantics: collection is portable, while emission remains adapter-specific.
 - No header emission for any of these values: they are post-hoc analysis fields,
   and two of the three are typically unknown at the header freeze point in
   streaming mode.