…dition

- Drop render_adm param: always include adm when creative present
- Gate GAM-bypass on per-bid debug_bid instead of a global window.tsjs flag
  (removes SPA-staleness edge case, TsjsApi change, and whole flag-emit task)
- Correct fallback scope: cache fallback only when adm absent; render failure
  after adm is supplied is not detectable
- Qualify sandbox claim: TS guarantees script-context escaping; bridge frame
  isolation depends on the Prebid Universal Creative
- Reconcile with existing ad_init.test.ts coverage (rename, no duplicates)
- Fix test assertion messages to expect("should ..."); list exact clippy gates

- Task 3: assert observable DOM (GAM iframe src) instead of spying on the
  module-private injectAdmIntoSlot
- Use existing make_bid helper + set .creative (make_test_bid_with_creative
  does not exist on this branch)
- Hostile-adm regression test covers both U+2028 and U+2029
- Add 'cd docs && npm run format' to verification

build_bid_map now always inserts the winning creative as adm so the pbRender
bridge can render it locally (no PBS Cache round trip); the verbose debug_bid
blob and the GAM-bypass gate stay behind inject_adm_for_testing. Rename the
param include_adm -> include_debug_bid and thread it through write_bids_to_state.
Reconcile the by-default test to the new behavior, drop the now-redundant
debug-only-adm test, and pin script-context escaping for a hostile adm
(</script> + U+2028/U+2029).

The direct GAM-replace path (injectAdmIntoSlot) now fires only when the bid
carries debug_bid, which is present only under inject_adm_for_testing. In
production the always-present adm is rendered by the pbRender bridge and GAM
stays in the loop. Add observable-DOM tests (GAM iframe src unchanged without
debug_bid, rewritten with it), strengthen the bridge test to prove inline adm
is preferred even when cache coords are present, and rename debug-adm
terminology to inline adm.

hb_adid is not unique per bid: absent PBS Cache it falls back to a
creative id a bidder may reuse across slots (observed: three IX bids
sharing one id). The bridge matched the first bid whose hb_adid equalled
the requested adId, then rejected on the slot-ownership guard, so every
slot but the first rendered blank.

Resolve the bid by the requesting slot and verify its hb_adid matches
the request, so each slot renders its own creative regardless of
duplicate ids. The adId check still blocks a slot A iframe from pulling
slot B's creative and beacons.

The pbRender bridge sized every inline response from the first configured
slot format, while the winning creative's own width/height were emitted
only inside the testing-only debug_bid. A multi-size slot whose winner is
not the first format therefore rendered at the wrong size (clipping or
whitespace).

Emit w/h in the normal bid map and AuctionBidData, and prefer them in the
inline bridge response, falling back to the first slot format only when
absent.

The inline render path forwarded adm without resolving the auction-price
macro. URL rewriting then serialized query pairs, encoding the literal
${AUCTION_PRICE} into %24%7BAUCTION_PRICE%7D inside the signed proxy/click
URL — so trackers received an encoded macro rather than the clearing
price, and signing locked the wrong value.

Add expand_auction_price_macro and call it from build_bid_map before
sanitize_creative_html and rewrite_inline_creative_html, using the exact
winning CPM. Only the clear-price token is expanded; the encrypted
${AUCTION_PRICE:B64} variant is left for the DSP.

rewrite_inline_creative_html hard-coded https://{publisher.domain},
discarding the incoming scheme, subdomain, and port. publisher.domain
cannot carry a port, deployments may serve a subdomain, and Axum/Viceroy
dev runs over HTTP with a port — so inline proxy/click URLs resolved
against the wrong origin with no render-time fallback.

Thread the trusted request origin (scheme://host, host including any
port) through write_bids_to_state and build_bid_map into
rewrite_inline_creative_html. Initial navigation derives it from the
buffered request host/scheme; SPA page-bids from RequestInfo. Falls back
to the configured publisher domain only when the origin is unknown.

Covers HTTP localhost with a port, a request subdomain differing from
publisher.domain, and a non-default HTTPS port.

extractCachedAdm reduced the cached bid to its adm string, so the cache
fallback sized every render from the first slot format and left price
macros unresolved. Replace it with parseCachedBid, which retains the
cached creative dimensions (w/h or width/height) and clearing price.

The fallback now sizes from the cached dimensions (slot format only when
absent) and expands ${AUCTION_PRICE} from the cached price before
responding. Raw-markup bodies stay supported as the adm-only variant.

Firing a cached win-notification URL is deferred: it is a billing side
effect and the exact cache field/dedup contract needs a real PBS Cache
payload to verify before emitting.

Threading the request origin pushed the private collect_stream_auction
helper to 8 arguments. Its arguments mirror the AuctionCollectCtx fields
the caller destructures, so a parameter struct would only duplicate that
context; suppress the lint instead.

Missing OpenRTB w/h parse to 0, and build_bid_map emitted them as w:0/h:0.
The bridge nullish-coalesces (matchedBid.w ?? fallback), so 0 was kept
rather than falling back to the slot format — sizing the frame to 0.
Omit a non-positive dimension server-side, and treat a zero cached
dimension as absent in parseCachedBid, so the bridge falls back.

The cache-fallback concurrency guard keyed on adId (hb_adid), which is not
unique per bid — two distinct slots sharing an hb_adid would have the
second's render cross-blocked. Not reachable today (a duplicate hb_adid
means no cache coordinates, so the cache path never runs), but the guard
relied on that invariant silently. Key the in-flight set on slotId|adId so
it dedups a genuine same-render race without colliding across slots.

Per OpenRTB, nurl and burl are the canonical carriers of the
${AUCTION_PRICE} macro, and the render bridge fires both verbatim via
sendBeacon. Only the creative was expanded, so every TS-won impression
sent the SSP a literal macro instead of the clearing price — a
revenue-reporting error, and the kind of malformed notification some
SSPs reject outright. Expand both from the same winning CPM already in
scope for the creative.

The PBS Cache fallback in the bridge is covered by the same change: it
fires matchedBid's beacons, which now arrive expanded from the auction
clearing price rather than the cached copy's price. Note that at the
fire site so the expansion is not duplicated client-side.

The debug_bid mirror keeps its bidder-supplied creative, nurl, and burl
verbatim: it is diagnostic, nothing renders or fires from it, and
showing what the bidder actually sent is the point.

Also drop the too_many_arguments allow on collect_stream_auction. Split
AuctionCollectCtx into the per-auction state that is moved at collect
time and the borrowed dependencies that outlive it, so the helper takes
three arguments and request-origin threading no longer widens the
signature.