diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 1552ee4fd..728cc1efe 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -109,16 +109,29 @@ impl DispatchedAuction {
 
 const PROVIDER_ERROR_MESSAGE_CHARS: usize = 500;
 
-const ERROR_TYPE_PARSE_RESPONSE: &str = "parse_response";
-const ERROR_TYPE_LAUNCH_FAILED: &str = "launch_failed";
-const ERROR_TYPE_TRANSPORT: &str = "transport";
-const ERROR_TYPE_TIMEOUT: &str = "timeout";
+pub(crate) const ERROR_TYPE_PARSE_RESPONSE: &str = "parse_response";
+pub(crate) const ERROR_TYPE_LAUNCH_FAILED: &str = "launch_failed";
+pub(crate) const ERROR_TYPE_TRANSPORT: &str = "transport";
+pub(crate) const ERROR_TYPE_TIMEOUT: &str = "timeout";
 /// A non-2xx HTTP status from an upstream SSP (e.g. a PBS 4xx/5xx). Distinct
 /// from [`ERROR_TYPE_TRANSPORT`] (a connection-level failure) so telemetry can
 /// bucket it separately. `pub(crate)` so producers such as the prebid provider
 /// tag errors with the exact value the telemetry layer recognises.
 pub(crate) const ERROR_TYPE_HTTP_STATUS: &str = "http_status";
 
+/// Every server-owned `error_type` classification.
+///
+/// Consumers that reproduce these values — notably the `ts-debug` redaction
+/// layer in [`crate::publisher`] — validate against this list so a new
+/// classification cannot silently disappear from their output.
+pub(crate) const ERROR_TYPE_ALL: &[&str] = &[
+    ERROR_TYPE_PARSE_RESPONSE,
+    ERROR_TYPE_LAUNCH_FAILED,
+    ERROR_TYPE_TRANSPORT,
+    ERROR_TYPE_TIMEOUT,
+    ERROR_TYPE_HTTP_STATUS,
+];
+
 // SECURITY: the returned string is included verbatim (truncated to
 // PROVIDER_ERROR_MESSAGE_CHARS) in the public /auction response via
 // ProviderSummary.metadata["message"]. Providers MUST NOT interpolate
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index d95f82567..7d445089a 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -39,7 +39,9 @@ use crate::auction::endpoints::{
 };
 use crate::auction::formats::sanitize_publisher_page_url;
 use crate::auction::orchestrator::{
-    AuctionOrchestrator, DispatchAuctionOutcome, DispatchedAuction,
+    AuctionOrchestrator, DispatchAuctionOutcome, DispatchedAuction, ERROR_TYPE_ALL,
+    ERROR_TYPE_HTTP_STATUS, ERROR_TYPE_LAUNCH_FAILED, ERROR_TYPE_PARSE_RESPONSE,
+    ERROR_TYPE_TIMEOUT, ERROR_TYPE_TRANSPORT,
 };
 use crate::auction::telemetry::{
     AuctionObservationContext, AuctionSource, AuctionTerminalOutcome, build_auction_events,
@@ -61,7 +63,10 @@ use crate::platform::{GeoInfo, PlatformBackendSpec, PlatformHttpRequest, Runtime
 use crate::price_bucket::{PriceGranularity, price_bucket};
 use crate::response_privacy::enforce_synthesized_html_cache_privacy;
 use crate::rsc_flight::RscFlightUrlRewriter;
-use crate::settings::Settings;
+use crate::settings::{
+    AUCTION_DEBUG_METADATA_ALLOWLIST, AUCTION_DEBUG_UPSTREAM_METADATA_KEYS,
+    AuctionDebugCommentFormat, AuctionDebugCommentOptions, AuctionDebugCommentVerbosity, Settings,
+};
 use crate::streaming_processor::{
     BodyStreamDecoder, BodyStreamEncoder, Compression, GzipDecodeReader, PipelineConfig,
     STREAM_CHUNK_SIZE, StreamProcessor, StreamingPipeline,
@@ -1871,24 +1876,6 @@ pub(crate) fn write_bids_to_state(
 /// enabled cannot bloat every page render without bound.
 const MAX_AUCTION_DEBUG_DUMP_BYTES: usize = 256 * 1024;
 
-/// Provider-metadata keys safe to surface in the on-page `ts-debug` dump.
-///
-/// Fail-closed allowlist: any key not listed — notably `debug`, which carries
-/// the resolved `OpenRTB` request (EC ID, `user.ext.eids`, the TC consent string,
-/// `device.ip`, and `device.geo`) plus per-bidder `httpcalls` — is dropped so a
-/// visitor's identity graph cannot reach the client-readable DOM even when
-/// `[integration.prebid].debug` is also enabled. Full debug detail remains
-/// available server-side via `log::trace!`.
-const DEBUG_DUMP_METADATA_ALLOWLIST: &[&str] = &[
-    "error_type",
-    "status",
-    "message",
-    "responsetimemillis",
-    "errors",
-    "warnings",
-    "bidstatus",
-];
-
 /// Per-bid creative preview length (in bytes) in the `ts-debug` dump. Mirrors
 /// the 512-byte upstream-body preview the prebid provider logs on an HTTP error
 /// (`integrations/prebid.rs`): enough to identify a creative without copying
@@ -1906,19 +1893,117 @@ fn truncate_with_marker(value: &str, max: usize) -> String {
     format!("{}…(truncated {} bytes)", &value[..end], value.len() - end)
 }
 
-/// Build a redacted JSON view of a single provider response for the `ts-debug`
-/// dump: only [`DEBUG_DUMP_METADATA_ALLOWLIST`] metadata keys survive, and each
-/// bid's creative is previewed to [`MAX_BID_CREATIVE_DUMP_BYTES`].
+/// Return a recognized server-owned provider error classification.
+///
+/// Validates against [`ERROR_TYPE_ALL`] rather than a local literal list so a
+/// classification added in the orchestrator cannot drift out of the dump.
+fn validated_error_type(
+    metadata: &std::collections::HashMap<String, serde_json::Value>,
+) -> Option<&str> {
+    let value = metadata.get("error_type")?.as_str()?;
+    ERROR_TYPE_ALL.contains(&value).then_some(value)
+}
+
+/// Return a valid HTTP response status from provider metadata.
+fn validated_http_status(
+    metadata: &std::collections::HashMap<String, serde_json::Value>,
+) -> Option<u64> {
+    metadata
+        .get("http_status")?
+        .as_u64()
+        .filter(|status| (100..=599).contains(status))
+}
+
+/// Generate public diagnostic wording without copying provider-controlled text.
+///
+/// Every [`ERROR_TYPE_ALL`] entry must map to wording here; the
+/// `redacted_metadata_covers_every_orchestrator_error_type` test fails when a
+/// new orchestrator classification is added without one.
+fn safe_error_message(error_type: &str, http_status: Option<u64>) -> Option<String> {
+    match error_type {
+        ERROR_TYPE_PARSE_RESPONSE => Some("Provider response could not be parsed".to_string()),
+        ERROR_TYPE_LAUNCH_FAILED => Some("Provider launch failed".to_string()),
+        ERROR_TYPE_TRANSPORT => Some("Provider request failed".to_string()),
+        ERROR_TYPE_TIMEOUT => Some("Provider request timed out".to_string()),
+        ERROR_TYPE_HTTP_STATUS => Some(http_status.map_or_else(
+            || "Provider returned an HTTP error".to_string(),
+            |status| format!("Provider returned HTTP {status}"),
+        )),
+        _ => None,
+    }
+}
+
+/// Reconstruct the configured response metadata from validated values.
+fn redacted_metadata_for_dump(
+    metadata: &std::collections::HashMap<String, serde_json::Value>,
+    options: &AuctionDebugCommentOptions,
+) -> serde_json::Map<String, serde_json::Value> {
+    let selected = |key: &str| {
+        AUCTION_DEBUG_METADATA_ALLOWLIST.contains(&key)
+            && options
+                .metadata_keys
+                .iter()
+                .any(|candidate| candidate == key)
+    };
+    let error_type = validated_error_type(metadata);
+    let http_status = validated_http_status(metadata);
+    let mut safe = serde_json::Map::new();
+
+    if selected("error_type")
+        && let Some(value) = error_type
+    {
+        safe.insert("error_type".to_string(), serde_json::json!(value));
+    }
+    if selected("http_status")
+        && let Some(value) = http_status
+    {
+        safe.insert("http_status".to_string(), serde_json::json!(value));
+    }
+    if selected("message")
+        && let Some(value) = error_type.and_then(|kind| safe_error_message(kind, http_status))
+    {
+        safe.insert("message".to_string(), serde_json::json!(value));
+    }
+
+    safe
+}
+
+/// Build a JSON view of a single provider response for the `ts-debug` dump.
+///
+/// `Redacted` reconstructs only schema-validated response metadata, `Upstream`
+/// adds six named provider diagnostics, and `Full` copies every metadata value.
 fn redact_response_for_dump(
     response: &crate::auction::types::AuctionResponse,
+    options: &AuctionDebugCommentOptions,
 ) -> serde_json::Value {
-    let metadata: serde_json::Map<String, serde_json::Value> = response
-        .metadata
-        .iter()
-        .filter(|(key, _)| DEBUG_DUMP_METADATA_ALLOWLIST.contains(&key.as_str()))
-        .map(|(key, value)| (key.clone(), value.clone()))
-        .collect();
-    let bids: Vec<serde_json::Value> = response.bids.iter().map(redact_bid_for_dump).collect();
+    let metadata: serde_json::Map<String, serde_json::Value> = match options.verbosity {
+        AuctionDebugCommentVerbosity::Redacted => {
+            redacted_metadata_for_dump(&response.metadata, options)
+        }
+        AuctionDebugCommentVerbosity::Upstream => {
+            let mut metadata = redacted_metadata_for_dump(&response.metadata, options);
+            for key in AUCTION_DEBUG_UPSTREAM_METADATA_KEYS {
+                if let Some(value) = response.metadata.get(*key) {
+                    metadata.insert((*key).to_string(), value.clone());
+                }
+            }
+            metadata
+        }
+        AuctionDebugCommentVerbosity::Full => response
+            .metadata
+            .iter()
+            .map(|(key, value)| (key.clone(), value.clone()))
+            .collect(),
+    };
+    let bids: Vec<serde_json::Value> = if options.include_bids {
+        response
+            .bids
+            .iter()
+            .map(|bid| redact_bid_for_dump(bid, options))
+            .collect()
+    } else {
+        Vec::new()
+    };
     serde_json::json!({
         "provider": response.provider,
         "status": response.status,
@@ -1928,23 +2013,31 @@ fn redact_response_for_dump(
     })
 }
 
-/// Build a redacted JSON view of a single bid: every field except `creative`,
-/// which is previewed to [`MAX_BID_CREATIVE_DUMP_BYTES`].
-fn redact_bid_for_dump(bid: &crate::auction::types::Bid) -> serde_json::Value {
+/// Build a JSON view of a single bid. `Redacted` and `Upstream` preview the
+/// creative to [`MAX_BID_CREATIVE_DUMP_BYTES`]; `Full` passes it through.
+fn redact_bid_for_dump(
+    bid: &crate::auction::types::Bid,
+    options: &AuctionDebugCommentOptions,
+) -> serde_json::Value {
     let mut value = serde_json::to_value(bid).unwrap_or(serde_json::Value::Null);
-    if let Some(creative) = &bid.creative {
+    if options.verbosity != AuctionDebugCommentVerbosity::Full
+        && let Some(creative) = &bid.creative
+    {
         value["creative"] =
             serde_json::Value::String(truncate_with_marker(creative, MAX_BID_CREATIVE_DUMP_BYTES));
     }
     value
 }
 
-/// Prepend a `<!-- ts-debug: ... -->` HTML comment carrying a redacted view of
-/// the auction result — pipeline stats plus, per provider, its status, bids
-/// (each creative previewed to [`MAX_BID_CREATIVE_DUMP_BYTES`]), and allowlisted
-/// metadata — onto the shared `ad_bids_state` so it lands directly before the
-/// injected bids `<script>`. Identity-bearing metadata (notably prebid's `debug`
-/// subtree) is dropped; see [`DEBUG_DUMP_METADATA_ALLOWLIST`]. Gated by
+/// Prepend a `<!-- ts-debug: ... -->` HTML comment carrying a view of the
+/// auction result — pipeline stats plus, per provider, its status, bids, and
+/// metadata, shaped by `options` — onto the shared `ad_bids_state` so it
+/// lands directly before the injected bids `<script>`. In
+/// [`AuctionDebugCommentVerbosity::Redacted`] (the default), response metadata
+/// is reconstructed from validated server-owned fields; provider diagnostics
+/// and prebid's `debug` subtree are dropped. Bid-level fields and bounded
+/// creative previews remain visible, so this is not a fully anonymized dump.
+/// Gated by
 /// [`auction_html_comment`](crate::settings::DebugConfig::auction_html_comment);
 /// never enable in production.
 ///
@@ -1955,25 +2048,26 @@ pub(crate) fn prepend_auction_debug_comment(
     path_label: &str,
     result: &crate::auction::orchestrator::OrchestrationResult,
     ad_bids_state: &Arc<Mutex<Option<String>>>,
+    options: &AuctionDebugCommentOptions,
 ) {
     let ssp_count = result.provider_responses.len();
     let mediator_info = match &result.mediator_response {
         Some(r) => format!("ok({}_bids)", r.bids.len()),
         None => "none".to_string(),
     };
-    // Redacted, bounded, deterministic dump so an operator can see each
-    // provider's status, bids, and safe metadata without needing log access.
+    // Bounded, deterministic dump so an operator can see each provider's
+    // status, bids, and mode-appropriate metadata without needing log access.
     //
     // SECURITY: `Bid.creative` and provider metadata are attacker/partner-
     // influenced. Two layers protect the DOM:
-    //   1. `redact_response_for_dump` drops all non-allowlisted *response-level*
-    //      metadata (notably the identity-bearing `debug` subtree) and previews
-    //      each creative, so the visitor's identity graph never enters the
-    //      comment and one large creative cannot dominate the payload. Bid-level
-    //      fields (`Bid.metadata`, `nurl`, `burl`) are NOT yet allowlisted; they
-    //      pass through today because the only writer (`integrations/aps.rs`)
-    //      emits opaque targeting keys. Tightening this to a fail-closed bid
-    //      allowlist is tracked in #925.
+    //   1. In Redacted mode, `redact_response_for_dump` reconstructs only
+    //      schema-validated response metadata and previews each creative, so
+    //      untyped provider diagnostics cannot cross that boundary and one
+    //      large creative cannot dominate the payload. Bid-level fields
+    //      (`Bid.metadata`, `nurl`, `burl`) are NOT yet allowlisted; they pass
+    //      through today because the only writer (`integrations/aps.rs`) emits
+    //      opaque targeting keys. Tightening this to a fail-closed bid allowlist
+    //      is tracked in #925.
     //   2. `render_dump` below neutralises HTML comment terminators and caps the
     //      total serialized size.
     //
@@ -1981,22 +2075,26 @@ pub(crate) fn prepend_auction_debug_comment(
     // the rendered metadata keys are sorted — the dump is deterministic even
     // though `AuctionResponse.metadata` is a `HashMap`.
     let mut dump = serde_json::Map::new();
-    dump.insert(
-        "provider_responses".to_string(),
-        serde_json::Value::Array(
-            result
-                .provider_responses
-                .iter()
-                .map(redact_response_for_dump)
-                .collect(),
-        ),
-    );
+    if options.include_provider_responses {
+        dump.insert(
+            "provider_responses".to_string(),
+            serde_json::Value::Array(
+                result
+                    .provider_responses
+                    .iter()
+                    .map(|r| redact_response_for_dump(r, options))
+                    .collect(),
+            ),
+        );
+    }
     // Only include the mediator response when one actually ran; otherwise the
     // `mediator=none` on the summary line already conveys it.
-    if let Some(mediator_response) = &result.mediator_response {
+    if options.include_mediator_response
+        && let Some(mediator_response) = &result.mediator_response
+    {
         dump.insert(
             "mediator_response".to_string(),
-            redact_response_for_dump(mediator_response),
+            redact_response_for_dump(mediator_response, options),
         );
     }
     // A single `replace("--", …)` is deliberately NOT used — because
@@ -2019,10 +2117,13 @@ pub(crate) fn prepend_auction_debug_comment(
         }
     };
     // Single serialize → single neutralise → single total-budget cap.
-    let dump = render_dump(
-        serde_json::to_string(&serde_json::Value::Object(dump))
-            .unwrap_or_else(|e| format!("<dump serialize error: {e}>")),
-    );
+    let dump = serde_json::Value::Object(dump);
+    let serialized = match options.format {
+        AuctionDebugCommentFormat::Compact => serde_json::to_string(&dump),
+        AuctionDebugCommentFormat::Pretty => serde_json::to_string_pretty(&dump),
+    };
+    let dump =
+        render_dump(serialized.unwrap_or_else(|error| format!("<dump serialize error: {error}>")));
     let debug_comment = format!(
         "<!-- ts-debug: path={path_label} ssp={ssp_count} mediator={mediator_info} winning={} time={}ms\n\
          dump={dump}\n\
@@ -2540,7 +2641,12 @@ async fn collect_stream_auction(
     }
 
