diff --git a/crates/edgecookie/README.md b/crates/edgecookie/README.md
new file mode 100644
index 000000000..f322c431f
--- /dev/null
+++ b/crates/edgecookie/README.md
@@ -0,0 +1,18 @@
+# Edge Cookie modules
+
+Vendor Edge Cookie module crates live here, one per vendor, for example
+`crates/edgecookie/<vendor>`. Each implements the `EdgeCookieModule` trait
+from `trusted-server-core` and is wired in by an adapter.
+
+The built-in HMAC module (HMAC over the client IP) ships in
+`trusted-server-core` (`ec::module`), so no crate is needed for it. There is
+no default module, and a deployment selects one explicitly with
+`[ec] module`.
+
+A module's own settings live in the `[ec.<name>]` table the selector names.
+The name is the module's implementation id, the same string its
+`EdgeCookieModule::id` returns, unless the table names one with
+`implementation = "<id>"`, which lets an operator configure a module under a
+name of their own choosing. A module with no settings needs no table.
+
+This directory is a placeholder until a vendor module is added.
diff --git a/crates/trusted-server-adapter-axum/src/app.rs b/crates/trusted-server-adapter-axum/src/app.rs
index caba714d6..7b50568a0 100644
--- a/crates/trusted-server-adapter-axum/src/app.rs
+++ b/crates/trusted-server-adapter-axum/src/app.rs
@@ -18,6 +18,7 @@ use trusted_server_core::ec::EcContext;
 use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported, deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::module::ensure_module_available;
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -77,8 +78,9 @@ fn build_state() -> Result<Arc<AppState>, Report<TrustedServerError>> {
 ///
 /// # Errors
 ///
-/// Returns an error when the auction orchestrator or the integration
-/// registry fail to initialise.
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 fn build_state_with_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -89,6 +91,26 @@ fn build_state_with_services(
     settings: Settings,
     services: Option<RuntimeServices>,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    // Composition root: reject a module selection this adapter can never
+    // supply, once, before any request is served. A caller supplying its own
+    // `RuntimeServices` may already have resolved a module, so the check is
+    // given whatever those services carry, which is what `EcContext` sees per
+    // request.
+    //
+    // This adapter checks rather than keeps what the check resolved, unlike the
+    // Fastly, Cloudflare and Spin adapters, because it is a long-lived process
+    // whose application state is built once at start-up while theirs is rebuilt
+    // for every request. With no services supplied it threads no module, so
+    // `EcContext` resolves the selection itself on every request, building a
+    // fresh built-in module that reads no request data; this dev server
+    // accepts that per-request construction rather than caching a resolved
+    // module.
+    ensure_module_available(
+        &settings.ec,
+        services
+            .as_ref()
+            .and_then(RuntimeServices::resolved_ec_module),
+    )?;
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Axum)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -179,13 +201,26 @@ where
 /// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
 /// `/_ts/page-bids`, and the publisher fallback).
 ///
-/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
-/// Unknown, which fails the auction consent gate closed even for consented
-/// users. Geo comes from the platform (a no-op on the local Axum dev server, so
-/// jurisdiction stays Unknown there unless the request carries TCF consent). A
-/// malformed consent string is logged and falls back to the default
-/// (fail-closed) context rather than being silently swallowed.
-fn build_ec_context(state: &AppState, services: &RuntimeServices, req: &Request) -> EcContext {
+/// Geo comes from the platform (a no-op on the local Axum dev server, so
+/// jurisdiction stays Unknown there unless the request carries TCF consent), and
+/// a geo lookup failure is logged and treated as no location.
+///
+/// Mirrors the Fastly entry point, which keeps the report and answers with an
+/// error response: when the Edge Cookie context cannot be read the request
+/// fails rather than continuing with `EcContext::default()`, which would serve
+/// every request with no identity. A malformed cookie value, a bad consent
+/// string and a failed geo lookup do not reach this error path at all, so
+/// failing here does not fail requests for ordinary parse problems.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this request, or when the request's `Cookie` header is not valid UTF-8.
+fn build_ec_context(
+    state: &AppState,
+    services: &RuntimeServices,
+    req: &Request,
+) -> Result<EcContext, Report<TrustedServerError>> {
     let geo_info = services
         .geo()
         .lookup(services.client_info().client_ip)
@@ -194,10 +229,6 @@ fn build_ec_context(state: &AppState, services: &RuntimeServices, req: &Request)
             None
         });
     EcContext::read_from_request_with_geo(&state.settings, req, services, geo_info.as_ref())
-        .unwrap_or_else(|e| {
-            log::warn!("EC context read failed: {e:?}");
-            EcContext::default()
-        })
 }
 
 // ---------------------------------------------------------------------------
@@ -244,7 +275,7 @@ async fn dispatch_fallback(
 
     // Run the server-side auction with the configured creative-opportunity
     // slots; `handle_publisher_request` matches them against the request path.
-    let mut ec_context = build_ec_context(state, services, &req);
+    let mut ec_context = build_ec_context(state, services, &req)?;
     let auction = AuctionDispatch {
         orchestrator: &state.orchestrator,
         slots: state.settings.creative_opportunity_slots(),
@@ -505,7 +536,7 @@ fn named_route_handler(
                         // Build the geo-aware EC context so the auction consent
                         // gate sees the caller's jurisdiction — `EcContext::default()`
                         // fails it closed for consented users.
-                        let mut ec_context = build_ec_context(&state, &services, &req);
+                        let mut ec_context = build_ec_context(&state, &services, &req)?;
                         handle_auction(
                             &state.settings,
                             &state.orchestrator,
@@ -524,7 +555,7 @@ fn named_route_handler(
                         if req.method() == Method::OPTIONS {
                             Ok(page_bids_preflight_denied())
                         } else {
-                            let mut ec_context = build_ec_context(&state, &services, &req);
+                            let mut ec_context = build_ec_context(&state, &services, &req)?;
                             let auction = AuctionDispatch {
                                 orchestrator: &state.orchestrator,
                                 slots: state.settings.creative_opportunity_slots(),
@@ -715,3 +746,81 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
     router.build()
 }
+
+#[cfg(test)]
+mod tests {
+    use edgezero_core::http::request_builder;
+    use edgezero_core::params::PathParams;
+
+    use super::*;
+
+    /// Settings selecting a vendor Edge Cookie module this adapter does not
+    /// inject, with the `[ec.acme]` block that module's settings live in.
+    /// `acme` is a fictional vendor key.
+    const UNINJECTED_MODULE_TOML: &str = r#"
+        [[handlers]]
+        path = "^/_ts/admin"
+        username = "admin"
+        password = "admin-pass"
+
+        [publisher]
+        domain = "test-publisher.example.com"
+        cookie_domain = ".test-publisher.example.com"
+        origin_url = "https://origin.test-publisher.example.com"
+        proxy_secret = "unit-test-proxy-secret"
+
+        [ec]
+        module = "acme"
+
+        [ec.acme]
+        endpoint = "https://ec.acme.example.com"
+    "#;
+
+    /// Builds application state directly, bypassing the composition root's
+    /// startup check, so the per-request behavior can be exercised with a
+    /// selection the adapter cannot supply.
+    fn state_with_uninjected_module() -> AppState {
+        let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+            .expect("should parse settings selecting an uninjected module");
+        let plan = Arc::new(compile_auction_plan(&settings).expect("should compile auction plan"));
+        let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)
+            .expect("should build orchestrator");
+        let registry =
+            IntegrationRegistry::with_plan(&settings, plan).expect("should build registry");
+        AppState {
+            settings: Arc::new(settings),
+            orchestrator: Arc::new(orchestrator),
+            registry: Arc::new(registry),
+            // This test drives the per-request path, which builds its services
+            // from the request context.
+            services: None,
+        }
+    }
+
+    /// The per-request Edge Cookie read must return its error rather than a
+    /// default context.
+    ///
+    /// Continuing with `EcContext::default()` would serve every request with
+    /// no identity when the selected module cannot be built. The call sites
+    /// propagate the error to `http_error`, matching the Fastly adapter.
+    #[test]
+    fn build_ec_context_fails_when_the_selected_module_is_unavailable() {
+        let state = state_with_uninjected_module();
+        let req = request_builder()
+            .method("POST")
+            .uri("https://test-publisher.example.com/auction")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build test request");
+        let ctx = RequestContext::new(req, PathParams::default());
+        let services = build_runtime_services(&ctx);
+        let req = ctx.into_request();
+
+        let error = build_ec_context(&state, &services, &req)
+            .expect_err("an unavailable Edge Cookie module must fail the request");
+
+        assert!(
+            error.to_string().contains("acme"),
+            "the error should name the selected module, got: {error}"
+        );
+    }
+}
diff --git a/crates/trusted-server-adapter-axum/src/middleware.rs b/crates/trusted-server-adapter-axum/src/middleware.rs
index fd11d7728..ec6e19cd1 100644
--- a/crates/trusted-server-adapter-axum/src/middleware.rs
+++ b/crates/trusted-server-adapter-axum/src/middleware.rs
@@ -193,6 +193,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-axum/tests/routes.rs b/crates/trusted-server-adapter-axum/tests/routes.rs
index 7126b2a71..1f6700fa7 100644
--- a/crates/trusted-server-adapter-axum/tests/routes.rs
+++ b/crates/trusted-server-adapter-axum/tests/routes.rs
@@ -33,6 +33,9 @@ fn test_settings() -> trusted_server_core::settings::Settings {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -868,6 +871,57 @@ async fn first_party_proxy_rebuild_is_routed() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// Edge Cookie module availability
+// ---------------------------------------------------------------------------
+
+/// Test settings selecting a vendor Edge Cookie module this adapter does not
+/// inject, with the `[ec.acme]` block that module's settings live in.
+/// `acme` is a fictional vendor key.
+const UNINJECTED_MODULE_TOML: &str = r#"
+    [[handlers]]
+    path = "^/_ts/admin"
+    username = "admin"
+    password = "admin-pass"
+
+    [publisher]
+    domain = "test-publisher.example.com"
+    cookie_domain = ".test-publisher.example.com"
+    origin_url = "https://origin.test-publisher.example.com"
+    proxy_secret = "integration-test-proxy-secret"
+
+    [ec]
+    module = "acme"
+
+    [ec.acme]
+    endpoint = "https://ec.acme.example.com"
+"#;
+
+/// A module selection this adapter can never supply must fail while the
+/// application state is built, before any request is served.
+///
+/// Configuration validation accepts this selection, because only the adapter
+/// that injects a module knows what that module needs, and the Axum dev
+/// server injects no vendor Edge Cookie module, so only the composition root
+/// can catch it. Without the startup check the deployment would come up and
+/// answer every request.
+#[test]
+fn selecting_a_module_this_adapter_cannot_supply_fails_at_startup() {
+    let settings = trusted_server_core::settings::Settings::from_toml(UNINJECTED_MODULE_TOML)
+        .expect("should parse settings selecting an uninjected module");
+
+    // `RouterService` is not `Debug`, so take the error side directly rather
+    // than through `expect_err`.
+    let error = trusted_server_adapter_axum::app::TrustedServerApp::routes_with_settings(settings)
+        .err()
+        .expect("building state with an uninjected module should fail");
+
+    assert!(
+        error.to_string().contains("acme"),
+        "the startup error should name the selected module, got: {error}"
+    );
+}
+
 /// Regression test: a Next.js navigation with a pending auction must buffer to
 /// the structural body close. The Flight payload carries a literal `</body>`, so
 /// a parser-blind seam would inject bids early and split the RSC data.
diff --git a/crates/trusted-server-adapter-cloudflare/src/app.rs b/crates/trusted-server-adapter-cloudflare/src/app.rs
index 87b9567e7..5c1613597 100644
--- a/crates/trusted-server-adapter-cloudflare/src/app.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/app.rs
@@ -22,6 +22,7 @@ use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported as core_admin_ec_lookup_not_supported,
     deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::module::{EdgeCookieModule, build_shared_module};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -74,6 +75,17 @@ pub struct AppState {
     settings: Arc<Settings>,
     orchestrator: Arc<AuctionOrchestrator>,
     registry: Arc<IntegrationRegistry>,
+    /// The Edge Cookie module `[ec] module` selects, resolved once here.
+    ///
+    /// This adapter runs a fresh instance per request and resolving reads no
+    /// request data, so the selection is resolved when the state is built
+    /// and handed to every request through
+    /// [`RuntimeServices::resolved_ec_module`](trusted_server_core::platform::RuntimeServices::resolved_ec_module),
+    /// rather than resolved again on the request path.
+    /// `None` for a deployment that selects no module.
+    ec_module: Option<Arc<dyn EdgeCookieModule>>,
+    /// Services a caller supplied for every request, rather than services built
+    /// from the request context. `None` in a deployment.
     services: Option<RuntimeServices>,
 }
 
@@ -191,8 +203,9 @@ fn cloudflare_config_envelope(
 ///
 /// # Errors
 ///
-/// Returns an error when the auction orchestrator or the integration
-/// registry fail to initialise.
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 fn build_state_with_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -203,6 +216,18 @@ fn build_state_with_services(
     settings: Settings,
     services: Option<RuntimeServices>,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    // Composition root: resolve the module selection once, before any request
+    // is served, so a selection this adapter can never supply fails here rather
+    // than on the first request. Keeping what the resolution produced is what
+    // stops the request path resolving the same settings again. This adapter
+    // injects no vendor Edge Cookie module of its own, so the only injected
+    // module is one a caller put into the services it supplied.
+    let ec_module = build_shared_module(
+        &settings.ec,
+        services
+            .as_ref()
+            .and_then(RuntimeServices::resolved_ec_module),
+    )?;
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Cloudflare)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -212,15 +237,20 @@ fn build_state_with_services(
         settings: Arc::new(settings),
         orchestrator: Arc::new(orchestrator),
         registry: Arc::new(registry),
+        ec_module,
         services,
     }))
 }
 
 impl AppState {
+    /// Builds the per-request services, carrying the Edge Cookie module the
+    /// composition root already resolved so the request path does not resolve
+    /// `[ec] module` a second time.
     fn services_for_request(&self, ctx: &RequestContext) -> RuntimeServices {
         self.services
             .clone()
             .unwrap_or_else(|| build_runtime_services(ctx))
+            .with_resolved_ec_module(self.ec_module.clone())
     }
 }
 
@@ -231,12 +261,25 @@ impl AppState {
 /// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
 /// `/_ts/page-bids`, and the publisher fallback).
 ///
-/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
-/// Unknown, which fails the auction consent gate closed even for consented
-/// users. Geo comes from the Workers `cf` object when deployed. A malformed
-/// consent string is logged and falls back to the default (fail-closed) context
-/// rather than being silently swallowed.
-fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Request) -> EcContext {
+/// Geo comes from the Workers `cf` object when deployed, and a geo lookup
+/// failure is logged and treated as no location.
+///
+/// Mirrors the Fastly entry point, which keeps the report and answers with an
+/// error response: when the Edge Cookie context cannot be read the request
+/// fails rather than continuing with `EcContext::default()`, which would serve
+/// every request with no identity. A malformed cookie value, a bad consent
+/// string and a failed geo lookup do not reach this error path at all, so
+/// failing here does not fail requests for ordinary parse problems.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this request, or when the request's `Cookie` header is not valid UTF-8.
+fn build_ec_context(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request,
+) -> Result<EcContext, Report<TrustedServerError>> {
     let geo_info = services
         .geo()
         .lookup(services.client_info().client_ip)
@@ -245,10 +288,6 @@ fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Reque
             None
         });
     EcContext::read_from_request_with_geo(settings, req, services, geo_info.as_ref())
-        .unwrap_or_else(|e| {
-            log::warn!("EC context read failed: {e:?}");
-            EcContext::default()
-        })
 }
 
 // ---------------------------------------------------------------------------
@@ -553,7 +592,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         }))
                     })
             } else {
-                let mut ec_context = build_ec_context(&state.settings, &services, &req);
+                // Identity could not be established (for example the selected
+                // Edge Cookie module is unavailable). Answer with an error
+                // rather than serving the page with no identity.
+                let mut ec_context = match build_ec_context(&state.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 let auction = AuctionDispatch {
                     orchestrator: &state.orchestrator,
                     slots: state.settings.creative_opportunity_slots(),
@@ -658,7 +703,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                     // Build the geo-aware EC context so the auction consent gate
                     // sees the caller's jurisdiction — `EcContext::default()`
                     // fails it closed for consented users.
-                    let mut ec_context = build_ec_context(&s.settings, &services, &req);
+                    let mut ec_context = build_ec_context(&s.settings, &services, &req)?;
                     handle_auction(
                         &s.settings,
                         &s.orchestrator,
@@ -722,7 +767,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
         // preflight fall through to a permissive origin would reopen exactly
         // the cross-site hole the canonical path closes.
         let page_bids = make_handler(Arc::clone(&state), |s, services, req| async move {
-            let mut ec_context = build_ec_context(&s.settings, &services, &req);
+            let mut ec_context = build_ec_context(&s.settings, &services, &req)?;
             let auction = AuctionDispatch {
                 orchestrator: &s.orchestrator,
                 slots: s.settings.creative_opportunity_slots(),
@@ -775,8 +820,67 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
 #[cfg(test)]
 mod tests {
+    use edgezero_core::http::request_builder;
+    use edgezero_core::params::PathParams;
+
     use super::*;
 
+    /// Settings selecting a vendor Edge Cookie module this adapter does not
+    /// inject, with the `[ec.acme]` block that module's settings live in.
+    /// `acme` is a fictional vendor key.
+    const UNINJECTED_MODULE_TOML: &str = r#"
+        [[handlers]]
+        path = "^/_ts/admin"
+        username = "admin"
+        password = "admin-pass"
+
+        [publisher]
+        domain = "test-publisher.example.com"
+        cookie_domain = ".test-publisher.example.com"
+        origin_url = "https://origin.test-publisher.example.com"
+        proxy_secret = "unit-test-proxy-secret"
+
+        [ec]
+        module = "acme"
+
+        [ec.acme]
+        endpoint = "https://ec.acme.example.com"
+    "#;
+
+    /// The per-request Edge Cookie read must return its error rather than a
+    /// default context.
+    ///
+    /// Continuing with `EcContext::default()` would serve every request with
+    /// no identity when the selected module cannot be built. The call sites
+    /// propagate the error to `http_error`, matching the Fastly adapter. The
+    /// settings are parsed directly, bypassing the composition root's startup
+    /// check, so the per-request behavior can be exercised with a selection
+    /// the adapter cannot supply.
+    #[test]
+    fn build_ec_context_fails_when_the_selected_module_is_unavailable() {
+        let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+            .expect("should parse settings selecting an uninjected module");
+        let req = request_builder()
+            .method("POST")
+            .uri("https://test-publisher.example.com/auction")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build test request");
+        let ctx = RequestContext::new(req, PathParams::default());
+        // No resolved module is threaded here, so the request path resolves
+        // the selection itself, which is what an embedder driving core
+        // directly does and where the loud failure has to stay.
+        let services = build_runtime_services(&ctx);
+        let req = ctx.into_request();
+
+        let error = build_ec_context(&settings, &services, &req)
+            .expect_err("an unavailable Edge Cookie module must fail the request");
+
+        assert!(
+            error.to_string().contains("acme"),
+            "the error should name the selected module, got: {error}"
+        );
+    }
+
     fn aps_profile_settings() -> Settings {
         let mut settings = Settings::from_toml(
             r#"
diff --git a/crates/trusted-server-adapter-cloudflare/src/middleware.rs b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
index 14efed56a..f8c7e2dd0 100644
--- a/crates/trusted-server-adapter-cloudflare/src/middleware.rs
+++ b/crates/trusted-server-adapter-cloudflare/src/middleware.rs
@@ -209,6 +209,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-cloudflare/tests/routes.rs b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
index f385bf529..422ed654e 100644
--- a/crates/trusted-server-adapter-cloudflare/tests/routes.rs
+++ b/crates/trusted-server-adapter-cloudflare/tests/routes.rs
@@ -36,6 +36,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -85,6 +88,9 @@ fn make_router() -> RouterService {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -676,6 +682,57 @@ async fn tsjs_route_prefix_is_handled_not_5xx() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// Edge Cookie module availability
+// ---------------------------------------------------------------------------
+
+/// Test settings selecting a vendor Edge Cookie module this adapter does not
+/// inject, with the `[ec.acme]` block that module's settings live in.
+/// `acme` is a fictional vendor key.
+const UNINJECTED_MODULE_TOML: &str = r#"
+    [[handlers]]
+    path = "^/_ts/admin"
+    username = "admin"
+    password = "admin-pass"
+
+    [publisher]
+    domain = "test-publisher.example.com"
+    cookie_domain = ".test-publisher.example.com"
+    origin_url = "https://origin.test-publisher.example.com"
+    proxy_secret = "route-test-proxy-secret"
+
+    [ec]
+    module = "acme"
+
+    [ec.acme]
+    endpoint = "https://ec.acme.example.com"
+"#;
+
+/// A module selection this adapter can never supply must fail while the
+/// application state is built, before any request is served.
+///
+/// Configuration validation accepts this selection, because only the adapter
+/// that injects a module knows what that module needs, and this adapter
+/// injects no vendor Edge Cookie module, so only the composition root can
+/// catch it. Without the startup check the deployment would come up and answer
+/// every request.
+#[test]
+fn selecting_a_module_this_adapter_cannot_supply_fails_at_startup() {
+    let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+        .expect("should parse settings selecting an uninjected module");
+
+    // `RouterService` is not `Debug`, so take the error side directly rather
+    // than through `expect_err`.
+    let error = TrustedServerApp::routes_with_settings(settings)
+        .err()
+        .expect("building state with an uninjected module should fail");
+
+    assert!(
+        error.to_string().contains("acme"),
+        "the startup error should name the selected module, got: {error}"
+    );
+}
+
 /// Regression test: a Next.js navigation with a pending auction must buffer to
 /// the structural body close. The Flight payload carries a literal `</body>`, so
 /// a parser-blind seam would inject bids early and split the RSC data.
diff --git a/crates/trusted-server-adapter-fastly/src/app.rs b/crates/trusted-server-adapter-fastly/src/app.rs
index fbcd5735d..8562e8277 100644
--- a/crates/trusted-server-adapter-fastly/src/app.rs
+++ b/crates/trusted-server-adapter-fastly/src/app.rs
@@ -116,6 +116,8 @@ use trusted_server_core::ec::consent::ec_consent_withdrawn;
 use trusted_server_core::ec::device::DeviceSignals;
 use trusted_server_core::ec::identify::{cors_preflight_identify, handle_identify};
 use trusted_server_core::ec::kv::KvIdentityGraph;
+use trusted_server_core::ec::module::request_module;
+use trusted_server_core::ec::module::{EdgeCookieModule, build_shared_module};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::ec::{EcContext, EidSyncSource};
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
@@ -183,6 +185,15 @@ pub(crate) struct AppState {
     pub(crate) registry: Arc<IntegrationRegistry>,
     pub(crate) default_kv_store: Arc<dyn PlatformKvStore>,
     pub(crate) auction_telemetry_sink: Arc<dyn AuctionTelemetrySink>,
+    /// The Edge Cookie module `[ec] module` selects, resolved once here.
+    ///
+    /// This adapter runs a fresh instance per request and resolving reads no
+    /// request data, so the selection is resolved when the state is built
+    /// and handed to every request through
+    /// [`RuntimeServices::resolved_ec_module`](trusted_server_core::platform::RuntimeServices::resolved_ec_module),
+    /// rather than resolved again on the request path.
+    /// `None` for a deployment that selects no module.
+    pub(crate) ec_module: Option<Arc<dyn EdgeCookieModule>>,
 }
 
 /// Build the application state, loading settings and constructing all per-application components.
@@ -209,11 +220,26 @@ pub(crate) fn load_settings_from_config_store(
     )
 }
 
+/// Build the application state from explicit settings.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 pub(crate) fn build_state_from_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
     warn_if_certificate_check_disabled(&settings);
 
+    // Composition root: resolve the module selection once, before any request
+    // is served, so a selection this adapter can never supply fails here rather
+    // than on the first request. Keeping what the resolution produced is what
+    // stops the request path resolving the same settings again. This adapter
+    // injects no vendor Edge Cookie module, so `None` is the injected
+    // argument, and one is passed here once this adapter supplies it.
+    let ec_module = build_shared_module(&settings.ec, None)?;
+
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Fastly)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -228,6 +254,7 @@ pub(crate) fn build_state_from_settings(
         registry: Arc::new(registry),
         default_kv_store,
         auction_telemetry_sink,
+        ec_module,
     }))
 }
 
@@ -265,7 +292,7 @@ fn build_per_request_services(state: &AppState, ctx: &RequestContext) -> Runtime
             ..ClientInfo::default()
         });
 
-    RuntimeServices::builder()
+    let builder = RuntimeServices::builder()
         .config_store(Arc::new(FastlyPlatformConfigStore))
         .secret_store(Arc::new(FastlyPlatformSecretStore))
         .kv_store(Arc::clone(&state.default_kv_store))
@@ -278,8 +305,16 @@ fn build_per_request_services(state: &AppState, ctx: &RequestContext) -> Runtime
         .http_client(Arc::new(FastlyPlatformHttpClient))
         .geo(Arc::new(FastlyPlatformGeo))
         .auction_telemetry_sink(Arc::clone(&state.auction_telemetry_sink))
-        .client_info(client_info)
-        .build()
+        .client_info(client_info);
+
+    // Hand every request the module resolved at the composition root, so the
+    // request path reuses that instance instead of resolving `[ec] module`
+    // again. Nothing is set for a deployment that selects no module, which
+    // resolves to nothing either way.
+    match state.ec_module.clone() {
+        Some(module) => builder.resolved_ec_module(module).build(),
+        None => builder.build(),
+    }
 }
 
 fn publisher_fallback_methods() -> [Method; 7] {
@@ -577,7 +612,12 @@ async fn execute_named(
                     // copy is bot-gated, while operators use curl for this
                     // authenticated diagnostic.
                     let kv = crate::maybe_identity_graph(&state.settings);
-                    handle_admin_ec_lookup(kv.as_ref(), &registry, &req)
+                    // The selected module decides which identifiers this
+                    // deployment recognizes, so build it here rather than
+                    // assuming the built-in HMAC shape. The read-only
+                    // diagnostic builds no EC request state to borrow it from.
+                    let module = request_module(&state.settings.ec, &services)?;
+                    handle_admin_ec_lookup(kv.as_ref(), &registry, module.as_deref(), &req)
                 }
                 NamedRouteHandler::AdminEidsLookup => handle_admin_eids_lookup(&registry, &req),
                 _ => unreachable!("admin diagnostics should use early dispatch"),
@@ -737,7 +777,11 @@ fn run_batch_sync(state: &AppState, services: &RuntimeServices, req: Request) ->
     let result = crate::require_identity_graph(&state.settings).and_then(|kv| {
         let partner_registry = PartnerRegistry::from_config(&state.settings.ec.partners)?;
         let limiter = FastlyRateLimiter::new(RATE_COUNTER_NAME);
-        handle_batch_sync(&kv, &partner_registry, &limiter, req)
+        // A partner echoes back an identifier the deployment's own module
+        // created, so validation and KV normalization are dispatched through
+        // that module rather than the built-in HMAC grammar.
+        let module = request_module(&state.settings.ec, services)?;
+        handle_batch_sync(&kv, &partner_registry, &limiter, module.as_deref(), req)
     });
 
     let mut response = result.unwrap_or_else(|e| http_error(&e));
@@ -847,7 +891,7 @@ async fn dispatch_fallback(
                 .ec_context
                 .generate_if_needed(&state.settings, ec.kv_graph.as_ref())
         {
-            log::warn!("EC generation failed for publisher proxy: {err:?}");
+            log::error!("EC generation failed for publisher proxy: {err:?}");
         }
 
