[ChristianPavilonis]

Scope

Addresses #854 in this existing draft PR: publisher-owned slot registration, dependency-safe JS deferral, explicit responsive slot reservation, and repeatable browser measurements.

• Keep synchronous core APIs, GPT interception and creative rendering in an early compiled entry; defer the remaining GPT runtime for supported profiles.
• Preserve synchronous delivery for enforced response CSP, active diagnostics and order-sensitive or unknown JS integrations. Keep the existing raw GPT bootstrap and takeover exactly once.
• Add explicit per-slot wrapper/min-height/breakpoint reservation. CSS follows request paths and does not depend on consent or auction results. No-fill retains space.
• Merge main 21f43aa0138498023455789f152f5a864bbefe24, preserving its APS failure relay, iframe/timeout ownership, asynchronous HTML EOF and origin-header rewriting. Thread actual path/CSP through the new EOF driver.
• Fix the registration launcher to read its checkout's Viceroy pin rather than require a stale literal.

Controlled measurements

Fresh Rust HTML, exact production JS, Chromium 145, five alternating samples per group and a controlled 750 ms runtime hold. Baseline is the unchanged c36c82df archive. Current output includes newer main, Node/Rust and build dependencies, so this is not an isolated PR-effect estimate or field-CWV claim.

Viewport	Baseline → combined FCP/LCP median	Baseline → combined CLS
Mobile 390×844	792 → 36 ms	0.207065 → 0
Desktop 1280×1000	792 → 44 ms	0.111133 → 0

No production ad-startup improvement is inferred from local request/visibility timings. Transfer cost increases: estimated HTML+runtime gzip is 42,104 → 50,583 bytes, +8,479. The existing 56,429-byte raw bootstrap remains, and the compiled early entry adds 56,602 bytes. This is not a size-reduction result.

Local verification

Code merge: 7b83a8ce87e773e2234a6dde7380a123f36e7d1f. Final fixture/evidence commit: 6a5cfd54d.

• Node 24.20.0, Rust 1.98.1, Viceroy 0.21.0.
• Full JS: 1,519 tests across 52 files, lint/format passed; focused GPT/APS: 671 tests.
• Native core: 3,197 tests plus 20 native integrations passed using the ordinary Cargo command.
• Fresh actual Rust/Next.js: 40 cases passed, inline and shared-template, with a new Node-labelled image.
• Lab 61, offline registration 109, initial-render overlap 10, fixture/CWV/initial-page units 31, real-PUC APS six: passed.
• The first hosted run flagged four fixture HTML-regex operations. The follow-up parses actual script elements and splices original source ranges, with source-order, overlap and EOF coverage. No production assets or dependencies changed.
• After that fix: 31 Node units, all 40 actual framework cases and three focused browser regressions passed. Independent review found no remaining issues. An 86-file/430-comparison proof and 13 recorded control hashes establish unchanged measured browser inputs; the existing 61-case timings are reused, not relabeled as a new execution.
• All 27 local backend/Clippy/docs/clock/EOF/URL gates passed after the narrow URL-lint cleanup. Actual Axum and Fastly EOF/auction controls passed.
• Real build.rs generated 14 modules; every complete module string matches the independent distribution and frozen WASM. WASM SHA-256 dad40087f6123d73b8465d774bd3212e7b25b4d6c8ce3051579f263e0d117f23.
• Independent correctness and architecture merge reviews found no remaining defects. Host exceptions are line-scoped references/test assertions, not global allowlist changes.
• Rust formatting, docs lint/format/build, Markdown formatting, Node-pin guard, documentation-proposal tests, launcher ShellCheck and changed-workflow actionlint passed.

Limits and retained failures

Hosted CI is separate from local results. The PR is mergeable and the full workflows now run. On final head 6a5cfd54d, CodeQL and all language analyses passed, including Rust; the four earlier fixture findings are cleared. Remaining test/integration jobs are still running, so full hosted success is not claimed yet. Standalone package-wide TypeScript still fails with existing main/branch diagnostics; there are no new merge signatures or extracted-helper errors. Whole-repository actionlint also reports unchanged upstream workflow issues; the changed integration workflow passes.

Initial Chromium crash/stall attempts, the temporary-file quota failure and original URL-lint failures remain documented separately. Serial browser retries passed unchanged inputs without weaker assertions or browser flags. Browser crash cause remains unproven.

No real GPT/GAM staging, customer-page testing, live customer auctions, deployment, production activation or field-CWV validation has run. Those require separate approval. The fixtures use fictional data and simulated GPT transport.

Records

• Spec
• Implementation and measurement plan
• Validation record, exact commands, hashes and historical evidence