     if settings.debug.auction_html_comment {
-        prepend_auction_debug_comment("stream", &result, ad_bids_state);
+        prepend_auction_debug_comment(
+            "stream",
+            &result,
+            ad_bids_state,
+            &settings.debug.auction_html_comment_options,
+        );
     }
 }
 
@@ -4235,7 +4341,10 @@ mod tests {
 
     /// Build the ts-debug comment for a one-bid auction whose creative is
     /// `creative`, so tests can assert on the rendered dump.
-    fn dump_comment_for_creative(creative: &str) -> String {
+    fn dump_comment_for_creative_with_options(
+        creative: &str,
+        options: &AuctionDebugCommentOptions,
+    ) -> String {
         let mut bid = make_test_bid_with_creative(creative);
         bid.slot_id = "ad-header-0".to_string();
         let result = OrchestrationResult {
@@ -4249,7 +4358,35 @@ mod tests {
             metadata: std::collections::HashMap::new(),
         };
         let state = Arc::new(Mutex::new(Some("BIDS_SCRIPT".to_string())));
-        prepend_auction_debug_comment("stream", &result, &state);
+        prepend_auction_debug_comment("stream", &result, &state, options);
+        let comment = state
+            .lock()
+            .expect("should lock state")
+            .clone()
+            .expect("should have comment");
+        drop(state);
+        comment
+    }
+
+    fn dump_comment_for_creative(creative: &str) -> String {
+        dump_comment_for_creative_with_options(creative, &AuctionDebugCommentOptions::default())
+    }
+
+    fn dump_comment_for_metadata_with_options(
+        metadata: std::collections::HashMap<String, serde_json::Value>,
+        options: &AuctionDebugCommentOptions,
+    ) -> String {
+        let mut response = AuctionResponse::error("prebid", 12);
+        response.metadata = metadata;
+        let result = OrchestrationResult {
+            provider_responses: vec![response],
+            mediator_response: None,
+            winning_bids: std::collections::HashMap::new(),
+            total_time_ms: 12,
+            metadata: std::collections::HashMap::new(),
+        };
+        let state = Arc::new(Mutex::new(Some("BIDS_SCRIPT".to_string())));
+        prepend_auction_debug_comment("stream", &result, &state, options);
         let comment = state
             .lock()
             .expect("should lock state")
@@ -4259,6 +4396,23 @@ mod tests {
         comment
     }
 
+    fn dump_from_comment(comment: &str) -> (&str, serde_json::Value) {
+        let (_, after_dump) = comment
+            .split_once("dump=")
+            .expect("should contain dump marker");
+        let (dump, _) = after_dump
+            .rsplit_once("\n-->")
+            .expect("should contain comment terminator");
+        let value: serde_json::Value =
+            serde_json::from_str(dump).expect("should contain valid untruncated JSON");
+        (dump, value)
+    }
+
+    fn response_metadata_from_comment(comment: &str) -> serde_json::Value {
+        let (_, dump) = dump_from_comment(comment);
+        dump["provider_responses"][0]["metadata"].clone()
+    }
+
     #[test]
     fn auction_debug_comment_dumps_provider_status() {
         let comment = dump_comment_for_creative("<div>plain</div>");
@@ -4278,6 +4432,59 @@ mod tests {
         );
     }
 
+    #[test]
+    fn auction_debug_comment_pretty_formats_outer_json_without_changing_value() {
+        let compact_comment = dump_comment_for_creative("<div>plain</div>");
+        let pretty_options = AuctionDebugCommentOptions {
+            format: AuctionDebugCommentFormat::Pretty,
+            ..AuctionDebugCommentOptions::default()
+        };
+        let pretty_comment =
+            dump_comment_for_creative_with_options("<div>plain</div>", &pretty_options);
+
+        assert!(
+            compact_comment.contains("dump={\"provider_responses\":"),
+            "default output should remain compact: {compact_comment}"
+        );
+        assert!(
+            pretty_comment.contains("dump={\n  \"provider_responses\":"),
+            "pretty output should indent the outer dump: {pretty_comment}"
+        );
+
+        let (_, compact_dump) = dump_from_comment(&compact_comment);
+        let (_, pretty_dump) = dump_from_comment(&pretty_comment);
+        assert_eq!(
+            pretty_dump, compact_dump,
+            "formatting should not change the dump value"
+        );
+    }
+
+    #[test]
+    fn auction_debug_comment_pretty_preserves_nested_json_as_string() {
+        let metadata = std::collections::HashMap::from([(
+            "debug".to_string(),
+            serde_json::json!({
+                "httpcalls": {
+                    "openx": [{ "requestbody": "{\"id\":\"request-1\"}" }]
+                }
+            }),
+        )]);
+        let options = AuctionDebugCommentOptions {
+            verbosity: AuctionDebugCommentVerbosity::Full,
+            format: AuctionDebugCommentFormat::Pretty,
+            ..AuctionDebugCommentOptions::default()
+        };
+
+        let comment = dump_comment_for_metadata_with_options(metadata, &options);
+        let response_metadata = response_metadata_from_comment(&comment);
+        let request_body = &response_metadata["debug"]["httpcalls"]["openx"][0]["requestbody"];
+        assert_eq!(request_body, "{\"id\":\"request-1\"}");
+        assert!(
+            request_body.is_string(),
+            "nested request body should remain a string"
+        );
+    }
+
     #[test]
     fn auction_debug_comment_never_leaks_provider_debug_metadata() {
         // A provider response whose `debug` metadata mirrors the shape prebid
@@ -4310,7 +4517,12 @@ mod tests {
             metadata: std::collections::HashMap::new(),
         };
         let state = Arc::new(Mutex::new(Some("BIDS_SCRIPT".to_string())));
-        prepend_auction_debug_comment("stream", &result, &state);
+        prepend_auction_debug_comment(
+            "stream",
+            &result,
+            &state,
+            &AuctionDebugCommentOptions::default(),
+        );
         let comment = state
             .lock()
             .expect("should lock state")
@@ -4336,6 +4548,438 @@ mod tests {
         );
     }
 