         // Run the server-side auction with the configured creative-
@@ -1521,6 +1565,9 @@ mod tests {
             allowed_domains = ["*.example", "*.example.com"]
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -1596,6 +1643,10 @@ mod tests {
         let registry = IntegrationRegistry::from_request_filters(filters);
         let default_kv_store =
             Arc::new(crate::platform::UnavailableKvStore) as Arc<dyn super::PlatformKvStore>;
+        // Resolved the same way the composition root resolves it, so this
+        // router behaves like a served one.
+        let ec_module = trusted_server_core::ec::module::build_shared_module(&settings.ec, None)
+            .expect("should resolve the Edge Cookie module selection");
         let state = Arc::new(super::AppState {
             auction_telemetry_sink: Arc::new(
                 trusted_server_core::auction::NoopAuctionTelemetrySink,
@@ -1604,6 +1655,7 @@ mod tests {
             orchestrator: Arc::new(orchestrator),
             registry: Arc::new(registry),
             default_kv_store,
+            ec_module,
         });
         TrustedServerApp::routes_for_state(&state)
     }
@@ -2022,6 +2074,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -2695,6 +2750,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -3122,6 +3180,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index b9f3b86be..e4b52bb94 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -859,6 +859,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-fastly/src/middleware.rs b/crates/trusted-server-adapter-fastly/src/middleware.rs
index 283f16255..423a411f3 100644
--- a/crates/trusted-server-adapter-fastly/src/middleware.rs
+++ b/crates/trusted-server-adapter-fastly/src/middleware.rs
@@ -320,6 +320,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
diff --git a/crates/trusted-server-adapter-spin/src/app.rs b/crates/trusted-server-adapter-spin/src/app.rs
index b8e8a2492..c60feb060 100644
--- a/crates/trusted-server-adapter-spin/src/app.rs
+++ b/crates/trusted-server-adapter-spin/src/app.rs
@@ -24,6 +24,7 @@ use trusted_server_core::ec::admin::{
     admin_ec_lookup_not_supported as core_admin_ec_lookup_not_supported,
     deny_admin_diagnostic_fallback, handle_admin_eids_lookup,
 };
+use trusted_server_core::ec::module::{EdgeCookieModule, build_shared_module};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::http_util::sanitize_forwarded_headers;
@@ -67,15 +68,31 @@ pub struct AppState {
     settings: Arc<Settings>,
     orchestrator: Arc<AuctionOrchestrator>,
     registry: Arc<IntegrationRegistry>,
+    /// The Edge Cookie module `[ec] module` selects, resolved once here.
+    ///
+    /// This adapter runs a fresh instance per request and resolving reads no
+    /// request data, so the selection is resolved when the state is built
+    /// and handed to every request through
+    /// [`RuntimeServices::resolved_ec_module`](trusted_server_core::platform::RuntimeServices::resolved_ec_module),
+    /// rather than resolved again on the request path.
+    /// `None` for a deployment that selects no module.
+    ec_module: Option<Arc<dyn EdgeCookieModule>>,
+    /// Services a caller supplied for every request, rather than services built
+    /// from the request context. `None` in a deployment.
     services: Option<RuntimeServices>,
 }
 
 /// Build the application state, loading settings and constructing all per-application components.
 ///
+/// Settings are read from the platform config store at run time, the same way
+/// the Fastly and Axum adapters read them, so an operator publishes one with
+/// `ts config push` and the deployed component picks it up.
+///
 /// # Errors
 ///
-/// Returns an error when settings, the auction orchestrator, or the integration
-/// registry fail to initialise.
+/// Returns an error when the config store holds no readable app config, or when
+/// settings, the auction orchestrator, or the integration registry fail to
+/// initialize.
 fn build_state() -> Result<Arc<AppState>, Report<TrustedServerError>> {
     let settings = load_startup_settings()?;
     build_state_with_settings(settings)
@@ -119,8 +136,9 @@ fn load_startup_settings() -> Result<Settings, Report<TrustedServerError>> {
 ///
 /// # Errors
 ///
-/// Returns an error when the auction orchestrator or the integration
-/// registry fail to initialise.
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this adapter, or when the auction orchestrator or the integration registry
+/// fail to initialize.
 fn build_state_with_settings(
     settings: Settings,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
@@ -131,6 +149,18 @@ fn build_state_with_services(
     settings: Settings,
     services: Option<RuntimeServices>,
 ) -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    // Composition root: resolve the module selection once, before any request
+    // is served, so a selection this adapter can never supply fails here rather
+    // than on the first request. Keeping what the resolution produced is what
+    // stops the request path resolving the same settings again. This adapter
+    // injects no vendor Edge Cookie module of its own, so the only injected
+    // module is one a caller put into the services it supplied.
+    let ec_module = build_shared_module(
+        &settings.ec,
+        services
+            .as_ref()
+            .and_then(RuntimeServices::resolved_ec_module),
+    )?;
     let plan = Arc::new(compile_auction_plan(&settings)?);
     plan.validate_for_target(trusted_server_core::platform::AuctionTargetId::Spin)?;
     let orchestrator = build_orchestrator_with_plan(Arc::clone(&plan), &settings)?;
@@ -140,15 +170,20 @@ fn build_state_with_services(
         settings: Arc::new(settings),
         orchestrator: Arc::new(orchestrator),
         registry: Arc::new(registry),
+        ec_module,
         services,
     }))
 }
 
 impl AppState {
+    /// Builds the per-request services, carrying the Edge Cookie module the
+    /// composition root already resolved so the request path does not resolve
+    /// `[ec] module` a second time.
     fn services_for_request(&self, ctx: &RequestContext) -> RuntimeServices {
         self.services
             .clone()
             .unwrap_or_else(|| build_runtime_services(ctx))
+            .with_resolved_ec_module(self.ec_module.clone())
     }
 }
 
@@ -409,13 +444,26 @@ fn health_response() -> Response {
 /// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
 /// `/_ts/page-bids`, and the publisher fallback).
 ///
-/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
-/// Unknown, which fails the auction consent gate closed even for consented
-/// users. Spin's platform geo is a no-op, so jurisdiction stays Unknown unless
-/// the request carries TCF consent. A malformed consent string is logged and
-/// falls back to the default (fail-closed) context rather than being silently
-/// swallowed.
-fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Request) -> EcContext {
+/// Spin's platform geo is a no-op, so jurisdiction stays Unknown unless the
+/// request carries TCF consent, and a geo lookup failure is logged and treated
+/// as no location.
+///
+/// Mirrors the Fastly entry point, which keeps the report and answers with an
+/// error response: when the Edge Cookie context cannot be read the request
+/// fails rather than continuing with `EcContext::default()`, which would serve
+/// every request with no identity. A malformed cookie value, a bad consent
+/// string and a failed geo lookup do not reach this error path at all, so
+/// failing here does not fail requests for ordinary parse problems.
+///
+/// # Errors
+///
+/// Returns an error when the selected Edge Cookie module cannot be built for
+/// this request, or when the request's `Cookie` header is not valid UTF-8.
+fn build_ec_context(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request,
+) -> Result<EcContext, Report<TrustedServerError>> {
     let geo_info = services
         .geo()
         .lookup(services.client_info().client_ip)
@@ -424,10 +472,6 @@ fn build_ec_context(settings: &Settings, services: &RuntimeServices, req: &Reque
             None
         });
     EcContext::read_from_request_with_geo(settings, req, services, geo_info.as_ref())
-        .unwrap_or_else(|e| {
-            log::warn!("EC context read failed: {e:?}");
-            EcContext::default()
-        })
 }
 
 fn cache_purge_not_supported() -> Response {
@@ -680,8 +724,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                 }
                 // Build the geo-aware EC context so the auction consent gate sees
                 // the caller's jurisdiction — `EcContext::default()` fails it
-                // closed for consented users.
-                let mut ec_context = build_ec_context(&s.settings, &services, &req);
+                // closed for consented users. When identity cannot be
+                // established at all, answer with an error rather than running
+                // the auction with no identity.
+                let mut ec_context = match build_ec_context(&s.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 Ok(handle_auction(
                     &s.settings,
                     &s.orchestrator,
@@ -711,7 +760,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                 {
                     return Ok(http_error(&error));
                 }
-                let mut ec_context = build_ec_context(&s.settings, &services, &req);
+                // Identity could not be established (for example the selected
+                // Edge Cookie module is unavailable). Answer with an error
+                // rather than re-running the auction with no identity.
+                let mut ec_context = match build_ec_context(&s.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 let auction = AuctionDispatch {
                     orchestrator: &s.orchestrator,
                     slots: s.settings.creative_opportunity_slots(),
@@ -834,7 +889,13 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         }))
                     })
             } else {
-                let mut ec_context = build_ec_context(&state.settings, &services, &req);
+                // Identity could not be established (for example the selected
+                // Edge Cookie module is unavailable). Answer with an error
+                // rather than serving the page with no identity.
+                let mut ec_context = match build_ec_context(&state.settings, &services, &req) {
+                    Ok(context) => context,
+                    Err(report) => return Ok(http_error(&report)),
+                };
                 let auction = AuctionDispatch {
                     orchestrator: &state.orchestrator,
                     slots: state.settings.creative_opportunity_slots(),
@@ -975,6 +1036,9 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
 
 #[cfg(test)]
 mod tests {
+    use edgezero_core::http::request_builder;
+    use edgezero_core::params::PathParams;
+
     use super::*;
 
     fn multi_provider_settings() -> Settings {
@@ -1071,6 +1135,85 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_state_takes_its_settings_from_the_platform_config_store() {
+        // Every other test enters through the `routes_with_settings` parity
+        // seam, so this is the one that calls `build_state` itself. There is
+        // no Spin runtime under `cargo test`, so there are no component
+        // variables to read and this cannot return `Ok` here. Its settings
+        // come from the config store alone, so the failure has to be the
+        // absence of a config store, and never a configuration compiled into
+        // the binary, such as a template's placeholder password.
+        let Err(error) = build_state() else {
+            return;
+        };
+        let message = format!("{error:?}");
+        assert!(
+            message.contains("config store"),
+            "build_state should fail only for want of a config store, got: {message}"
+        );
+        assert!(
+            !message.to_lowercase().contains("password"),
+            "build_state must not fail on a configuration compiled into the binary, got: {message}"
+        );
+    }
+
+    /// Settings selecting a vendor Edge Cookie module this adapter does not
+    /// inject, with the `[ec.acme]` block that module's settings live in.
+    /// `acme` is a fictional vendor key.
+    const UNINJECTED_MODULE_TOML: &str = r#"
+        [[handlers]]
+        path = "^/_ts/admin"
+        username = "admin"
+        password = "admin-pass"
+
+        [publisher]
+        domain = "test-publisher.example.com"
+        cookie_domain = ".test-publisher.example.com"
+        origin_url = "https://origin.test-publisher.example.com"
+        proxy_secret = "unit-test-proxy-secret"
+
+        [ec]
+        module = "acme"
+
+        [ec.acme]
+        endpoint = "https://ec.acme.example.com"
+    "#;
+
+    /// The per-request Edge Cookie read must return its error rather than a
+    /// default context.
+    ///
+    /// Continuing with `EcContext::default()` would serve every request with
+    /// no identity when the selected module cannot be built. The call sites
+    /// propagate the error to `http_error`, matching the Fastly adapter. The
+    /// settings are parsed directly, bypassing the composition root's startup
+    /// check, so the per-request behavior can be exercised with a selection
+    /// the adapter cannot supply.
+    #[test]
+    fn build_ec_context_fails_when_the_selected_module_is_unavailable() {
+        let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+            .expect("should parse settings selecting an uninjected module");
+        let req = request_builder()
+            .method("POST")
+            .uri("https://test-publisher.example.com/auction")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build test request");
+        let ctx = RequestContext::new(req, PathParams::default());
+        // No resolved module is threaded here, so the request path resolves
+        // the selection itself, which is what an embedder driving core
+        // directly does and where the loud failure has to stay.
+        let services = build_runtime_services(&ctx);
+        let req = ctx.into_request();
+
+        let error = build_ec_context(&settings, &services, &req)
+            .expect_err("an unavailable Edge Cookie module must fail the request");
+
+        assert!(
+            error.to_string().contains("acme"),
+            "the error should name the selected module, got: {error}"
+        );
+    }
+
     #[test]
     fn scheme_host_from_spin_url_extracts_localhost_with_port() {
         assert_eq!(
diff --git a/crates/trusted-server-adapter-spin/src/middleware.rs b/crates/trusted-server-adapter-spin/src/middleware.rs
index d7a09987a..d8300d4ff 100644
--- a/crates/trusted-server-adapter-spin/src/middleware.rs
+++ b/crates/trusted-server-adapter-spin/src/middleware.rs
@@ -236,6 +236,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-adapter-spin/tests/routes.rs b/crates/trusted-server-adapter-spin/tests/routes.rs
index 613832b05..ab33bc16b 100644
--- a/crates/trusted-server-adapter-spin/tests/routes.rs
+++ b/crates/trusted-server-adapter-spin/tests/routes.rs
@@ -35,6 +35,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -974,6 +977,57 @@ async fn admin_deactivate_key_auth_fail_returns_401() {
     );
 }
 
+// ---------------------------------------------------------------------------
+// Edge Cookie module availability
+// ---------------------------------------------------------------------------
+
+/// Test settings selecting a vendor Edge Cookie module this adapter does not
+/// inject, with the `[ec.acme]` block that module's settings live in.
+/// `acme` is a fictional vendor key.
+const UNINJECTED_MODULE_TOML: &str = r#"
+    [[handlers]]
+    path = "^/_ts/admin"
+    username = "admin"
+    password = "admin-pass"
+
+    [publisher]
+    domain = "test-publisher.example.com"
+    cookie_domain = ".test-publisher.example.com"
+    origin_url = "https://origin.test-publisher.example.com"
+    proxy_secret = "route-test-proxy-secret"
+
+    [ec]
+    module = "acme"
+
+    [ec.acme]
+    endpoint = "https://ec.acme.example.com"
+"#;
+
+/// A module selection this adapter can never supply must fail while the
+/// application state is built, before any request is served.
+///
+/// Configuration validation accepts this selection, because only the adapter
+/// that injects a module knows what that module needs, and this adapter
+/// injects no vendor Edge Cookie module, so only the composition root can
+/// catch it. Without the startup check the deployment would come up and answer
+/// every request.
+#[test]
+fn selecting_a_module_this_adapter_cannot_supply_fails_at_startup() {
+    let settings = Settings::from_toml(UNINJECTED_MODULE_TOML)
+        .expect("should parse settings selecting an uninjected module");
+
+    // `RouterService` is not `Debug`, so take the error side directly rather
+    // than through `expect_err`.
+    let error = TrustedServerApp::routes_with_settings(settings)
+        .err()
+        .expect("building state with an uninjected module should fail");
+
+    assert!(
+        error.to_string().contains("acme"),
+        "the startup error should name the selected module, got: {error}"
+    );
+}
+
 /// Regression test: a Next.js navigation with a pending auction must buffer to
 /// the structural body close. The Flight payload carries a literal `</body>`, so
 /// a parser-blind seam would inject bids early and split the RSC data.
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index ab3585e3d..0a40e86a4 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -303,8 +303,13 @@ pub async fn handle_auction(
     // EC and both KV and partner stores are available. Gate the read on a
     // present registry: without one, `resolve_auction_eids` yields no
     // server-side EIDs, so the snapshot would be an unused billable KV read.
+    // The row is read under the owning module's canonical form of the
+    // identifier, the key it is stored under, rather than under the identifier
+    // as issued.
     let auction_kv_snapshot = match (kv, ec_id.as_deref(), registry) {
-        (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
+        (Some(graph), Some(_), Some(_)) => ec_context
+            .ec_kv_key()
+            .map_or(EcKvSnapshot::NotRead, |kv_key| graph.load_snapshot(&kv_key)),
         _ => EcKvSnapshot::NotRead,
     };
     // Hand the loaded row to the request context so response finalization —
@@ -451,7 +456,13 @@ pub(crate) fn resolve_auction_eids(
 
     let ec_id = ec_context.ec_value()?;
 
-    let Some(entry) = snapshot.entry_for(ec_id) else {
+    // Callers read the snapshot under the identity-graph key, the owning
+    // module's canonical form of the identifier, so the entry is looked up
+    // under that key rather than under the identifier as issued.
+    let Some(entry) = ec_context
+        .kv_key_for(ec_id)
+        .and_then(|kv_key| snapshot.entry_for(&kv_key))
+    else {
         return Some(Vec::new());
     };
 
@@ -624,6 +635,7 @@ mod tests {
     use crate::auction::types::{AuctionRequest, AuctionResponse};
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::ConsentContext;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule};
     use crate::error::IntoHttpResponse as _;
     use crate::openrtb::Uid;
     use crate::platform::test_support::{
@@ -797,6 +809,85 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn auction_endpoint_loads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning module's
+        // canonical form of the identifier. Loaded and resolved under the
+        // identifier as issued, a module whose canonical form differs from
+        // the cookie value found no row, so the auction carried no server-side
+        // EIDs and the context kept a snapshot bound to the wrong key.
+        let settings = create_test_settings();
+        let had_eids = Arc::new(std::sync::Mutex::new(None));
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::clone(&had_eids),
+        }));
+        let registry = PartnerRegistry::from_config(&[counting_test_partner("ssp.example.com")])
+            .expect("should build partner registry");
+        let graph = KvIdentityGraph::in_memory("canonical-auction-store");
+        graph
+            .create(
+                CANONICAL_KV_KEY,
+                &crate::ec::kv_types::KvEntry::minimal(
+                    "ssp.example.com",
+                    "partner-uid-123",
+                    1_741_824_000,
+                ),
+            )
+            .expect("should seed the row under the canonical key");
+        let mut ec_context =
+            make_ec_context(Jurisdiction::NonRegulated, Some(CANONICAL_COOKIE_VALUE))
+                .with_module_for_test(Arc::new(CanonicalizingModule));
+        let req = Request::builder()
+            .method("POST")
+            .uri("https://test-publisher.com/auction")
+            .body(EdgeBody::from(
+                serde_json::to_vec(&json!({
+                    "adUnits": [
+                        {
+                            "code": "div-gpt-ad-1",
+                            "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+                        }
+                    ]
+                }))
+                .expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        // The capturing provider records whether the request carried EIDs and
+        // then fails its launch, which is all this test needs. The request
+        // carries no client EIDs, so any EID it records came from the graph.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        assert!(
+            ec_context
+                .kv_snapshot()
+                .entry_for(CANONICAL_KV_KEY)
+                .is_some(),
+            "the endpoint should load the row stored under the canonical key"
+        );
+        assert_eq!(
+            *had_eids.lock().expect("should lock captured eids"),
+            Some(true),
+            "the auction should carry the canonical row's partner ID as an EID"
+        );
+    }
+
     /// Provider that fails the test if it is ever contacted. Used to prove the
     /// `/auction` consent gate short-circuits before any outbound bid request.
     struct PanicOnBidProvider;
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index 79f100e2f..d1bc937c4 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -11,8 +11,9 @@ use std::borrow::Cow;
 use edgezero_core::app_config::{SecretField, SecretKind, SecretPathSegment};
 use error_stack::Report;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
-use validator::{Validate, ValidationError, ValidationErrors};
+use validator::{Validate, ValidationError, ValidationErrors, ValidationErrorsKind};
 
+use crate::ec::module::HMAC_MODULE_KEY;
 use crate::ec::registry::PartnerRegistry;
 use crate::error::TrustedServerError;
 use crate::integrations::{
@@ -32,7 +33,9 @@ use crate::integrations::{
     sourcepoint::SourcepointConfig,
     testlight::TestlightConfig,
 };
-use crate::settings::{AssetOriginAuth, IntegrationConfig, Settings};
+use crate::settings::{
+    AssetOriginAuth, Ec, IntegrationConfig, MODULE_IMPLEMENTATION_KEY, Settings,
+};
 
 const DEPLOY_VALIDATION_FIELD: &str = "trusted_server";
 #[cfg(test)]
@@ -117,6 +120,7 @@ impl<'de> Deserialize<'de> for TrustedServerAppConfig {
 impl Validate for TrustedServerAppConfig {
     fn validate(&self) -> Result<(), ValidationErrors> {
         let mut errors = self.settings.validate().err().unwrap_or_default();
+        remove_labeled_module_secret_errors(&mut errors, &self.settings.ec);
         if let Err(report) = validate_settings_for_deploy(&self.settings) {
             errors.add(
                 DEPLOY_VALIDATION_FIELD,
@@ -131,6 +135,90 @@ impl Validate for TrustedServerAppConfig {
     }
 }
 
+/// Removes the passphrase checks on Edge Cookie module blocks written under
+/// a label.
+///
+/// Push-time validation reads a configuration whose secret fields hold
+/// secret-store key names rather than the secrets themselves, so a value check
+/// such as the 32-byte passphrase minimum would be judging a key name.
+/// `EdgeZero`'s `validate_excluding_secrets` removes those checks for the
+/// leaves [`secret_fields`](edgezero_core::app_config::AppConfigMeta::secret_fields)
+/// lists, which covers the `[ec.hmac]` block. A block under a label of the
+/// operator's choosing has no fixed path that list can hold, so its check is
+/// removed here instead. The check itself is unchanged, and runs wherever
+/// settings are loaded with their secrets resolved.
+fn remove_labeled_module_secret_errors(errors: &mut ValidationErrors, ec: &Ec) {
+    let Some(ValidationErrorsKind::Struct(ec_errors)) = errors.errors_mut().get_mut("ec") else {
+        return;
+    };
+    for (name, _) in ec
+        .module_blocks
+        .hmac_blocks()
+        .filter(|(name, _)| *name != HMAC_MODULE_KEY)
+    {
+        let Some(ValidationErrorsKind::Struct(block_errors)) = ec_errors.errors_mut().get_mut(name)
+        else {
+            continue;
+        };
+        block_errors.errors_mut().remove("passphrase");
+        if block_errors.errors().is_empty() {
+            ec_errors.errors_mut().remove(name);
+        }
+    }
+    // An `ec` entry holding nothing would keep the whole result an error, the
+    // same reason `EdgeZero` prunes emptied containers after its own removals.
+    let ec_is_empty = ec_errors.errors().is_empty();
+    if ec_is_empty {
+        errors.errors_mut().remove("ec");
+    }
+}
+
+impl crate::secret_resolution::ConfiguredSecretFields for TrustedServerAppConfig {
+    /// The passphrase of every Edge Cookie module block that configures the
+    /// built-in HMAC module under a label.
+    ///
+    /// [`secret_fields`](edgezero_core::app_config::AppConfigMeta::secret_fields)
+    /// lists the passphrase of the `[ec.hmac]` block, the one path this
+    /// module's block has when its name is its implementation. The same
+    /// module under a label of the operator's choosing holds that secret at
+    /// `ec.<label>.passphrase`, which is only knowable from the configuration
+    /// itself.
+    fn configured_secret_fields(data: &serde_json::Value) -> Vec<SecretField> {
+        labeled_hmac_block_names(data)
+            .map(|name| SecretField {
+                kind: SecretKind::KeyInDefault,
+                optional: true,
+                path: vec![
+                    SecretPathSegment::Field(Cow::Borrowed("ec")),
+                    SecretPathSegment::Field(Cow::Owned(name)),
+                    SecretPathSegment::Field(Cow::Borrowed("passphrase")),
+                ],
+            })
+            .collect()
+    }
+}
+
+/// The names of the `[ec.<name>]` blocks in a serialized configuration that
+/// configure the built-in HMAC module under a label.
+///
+/// A block named `hmac` is the fixed path `secret_fields` already lists, and a
+/// block naming any other implementation holds that implementation's settings,
+/// which core does not read.
+fn labeled_hmac_block_names(data: &serde_json::Value) -> impl Iterator<Item = String> + '_ {
+    data.get("ec")
+        .and_then(serde_json::Value::as_object)
+        .into_iter()
+        .flatten()
+        .filter(|(name, block)| {
+            name.as_str() != HMAC_MODULE_KEY
+                && block
+                    .get(MODULE_IMPLEMENTATION_KEY)
+                    .and_then(serde_json::Value::as_str)
+                    == Some(HMAC_MODULE_KEY)
+        })
+        .map(|(name, _)| name.clone())
+}
+
 impl edgezero_core::app_config::AppConfigMeta for TrustedServerAppConfig {
     fn secret_fields() -> Vec<SecretField> {
         let field = |path: Vec<SecretPathSegment>, optional| SecretField {
@@ -144,7 +232,16 @@ impl edgezero_core::app_config::AppConfigMeta for TrustedServerAppConfig {
 
         vec![
             field(vec![object("publisher"), object("proxy_secret")], false),
-            field(vec![object("ec"), object("passphrase")], false),
+            field(vec![object("ec"), object("passphrase")], true),
+            // The `[ec.hmac]` block, the built-in HMAC module configured
+            // under its own name, is the one module block with a fixed path.
+            // The same module under a label of the operator's choosing is
+            // reached by `ConfiguredSecretFields`, which reads the names out of
+            // the configuration.
+            field(
+                vec![object("ec"), optional_object("hmac"), object("passphrase")],
+                true,
+            ),
             field(
                 vec![
                     object("ec"),
@@ -390,7 +487,12 @@ fn validate_secret_key_references(settings: &Settings) -> Result<(), Report<Trus
         "publisher.proxy_secret",
         settings.publisher.proxy_secret.expose(),
     )?;
-    validate_secret_key_reference("ec.passphrase", settings.ec.passphrase.expose())?;
+    if let Some(passphrase) = &settings.ec.passphrase {
+        validate_secret_key_reference("ec.passphrase", passphrase.expose())?;
+    }
+    for (name, hmac) in settings.ec.module_blocks.hmac_blocks() {
+        validate_secret_key_reference(&format!("ec.{name}.passphrase"), hmac.passphrase.expose())?;
+    }
 
     for (index, partner) in settings.ec.partners.iter().enumerate() {
         if let Some(token) = &partner.api_token {
@@ -518,7 +620,9 @@ mod tests {
     use crate::auction_config_types::{NotificationConfig, ProviderConfig, RoutingMode};
     use crate::redacted::Redacted;
     use crate::settings::{ProxyAssetRoute, S3SigV4AuthConfig, TrustedClientIpConfig};
-    use crate::test_support::tests::crate_test_settings_str;
+    use crate::test_support::tests::{
+        crate_test_settings_str, crate_test_settings_str_with_ec_section, select_hmac_module,
+    };
     use edgezero_core::app_config::AppConfigMeta;
     use edgezero_core::blob_envelope::BlobEnvelope;
 
@@ -800,7 +904,7 @@ formats = [{ width = 300, height = 250 }]
     fn push_validation_accepts_secret_key_names() {
         let mut settings = valid_settings();
         settings.publisher.proxy_secret = Redacted::new("publisher_proxy".to_owned());
-        settings.ec.passphrase = Redacted::new("ec_key".to_owned());
+        select_hmac_module(&mut settings.ec, HMAC_MODULE_KEY, "ec_key");
         settings.handlers[0].password = Redacted::new("handler_password".to_owned());
         settings.handlers[1].password = Redacted::new("admin_password".to_owned());
         let app_config = TrustedServerAppConfig::new(settings)
@@ -812,6 +916,117 @@ formats = [{ width = 300, height = 250 }]
         assert!(!serialized.contains("unit-test-proxy-secret"));
     }
 
+    /// The crate test configuration selecting the built-in HMAC module
+    /// under the label `primary`, with `passphrase` as the block's passphrase.
+    fn labeled_hmac_settings_str(passphrase: &str) -> String {
+        crate_test_settings_str_with_ec_section(&format!(
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"hmac\"\npassphrase = \"{passphrase}\"\n"
+        ))
+    }
+
+    #[test]
+    fn push_validation_accepts_a_key_name_in_a_labeled_hmac_block() {
+        // At push time a secret field holds the name of a secret-store key, so
+        // a value check such as the 32-byte passphrase minimum would be judging
+        // the key name. `ec_key` is far shorter than any passphrase.
+        let toml = labeled_hmac_settings_str("ec_key");
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize a labeled module block");
+        let mut settings = app_config.into_settings();
+        settings.proxy.allowed_domains = vec!["*.example".to_owned(), "*.example.com".to_owned()];
+
+        TrustedServerAppConfig::new(settings)
+            .expect("should validate the key name without judging it as a passphrase");
+
+        // The value check still exists. It runs where settings are loaded with
+        // their secrets resolved, which here reads `ec_key` as the passphrase.
+        let err = Settings::from_toml(&toml)
+            .expect_err("a short passphrase in a labeled block should be rejected on load");
+        assert!(
+            format!("{err:?}").contains("ec.primary.passphrase: short_passphrase"),
+            "should report the short passphrase at the labeled block's path: {err:?}"
+        );
+    }
+
+    #[test]
+    fn configured_secret_fields_names_only_labeled_hmac_blocks() {
+        use crate::secret_resolution::ConfiguredSecretFields as _;
+
+        let data = serde_json::json!({
+            "ec": {
+                "module": "primary",
+                "ec_store": "ec_identity_store",
+                "hmac": { "passphrase": "ec_key" },
+                "primary": { "implementation": "hmac", "passphrase": "labeled_ec_key" },
+                "acme": { "implementation": "acme", "endpoint": "https://ec.acme.example.com" },
+            }
+        });
+
+        let paths = TrustedServerAppConfig::configured_secret_fields(&data)
+            .iter()
+            .map(SecretField::dotted_path)
+            .collect::<Vec<_>>();
+
+        assert_eq!(
+            paths,
+            vec!["ec.primary.passphrase".to_owned()],
+            "only a block naming the hmac implementation under a label needs a path the \
+             fixed list cannot hold"
+        );
+    }
+
+    #[test]
+    fn push_validation_keeps_the_sections_other_errors_for_a_labeled_block() {
+        // A block under a label has no fixed secret path, so push validation
+        // strips the error that judged its key name as a passphrase, and only
+        // that one: another error in the Edge Cookie section is still reported.
+        let toml = labeled_hmac_settings_str("ec_key");
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize a labeled module block");
+        let mut settings = app_config.into_settings();
+        settings.proxy.allowed_domains = vec!["*.example".to_owned(), "*.example.com".to_owned()];
+        settings.ec.partners = vec![
+            serde_json::from_value(serde_json::json!({
+                "name": "Example partner",
+                "source_domain": "https://partner.example",
+            }))
+            .expect("should deserialize a partner"),
+        ];
+
+        // Read from the section's own errors, because deploy validation
+        // reports a bad partner as well.
+        let errors = TrustedServerAppConfig { settings }
+            .validate()
+            .expect_err("an error beside the passphrase should still be reported");
+        let Some(ValidationErrorsKind::Struct(ec)) = errors.errors().get("ec") else {
+            panic!("the Edge Cookie section should keep its error: {errors}");
+        };
+        assert!(
+            ec.errors().contains_key("partners"),
+            "the partner error should be reported: {errors}"
+        );
+        assert!(
+            !ec.errors().contains_key("primary"),
+            "the key name should not be judged as a passphrase: {errors}"
+        );
+    }
+
+    #[test]
+    fn push_validation_rejects_an_empty_key_name_in_a_labeled_hmac_block() {
+        let toml = labeled_hmac_settings_str("");
+        let app_config: TrustedServerAppConfig =
+            toml::from_str(&toml).expect("should deserialize a labeled module block");
+        let mut settings = app_config.into_settings();
+        settings.proxy.allowed_domains = vec!["*.example".to_owned(), "*.example.com".to_owned()];
+
+        let err = TrustedServerAppConfig::new(settings)
+            .expect_err("should reject an empty secret key reference in a labeled block");
+        assert!(
+            err.to_string().contains("ec.primary.passphrase"),
+            "error should identify the labeled block's empty reference: {err:?}"
+        );
+    }
+
     #[test]
     fn secret_metadata_lists_all_secret_paths_and_optionality() {
         let fields = TrustedServerAppConfig::secret_fields();
@@ -824,7 +1039,8 @@ formats = [{ width = 300, height = 250 }]
             paths,
             vec![
                 ("publisher.proxy_secret".to_owned(), false),
-                ("ec.passphrase".to_owned(), false),
+                ("ec.passphrase".to_owned(), true),
+                ("ec.hmac.passphrase".to_owned(), true),
                 ("ec.partners[*].api_token".to_owned(), true),
                 ("ec.partners[*].ts_pull_token".to_owned(), true),
                 ("handlers[*].password".to_owned(), false),
@@ -1105,6 +1321,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "change-me-proxy-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "production-secret-key-32-bytes-min"
 
