Quantize auction transport timeouts to stabilize Fastly backend names

[prk-Jr]

Summary

• Fastly dynamic backend names deliberately embed the first-byte and between-bytes timeouts so a registration can never be silently reused with a different transport configuration. But deriving those timeouts from the remaining wall-clock auction budget minted a new backend name on nearly every request — defeating cross-request TCP/TLS connection reuse to bidder hosts (Fastly pools connections per backend name) and accumulating registrations toward the per-service dynamic backend limit.
• Timeout canonicalization is now a platform capability: PlatformBackend::canonicalize_transport_timeout_ms defaults to the exact budget-bound value (remaining.min(configured)) because adapters that neither register nor name-key backends gain nothing from rounding and must not shorten bidder deadlines. Only the Fastly adapter overrides it with quantization.
• The Fastly canonicalization has three regimes, all name-stable and globally bounded in cardinality: (1) the provider's configured timeout is returned verbatim when the budget allows — it is a constant, including sub-250ms configured values, which must not be rounded away or the provider could never launch; (2) budget-bound values below the 2,000ms ceiling floor to 250ms quanta, with sub-quantum remainders snapping down to the finite [200, 150, 100, 50] ladder (below the smallest rung the value canonicalizes to 0 and callers skip the launch as budget-exhausted); (3) at or above the ceiling, values floor to a fixed 8-rung coarse ladder (2,000 … 60,000ms, clamping above the top rung) so a large configured ceiling cannot mint hundreds of buckets. Rounding down never extends a transport cap past the remaining budget — the mediator and dispatched-collect </body> hold bounds rely on this, and the exhaustive enumeration tests assert it for every reachable input.
• Backend naming is hardened so name equality implies spec equality: the name is backend_<readable>_<digest> where the digest is the first 128 bits of a SHA-256 over an unambiguous encoding of the complete spec (scheme, host, port, certificate setting, Host override, provider discriminator, and both transport timeouts). This makes NameInUse reuse provably safe and prevents first-registration-wins poisoning where a later request with a tighter timeout would inherit an earlier registration's value. The readable prefix is a lossy, bounded slug carried only for logs, and the whole name is bounded to Fastly's 255-char limit.
• Each auction integration folds its integration id into the backend spec as a discriminator, so two providers targeting the same origin get distinct backend names on all four adapters and orchestrator response correlation by predicted name cannot cross providers.
• Startup validation rejects a provider listed twice in [auction].providers and a mediator that is also listed as a provider (both would fire duplicate outbound requests per auction; a mediator's own demand already flows through its mediation response). The parallel and dispatch launch paths additionally skip a duplicate predicted backend name before sending, as defense in depth.
• predict_name == ensure is pinned with a Viceroy test, since the orchestrator maps SSP responses back to providers by predicted backend name.

Changes

File	Change
crates/trusted-server-adapter-fastly/src/backend.rs	Digest-based backend naming: canonical spec string, 128-bit SHA-256 suffix (written into a pre-sized buffer), bounded human-readable prefix, Host-override/discriminator/cert markers, 255-char guard; predict_name convenience wrapper
crates/trusted-server-adapter-fastly/src/platform.rs	Fastly override of canonicalize_transport_timeout_ms; quantum, sub-quantum ladder, and coarse ladder constants with rationale (including the accepted worst-case rounding haircut); exhaustive cardinality + budget-bound tests; predict_name == ensure and discriminator tests
crates/trusted-server-core/src/platform/traits.rs, types.rs, test_support.rs	canonicalize_transport_timeout_ms trait method with exact-passthrough default; PlatformBackendSpec.discriminator field
crates/trusted-server-core/src/auction/orchestrator.rs	Apply canonical timeout at all four provider-launch sites (parallel, dispatch, synchronous mediator, collect-path mediator); startup rejection of duplicate providers and provider/mediator overlap; pre-send duplicate-backend-name skip; deterministic timeout wiring tests via an injectable clock
crates/trusted-server-core/src/integrations/mod.rs	Fold the integration id into the backend spec as the provider discriminator
crates/trusted-server-adapter-{axum,cloudflare,spin}/src/platform.rs	Carry the discriminator through the backend spec; canonicalization keeps the trait default

Closes

Closes #847

Test plan

• cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm
• cargo fmt --all -- --check
• Integration parity suite: cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
• CLI tests: ./scripts/test-cli.sh
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed

[ChristianPavilonis]

Summary

Reviewed the timeout quantization change against the PR's actual main base. The arithmetic is internally consistent, but the current implementation has correctness and operational risks that should be addressed before merge. Detailed findings are attached inline.

[ChristianPavilonis]

Summary

Reviewed current HEAD 5512d850 against main. The Fastly-only canonicalization and provider-discriminator wiring are directionally correct, but two high-risk backend identity/cardinality issues and two medium reliability/compatibility issues remain; details are inline.

Documentation

The PR description no longer describes HEAD: it still claims exact sub-quantum passthrough and a two-file change, while HEAD uses a [200, 150, 100, 50] ladder, skips values below 50 ms, adds a platform trait capability and discriminator, and changes 15 files. Please refresh the Summary, Changes table, and test plan.

[aram356]

Summary

Reviewed HEAD 77f3521 against main. All nine findings from the two earlier review rounds are verified fixed on this HEAD: the digest-based backend naming makes name equality imply spec equality (and I confirmed the only Backend::builder call in the Fastly adapter flows through it), the discriminator keeps same-origin providers on distinct names on all four adapters, cardinality is globally bounded by the sub-quantum and coarse ladders, duplicate providers are rejected at startup with a pre-launch guard on both paths, canonicalization is Fastly-only via the platform trait, and the timeout wiring tests are deterministic. Remaining items are one documentation blocker and a handful of non-blocking suggestions, inline.

Blocking

🔧 wrench

• Stale PR description: the description still describes the pre-review design — "exact passthrough for sub-quantum remainders so publishers with sub-250ms configured budgets keep launching" was removed in 5512d85 (budget-derived sub-quantum values now snap to the [200, 150, 100, 50] ladder; only configured sub-250ms constants pass through). It also predates most of what the PR now contains: digest-based backend naming, provider discriminators, the coarse ladder, duplicate-provider startup rejection, and the platform-capability split. The changes table still places the quantization helpers in orchestrator.rs, but they live in the Fastly adapter now. Please rewrite the Summary/Changes to describe HEAD.

Non-blocking

⛏ nitpick

• ensure() doc drift: the doc comment still says the name is "derived from the scheme, host, port, certificate setting, first_byte_timeout, and between_bytes_timeout" — no digest, no discriminator, no Host override (crates/trusted-server-adapter-fastly/src/backend.rs:328-334). compute_name carries the accurate description; this paragraph should defer to it instead of restating a stale subset.

CI Status

• fmt: PASS
• clippy: PASS
• rust tests (fastly/axum/cloudflare/spin + parity + CLI): PASS
• js tests: PASS
• integration/browser tests: PASS