+    #[test]
+    fn default_options_apply_safe_response_metadata_schema() {
+        let metadata = std::collections::HashMap::from([
+            ("error_type".to_string(), serde_json::json!("http_status")),
+            ("http_status".to_string(), serde_json::json!(422)),
+            (
+                "message".to_string(),
+                serde_json::json!("raw-message-example-user-123"),
+            ),
+            (
+                "errors".to_string(),
+                serde_json::json!(["errors-example-user-123"]),
+            ),
+            (
+                "warnings".to_string(),
+                serde_json::json!(["warnings-example-user-123"]),
+            ),
+            (
+                "responsetimemillis".to_string(),
+                serde_json::json!({"timing-example-user-123": 12}),
+            ),
+            (
+                "bidstatus".to_string(),
+                serde_json::json!([{"bidder": "bidstatus-example-user-123"}]),
+            ),
+            (
+                "upstream_message".to_string(),
+                serde_json::json!("upstream-example-user-123"),
+            ),
+            (
+                "upstream_message_truncated".to_string(),
+                serde_json::json!("truncated-example-user-123"),
+            ),
+            (
+                "debug".to_string(),
+                serde_json::json!({"resolvedrequest": {"user": {"id": "debug-example-user-123"}}}),
+            ),
+        ]);
+
+        let comment = dump_comment_for_metadata_with_options(
+            metadata,
+            &AuctionDebugCommentOptions::default(),
+        );
+
+        assert_eq!(
+            response_metadata_from_comment(&comment),
+            serde_json::json!({
+                "error_type": "http_status",
+                "http_status": 422,
+                "message": "Provider returned HTTP 422",
+            })
+        );
+    }
+
+    #[test]
+    fn configured_metadata_subset_only_includes_selected_safe_keys() {
+        let metadata = std::collections::HashMap::from([
+            ("error_type".to_string(), serde_json::json!("http_status")),
+            ("http_status".to_string(), serde_json::json!(418)),
+            (
+                "errors".to_string(),
+                serde_json::json!(["errors-example-user-123"]),
+            ),
+            (
+                "debug".to_string(),
+                serde_json::json!({"identity": "debug-example-user-123"}),
+            ),
+        ]);
+        let options = AuctionDebugCommentOptions {
+            metadata_keys: vec![
+                "http_status".to_string(),
+                "errors".to_string(),
+                "debug".to_string(),
+            ],
+            ..AuctionDebugCommentOptions::default()
+        };
+
+        let comment = dump_comment_for_metadata_with_options(metadata, &options);
+
+        assert_eq!(
+            response_metadata_from_comment(&comment),
+            serde_json::json!({"http_status": 418})
+        );
+    }
+
+    #[test]
+    fn redacted_mode_rejects_wrong_types_and_unknown_error_classifications() {
+        let invalid_cases = [
+            std::collections::HashMap::from([(
+                "error_type".to_string(),
+                serde_json::json!({"identity": "example-user-123"}),
+            )]),
+            std::collections::HashMap::from([
+                (
+                    "error_type".to_string(),
+                    serde_json::json!("provider_supplied_unknown"),
+                ),
+                ("message".to_string(), serde_json::json!("example-user-123")),
+            ]),
+            std::collections::HashMap::from([(
+                "http_status".to_string(),
+                serde_json::json!("200 example-user-123"),
+            )]),
+            std::collections::HashMap::from([("http_status".to_string(), serde_json::json!(99))]),
+            std::collections::HashMap::from([("http_status".to_string(), serde_json::json!(600))]),
+            std::collections::HashMap::from([(
+                "http_status".to_string(),
+                serde_json::json!(200.5),
+            )]),
+            std::collections::HashMap::from([(
+                "message".to_string(),
+                serde_json::json!({"identity": "example-user-123"}),
+            )]),
+        ];
+        for metadata in invalid_cases {
+            let comment = dump_comment_for_metadata_with_options(
+                metadata,
+                &AuctionDebugCommentOptions::default(),
+            );
+            assert_eq!(
+                response_metadata_from_comment(&comment),
+                serde_json::json!({})
+            );
+            assert!(!comment.contains("example-user-123"));
+            assert!(!comment.contains("provider_supplied_unknown"));
+        }
+
+        for status in [100_u64, 599] {
+            let metadata = std::collections::HashMap::from([(
+                "http_status".to_string(),
+                serde_json::json!(status),
+            )]);
+            let comment = dump_comment_for_metadata_with_options(
+                metadata,
+                &AuctionDebugCommentOptions::default(),
+            );
+            assert_eq!(
+                response_metadata_from_comment(&comment),
+                serde_json::json!({"http_status": status})
+            );
+        }
+    }
+
+    #[test]
+    fn redacted_mode_generates_fixed_safe_messages() {
+        let cases = [
+            (
+                "parse_response",
+                None,
+                "Provider response could not be parsed",
+            ),
+            ("launch_failed", None, "Provider launch failed"),
+            ("transport", None, "Provider request failed"),
+            ("timeout", None, "Provider request timed out"),
+            ("http_status", Some(418_u64), "Provider returned HTTP 418"),
+            ("http_status", None, "Provider returned an HTTP error"),
+        ];
+        for (error_type, status, expected) in cases {
+            let mut metadata = std::collections::HashMap::from([
+                ("error_type".to_string(), serde_json::json!(error_type)),
+                (
+                    "message".to_string(),
+                    serde_json::json!("raw-example-user-123"),
+                ),
+            ]);
+            if let Some(status) = status {
+                metadata.insert("http_status".to_string(), serde_json::json!(status));
+            }
+            let comment = dump_comment_for_metadata_with_options(
+                metadata,
+                &AuctionDebugCommentOptions::default(),
+            );
+            let rendered = response_metadata_from_comment(&comment);
+            assert_eq!(rendered["message"], serde_json::json!(expected));
+            assert!(!comment.contains("raw-example-user-123"));
+        }
+    }
+
+    #[test]
+    fn redacted_metadata_covers_every_orchestrator_error_type() {
+        // Drift guard: adding a classification to ERROR_TYPE_ALL without wiring
+        // wording into safe_error_message would make it vanish from redacted
+        // dumps through the catch-all match arm.
+        for error_type in ERROR_TYPE_ALL {
+            let metadata = std::collections::HashMap::from([(
+                "error_type".to_string(),
+                serde_json::json!(error_type),
+            )]);
+            assert_eq!(
+                validated_error_type(&metadata),
+                Some(*error_type),
+                "{error_type} should be a recognized classification"
+            );
+            assert!(
+                safe_error_message(error_type, None).is_some(),
+                "{error_type} should map to safe diagnostic wording"
+            );
+        }
+    }
+
+    #[test]
+    fn metadata_keys_empty_yields_empty_safe_metadata_in_redacted() {
+        let options = AuctionDebugCommentOptions {
+            metadata_keys: vec![],
+            ..AuctionDebugCommentOptions::default()
+        };
+        let comment = dump_comment_for_creative_with_options("<div>x</div>", &options);
+        assert!(
+            comment.contains("\"metadata\":{}"),
+            "empty metadata_keys should yield an empty metadata object: {comment}"
+        );
+    }
+
+    #[test]
+    fn metadata_keys_attack_vector_debug_key_never_surfaces_in_redacted_mode() {
+        // Configuring "debug" in metadata_keys must have zero effect in Redacted
+        // mode — the allowlist intersection is the actual security boundary, not
+        // the config value. This is the load-bearing test for this whole design.
+        let response = AuctionResponse::error("prebid", 12).with_metadata(
+            "debug",
+            serde_json::json!({"resolvedrequest": {"user": {"id": "EC-ID-abc123"}}}),
+        );
+        let result = OrchestrationResult {
+            provider_responses: vec![response],
+            mediator_response: None,
+            winning_bids: std::collections::HashMap::new(),
+            total_time_ms: 12,
+            metadata: std::collections::HashMap::new(),
+        };
+        let options = AuctionDebugCommentOptions {
+            metadata_keys: vec!["debug".to_string()],
+            ..AuctionDebugCommentOptions::default()
+        };
+        let state = Arc::new(Mutex::new(Some("BIDS_SCRIPT".to_string())));
+        prepend_auction_debug_comment("stream", &result, &state, &options);
+        let comment = state
+            .lock()
+            .expect("should lock state")
+            .clone()
+            .expect("should have comment");
+        assert!(
+            !comment.contains("EC-ID-abc123"),
+            "debug key must never surface in Redacted mode even if configured: {comment}"
+        );
+    }
+
+    #[test]
+    fn upstream_mode_includes_provider_diagnostics_but_not_debug_subtree() {
+        let metadata = std::collections::HashMap::from([
+            ("error_type".to_string(), serde_json::json!("timeout")),
+            (
+                "errors".to_string(),
+                serde_json::json!(["errors-example-user-123"]),
+            ),
+            (
+                "warnings".to_string(),
+                serde_json::json!(["warnings-example-user-123"]),
+            ),
+            (
+                "responsetimemillis".to_string(),
+                serde_json::json!({"example-bidder": 12}),
+            ),
+            (
+                "bidstatus".to_string(),
+                serde_json::json!([{"bidder": "example-bidder", "status": "timeout"}]),
+            ),
+            (
+                "upstream_message".to_string(),
+                serde_json::json!("upstream-example-user-123"),
+            ),
+            (
+                "upstream_message_truncated".to_string(),
+                serde_json::json!(true),
+            ),
+            (
+                "debug".to_string(),
+                serde_json::json!({"resolvedrequest": {"user": {"id": "debug-example-user-123"}}}),
+            ),
+        ]);
+        let options = AuctionDebugCommentOptions {
+            verbosity: AuctionDebugCommentVerbosity::Upstream,
+            metadata_keys: vec!["error_type".to_string()],
+            ..AuctionDebugCommentOptions::default()
+        };
+
+        let comment = dump_comment_for_metadata_with_options(metadata, &options);
+        let rendered = response_metadata_from_comment(&comment);
+
+        for key in [
+            "error_type",
+            "errors",
+            "warnings",
+            "responsetimemillis",
+            "bidstatus",
+            "upstream_message",
+            "upstream_message_truncated",
+        ] {
+            assert!(
+                rendered.get(key).is_some(),
+                "should include {key}: {comment}"
+            );
+        }
+        assert!(rendered.get("debug").is_none());
+        assert!(!comment.contains("debug-example-user-123"));
+    }
+
+    #[test]
+    fn verbosity_upstream_still_truncates_creative() {
+        let big_creative = "u".repeat(MAX_BID_CREATIVE_DUMP_BYTES * 2);
+        let options = AuctionDebugCommentOptions {
+            verbosity: AuctionDebugCommentVerbosity::Upstream,
+            ..AuctionDebugCommentOptions::default()
+        };
+
+        let comment = dump_comment_for_creative_with_options(&big_creative, &options);
+
+        assert!(comment.contains("(truncated"));
+        assert!(!comment.contains(&big_creative));
+    }
+
+    #[test]
+    fn verbosity_full_includes_raw_debug_subtree_when_present() {
+        let response = AuctionResponse::error("prebid", 12).with_metadata(
+            "debug",
+            serde_json::json!({"httpcalls": {"aps": [{"status": 200}]}}),
+        );
+        let result = OrchestrationResult {
+            provider_responses: vec![response],
+            mediator_response: None,
+            winning_bids: std::collections::HashMap::new(),
+            total_time_ms: 12,
+            metadata: std::collections::HashMap::new(),
+        };
+        let options = AuctionDebugCommentOptions {
+            verbosity: AuctionDebugCommentVerbosity::Full,
+            ..AuctionDebugCommentOptions::default()
+        };
+        let state = Arc::new(Mutex::new(Some("BIDS_SCRIPT".to_string())));
+        prepend_auction_debug_comment("stream", &result, &state, &options);
+        let comment = state
+            .lock()
+            .expect("should lock state")
+            .clone()
+            .expect("should have comment");
+        assert!(
+            comment.contains("httpcalls"),
+            "Full verbosity should surface the raw debug subtree: {comment}"
+        );
+    }
+
+    #[test]
+    fn verbosity_full_skips_creative_truncation() {
+        let big_creative = "y".repeat(MAX_BID_CREATIVE_DUMP_BYTES * 2);
+        let options = AuctionDebugCommentOptions {
+            verbosity: AuctionDebugCommentVerbosity::Full,
+            ..AuctionDebugCommentOptions::default()
+        };
+        let comment = dump_comment_for_creative_with_options(&big_creative, &options);
+        assert!(
+            comment.contains(&big_creative),
+            "Full verbosity should not truncate the creative preview"
+        );
+    }
+
+    #[test]
+    fn verbosity_full_still_hits_overall_byte_cap() {
+        let huge_creative = "z".repeat(MAX_AUCTION_DEBUG_DUMP_BYTES * 2);
+        for format in [
+            AuctionDebugCommentFormat::Compact,
+            AuctionDebugCommentFormat::Pretty,
+        ] {
+            let options = AuctionDebugCommentOptions {
+                verbosity: AuctionDebugCommentVerbosity::Full,
+                format,
+                ..AuctionDebugCommentOptions::default()
+            };
+            let comment = dump_comment_for_creative_with_options(&huge_creative, &options);
+            assert!(
+                comment.contains("(truncated"),
+                "even Full verbosity must respect the total dump byte cap for {format:?}: {}",
+                &comment[..comment.len().min(200)]
+            );
+        }
+    }
+
+    #[test]
+    fn include_provider_responses_false_omits_section_entirely() {
+        let options = AuctionDebugCommentOptions {
+            include_provider_responses: false,
+            ..AuctionDebugCommentOptions::default()
+        };
+        let comment = dump_comment_for_creative_with_options("<div>x</div>", &options);
+        assert!(!comment.contains("provider_responses"));
+    }
+
+    #[test]
+    fn include_mediator_response_false_omits_even_when_mediator_ran() {
+        let response = AuctionResponse::success("aps", vec![], 10);
+        let mediator = AuctionResponse::success("mediator", vec![], 5);
+        let result = OrchestrationResult {
+            provider_responses: vec![response],
+            mediator_response: Some(mediator),
+            winning_bids: std::collections::HashMap::new(),
+            total_time_ms: 10,
+            metadata: std::collections::HashMap::new(),
+        };
+        let options = AuctionDebugCommentOptions {
+            include_mediator_response: false,
+            ..AuctionDebugCommentOptions::default()
+        };
+        let state = Arc::new(Mutex::new(Some("BIDS_SCRIPT".to_string())));
+        prepend_auction_debug_comment("stream", &result, &state, &options);
+        let comment = state
+            .lock()
+            .expect("should lock state")
+            .clone()
+            .expect("should have comment");
+        assert!(!comment.contains("mediator_response"));
+    }
+
+    #[test]
+    fn include_bids_false_yields_empty_bids_array_not_omitted_response() {
+        let options = AuctionDebugCommentOptions {
+            include_bids: false,
+            ..AuctionDebugCommentOptions::default()
+        };
+        let comment = dump_comment_for_creative_with_options("<div>x</div>", &options);
+        assert!(comment.contains("\"bids\":[]"));
+        // The provider entry itself (status/provider name) must still be present.
+        assert!(comment.contains("\"provider\":\"aps\""));
+    }
+
     #[test]
     fn auction_debug_comment_truncates_oversized_creative() {
         // A creative larger than the per-bid preview cap must be truncated with a
@@ -4359,23 +5003,38 @@ mod tests {
         // path. A single `replace("--", …)` would re-form a terminator on the
         // odd-dash-run cases; the targeted two-replace must leave the comment's
         // own trailing `-->` as the only surviving terminator and drop `--!>`.
-        for creative in [
-            "<div>evil-->break</div>",
-            "--!><img src=x onerror=alert(1)>",
-            "<!--><img src=x onerror=alert(1)>",
-            "<!--!><img src=x onerror=alert(1)>",
-            "----!><img src=x onerror=alert(1)>",
+        for verbosity in [
+            AuctionDebugCommentVerbosity::Redacted,
+            AuctionDebugCommentVerbosity::Full,
         ] {
-            let comment = dump_comment_for_creative(creative);
-            assert_eq!(
-                comment.matches("-->").count(),
-                1,
-                "exactly one `-->` (the terminator) must survive for {creative:?}: {comment}"
-            );
-            assert!(
-                !comment.contains("--!>"),
-                "the `--!>` nested terminator must not survive for {creative:?}: {comment}"
-            );
+            for format in [
+                AuctionDebugCommentFormat::Compact,
+                AuctionDebugCommentFormat::Pretty,
+            ] {
+                let options = AuctionDebugCommentOptions {
+                    verbosity,
+                    format,
+                    ..AuctionDebugCommentOptions::default()
+                };
+                for creative in [
+                    "<div>evil-->break</div>",
+                    "--!><img src=x onerror=alert(1)>",
+                    "<!--><img src=x onerror=alert(1)>",
+                    "<!--!><img src=x onerror=alert(1)>",
+                    "----!><img src=x onerror=alert(1)>",
+                ] {
+                    let comment = dump_comment_for_creative_with_options(creative, &options);
+                    assert_eq!(
+                        comment.matches("-->").count(),
+                        1,
+                        "exactly one terminator must survive for {verbosity:?}, {format:?}, {creative:?}: {comment}"
+                    );
+                    assert!(
+                        !comment.contains("--!>"),
+                        "nested terminator must not survive for {verbosity:?}, {format:?}, {creative:?}: {comment}"
+                    );
+                }
+            }
         }
     }
 
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 598c00056..745f64023 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -1878,16 +1878,27 @@ pub struct DebugConfig {
     #[serde(default)]
     pub ja4_endpoint_enabled: bool,
 
-    /// Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping a
-    /// redacted per-provider auction result: pipeline stats (SSP count, mediator
-    /// status, winning bid count) plus every provider response — each bid's
-    /// creative previewed (not the full `adm` markup) and provider metadata
-    /// filtered to a fail-closed allowlist that drops identity-bearing keys.
-    /// Never enable in production — visible in page source and injects (bounded)
-    /// raw HTML from SSPs.
+    /// Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping
+    /// per-provider auction diagnostics. The default validates response-level
+    /// metadata, but bid fields and bounded creative previews remain visible;
+    /// this is not a fully anonymized dump. Never enable in production.
     #[serde(default)]
     pub auction_html_comment: bool,
 
+    /// Content and verbosity of the `auction_html_comment` dump. Ignored
+    /// when `auction_html_comment` is false.
+    ///
+    /// The default table must stay omitted from serialized config blobs:
+    /// [`DebugConfig`] denies unknown fields, so an older binary rejects a blob
+    /// carrying this table during a mixed-version deployment or rollback. Any
+    /// non-default table still serializes and requires restoring a compatible
+    /// blob before rolling back.
+    #[serde(
+        default,
+        skip_serializing_if = "is_default_auction_debug_comment_options"
+    )]
+    pub auction_html_comment_options: AuctionDebugCommentOptions,
+
     /// Enable the testing-only direct GAM-replace path and the verbose per-bid
     /// `debug_bid` blob in `window.tsjs.bids`.
     ///
@@ -1903,6 +1914,179 @@ pub struct DebugConfig {
     pub inject_adm_for_testing: bool,
 }
 