 [[handlers]]
diff --git a/crates/trusted-server-core/src/config_payload.rs b/crates/trusted-server-core/src/config_payload.rs
index c9690b01f..977290193 100644
--- a/crates/trusted-server-core/src/config_payload.rs
+++ b/crates/trusted-server-core/src/config_payload.rs
@@ -139,13 +139,16 @@ fn json_bool_or_string_is_true(value: Option<&serde_json::Value>) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::ec::module::HMAC_MODULE_KEY;
     use crate::integrations::didomi::DidomiIntegrationConfig;
     use crate::platform::{PlatformError, StoreId};
     use crate::redacted::Redacted;
     use crate::settings::{
         AssetOriginAuth, EcPartner, ProxyAssetRoute, S3SigV4AuthConfig, TrustedClientIpConfig,
     };
-    use crate::test_support::tests::crate_test_settings_str;
+    use crate::test_support::tests::{
+        crate_test_settings_str, hmac_passphrase, select_hmac_module,
+    };
 
     fn test_settings() -> Settings {
         let mut settings =
@@ -206,6 +209,7 @@ mod tests {
                 "partner-api-token-key" => "resolved-partner-api-token-32-bytes-ok",
                 "partner-pull-token-key" => "resolved-partner-pull-token-32-bytes-ok",
                 "trusted-client-ip-key" => "resolved-trusted-client-ip-secret-32-bytes",
+                "labeled-passphrase-key" => "resolved-labeled-passphrase-32-bytes",
                 _ => key,
             };
             Ok(value.as_bytes().to_vec())
@@ -502,6 +506,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_labeled_hmac_block_resolves_its_passphrase_from_the_secret_store() {
+        // `secret_fields` can only list fixed paths, so a block under a label
+        // of the operator's choosing is found by reading the configuration.
+        // Without that, the key name would reach settings as the passphrase.
+        let mut data =
+            serde_json::to_value(test_settings()).expect("should serialize settings to JSON");
+        data["ec"] = serde_json::json!({
+            "module": "primary",
+            "primary": {
+                "implementation": "hmac",
+                "passphrase": "labeled-passphrase-key",
+            },
+        });
+        let envelope = BlobEnvelope::new(data, "2026-01-01T00:00:00Z".to_owned());
+        let envelope_json = serde_json::to_string(&envelope).expect("should serialize envelope");
+
+        let reconstructed = settings_from_config_blob(
+            &envelope_json,
+            &UnifiedSecretStore,
+            &StoreName::from("ts_secrets"),
+        )
+        .expect("should resolve the labeled block's passphrase");
+
+        let written =
+            serde_json::to_value(&reconstructed).expect("should serialize the loaded settings");
+        assert_eq!(
+            written["ec"]["primary"]["passphrase"], "resolved-labeled-passphrase-32-bytes",
+            "should replace the key name with the value from the secret store"
+        );
+    }
+
     #[test]
     fn omitted_s3_secret_references_resolve_default_store_keys() {
         let mut original = test_settings();
@@ -754,7 +790,11 @@ mod tests {
         let mut original = test_settings();
         original.publisher.proxy_secret =
             Redacted::new("12345678901234567890123456789012".to_string());
-        original.ec.passphrase = Redacted::new("12345678901234567890123456789012".to_string());
+        select_hmac_module(
+            &mut original.ec,
+            HMAC_MODULE_KEY,
+            "12345678901234567890123456789012",
+        );
         original.handlers[0].password = Redacted::new("true".to_string());
 
         let reconstructed =
@@ -766,8 +806,8 @@ mod tests {
             "numeric-looking proxy secret should remain a string"
         );
         assert_eq!(
-            reconstructed.ec.passphrase.expose(),
-            original.ec.passphrase.expose(),
+            hmac_passphrase(&reconstructed.ec, HMAC_MODULE_KEY),
+            hmac_passphrase(&original.ec, HMAC_MODULE_KEY),
             "numeric-looking passphrase should remain a string"
         );
         assert_eq!(
@@ -809,7 +849,7 @@ mod tests {
     #[test]
     fn runtime_validation_rejects_short_resolved_passphrase() {
         let mut settings = test_settings();
-        settings.ec.passphrase = Redacted::new("short_key".to_owned());
+        select_hmac_module(&mut settings.ec, HMAC_MODULE_KEY, "short_key");
 
         let err = load_settings(&envelope_json(&settings))
             .expect_err("should reject a short resolved passphrase");
diff --git a/crates/trusted-server-core/src/constants.rs b/crates/trusted-server-core/src/constants.rs
index 1b55679e2..ad51b7392 100644
--- a/crates/trusted-server-core/src/constants.rs
+++ b/crates/trusted-server-core/src/constants.rs
@@ -46,19 +46,31 @@ pub const HEADER_ACCEPT_LANGUAGE: HeaderName = HeaderName::from_static("accept-l
 pub const HEADER_ACCEPT_ENCODING: HeaderName = HeaderName::from_static("accept-encoding");
 pub const HEADER_REFERER: HeaderName = HeaderName::from_static("referer");
 
-/// TS-internal header names that must NOT be forwarded to downstream third-party services.
+/// The fixed response headers that carry Edge Cookie identity output.
 ///
-/// These headers are used internally by Trusted Server for identification, geo-enrichment,
-/// debugging, and compression hints. Leaking them to external origins could expose
-/// data and internal implementation details.
+/// EC finalization strips these from a response the request was not permitted
+/// to carry an identity on (see `clear_ec_headers_on_response` in
+/// [`finalize`](crate::ec::finalize)), and they are also internal headers, so
+/// [`INTERNAL_HEADERS`] is built from this list rather than repeating it. That
+/// is the whole reason the list lives here alongside `INTERNAL_HEADERS` and not
+/// beside its only reader, because two hand-written copies of one list drift as
+/// soon as a header is added to one of them.
 ///
-/// Uses `&str` slices because `HeaderName` has interior mutability and cannot appear
-/// in `const` context.
-pub const INTERNAL_HEADERS: &[&str] = &[
+/// Uses `&str` slices for the same reason [`INTERNAL_HEADERS`] does.
+pub const EC_RESPONSE_HEADERS: &[&str] = &[
     "x-ts-ec",
     "x-ts-eids",
     "x-ts-ec-consent",
     "x-ts-eids-truncated",
+];
+
+/// The internal headers that are not part of the Edge Cookie output surface.
+///
+/// Kept apart from [`EC_RESPONSE_HEADERS`] only so [`INTERNAL_HEADERS`] can be
+/// assembled from the two without repeating either. Add a header here unless it
+/// is one EC finalization has to strip, in which case it belongs in
+/// [`EC_RESPONSE_HEADERS`] and reaches [`INTERNAL_HEADERS`] from there.
+const NON_EC_INTERNAL_HEADERS: &[&str] = &[
     "x-pub-user-id",
     "x-subject-id",
     "x-consent-advertising",
@@ -80,6 +92,43 @@ pub const INTERNAL_HEADERS: &[&str] = &[
     "x-ts-tls-cipher",
 ];
 
+/// How many names [`INTERNAL_HEADERS`] holds.
+const INTERNAL_HEADER_COUNT: usize = EC_RESPONSE_HEADERS.len() + NON_EC_INTERNAL_HEADERS.len();
+
+/// Joins the two source lists into the array [`INTERNAL_HEADERS`] borrows.
+///
+/// Written as a `const fn` because slice concatenation is not available in a
+/// `const` initializer, and the join has to happen while the crate is compiled
+/// so no caller pays for it.
+const fn join_internal_headers() -> [&'static str; INTERNAL_HEADER_COUNT] {
+    let mut joined = [""; INTERNAL_HEADER_COUNT];
+    let mut i = 0;
+    while i < EC_RESPONSE_HEADERS.len() {
+        joined[i] = EC_RESPONSE_HEADERS[i];
+        i += 1;
+    }
+    let mut j = 0;
+    while j < NON_EC_INTERNAL_HEADERS.len() {
+        joined[i + j] = NON_EC_INTERNAL_HEADERS[j];
+        j += 1;
+    }
+    joined
+}
+
+/// TS-internal header names that must NOT be forwarded to downstream third-party services.
+///
+/// These headers are used internally by Trusted Server for identification, geo-enrichment,
+/// debugging, and compression hints. Leaking them to external origins could expose
+/// data and internal implementation details.
+///
+/// Built at compile time from [`EC_RESPONSE_HEADERS`] followed by
+/// [`NON_EC_INTERNAL_HEADERS`], so an Edge Cookie response header cannot be
+/// added to one list and missed in the other.
+///
+/// Uses `&str` slices because `HeaderName` has interior mutability and cannot appear
+/// in `const` context.
+pub const INTERNAL_HEADERS: &[&str] = &join_internal_headers();
+
 // Consent-related cookie names
 pub const COOKIE_EUCONSENT_V2: &str = "euconsent-v2";
 pub const COOKIE_GPP: &str = "__gpp";
@@ -88,3 +137,36 @@ pub const COOKIE_US_PRIVACY: &str = "us_privacy";
 
 // Consent-related header names
 pub const HEADER_SEC_GPC: HeaderName = HeaderName::from_static("sec-gpc");
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_edge_cookie_response_header_is_an_internal_header() {
+        // `INTERNAL_HEADERS` is assembled from `EC_RESPONSE_HEADERS`. Two
+        // lists written out separately could drift, so that a new Edge Cookie
+        // response header was stripped by EC finalization and still
+        // forwarded to a third party, and this assertion fails if they are
+        // ever separated.
+        for header in EC_RESPONSE_HEADERS {
+            assert!(
+                INTERNAL_HEADERS.contains(header),
+                "`{header}` carries Edge Cookie output, so it must never be forwarded"
+            );
+        }
+
+        assert_eq!(
+            INTERNAL_HEADERS.len(),
+            EC_RESPONSE_HEADERS.len() + NON_EC_INTERNAL_HEADERS.len(),
+            "every internal header should come from exactly one of the two source lists"
+        );
+
+        for (index, header) in INTERNAL_HEADERS.iter().enumerate() {
+            assert!(
+                !INTERNAL_HEADERS[index + 1..].contains(header),
+                "`{header}` is listed twice, so the two source lists overlap"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/admin.rs b/crates/trusted-server-core/src/ec/admin.rs
index 67b13c4b6..3279fb978 100644
--- a/crates/trusted-server-core/src/ec/admin.rs
+++ b/crates/trusted-server-core/src/ec/admin.rs
@@ -32,11 +32,11 @@ use crate::error::TrustedServerError;
 use crate::openrtb::Eid;
 
 use super::eids::{resolve_partner_ids, to_eids};
-use super::generation::is_valid_ec_id;
 use super::kv::KvIdentityGraph;
 use super::kv_backend::EcKvLookup;
 use super::kv_types::{KvEntry, KvMetadata};
 use super::log_id;
+use super::module::{AcceptedModules, EdgeCookieModule};
 use super::prebid_eids::{
     analyze_prebid_eids_cookie, collect_sharedid_update, dedupe_partner_updates, is_valid_eid_uid,
 };
@@ -197,8 +197,11 @@ pub fn deny_admin_diagnostic_fallback(req: &Request<EdgeBody>) -> Option<Respons
 /// Successful admin EC lookup payload.
 #[derive(Debug, Serialize)]
 struct AdminEcLookupResponse {
-    /// The EC ID that was looked up.
+    /// The EC ID as requested, from the path or the `ts-ec` cookie.
     ec_id: String,
+    /// The identity-graph key the entry was read from, being the canonical form
+    /// of `ec_id` that [`AcceptedModules::canonical_kv_key`] returns.
+    kv_key: String,
     /// Platform KV store name the entry was read from.
     store: String,
     /// Store generation marker for the entry.
@@ -276,19 +279,28 @@ struct SkippedPartnerId {
 pub fn handle_admin_ec_lookup(
     kv: Option<&KvIdentityGraph>,
     registry: &PartnerRegistry,
+    module: Option<&dyn EdgeCookieModule>,
     req: &Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let Some(kv) = kv else {
         return Ok(admin_ec_lookup_not_supported());
     };
 
-    let ec_id = match requested_ec_id(req) {
-        Ok(ec_id) => ec_id,
+    let requested = match requested_ec_id(req, &AcceptedModules::active(module)) {
+        Ok(requested) => requested,
         Err(response) => return Ok(*response),
     };
 
-    let Some(lookup) = kv.lookup_raw(&ec_id)? else {
-        log::info!("Admin EC lookup: no entry for '{}'", log_id(&ec_id));
+    // Read the row under the owning module's canonical form of the
+    // identifier, the key the row is stored under, rather than under the
+    // identifier as requested. The two differ whenever the canonical form is
+    // not the requested string itself, for example for a built-in HMAC
+    // identifier requested with its hash in uppercase.
+    let Some(lookup) = kv.lookup_raw(&requested.kv_key)? else {
+        log::info!(
+            "Admin EC lookup: no entry for '{}'",
+            log_id(&requested.ec_id)
+        );
         return Ok(json_error(
             StatusCode::NOT_FOUND,
             "EC entry not found (KV reads are eventually consistent; a very \
@@ -296,8 +308,11 @@ pub fn handle_admin_ec_lookup(
         ));
     };
 
-    log::info!("Admin EC lookup: returning entry for '{}'", log_id(&ec_id));
-    let payload = build_lookup_response(registry, kv.store_name(), ec_id, &lookup);
+    log::info!(
+        "Admin EC lookup: returning entry for '{}'",
+        log_id(&requested.ec_id)
+    );
+    let payload = build_lookup_response(registry, kv.store_name(), requested, &lookup);
     let body =
         serde_json::to_string(&payload).change_context(TrustedServerError::Configuration {
             message: "failed to serialize admin EC lookup response".to_owned(),
@@ -340,11 +355,34 @@ fn cookie_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeBody
     })
 }
 
-/// Resolves the EC ID to look up from the path or the `ts-ec` cookie.
+/// An EC ID resolved for lookup, with the identity-graph key its row is stored
+/// under.
+#[derive(Debug)]
+struct RequestedEcId {
+    /// The EC ID as requested, from the path or the `ts-ec` cookie.
+    ec_id: String,
+    /// The canonical form of `ec_id` that
+    /// [`AcceptedModules::canonical_kv_key`] returns, which the row is stored
+    /// under.
+    kv_key: String,
+}
+
+/// Resolves the EC ID to look up from the path or the `ts-ec` cookie, with the
+/// identity-graph key its row is stored under.
+///
+/// The identifier is validated in two parts: the global cookie bounds, then
+/// the module that owns its `{code}~` prefix, so an operator can look up an
+/// identifier created by whichever module this deployment reads rather than
+/// only a built-in HMAC one. The same check supplies the key, the canonical
+/// form of the identifier that [`AcceptedModules::canonical_kv_key`]
+/// returns.
 ///
 /// Returns the (boxed) error response to send directly when no valid ID is
 /// available.
-fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeBody>>> {
+fn requested_ec_id(
+    req: &Request<EdgeBody>,
+    accepted_modules: &AcceptedModules<'_>,
+) -> Result<RequestedEcId, Box<Response<EdgeBody>>> {
     let remainder = req
         .uri()
         .path()
@@ -358,14 +396,16 @@ fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeB
         remainder.to_owned()
     };
 
-    if !is_valid_ec_id(&ec_id) {
+    let Some(kv_key) = accepted_modules.canonical_kv_key(&ec_id) else {
         return Err(Box::new(json_error(
             StatusCode::BAD_REQUEST,
-            "invalid EC ID format (expected {64hex}.{6alnum})",
+            "invalid EC ID: not an identifier any module this deployment reads \
+             issued (the built-in HMAC module issues hmac~{64hex}.{6alnum} and \
+             still reads the bare legacy form)",
         )));
-    }
+    };
 
-    Ok(ec_id)
+    Ok(RequestedEcId { ec_id, kv_key })
 }
 
 /// Builds the success payload from a raw KV lookup.
@@ -375,11 +415,12 @@ fn requested_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeB
 fn build_lookup_response(
     registry: &PartnerRegistry,
     store_name: &str,
-    ec_id: String,
+    requested: RequestedEcId,
     lookup: &EcKvLookup,
 ) -> AdminEcLookupResponse {
     let mut payload = AdminEcLookupResponse {
-        ec_id,
+        ec_id: requested.ec_id,
+        kv_key: requested.kv_key,
         store: store_name.to_owned(),
         generation: lookup.generation,
         tombstone: None,
@@ -683,6 +724,9 @@ mod tests {
     use crate::ec::kv_backend::test_support::InMemoryEcKv;
     use crate::ec::kv_backend::{EcKvStore as _, EcKvWrite, EcKvWriteMode};
     use crate::ec::kv_types::KvPartnerId;
+    use crate::ec::tests::{
+        CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule, OpaqueModule,
+    };
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
 
@@ -975,7 +1019,7 @@ mod tests {
         let kv = kv_with_entry(&ec_id, &sample_entry());
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1071,7 +1115,7 @@ mod tests {
         let kv = kv_with_raw_body_and_metadata(&ec_id, &body, &metadata);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
         let json = response_json(response);
 
@@ -1098,7 +1142,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, &body);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
         let json = response_json(response);
 
@@ -1130,7 +1174,7 @@ mod tests {
         );
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1150,7 +1194,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_FOUND);
@@ -1161,7 +1205,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request("/_ts/admin/ec/not-a-valid-id");
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
@@ -1173,7 +1217,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, "not json at all");
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(
@@ -1214,7 +1258,7 @@ mod tests {
         let kv = kv_with_raw_body(&ec_id, &body);
         let req = get_request(&format!("/_ts/admin/ec/{ec_id}"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1239,7 +1283,7 @@ mod tests {
         let kv = kv_with_entry(&ec_id, &sample_entry());
         let req = get_request_with_cookie("/_ts/admin/ec", &format!("other=1; ts-ec={ec_id}; x=2"));
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1264,7 +1308,7 @@ mod tests {
             &format!("ts-ec={stale_ec_id}; ts-ec={live_ec_id}"),
         );
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::OK);
@@ -1281,7 +1325,7 @@ mod tests {
         let kv = KvIdentityGraph::in_memory("test-store");
         let req = get_request("/_ts/admin/ec");
 
-        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req)
+        let response = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req)
             .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_FOUND);
@@ -1299,8 +1343,8 @@ mod tests {
     fn missing_identity_graph_returns_501() {
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let response =
-            handle_admin_ec_lookup(None, &test_registry(), &req).expect("should handle lookup");
+        let response = handle_admin_ec_lookup(None, &test_registry(), None, &req)
+            .expect("should handle lookup");
 
         assert_eq!(response.status(), StatusCode::NOT_IMPLEMENTED);
     }
@@ -1334,7 +1378,7 @@ mod tests {
         let kv = KvIdentityGraph::failing("broken-store");
         let req = get_request(&format!("/_ts/admin/ec/{}", test_ec_id()));
 
-        let result = handle_admin_ec_lookup(Some(&kv), &test_registry(), &req);
+        let result = handle_admin_ec_lookup(Some(&kv), &test_registry(), None, &req);
 
         assert!(result.is_err(), "should propagate KV read failures");
     }
@@ -1531,4 +1575,124 @@ mod tests {
         assert_eq!(matched[0]["source_domain"], "sharedid.org");
         assert_eq!(matched[0]["uid"], "shared-uid-123");
     }
+
+    #[test]
+    fn requested_ec_id_accepts_the_hmac_envelope() {
+        let coded = format!("hmac~{}", test_ec_id());
+        let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{coded}"));
+
+        let requested = requested_ec_id(&request, &AcceptedModules::active(None))
+            .unwrap_or_else(|_| panic!("should accept a coded HMAC identifier in the path"));
+
+        assert_eq!(
+            requested.ec_id, coded,
+            "should report the identifier as given"
+        );
+        assert_eq!(
+            requested.kv_key, coded,
+            "a lowercase HMAC identifier should be its own identity-graph key"
+        );
+    }
+
+    #[test]
+    fn requested_ec_id_accepts_the_active_non_hmac_module_and_rejects_others() {
+        // The diagnostic must be usable on a deployment whose module is not
+        // the built-in HMAC one. Before the dispatch every non-`hmac` code was
+        // a 400, so an operator could not look up the identifier in the very
+        // cookie the browser was carrying.
+        let accepted = AcceptedModules::active(Some(&OpaqueModule));
+
+        let opaque = "t0op~Opaque_Value_MixedCase";
+        let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{opaque}"));
+        let requested = requested_ec_id(&request, &accepted)
+            .unwrap_or_else(|_| panic!("should accept the active module's identifier"));
+        assert_eq!(
+            requested.ec_id, opaque,
+            "should report the identifier as given"
+        );
+
+        // A code no configured module reads stays a 400, even in the built-in
+        // HMAC shape, so one deployment cannot inspect another's identifiers.
+        let foreign = format!("t0zz~{}", test_ec_id());
+        let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{foreign}"));
+        let response = requested_ec_id(&request, &accepted)
+            .expect_err("an unread module code should be rejected");
+        assert_eq!(
+            response.status(),
+            StatusCode::BAD_REQUEST,
+            "an unread module code should be a 400"
+        );
+    }
+
+    #[test]
+    fn ec_lookup_reads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning module's
+        // canonical form of the identifier. Read under the identifier as
+        // requested, the lookup answered 404 for a row that exists whenever a
+        // module's canonical form differs from the cookie value.
+        let kv = kv_with_entry(CANONICAL_KV_KEY, &sample_entry());
+        let req =
+            get_request_with_cookie("/_ts/admin/ec", &format!("ts-ec={CANONICAL_COOKIE_VALUE}"));
+
+        let response = handle_admin_ec_lookup(
+            Some(&kv),
+            &test_registry(),
+            Some(&CanonicalizingModule),
+            &req,
+        )
+        .expect("should handle lookup");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "the cookie value should find the row stored under the canonical key"
+        );
+        let json = response_json(response);
+        assert_eq!(
+            json["ec_id"], CANONICAL_COOKIE_VALUE,
+            "should report the identifier as requested"
+        );
+        assert_eq!(
+            json["kv_key"], CANONICAL_KV_KEY,
+            "should report the key the entry was read from"
+        );
+        assert_eq!(
+            json["entry"]["ids"]["bidstream.example"]["uid"], "uid-live",
+            "should return the entry stored under the canonical key"
+        );
+    }
+
+    #[test]
+    fn ec_lookup_given_an_uppercase_hmac_hash_reads_the_lowercase_row() {
+        // The built-in HMAC module issues lowercase hex, and its canonical
+        // form lowercases the hash, so its row key is the identifier it issued.
+        // An operator who pastes that identifier with the hash in uppercase is
+        // still asking for the same row.
+        let ec_id = format!("hmac~{}", test_ec_id());
+        let kv = kv_with_entry(&ec_id, &sample_entry());
+        let uppercase = format!("hmac~{}.abc123", "A".repeat(64));
+        let module = crate::ec::tests::hmac_module();
+        let req = get_request(&format!("/_ts/admin/ec/{uppercase}"));
+
+        let response =
+            handle_admin_ec_lookup(Some(&kv), &test_registry(), Some(module.as_ref()), &req)
+                .expect("should handle lookup");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "an uppercase hash should find the row stored under the lowercase key"
+        );
+        let json = response_json(response);
+        assert_eq!(
+            json["ec_id"],
+            uppercase.as_str(),
+            "should report the identifier as requested"
+        );
+        assert_eq!(
+            json["kv_key"],
+            ec_id.as_str(),
+            "should report the lowercase key the entry was read from"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/batch_sync.rs b/crates/trusted-server-core/src/ec/batch_sync.rs
index 4903589b2..97fbe630e 100644
--- a/crates/trusted-server-core/src/ec/batch_sync.rs
+++ b/crates/trusted-server-core/src/ec/batch_sync.rs
@@ -23,9 +23,9 @@ use serde::{Deserialize, Serialize};
 use crate::error::TrustedServerError;
 
 use super::auth::authenticate_bearer;
-use super::generation::{is_valid_ec_id, normalize_ec_id_for_kv};
 use super::kv::{KvIdentityGraph, UpsertResult};
 use super::log_id;
+use super::module::{AcceptedModules, EdgeCookieModule};
 use super::rate_limiter::RateLimiter;
 use super::registry::PartnerRegistry;
 
@@ -115,15 +115,17 @@ pub fn handle_batch_sync(
     kv: &KvIdentityGraph,
     registry: &PartnerRegistry,
     rate_limiter: &dyn RateLimiter,
+    module: Option<&dyn EdgeCookieModule>,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    handle_batch_sync_with_writer(kv, registry, rate_limiter, req)
+    handle_batch_sync_with_writer(kv, registry, rate_limiter, module, req)
 }
 
 fn handle_batch_sync_with_writer(
     writer: &dyn BatchSyncWriter,
     registry: &PartnerRegistry,
     rate_limiter: &dyn RateLimiter,
+    module: Option<&dyn EdgeCookieModule>,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     // 1. Authenticate
@@ -167,7 +169,12 @@ fn handle_batch_sync_with_writer(
     }
 
     // 4. Process mappings with per-item validation and rejection reasons.
-    let (accepted, errors) = process_mappings(writer, &partner.source_domain, &body.mappings);
+    let (accepted, errors) = process_mappings(
+        writer,
+        &partner.source_domain,
+        &body.mappings,
+        &AcceptedModules::active(module),
+    );
 
     let rejected = errors.len();
     let status = if rejected > 0 {
@@ -203,6 +210,7 @@ fn process_mappings(
     writer: &dyn BatchSyncWriter,
     partner_id: &str,
     mappings: &[SyncMapping],
+    accepted_modules: &AcceptedModules<'_>,
 ) -> (usize, Vec<MappingError>) {
     let mut errors = Vec::new();
     let mut groups: Vec<MappingGroup> = Vec::new();
@@ -211,14 +219,18 @@ fn process_mappings(
     // Validate all inputs before beginning KV work. The vector preserves group
     // order; the map only locates an existing group in constant time.
     for (index, mapping) in mappings.iter().enumerate() {
-        let ec_id = normalize_ec_id_for_kv(&mapping.ec_id);
-        if !is_valid_ec_id(&ec_id) {
+        // The global cookie bounds, then the module that owns the
+        // identifier's code, which canonicalizes its own value part and decides
+        // whether the canonical form is one of its own. A partner echoing back
+        // an identifier a non-HMAC module created is accepted here; an
+        // identifier under a code this deployment does not read is not.
+        let Some(ec_id) = accepted_modules.canonical_kv_key(&mapping.ec_id) else {
             errors.push(MappingError {
                 index,
                 reason: REASON_INVALID_EC_ID,
             });
             continue;
-        }
+        };
 
         if mapping.partner_uid.trim().is_empty() || mapping.partner_uid.len() > MAX_UID_LENGTH {
             errors.push(MappingError {
@@ -308,17 +320,15 @@ mod tests {
     use super::*;
     use std::collections::VecDeque;
 
