Address fourth-round review feedback on backend naming and quantization

- Reject a mediator that is also listed in [auction].providers at startup;
  the overlap would fire the same provider twice per auction and its demand
  already flows through the mediation response
- Assert in both cardinality enumeration tests that canonical values never
  exceed the remaining budget (the mediator </body> hold bound invariant)
- Document the accepted worst-case rounding haircut on the coarse ladder
- Write the spec digest hex into one pre-sized buffer instead of allocating
  per byte, and defer the ensure() doc to compute_name

Author: prk-Jr

crates/trusted-server-adapter-fastly/src/backend.rs

@@ -1,3 +1,4 @@
+use core::fmt::Write as _;
 use std::time::Duration;
 
 use error_stack::{Report, ResultExt as _};
@@ -69,11 +70,11 @@ fn spec_digest_hex(canonical: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(canonical.as_bytes());
     let digest = hasher.finalize();
-    digest
-        .iter()
-        .take(SPEC_DIGEST_HEX_LEN / 2)
-        .map(|byte| format!("{byte:02x}"))
-        .collect()
+    let mut hex = String::with_capacity(SPEC_DIGEST_HEX_LEN);
+    for byte in digest.iter().take(SPEC_DIGEST_HEX_LEN / 2) {
+        write!(hex, "{byte:02x}").expect("should write hex digit to string");
+    }
+    hex
 }
 
 /// Default first-byte timeout for backends (15 seconds).
@@ -327,11 +328,10 @@ impl<'a> BackendConfig<'a> {
 
     /// Ensure a dynamic backend exists for this configuration and return its name.
     ///
-    /// The backend name is derived from the scheme, host, port, certificate
-    /// setting, `first_byte_timeout`, and `between_bytes_timeout` to avoid
-    /// collisions. Different timeout values produce different backend
-    /// registrations so that a tight deadline cannot be silently widened by an
-    /// earlier registration.
+    /// The name is a collision-resistant function of the complete backend spec
+    /// (see `Self::compute_name`), so different specs — for example, different
+    /// timeout values — always produce different backend registrations and a
+    /// tight deadline cannot be silently widened by an earlier registration.
     ///
     /// # Errors
     ///

crates/trusted-server-adapter-fastly/src/platform.rs

@@ -196,6 +196,13 @@ const SUB_QUANTUM_LADDER_MS: [u32; 4] = [200, 150, 100, 50];
 /// the greatest rung no larger than the remaining budget, and anything above
 /// the top rung clamps to it. Rounding down never extends a transport cap past
 /// the remaining budget.
+///
+/// The rung spacing trades transport window for cardinality: just below a rung
+/// the haircut approaches the gap to the rung beneath (worst case ~50%, e.g. a
+/// remaining budget of 9,999 ms snaps to 5,000 ms). This is accepted — on the
+/// mediator path this value is the effective bound, but a denser ladder would
+/// buy back at most half a bucket of transport time at the cost of
+/// proportionally more backend names.
 const TRANSPORT_TIMEOUT_COARSE_LADDER_MS: [u32; 8] =
     [2000, 3000, 5000, 10000, 20000, 30000, 45000, 60000];
 
@@ -1126,6 +1133,12 @@ mod tests {
                 "canonical value {value}ms (from remaining {remaining}ms) is neither a quantum \
                  multiple nor a ladder rung"
             );
+            // The mediator </body> hold bound relies on canonicalization never
+            // extending a transport cap past the wall-clock budget.
+            assert!(
+                value <= remaining,
+                "canonical value {value}ms must not extend past the remaining {remaining}ms budget"
+            );
         }
         assert!(
             distinct.len() <= 16,
@@ -1156,6 +1169,12 @@ mod tests {
                 "canonical value {value}ms (from remaining {remaining}ms) is neither a quantum \
                  multiple nor a ladder rung"
             );
+            // The mediator </body> hold bound relies on canonicalization never
+            // extending a transport cap past the wall-clock budget.
+            assert!(
+                value <= remaining,
+                "canonical value {value}ms must not extend past the remaining {remaining}ms budget"
+            );
         }
         // A budget above the top coarse rung must clamp to it, not open a new
         // bucket per 250ms step.

crates/trusted-server-core/src/auction/orchestrator.rs

@@ -209,6 +209,20 @@ impl AuctionOrchestrator {
             }
         }
 
+        // A provider that is also the mediator would be called twice per
+        // auction — once in the bidding phase and again as the mediator. The
+        // mediator's own demand already flows through its mediation response,
+        // so the overlap is never a legitimate configuration.
+        if let Some(mediator_name) = &self.config.mediator
+            && seen.contains(mediator_name.as_str())
+        {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "Auction mediator `{mediator_name}` is also listed in [auction].providers; a provider may not mediate its own auction"
+                ),
+            }));
+        }
+
         for provider_name in self
             .config
             .providers
@@ -2074,6 +2088,29 @@ mod tests {
         );
     }
 
+    #[test]
+    fn rejects_mediator_also_listed_as_provider() {
+        // A provider acting as its own mediator would be called twice per
+        // auction (bidding phase, then mediation); its demand already flows
+        // through the mediation response, so reject the overlap at startup.
+        let config = AuctionConfig {
+            enabled: true,
+            providers: vec!["prebid".to_string()],
+            mediator: Some("prebid".to_string()),
+            timeout_ms: 2000,
+            ..Default::default()
+        };
+        let orchestrator = AuctionOrchestrator::new(config);
+
+        let err = orchestrator
+            .validate_configured_provider_names()
+            .expect_err("should reject a mediator that is also a provider");
+        assert!(
+            err.to_string().contains("may not mediate its own auction"),
+            "should explain the mediator/provider overlap, got: {err}"
+        );
+    }
+
     #[test]
     fn test_orchestrator_is_enabled() {
         let config = AuctionConfig {