+/// Metadata keys safe to surface in the `ts-debug` auction comment.
+///
+/// Fail-closed superset: any key not listed here — notably `debug`, which
+/// carries the resolved `OpenRTB` request (EC ID, `user.ext.eids`, the TC
+/// consent string, `device.ip`, `device.geo`) plus per-bidder `httpcalls` —
+/// is dropped in [`AuctionDebugCommentVerbosity::Redacted`] mode regardless
+/// of what an operator lists in [`AuctionDebugCommentOptions::metadata_keys`].
+/// `metadata_keys` is a subset selector against this const, never a way to
+/// add new keys.
+pub(crate) const AUCTION_DEBUG_METADATA_ALLOWLIST: &[&str] =
+    &["error_type", "http_status", "message"];
+
+/// Provider-controlled diagnostic keys exposed only by `Upstream` or `Full`.
+///
+/// Values remain untyped upstream JSON and may contain request or identity
+/// data. Keeping this list separate prevents [`AuctionDebugCommentOptions::metadata_keys`]
+/// from widening the default response-metadata boundary.
+pub(crate) const AUCTION_DEBUG_UPSTREAM_METADATA_KEYS: &[&str] = &[
+    "errors",
+    "warnings",
+    "responsetimemillis",
+    "bidstatus",
+    "upstream_message",
+    "upstream_message_truncated",
+];
+
+fn default_true() -> bool {
+    true
+}
+
+fn default_auction_debug_metadata_keys() -> Vec<String> {
+    AUCTION_DEBUG_METADATA_ALLOWLIST
+        .iter()
+        .map(std::string::ToString::to_string)
+        .collect()
+}
+
+// This predicate preserves rollback compatibility by omitting the default table.
+fn is_default_auction_debug_comment_options(value: &AuctionDebugCommentOptions) -> bool {
+    *value == AuctionDebugCommentOptions::default()
+}
+
+/// Behavior of the `<!-- ts-debug: ... -->` auction dump. Only consulted when
+/// [`DebugConfig::auction_html_comment`] is true.
+///
+/// `deny_unknown_fields` matches the convention used by sibling config
+/// structs in this file, including the `DebugConfig` this struct nests
+/// under: an operator typo (e.g. `metadata_key` instead of `metadata_keys`)
+/// must fail config load loudly, not be silently ignored.
+#[derive(Debug, Clone, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct AuctionDebugCommentOptions {
+    /// Include the `provider_responses` section at all.
+    #[serde(default = "default_true")]
+    pub include_provider_responses: bool,
+
+    /// Include `mediator_response` when a mediator ran.
+    #[serde(default = "default_true")]
+    pub include_mediator_response: bool,
+
+    /// Include each provider's `bids` array (vs. status/metadata only).
+    #[serde(default = "default_true")]
+    pub include_bids: bool,
+
+    /// Subset of [`AUCTION_DEBUG_METADATA_ALLOWLIST`] to surface in
+    /// [`AuctionDebugCommentVerbosity::Redacted`] mode. This selector cannot
+    /// unlock provider diagnostics, and entries outside the fixed allowlist are
+    /// rejected at config load by
+    /// [`validate_metadata_keys`](Self::validate_metadata_keys).
+    ///
+    /// [`AuctionDebugCommentVerbosity::Upstream`] builds on the redacted
+    /// metadata, so this subset still gates those three keys there; the six
+    /// upstream diagnostics are unlocked by `verbosity` alone. Ignored entirely
+    /// when `verbosity` is [`AuctionDebugCommentVerbosity::Full`].
+    #[serde(default = "default_auction_debug_metadata_keys")]
+    pub metadata_keys: Vec<String>,
+
+    /// `Redacted` (default): validated `metadata_keys` subset only, with
+    /// creative previews truncated to `MAX_BID_CREATIVE_DUMP_BYTES`.
+    /// `Upstream`: redacted fields plus six untyped provider diagnostics;
+    /// creative previews remain truncated.
+    /// `Full`: raw `response.metadata` verbatim, including the `debug`
+    /// subtree (httpcalls/resolvedrequest) when present, and no creative
+    /// truncation. The total dump byte cap and comment-terminator
+    /// neutralization still apply unconditionally.
+    ///
+    /// NEVER enable `Upstream` or `Full` in production — identity-bearing
+    /// request/response data may become visible via view-source.
+    #[serde(default)]
+    pub verbosity: AuctionDebugCommentVerbosity,
+
+    /// JSON representation used for the outer auction dump.
+    #[serde(default)]
+    pub format: AuctionDebugCommentFormat,
+}
+
+impl Default for AuctionDebugCommentOptions {
+    fn default() -> Self {
+        Self {
+            include_provider_responses: true,
+            include_mediator_response: true,
+            include_bids: true,
+            metadata_keys: default_auction_debug_metadata_keys(),
+            verbosity: AuctionDebugCommentVerbosity::Redacted,
+            format: AuctionDebugCommentFormat::Compact,
+        }
+    }
+}
+
+impl AuctionDebugCommentOptions {
+    pub(crate) fn normalize(&mut self) {
+        self.metadata_keys = self
+            .metadata_keys
+            .drain(..)
+            .map(|key| key.trim().to_string())
+            .filter(|key| !key.is_empty())
+            .collect();
+    }
+
+    /// Reject [`Self::metadata_keys`] entries outside
+    /// [`AUCTION_DEBUG_METADATA_ALLOWLIST`].
+    ///
+    /// Render time intersects the configured list with the allowlist, so an
+    /// entry outside it is dead config that silently renders `metadata: {}`.
+    /// Fail the load loudly instead, matching the `deny_unknown_fields`
+    /// contract on this struct. The render-time intersection stays as
+    /// defense-in-depth for config paths that bypass this check.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] naming every unknown key.
+    pub(crate) fn validate_metadata_keys(&self) -> Result<(), Report<TrustedServerError>> {
+        let unknown: Vec<&str> = self
+            .metadata_keys
+            .iter()
+            .map(String::as_str)
+            .filter(|key| !AUCTION_DEBUG_METADATA_ALLOWLIST.contains(key))
+            .collect();
+
+        if unknown.is_empty() {
+            return Ok(());
+        }
+
+        Err(Report::new(TrustedServerError::Configuration {
+            message: format!(
+                "debug.auction_html_comment_options.metadata_keys contains unsupported keys [{}]; supported keys are [{}]",
+                unknown.join(", "),
+                AUCTION_DEBUG_METADATA_ALLOWLIST.join(", ")
+            ),
+        }))
+    }
+}
+
+/// Verbosity of the `ts-debug` auction comment. See
+/// [`AuctionDebugCommentOptions::verbosity`].
+#[derive(Debug, Clone, Copy, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuctionDebugCommentVerbosity {
+    #[default]
+    Redacted,
+    Upstream,
+    Full,
+}
+
+/// JSON representation used for the outer `ts-debug` auction dump.
+#[derive(Debug, Clone, Copy, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuctionDebugCommentFormat {
+    #[default]
+    Compact,
+    Pretty,
+}
+
 /// Tester-cookie endpoint configuration.
 #[derive(Debug, Default, Clone, Deserialize, Serialize)]
 pub struct TesterCookieConfig {
@@ -2021,6 +2205,7 @@ impl Settings {
     ) -> Result<Self, Report<TrustedServerError>> {
         settings.proxy.normalize();
         settings.image_optimizer.normalize();
+        settings.debug.auction_html_comment_options.normalize();
         settings.consent.validate();
 
         settings.prepare_runtime()?;
@@ -2048,12 +2233,16 @@ impl Settings {
     /// # Errors
     ///
     /// Returns a configuration error if any cached runtime artifact cannot be
-    /// prepared, if any handler path regex does not compile, or if a creative
-    /// opportunity slot is invalid.
+    /// prepared, if any handler path regex does not compile, if a creative
+    /// opportunity slot is invalid, or if
+    /// [`AuctionDebugCommentOptions::metadata_keys`] names an unsupported key.
     pub fn prepare_runtime(&mut self) -> Result<(), Report<TrustedServerError>> {
         self.image_optimizer.prepare_runtime()?;
         self.proxy.prepare_runtime()?;
         self.tinybird.prepare_runtime()?;
+        self.debug
+            .auction_html_comment_options
+            .validate_metadata_keys()?;
         self.validate_asset_image_optimizer_profile_sets()?;
 
         for handler in &self.handlers {
@@ -2595,6 +2784,173 @@ mod tests {
     use crate::redacted::Redacted;
     use crate::test_support::tests::{crate_test_settings_str, create_test_settings};
 