+    use crate::ec::module::HmacModule;
+    use crate::ec::tests::OpaqueModule;
     use crate::error::TrustedServerError;
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
 
-    // EC ID validation tests are in generation.rs (is_valid_ec_id).
-    // Verify the import works here with a basic smoke test.
-    #[test]
-    fn is_valid_ec_id_smoke_test() {
-        let valid = format!("{}.ABC123", "a".repeat(64));
-        assert!(is_valid_ec_id(&valid));
-        assert!(!is_valid_ec_id(&"a".repeat(64)));
+    /// The built-in module, standing in for a deployment that selected it.
+    fn hmac_module() -> HmacModule {
+        HmacModule::new(Redacted::new("test-secret-key-32-bytes-minimum".to_owned()))
     }
 
     struct MockRateLimiter {
@@ -489,7 +499,7 @@ mod tests {
             .body(EdgeBody::from("not-json"))
             .expect("should build test request");
 
-        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, req)
+        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, None, req)
             .expect("should return oversized response");
 
         assert_eq!(
@@ -515,7 +525,7 @@ mod tests {
             .body(EdgeBody::from(oversized_body))
             .expect("should build test request");
 
-        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, req)
+        let response = handle_batch_sync_with_writer(&writer, &registry, &limiter, None, req)
             .expect("should return oversized response");
 
         assert_eq!(
@@ -534,7 +544,13 @@ mod tests {
             mapping(&format!("{}.ABC123", "a".repeat(64)), "u3", 1),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 1, "should count successful writes as accepted");
         assert_eq!(errors.len(), 2, "should reject invalid mappings only");
@@ -560,7 +576,13 @@ mod tests {
             mapping(&format!("{}.ABC123", "c".repeat(64)), "u3", 1),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 1, "should keep accepted count before failure");
         assert_eq!(
@@ -593,7 +615,7 @@ mod tests {
             .expect("should build test request");
 
         let response =
-            handle_batch_sync(&kv, &registry, &limiter, req).expect("should return response");
+            handle_batch_sync(&kv, &registry, &limiter, None, req).expect("should return response");
         assert_eq!(
             response.status(),
             StatusCode::UNAUTHORIZED,
@@ -657,7 +679,13 @@ mod tests {
             mapping(&withdrawn_ec_id, "uid-2", 101),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 0, "should not accept ineligible mappings");
         assert_eq!(errors.len(), 2, "should report both errors");
@@ -668,13 +696,111 @@ mod tests {
         assert_eq!(writer.calls().len(), 2, "should exercise both outcomes");
     }
 
+    #[test]
+    fn process_mappings_accepts_an_identifier_from_the_active_non_hmac_module() {
+        // An identifier the active non-HMAC module owns is accepted, so a
+        // partner can sync a mapping against an identifier the HMAC grammar
+        // would reject.
+        let writer = MockWriter::new(vec![Ok(UpsertResult::Written)]);
+        let mappings = vec![mapping("t0op~Opaque_Value_MixedCase", "uid-1", 100)];
+
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&OpaqueModule)),
+        );
+
+        assert_eq!(accepted, 1, "the active module's identifier is accepted");
+        assert!(
+            errors.is_empty(),
+            "should report no errors, got: {errors:?}"
+        );
+    }
+
+    #[test]
+    fn process_mappings_rejects_a_code_no_configured_module_reads() {
+        // The other side of the dispatch: a code belonging to a module this
+        // deployment neither runs nor reads is not an identifier here, whatever
+        // its shape.
+        let writer = MockWriter::new(vec![]);
+        let hmac_shaped = format!("t0zz~{}.ABC123", "a".repeat(64));
+        let mappings = vec![
+            mapping("t0zz~Opaque_Value", "uid-1", 100),
+            mapping(&hmac_shaped, "uid-2", 100),
+        ];
+
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&OpaqueModule)),
+        );
+
+        assert_eq!(accepted, 0, "an unknown module code is not accepted");
+        assert_eq!(errors.len(), 2, "both mappings should be rejected");
+        assert!(
+            errors
+                .iter()
+                .all(|error| error.reason == REASON_INVALID_EC_ID),
+            "should reject as an invalid EC ID, got: {errors:?}"
+        );
+    }
+
+    #[test]
+    fn process_mappings_canonicalizes_through_the_owning_module() {
+        // KV normalization is dispatched the same way as validation. The
+        // built-in module lowercases its hash segment, so a partner echoing
+        // uppercase hex still writes the row created at generation time, while
+        // the opaque module's own normalization leaves its value untouched.
+        let writer = MockWriter::new(vec![Ok(UpsertResult::Written)]);
+        let uppercase = format!("hmac~{}.ABC123", "A".repeat(64));
+        let module = hmac_module();
+        let accepted_modules = AcceptedModules::active(Some(&module));
+
+        assert_eq!(
+            accepted_modules.canonical_kv_key(&uppercase),
+            Some(format!("hmac~{}.ABC123", "a".repeat(64))),
+            "the built-in module should lowercase only its hash segment"
+        );
+        assert_eq!(
+            AcceptedModules::active(Some(&OpaqueModule))
+                .canonical_kv_key("t0op~Opaque_Value_MixedCase"),
+            Some("t0op~Opaque_Value_MixedCase".to_owned()),
+            "an opaque module's identifier should be keyed verbatim"
+        );
+
+        let mappings = vec![mapping(&uppercase, "uid-1", 100)];
+        let (accepted, errors) = process_mappings(&writer, "partner", &mappings, &accepted_modules);
+        assert_eq!(accepted, 1, "uppercase hex should still be accepted");
+        assert!(
+            errors.is_empty(),
+            "should report no errors, got: {errors:?}"
+        );
+        assert_eq!(
+            writer
+                .calls()
+                .into_iter()
+                .map(|call| call.ec_id)
+                .collect::<Vec<_>>(),
+            vec![format!("hmac~{}.ABC123", "a".repeat(64))],
+            "the write should go to the row under the lowercase canonical key"
+        );
+    }
+
     #[test]
     fn process_mappings_fans_out_unchanged_to_group_members() {
         let writer = MockWriter::new(vec![Ok(UpsertResult::Unchanged)]);
         let ec_id = format!("{}.ABC123", "a".repeat(64));
         let mappings = vec![mapping(&ec_id, "uid-1", 100), mapping(&ec_id, "uid-1", 101)];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(accepted, 2, "should accept every unchanged group member");
         assert!(
@@ -693,7 +819,13 @@ mod tests {
             mapping(&ec_id, "uid-old", 100),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
 
         assert_eq!(
             accepted, 2,
@@ -723,7 +855,12 @@ mod tests {
             mapping(&ec_id_a_upper, "a-last", 3),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 3, "should accept every valid group member");
         assert!(errors.is_empty(), "should report no errors");
@@ -753,7 +890,12 @@ mod tests {
             .map(|index| mapping(&ec_id, &format!("uid-{index}"), index as u64))
             .collect::<Vec<_>>();
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(
             accepted, MAX_BATCH_SIZE,
@@ -781,7 +923,12 @@ mod tests {
             mapping(&mixed_suffix, "mixed", 2),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 2, "should accept both distinct EC IDs");
         assert!(errors.is_empty(), "should report no errors");
@@ -813,7 +960,12 @@ mod tests {
             mapping(&ec_id, "   ", 3),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 2, "should accept valid group members");
         assert_eq!(errors.len(), 1, "should retain the invalid UID error");
@@ -841,7 +993,12 @@ mod tests {
             mapping(&ec_id_b, "b-2", 4),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(accepted, 0, "should reject all ineligible group members");
         assert_eq!(
@@ -882,7 +1039,12 @@ mod tests {
             mapping(&ec_id_c, "", 6),
         ];
 
-        let (accepted, errors) = process_mappings(&writer, "partner", &mappings);
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&hmac_module())),
+        );
 
         assert_eq!(
             accepted, 2,
@@ -929,6 +1091,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return success response");
@@ -959,6 +1122,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return multi-status response");
@@ -997,6 +1161,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return validation response");
@@ -1042,6 +1207,7 @@ mod tests {
             &writer,
             &registry,
             &limiter,
+            Some(&hmac_module()),
             authorized_batch_request(&body),
         )
         .expect("should return infrastructure failure response");
@@ -1074,4 +1240,27 @@ mod tests {
             "should stop after the failing group and accept A's later duplicate"
         );
     }
+
+    #[test]
+    fn process_mappings_accepts_a_created_coded_ec_id() {
+        let writer = MockWriter::new(vec![Ok(UpsertResult::Written)]);
+        // Partners echo the identifier identify gave them, which carries the
+        // module-code envelope since the creation path applies it.
+        let ec_id = format!("hmac~{}.ABC123", "a".repeat(64));
+        let mappings = vec![mapping(&ec_id, "uid-1", 1)];
+
+        let module = hmac_module();
+        let (accepted, errors) = process_mappings(
+            &writer,
+            "partner",
+            &mappings,
+            &AcceptedModules::active(Some(&module)),
+        );
+
+        assert_eq!(accepted, 1, "should accept a coded HMAC identifier");
+        assert!(
+            errors.is_empty(),
+            "should report no format error for a coded HMAC identifier"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/cookies.rs b/crates/trusted-server-core/src/ec/cookies.rs
index ac0e0c05b..409124a73 100644
--- a/crates/trusted-server-core/src/ec/cookies.rs
+++ b/crates/trusted-server-core/src/ec/cookies.rs
@@ -13,8 +13,6 @@
 //!   endpoint (`/_ts/api/v1/identify`) exposes the EC ID in its response
 //!   body for legitimate JS use cases.
 
-use std::borrow::Cow;
-
 use edgezero_core::body::Body as EdgeBody;
 use http::{HeaderValue, Response, header};
 
@@ -24,64 +22,27 @@ use crate::settings::Settings;
 /// Maximum age for the EC cookie (1 year in seconds).
 const COOKIE_MAX_AGE: i32 = 365 * 24 * 60 * 60;
 
+/// Maximum length in bytes of an Edge Cookie identifier.
+///
+/// A global bound enforced wherever an identifier enters the system (creation,
+/// cookie read-back, cookie write), so no module can emit a value the cookie
+/// layer, logs, or the KV key space cannot carry.
+pub(crate) const MAX_EC_ID_LEN: usize = 256;
+
 fn is_allowed_ec_id_char(c: char) -> bool {
-    c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_')
+    c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_' | '~')
 }
 
-// Outbound allowlist for cookie sanitization: permits [a-zA-Z0-9._-] as a
-// defense-in-depth backstop when setting the Set-Cookie header. This is
-// intentionally broader than the inbound format validator
-// (`generation::is_valid_ec_id`), which enforces the exact
-// `<64-hex>.<6-alphanumeric>` structure and is used to reject untrusted
-// request values before they enter the system.
+// Identifier allowlist: [A-Za-z0-9._~-], the cookie-safe alphabet every
+// Edge Cookie identifier must fit regardless of which module created it.
+// This is intentionally broader than the built-in format validator
+// (`generation::is_valid_ec_id`), which enforces the HMAC module's
+// `<64-hex>.<6-alphanumeric>` structure, either bare or under the `hmac~`
+// envelope; an opaque vendor identifier only has to fit the alphabet and the
+// length bound.
 #[must_use]
 pub(crate) fn ec_id_has_only_allowed_chars(ec_id: &str) -> bool {
-    ec_id.chars().all(is_allowed_ec_id_char)
-}
-
-fn sanitize_ec_id_for_cookie(ec_id: &str) -> Cow<'_, str> {
-    if ec_id_has_only_allowed_chars(ec_id) {
-        return Cow::Borrowed(ec_id);
-    }
-
-    let safe_id = ec_id
-        .chars()
-        .filter(|c| is_allowed_ec_id_char(*c))
-        .collect::<String>();
-
-    log::warn!(
-        "Stripped disallowed characters from EC ID before setting cookie (len {} -> {}); \
-         callers should reject invalid request IDs before cookie creation",
-        ec_id.len(),
-        safe_id.len(),
-    );
-
-    Cow::Owned(safe_id)
-}
-
-/// Returns `true` if every byte in `value` is a valid RFC 6265 `cookie-octet`.
-/// An empty string is always rejected.
-///
-/// RFC 6265 restricts cookie values to printable US-ASCII excluding whitespace,
-/// double-quote, comma, semicolon, and backslash. Rejecting these characters
-/// prevents header-injection attacks where a crafted value could append
-/// spurious cookie attributes (e.g. `evil; Domain=.attacker.com`).
-///
-/// Non-ASCII characters (multi-byte UTF-8) are always rejected because their
-/// byte values exceed `0x7E`.
-#[must_use]
-fn is_safe_cookie_value(value: &str) -> bool {
-    // RFC 6265 §4.1.1 cookie-octet:
-    //   0x21        — '!'
-    //   0x23–0x2B  — '#' through '+'   (excludes 0x22 DQUOTE)
-    //   0x2D–0x3A  — '-' through ':'   (excludes 0x2C comma)
-    //   0x3C–0x5B  — '<' through '['   (excludes 0x3B semicolon)
-    //   0x5D–0x7E  — ']' through '~'   (excludes 0x5C backslash, 0x7F DEL)
-    // All control characters (0x00–0x20) and non-ASCII (0x80+) are also excluded.
-    !value.is_empty()
-        && value
-            .bytes()
-            .all(|b| matches!(b, 0x21 | 0x23..=0x2B | 0x2D..=0x3A | 0x3C..=0x5B | 0x5D..=0x7E))
+    !ec_id.is_empty() && ec_id.len() <= MAX_EC_ID_LEN && ec_id.chars().all(is_allowed_ec_id_char)
 }
 
 /// Formats a `Set-Cookie` header value for the EC cookie.
@@ -98,56 +59,48 @@ fn format_set_cookie(domain: &str, value: &str, max_age: i32) -> String {
 ///
 /// Per spec §5.2, the EC cookie domain is computed from
 /// `settings.publisher.domain` (not `cookie_domain`) to ensure the EC
-/// cookie is always scoped to the publisher's apex domain. The EC ID is
-/// sanitized through a narrow outbound allowlist as a defense-in-depth
-/// backstop against header injection.
+/// cookie is always scoped to the publisher's apex domain. Callers validate
+/// the identifier with [`ec_id_has_only_allowed_chars`] before this point;
+/// an identifier is rejected outright rather than rewritten, so the cookie
+/// value and the identity-graph key can never silently diverge.
 #[must_use]
 pub(crate) fn create_ec_cookie(settings: &Settings, ec_id: &str) -> String {
-    let safe_id = sanitize_ec_id_for_cookie(ec_id);
-
     format_set_cookie(
         &settings.publisher.ec_cookie_domain(),
-        safe_id.as_ref(),
+        ec_id,
         COOKIE_MAX_AGE,
     )
 }
 
 /// Sets the EC ID cookie on the given response.
 ///
-/// Validates `ec_id` against RFC 6265 `cookie-octet` rules before
-/// interpolation. If the value contains unsafe characters (e.g. semicolons),
-/// the cookie is not set and a warning is logged. This prevents an attacker
-/// from injecting spurious cookie attributes via a controlled ID value.
+/// Validates `ec_id` against the identifier alphabet and length bound before
+/// interpolation. An identifier that fails validation is rejected and the
+/// cookie is not set, with an error logged; the value is never rewritten, so
+/// a module identifier survives byte for byte or not at all. This also
+/// prevents an attacker from injecting spurious cookie attributes via a
+/// controlled ID value.
 ///
 /// `cookie_domain` comes from operator configuration and is considered trusted.
-///
-/// # Panics (debug only)
-///
-/// Debug-asserts that `ec_id` passes [`super::generation::is_valid_ec_id`]
-/// as a defense-in-depth check against cookie injection.
 pub fn set_ec_cookie(settings: &Settings, response: &mut Response<EdgeBody>, ec_id: &str) {
-    if !is_safe_cookie_value(ec_id) {
-        log::warn!(
-            "Rejecting EC ID for Set-Cookie: value of {} bytes contains characters illegal in a cookie value",
-            ec_id.len()
+    if !ec_id_has_only_allowed_chars(ec_id) {
+        log::error!(
+            "Rejecting EC ID for Set-Cookie: value of {} bytes is empty, over {} bytes, or \
+             contains characters outside the identifier alphabet",
+            ec_id.len(),
+            MAX_EC_ID_LEN,
         );
         return;
     }
 
-    debug_assert!(
-        super::generation::is_valid_ec_id(ec_id),
-        "EC ID must be validated before cookie creation: got '{ec_id}'"
-    );
-
     match HeaderValue::from_str(&create_ec_cookie(settings, ec_id)) {
         Ok(val) => {
             response.headers_mut().append(header::SET_COOKIE, val);
         }
         Err(e) => {
-            // Unreachable in practice — is_safe_cookie_value and the debug
-            // assertion above gate the value, and format_set_cookie emits
-            // only controlled bytes. Logged for defense-in-depth symmetry
-            // with the rejection logging above.
+            // Unreachable in practice: the identifier allowlist above gates
+            // the value, and format_set_cookie emits only controlled bytes.
+            // Logged for defense-in-depth symmetry with the rejection above.
             log::warn!("Skipping EC Set-Cookie: invalid header value: {e}");
         }
     }
@@ -177,6 +130,41 @@ pub fn expire_ec_cookie(settings: &Settings, response: &mut Response<EdgeBody>)
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn the_ec_cookie_lifetime_is_one_year() {
+        // The legacy bare-identifier reader's retirement condition (see
+        // `module_owns_id`) is written in terms of this lifetime and the
+        // identity-graph `ENTRY_TTL`, which `kv::tests::constants_have_expected_values`
+        // pins to the same figure. Changing either moves the earliest safe
+        // retirement, so neither may drift unnoticed.
+        assert_eq!(
+            COOKIE_MAX_AGE, 31_536_000,
+            "the EC cookie should live one year"
+        );
+    }
+
+    #[test]
+    fn identifier_bounds_reject_oversize_and_accept_tilde() {
+        assert!(
+            ec_id_has_only_allowed_chars("a.~-_Z9"),
+            "the cookie-safe alphabet includes the tilde"
+        );
+        assert!(
+            !ec_id_has_only_allowed_chars(""),
+            "an empty identifier is rejected"
+        );
+        let oversize = "a".repeat(MAX_EC_ID_LEN + 1);
+        assert!(
+            !ec_id_has_only_allowed_chars(&oversize),
+            "an identifier over the length cap is rejected"
+        );
+        let at_cap = "a".repeat(MAX_EC_ID_LEN);
+        assert!(
+            ec_id_has_only_allowed_chars(&at_cap),
+            "an identifier at the length cap is accepted"
+        );
+    }
     use crate::test_support::tests::create_test_settings;
     use http::header;
 
@@ -226,17 +214,21 @@ mod tests {
     }
 
     #[test]
-    fn create_ec_cookie_sanitizes_disallowed_chars_in_id() {
+    fn set_ec_cookie_rejects_disallowed_chars_outright() {
+        // Rejection, never rewriting: an identifier outside the alphabet must
+        // not produce a cookie at all, so the cookie value and the identity
+        // graph key can never silently diverge.
         let settings = create_test_settings();
-        let result = create_ec_cookie(&settings, "evil;injected\r\nfoo=bar\0baz");
-        let value = result
-            .strip_prefix(&format!("{COOKIE_TS_EC}="))
-            .and_then(|s| s.split_once(';').map(|(v, _)| v))
-            .expect("should have cookie value portion");
-
-        assert_eq!(
-            value, "evilinjectedfoobarbaz",
-            "should strip disallowed characters and preserve safe chars"
+        let mut response = Response::new(EdgeBody::empty());
+        set_ec_cookie(
+            &settings,
+            &mut response,
+            "evil;injected
+foo=bar",
+        );
+        assert!(
+            response.headers().get(header::SET_COOKIE).is_none(),
+            "an identifier outside the alphabet should set no cookie"
         );
     }
 
@@ -289,47 +281,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn is_safe_cookie_value_rejects_empty_string() {
-        assert!(!is_safe_cookie_value(""), "should reject empty string");
-    }
-
-    #[test]
-    fn is_safe_cookie_value_accepts_valid_ec_id_characters() {
-        assert!(
-            is_safe_cookie_value("abcdef0123456789.ABCDEFabcdef"),
-            "should accept hex digits, dots, and alphanumeric characters"
-        );
-    }
-
-    #[test]
-    fn is_safe_cookie_value_rejects_non_ascii() {
-        assert!(
-            !is_safe_cookie_value("val\u{fc}e"),
-            "should reject non-ASCII UTF-8 characters"
-        );
-    }
-
-    #[test]
-    fn is_safe_cookie_value_rejects_illegal_characters() {
-        assert!(!is_safe_cookie_value("val;ue"), "should reject semicolon");
-        assert!(!is_safe_cookie_value("val,ue"), "should reject comma");
-        assert!(
-            !is_safe_cookie_value("val\"ue"),
-            "should reject double-quote"
-        );
-        assert!(!is_safe_cookie_value("val\\ue"), "should reject backslash");
-        assert!(!is_safe_cookie_value("val ue"), "should reject space");
-        assert!(
-            !is_safe_cookie_value("val\x00ue"),
-            "should reject null byte"
-        );
-        assert!(
-            !is_safe_cookie_value("val\x7fue"),
-            "should reject DEL character"
-        );
-    }
-
     #[test]
     fn expire_ec_cookie_sets_max_age_zero() {
         let settings = create_test_settings();
diff --git a/crates/trusted-server-core/src/ec/finalize.rs b/crates/trusted-server-core/src/ec/finalize.rs
index 2c5bbde09..c6b6cd0d0 100644
--- a/crates/trusted-server-core/src/ec/finalize.rs
+++ b/crates/trusted-server-core/src/ec/finalize.rs
@@ -8,38 +8,35 @@ use std::collections::HashSet;
 use edgezero_core::body::Body as EdgeBody;
 use http::Response;
 
-use super::consent::{ec_consent_granted, ec_consent_withdrawn};
+use crate::constants::EC_RESPONSE_HEADERS;
 use crate::settings::Settings;
 
 use super::EcContext;
+use super::consent::ec_consent_withdrawn;
 use super::cookies::{expire_ec_cookie, set_ec_cookie};
-use super::generation::{generate_ec_id, is_valid_ec_id};
 use super::kv::{
     CreateIfAbsentOutcome, EidCookieSyncOutcome, KvIdentityGraph, PartnerIdUpdate,
     apply_partner_id_updates,
 };
 use super::kv_types::KvEntry;
+use super::module::{apply_module_response_headers, module_kv_key};
 use super::prebid_eids::collect_eid_cookie_updates;
 use super::pull_sync_marker::{expire_marker, reconcile_marker};
 use super::registry::PartnerRegistry;
 use super::{EcKvSnapshot, EidSyncSource, current_timestamp, log_id};
 
-/// TS-managed response headers tied to EC identity output.
-const EC_RESPONSE_HEADERS: &[&str] = &[
-    "x-ts-ec",
-    "x-ts-eids",
-    "x-ts-ec-consent",
-    "x-ts-eids-truncated",
-];
-
 /// Finalizes EC response behavior for all routes.
 ///
-/// Applies withdrawal handling, last-seen updates, cookie reconciliation,
-/// Prebid EID ingestion, and cookie writes for new EC generation.
+/// Applies the resolved consent gate, cookie reconciliation, Prebid EID
+/// ingestion, and cookie writes for new EC generation.
 ///
-/// On consent withdrawal, the browser response clears the EC cookie
-/// immediately and the EC identity-graph KV tombstone is the authoritative
-/// revocation marker. There is no separate consent KV store to clean up.
+/// When the request carries an explicit withdrawal signal (a storage opt-out or
+/// a TCF record refusing storage) and the client presented a cookie, the browser
+/// response clears the EC cookie immediately and the EC identity-graph KV
+/// tombstone is the authoritative revocation marker. A request that is merely
+/// not permitted (pre-consent or fail-closed) strips EC response headers but
+/// leaves an already-issued cookie intact. There is no separate consent KV
+/// store to clean up.
 ///
 /// `eids_cookie` should be the raw value of the `ts-eids` cookie extracted
 /// from the request *before* routing consumes it.
@@ -52,11 +49,25 @@ pub fn ec_finalize_response(
     sharedid_cookie: Option<&str>,
     response: &mut Response<EdgeBody>,
 ) {
+    // Apply any response headers the active module asked for during
+    // generation (for example to request more client evidence). This is empty
+    // unless a module produced headers, so it is safe on every path. Each
+    // one was checked against core's reserved response surface at capture
+    // time in `EcContext::candidate_id`, so nothing here can set a
+    // managed `ts-` cookie, an `x-ts-` header, or a framing or hop-by-hop
+    // header. They accumulate with whatever the origin returned rather than
+    // replacing it, for the reasons on
+    // `module::apply_module_response_headers`.
+    apply_module_response_headers(
+        response.headers_mut(),
+        ec_context.response_headers().iter().cloned(),
+    );
+
     ec_context.validate_pull_sync_marker(settings, registry);
-    let consent_allows_ec = ec_consent_granted(ec_context.consent());
+    let ec_permitted = ec_context.ec_allowed();
     let consent_withdrawn = ec_consent_withdrawn(ec_context.consent());
 
-    if !consent_allows_ec {
+    if !ec_permitted {
         // Expire the request-local marker independently of the EC cookie: a
         // withdrawal must stop any pending pull-sync disclosure window.
         if consent_withdrawn && ec_context.pull_sync_marker().was_present() {
@@ -74,21 +85,25 @@ pub fn ec_finalize_response(
         return;
     }
 
-    // Returning user: consent is granted and EC came from request.
-    if ec_context.ec_was_present() && !ec_context.ec_generated() && consent_allows_ec {
-        if let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) {
+    // Returning user: EC is permitted and came from the request.
+    if ec_context.ec_was_present() && !ec_context.ec_generated() && ec_permitted {
+        // Key the snapshot, EID ingestion and orphan recovery by the module's
+        // canonical form of the identifier, the key the identity-graph row is
+        // stored under, so an ingested EID lands on the live row rather than on
+        // a second row keyed by the value the browser carries.
+        if let (Some(graph), Some(kv_key)) = (kv, ec_context.ec_kv_key()) {
             let source = ec_context.eid_sync_source();
             let updates = source
                 .map(|_| collect_eid_cookie_updates(eids_cookie, sharedid_cookie, registry))
                 .unwrap_or_default();
             if let Some(source) = source {
-                sync_eid_cookie_updates(graph, ec_context, &ec_id, &updates, source);
+                sync_eid_cookie_updates(graph, ec_context, &kv_key, &updates, source);
             }
             if matches!(ec_context.kv_snapshot(), EcKvSnapshot::Missing { .. })
                 && ec_context.recovery_eligible()
             {
                 confirm_then_recover_orphaned_ec(
-                    settings, ec_context, graph, &ec_id, &updates, response,
+                    settings, ec_context, graph, &kv_key, &updates, response,
                 );
             }
         }
@@ -104,15 +119,18 @@ pub fn ec_finalize_response(
     // there is no KV graph: that would mint a browser cookie with no backing
     // identity-graph row, producing a phantom ID on later requests.
     if ec_context.ec_generated() {
-        let (Some(graph), Some(ec_id)) = (kv, ec_context.ec_value().map(str::to_owned)) else {
-            log::info!("Skipping generated EC response write because KV graph is unavailable");
+        let (Some(graph), Some(kv_key)) = (kv, ec_context.ec_kv_key()) else {
+            log::info!(
+                "Skipping generated EC response write because the KV graph or the \
+                 identity-graph key is unavailable"
+            );
             reconcile_pull_sync_marker(settings, registry, ec_context, response);
             return;
         };
 
         let updates = collect_eid_cookie_updates(eids_cookie, sharedid_cookie, registry);
-        sync_eid_cookie_updates(graph, ec_context, &ec_id, &updates, EidSyncSource::NewEc);
-        if ec_context.kv_snapshot().entry_for(&ec_id).is_some() {
+        sync_eid_cookie_updates(graph, ec_context, &kv_key, &updates, EidSyncSource::NewEc);
+        if ec_context.kv_snapshot().entry_for(&kv_key).is_some() {
             set_ec_cookie_on_response(settings, ec_context, response);
         } else {
             log::warn!("Skipping generated EC cookie because backing row is not authoritative");
@@ -206,38 +224,49 @@ fn reconcile_pull_sync_marker(
     );
 }
 
+/// Rotates an orphaned identifier to a new one created by the selected module.
+///
+/// Called only once [`confirm_then_recover_orphaned_ec`] has proved the
+/// orphan's row absent. The replacement goes through the same checks as a new
+/// identifier, and its row is created only when no row already holds its key.
+/// Every exit that does not rotate leaves a failed snapshot bound to the
+/// orphan's key.
 fn recover_orphaned_ec(
     settings: &Settings,
     ec_context: &mut EcContext,
     graph: &KvIdentityGraph,
+    orphan_kv_key: &str,
     updates: &[super::kv::PartnerIdUpdate],
     response: &mut Response<EdgeBody>,
 ) {
-    // Snapshot the orphaned ID once so every fail-closed exit binds the failed
-    // snapshot to the same key.
-    let Some(orphan_id) = ec_context.ec_value().map(str::to_owned) else {
-        return;
-    };
-    let Some(client_ip) = ec_context.client_ip().map(str::to_owned) else {
-        log::warn!("Orphan EC recovery skipped because client IP is unavailable");
-        ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-            ec_id: orphan_id.clone(),
-        });
+    // A deployment with no module selected has nothing to rotate to.
+    let Some(module) = ec_context.selected_module() else {
         return;
     };
 
+    // Ask the selected module rather than the built-in generator, so a
+    // vendor deployment never rotates an orphaned cookie into a built-in
+    // identifier. Whether the client IP is needed is that module's decision.
     const MAX_RECOVERY_ATTEMPTS: usize = 5;
     for _attempt in 0..MAX_RECOVERY_ATTEMPTS {
-        let ec_id = match generate_ec_id(settings, &client_ip) {
-            Ok(ec_id) => ec_id,
+        let ec_id = match ec_context.candidate_id(module.as_ref()) {
+            Ok(Some(ec_id)) => ec_id,
+            Ok(None) => {
+                log::info!("Orphan EC recovery skipped because the module produced no identifier");
+                ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
+                    ec_id: orphan_kv_key.to_owned(),
+                });
+                return;
+            }
             Err(err) => {
                 log::warn!("Orphan EC recovery ID generation failed: {err:?}");
                 ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-                    ec_id: orphan_id.clone(),
+                    ec_id: orphan_kv_key.to_owned(),
                 });
                 return;
             }
         };
+        let kv_key = module_kv_key(module.as_ref(), &ec_id);
         let mut entry = KvEntry::new(
             ec_context.consent(),
             ec_context.geo_info(),
@@ -249,14 +278,21 @@ fn recover_orphaned_ec(
             .map(super::device::DeviceSignals::to_kv_device);
         apply_partner_id_updates(&mut entry, updates);
 
-        match graph.create_if_absent(&ec_id, &entry) {
+        match graph.create_if_absent(&kv_key, &entry) {
             Ok(CreateIfAbsentOutcome::Written) => {
                 let snapshot = EcKvSnapshot::Present {
-                    ec_id: ec_id.clone(),
+                    ec_id: kv_key,
                     entry: Box::new(entry),
                     generation: None,
                 };
                 ec_context.replace_with_generated(ec_id, snapshot);
+                // A returning visitor runs no generation earlier in the
+                // request, so these are only the headers the module asked
+                // for while creating the replacement.
+                apply_module_response_headers(
+                    response.headers_mut(),
+                    ec_context.response_headers().iter().cloned(),
+                );
                 set_ec_cookie_on_response(settings, ec_context, response);
                 return;
             }
@@ -264,7 +300,7 @@ fn recover_orphaned_ec(
             Err(err) => {
                 log::warn!("Orphan EC recovery failed: {err:?}");
                 ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-                    ec_id: orphan_id.clone(),
+                    ec_id: orphan_kv_key.to_owned(),
                 });
                 return;
             }
@@ -273,7 +309,7 @@ fn recover_orphaned_ec(
 
     log::warn!("Orphan EC recovery exhausted collision retries");
     ec_context.set_kv_snapshot(EcKvSnapshot::Failed {
-        ec_id: orphan_id.clone(),
+        ec_id: orphan_kv_key.to_owned(),
     });
 }
 
@@ -299,20 +335,28 @@ fn confirm_then_recover_orphaned_ec(
     settings: &Settings,
     ec_context: &mut EcContext,
     graph: &KvIdentityGraph,
-    ec_id: &str,
+    kv_key: &str,
     updates: &[super::kv::PartnerIdUpdate],
     response: &mut Response<EdgeBody>,
 ) {
-    let confirmed = graph.load_snapshot(ec_id);
+    let confirmed = graph.load_snapshot(kv_key);
     match confirmed {
         EcKvSnapshot::Present { .. } => {
             // The row became visible after the origin round trip: adopt it and
             // merge any pending updates rather than rotating a valid identity.
             ec_context.set_kv_snapshot(confirmed);
-            sync_eid_cookie_updates(graph, ec_context, ec_id, updates, EidSyncSource::Navigation);
+            sync_eid_cookie_updates(
+                graph,
+                ec_context,
+                kv_key,
+                updates,
+                EidSyncSource::Navigation,
+            );
         }
-        EcKvSnapshot::Missing { .. } => match graph.key_exists_confirmed(ec_id) {
-            Ok(false) => recover_orphaned_ec(settings, ec_context, graph, updates, response),
+        EcKvSnapshot::Missing { .. } => match graph.key_exists_confirmed(kv_key) {
+            Ok(false) => {
+                recover_orphaned_ec(settings, ec_context, graph, kv_key, updates, response)
+            }
             Ok(true) => {
                 log::warn!(
                     "Orphan EC recovery skipped: both point reads missed a row the store still \
@@ -397,66 +441,75 @@ fn finalize_unusable_consent(
 
     expire_ec_cookie(settings, response);
 
-    // Compute once for the authoritative identity-graph tombstones.
-    let ids_to_withdraw = withdrawal_ec_ids(ec_context);
+    // Compute once for the authoritative identity-graph tombstones, keyed by
+    // the canonical form each row is stored under.
+    let keys_to_withdraw = withdrawal_kv_keys(ec_context);
+    let active_kv_key = ec_context.ec_kv_key();
 
     // The identity-graph tombstone is the authoritative withdrawal marker
     // for subsequent EC behavior.
     if let Some(graph) = kv {
-        apply_withdrawal_tombstones(&ids_to_withdraw, |ec_id| {
+        apply_withdrawal_tombstones(&keys_to_withdraw, |kv_key| {
             // The graph hands back the post-withdrawal snapshot rather than
             // leaving the caller to rebuild it, so post-send work that reads
-            // the context — pull sync discloses the raw EC ID to partners —
-            // sees the tombstone that was just written. Only the active ID has
-            // a snapshot in the context to correct.
-            let initial = if ec_context.kv_snapshot().belongs_to(ec_id) {
+            // the context, such as pull sync, which discloses the raw EC ID to
+            // partners, sees the tombstone that was just written. Only the
+            // active identifier has a snapshot in the context to correct.
+            let initial = if ec_context.kv_snapshot().belongs_to(kv_key) {
                 ec_context.kv_snapshot().clone()
             } else {
                 EcKvSnapshot::NotRead
             };
-            let outcome = graph.tombstone_existing_from_snapshot(ec_id, initial);
+            let outcome = graph.tombstone_existing_from_snapshot(kv_key, initial);
             // The browser cookie is already cleared, so a failed tombstone
             // leaves a live row that server-side consumers still read as
             // consented. Report every failure, including the non-active cookie
-            // ID whose outcome is not retained on the request context.
+            // key whose outcome is not retained on the request context.
             if matches!(outcome, EcKvSnapshot::Failed { .. }) {
                 log::warn!(
                     "EC withdrawal tombstone failed for '{}': the identity-graph row may \
                      still be live with consent granted",
-                    log_id(ec_id)
+                    log_id(kv_key)
                 );
             }
-            if ec_context.ec_value() == Some(ec_id) {
+            if active_kv_key.as_deref() == Some(kv_key) {
                 ec_context.set_kv_snapshot(outcome);
             }
         });
     }
 }
 
-fn withdrawal_ec_ids(ec_context: &EcContext) -> HashSet<String> {
-    let mut hashes = HashSet::new();
+/// The identity-graph keys a withdrawal must tombstone.
+///
+/// Both the `ts-ec` cookie the request carried and the active identifier are
+/// turned into keys by the module that owns them, so the tombstone lands on
+/// the row the live identifier is stored under rather than on the raw cookie
+/// value. An identifier no module this deployment reads owns produces no key
+/// and is dropped, and with no module selected the built-in HMAC grammar
+/// decides, as
+/// [`AcceptedModules::canonical_kv_key`](super::module::AcceptedModules::canonical_kv_key)
+/// does. The two collapse to one key when they are the same identity written
+/// two ways.
+fn withdrawal_kv_keys(ec_context: &EcContext) -> HashSet<String> {
+    let mut keys = HashSet::new();
 
-    if let Some(cookie_ec_id) = ec_context.existing_cookie_ec_id()
-        && is_valid_ec_id(cookie_ec_id)
-    {
-        hashes.insert(cookie_ec_id.to_owned());
+    if let Some(cookie_kv_key) = ec_context.cookie_ec_kv_key() {
+        keys.insert(cookie_kv_key);
     }
 
-    if let Some(active_ec_id) = ec_context.ec_value()
-        && is_valid_ec_id(active_ec_id)
-    {
-        hashes.insert(active_ec_id.to_owned());
+    if let Some(active_kv_key) = ec_context.ec_kv_key() {
+        keys.insert(active_kv_key);
     }
 
-    hashes
+    keys
 }
 
-fn apply_withdrawal_tombstones<F>(ec_ids: &HashSet<String>, mut write_tombstone: F)
+fn apply_withdrawal_tombstones<F>(kv_keys: &HashSet<String>, mut write_tombstone: F)
 where
     F: FnMut(&str),
 {
-    for ec_id in ec_ids {
-        write_tombstone(ec_id);
+    for kv_key in kv_keys {
+        write_tombstone(kv_key);
     }
 }
 
@@ -467,6 +520,7 @@ mod tests {
     use super::*;
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
     use crate::test_support::tests::create_test_settings;
@@ -500,6 +554,7 @@ mod tests {
         ec_was_present: bool,
         ec_generated: bool,
         jurisdiction: Jurisdiction,
+        ec_allowed: bool,
     ) -> EcContext {
         let consent = ConsentContext {
             jurisdiction,
@@ -513,6 +568,7 @@ mod tests {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
         )
     }
 
@@ -522,6 +578,7 @@ mod tests {
         ec_was_present: bool,
         ec_generated: bool,
         consent: ConsentContext,
+        ec_allowed: bool,
     ) -> EcContext {
         EcContext::new_for_test_with_cookie(
             ec_value.map(str::to_owned),
@@ -529,7 +586,40 @@ mod tests {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
+        )
+    }
+
+    fn canonicalizing_context(
+        ec_was_present: bool,
+        ec_generated: bool,
+        consent: ConsentContext,
+        ec_allowed: bool,
+    ) -> EcContext {
+        make_context_with_consent(
+            Some(CANONICAL_COOKIE_VALUE),
+            Some(CANONICAL_COOKIE_VALUE),
+            ec_was_present,
+            ec_generated,
+            consent,
+            ec_allowed,
         )
+        .with_module_for_test(std::sync::Arc::new(crate::ec::tests::CanonicalizingModule))
+    }
+
+    fn graph_with_live_canonical_row() -> KvIdentityGraph {
+        let graph = KvIdentityGraph::in_memory("finalize-canonical-store");
+        graph
+            .create(
+                CANONICAL_KV_KEY,
+                &crate::ec::kv_types::KvEntry::minimal(
+                    "ssp.example.com",
+                    "partner-uid-123",
+                    1_741_824_000,
+                ),
+            )
+            .expect("should write the row generation keys by the canonical form");
+        graph
     }
 
     fn sample_ec_id(suffix: &str) -> String {
@@ -556,70 +646,48 @@ mod tests {
     }
 
     #[test]
-    fn withdrawal_ec_ids_returns_cookie_ec_only_when_active_missing() {
-        let cookie_ec = sample_ec_id("cook1e");
-        let ec_context = make_context(None, Some(&cookie_ec), true, false, Jurisdiction::Unknown);
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 1, "should include exactly one EC ID");
-        assert!(
-            ids.contains(&cookie_ec),
-            "should include the cookie EC value"
-        );
-    }
-
-    #[test]
-    fn withdrawal_ec_ids_deduplicates_matching_cookie_and_active_ec() {
-        let ec_id = sample_ec_id("same01");
-        let ec_context = make_context(
-            Some(&ec_id),
-            Some(&ec_id),
-            true,
-            false,
-            Jurisdiction::Unknown,
-        );
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 1, "should deduplicate identical EC IDs");
-        assert!(ids.contains(&ec_id), "should retain the shared EC ID");
-    }
-
-    #[test]
-    fn withdrawal_ec_ids_includes_both_cookie_and_active_when_different() {
-        let active_ec = sample_ec_id("activ1");
-        let cookie_ec = sample_ec_id("cook1e");
-        let ec_context = make_context(
-            Some(&active_ec),
-            Some(&cookie_ec),
-            true,
-            false,
-            Jurisdiction::Unknown,
-        );
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 2, "should include both distinct EC IDs");
-        assert!(ids.contains(&active_ec), "should include active EC ID");
-        assert!(ids.contains(&cookie_ec), "should include cookie EC ID");
-    }
-
-    #[test]
-    fn withdrawal_ec_ids_filters_invalid_values() {
-        let valid_ec = sample_ec_id("valid1");
-        let ec_context = make_context(
-            Some(&valid_ec),
-            Some("not-an-ec-id"),
-            true,
-            false,
-            Jurisdiction::Unknown,
-        );
-
-        let ids = withdrawal_ec_ids(&ec_context);
-
-        assert_eq!(ids.len(), 1, "should ignore malformed EC values");
-        assert!(ids.contains(&valid_ec), "should keep the valid EC ID");
+    fn withdrawal_kv_keys_covers_the_cookie_and_the_active_identifier() {
+        let active = sample_ec_id("activ1");
+        let cookie = sample_ec_id("cook1e");
+        let same = sample_ec_id("same01");
+        let valid = sample_ec_id("valid1");
+        for (case, active_ec, cookie_ec, expected) in [
+            (
+                "the cookie alone when no identifier is active",
+                None,
+                Some(cookie.as_str()),
+                vec![cookie.as_str()],
+            ),
+            (
+                "one key when the cookie and the active identifier match",
+                Some(same.as_str()),
+                Some(same.as_str()),
+                vec![same.as_str()],
+            ),
+            (
+                "both keys when the cookie and the active identifier differ",
+                Some(active.as_str()),
+                Some(cookie.as_str()),
+                vec![active.as_str(), cookie.as_str()],
+            ),
+            (
+                "no key for a malformed value",
+                Some(valid.as_str()),
+                Some("not-an-ec-id"),
+                vec![valid.as_str()],
+            ),
+        ] {
+            let ec_context = make_context(
+                active_ec,
+                cookie_ec,
+                true,
+                false,
+                Jurisdiction::Unknown,
+                false,
+            );
+            let expected: HashSet<String> = expected.into_iter().map(str::to_owned).collect();
+            assert_eq!(withdrawal_kv_keys(&ec_context), expected, "{case}");
+        }
     }
 
     #[test]
@@ -688,7 +756,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let kv = KvIdentityGraph::in_memory("test-store");
         let mut response = empty_response();
         let registry = PartnerRegistry::from_config(&[]).expect("should build registry");
@@ -729,7 +797,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let kv = KvIdentityGraph::stale_lookup("test-store", 1);
         kv.create(
             &ec_id,
@@ -785,7 +853,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         ec_context.set_kv_snapshot(EcKvSnapshot::Present {
             ec_id: ec_id.clone(),
             entry: Box::new(live_entry()),
@@ -832,7 +900,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         let mut response = empty_response();
         set_header(&mut response, "x-ts-ec", "stale");
         set_header(&mut response, "x-ts-eids", "[]");
@@ -889,6 +957,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -923,6 +992,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -957,6 +1027,7 @@ mod tests {
             false,
             true,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut response = empty_response();
 
@@ -994,7 +1065,8 @@ mod tests {
             Some(orphaned_ec.clone()),
             consent,
             Some("192.0.2.10".to_owned()),
-        );
+        )
+        .with_module_for_test(crate::ec::tests::hmac_module());
         ec_context.set_recovery_eligible(true);
         ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
             ec_id: orphaned_ec.clone(),
@@ -1178,8 +1250,14 @@ mod tests {
         graph
             .create(&ec_id, &live)
             .expect("should seed generated row");
-        let mut ec_context =
-            make_context(Some(&ec_id), None, false, true, Jurisdiction::NonRegulated);
+        let mut ec_context = make_context(
+            Some(&ec_id),
+            None,
+            false,
+            true,
+            Jurisdiction::NonRegulated,
+            true,
+        );
         ec_context.set_kv_snapshot(graph.load_snapshot(&ec_id));
         let partners = vec![make_partner("sharedid.org")];
         let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
@@ -1550,6 +1628,217 @@ mod tests {
         );
     }
 
+    /// A returning visitor's context on a recovery-eligible navigation whose
+    /// row is missing, with `module` selected.
+    fn orphan_context(
+        orphan: &str,
+        client_ip: Option<&str>,
+        module: std::sync::Arc<dyn crate::ec::module::EdgeCookieModule>,
+    ) -> EcContext {
+        let mut ec = EcContext::new_for_test_with_ip(
+            Some(orphan.to_owned()),
+            granting_consent(),
+            client_ip.map(str::to_owned),
+        )
+        .with_module_for_test(module);
+        ec.set_recovery_eligible(true);
+        ec.set_kv_snapshot(EcKvSnapshot::Missing {
+            ec_id: orphan.to_owned(),
+        });
+        ec
+    }
+
+    /// A store that holds no row and refuses every write, so a proven-absent
+    /// orphan reaches the replacement write and that write fails.
+    struct EmptyUnwritableEcKv;
+
+    impl crate::ec::kv_backend::EcKvStore for EmptyUnwritableEcKv {
+        fn store_name(&self) -> &str {
+            "empty-unwritable-store"
+        }
+
+        fn lookup(
+            &self,
+            _key: &str,
+        ) -> Result<
+            Option<crate::ec::kv_backend::EcKvLookup>,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Ok(None)
+        }
+
+        fn key_exists(
+            &self,
+            _key: &str,
+        ) -> Result<bool, error_stack::Report<crate::error::TrustedServerError>> {
+            Ok(false)
+        }
+
+        fn insert(
+            &self,
+            _key: &str,
+            _write: crate::ec::kv_backend::EcKvWrite<'_>,
+        ) -> Result<
+            crate::ec::kv_backend::EcKvWriteOutcome,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Err(error_stack::Report::new(
+                crate::error::TrustedServerError::KvStore {
+                    store_name: "empty-unwritable-store".to_owned(),
+                    message: "the test store refuses every write".to_owned(),
+                },
+            ))
+        }
+
+        fn list_keys_with_prefix(
+            &self,
+            _prefix: &str,
+            _limit: u32,
+        ) -> Result<Vec<String>, error_stack::Report<crate::error::TrustedServerError>> {
+            Ok(Vec::new())
+        }
+
+        fn delete(
+            &self,
+            _key: &str,
+        ) -> Result<(), error_stack::Report<crate::error::TrustedServerError>> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn an_orphan_recovery_that_cannot_rotate_leaves_a_failed_snapshot() {
+        // Recovery runs only once the orphan's row is proven absent. Each of
+        // these exits gives up without a replacement, and each must leave the
+        // orphan in place, write no cookie and record a failed snapshot for
+        // the orphan's key, so nothing later treats the miss as authoritative.
+        let settings = create_test_settings();
+        let hmac_orphan = sample_ec_id("orphn2");
+        let cases: [(&str, EcContext, KvIdentityGraph); 3] = [
+            (
+                "the HMAC module with no client IP",
+                orphan_context(&hmac_orphan, None, crate::ec::tests::hmac_module()),
+                KvIdentityGraph::in_memory("test_store"),
+            ),
+            (
+                "a store whose replacement write fails",
+                orphan_context(
+                    &hmac_orphan,
+                    Some("192.0.2.10"),
+                    crate::ec::tests::hmac_module(),
+                ),
+                KvIdentityGraph::new(EmptyUnwritableEcKv),
+            ),
+            (
+                "a replacement that always collides",
+                orphan_context(
+                    &hmac_orphan,
+                    Some("192.0.2.10"),
+                    crate::ec::tests::hmac_module(),
+                ),
+                KvIdentityGraph::new(crate::ec::tests::AddCollidingEcKv::new(u32::MAX)),
+            ),
+        ];
+        for (case, mut ec_context, graph) in cases {
+            let orphan = ec_context
+                .ec_value()
+                .expect("the context should carry the orphan")
+                .to_owned();
+            let orphan_kv_key = ec_context
+                .ec_kv_key()
+                .expect("the selected module should own the orphan");
+            let mut response = empty_response();
+
+            ec_finalize_response(
+                &settings,
+                &mut ec_context,
+                Some(&graph),
+                &PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+
+            assert_eq!(
+                ec_context.ec_value(),
+                Some(orphan.as_str()),
+                "{case}: the orphan must not rotate"
+            );
+            assert!(
+                !ec_context.ec_generated(),
+                "{case}: nothing should be marked as generated"
+            );
+            assert!(
+                get_header(&response, "set-cookie").is_none(),
+                "{case}: no replacement cookie should be written"
+            );
+            assert_eq!(
+                ec_context.kv_snapshot(),
+                &EcKvSnapshot::Failed {
+                    ec_id: orphan_kv_key,
+                },
+                "{case}: the orphan's key should carry a failed snapshot"
+            );
+        }
+    }
+
+    #[test]
+    fn an_orphan_rotation_applies_the_replacement_modules_response_headers() {
+        // A returning visitor runs no generation earlier in the request, so the
+        // headers the module asks for while creating the replacement reach
+        // the response through the rotation alone.
+        let settings = create_test_settings();
+        let mut ec_context = orphan_context(
+            "t0eh~orphaned-value",
+            Some("192.0.2.10"),
+            std::sync::Arc::new(EvidenceHeaderModule),
+        );
+        let graph = KvIdentityGraph::in_memory("test_store");
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        assert_eq!(
+            ec_context.ec_value(),
+            Some("t0eh~evidence-id"),
+            "the orphan should rotate to the module's replacement"
+        );
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should render set-cookie as utf-8"))
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("vendor-ev=abc")),
+            "the module's cookie should reach the response, got {cookies:?}"
+        );
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("ts-ec=t0eh~evidence-id")),
+            "the replacement Edge Cookie should be written, got {cookies:?}"
+        );
+        assert!(
+            response
+                .headers()
+                .get_all(http::header::VARY)
+                .iter()
+                .any(|value| value == "sec-ch-ua"),
+            "the module's Vary should reach the response"
+        );
+    }
+
     #[test]
     fn finalize_does_not_rotate_when_the_existence_check_fails() {
         // Absence is unprovable when the list itself errors. Rotation abandons a
@@ -1589,6 +1878,7 @@ mod tests {
             false,
             true,
             Jurisdiction::NonRegulated,
+            true,
         );
         ec_context.set_kv_snapshot(EcKvSnapshot::Missing {
             ec_id: generated_ec,
@@ -1615,7 +1905,7 @@ mod tests {
     #[test]
     fn finalize_denied_without_cookie_is_noop() {
         let settings = create_test_settings();
-        let mut ec_context = make_context(None, None, false, false, Jurisdiction::Unknown);
+        let mut ec_context = make_context(None, None, false, false, Jurisdiction::Unknown, false);
         let mut response = empty_response();
 
         let test_registry = PartnerRegistry::empty();
@@ -1640,7 +1930,12 @@ mod tests {
     }
 
     #[test]
-    fn finalize_unknown_jurisdiction_strips_headers_without_expiring_cookie() {
+    fn finalize_not_permitted_without_withdrawal_keeps_cookie() {
+        // When EC is not permitted (here a fail-closed unknown jurisdiction with
+        // no geo) but the request carries no explicit withdrawal signal, the
+        // response strips EC headers yet must leave an already-issued cookie
+        // intact. A pre-consent or transient fail-closed request must not
+        // permanently withdraw a returning user before they get to consent.
         let settings = create_test_settings();
         let ec_id = sample_ec_id("unk001");
         let mut ec_context = make_context(
@@ -1649,6 +1944,7 @@ mod tests {
             true,
             false,
             Jurisdiction::Unknown,
+            false,
         );
         let mut response = empty_response();
         set_header(&mut response, "x-ts-ec", &ec_id);
@@ -1667,15 +1963,424 @@ mod tests {
 