+    #[test]
+    fn auction_debug_comment_options_default_matches_serde_defaults() {
+        let opts = AuctionDebugCommentOptions::default();
+        assert!(opts.include_provider_responses, "should default to true");
+        assert!(opts.include_mediator_response, "should default to true");
+        assert!(opts.include_bids, "should default to true");
+        assert_eq!(
+            opts.metadata_keys,
+            vec![
+                "error_type".to_string(),
+                "http_status".to_string(),
+                "message".to_string(),
+            ],
+            "should default to only schema-validated response metadata"
+        );
+        assert_eq!(
+            opts.verbosity,
+            AuctionDebugCommentVerbosity::Redacted,
+            "should default to Redacted"
+        );
+        assert_eq!(
+            opts.format,
+            AuctionDebugCommentFormat::Compact,
+            "should default to compact output"
+        );
+    }
+
+    #[test]
+    fn auction_debug_comment_options_normalize_trims_and_drops_empty_keys() {
+        let mut opts = AuctionDebugCommentOptions {
+            metadata_keys: vec![
+                " http_status ".to_string(),
+                "".to_string(),
+                "debug".to_string(),
+            ],
+            ..AuctionDebugCommentOptions::default()
+        };
+        opts.normalize();
+        assert_eq!(
+            opts.metadata_keys,
+            vec!["http_status".to_string(), "debug".to_string()]
+        );
+    }
+
+    #[test]
+    fn auction_debug_comment_options_deserializes_upstream_verbosity() {
+        let options: AuctionDebugCommentOptions = toml::from_str(r#"verbosity = "upstream""#)
+            .expect("should deserialize upstream verbosity");
+        assert_eq!(options.verbosity, AuctionDebugCommentVerbosity::Upstream);
+    }
+
+    #[test]
+    fn auction_debug_comment_options_deserializes_pretty_format() {
+        let options: AuctionDebugCommentOptions =
+            toml::from_str(r#"format = "pretty""#).expect("should deserialize pretty format");
+        assert_eq!(options.format, AuctionDebugCommentFormat::Pretty);
+    }
+
+    #[test]
+    fn auction_debug_comment_options_bad_format_fails_config_load() {
+        let result: Result<AuctionDebugCommentOptions, _> =
+            toml::from_str(r#"format = "expanded""#);
+        assert!(
+            result.is_err(),
+            "unrecognized format must fail to deserialize, not silently fall back"
+        );
+    }
+
+    #[test]
+    fn bad_verbosity_string_fails_config_load() {
+        // Deserialize AuctionDebugCommentOptions directly, not a full Settings —
+        // Settings has required fields with no #[serde(default)] (e.g.
+        // `publisher`), so a full-Settings fixture missing them would fail with
+        // "missing field `publisher`" regardless of whether `verbosity` itself
+        // deserialized correctly, testing the wrong thing.
+        let result: Result<AuctionDebugCommentOptions, _> =
+            toml::from_str(r#"verbosity = "everything""#);
+        assert!(
+            result.is_err(),
+            "unrecognized verbosity must fail to deserialize, not silently fall back"
+        );
+    }
+
+    #[test]
+    fn auction_debug_comment_options_unknown_metadata_key_fails_config_load() {
+        let toml = format!(
+            "{}\n[debug]\nauction_html_comment = true\n\n[debug.auction_html_comment_options]\nmetadata_keys = [\"http_staus\", \"errors\"]\n",
+            crate_test_settings_str()
+        );
+        let error = Settings::from_toml(&toml)
+            .expect_err("should reject metadata keys outside the fixed allowlist");
+        let rendered = format!("{error:?}");
+        assert!(
+            rendered.contains("http_staus") && rendered.contains("errors"),
+            "error should name every unsupported key, got {rendered}"
+        );
+    }
+
+    #[test]
+    fn auction_debug_comment_options_allowlisted_metadata_keys_load() {
+        let toml = format!(
+            "{}\n[debug]\nauction_html_comment = true\n\n[debug.auction_html_comment_options]\nmetadata_keys = [\" message \"]\n",
+            crate_test_settings_str()
+        );
+        let settings = Settings::from_toml(&toml).expect("should accept an allowlisted key");
+        assert_eq!(
+            settings.debug.auction_html_comment_options.metadata_keys,
+            vec!["message".to_string()],
+            "normalize should trim before validation runs"
+        );
+    }
+
+    #[test]
+    fn auction_debug_comment_options_unknown_field_fails_config_load() {
+        let result: Result<AuctionDebugCommentOptions, _> =
+            toml::from_str(r#"metadata_key = ["message"]"#);
+        assert!(
+            result.is_err(),
+            "a misspelled field must fail config load, not be silently ignored"
+        );
+    }
+
+    #[test]
+    fn default_auction_debug_comment_options_stay_out_of_serialized_config() {
+        // Rollback contract: `DebugConfig` denies unknown fields, so the
+        // previous binary rejects a config blob carrying a table it does not
+        // know. Defaults must therefore serialize to nothing.
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields)]
+        struct LegacyDebugConfig {
+            #[serde(default)]
+            ja4_endpoint_enabled: bool,
+            #[serde(default)]
+            auction_html_comment: bool,
+            #[serde(default)]
+            inject_adm_for_testing: bool,
+        }
+
+        let value = serde_json::to_value(DebugConfig::default())
+            .expect("should serialize the default debug config");
+        assert!(
+            value.get("auction_html_comment_options").is_none(),
+            "default options table should not be serialized, got {value}"
+        );
+
+        let legacy: LegacyDebugConfig = serde_json::from_value(value)
+            .expect("legacy schema should accept the default debug payload");
+        assert!(!legacy.ja4_endpoint_enabled);
+        assert!(!legacy.auction_html_comment);
+        assert!(!legacy.inject_adm_for_testing);
+
+        let configured = DebugConfig {
+            auction_html_comment: true,
+            auction_html_comment_options: AuctionDebugCommentOptions {
+                include_bids: false,
+                ..AuctionDebugCommentOptions::default()
+            },
+            ..DebugConfig::default()
+        };
+        let value =
+            serde_json::to_value(&configured).expect("should serialize a configured debug config");
+        assert!(
+            value.get("auction_html_comment_options").is_some(),
+            "non-default options must still serialize, got {value}"
+        );
+    }
+
     #[test]
     fn tinybird_defaults_to_disabled_placeholders() {
         let settings = Settings::from_toml(&crate_test_settings_str())
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index b4ba6b797..a47dbf155 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -823,3 +823,78 @@ Every auction response includes structured metadata in `ext.orchestrator`:
   "time_ms": 145
 }
 ```
+
+### SSAT HTML Debug Comment
+
+For local server-side auction template (SSAT) investigation, Trusted Server can
+insert a `<!-- ts-debug: ... -->` comment before the page's bids script. Enable
+it in `trusted-server.toml`, push the local configuration, restart the local
+server, and search the page source for `ts-debug`:
+
+```toml
+[debug]
+auction_html_comment = true
+
+[debug.auction_html_comment_options]
+include_provider_responses = true
+include_mediator_response = false
+include_bids = false
+verbosity = "full"
+format = "pretty"
+```
+
+```bash
+ts config validate
+ts config push --adapter fastly --local
+fastly compute serve
+```
+
+This example is useful when investigating raw Prebid Server requests and
+responses without spending the dump budget on winning creatives. Raw PBS
+`debug.httpcalls` and `resolvedrequest` metadata also require
+`debug = true` under `[integrations.prebid]`.
+
+| Option                       | Default                                | Behavior                                                                                       |
+| ---------------------------- | -------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `include_provider_responses` | `true`                                 | Include the provider response array                                                            |
+| `include_mediator_response`  | `true`                                 | Include the mediator response when a mediator ran                                              |
+| `include_bids`               | `true`                                 | Include bid objects; when `false`, provider status and metadata remain                         |
+| `metadata_keys`              | `error_type`, `http_status`, `message` | Subset of the fixed validated keys; gates them in `redacted` and `upstream`, ignored in `full` |
+| `verbosity`                  | `redacted`                             | Select `redacted`, `upstream`, or `full` sensitivity                                           |
+| `format`                     | `compact`                              | Use compact outer JSON or indented outer JSON with `pretty`                                    |
+
+`metadata_keys` is a subset selector against a fixed allowlist —
+`error_type`, `http_status`, and `message` — never a way to add keys. Any other
+entry fails config load rather than being silently ignored.
+
+The verbosity modes form an explicit sensitivity ladder:
+
+- `redacted` reconstructs only validated `error_type`, `http_status`, and a
+  server-generated `message`, intersected with `metadata_keys`. A successful
+  provider response can therefore have `metadata: {}`.
+- `upstream` adds provider-controlled errors, warnings, response timings, bid
+  statuses, and bounded upstream-message fields. It builds on the redacted
+  metadata, so `metadata_keys` still gates the three validated keys, while the
+  provider diagnostics are unlocked by `verbosity` alone. It does not include
+  raw PBS `httpcalls` or `resolvedrequest`.
+- `full` includes raw response metadata and untruncated creatives, ignoring
+  `metadata_keys` entirely. It can expose IP addresses, geo data, identifiers,
+  consent strings, request signatures, and complete provider request/response
+  bodies.
+
+`format = "pretty"` indents only the outer dump. JSON-looking fields such as
+`requestbody` and `responsebody` remain strings exactly as captured, so their
+contents still appear escaped. Use a local JSON inspection tool when those
+nested values need additional formatting.
+
+The summary line's `winning=N` count is computed before section filtering, so
+it can be nonzero while `include_bids = false` produces empty bid arrays. Every
+mode and format neutralizes HTML-comment terminators and enforces a 256 KiB
+total dump cap. A capped dump ends with `…(truncated N bytes)` and is no longer
+valid JSON.
+
+::: danger Local debugging only
+Do not enable the auction HTML comment in production. Even `redacted` can
+contain bid-level data and creative previews, while `upstream` and `full` may
+expose identity-bearing request data to anyone who can view the page source.
+:::
diff --git a/docs/superpowers/plans/2026-07-20-ssat-debug-comment-config.md b/docs/superpowers/plans/2026-07-20-ssat-debug-comment-config.md
new file mode 100644
index 000000000..ad3381720
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-20-ssat-debug-comment-config.md
@@ -0,0 +1,491 @@
+# SSAT Debug Comment Configuration Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Finish the SSAT debug-comment configuration with three explicit sensitivity modes while making default response-level metadata fail closed by both key and value schema.
+
+**Architecture:** Keep the existing configuration types in `settings.rs` and rendering in `publisher.rs`. Add an `Upstream` enum branch and a separate provider-diagnostic key set. In `Redacted`, reconstruct a small metadata object from validated values instead of copying arbitrary JSON; in `Upstream`, add only six named provider diagnostics; in `Full`, retain the existing raw-metadata behavior.
+
+**Tech Stack:** Rust, serde/serde_json, TOML, existing `trusted-server-core` tests and target-specific Cargo aliases.
+
+**Spec:** `docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md`
+
+---
+
+## File Structure
+
+| File                                                                    | Responsibility                                                                                                                       |
+| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| `crates/trusted-server-core/src/settings.rs`                            | Public config schema, safe selector keys, upstream diagnostic keys, normalization, config tests                                      |
+| `crates/trusted-server-core/src/publisher.rs`                           | Schema validation, safe message generation, three rendering branches, section/size protections, renderer tests                       |
+| `trusted-server.example.toml`                                           | Operator-facing mode and privacy documentation                                                                                       |
+| `docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md` | Approved security contract; no behavioral edits during implementation unless a discovered contradiction is brought back for approval |
+
+No new production file or dependency is needed. The existing large modules already own these responsibilities, so splitting them during this security fix would add unrelated churn.
+
+---
+
+### Task 1: Lock down the configuration boundary
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs:1890-2020`
+- Test: `crates/trusted-server-core/src/settings.rs:2700-2770`
+
+- [ ] **Step 1: Write failing settings tests**
+
+Update `auction_debug_comment_options_default_matches_serde_defaults` to require exactly the safe selector keys:
+
+```rust
+assert_eq!(
+    opts.metadata_keys,
+    vec![
+        "error_type".to_string(),
+        "http_status".to_string(),
+        "message".to_string(),
+    ],
+    "should default to only schema-validated response metadata"
+);
+```
+
+Add direct enum deserialization coverage:
+
+```rust
+#[test]
+fn auction_debug_comment_options_deserializes_upstream_verbosity() {
+    let options: AuctionDebugCommentOptions =
+        toml::from_str("verbosity = \"upstream\"")
+            .expect("should deserialize upstream verbosity");
+    assert_eq!(options.verbosity, AuctionDebugCommentVerbosity::Upstream);
+}
+```
+
+Change the normalization fixture to safe and unsafe-looking names so it proves normalization only, not authorization:
+
+```rust
+let mut opts = AuctionDebugCommentOptions {
+    metadata_keys: vec![
+        " http_status ".to_string(),
+        "".to_string(),
+        "debug".to_string(),
+    ],
+    ..AuctionDebugCommentOptions::default()
+};
+opts.normalize();
+assert_eq!(
+    opts.metadata_keys,
+    vec!["http_status".to_string(), "debug".to_string()]
+);
+```
+
+This deliberately leaves `debug` in normalized configuration; authorization must happen at render time.
+
+- [ ] **Step 2: Run the focused tests and confirm RED**
+
+Run:
+
+```bash
+cargo test -p trusted-server-core --lib auction_debug_comment_options -- --nocapture
+cargo test -p trusted-server-core --lib bad_verbosity_string_fails_config_load -- --nocapture
+```
+
+Expected: both commands fail to compile because Rust builds the complete lib test binary before applying the name filter, and the newly added test references the nonexistent `AuctionDebugCommentVerbosity::Upstream`. This is the intended RED state; the existing invalid-verbosity assertion is re-confirmed after the enum compiles in Step 4.
+
+- [ ] **Step 3: Implement the minimal settings change**
+
+Replace the current safe const with:
+
+```rust
+pub(crate) const AUCTION_DEBUG_METADATA_ALLOWLIST: &[&str] =
+    &["error_type", "http_status", "message"];
+
+pub(crate) const AUCTION_DEBUG_UPSTREAM_METADATA_KEYS: &[&str] = &[
+    "errors",
+    "warnings",
+    "responsetimemillis",
+    "bidstatus",
+    "upstream_message",
+    "upstream_message_truncated",
+];
+```
+
+Add the enum variant between `Redacted` and `Full`:
+
+```rust
+#[derive(Debug, Clone, Copy, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuctionDebugCommentVerbosity {
+    #[default]
+    Redacted,
+    Upstream,
+    Full,
+}
+```
+
+Update the public docs on `metadata_keys` and `verbosity` to state:
+
+- `metadata_keys` selects only the three safe fields and cannot unlock upstream keys.
+- `Upstream` adds six untyped provider diagnostic values and remains creative-truncated.
+- `Full` copies all response metadata and does not truncate creatives.
+- `Upstream` and `Full` must not be enabled in production.
+
+- [ ] **Step 4: Run focused tests and confirm GREEN**
+
+Run both commands from Step 2.
+
+Expected: all matching settings tests pass, including invalid-verbosity rejection.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/settings.rs
+git commit -m "Harden SSAT debug comment configuration modes"
+```
+
+---
+
+### Task 2: Make redacted rendering schema-safe
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs:60-70`
+- Modify: `crates/trusted-server-core/src/publisher.rs:1870-2035`
+- Test: `crates/trusted-server-core/src/publisher.rs:4250-4565`
+
+- [ ] **Step 1: Add a reusable test renderer with explicit metadata**
+