         assert!(
             get_header(&response, "x-ts-ec").is_none(),
-            "should strip EC header when consent cannot be verified"
+            "should strip EC header when EC is not permitted"
         );
         assert!(
             get_header(&response, "x-ts-eids").is_none(),
-            "should strip EID header when consent cannot be verified"
+            "should strip EID header when EC is not permitted"
         );
         assert!(
             get_header(&response, "set-cookie").is_none(),
-            "should not expire the cookie without an explicit withdrawal signal"
+            "a not-permitted request without a withdrawal signal should keep the cookie"
+        );
+    }
+
+    #[test]
+    fn set_ec_cookie_on_response_writes_the_ts_ec_cookie() {
+        // The positive case: when an EC value is present, the finalize path
+        // writes the ts-ec cookie to the browser, carrying the EC id.
+        let settings = create_test_settings();
+        let ec_id = sample_ec_id("setck1");
+        let ec_context = make_context(
+            Some(&ec_id),
+            None,
+            false,
+            true,
+            Jurisdiction::NonRegulated,
+            true,
+        );
+        let mut response = empty_response();
+
+        set_ec_cookie_on_response(&settings, &ec_context, &mut response);
+
+        let set_cookie =
+            get_header_str(&response, "set-cookie").expect("an EC value should write a Set-Cookie");
+        assert!(
+            set_cookie.contains("ts-ec=") && set_cookie.contains(&ec_id),
+            "should write the ts-ec cookie carrying the EC id, got: {set_cookie}"
+        );
+    }
+
+    #[test]
+    fn the_consent_gate_decides_whether_a_generated_ec_cookie_is_written() {
+        // The generated identifier has a backing row and a snapshot bound to
+        // it, so the backing-row guard would let the cookie through and the
+        // consent gate is the only thing that can withhold it.
+        let settings = create_test_settings();
+        for (case, gate_open) in [("an open gate", true), ("a closed gate", false)] {
+            let ec_id = sample_ec_id("gated1");
+            let graph = KvIdentityGraph::in_memory("test_store");
+            graph
+                .create(&ec_id, &live_entry())
+                .expect("should seed the generated identifier's row");
+            let mut ec_context = make_context(
+                Some(&ec_id),
+                None,
+                false,
+                true,
+                Jurisdiction::NonRegulated,
+                gate_open,
+            );
+            ec_context.set_kv_snapshot(EcKvSnapshot::Present {
+                ec_id: ec_id.clone(),
+                entry: Box::new(live_entry()),
+                generation: None,
+            });
+            let mut response = empty_response();
+
+            ec_finalize_response(
+                &settings,
+                &mut ec_context,
+                Some(&graph),
+                &PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+
+            let wrote_ec_cookie = response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .any(|cookie| cookie.starts_with("ts-ec=") && cookie.contains(&ec_id));
+            assert_eq!(
+                wrote_ec_cookie, gate_open,
+                "{case}: the ts-ec cookie should be written only when the consent gate is open"
+            );
+        }
+    }
+
+    #[test]
+    fn withdrawal_tombstones_the_canonical_row_not_the_cookie_value() {
+        // The tombstone is the authoritative revocation marker, so it has to
+        // land on the key the live row uses. Written under the raw cookie
+        // value it creates a second row nothing reads, and the revocation
+        // never takes effect for a module whose canonical form differs.
+        let settings = create_test_settings();
+        let graph = graph_with_live_canonical_row();
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+            gpc: true,
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        let mut ec_context = canonicalizing_context(true, false, consent, false);
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let (live_row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the canonical row")
+            .expect("the canonical row should still exist");
+        assert!(
+            !live_row.consent.ok,
+            "withdrawal should tombstone the row the live identifier is keyed by"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_COOKIE_VALUE)
+                .expect("should read the graph")
+                .is_none(),
+            "withdrawal should not write a tombstone under the raw cookie value"
+        );
+    }
+
+    #[test]
+    fn eid_ingestion_keys_by_the_modules_canonical_form() {
+        // An ingested EID must join the row the identifier already has. Keyed
+        // by the raw cookie value the upsert finds no row and the partner ID
+        // is dropped.
+        let settings = create_test_settings();
+        let graph = graph_with_live_canonical_row();
+        let partners = vec![make_partner("sharedid.org")];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::NonRegulated,
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        let mut ec_context = canonicalizing_context(true, false, consent, true);
+        ec_context.set_eid_sync_source(EidSyncSource::Navigation);
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &registry,
+            None,
+            Some("shared-cookie-id"),
+            &mut response,
+        );
+
+        let (row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the canonical row")
+            .expect("the canonical row should still exist");
+        assert_eq!(
+            row.ids.get("sharedid.org").map(|id| id.uid.as_str()),
+            Some("shared-cookie-id"),
+            "the ingested EID should land on the row keyed by the canonical form"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_COOKIE_VALUE)
+                .expect("should read the graph")
+                .is_none(),
+            "EID ingestion should not create a row under the raw cookie value"
+        );
+    }
+
+    /// A module that sets one cookie of its own and one `Vary` entry, the
+    /// two response effects a module realistically asks for, so a test can
+    /// watch both land on a response the origin already wrote headers to.
+    #[derive(Debug)]
+    struct EvidenceHeaderModule;
+
+    impl crate::ec::module::EdgeCookieModule for EvidenceHeaderModule {
+        fn id(&self) -> &'static str {
+            "evidence-header"
+        }
+
+        fn code(&self) -> crate::ec::module::ModuleCode {
+            crate::module_code!("t0eh")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn crate::evidence::RequestInfo,
+            _input: &crate::ec::module::IdentityInput<'_>,
+        ) -> Result<
+            crate::ec::module::GeneratedEdgeCookie,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Ok(crate::ec::module::GeneratedEdgeCookie {
+                id: Some("evidence-id".to_owned()),
+                response_headers: vec![
+                    (
+                        http::header::SET_COOKIE,
+                        HeaderValue::from_static("vendor-ev=abc; Path=/"),
+                    ),
+                    (http::header::VARY, HeaderValue::from_static("sec-ch-ua")),
+                ],
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    #[test]
+    fn module_response_headers_reach_the_response_without_dropping_the_origins() {
+        // The response finalization runs on is the finished one, so it already
+        // carries the publisher origin's own headers. A module effect must
+        // add to those, never replace them: replacing `Set-Cookie` would drop
+        // the publisher's session and sign-in cookies, and replacing `Vary`
+        // would break the caching the origin asked for.
+        let settings = create_test_settings();
+        let graph = KvIdentityGraph::in_memory("finalize-module-headers-store");
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::NonRegulated,
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        let mut ec_context = make_context_with_consent(None, None, false, false, consent, true)
+            .with_module_for_test(std::sync::Arc::new(EvidenceHeaderModule));
+        ec_context
+            .generate_if_needed(&settings, Some(&graph))
+            .expect("should create the identifier through the module");
+
+        // What the publisher's origin returned, before EC finalization runs.
+        let mut response = empty_response();
+        response.headers_mut().append(
+            http::header::SET_COOKIE,
+            HeaderValue::from_static("publisher_session=origin-value; Path=/; HttpOnly"),
+        );
+        response.headers_mut().append(
+            http::header::VARY,
+            HeaderValue::from_static("accept-encoding"),
+        );
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should render set-cookie as utf-8"))
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("publisher_session=origin-value")),
+            "the origin's own cookie must survive a module effect, got {cookies:?}"
+        );
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("vendor-ev=abc")),
+            "the module's cookie must reach the response, got {cookies:?}"
+        );
+        assert!(
+            cookies.iter().any(|cookie| cookie.starts_with("ts-ec=")),
+            "core's own managed cookie must still be written, got {cookies:?}"
+        );
+
+        let vary: Vec<&str> = response
+            .headers()
+            .get_all(http::header::VARY)
+            .iter()
+            .map(|value| value.to_str().expect("should render vary as utf-8"))
+            .collect();
+        assert!(
+            vary.contains(&"accept-encoding"),
+            "the origin's Vary must survive a module effect, got {vary:?}"
+        );
+        assert!(
+            vary.contains(&"sec-ch-ua"),
+            "the module's Vary must reach the response, got {vary:?}"
+        );
+    }
+
+    /// A module standing in for the one a deployment switched *to*, with a
+    /// different registered code from the module that created the live row.
+    #[derive(Debug)]
+    struct SwitchedModule;
+
+    impl crate::ec::module::EdgeCookieModule for SwitchedModule {
+        fn id(&self) -> &'static str {
+            "switched"
+        }
+
+        fn code(&self) -> crate::ec::module::ModuleCode {
+            crate::module_code!("t0sw")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn crate::evidence::RequestInfo,
+            _input: &crate::ec::module::IdentityInput<'_>,
+        ) -> Result<
+            crate::ec::module::GeneratedEdgeCookie,
+            error_stack::Report<crate::error::TrustedServerError>,
+        > {
+            Ok(crate::ec::module::GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_ascii_lowercase()
+        }
+    }
+
+    #[test]
+    fn switching_module_leaves_the_previous_modules_row_beyond_withdrawal() {
+        // A retired module's identifier is owned by nobody this deployment
+        // reads, so a later withdrawal expires the browser cookie but cannot
+        // tombstone the row, and the identifier is never adopted either.
+        let settings = create_test_settings();
+        let graph = graph_with_live_canonical_row();
+        // A TCF record consenting to nothing, under GDPR, so the request
+        // carries an explicit refusal of storage. That is the narrow,
+        // destructive kind of withdrawal, the one that tombstones rather than
+        // merely suppressing, which is the behavior under test.
+        let consent = ConsentContext {
+            jurisdiction: Jurisdiction::Gdpr,
+            tcf: Some(crate::consent::TcfConsent {
+                version: 2,
+                cmp_id: 0,
+                cmp_version: 0,
+                consent_screen: 0,
+                consent_language: "EN".to_owned(),
+                vendor_list_version: 0,
+                tcf_policy_version: 2,
+                created_ds: 0,
+                last_updated_ds: 0,
+                purpose_consents: vec![false; 24],
+                purpose_legitimate_interests: vec![false; 24],
+                vendor_consents: Vec::new(),
+                vendor_legitimate_interests: Vec::new(),
+                special_feature_opt_ins: vec![false; 12],
+            }),
+            source: ConsentSource::Cookie,
+            ..Default::default()
+        };
+        // The browser still carries the identifier the previous module
+        // created, but the deployment now runs a module with a different
+        // code, so read-back treats the cookie as absent and the active
+        // identifier is empty.
+        let mut ec_context = make_context_with_consent(
+            None,
+            Some(CANONICAL_COOKIE_VALUE),
+            false,
+            false,
+            consent,
+            false,
+        )
+        .with_module_for_test(std::sync::Arc::new(SwitchedModule));
+        let mut response = empty_response();
+
+        ec_finalize_response(
+            &settings,
+            &mut ec_context,
+            Some(&graph),
+            &PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        assert!(
+            ec_context.ec_value().is_none(),
+            "the retired module's identifier must never be adopted by the new one"
+        );
+
+        let (row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the previous module's row")
+            .expect("the previous module's row should still exist");
+        assert!(
+            row.consent.ok,
+            "withdrawal cannot reach a retired module's row without the module that owns the code"
+        );
+
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .map(|value| value.to_str().expect("should render set-cookie as utf-8"))
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("ts-ec=") && cookie.contains("Max-Age=0")),
+            "withdrawal should still expire the browser cookie after a switch, got {cookies:?}"
         );
     }
 
@@ -1700,7 +2405,8 @@ mod tests {
             Some(orphan.to_owned()),
             granting_consent(),
             Some("192.0.2.10".to_owned()),
-        );
+        )
+        .with_module_for_test(crate::ec::tests::hmac_module());
         ec.set_recovery_eligible(recovery_eligible);
         ec.set_kv_snapshot(snapshot);
         ec
@@ -1836,8 +2542,14 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context =
-            make_context_with_consent(Some(&active_ec), Some(&cookie_ec), true, false, consent);
+        let mut ec_context = make_context_with_consent(
+            Some(&active_ec),
+            Some(&cookie_ec),
+            true,
+            false,
+            consent,
+            false,
+        );
         // Carry a snapshot only for the active ID; the other ID must be looked up
         // independently and never created if absent.
         let graph = KvIdentityGraph::in_memory("test_store");
@@ -1882,8 +2594,14 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context =
-            make_context_with_consent(Some(&active_ec), Some(&cookie_ec), true, false, consent);
+        let mut ec_context = make_context_with_consent(
+            Some(&active_ec),
+            Some(&cookie_ec),
+            true,
+            false,
+            consent,
+            false,
+        );
         let graph = KvIdentityGraph::in_memory("test_store");
         graph
             .create(
@@ -1977,7 +2695,7 @@ mod tests {
             ..Default::default()
         };
         let mut ec_context =
-            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent);
+            make_context_with_consent(Some(&ec_id), Some(&ec_id), true, false, consent, false);
         ec_context.set_pull_sync_marker_for_test(
             crate::ec::pull_sync_marker::PullSyncMarkerState::Invalid,
         );
@@ -2035,6 +2753,7 @@ mod tests {
             true,
             false,
             Jurisdiction::NonRegulated,
+            true,
         );
         let mut entry = live_entry();
         entry.ids.insert(
@@ -2083,7 +2802,7 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context = make_context_with_consent(None, None, false, false, consent);
+        let mut ec_context = make_context_with_consent(None, None, false, false, consent, false);
         let mut response = empty_response();
 
         ec_finalize_response(
@@ -2111,7 +2830,7 @@ mod tests {
             source: ConsentSource::Cookie,
             ..Default::default()
         };
-        let mut ec_context = make_context_with_consent(None, None, false, false, consent);
+        let mut ec_context = make_context_with_consent(None, None, false, false, consent, false);
         ec_context.set_pull_sync_marker_for_test(
             crate::ec::pull_sync_marker::PullSyncMarkerState::Invalid,
         );
diff --git a/crates/trusted-server-core/src/ec/generation.rs b/crates/trusted-server-core/src/ec/generation.rs
index 2924b7692..695be1c63 100644
--- a/crates/trusted-server-core/src/ec/generation.rs
+++ b/crates/trusted-server-core/src/ec/generation.rs
@@ -1,7 +1,8 @@
 //! Edge Cookie (EC) ID generation using HMAC.
 //!
-//! This module generates EC IDs from the client IP address and a configured
-//! secret key.
+//! This module creates EC IDs as an HMAC, keyed by a configured secret, over
+//! one or more request parts such as the client IP, and holds the format
+//! helpers for the built-in HMAC identifier.
 
 use std::net::IpAddr;
 
@@ -10,8 +11,8 @@ use hmac::{Hmac, Mac};
 use rand::Rng;
 use sha2::Sha256;
 
+use crate::ec::module::{HMAC_MODULE_CODE, MODULE_CODE_SEPARATOR, split_module_code};
 use crate::error::TrustedServerError;
-use crate::settings::Settings;
 
 type HmacSha256 = Hmac<Sha256>;
 
@@ -73,7 +74,7 @@ fn generate_random_suffix(length: usize) -> String {
 /// the client IP address, then appends a random suffix for additional
 /// uniqueness. The resulting format is `{64hex}.{6alnum}`.
 ///
-/// **Important:** `client_ip` must be pre-normalized via [`extract_client_ip`].
+/// **Important:** `client_ip` must be pre-normalized with `normalize_ip`.
 /// Raw IPv6 addresses produce different hashes than their normalized /64
 /// form, which would create duplicate identity graph entries.
 ///
@@ -81,19 +82,40 @@ fn generate_random_suffix(length: usize) -> String {
 ///
 /// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
 pub fn generate_ec_id(
-    settings: &Settings,
+    passphrase: &str,
     client_ip: &str,
 ) -> Result<String, Report<TrustedServerError>> {
-    let mut mac = HmacSha256::new_from_slice(settings.ec.passphrase.expose().as_bytes())
-        .change_context(TrustedServerError::EdgeCookie {
+    generate_hmac_ec_id(passphrase, &[client_ip])
+}
+
+/// Creates an Edge Cookie identifier as HMAC-SHA256 over the given parts plus a
+/// random suffix, in the `{64hex}.{6alnum}` format.
+///
+/// The parts are joined with a unit separator (`\u{1f}`), which cannot appear in
+/// a client IP, User-Agent, or TLS and HTTP/2 signal, so distinct part lists
+/// cannot collide. A module that derives identity from multiple request
+/// signals, for example a TLS fingerprint, HTTP/2 settings and the client IP,
+/// passes them as separate parts. Each part must be pre-normalized by the
+/// caller.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
+pub fn generate_hmac_ec_id(
+    passphrase: &str,
+    parts: &[&str],
+) -> Result<String, Report<TrustedServerError>> {
+    let mut mac = HmacSha256::new_from_slice(passphrase.as_bytes()).change_context(
+        TrustedServerError::EdgeCookie {
             message: "Failed to create HMAC instance".to_string(),
-        })?;
-    mac.update(client_ip.as_bytes());
+        },
+    )?;
+    // A unit separator cannot occur in any part, so distinct lists never collide.
+    mac.update(parts.join("\u{1f}").as_bytes());
     let hmac_hash = hex::encode(mac.finalize().into_bytes());
 
-    // Append random 6-character alphanumeric suffix for additional uniqueness.
-    let random_suffix = generate_random_suffix(6);
-    let ec_id = format!("{hmac_hash}.{random_suffix}");
+    // Append a random 6-character alphanumeric suffix for additional uniqueness.
+    let ec_id = format!("{hmac_hash}.{}", generate_random_suffix(6));
 
     log::trace!("Generated fresh EC ID: {}", super::log_id(&ec_id));
 
@@ -120,12 +142,33 @@ pub fn ec_hash(ec_id: &str) -> &str {
 /// so internal EC IDs are already lowercase. This normalization is a
 /// defense-in-depth measure for EC IDs submitted by external partners
 /// (via batch sync) that may use uppercase hex.
+///
+/// A created identifier carries the built-in module's code envelope
+/// (`hmac~` before the value, see
+/// [`MODULE_CODE_SEPARATOR`](super::module::MODULE_CODE_SEPARATOR)),
+/// and partners echo that form back, so the envelope is kept and only the
+/// value inside it is lowercased. That keeps the key identical to the one
+/// written at creation. An identifier under any other module's code is not
+/// HMAC-shaped and is returned unchanged, because only that module knows
+/// how to normalize it.
 #[must_use]
 pub fn normalize_ec_id_for_kv(ec_id: &str) -> String {
-    let mut parts = ec_id.splitn(2, '.');
+    let (code, bare) = match split_module_code(ec_id) {
+        (Some(code), bare) if code == HMAC_MODULE_CODE.as_str() => (Some(code), bare),
+        (Some(_), _) => return ec_id.to_owned(),
+        (None, bare) => (None, bare),
+    };
+    let mut parts = bare.splitn(2, '.');
     let hash = parts.next().unwrap_or_default();
     let suffix = parts.next().unwrap_or_default();
-    format!("{}.{}", hash.to_ascii_lowercase(), suffix)
+    match code {
+        Some(code) => format!(
+            "{code}{MODULE_CODE_SEPARATOR}{}.{}",
+            hash.to_ascii_lowercase(),
+            suffix
+        ),
+        None => format!("{}.{}", hash.to_ascii_lowercase(), suffix),
+    }
 }
 
 /// Checks whether a string is a valid 64-character hex EC hash prefix.
@@ -139,17 +182,35 @@ pub fn is_valid_ec_hash(value: &str) -> bool {
     value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit())
 }
 
-/// Checks whether a string matches the expected EC ID format.
+/// Checks whether a string is a built-in HMAC identifier, bare or enveloped.
 ///
-/// The format is `{64hex}.{6alnum}` where the first part is a 64-character
-/// **lowercase** hex string and the second part is a 6-character alphanumeric
-/// string. Only lowercase hex is accepted; callers must normalize before
-/// validation to prevent duplicate KV keys from case-variant EC IDs. The HMAC
-/// prefix is lowercase because it comes from `hex::encode`; the random suffix
-/// allows mixed-case alphanumeric characters by construction.
+/// The bare format is `{64hex}.{6alnum}` where the first part is a
+/// 64-character **lowercase** hex string and the second part is a 6-character
+/// alphanumeric string. Only lowercase hex is accepted; callers must
+/// normalize before validation to prevent duplicate KV keys from case-variant
+/// EC IDs. The HMAC prefix is lowercase because it comes from `hex::encode`;
+/// the random suffix allows mixed-case alphanumeric characters by
+/// construction.
+///
+/// An identifier this module creates carries the module-code envelope,
+/// `hmac~` before the bare value, so both the enveloped and the legacy bare
+/// form are accepted here. An identifier under any other module's code is
+/// not an HMAC identifier and is rejected.
+///
+/// This is the built-in module's grammar, not the deployment's. The
+/// partner-facing paths (pull sync, batch sync, the admin lookup) dispatch by
+/// module code through
+/// [`AcceptedModules`](super::module::AcceptedModules), which reaches
+/// this only for an identifier the built-in module owns, or as the fallback
+/// for a stateless deployment that has selected no module at all.
 #[must_use]
 pub fn is_valid_ec_id(value: &str) -> bool {
-    let mut parts = value.split('.');
+    let bare = match split_module_code(value) {
+        (Some(code), bare) if code == HMAC_MODULE_CODE.as_str() => bare,
+        (Some(_), _) => return false,
+        (None, bare) => bare,
+    };
+    let mut parts = bare.split('.');
     let Some(hmac_part) = parts.next() else {
         return false;
     };
@@ -175,7 +236,39 @@ mod tests {
     use super::*;
     use std::net::{Ipv4Addr, Ipv6Addr};
 
-    use crate::test_support::tests::create_test_settings;
+    const TEST_PASSPHRASE: &str = "test-secret-key-32-bytes-minimum";
+
+    #[test]
+    fn generate_hmac_ec_id_is_stable_per_parts_and_collision_resistant() {
+        // The 64-char hex prefix is HMAC over the parts and is stable for the
+        // same parts; the random suffix varies, so compare prefixes only.
+        let prefix = |parts: &[&str]| {
+            generate_hmac_ec_id(TEST_PASSPHRASE, parts)
+                .expect("should generate")
+                .split('.')
+                .next()
+                .expect("should have a prefix")
+                .to_owned()
+        };
+
+        assert_eq!(
+            prefix(&["a", "b"]),
+            prefix(&["a", "b"]),
+            "the same parts should yield the same stable prefix"
+        );
+        assert_ne!(
+            prefix(&["a", "b"]),
+            prefix(&["a", "c"]),
+            "different parts should yield a different prefix"
+        );
+        // The unit separator prevents a join collision: ["a", "b"] must not hash
+        // the same as ["ab"].
+        assert_ne!(
+            prefix(&["a", "b"]),
+            prefix(&["ab"]),
+            "the separator should prevent ['a','b'] colliding with ['ab']"
+        );
+    }
 
     #[test]
     fn normalize_ipv4_unchanged() {
@@ -215,8 +308,7 @@ mod tests {
 
     #[test]
     fn generate_produces_valid_format() {
-        let settings = create_test_settings();
-        let ec_id = generate_ec_id(&settings, "192.168.1.1").expect("should generate EC ID");
+        let ec_id = generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate EC ID");
         assert!(
             is_valid_ec_id(&ec_id),
             "should match EC ID format: {{64hex}}.{{6alnum}}, got: {ec_id}"
@@ -225,10 +317,10 @@ mod tests {
 
     #[test]
     fn generate_same_ip_produces_consistent_hash_prefix() {
-        let settings = create_test_settings();
-        let first = generate_ec_id(&settings, "192.168.1.1").expect("should generate first EC ID");
+        let first =
+            generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate first EC ID");
         let second =
-            generate_ec_id(&settings, "192.168.1.1").expect("should generate second EC ID");
+            generate_ec_id(TEST_PASSPHRASE, "192.168.1.1").expect("should generate second EC ID");
 
         assert_eq!(
             ec_hash(&first),
@@ -281,44 +373,50 @@ mod tests {
     }
 
     #[test]
-    fn is_valid_ec_id_accepts_valid() {
-        let value = format!("{}.Ab12z9", "a".repeat(64));
-        assert!(is_valid_ec_id(&value), "should accept a valid EC ID format");
-    }
-
-    #[test]
-    fn is_valid_ec_id_rejects_missing_suffix() {
-        let missing_suffix = "a".repeat(64);
-        assert!(
-            !is_valid_ec_id(&missing_suffix),
-            "should reject missing suffix"
-        );
-    }
-
-    #[test]
-    fn is_valid_ec_id_rejects_invalid_hex() {
-        let invalid_hex = format!("{}.Ab12z9", "a".repeat(63) + "g");
-        assert!(
-            !is_valid_ec_id(&invalid_hex),
-            "should reject non-hex HMAC content"
-        );
+    fn is_valid_ec_id_accepts_only_the_hmac_grammar() {
+        let hash = "a".repeat(64);
+        for (input, expected, reason) in [
+            (format!("{hash}.Ab12z9"), true, "a valid EC ID format"),
+            (hash.clone(), false, "a missing suffix"),
+            (
+                format!("{}.Ab12z9", "a".repeat(63) + "g"),
+                false,
+                "non-hex HMAC content",
+            ),
+            (format!("{hash}.ab-129"), false, "a non-alphanumeric suffix"),
+            (format!("{hash}.Ab12z9.zz"), false, "an extra segment"),
+            (
+                format!("hmac~{hash}.ABC123"),
+                true,
+                "a created identifier carrying the hmac code",
+            ),
+            (
+                format!("t0op~{hash}.ABC123"),
+                false,
+                "an identifier carrying another module's code",
+            ),
+        ] {
+            assert_eq!(
+                is_valid_ec_id(&input),
+                expected,
+                "{reason} should be {}: {input}",
+                if expected { "accepted" } else { "rejected" }
+            );
+        }
     }
 
     #[test]
-    fn is_valid_ec_id_rejects_invalid_suffix() {
-        let invalid_suffix = format!("{}.ab-129", "a".repeat(64));
-        assert!(
-            !is_valid_ec_id(&invalid_suffix),
-            "should reject non-alphanumeric suffix"
+    fn normalize_ec_id_for_kv_keeps_the_hmac_envelope() {
+        let coded = format!("hmac~{}.ABC123", "A".repeat(64));
+        assert_eq!(
+            normalize_ec_id_for_kv(&coded),
+            format!("hmac~{}.ABC123", "a".repeat(64)),
+            "should lowercase the hash and keep the code prefix"
         );
-    }
-
-    #[test]
-    fn is_valid_ec_id_rejects_extra_segments() {
-        let extra_segment = format!("{}.Ab12z9.zz", "a".repeat(64));
-        assert!(
-            !is_valid_ec_id(&extra_segment),
-            "should reject extra segments"
+        assert_eq!(
+            normalize_ec_id_for_kv("t0op~MixedCase"),
+            "t0op~MixedCase",
+            "should leave another module's identifier unchanged"
         );
     }
 }
diff --git a/crates/trusted-server-core/src/ec/identify.rs b/crates/trusted-server-core/src/ec/identify.rs
index 94464d1a5..cf017a04a 100644
--- a/crates/trusted-server-core/src/ec/identify.rs
+++ b/crates/trusted-server-core/src/ec/identify.rs
@@ -10,7 +10,6 @@ use http::{Request, Response, StatusCode};
 use url::Url;
 
 use super::auth::authenticate_bearer;
-use super::consent::ec_consent_granted;
 use crate::error::TrustedServerError;
 use crate::openrtb::{Eid, Uid};
 use crate::settings::Settings;
@@ -62,7 +61,7 @@ pub fn handle_identify(
         );
     };
 
-    if !ec_consent_granted(ec_context.consent()) {
+    if !ec_context.ec_allowed() {
         return json_response_with_origin(
             StatusCode::FORBIDDEN,
             &serde_json::json!({ "consent": "denied" }),
@@ -87,40 +86,53 @@ pub fn handle_identify(
     let mut uid: Option<String> = None;
     let mut cluster_size: Option<u32> = None;
 
-    match kv.get(ec_id) {
-        Ok(Some((entry, generation))) => {
-            if !entry.consent.ok {
-                // Tombstone entries preserve the withdrawal signal for 24 hours.
-                // Do not extract IDs or evaluate cluster size because that would
-                // write back with the live-entry TTL.
-                log::trace!("Identify found tombstone for '{}'", log_id(ec_id));
-            } else {
-                // Extract only this partner's UID.
-                if let Some(partner_uid) = entry.ids.get(&partner.source_domain)
-                    && !partner_uid.uid.is_empty()
-                {
-                    uid = Some(partner_uid.uid.clone());
-                }
-
-                // Evaluate cluster size lazily for identify responses. Existing
-                // stored cluster_size values are reused without a prefix-list call.
-                match kv.evaluate_cluster(ec_id, &entry, generation) {
-                    Ok(size) => {
-                        cluster_size = size;
+    // Read the identity-graph row under the module's canonical form of the
+    // identifier, the same key generation wrote, rather than under the value the
+    // browser carries. The two are the same string for the built-in HMAC
+    // module and differ for any module whose canonical form is not the
+    // cookie value. `None` means no module this deployment reads owns the
+    // identifier, so there is no row to look for and the response is not
+    // degraded.
+    if let Some(kv_key) = ec_context.ec_kv_key() {
+        match kv.get(&kv_key) {
+            Ok(Some((entry, generation))) => {
+                if !entry.consent.ok {
+                    // Tombstone entries preserve the withdrawal signal for 24
+                    // hours. Do not extract IDs or evaluate cluster size because
+                    // that would write back with the live-entry TTL.
+                    log::trace!("Identify found tombstone for '{}'", log_id(&kv_key));
+                } else {
+                    // Extract only this partner's UID.
+                    if let Some(partner_uid) = entry.ids.get(&partner.source_domain)
+                        && !partner_uid.uid.is_empty()
+                    {
+                        uid = Some(partner_uid.uid.clone());
                     }
-                    Err(err) => {
-                        log::warn!("Cluster evaluation failed for '{}': {err:?}", log_id(ec_id));
+
+                    // Evaluate cluster size lazily for identify responses.
+                    // Existing stored cluster_size values are reused without a
+                    // prefix-list call.
+                    match kv.evaluate_cluster(&kv_key, &entry, generation) {
+                        Ok(size) => {
+                            cluster_size = size;
+                        }
+                        Err(err) => {
+                            log::warn!(
+                                "Cluster evaluation failed for '{}': {err:?}",
+                                log_id(&kv_key)
+                            );
+                        }
                     }
                 }
             }
-        }
-        Ok(None) => {}
-        Err(err) => {
-            log::warn!(
-                "Identify KV read failed for EC ID '{}': {err:?}",
-                log_id(ec_id)
-            );
-            degraded = true;
+            Ok(None) => {}
+            Err(err) => {
+                log::warn!(
+                    "Identify KV read failed for EC ID '{}': {err:?}",
+                    log_id(&kv_key)
+                );
+                degraded = true;
+            }
         }
     }
 
@@ -332,9 +344,9 @@ fn apply_cors_headers(response: &mut Response<EdgeBody>, origin: &str) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
     use crate::ec::registry::PartnerRegistry;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
     use crate::test_support::tests::create_test_settings;
@@ -352,13 +364,12 @@ mod tests {
         );
     }
 
-    fn make_ec_context(jurisdiction: Jurisdiction, ec_value: Option<&str>) -> EcContext {
+    fn make_ec_context(ec_allowed: bool, ec_value: Option<&str>) -> EcContext {
         let consent = ConsentContext {
-            jurisdiction,
             source: ConsentSource::Cookie,
             ..ConsentContext::default()
         };
-        EcContext::new_for_test(ec_value.map(str::to_owned), consent)
+        EcContext::new_for_test_gated(ec_value.map(str::to_owned), consent, ec_allowed)
     }
 
     fn make_test_partner(source_domain: &str, api_token: &str) -> EcPartner {
@@ -472,7 +483,7 @@ mod tests {
             .uri("https://edge.test-publisher.com/identify")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct unauthorized response");
@@ -514,7 +525,7 @@ mod tests {
             .header("authorization", "Bearer wrong-token")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct unauthorized response");
@@ -539,7 +550,7 @@ mod tests {
             .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::Unknown, None);
+        let ec_context = make_ec_context(false, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct denied response");
@@ -573,7 +584,7 @@ mod tests {
             .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct no-content response");
@@ -599,7 +610,7 @@ mod tests {
             .body(EdgeBody::empty())
             .expect("should build test request");
         let ec_id = format!("{}.ABC123", "a".repeat(64));
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, Some(&ec_id));
+        let ec_context = make_ec_context(true, Some(&ec_id));
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct degraded identify response");
@@ -652,7 +663,7 @@ mod tests {
             .header("origin", "https://evil.example")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct forbidden response");
@@ -678,7 +689,7 @@ mod tests {
             .header("origin", "https://www.test-publisher.com")
             .body(EdgeBody::empty())
             .expect("should build test request");
-        let ec_context = make_ec_context(Jurisdiction::NonRegulated, None);
+        let ec_context = make_ec_context(true, None);
 
         let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
             .expect("should construct no-content response with CORS headers");
@@ -756,4 +767,55 @@ mod tests {
             "should vary on identity request inputs for preflight"
         );
     }
+
+    #[test]
+    fn handle_identify_reads_the_row_under_the_modules_canonical_key() {
+        // A module whose canonical form is not the cookie value keys its row
+        // under the canonical form at generation. Identify has to look there,
+        // or every such deployment reads a miss for every request and reports
+        // no partner UID at all.
+        let settings = create_test_settings();
+        let kv = KvIdentityGraph::in_memory("identify-canonical-store");
+        kv.create(
+            CANONICAL_KV_KEY,
+            &crate::ec::kv_types::KvEntry::minimal(
+                "ssp.example.com",
+                "partner-uid-123",
+                1_741_824_000,
+            ),
+        )
+        .expect("should write the row generation keys by the canonical form");
+        let partners = vec![make_test_partner("ssp.example.com", VALID_API_TOKEN)];
+        let registry = PartnerRegistry::from_config(&partners).expect("should build registry");
+        let req = Request::builder()
+            .method("GET")
+            .uri("https://edge.test-publisher.com/identify")
+            .header("authorization", format!("Bearer {VALID_API_TOKEN}"))
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        let ec_context = make_ec_context(true, Some(CANONICAL_COOKIE_VALUE))
+            .with_module_for_test(std::sync::Arc::new(crate::ec::tests::CanonicalizingModule));
+
+        let response = handle_identify(&settings, &kv, &registry, &req, &ec_context)
+            .expect("should build identify response");
+
+        assert_eq!(response.status(), StatusCode::OK, "should return 200");
+        let body = serde_json::from_slice::<serde_json::Value>(
+            &response.into_body().into_bytes().unwrap_or_default(),
+        )
+        .expect("should decode identify response JSON");
+        assert_eq!(
+            body["ec"], CANONICAL_COOKIE_VALUE,
+            "should echo the identifier the browser carries, not the graph key"
+        );
+        assert_eq!(
+            body["uid"], "partner-uid-123",
+            "should find the row generation keyed by the module's canonical form"
+        );
+        assert_eq!(
+            body["degraded"],
+            serde_json::Value::Bool(false),
+            "a hit under the canonical key is not a degraded read"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/kv.rs b/crates/trusted-server-core/src/ec/kv.rs
index b0eb83d3f..071ea29d6 100644
--- a/crates/trusted-server-core/src/ec/kv.rs
+++ b/crates/trusted-server-core/src/ec/kv.rs
@@ -1502,6 +1502,13 @@ impl KvIdentityGraph {
         }
 
         // Compute cluster size via prefix list.
+        //
+        // `ec_hash` takes everything before the first `.`, so a coded
+        // identifier yields `hmac~<hash>` and a bare one yields `<hash>`.
+        // Prefix matching is anchored at the start of the key, so bare and
+        // `hmac~` rows for one client IP are counted separately and
+        // `cluster_size` can under-report. The count is reported in identify
+        // responses and gates nothing, and it must not gate a decision.
         let hash_prefix = ec_hash(ec_id);
         let cluster_size = self.count_hash_prefix_keys(hash_prefix)?;
 
diff --git a/crates/trusted-server-core/src/ec/kv_types.rs b/crates/trusted-server-core/src/ec/kv_types.rs
index 589f280c1..8eb1bcc2d 100644
--- a/crates/trusted-server-core/src/ec/kv_types.rs
+++ b/crates/trusted-server-core/src/ec/kv_types.rs
@@ -58,7 +58,9 @@ pub struct KvEntry {
     /// Network cluster disambiguation data.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub network: Option<KvNetwork>,
-    /// Map of partner ID namespace → UID record.
+    /// Map of partner ID namespace to that partner's identifier for the same
+    /// browser on the same device, never an identifier for a person.
+    ///
     /// Populated by pixel sync, batch sync, and pull sync operations.
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub ids: BTreeMap<String, KvPartnerId>,
@@ -181,7 +183,12 @@ pub struct KvDevice {
 ///
 /// Tracks how many distinct EC entries share the same hash prefix. A high
 /// count indicates a shared network (corporate VPN, campus); a low count
-/// indicates an individual or household.
+/// indicates a small one, such as a home connection.
+///
+/// The count is a fact about a network and identifies no person. An Edge
+/// Cookie identifies a browser on a device, and the partner identifiers in
+/// [`KvEntry::ids`] are other parties' identifiers for that same browser and
+/// device.
 ///
 /// Written only by the `/_ts/api/v1/identify` endpoint when `cluster_size` is
 /// missing. Once stored, the value is reused because the EC entry no longer
diff --git a/crates/trusted-server-core/src/ec/mod.rs b/crates/trusted-server-core/src/ec/mod.rs
index 16fd016ea..ebce45f1e 100644
--- a/crates/trusted-server-core/src/ec/mod.rs
+++ b/crates/trusted-server-core/src/ec/mod.rs
@@ -14,14 +14,19 @@
 //! # Module structure
 //!
 //! - auth (private) — shared Bearer-token authentication helpers
+//! - [`admin`]: operator endpoints that show the stored identity state
+//!   (`GET /_ts/admin/ec`)
 //! - [`generation`] — HMAC-based ID generation, IP normalization, format helpers
 //! - [`consent`] — EC-specific consent gating wrapper
 //! - [`cookies`] — `Set-Cookie` header creation and expiration helpers
+//! - [`finalize`]: the cookie and identity-graph writes made on the response
+//!   after routing
 //! - [`kv`] — KV Store identity graph operations (CAS, tombstones, debounce)
 //! - [`kv_backend`] — Platform-neutral KV primitives implemented by adapters
 //! - [`kv_types`] — Schema types for KV identity graph entries
 //! - [`device`]: Device signal derivation (UA, JA4, H2 SETTINGS)
 //! - [`partner`] — Partner validation helpers (ID format, pull sync config)
+//! - [`module`]: Edge Cookie modules and their selection
 //! - [`registry`] — In-memory partner registry built from config
 //! - [`rate_limiter`] — Rate limiting abstraction (implemented by adapters)
 //! - [`identify`] — Identity read endpoint (`GET /_ts/api/v1/identify`)
@@ -43,6 +48,7 @@ pub mod identify;
 pub mod kv;
 pub mod kv_backend;
 pub mod kv_types;
+pub mod module;
 pub mod partner;
 pub mod prebid_eids;
 pub mod pull_sync;
@@ -67,6 +73,8 @@ pub fn log_id(ec_id: &str) -> String {
     format!("{prefix}\u{2026}")
 }
 
+use std::sync::Arc;
+
 use cookie::CookieJar;
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
@@ -77,10 +85,12 @@ use crate::constants::{COOKIE_TS_EC, COOKIE_TS_EC_PULL_COMPLETE};
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 use crate::error::TrustedServerError;
+use crate::evidence::BorrowedRequestInfo;
 use crate::geo::GeoInfo;
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 use device::DeviceSignals;
+use module::{EdgeCookieModule, GeneratedEdgeCookie, IdentityInput};
 
 use self::kv::{CreateIfAbsentOutcome, KvIdentityGraph};
 use self::kv_types::KvEntry;
@@ -221,24 +231,6 @@ fn request_ec_id_if_allowed(value: &str, source: &str) -> Option<String> {
     None
 }
 
-/// Gets an existing EC ID from the request.
-///
-/// Attempts to retrieve an existing EC ID from the `ts-ec` cookie.
-///
-/// Returns `None` if the cookie does not contain a valid EC ID.
-///
-/// # Errors
-///
-/// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
-pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<TrustedServerError>> {
-    let parsed = parse_ec_from_request(req)?;
-    let ec_id = parsed.cookie_ec.filter(|v| is_valid_ec_id(v));
-    if let Some(ref id) = ec_id {
-        log::trace!("Existing EC ID found: {}", log_id(id));
-    }
-    Ok(ec_id)
-}
-
 /// Captures the EC state for a single request lifecycle.
 ///
 /// Created via [`read_from_request`](Self::read_from_request) during
@@ -258,6 +250,10 @@ pub struct EcContext {
     ec_generated: bool,
     /// The consent context for this request.
     consent: ConsentContext,
+    /// Whether Edge Cookie creation is allowed for this request. Resolved once
+    /// at construction: closed when no module is selected, otherwise from the
+    /// request's consent context. Read via [`ec_allowed`](Self::ec_allowed).
+    ec_allowed: bool,
     /// The normalized client IP, captured early before the request body
     /// is consumed. `None` when the platform cannot determine client IP.
     client_ip: Option<String>,
@@ -267,6 +263,30 @@ pub struct EcContext {
     /// Set via [`EcContext::set_device_signals`] before
     /// [`EcContext::generate_if_needed`] is called.
     device_signals: Option<DeviceSignals>,
+    /// The selected Edge Cookie module (built-in or injected), built once at
+    /// construction. Core asks it whether an identifier is well formed
+    /// ([`accepts_id`](crate::ec::module::EdgeCookieModule::accepts_id)) so
+    /// an opaque vendor identifier round-trips through read-back and withdrawal
+    /// instead of being dropped by the built-in shape check. `None` when no
+    /// module is configured.
+    selected_module: Option<Arc<dyn crate::ec::module::EdgeCookieModule>>,
+    /// A snapshot of the request evidence a module reads when it creates an
+    /// identifier, at generation or in orphan recovery: the request headers (so
+    /// a module can read cookies and client hints), and the URL path and query
+    /// string (so it can read request parameters). Captured once at
+    /// construction, when a module is configured and the request either
+    /// carries no usable identifier or is a document navigation, the only
+    /// request that can recover an orphaned one. So a no-module deployment
+    /// and a returning visitor's subresource requests clone nothing. A module
+    /// reads these through [`RequestInfo`](crate::evidence::RequestInfo).
+    request_headers: http::HeaderMap,
+    request_path: String,
+    request_query: String,
+    /// Response headers a module asked to set, captured when it creates an
+    /// identifier (in [`EcContext::generate_if_needed`], or during orphan
+    /// recovery in EC finalization) and applied to the response by EC
+    /// finalization. Empty for modules that set no headers.
+    response_headers: Vec<(http::HeaderName, http::HeaderValue)>,
     /// Request-scoped persisted identity-graph state for the active EC ID.
     kv_snapshot: EcKvSnapshot,
     /// Whether this request may rotate an orphaned EC identity.
@@ -314,13 +334,53 @@ impl EcContext {
     ) -> Result<Self, Report<TrustedServerError>> {
         let parsed = parse_ec_from_request(req)?;
 
-        let ec_value = parsed.cookie_ec.clone().filter(|v| is_valid_ec_id(v));
+        // Take the selected module once. It is used here to decide whether
+        // the incoming cookie value is a usable identifier, and again by
+        // generation, which reuses this one rather than asking for another.
+        // Resolving needs no request data, so an adapter that resolved the
+        // selection while it built application state hands the same instance
+        // back here and nothing is built a second time on this request.
+        let selected_module: Option<Arc<dyn crate::ec::module::EdgeCookieModule>> =
+            module::request_module(&settings.ec, services)?;
+
+        // Read back an existing identifier only when the selected module
+        // accepts its shape, so an opaque vendor identifier (for example a signed
+        // envelope) round-trips instead of being silently dropped by the built-in
+        // shape check. With no module configured, Trusted Server is stateless:
+        // an existing identifier is treated as absent so it is never used or
+        // egressed, while the raw cookie value stays available to withdrawal
+        // handling below.
+        let ec_value = parsed.cookie_ec.clone().filter(|v| {
+            selected_module
+                .as_ref()
+                .is_some_and(|selected| module::module_owns_id(selected.as_ref(), v))
+        });
         let ec_was_present = ec_value.is_some();
 
         if let Some(ref id) = ec_value {
             log::trace!("Existing EC ID found: {}", log_id(id));
         }
 
+        // Snapshot the request evidence a module reads when it creates an
+        // identifier (the headers, so it can read cookies and client hints, and
+        // the URL path and query, so it can read request parameters). Capture
+        // only when a module is configured and either no identifier exists or
+        // the request is a document navigation, which orphan recovery may need,
+        // so a no-module deployment and a returning visitor's subresource
+        // requests clone nothing. Creation runs after the request body may be
+        // consumed, so the snapshot is owned.
+        let (request_headers, request_path, request_query) = if selected_module.is_some()
+            && (ec_value.is_none() || crate::http_util::is_navigation_request(req))
+        {
+            (
+                req.headers().clone(),
+                req.uri().path().to_owned(),
+                req.uri().query().unwrap_or_default().to_owned(),
+            )
+        } else {
+            (http::HeaderMap::new(), String::new(), String::new())
+        };
+
         // Capture the client IP from platform services (normalized).
         let client_ip = services
             .client_info()
@@ -335,11 +395,20 @@ impl EcContext {
             geo: geo_info,
         });
 
+        // Gate Edge Cookie creation and use on the request's consent context
+        // (jurisdiction and consent signals). With no module selected nothing
+        // may create or use an identifier, so the gate is closed rather than
+        // open by default. Downstream consumers read the stored result via
+        // [`EcContext::ec_allowed`] rather than re-deriving it.
+        let ec_allowed = selected_module
+            .as_ref()
+            .is_some_and(|_| consent::ec_consent_granted(&consent));
+
         log::info!(
-            "EC context: present={}, cookie_present={}, consent_allowed={}, jurisdiction={}",
+            "EC context: present={}, cookie_present={}, ec_allowed={}, jurisdiction={}",
             ec_was_present,
             parsed.cookie_ec.is_some(),
-            consent::ec_consent_granted(&consent),
+            ec_allowed,
             consent.jurisdiction,
         );
 
@@ -349,9 +418,15 @@ impl EcContext {
             ec_was_present,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip,
             geo_info: geo_info.cloned(),
             device_signals: None,
+            selected_module,
+            request_headers,
+            request_path,
+            request_query,
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             pull_sync_marker: PullSyncMarkerState::from_cookie(parsed.pull_sync_marker),
@@ -370,8 +445,14 @@ impl EcContext {
     ///
     /// # Errors
     ///
-    /// Returns an error if the client IP is unavailable and generation is
-    /// needed, or if HMAC generation fails.
+    /// Forwards every error from `generate_with_module`: the selected module
+    /// failing to derive an identifier (which includes a module that needs the
+    /// client IP being run on a host that cannot supply one), the module
+    /// producing an identifier outside the cookie-safe alphabet or over the
+    /// length cap, the module asking for a response header inside core's
+    /// reserved surface, persisting the identifier to the KV identity graph
+    /// failing, or every attempt within the retry limit producing an identifier
+    /// the graph already holds.
     pub fn generate_if_needed(
         &mut self,
         settings: &Settings,
@@ -381,24 +462,175 @@ impl EcContext {
             return Ok(());
         }
 
-        if !consent::ec_consent_granted(&self.consent) {
+        // A deployment with no module selected is stateless: nothing to
+        // generate, and not an error. Reuse the module built at read time
+        // rather than building it again.
+        let Some(ec_module) = self.selected_module.clone() else {
+            log::trace!("EC generation skipped: no Edge Cookie module configured");
+            return Ok(());
+        };
+
+        if !self.ec_allowed {
             log::info!(
-                "EC generation skipped: consent not granted (jurisdiction={})",
+                "EC generation skipped: EC creation not permitted (jurisdiction={})",
                 self.consent.jurisdiction,
             );
             return Ok(());
         }
 
-        let client_ip = self.client_ip.as_deref().ok_or_else(|| {
-            Report::new(TrustedServerError::EdgeCookie {
-                message: "Client IP required for EC generation but unavailable".to_owned(),
-            })
-        })?;
+        // Whether the client IP is needed is the selected module's decision,
+        // not core's. A module that derives identity from headers, cookies,
+        // query parameters, or the client reads no IP and must still run on a
+        // host that cannot supply one. The IP is passed as the documented
+        // unavailable value, the empty string (see
+        // [`RequestInfo::client_ip`](crate::evidence::RequestInfo::client_ip)),
+        // and a module that needs it refuses there, returning the error to
+        // the caller. The publisher proxy and integration proxy log it and
+        // serve the response without an Edge Cookie.
+        self.generate_with_module(ec_module.as_ref(), settings, kv)
+    }
 
+    /// Asks the selected module for one new identifier, without persisting
+    /// it.
+    ///
+    /// Runs the checks every new identifier has to pass before it is kept. The
+    /// module's response headers are checked against core's reserved surface
+    /// and captured for EC finalization, even when the module produces no
+    /// identifier, and the finished identifier, with its module code applied,
+    /// is checked against the global bounds. Generation and orphan recovery both
+    /// use this, so a rotated identifier comes from the same module
+    /// and passes the same checks as a new one. The request evidence captured at
+    /// read time (client IP, headers, and the URL path and query) is passed
+    /// borrowed through [`RequestInfo`](crate::evidence::RequestInfo), and the
+    /// built-in HMAC module reads only the client IP.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::EdgeCookie`] when the module fails to
+    /// derive an identifier (which for [`HmacModule`] includes an
+    /// unavailable client IP), asks for a response header inside core's
+    /// reserved surface (see
+    /// [`reserved_response_effect`](crate::ec::module::reserved_response_effect)),
+    /// or produces an identifier that is empty, over the length cap, or outside
+    /// the cookie-safe alphabet.
+    pub(crate) fn candidate_id(
+        &mut self,
+        ec_module: &dyn EdgeCookieModule,
+    ) -> Result<Option<String>, Report<TrustedServerError>> {
+        let input = IdentityInput {
+            consent: Some(&self.consent),
+        };
+        let request_info = BorrowedRequestInfo::new(
+            self.client_ip.as_deref().unwrap_or_default(),
+            Some(&self.request_headers),
+        )
+        .with_request_target(&self.request_path, &self.request_query);
+        let generated: GeneratedEdgeCookie = ec_module.generate(&request_info, &input)?;
+        // Check every response header the module asked for against core's
+        // reserved surface before any of them are kept. A module may set its
+        // own cookies and headers, but not a managed `ts-` cookie, a header in
+        // the `x-ts-` namespace, or a framing or hop-by-hop header. Without the
+        // check a module could write `ts-ec` itself and bypass the identifier
+        // validation and identity-graph row generation enforces. A rejection
+        // returns an error, as the identifier-bounds rejection below does.
+        // Because the check runs before the headers are captured, nothing from
+        // a rejected module response is kept, and the response is served
+        // without a new Edge Cookie. Checked before the identifier is read,
+        // because a module can return headers with no identifier at all.
+        for (name, value) in &generated.response_headers {
+            if let Some(effect) = module::reserved_response_effect(name, value) {
+                return Err(Report::new(TrustedServerError::EdgeCookie {
+                    message: format!(
+                        "Module `{}` returned a response header `{name}` that {effect}",
+                        ec_module.id(),
+                    ),
+                }));
+            }
+        }
+        let generated_id = generated
+            .id
+            .map(|value| crate::ec::module::apply_module_code(ec_module, &value));
+        let Some(ec_id) = generated_id else {
+            // Keep the response headers the module asked for even though it
+            // produced no identifier (for example while it still needs more
+            // client evidence). EC finalization applies them to the response.
+            self.response_headers = generated.response_headers;
+            log::info!(
+                "EC generation produced no identifier (module={}); proceeding without an EC",
+                ec_module.id(),
+            );
+            return Ok(None);
+        };
+        // Enforce the global identifier bounds at creation. The cookie-safe
+        // alphabet and the length cap apply to every module, so no
+        // implementation can emit a value the cookie layer or the identity
+        // graph cannot carry. Rejection is loud and total; the identifier is
+        // never rewritten.
+        if !ec_id_has_only_allowed_chars(&ec_id) {
+            return Err(Report::new(TrustedServerError::EdgeCookie {
+                message: format!(
+                    "Module `{}` produced an identifier that is empty, over {} bytes, or \
+                     outside the cookie-safe alphabet",
+                    ec_module.id(),
+                    cookies::MAX_EC_ID_LEN,
+                ),
+            }));
+        }
+        // Keep the module's response headers only now that its identifier
+        // has passed the bounds check, so a module response whose identifier
+        // is rejected keeps none of them. EC finalization applies them to the
+        // response.
+        self.response_headers = generated.response_headers;
+        log::info!(
+            "Generated new EC ID (module={}): {}",
+            ec_module.id(),
+            log_id(&ec_id),
+        );
+        Ok(Some(ec_id))
+    }
+
+    /// Derives and commits an EC identifier using a specific module.
+    ///
+    /// Split out of [`generate_if_needed`](Self::generate_if_needed) so the
+    /// module is supplied explicitly, resolved once at read time and threaded
+    /// here rather than rebuilt. Each attempt asks the module for a candidate
+    /// through [`candidate_id`](Self::candidate_id) and creates its
+    /// identity-graph row only when no row already holds that key, so a
+    /// colliding identifier never overwrites another identity's row and the
+    /// next attempt asks the module again. The row is keyed by the module's
+    /// canonical form of the identifier, and the request snapshot is bound to
+    /// that key. The skip guards (existing EC, consent gate) stay in
+    /// [`generate_if_needed`](Self::generate_if_needed).
+    ///
+    /// The response headers a module response asks for stay on the context
+    /// only when its identifier is committed or it produced no identifier at
+    /// all. A colliding candidate's headers are dropped before the next attempt
+    /// and nothing is kept when persisting fails, so EC finalization never
+    /// applies a header from a candidate this request discarded.
+    ///
+    /// # Errors
+    ///
+    /// Forwards every error from [`candidate_id`](Self::candidate_id), and
+    /// returns [`TrustedServerError::EdgeCookie`] when persisting a generated
+    /// identifier to the KV identity graph fails or every attempt within the
+    /// retry limit produces an identifier the graph already holds.
+    fn generate_with_module(
+        &mut self,
+        ec_module: &dyn EdgeCookieModule,
+        settings: &Settings,
+        kv: Option<&KvIdentityGraph>,
+    ) -> Result<(), Report<TrustedServerError>> {
         const MAX_CREATE_ATTEMPTS: usize = 5;
         for attempt in 0..MAX_CREATE_ATTEMPTS {
-            let ec_id = generation::generate_ec_id(settings, client_ip)?;
-            log::info!("Generated new EC ID: {}", log_id(&ec_id));
+            let Some(ec_id) = self.candidate_id(ec_module)? else {
+                return Ok(());
+            };
+            // Key the identity graph by the module's canonical form of the
+            // identifier, so equivalent representations of one identity share
+            // one row. The built-in normalization lowercases only the HMAC
+            // hash segment; an opaque vendor module overrides it to the
+            // identity function.
+            let kv_key = crate::ec::module::module_kv_key(ec_module, &ec_id);
             let now = current_timestamp();
             let mut entry = KvEntry::new(
                 &self.consent,
@@ -412,15 +644,19 @@ impl EcContext {
                 .map(DeviceSignals::to_kv_device);
 
             if let Some(graph) = kv {
-                match graph.create_if_absent(&ec_id, &entry) {
+                match graph.create_if_absent(&kv_key, &entry) {
                     Ok(CreateIfAbsentOutcome::Written) => {
                         self.kv_snapshot = EcKvSnapshot::Present {
-                            ec_id: ec_id.clone(),
+                            ec_id: kv_key,
                             entry: Box::new(entry),
                             generation: None,
                         };
                     }
                     Ok(CreateIfAbsentOutcome::AlreadyExists) => {
+                        // The colliding candidate is discarded, and the
+                        // response headers its module response asked for
+                        // are discarded with it.
+                        self.response_headers.clear();
                         log::warn!(
                             "Generated EC ID collision on attempt {}/{MAX_CREATE_ATTEMPTS}",
                             attempt + 1
@@ -428,6 +664,9 @@ impl EcContext {
                         continue;
                     }
                     Err(err) => {
+                        // Nothing is committed, so none of the module's
+                        // response headers are kept either.
+                        self.response_headers.clear();
                         log::error!(
                             "Failed to create EC entry for id '{}' after generation: {err:?}",
                             log_id(&ec_id),
@@ -459,6 +698,69 @@ impl EcContext {
         self.ec_value.as_deref()
     }
 
+    /// The modules whose identifiers this request's paths accept, being the
+    /// selected module alone (see
+    /// [`AcceptedModules`](module::AcceptedModules)).
+    #[must_use]
+    pub(crate) fn accepted_modules(&self) -> module::AcceptedModules<'_> {
+        module::AcceptedModules::active(self.selected_module.as_deref())
+    }
+
+    /// The identity-graph key for `value` under the modules this deployment
+    /// reads.
+    ///
+    /// The canonical route from a request's identifier to a row key, so a
+    /// module whose canonical form differs from the cookie value still finds
+    /// the row it created. The owning module is picked by the identifier's
+    /// `{code}~` prefix and supplies the canonical form of its own value part,
+    /// matching the key [`generate_if_needed`](Self::generate_if_needed) wrote
+    /// at creation.
+    ///
+    /// Identify, EC finalization and pull sync read and write this
+    /// identifier's row under this key. The publisher navigation, `/auction`
+    /// and `/_ts/page-bids` paths load their request snapshot under this key,
+    /// and EID resolution looks the entry up in that snapshot under this key.
+    /// Each of these reaches the key through this function or through
+    /// [`ec_kv_key`](Self::ec_kv_key), which wraps this function. Batch sync
+    /// and the admin lookup have no EC context, so they call
+    /// [`AcceptedModules::canonical_kv_key`](module::AcceptedModules::canonical_kv_key),
+    /// the function this one wraps, directly.
+    ///
+    /// `None` when no module this deployment reads owns `value`, in which
+    /// case there is no row to read or write.
+    #[must_use]
+    pub(crate) fn kv_key_for(&self, value: &str) -> Option<String> {
+        self.accepted_modules().canonical_kv_key(value)
+    }
+
+    /// The identity-graph key for this request's active identifier.
+    #[must_use]
+    pub(crate) fn ec_kv_key(&self) -> Option<String> {
+        self.ec_value().and_then(|value| self.kv_key_for(value))
+    }
+
+    /// The identity-graph key for the `ts-ec` cookie the request carried.
+    ///
+    /// Withdrawal tombstones the cookie's row as well as the active one,
+    /// because a stateless deployment leaves [`ec_kv_key`](Self::ec_kv_key)
+    /// empty while a live row still exists, and the cookie is the only way
+    /// back to it.
+    ///
+    /// This does not reach across a module switch. An identifier created
+    /// under a retired module's `{code}~` prefix is owned by no module
+    /// this deployment reads, so [`kv_key_for`](Self::kv_key_for) yields
+    /// `None` and its row is never tombstoned. Core cannot derive that key,
+    /// because the canonical form is the owning module's own normalization.
+    /// So after a module switch a withdrawal expires only the browser
+    /// cookie, because that path keys off the raw cookie rather than off
+    /// ownership, and the retired module's row stays until its time to live
+    /// runs out.
+    #[must_use]
+    pub(crate) fn cookie_ec_kv_key(&self) -> Option<String> {
+        self.existing_cookie_ec_id()
+            .and_then(|value| self.kv_key_for(value))
+    }
+
     /// Returns whether the `ts-ec` cookie was present on the incoming request.
     #[must_use]
     pub fn cookie_was_present(&self) -> bool {
@@ -488,7 +790,8 @@ impl EcContext {
     ///
     /// Allows handlers to apply query-param fallback consent for the current
     /// request only when pre-routing consent extraction produced an empty
-    /// context.
+    /// context. Mutations do not re-derive [`ec_allowed`](Self::ec_allowed),
+    /// which is resolved once at construction.
     pub fn consent_mut(&mut self) -> &mut ConsentContext {
         &mut self.consent
     }
@@ -505,6 +808,14 @@ impl EcContext {
         self.device_signals = Some(signals);
     }
 
+    /// Returns the response headers a module asked to set during
+    /// [`generate_if_needed`](Self::generate_if_needed). Empty unless a module
+    /// produced any.
+    #[must_use]
+    pub fn response_headers(&self) -> &[(http::HeaderName, http::HeaderValue)] {
+        &self.response_headers
+    }
+
     /// Returns the device signals, if set.
     #[must_use]
     pub fn device_signals(&self) -> Option<&DeviceSignals> {
@@ -595,10 +906,23 @@ impl EcContext {
         self.pull_sync_marker.invalidate_for_replaced_ec();
     }
 
-    /// Returns whether EC creation is permitted by consent for this request.
+    /// The Edge Cookie module this request resolved at read time, if any.
+    ///
+    /// Orphan recovery creates a replacement identifier through this module,
+    /// so a rotated identifier comes from the same module as a new one.
+    #[must_use]
+    pub(crate) fn selected_module(&self) -> Option<Arc<dyn crate::ec::module::EdgeCookieModule>> {
+        self.selected_module.clone()
+    }
+
+    /// Returns whether Edge Cookie creation is allowed for this request.
+    ///
+    /// Resolved once at construction: closed when no module is selected,
+    /// otherwise from the request's consent context (see
+    /// [`consent::ec_consent_granted`]).
     #[must_use]
     pub fn ec_allowed(&self) -> bool {
-        consent::ec_consent_granted(&self.consent)
+        self.ec_allowed
     }
 
     /// Returns the existing EC cookie value for revocation handling.
@@ -611,35 +935,67 @@ impl EcContext {
         self.cookie_ec_value.as_deref()
     }
 
-    /// Returns `true` when the request carried a cookie EC and the selected
-    /// active EC differs from that cookie value.
-    #[must_use]
-    pub fn cookie_differs_from_active_ec(&self) -> bool {
-        matches!(
-            (self.cookie_ec_value.as_deref(), self.ec_value.as_deref()),
-            (Some(cookie), Some(active)) if cookie != active
-        )
-    }
-
     /// Returns the stable EC hash prefix from the active EC value.
     #[must_use]
     pub fn ec_hash(&self) -> Option<&str> {
         self.ec_value.as_deref().map(generation::ec_hash)
     }
 