+Near the existing `dump_comment_for_creative_with_options`, add a helper that builds one `AuctionResponse::error("prebid", 12)`, attaches supplied metadata with the existing `with_metadata` builder, calls `prepend_auction_debug_comment`, and returns the rendered state. Do not add a production convenience API only for tests.
+
+- [ ] **Step 2: Write the failing default and subset tests**
+
+Replace `default_options_reproduce_current_behavior` with `default_options_apply_safe_response_metadata_schema`. Its fixture must contain:
+
+- valid `error_type = "http_status"`
+- valid `http_status = 422`
+- malicious raw `message`
+- all six upstream diagnostic keys containing unique fictional identity-shaped markers
+- `debug.resolvedrequest.user.id`
+
+Assert that output contains `error_type`, `http_status`, and the fixed message `Provider returned HTTP 422`; assert that none of the raw message, upstream markers, or `debug` subtree appear.
+
+Add `configured_metadata_subset_only_includes_selected_safe_keys` with `metadata_keys = ["http_status", "errors", "debug"]`. Assert only validated `http_status` survives; `errors` and `debug` cannot be unlocked by selector configuration.
+
+- [ ] **Step 3: Write the failing adversarial schema test**
+
+Add `redacted_mode_rejects_wrong_types_and_unknown_error_classifications`. Render separate cases containing:
+
+```rust
+json!({"error_type": {"identity": "example-user-123"}})
+json!({"error_type": "provider_supplied_unknown", "message": "example-user-123"})
+json!({"http_status": "200 example-user-123"})
+json!({"http_status": 99})
+json!({"http_status": 600})
+json!({"message": {"identity": "example-user-123"}})
+```
+
+Assert no identity marker or attacker-provided message appears. Also assert valid integer boundaries `100` and `599` survive, while non-integral JSON numbers do not.
+
+- [ ] **Step 4: Write the failing safe-message mapping test**
+
+Add a table-driven test for the fixed mappings:
+
+```rust
+let cases = [
+    ("parse_response", None, "Provider response could not be parsed"),
+    ("launch_failed", None, "Provider launch failed"),
+    ("transport", None, "Provider request failed"),
+    ("timeout", None, "Provider request timed out"),
+    ("http_status", Some(418), "Provider returned HTTP 418"),
+    ("http_status", None, "Provider returned an HTTP error"),
+];
+```
+
+For every case, include a malicious raw `metadata["message"]` and prove the renderer ignores it.
+
+- [ ] **Step 5: Run the focused publisher tests and confirm RED**
+
+Run:
+
+```bash
+cargo test -p trusted-server-core --lib publisher::tests:: -- --nocapture
+```
+
+Expected: new privacy tests fail because current redacted rendering clones values by matching key names only.
+
+- [ ] **Step 6: Implement schema validation and safe message generation**
+
+Import both key constants. Add private helpers close to `redact_response_for_dump`:
+
+```rust
+fn validated_error_type(
+    metadata: &std::collections::HashMap<String, serde_json::Value>,
+) -> Option<&str> {
+    let value = metadata.get("error_type")?.as_str()?;
+    matches!(
+        value,
+        "parse_response" | "launch_failed" | "transport" | "timeout" | "http_status"
+    )
+    .then_some(value)
+}
+
+fn validated_http_status(
+    metadata: &std::collections::HashMap<String, serde_json::Value>,
+) -> Option<u64> {
+    metadata
+        .get("http_status")?
+        .as_u64()
+        .filter(|status| (100..=599).contains(status))
+}
+
+fn safe_error_message(error_type: &str, http_status: Option<u64>) -> Option<String> {
+    match error_type {
+        "parse_response" => Some("Provider response could not be parsed".to_string()),
+        "launch_failed" => Some("Provider launch failed".to_string()),
+        "transport" => Some("Provider request failed".to_string()),
+        "timeout" => Some("Provider request timed out".to_string()),
+        "http_status" => Some(http_status.map_or_else(
+            || "Provider returned an HTTP error".to_string(),
+            |status| format!("Provider returned HTTP {status}"),
+        )),
+        _ => None,
+    }
+}
+```
+
+Implement `redacted_metadata_for_dump` so it reconstructs values only when each field is configured and valid. It must never clone `metadata["message"]`:
+
+```rust
+fn redacted_metadata_for_dump(
+    metadata: &std::collections::HashMap<String, serde_json::Value>,
+    options: &AuctionDebugCommentOptions,
+) -> serde_json::Map<String, serde_json::Value> {
+    let selected = |key: &str| {
+        AUCTION_DEBUG_METADATA_ALLOWLIST.contains(&key)
+            && options.metadata_keys.iter().any(|candidate| candidate == key)
+    };
+    let error_type = validated_error_type(metadata);
+    let http_status = validated_http_status(metadata);
+    let mut safe = serde_json::Map::new();
+    if selected("error_type") && let Some(value) = error_type {
+        safe.insert("error_type".to_string(), serde_json::json!(value));
+    }
+    if selected("http_status") && let Some(value) = http_status {
+        safe.insert("http_status".to_string(), serde_json::json!(value));
+    }
+    if selected("message")
+        && let Some(value) = error_type.and_then(|kind| safe_error_message(kind, http_status))
+    {
+        safe.insert("message".to_string(), serde_json::json!(value));
+    }
+    safe
+}
+```
+
+- [ ] **Step 7: Add the `Upstream` and `Full` metadata branches**
+
+Build redacted metadata first. For `Upstream`, copy only keys in `AUCTION_DEBUG_UPSTREAM_METADATA_KEYS`; for `Full`, clone the entire map:
+
+```rust
+let metadata = match options.verbosity {
+    AuctionDebugCommentVerbosity::Redacted => {
+        redacted_metadata_for_dump(&response.metadata, options)
+    }
+    AuctionDebugCommentVerbosity::Upstream => {
+        let mut metadata = redacted_metadata_for_dump(&response.metadata, options);
+        for key in AUCTION_DEBUG_UPSTREAM_METADATA_KEYS {
+            if let Some(value) = response.metadata.get(*key) {
+                metadata.insert((*key).to_string(), value.clone());
+            }
+        }
+        metadata
+    }
+    AuctionDebugCommentVerbosity::Full => response
+        .metadata
+        .iter()
+        .map(|(key, value)| (key.clone(), value.clone()))
+        .collect(),
+};
+```
+
+Change creative handling so truncation applies to every mode except `Full`:
+
+```rust
+if options.verbosity != AuctionDebugCommentVerbosity::Full
+    && let Some(creative) = &bid.creative
+{
+    value["creative"] = serde_json::Value::String(truncate_with_marker(
+        creative,
+        MAX_BID_CREATIVE_DUMP_BYTES,
+    ));
+}
+```
+
+- [ ] **Step 8: Write and run upstream/full safety tests**
+
+Add:
+
+- `upstream_mode_includes_provider_diagnostics_but_not_debug_subtree`
+- `verbosity_upstream_still_truncates_creative`
+- `metadata_keys_empty_yields_empty_safe_metadata_in_redacted`
+
+The upstream fixture must include all six diagnostics plus a `debug` subtree. Assert all six diagnostics appear, `debug` does not, the configured safe subset still works, and the creative carries the existing truncation marker. Retain existing tests proving `Full` includes `debug`, skips per-creative truncation, and still respects the 256 KiB total cap.
+
+Extend `auction_debug_comment_neutralises_every_comment_terminator_vector` so its existing five attack vectors run once with `Redacted` and once with `Full`. Do not replace this table with the narrower two-vector full-mode test: every vector must prove that verbosity cannot bypass the unconditional HTML-comment safety boundary.
+
+Run:
+
+```bash
+cargo test -p trusted-server-core --lib publisher::tests:: -- --nocapture
+```
+
+Expected: all publisher tests pass.
+
+- [ ] **Step 9: Commit**
+
+```bash
+git add crates/trusted-server-core/src/publisher.rs
+git commit -m "Enforce SSAT debug response metadata schemas"
+```
+
+---
+
+### Task 3: Correct operator-facing configuration documentation
+
+**Files:**
+
+- Modify: `trusted-server.example.toml:160-190`
+- Verify against: `docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md`
+
+- [ ] **Step 1: Update the example configuration**
+
+Use exactly the safe default selector:
+
+```toml
+[debug]
+# NEVER enable in production. Injects an auction dump before </body>.
+# "redacted" validates response metadata but still includes bid-level fields
+# and creative previews; it is not a fully anonymized dump.
+auction_html_comment = false
+
+[debug.auction_html_comment_options]
+include_provider_responses = true
+include_mediator_response = true
+include_bids = true
+metadata_keys = ["error_type", "http_status", "message"]
+# "redacted" (default), "upstream", or "full".
+# "upstream" exposes six untyped provider diagnostic values that may contain
+# request or identity data. "full" additionally exposes all response metadata
+# and untruncated creatives. Never use either sensitive mode in production.
+verbosity = "redacted"
+```
+
+Preserve nearby unrelated comments and settings from `main`.
+
+- [ ] **Step 2: Verify example parsing**
+
+Run:
+
+```bash
+cargo test-cloudflare
+cargo test-spin
+```
+
+Expected: both adapter suites pass, including paths that load `trusted-server.example.toml`.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add trusted-server.example.toml
+git commit -m "Document SSAT debug sensitivity modes"
+```
+
+---
+
+### Task 4: Full verification and review
+
+**Files:** none unless verification exposes a scoped defect.
+
+- [ ] **Step 1: Run formatting checks**
+
+```bash
+cargo fmt --all -- --check
+cd docs && npm run format
+```
+
+Expected: no formatting differences.
+
+- [ ] **Step 2: Run native and adapter tests**
+
+```bash
+cargo test -p trusted-server-core --lib
+cargo test-axum
+cargo test-cloudflare
+cargo test-spin
+cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+```
+
+Expected: all pass.
+
+- [ ] **Step 3: Run Fastly tests**
+
+```bash
+cargo test-fastly
+```
+
+Expected: pass. If Viceroy fails before executing tests because macOS native certificate/keychain access is unavailable, record that exact environment blocker and separately run `cargo check-fastly`; do not describe Fastly tests as passing.
+
+- [ ] **Step 4: Run every target-specific lint alias**
+
+```bash
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+cargo clippy-cloudflare-wasm
+cargo clippy-spin-native
+cargo clippy-spin-wasm
+```
+
+Expected: no warnings or errors.
+
+- [ ] **Step 5: Run documentation and JavaScript gates required by repository CI**
+
+Use the repository-pinned Node version (`.tool-versions`, currently Node 24.12.0) for JavaScript commands:
+
+```bash
+cd crates/trusted-server-js/lib && npm run format
+cd crates/trusted-server-js/lib && npx vitest run
+cd crates/trusted-server-js/lib && node build-all.mjs
+```
+
+Expected: all pass. If the current shell uses another Node major, invoke the pinned Node binary explicitly rather than changing lockfiles.
+
+- [ ] **Step 6: Inspect the final diff and request independent code review**
+
+```bash
+git diff origin/main...HEAD --check
+git status --short
+```
+
+Verify:
+
+- no conflict markers
+- no unrelated changes
+- safe selector contains only `error_type`, `http_status`, `message`
+- every safe value is validated or generated
+- upstream includes exactly six named diagnostic keys
+- full remains the only mode that copies arbitrary response metadata
+- upstream and redacted both truncate creatives
+- byte cap and comment neutralization remain unconditional
+
+Then invoke `superpowers:requesting-code-review`. Fix any Critical or Important findings and rerun the affected gates before claiming completion.
+
+---
+
+## Implementation Constraints
+
+- Follow test-driven development: observe each new security test fail before changing its production path.
+- Do not alter bid-level `metadata`, `nurl`, `burl`, or creative contents beyond the existing preview truncation; issue #925 owns that separate boundary.
+- Do not add provider instrumentation or change Prebid response parsing.
+- Do not make either size cap configurable.
+- Do not silently downgrade invalid verbosity strings; serde must reject them.
+- Do not push the branch until the user has received the final verification and review results.
diff --git a/docs/superpowers/plans/2026-08-18-ssat-debug-comment-format.md b/docs/superpowers/plans/2026-08-18-ssat-debug-comment-format.md
new file mode 100644
index 000000000..bbe214363
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-18-ssat-debug-comment-format.md
@@ -0,0 +1,232 @@
+# SSAT Debug Comment Output Format Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a backward-compatible `compact`/`pretty` configuration option for the outer JSON in SSAT auction debug comments.
+
+**Architecture:** Extend `AuctionDebugCommentOptions` with a serde-backed format enum that defaults to compact. Keep the existing dump value and safety pipeline unchanged, selecting only `serde_json::to_string` versus `serde_json::to_string_pretty` before terminator neutralization and the 256 KiB cap.
+
+**Tech Stack:** Rust 2024, serde, serde_json, TOML configuration, existing `trusted-server-core` unit tests.
+
+---
+
+## File Map
+
+- Modify `crates/trusted-server-core/src/settings.rs`: define the output-format enum, add the option and default, and test TOML behavior.
+- Modify `crates/trusted-server-core/src/publisher.rs`: select compact or pretty JSON serialization and test rendering/safety invariants.
+- Modify `trusted-server.example.toml`: document the new setting and accepted values.
+
+### Task 1: Add the configuration type
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs:1945-2030`
+- Test: `crates/trusted-server-core/src/settings.rs:2710-2780`
+
+- [ ] **Step 1: Write failing settings tests**
+
+Extend `auction_debug_comment_options_default_matches_serde_defaults` with:
+
+```rust
+assert_eq!(
+    opts.format,
+    AuctionDebugCommentFormat::Compact,
+    "should default to compact output"
+);
+```
+
+Add focused tests:
+
+```rust
+#[test]
+fn auction_debug_comment_options_deserializes_pretty_format() {
+    let options: AuctionDebugCommentOptions = toml::from_str(r#"format = "pretty""#)
+        .expect("should deserialize pretty format");
+    assert_eq!(options.format, AuctionDebugCommentFormat::Pretty);
+}
+
+#[test]
+fn auction_debug_comment_options_bad_format_fails_config_load() {
+    let result: Result<AuctionDebugCommentOptions, _> =
+        toml::from_str(r#"format = "expanded""#);
+    assert!(
+        result.is_err(),
+        "unrecognized format must fail to deserialize, not silently fall back"
+    );
+}
+```
+
+- [ ] **Step 2: Run the tests and verify RED**
+
+Run:
+
+```bash
+cargo test-fastly auction_debug_comment_options -- --nocapture
+```
+
+Expected: compilation fails because `AuctionDebugCommentFormat` and `format` do not exist.
+
+- [ ] **Step 3: Implement the minimal configuration surface**
+
+Add `format` after `verbosity` in `AuctionDebugCommentOptions`:
+
+```rust
+/// JSON representation used for the outer auction dump.
+#[serde(default)]
+pub format: AuctionDebugCommentFormat,
+```
+
+Set `format: AuctionDebugCommentFormat::Compact` in the hand-written default and define:
+
+```rust
+/// JSON representation used for the outer `ts-debug` auction dump.
+#[derive(Debug, Clone, Copy, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuctionDebugCommentFormat {
+    #[default]
+    Compact,
+    Pretty,
+}
+```
+
+- [ ] **Step 4: Run the focused tests and verify GREEN**
+
+Run `cargo test-fastly auction_debug_comment_options -- --nocapture`.
+
+Expected: all matching settings tests pass.
+
+- [ ] **Step 5: Commit the configuration change**
+
+```bash
+git add crates/trusted-server-core/src/settings.rs
+git commit -m "Configure SSAT debug comment output format"
+```
+
+### Task 2: Render pretty outer JSON without transforming values
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs:2027-2130`
+- Test: `crates/trusted-server-core/src/publisher.rs:4330-4945`
+
+- [ ] **Step 1: Add a test helper for extracting an uncapped dump**
+
+Extract the existing parsing logic into `dump_json_from_comment`, returning the dump substring and parsed `serde_json::Value`. It must split after `dump=` and before the comment's final newline/terminator so it works for both one-line and indented JSON.
+
+- [ ] **Step 2: Write failing rendering tests**
+
+Add tests proving:
+
+1. Default compact output still contains `dump={"provider_responses":` and no newline immediately after the opening object.
+2. Pretty output contains `dump={\n  "provider_responses":`.
+3. Compact and pretty uncapped dumps deserialize to equal JSON values.
+4. In Full mode, metadata containing `{"requestbody": "{\"id\":\"request-1\"}"}` retains `requestbody` as a JSON string in pretty output.
+
+Extend the existing comment-terminator test to iterate over both
+`AuctionDebugCommentFormat::{Compact, Pretty}` for the tested verbosity modes.
+Add a pretty/full case to the total-cap test and assert the existing
+`(truncated` marker remains present.
+
+- [ ] **Step 3: Run the rendering tests and verify RED**
+
+Run:
+
+```bash
+cargo test-fastly auction_debug_comment -- --nocapture
+```
+
+Expected: the pretty-layout assertion fails because rendering still always uses compact serialization.
+
+- [ ] **Step 4: Implement format-selected serialization**
+
+Import `AuctionDebugCommentFormat` alongside the existing options types. Replace the single serializer call with:
+
+```rust
+let serialized = match options.format {
+    AuctionDebugCommentFormat::Compact => serde_json::to_string(&dump),
+    AuctionDebugCommentFormat::Pretty => serde_json::to_string_pretty(&dump),
+};
+let dump = render_dump(
+    serialized.unwrap_or_else(|error| format!("<dump serialize error: {error}>")),
+);
+```
+
+Do not alter the dump value, nested strings, neutralization, cap, or comment envelope.
+
+- [ ] **Step 5: Run the focused tests and verify GREEN**
+
+Run `cargo test-fastly auction_debug_comment -- --nocapture`.
+
+Expected: all matching rendering tests pass.
+
+- [ ] **Step 6: Commit the renderer change**
+
+```bash
+git add crates/trusted-server-core/src/publisher.rs
+git commit -m "Pretty print SSAT debug comment dumps"
+```
+
+### Task 3: Document and verify the completed feature
+
+**Files:**
+
+- Modify: `trusted-server.example.toml:180-190`
+
+- [ ] **Step 1: Document the setting**
+
+Add to `[debug.auction_html_comment_options]`:
+
+```toml
+# "compact" (default) or "pretty". Pretty formats only the outer dump;
+# JSON request/response bodies remain strings exactly as captured.
+format = "compact"
+```
+
+- [ ] **Step 2: Run formatting**
+
+Run `cargo fmt --all` and then `cargo fmt --all -- --check`.
+
+Expected: both exit successfully.
+
+- [ ] **Step 3: Run required tests**
+
+Run each command separately:
+
+```bash
+cargo test-fastly
+cargo test-axum
+cargo test-cloudflare
+cargo test-spin
+```
+
+Expected: every command exits successfully with zero failed tests.
+
+- [ ] **Step 4: Run target-matched lint checks**
+
+Run each command separately:
+
+```bash
+cargo clippy-fastly
+cargo clippy-axum
+cargo clippy-cloudflare
+cargo clippy-cloudflare-wasm
+cargo clippy-spin-native
+cargo clippy-spin-wasm
+```
+
+Expected: every command exits successfully with warnings denied.
+
+- [ ] **Step 5: Inspect the final diff and configuration compatibility**
+
+Run `git diff --check` and inspect `git diff origin/main...HEAD` plus the remaining working-tree diff. Confirm compact is the serde/default value, pretty changes whitespace only, nested strings are preserved, and both safety protections remain unconditional.
+
+- [ ] **Step 6: Commit documentation and any formatting changes**
+
+```bash
+git add crates/trusted-server-core/src/settings.rs crates/trusted-server-core/src/publisher.rs trusted-server.example.toml
+git commit -m "Document SSAT debug comment formatting"
+```
+
+- [ ] **Step 7: Push the branch and update PR #943**
+
+Run `git push origin feat/ssat-debug-comment-config`, then verify PR state and checks with `gh pr view 943` and `gh pr checks 943`.
diff --git a/docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md b/docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md
new file mode 100644
index 000000000..1c73fd668
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md
@@ -0,0 +1,488 @@
+# SSAT Debug Comment Configuration Design
+
+**Date:** 2026-07-20
+
+**Status:** Proposed security revision; awaiting approval
+
+**Issue:** [IABTechLab/trusted-server#935](https://github.com/IABTechLab/trusted-server/issues/935) — "For SSAT, make debug comment configurable"
+
+## Summary
+
+The server-side auction template (SSAT) can inject a `<!-- ts-debug: ... -->`
+HTML comment before the bids `<script>`, gated by `[debug]
+auction_html_comment = true`. Today its content is entirely fixed: a hardcoded
+metadata allowlist, a hardcoded 512-byte creative preview, and no way to omit
+sections. Operators debugging "why did we get bids for some slots and not
+others" need to see the actual request sent to and response received from each
+provider — including HTTP status codes and upstream error text — without
+recompiling or patching the redaction logic.
+
+This design adds a config table, `[debug.auction_html_comment_options]`,
+alongside the existing bool, with:
+
+1. Section toggles (provider responses / mediator response / bids array).
+2. A configurable subset of a revised, still-hardcoded safe metadata
+   allowlist.
+3. A three-level `verbosity` switch: `redacted` (validated response metadata by
+   default), `upstream` (provider diagnostic text), and `full` (raw metadata
+   and creatives).
+
+## Goals
+
+1. Let an operator omit sections of the dump to keep it small/focused.
+2. Let an operator select which validated, server-generated metadata fields to
+   surface.
+3. Surface `http_status` in the validated default response metadata, and make
+   the already-captured provider-controlled diagnostic text available through
+   an explicit intermediate `upstream`
+   mode so "was it a 400, and for what reason" is answerable without enabling
+   the complete provider dump. Upstream text is provider-controlled and may
+   echo sensitive request values, so it is not part of `redacted` mode.
+4. Provide an explicit, loudly-documented `full` mode for the rare case where
+   an operator needs the raw per-bidder request/response (PBS `debug.httpcalls`)
+   to diagnose a specific auction, accepting the PII exposure that implies.
+5. Never let section or metadata-key configuration weaken the fail-closed
+   response-metadata guarantee in redacted mode: identity-bearing response
+   metadata (device IP, geo, `user.ext.eids`, TC consent string) must be
+   unreachable via `metadata_keys` regardless of what an operator configures.
+
+## Non-goals
+
+- Per-provider filtering (dump only named SSPs). Explicitly declined — out of
+  scope for this change.
+- Configurable size limits. Explicitly declined — `MAX_BID_CREATIVE_DUMP_BYTES`
+  (512) and `MAX_AUCTION_DEBUG_DUMP_BYTES` (256KB) stay hardcoded constants;
+  neither becomes operator-tunable. Note this does **not** mean both apply in
+  every verbosity mode: `MAX_AUCTION_DEBUG_DUMP_BYTES` (the 256KB total cap)
+  is unconditional, while `MAX_BID_CREATIVE_DUMP_BYTES` (the 512-byte per-bid
+  preview) applies to `Redacted` and `Upstream`; `Full` skips creative
+  truncation entirely (see Rendering / Data Flow). "Hardcoded" means "not
+  config-driven," not "applied unconditionally in every mode."
+- Adding failure-reason instrumentation to provider adapters that don't
+  capture any today. Notably, `AuctionResponse::no_bid()`
+  ([auction/types.rs:296](../../../crates/trusted-server-core/src/auction/types.rs#L296))
+  always carries empty metadata, and `aps.rs`
+  ([integrations/aps.rs:546](../../../crates/trusted-server-core/src/integrations/aps.rs#L546))
+  never attaches a no-fill reason. `verbosity=full` will show nothing more for
+  an APS no-bid than redacted mode does today, because there is nothing more
+  captured server-side. Fixing that is separate, larger, per-provider work —
+  tracked as a follow-up issue, not part of this spec.
+- A bare-bool-or-table union deserializer for backward compatibility. The
+  existing `auction_html_comment` bool is untouched; the new table is a
+  sibling field, so no migration path is needed.
+- Changing `inject_adm_for_testing` (the existing "raw `adm` into
+  `window.tsjs.bids`" debug flag). Independent toggle, different channel
+  (client JS state vs. HTML comment), no interaction with this design.
+- Tightening `Bid`-level fields (`Bid.metadata`, `nurl`, `burl`) to a
+  fail-closed allowlist. These already pass through `redact_bid_for_dump`
+  unfiltered today in all verbosity modes
+  ([publisher.rs:966-972](../../../crates/trusted-server-core/src/publisher.rs#L966-L972)),
+  pre-existing and tracked separately as issue #925. Unaffected by, and
+  orthogonal to, this design.
+
+## Current Behavior (today, for reference)
+
+`prepend_auction_debug_comment`
+([publisher.rs:950](../../../crates/trusted-server-core/src/publisher.rs#L950))
+unconditionally:
+
+- Includes `provider_responses` and `mediator_response` (when present).
+- Includes every provider's `bids` array.
+- Filters each response's metadata to a fixed 7-key allowlist:
+  `error_type, status, message, responsetimemillis, errors, warnings, bidstatus`
+  ([publisher.rs:878](../../../crates/trusted-server-core/src/publisher.rs#L878)).
+- Previews each bid's `creative` to 512 bytes
+  ([publisher.rs:893](../../../crates/trusted-server-core/src/publisher.rs#L893)).
+- Neutralizes `-->`/`--!>` comment terminators and caps the total serialized
+  dump at 256KB, unconditionally.
+
+Notably absent from the allowlist today despite already being captured
+server-side by the prebid integration:
+
+- `http_status` — numeric HTTP status from a non-2xx PBS response
+  ([prebid.rs:2025](../../../crates/trusted-server-core/src/integrations/prebid.rs#L2025)).
+- `upstream_message` / `upstream_message_truncated` — the actual PBS error
+  body text, only populated when `[integrations.prebid] debug = true`
+  ([prebid.rs:2038-2046](../../../crates/trusted-server-core/src/integrations/prebid.rs#L2038-L2046)).
+  The text is bounded but provider-controlled, and may echo identifiers or
+  other request values. It is therefore available only in `upstream` and
+  `full` modes, never in the safe `redacted` default.
+
+The current allowlist's `errors`, `warnings`, `responsetimemillis`, and
+`bidstatus` values also come verbatim from untyped PBS JSON. Even fields that
+normally contain numbers or status labels could instead contain arbitrary
+strings or nested identity data. This design therefore moves all four out of
+`redacted` and makes them available only in `upstream` and `full`.
+
+Also captured server-side, but deliberately excluded from the allowlist and
+staying that way in redacted mode: the raw `debug` subtree
+(`httpcalls`/`resolvedrequest`) that PBS returns when `integrations.prebid.debug`
+is on ([prebid.rs:1945-1948](../../../crates/trusted-server-core/src/integrations/prebid.rs#L1945-L1948)).
+This carries the resolved OpenRTB request: device IP, geo, `user.ext.eids`, TC
+consent string, per-bidder request/response bodies. This is the data `full`
+verbosity exists to expose, on explicit opt-in.
+
+## Config Schema
+
+```rust
+/// Debug-only features. All flags default to `false` (off in production).
+#[derive(Debug, Default, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DebugConfig {
+    // ...existing fields unchanged (ja4_endpoint_enabled, auction_html_comment,
+    // inject_adm_for_testing)...
+
+    /// Behavior of the ts-debug comment. Only consulted when
+    /// `auction_html_comment` is true. Defaults preserve today's enabled
+    /// sections and redacted creative previews while using the revised safe
+    /// metadata allowlist documented below.
+    #[serde(default)]
+    pub auction_html_comment_options: AuctionDebugCommentOptions,
+}
+
+/// Behavior of the `<!-- ts-debug: ... -->` auction dump.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct AuctionDebugCommentOptions {
+    /// Include the `provider_responses` section at all.
+    #[serde(default = "default_true")]
+    pub include_provider_responses: bool,
+
+    /// Include `mediator_response` when a mediator ran.
+    #[serde(default = "default_true")]
+    pub include_mediator_response: bool,
+
+    /// Include each provider's `bids` array (vs. status/metadata only).
+    #[serde(default = "default_true")]
+    pub include_bids: bool,
+
+    /// Subset of `AUCTION_DEBUG_METADATA_ALLOWLIST` to surface in `Redacted`
+    /// mode. Keys outside the fixed allowlist are always dropped, regardless
+    /// of what is listed here — this is a subset selector, not a new
+    /// allowlist. Ignored entirely when `verbosity = Full`.
+    #[serde(default = "default_auction_debug_metadata_keys")]
+    pub metadata_keys: Vec<String>,
+
+    /// `Redacted` (default): `metadata_keys` subset only, creative preview
+    /// truncated to `MAX_BID_CREATIVE_DUMP_BYTES`.
+    /// `Upstream`: the redacted fields plus provider-controlled diagnostics
+    /// (`errors`, `warnings`, response timings, bid statuses, and bounded
+    /// upstream-message fields); creatives remain truncated and all other
+    /// metadata remains filtered.
+    /// `Full`: raw `response.metadata` verbatim, including the `debug`
+    /// subtree (httpcalls/resolvedrequest — device IP, geo, eids, TC consent
+    /// string — when `integrations.prebid.debug` is also on), and no
+    /// creative truncation. The 256KB total dump cap and comment-terminator
+    /// neutralization still apply.
+    ///
+    /// NEVER enable `Upstream` or `Full` in production: provider-controlled
+    /// text or identity-bearing request/response data becomes visible to any
+    /// visitor via view-source.
+    #[serde(default)]
+    pub verbosity: AuctionDebugCommentVerbosity,
+}
+
+impl Default for AuctionDebugCommentOptions {
+    fn default() -> Self {
+        Self {
+            include_provider_responses: true,
+            include_mediator_response: true,
+            include_bids: true,
+            metadata_keys: default_auction_debug_metadata_keys(),
+            verbosity: AuctionDebugCommentVerbosity::Redacted,
+        }
+    }
+}
+
+impl AuctionDebugCommentOptions {
+    fn normalize(&mut self) {
+        self.metadata_keys = self
+            .metadata_keys
+            .drain(..)
+            .map(|key| key.trim().to_string())
+            .filter(|key| !key.is_empty())
+            .collect();
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuctionDebugCommentVerbosity {
+    #[default]
+    Redacted,
+    Upstream,
+    Full,
+}
+```
+
+`DebugConfig` derives `#[derive(Default, ...)]`
+([settings.rs:1895](../../../crates/trusted-server-core/src/settings.rs#L1895)),
+which requires every field's type to implement `Default`. The hand-written
+`impl Default for AuctionDebugCommentOptions` above is required for this to
+compile — a naive `#[derive(Default)]` would produce
+`include_provider_responses: false` etc., contradicting the serde field
+defaults (`true`/`true`/`true`/full-allowlist/`Redacted`). Both `Default` and
+serde's per-field `#[serde(default = "...")]` must agree.
+
+`AUCTION_DEBUG_METADATA_ALLOWLIST` moves from `publisher.rs` into `settings.rs`
+as the single canonical superset (publisher.rs imports it; it's the same list
+used both as `default_auction_debug_metadata_keys()`'s return value and as the
+fail-closed intersection filter — see Security Invariants). The safe list
+drops the old allowlist's `"status"` key (verified: no production code path
+writes `response.metadata["status"]` — only an unrelated `telemetry.rs` test
+does — so this is an intentional cleanup of a key nothing ever populates, not
+an accidental narrowing). Provider-controlled upstream text is deliberately
+excluded and handled by the verbosity branch instead:
+
+```rust
+const AUCTION_DEBUG_METADATA_ALLOWLIST: &[&str] = &[
+    "error_type",
+    "http_status",
+    "message",
+];
+```
+
+The allowlist controls selectable field names, but name matching alone is not
+the security boundary. Rendering validates and normalizes each selected value:
+
+- `error_type` is copied only when it is one of the server's known static
+  classifications (`parse_response`, `launch_failed`, `transport`, `timeout`,
+  or `http_status`). Unknown strings and non-string values are dropped.
+- `http_status` is copied only when it is an integer in `100..=599`.
+- `message` is never copied from `response.metadata`. When selected, it is
+  generated by the renderer from the validated classification and optional
+  validated HTTP status using fixed server-owned wording:
+  `parse_response` → `Provider response could not be parsed`, `launch_failed`
+  → `Provider launch failed`, `transport` → `Provider request failed`,
+  `timeout` → `Provider request timed out`, and `http_status` →
+  `Provider returned HTTP {status}` (or `Provider returned an HTTP error` when
+  a valid status is absent). Unknown or invalid classifications produce no
+  message.
+
+This makes `redacted` fail closed at the rendering boundary even if a future
+provider writes an unexpected value beneath a familiar metadata key.
+
+`Settings::finalize_deserialized`
+([settings.rs:2038-2059](../../../crates/trusted-server-core/src/settings.rs#L2038-L2059))
+— the associated fn that already calls `settings.integrations.normalize();
+settings.proxy.normalize(); settings.image_optimizer.normalize();` on a
+locally-owned `settings: Self` — gains
+`settings.debug.auction_html_comment_options.normalize();` alongside those.
+(Not `Settings::normalize()`: no such method touches `DebugConfig` today, and
+the lines this draft originally cited — settings.rs:1388-1406 — are
+`ProxyAssetRoute::normalize()`, an unrelated per-route proxy struct with no
+`debug` field.) `DebugConfig` is not touched by any normalize/prepare_runtime
+pipeline today; this is the first field on it that needs one.
+
+## Rendering / Data Flow
+
+`prepend_auction_debug_comment` gains an `options: &AuctionDebugCommentOptions`
+parameter:
+
+```rust
+let mut dump = serde_json::Map::new();
+if options.include_provider_responses {
+    dump.insert(
+        "provider_responses".to_string(),
+        Value::Array(
+            result.provider_responses.iter()
+                .map(|r| redact_response_for_dump(r, options))
+                .collect(),
+        ),
+    );
+}
+if options.include_mediator_response
+    && let Some(mediator_response) = &result.mediator_response
+{
+    dump.insert("mediator_response".to_string(), redact_response_for_dump(mediator_response, options));
+}
+```
+
+`redact_response_for_dump(response, options)`:
+
+- `Redacted`: `metadata` = the validated and normalized safe fields selected by
+  `options.metadata_keys ∩ AUCTION_DEBUG_METADATA_ALLOWLIST`. Both the
+  name intersection and the per-field schema checks are computed here, at the
+  render call — this is the actual security boundary, not the config struct.
+- `Upstream`: the same validated metadata as `Redacted`, plus `errors`,
+  `warnings`, `responsetimemillis`, `bidstatus`, `upstream_message`, and
+  `upstream_message_truncated` when present. These keys are selected by the
+  enum branch, never by `metadata_keys`, so configuration cannot widen the
+  boundary accidentally. This mode is explicitly sensitive because PBS
+  supplies these untyped values and its diagnostics may echo request data.
+- `Full`: `metadata` = `response.metadata.clone()`, unfiltered.
+- `bids` = `[]` when `!options.include_bids`; otherwise each bid goes through
+  `redact_bid_for_dump(bid, options)`.
+
+The implementation keeps the six provider-controlled diagnostic keys in a
+separate hardcoded const,
+`AUCTION_DEBUG_UPSTREAM_METADATA_KEYS`. It first builds the safe configured
+intersection, then adds those keys only for `Upstream`; `Full` remains a direct
+copy of all metadata. Pattern-based text redaction is deliberately avoided:
+arbitrary identifiers and consent values cannot be recognized exhaustively,
+so presenting such filtering as safe would weaken the fail-closed contract.
+
+`redact_bid_for_dump(bid, options)`:
+
+- `Redacted` and `Upstream`: retain at most
+  `MAX_BID_CREATIVE_DUMP_BYTES` (512) bytes of the creative, as today. The
+  appended truncation marker is outside that retained-prefix limit, so the
+  rendered field may be slightly larger than 512 bytes.
+- `Full`: `creative` passed through untruncated.
+
+Unconditional regardless of `options` (safety nets, not redaction controls):
+
+- comment-terminator neutralization (`-->` → `-- >`, `--!>` → `-- !>`)
+- `MAX_AUCTION_DEBUG_DUMP_BYTES` (256KB) final cap on the serialized dump
+
+**Wiring** — production call site
+[publisher.rs:1394](../../../crates/trusted-server-core/src/publisher.rs#L1394)
+(the two existing test call sites for `prepend_auction_debug_comment`, around
+publisher.rs:2638 and 2699, also need the new parameter — same signature
+change ripples to both):
+
+```rust
+if settings.debug.auction_html_comment {
+    prepend_auction_debug_comment(
+        "stream",
+        &result,
+        ad_bids_state,
+        &settings.debug.auction_html_comment_options,
+    );
+}
+```
+
+## Security Invariants
+
+1. **`metadata_keys` is a subset selector, never a new allowlist.** The
+   `AUCTION_DEBUG_METADATA_ALLOWLIST` superset is a hardcoded Rust const, not
+   config-driven. An operator listing `"debug"` (or any other key outside the
+   superset) in `metadata_keys` has zero effect in `Redacted` mode — the
+   intersection silently drops it. This must hold even when the operator's
+   intent is clearly to widen access; fail-closed means the config cannot
+   widen the boundary, only narrow what's already inside it. A matching key is
+   still dropped unless its value passes that field's strict schema; `message`
+   is generated from validated fields rather than copied.
+2. **Provider-controlled text requires an explicit sensitivity mode.**
+   `errors`, `warnings`, `responsetimemillis`, `bidstatus`,
+   `upstream_message`, and `upstream_message_truncated` are never in the
+   redacted allowlist. They appear only when verbosity is `upstream` or `full`;
+   the upstream-message fields additionally require
+   `integrations.prebid.debug = true` to capture them. Operators must treat
+   `upstream` as potentially sensitive because untyped provider values can
+   contain or echo identifiers and request data.
+3. **The complete PBS debug subtree requires `Full`.** The PBS
+   `debug.httpcalls` and `resolvedrequest` subtrees remain excluded in
+   `upstream` mode and require `verbosity = "full"` plus
+   `integrations.prebid.debug = true`. This does not make `Upstream`
+   identity-safe: its six untyped diagnostic values may themselves contain
+   nested identity or request data, as stated above.
+4. **Comment-terminator neutralization and the total byte cap are
+   unconditional** — they are HTML-injection and page-bloat safety nets, not
+   privacy controls, and must never be gated behind `verbosity` or any other
+   option.
+5. **Bad `verbosity` values fail config load**, not silently fall back to
+   `Redacted`. An unrecognized string is a serde deserialize error at startup
+   — loud failure over silent (mis)interpretation.
+6. **The redacted guarantee is limited to response-level metadata.** Existing
+   bid-level metadata, `nurl`/`burl`, and the retained creative prefix are not
+   covered by this change; issue #925 tracks tightening those fields. The mode
+   must be documented as safer response metadata, not as a fully anonymized
+   auction dump.
+
+## Edge Cases and Behavior Changes
+
+- **`metadata_keys = []`**: valid; yields no configured safe metadata in
+  `Redacted`. In `Upstream`, provider-controlled diagnostic fields may still
+  be added by that explicit sensitivity mode. `Full` ignores the selector and
+  copies all metadata. An operator can therefore request zero metadata only
+  while remaining in `Redacted`.
+- **`verbosity=Upstream` is intentionally narrower than `Full`**: it adds only
+  the provider-controlled errors, warnings, response timings, bid statuses,
+  and bounded upstream-message fields. It does not expose other arbitrary
+  metadata, raw PBS requests/responses, or untruncated creatives.
+- **`verbosity=Full` value is provider-dependent**: only `prebid.rs` populates
+  `metadata["debug"]` today. For `aps` and other direct integrations, `Full`
+  only removes creative truncation and the metadata filter — there's no
+  `debug` subtree to reveal because none is captured. See Non-goals.
+- **Truncation lands mid-structure more often under `Full`**: the final-string
+  truncation in `render_dump` is byte-boundary-safe (UTF-8) but not
+  JSON-structure-aware — pre-existing behavior, unchanged. `Full` mode's raw
+  httpcalls payloads are much larger than redacted previews, so hitting the
+  256KB cap (and getting a truncated, non-parseable tail) becomes routine
+  rather than exceptional. No new per-provider cap is being added (see
+  Non-goals) — this is a known, accepted tradeoff.
+- **Default output changes for existing operators**: anyone already running
+  `auction_html_comment = true` gets validated `error_type`, `http_status`, and
+  a renderer-generated `message` in the default dump with zero config changes.
+  The old untyped `errors`, `warnings`, `responsetimemillis`, and `bidstatus`
+  fields move behind explicit `upstream` or `full` mode; the unused `status`
+  key is removed.
+
+## Testing Strategy
+
+All in the existing `publisher.rs` test module (plain `#[test]` fns,
+Arrange-Act-Assert, matching existing `auction_debug_comment_*` tests — no
+`rstest` in this file today):
+
+- `default_options_apply_safe_response_metadata_schema` — regression: default
+  struct keeps today's sections and creative preview while exposing only
+  validated `error_type`, `http_status`, and renderer-generated `message`.
+  The fixture must also contain the newly excluded legacy keys so the assertion
+  proves they do not remain in the default output.
+- `configured_metadata_subset_only_includes_selected_safe_keys`
+- `redacted_mode_never_surfaces_provider_controlled_diagnostic_text` — put
+  identity-shaped markers in every upstream diagnostic key to prove the
+  response-metadata boundary.
+- `redacted_mode_rejects_wrong_types_and_unknown_error_classifications` — put
+  strings and nested identity-shaped JSON under every safe key; assert only
+  valid values survive and `message` is regenerated rather than copied.
+- `upstream_mode_includes_provider_diagnostics_but_not_debug_subtree`
+- `verbosity_upstream_still_truncates_creative`
+- `metadata_keys_empty_yields_empty_safe_metadata_in_redacted`
+- `metadata_keys_attack_vector_debug_key_never_surfaces_in_redacted_mode` —
+  configuring `metadata_keys = ["debug"]` under `Redacted` still produces no
+  `debug` key. This is the load-bearing security test for this whole design.
+- `verbosity_full_includes_raw_debug_subtree_when_present`
+- `verbosity_full_skips_creative_truncation`
+- `verbosity_full_still_hits_overall_byte_cap`
+- `verbosity_full_still_neutralises_comment_terminators` — extends the
+  existing `auction_debug_comment_neutralises_every_comment_terminator_vector`
+  test to run under `Full` too, proving neutralization isn't bypassable via
+  verbosity.
+- `include_provider_responses_false_omits_section_entirely`
+- `include_mediator_response_false_omits_even_when_mediator_ran`
+- `include_bids_false_yields_empty_bids_array_not_omitted_response`
+- `normalize_trims_and_drops_empty_metadata_keys`
+- `bad_verbosity_string_fails_config_load`
+
+## Example TOML
+
+```toml
+[debug]
+# NEVER enable in production. Injects an auction dump before </body>.
+# "redacted" validates response metadata but still includes existing bid-level
+# fields and creative previews; it is not a fully anonymized dump.
+# See [debug.auction_html_comment_options] for content control.
+auction_html_comment = false
+
+[debug.auction_html_comment_options]
+include_provider_responses = true
+include_mediator_response = true
+include_bids = true
+metadata_keys = [
+    "error_type", "http_status", "message",
+]
+# "redacted" (default), "upstream", or "full".
+# "upstream" exposes provider-controlled error text, which may echo request
+# data. "full" additionally exposes raw metadata and untruncated creatives.
+# Never use either sensitive mode in production.
+verbosity = "redacted"
+```
+
+## Follow-up / Out of Scope
+
+- File a separate issue: add no-bid/failure reason capture to `aps.rs` and
+  audit other direct-integration providers (kargo, ttd, etc.) for the same
+  gap. Until that lands, `verbosity=full` cannot explain a no-bid from those
+  providers — there is nothing more recorded server-side to show.
diff --git a/docs/superpowers/specs/2026-08-18-ssat-debug-comment-format-design.md b/docs/superpowers/specs/2026-08-18-ssat-debug-comment-format-design.md
new file mode 100644
index 000000000..0cb6f5ec0
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-18-ssat-debug-comment-format-design.md
@@ -0,0 +1,143 @@
+# SSAT Debug Comment Output Format Design
+
+**Date:** 2026-08-18
+
+**Status:** Approved for implementation planning
+
+**Related PR:** [IABTechLab/trusted-server#943](https://github.com/IABTechLab/trusted-server/pull/943)
+
+## Summary
+
+The configurable SSAT `ts-debug` comment currently serializes its auction dump
+as compact JSON. Full-verbosity dumps can contain bids, creatives, provider
+metadata, and PBS HTTP-call diagnostics, making the single-line payload hard to
+navigate in page source.
+
+Add a `format` option to `[debug.auction_html_comment_options]` with two values:
+
+- `compact` (default): preserve the existing one-line JSON representation.
+- `pretty`: serialize the outer auction dump as indented JSON.
+
+Pretty formatting does not parse or transform JSON-looking strings such as PBS
+`requestbody` and `responsebody`. Those values remain byte-for-byte equivalent
+JSON string values so the comment continues to represent what the provider
+integration captured rather than a guessed interpretation of it.
+
+## Goals
+
+1. Make the outer provider, bid, metadata, and HTTP-call hierarchy easier to
+   navigate in HTML source during local debugging.
+2. Preserve today's compact output unless an operator explicitly opts in.
+3. Preserve the existing dump schema and the exact contents of nested strings.
+4. Keep the existing security and size protections independent of formatting.
+
+## Non-goals
+
+- Recursively parsing or formatting `requestbody`, `responsebody`, creative
+  markup, or any other string that happens to contain JSON.
+- Adding a browser UI, CLI viewer, downloadable artifact, or syntax highlighting.
+- Changing verbosity, redaction, section toggles, metadata selection, creative
+  truncation, or provider response capture.
+- Making the 256 KiB total dump cap configurable.
+
+## Configuration
+
+Extend `AuctionDebugCommentOptions` with an enum-backed field:
+
+```rust
+#[serde(default)]
+pub format: AuctionDebugCommentFormat,
+
+#[derive(Debug, Clone, Copy, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuctionDebugCommentFormat {
+    #[default]
+    Compact,
+    Pretty,
+}
+```
+
+The hand-written `Default` implementation for `AuctionDebugCommentOptions`
+sets `format` to `Compact`, matching serde's default. Unknown strings fail
+configuration loading because serde rejects enum variants other than `compact`
+and `pretty`; the enum deliberately has no catch-all variant.
+
+Example:
+
+```toml
+[debug.auction_html_comment_options]
+include_provider_responses = true
+include_mediator_response = false
+include_bids = false
+metadata_keys = ["error_type", "http_status", "message"]
+verbosity = "full"
+format = "pretty"
+```
+
+`trusted-server.example.toml` documents both accepted values and keeps
+`format = "compact"` in the example to make the default visible.
+
+## Rendering and Data Flow
+
+`prepend_auction_debug_comment` continues building the same
+`serde_json::Value::Object`. Only the serialization selection changes:
+
+- `Compact` uses `serde_json::to_string`.
+- `Pretty` uses `serde_json::to_string_pretty`.
+
+The serialized string then passes through the existing processing in the same
+order:
+
+1. Neutralize HTML comment terminators (`-->` and `--!>`).
+2. Apply the unconditional 256 KiB total serialized dump cap.
+3. Place the result after `dump=` in the `ts-debug` HTML comment.
+
+Pretty mode intentionally introduces line breaks after `dump=`. The comment's
+summary line remains unchanged, and both modes remain valid JSON whenever the
+total cap is not reached.
+
+Pretty printing increases serialized size, so it may reach the existing cap
+sooner than compact output. If capped, the dump may end mid-JSON exactly as it
+can today; the existing `…(truncated N bytes)` marker continues to make that
+condition explicit.
+
+## Compatibility and Safety
+
+- Existing configurations that omit `format` produce byte-for-byte-equivalent
+  compact JSON output.
+- Formatting does not change which fields are included or expose data hidden by
+  `redacted` or `upstream` verbosity.
+- Nested request and response bodies remain strings. Pretty mode adds whitespace
+  only to the outer serialized representation; deserializing an uncapped dump
+  produces the same JSON value as compact mode.
+- Comment-terminator neutralization and the total cap apply in both modes.
+- The existing warning remains: `upstream` and `full` output can expose identity
+  and request data and must not be enabled in production.
+
+## Testing
+
+Follow test-driven development with focused tests before production changes:
+
+1. Settings deserialization accepts `format = "pretty"` and defaults to
+   `Compact` when omitted.
+2. An invalid format string fails deserialization.
+3. Compact rendering retains the existing one-line `dump={...}` representation.
+4. Pretty rendering contains indented outer JSON and deserializes to the same
+   value as compact rendering for the same auction result.
+5. A nested JSON `requestbody` remains a JSON string rather than becoming an
+   object in pretty mode.
+6. Pretty rendering still neutralizes every tested HTML-comment terminator.
+7. Pretty rendering still respects the 256 KiB total dump cap and emits the
+   existing truncation marker.
+
+After focused tests pass, run the repository-required Fastly/core test suite,
+format check, and target-matched clippy checks relevant to the changed Rust
+core code.
+
+## Future Direction
+
+If operators need decoded navigation of nested provider bodies, add a separate
+local inspection tool that extracts the comment and conditionally parses known
+JSON body fields for display. Keeping that transformation outside the emitted
+comment preserves raw capture fidelity and avoids increasing every debug page's
+payload.
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index cb10906b0..df3d7696f 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -175,14 +175,27 @@ example_segments = "segments"
 [debug]
 ja4_endpoint_enabled = false
 
-# Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping a
-# redacted per-provider auction result: pipeline stats plus every provider
-# response, with each bid's creative previewed (not the full markup) and
-# provider metadata filtered to a fail-closed allowlist.
-# Visible in page source and injects (bounded) raw HTML from SSPs. NEVER enable
-# in production.
+# NEVER enable in production. Injects an auction dump before `</body>`.
+# "redacted" validates response metadata but still includes bid-level fields
+# and creative previews; it is not a fully anonymized dump.
 auction_html_comment = false
 
+[debug.auction_html_comment_options]
+include_provider_responses = true
+include_mediator_response = true
+include_bids = true
+# Subset of the fixed validated metadata keys shown in "redacted" (and, for
+# these three keys, "upstream") mode. Any other key fails config load.
+metadata_keys = ["error_type", "http_status", "message"]
+# "redacted" (default), "upstream", or "full".
+# "upstream" exposes six untyped provider diagnostic values that may contain
+# request or identity data. "full" additionally exposes all response metadata
+# and untruncated creatives. Never use either sensitive mode in production.
+verbosity = "redacted"
+# "compact" (default) or "pretty". Pretty formats only the outer dump;
+# JSON request/response bodies remain strings exactly as captured.
+format = "compact"
+
 [creative_opportunities]
 gam_network_id = "123456789"
 # FCP is not affected by this value — body content above </body> has already