-    /// Creates a test-only `EcContext` with explicit field values.
+    /// Attaches a selected module to a test-only [`EcContext`].
+    ///
+    /// The production constructor builds the module from settings and
+    /// injected services. A test that only needs the module's identifier
+    /// semantics (which identifiers it owns, and their canonical key form)
+    /// takes this shortcut instead.
+    #[cfg(test)]
+    #[must_use]
+    pub fn with_module_for_test(
+        mut self,
+        module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+    ) -> Self {
+        self.selected_module = Some(module);
+        self
+    }
+
+    /// Creates a test-only `EcContext` whose creation gate is derived from the
+    /// consent context, matching the production construction path.
+    ///
+    /// Use [`new_for_test_gated`](Self::new_for_test_gated) when a test needs
+    /// an explicit gate.
     #[cfg(test)]
     #[must_use]
     pub fn new_for_test(ec_value: Option<String>, consent: ConsentContext) -> Self {
+        let ec_allowed = consent::ec_consent_granted(&consent);
+        Self::new_for_test_gated(ec_value, consent, ec_allowed)
+    }
+
+    /// Creates a test-only `EcContext` with an explicit creation gate.
+    ///
+    /// `ec_allowed` stands in for the gating decision the production path
+    /// resolves at construction, so a test can exercise the gate-open and
+    /// gate-closed branches directly.
+    #[cfg(test)]
+    #[must_use]
+    pub fn new_for_test_gated(
+        ec_value: Option<String>,
+        consent: ConsentContext,
+        ec_allowed: bool,
+    ) -> Self {
         Self {
             ec_was_present: ec_value.is_some(),
             cookie_ec_value: ec_value.clone(),
             ec_value,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip: None,
             geo_info: None,
             device_signals: None,
+            selected_module: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             pull_sync_marker: PullSyncMarkerState::Absent,
@@ -655,15 +1011,22 @@ impl EcContext {
         consent: ConsentContext,
         client_ip: Option<String>,
     ) -> Self {
+        let ec_allowed = consent::ec_consent_granted(&consent);
         Self {
             ec_was_present: ec_value.is_some(),
             cookie_ec_value: ec_value.clone(),
             ec_value,
             ec_generated: false,
             consent,
+            ec_allowed,
             client_ip,
             geo_info: None,
             device_signals: None,
+            selected_module: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             pull_sync_marker: PullSyncMarkerState::Absent,
@@ -681,6 +1044,7 @@ impl EcContext {
         ec_was_present: bool,
         ec_generated: bool,
         consent: ConsentContext,
+        ec_allowed: bool,
     ) -> Self {
         Self {
             ec_value,
@@ -688,9 +1052,15 @@ impl EcContext {
             ec_was_present,
             ec_generated,
             consent,
+            ec_allowed,
             client_ip: None,
             geo_info: None,
             device_signals: None,
+            selected_module: None,
+            request_headers: http::HeaderMap::new(),
+            request_path: String::new(),
+            request_query: String::new(),
+            response_headers: Vec::new(),
             kv_snapshot: EcKvSnapshot::NotRead,
             recovery_eligible: false,
             pull_sync_marker: PullSyncMarkerState::Absent,
@@ -724,7 +1094,7 @@ pub(crate) fn checked_current_timestamp() -> Option<u64> {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use super::*;
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::{ConsentContext, ConsentSource};
@@ -732,18 +1102,23 @@ mod tests {
     use crate::ec::kv_backend::{
         EcKvLookup, EcKvStore, EcKvWrite, EcKvWriteMode, EcKvWriteOutcome,
     };
+    use crate::ec::module::{EcModuleSelection, ModuleCode};
+    use crate::evidence::RequestInfo;
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
 
     /// [`EcKvStore`] wrapper whose first `collisions` `Add` writes report a
     /// precondition failure, forcing generation to retry with a fresh suffix.
-    struct AddCollidingEcKv {
+    ///
+    /// Shared with the finalization tests, whose orphan recovery creates its
+    /// replacement through the same `Add` write.
+    pub(crate) struct AddCollidingEcKv {
         inner: InMemoryEcKv,
         collisions_remaining: std::sync::Mutex<u32>,
     }
 
     impl AddCollidingEcKv {
-        fn new(collisions: u32) -> Self {
+        pub(crate) fn new(collisions: u32) -> Self {
             Self {
                 inner: InMemoryEcKv::new("add-colliding-store"),
                 collisions_remaining: std::sync::Mutex::new(collisions),
@@ -803,7 +1178,8 @@ mod tests {
     fn generate_if_needed_retries_id_collision_then_persists() {
         let settings = create_test_settings();
         let mut ec =
-            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()));
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.5".to_owned()))
+                .with_module_for_test(hmac_module());
         let graph = KvIdentityGraph::new(AddCollidingEcKv::new(2));
 
         ec.generate_if_needed(&settings, Some(&graph))
@@ -821,7 +1197,8 @@ mod tests {
     fn generate_if_needed_errors_after_collision_exhaustion() {
         let settings = create_test_settings();
         let mut ec =
-            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.6".to_owned()));
+            EcContext::new_for_test_with_ip(None, granting_consent(), Some("192.0.2.6".to_owned()))
+                .with_module_for_test(hmac_module());
         // Collide on every attempt so the bounded retry is exhausted.
         let graph = KvIdentityGraph::new(AddCollidingEcKv::new(u32::MAX));
 
@@ -885,6 +1262,983 @@ mod tests {
         format!("{}.{suffix}", prefix_char.repeat(64))
     }
 
+    /// A module other than the built-in HMAC one, whose identifiers the HMAC
+    /// grammar rejects (no dot, mixed case), modeling a vendor identifier such
+    /// as a signed envelope. It accepts any of its own non-empty identifiers
+    /// and keys the identity graph by the value unchanged.
+    ///
+    /// Shared with the admin lookup, batch sync and pull sync tests.
+    #[derive(Debug)]
+    pub(crate) struct OpaqueModule;
+
+    impl EdgeCookieModule for OpaqueModule {
+        fn id(&self) -> &'static str {
+            "opaque"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0op")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    /// A geo that resolves to the non-regulated jurisdiction (US, no region),
+    /// so the consent gate is open and generation runs in module tests.
+    fn non_regulated_geo() -> GeoInfo {
+        GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        }
+    }
+
+    #[test]
+    fn read_from_request_reuses_the_module_the_composition_root_resolved() {
+        // The context reuses the module the composition root resolved and
+        // threaded through `RuntimeServices`, so the request builds none.
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("opaque"));
+
+        let ec_config = settings.ec.clone();
+        let resolved =
+            crate::ec::module::build_shared_module(&ec_config, Some(Arc::new(OpaqueModule)))
+                .expect("the composition root should resolve the selection")
+                .expect("the selection should yield a module");
+
+        let services =
+            crate::platform::test_support::noop_services_with_ec_module(Arc::clone(&resolved));
+        let req = create_test_request(&[]);
+        let ec = EcContext::read_from_request(&settings, &req, &services)
+            .expect("should read EC context");
+
+        let used = ec
+            .selected_module
+            .as_ref()
+            .expect("the context should hold the selected module");
+        assert!(
+            Arc::ptr_eq(used, &resolved),
+            "reading EC state should reuse the module resolved at startup rather \
+             than building a second one for this request"
+        );
+    }
+
+    #[test]
+    fn read_from_request_round_trips_an_opaque_module_identifier() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        // A vendor identifier that is deliberately not the built-in HMAC shape
+        // (no dot, mixed case), the exact value the built-in check would drop.
+        const OPAQUE_ID: &str = "AbC123opaqueEnvelopeValueXYZ";
+        const CODED_ID: &str = "t0op~AbC123opaqueEnvelopeValueXYZ";
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("opaque"));
+        let cookie = format!("ts-ec={CODED_ID}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+
+        // With the opaque module injected, its `accepts_id` governs read-back,
+        // so the identifier survives verbatim.
+        let services = noop_services_with_ec_module(Arc::new(OpaqueModule));
+        let ec = EcContext::read_from_request(&settings, &req, &services)
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            Some(CODED_ID),
+            "an opaque module identifier should round-trip through read-back verbatim"
+        );
+        let _ = OPAQUE_ID;
+
+        // Control: with the module selected but not injected by the adapter,
+        // the request fails loudly instead of silently running stateless with
+        // the identifier dropped.
+        let err = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect_err("a selected but uninjected module should fail the request");
+        assert!(
+            err.to_string().contains("opaque"),
+            "the error should name the selected module, got: {err}"
+        );
+
+        // Control: with no module selected at all, the identifier is treated
+        // as absent, so a stateless deployment never uses or egresses it.
+        let mut stateless = create_test_settings();
+        stateless.ec.module = None;
+        stateless.ec.module_blocks.clear();
+        let ec_without = EcContext::read_from_request(&stateless, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec_without.ec_value(),
+            None,
+            "with no module selected, an existing identifier is treated as absent"
+        );
+        assert!(
+            !ec_without.ec_allowed(),
+            "with no module selected, the gate stays closed"
+        );
+    }
+
+    /// A module that records the request query parameter `id` and the `Cookie`
+    /// header it is given at generate time, proving request evidence (parameters
+    /// and cookies) reaches a module through the organic generate path.
+    #[derive(Debug, Default)]
+    struct EvidenceCapturingModule {
+        seen: std::sync::Mutex<Option<(String, String)>>,
+    }
+
+    impl EdgeCookieModule for EvidenceCapturingModule {
+        fn id(&self) -> &'static str {
+            "evidence"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0ev")
+        }
+
+        fn generate(
+            &self,
+            request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            let query_id = request_info.query_param("id").unwrap_or_default();
+            let cookie = request_info.header("cookie").unwrap_or_default().to_owned();
+            *self.seen.lock().expect("should lock seen evidence") = Some((query_id, cookie));
+            Ok(GeneratedEdgeCookie {
+                id: Some("evidence-ec".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+    }
+
+    #[test]
+    fn generate_passes_request_parameters_and_cookies_to_the_module() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let module = Arc::new(EvidenceCapturingModule::default());
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("evidence"));
+
+        // A request carrying a query parameter and a (non-EC) cookie, with no
+        // existing `ts-ec` cookie so the generate path runs.
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123&debug=1")
+            .header("cookie", "client-id=xyz789")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_module(module.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, None)
+            .expect("should run generation");
+
+        let seen = module
+            .seen
+            .lock()
+            .expect("should lock seen evidence")
+            .clone();
+        assert_eq!(
+            seen,
+            Some(("abc123".to_owned(), "client-id=xyz789".to_owned())),
+            "the module should read the request query parameter and cookies at generate time"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            Some("t0ev~evidence-ec"),
+            "the identifier the module created should be committed under its code"
+        );
+    }
+
+    #[test]
+    fn recovery_on_a_navigation_passes_request_parameters_and_cookies_to_the_module() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let module = Arc::new(EvidenceCapturingModule::default());
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("evidence"));
+
+        // A returning visitor's document navigation, carrying an identifier
+        // the module owns, which is the request orphan recovery runs on.
+        let cookie = "ts-ec=t0ev~orphaned; client-id=xyz789";
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123")
+            .header("cookie", cookie)
+            .header("sec-fetch-dest", "document")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_module(module.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        assert!(ec.ec_was_present(), "the identifier should be read back");
+        let selected = ec.selected_module().expect("a module is selected");
+        ec.candidate_id(selected.as_ref())
+            .expect("should create a replacement");
+
+        let seen = module
+            .seen
+            .lock()
+            .expect("should lock seen evidence")
+            .clone();
+        assert_eq!(
+            seen,
+            Some(("abc123".to_owned(), cookie.to_owned())),
+            "recovery should give the module the request's parameters and cookies"
+        );
+    }
+
+    /// A module that creates an opaque, mixed-case, non-HMAC identifier at
+    /// the edge, so a test can prove such an identifier persists to the KV identity
+    /// graph under its own value as the key.
+    #[derive(Debug)]
+    struct ServerOpaqueModule;
+
+    impl EdgeCookieModule for ServerOpaqueModule {
+        fn id(&self) -> &'static str {
+            "server_opaque"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0so")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("Opaque_EC_Value_MixedCase_123".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    #[test]
+    fn generate_persists_an_opaque_identifier_to_kv_under_its_own_key() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        const OPAQUE: &str = "t0so~Opaque_EC_Value_MixedCase_123";
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("server_opaque"));
+        let services = noop_services_with_ec_module(Arc::new(ServerOpaqueModule));
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+
+        // No existing cookie, so the edge creates one and persists it.
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, Some(&graph))
+            .expect("should generate and persist");
+
+        assert_eq!(
+            ec.ec_value(),
+            Some(OPAQUE),
+            "the opaque identifier should be created"
+        );
+
+        // The entry is stored under the full identifier verbatim.
+        assert!(
+            graph.get(OPAQUE).expect("kv get should succeed").is_some(),
+            "the entry should exist under the opaque identifier key"
+        );
+
+        // A lowercased key must miss, proving the key preserves case rather than
+        // being lowercased like the built-in HMAC form (the clash this guards).
+        assert!(
+            graph
+                .get(&OPAQUE.to_lowercase())
+                .expect("kv get should succeed")
+                .is_none(),
+            "the KV key must be case-sensitive and verbatim, not lowercased"
+        );
+    }
+
+    #[test]
+    fn a_module_that_reads_no_client_ip_creates_when_the_host_has_none() {
+        use crate::platform::test_support::noop_services_with_ec_module_without_client_ip;
+
+        // The requirement for a client IP belongs to the module that uses
+        // one, not to core. A module deriving identity from the request
+        // query and cookies runs on a host that cannot determine a client IP,
+        // and receives the documented unavailable value, the empty string.
+        let module = Arc::new(EvidenceCapturingModule::default());
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("evidence"));
+        let req = Request::builder()
+            .method("GET")
+            .uri("http://example.com/page?id=abc123")
+            .header("cookie", "client-id=xyz789")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let services = noop_services_with_ec_module_without_client_ip(module.clone());
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        assert_eq!(
+            ec.client_ip(),
+            None,
+            "the host should supply no client IP in this test"
+        );
+
+        ec.generate_if_needed(&settings, None)
+            .expect("a module that reads no client IP should still create an identifier");
+        assert_eq!(
+            ec.ec_value(),
+            Some("t0ev~evidence-ec"),
+            "the identifier should be committed with no client IP available"
+        );
+    }
+
+    #[test]
+    fn the_hmac_module_refuses_when_the_host_has_no_client_ip() {
+        // The other half: the built-in module's only input is the client IP,
+        // so with none it fails rather than hashing the empty string into an
+        // identifier every visitor on that host would share. Identity cannot be
+        // established, so generate_if_needed returns the error, which the
+        // publisher and integration proxies log before serving the response
+        // without an Edge Cookie.
+        let settings = create_test_settings();
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec =
+            EcContext::read_from_request_with_geo(&settings, &req, &noop_services(), Some(&geo))
+                .expect("should read EC context");
+        assert_eq!(
+            ec.client_ip(),
+            None,
+            "the host should supply no client IP in this test"
+        );
+
+        let err = ec
+            .generate_if_needed(&settings, None)
+            .expect_err("the HMAC module should refuse without a client IP");
+        assert!(
+            err.to_string().contains("client IP"),
+            "the error should name the missing client IP, got: {err}"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            None,
+            "no identifier should be committed when the module refuses"
+        );
+    }
+
+    /// A module that creates an identifier outside the cookie-safe alphabet,
+    /// to prove core rejects it at creation rather than rewriting it.
+    #[derive(Debug)]
+    struct IllegalIdModule;
+
+    impl EdgeCookieModule for IllegalIdModule {
+        fn id(&self) -> &'static str {
+            "illegal"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0il")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("bad;value with spaces".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, _value: &str) -> bool {
+            true
+        }
+    }
+
+    #[test]
+    fn generate_rejects_an_identifier_outside_the_cookie_safe_alphabet() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("illegal"));
+        let services = noop_services_with_ec_module(Arc::new(IllegalIdModule));
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+
+        let err = ec
+            .generate_if_needed(&settings, None)
+            .expect_err("an identifier outside the alphabet should be rejected at creation");
+        assert!(
+            err.to_string().contains("illegal"),
+            "the error should name the module, got: {err}"
+        );
+        assert_eq!(
+            ec.ec_value(),
+            None,
+            "no identifier should be committed after a creation rejection"
+        );
+    }
+
+    /// A module that returns a caller-chosen response header, and `id` as its
+    /// identifier when one is given, so a test can drive one module response
+    /// effect at a time through the organic generate path.
+    #[derive(Debug)]
+    struct HeaderSettingModule {
+        name: &'static str,
+        value: &'static str,
+        id: Option<&'static str>,
+    }
+
+    impl EdgeCookieModule for HeaderSettingModule {
+        fn id(&self) -> &'static str {
+            "header_setting"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0hs")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: self.id.map(str::to_owned),
+                response_headers: vec![(
+                    http::HeaderName::from_bytes(self.name.as_bytes())
+                        .expect("should parse header name"),
+                    http::HeaderValue::from_static(self.value),
+                )],
+            })
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            !value.is_empty()
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_owned()
+        }
+    }
+
+    /// Runs generation through `module` and hands back the context whether or
+    /// not generation succeeded, so a test can finalize a response on a context
+    /// whose generation returned an error.
+    fn generate_with_header_setting_module(
+        module: HeaderSettingModule,
+        graph: Option<&KvIdentityGraph>,
+    ) -> (Settings, EcContext, Result<(), Report<TrustedServerError>>) {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("header_setting"));
+        let services = noop_services_with_ec_module(Arc::new(module));
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        let outcome = ec.generate_if_needed(&settings, graph);
+        (settings, ec, outcome)
+    }
+
+    #[test]
+    fn a_rejected_module_effect_never_reaches_the_finalized_response() {
+        // A module that sets the managed `ts-ec` cookie, a header in the
+        // `x-ts-` namespace or a framing header would bypass core's identifier
+        // validation and its identity-graph row, so generation returns an
+        // error rather than quietly dropping the effect. The publisher and
+        // integration proxies log the error and still serve the response, and
+        // EC finalization applies the response headers this same context
+        // holds, so a rejected header kept among them would reach the browser
+        // anyway. Each header is tried with no identifier, the case a cookie
+        // write would otherwise slip through, and with one, to show that
+        // nothing from the rejected module response is kept.
+        for (name, value, id) in [
+            ("set-cookie", "ts-ec=forged-value; Path=/", None),
+            ("x-ts-ec", "forged", None),
+            ("transfer-encoding", "chunked", None),
+            (
+                "set-cookie",
+                "ts-ec=forged-value; Path=/",
+                Some("module-value"),
+            ),
+            ("x-ts-ec", "forged", Some("module-value")),
+            ("transfer-encoding", "chunked", Some("module-value")),
+        ] {
+            let case = format!("`{name}` with identifier {id:?}");
+            let graph = KvIdentityGraph::in_memory("test-ec-store");
+            let (settings, mut ec, outcome) = generate_with_header_setting_module(
+                HeaderSettingModule { name, value, id },
+                Some(&graph),
+            );
+            let Err(err) = outcome else {
+                panic!("{case}: the header is reserved, so generation should return an error");
+            };
+            assert!(
+                err.to_string().contains("header_setting"),
+                "{case}: the error should name the module, got: {err}"
+            );
+            assert_eq!(
+                ec.ec_value(),
+                None,
+                "{case}: no identifier should be committed after the rejection"
+            );
+
+            let mut response = http::Response::builder()
+                .status(200)
+                .body(EdgeBody::empty())
+                .expect("should build test response");
+            finalize::ec_finalize_response(
+                &settings,
+                &mut ec,
+                Some(&graph),
+                &registry::PartnerRegistry::empty(),
+                None,
+                None,
+                &mut response,
+            );
+
+            let cookies: Vec<&str> = response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|cookie| cookie.to_str().ok())
+                .collect();
+            assert!(
+                !cookies.iter().any(|cookie| cookie.contains("ts-ec=forged")),
+                "{case}: the rejected effect should not set `ts-ec`, got: {cookies:?}"
+            );
+            assert!(
+                response.headers().get("x-ts-ec").is_none(),
+                "{case}: the rejected effect should not set `x-ts-ec`"
+            );
+            assert!(
+                response
+                    .headers()
+                    .get(http::header::TRANSFER_ENCODING)
+                    .is_none(),
+                "{case}: the rejected effect should not set `transfer-encoding`"
+            );
+        }
+    }
+
+    #[test]
+    fn generate_applies_a_module_owned_cookie_to_the_response() {
+        // The other half of the rule: a module's own cookie is not core's, so
+        // it survives generation and reaches the browser response unchanged,
+        // alongside the managed `ts-ec` cookie core writes itself.
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+        let (settings, mut ec, outcome) = generate_with_header_setting_module(
+            HeaderSettingModule {
+                name: "set-cookie",
+                value: "acme-evidence=abc123; Path=/; Secure",
+                id: Some("module-value"),
+            },
+            Some(&graph),
+        );
+        outcome.expect("generation should accept a module-owned cookie");
+        assert_eq!(
+            ec.ec_value(),
+            Some("t0hs~module-value"),
+            "the identifier should still be committed"
+        );
+
+        let mut response = http::Response::builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build test response");
+        finalize::ec_finalize_response(
+            &settings,
+            &mut ec,
+            Some(&graph),
+            &registry::PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        let cookies: Vec<&str> = response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .collect();
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("acme-evidence=abc123")),
+            "the module's own cookie should reach the response, got: {cookies:?}"
+        );
+        assert!(
+            cookies.iter().any(|cookie| cookie.starts_with("ts-ec=")),
+            "core's own managed cookie should still be written, got: {cookies:?}"
+        );
+    }
+
+    /// A cookie a module may set for itself, used to check which module
+    /// responses keep their headers.
+    const MODULE_EVIDENCE_COOKIE: &str = "acme-evidence=abc123; Path=/; Secure";
+
+    /// Runs EC finalization on `ec` for an empty response and returns the
+    /// `Set-Cookie` values the response carries.
+    fn finalized_set_cookies(
+        settings: &Settings,
+        ec: &mut EcContext,
+        graph: &KvIdentityGraph,
+    ) -> Vec<String> {
+        let mut response = http::Response::builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build test response");
+        finalize::ec_finalize_response(
+            settings,
+            ec,
+            Some(graph),
+            &registry::PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+        response
+            .headers()
+            .get_all(http::header::SET_COOKIE)
+            .iter()
+            .filter_map(|cookie| cookie.to_str().ok())
+            .map(str::to_owned)
+            .collect()
+    }
+
+    #[test]
+    fn a_discarded_candidate_keeps_none_of_its_module_response_headers() {
+        // The module's own cookie is permitted, but each of these candidates
+        // is discarded, so generation returns an error and the cookie its
+        // module response asked for must not reach the browser.
+        for (case, graph, id) in [
+            // The identifier is outside the cookie-safe alphabet.
+            (
+                "a rejected identifier",
+                KvIdentityGraph::in_memory("test-ec-store"),
+                "bad;value with spaces",
+            ),
+            // Every candidate collides with a row the graph already holds, so
+            // each one is discarded until the retries run out.
+            (
+                "a colliding candidate",
+                KvIdentityGraph::new(AddCollidingEcKv::new(u32::MAX)),
+                "module-value",
+            ),
+            // The identity graph cannot store the candidate's row.
+            (
+                "an unpersisted candidate",
+                KvIdentityGraph::new(crate::ec::kv_backend::test_support::FailingEcKv::new(
+                    "failing-ec-store",
+                )),
+                "module-value",
+            ),
+        ] {
+            let (settings, mut ec, outcome) = generate_with_header_setting_module(
+                HeaderSettingModule {
+                    name: "set-cookie",
+                    value: MODULE_EVIDENCE_COOKIE,
+                    id: Some(id),
+                },
+                Some(&graph),
+            );
+
+            assert!(
+                outcome.is_err(),
+                "{case}: generation should return an error"
+            );
+            let cookies = finalized_set_cookies(&settings, &mut ec, &graph);
+            assert!(
+                !cookies
+                    .iter()
+                    .any(|cookie| cookie.starts_with("acme-evidence=")),
+                "{case}: the module response's cookie should not reach the response, got: \
+                 {cookies:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_module_that_creates_nothing_still_has_its_headers_applied() {
+        // A module may ask for more client evidence before it can create an
+        // identifier, for example with `Accept-CH`, so its headers reach the
+        // response even though no Edge Cookie is set.
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+        let (settings, mut ec, outcome) = generate_with_header_setting_module(
+            HeaderSettingModule {
+                name: "accept-ch",
+                value: "Sec-CH-UA",
+                id: None,
+            },
+            Some(&graph),
+        );
+        outcome.expect("a module that creates nothing should not fail the request");
+        assert_eq!(ec.ec_value(), None, "the module created no identifier");
+
+        let mut response = http::Response::builder()
+            .status(200)
+            .body(EdgeBody::empty())
+            .expect("should build test response");
+        finalize::ec_finalize_response(
+            &settings,
+            &mut ec,
+            Some(&graph),
+            &registry::PartnerRegistry::empty(),
+            None,
+            None,
+            &mut response,
+        );
+
+        assert_eq!(
+            response
+                .headers()
+                .get("accept-ch")
+                .and_then(|value| value.to_str().ok()),
+            Some("Sec-CH-UA"),
+            "the module's header should reach the response"
+        );
+        assert!(
+            !response
+                .headers()
+                .get_all(http::header::SET_COOKIE)
+                .iter()
+                .filter_map(|value| value.to_str().ok())
+                .any(|cookie| cookie.starts_with("ts-ec=")),
+            "no Edge Cookie should be set when the module created nothing"
+        );
+    }
+
+    /// A module whose identifier normalizes to a distinct canonical form, to
+    /// prove the identity graph is keyed by the canonical form.
+    ///
+    /// Shared with the identify, finalization, pull sync, admin lookup, auction
+    /// and publisher tests, which need a module whose canonical key is not the
+    /// value the browser carries.
+    #[derive(Debug)]
+    pub(crate) struct CanonicalizingModule;
+
+    impl EdgeCookieModule for CanonicalizingModule {
+        fn id(&self) -> &'static str {
+            "canonical"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0ca")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie {
+                id: Some("MiXeD.CaseId".to_owned()),
+                response_headers: Vec::new(),
+            })
+        }
+
+        fn accepts_id(&self, _value: &str) -> bool {
+            true
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            value.to_ascii_lowercase()
+        }
+    }
+
+    /// The identifier [`CanonicalizingModule`] creates, as the browser
+    /// carries it in the `ts-ec` cookie.
+    pub(crate) const CANONICAL_COOKIE_VALUE: &str = "t0ca~MiXeD.CaseId";
+
+    /// The identity-graph key generation writes that identifier's row under.
+    /// Pinned to the creation path by
+    /// `generate_keys_the_identity_graph_by_the_normalized_identifier`, which
+    /// asserts both the key generation writes and the key
+    /// [`EcContext::ec_kv_key`] derives.
+    pub(crate) const CANONICAL_KV_KEY: &str = "t0ca~mixed.caseid";
+
+    /// The built-in HMAC module, as an HMAC deployment selects it.
+    ///
+    /// Creating or rotating an identifier needs a selected module, so the
+    /// generation and orphan-recovery tests attach this one. Shared with the
+    /// finalization tests.
+    pub(crate) fn hmac_module() -> Arc<dyn EdgeCookieModule> {
+        Arc::new(crate::ec::module::HmacModule::new(
+            crate::redacted::Redacted::new("test-secret-key-32-bytes-minimum".to_owned()),
+        ))
+    }
+
+    #[test]
+    fn generate_keys_the_identity_graph_by_the_normalized_identifier() {
+        use crate::platform::test_support::noop_services_with_ec_module;
+
+        let mut settings = create_test_settings();
+        settings.ec.module = Some(EcModuleSelection::from("canonical"));
+        let services = noop_services_with_ec_module(Arc::new(CanonicalizingModule));
+        let graph = KvIdentityGraph::in_memory("test-ec-store");
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, Some(&graph))
+            .expect("should generate and persist");
+
+        assert_eq!(
+            ec.ec_value(),
+            Some(CANONICAL_COOKIE_VALUE),
+            "the cookie value keeps the module's exact identifier under its code"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_KV_KEY)
+                .expect("should read the graph")
+                .is_some(),
+            "the graph row should be keyed by the code plus the canonical form"
+        );
+        // Pin the read-side derivation to the key generation actually wrote.
+        // Identify, the withdrawal tombstones, and EID ingestion all read the
+        // row through `ec_kv_key`, so the two must never drift apart.
+        assert_eq!(
+            ec.ec_kv_key().as_deref(),
+            Some(CANONICAL_KV_KEY),
+            "the read-side key should be the key generation wrote"
+        );
+    }
+
+    #[test]
+    fn hmac_creates_a_coded_identifier_and_reads_the_legacy_bare_form() {
+        let settings = create_test_settings();
+        let req = create_test_request(&[]);
+        let geo = non_regulated_geo();
+        let services = crate::platform::test_support::noop_services_with_client_ip(
+            std::net::IpAddr::V4(std::net::Ipv4Addr::new(203, 0, 113, 7)),
+        );
+        let mut ec = EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+            .expect("should read EC context");
+        ec.generate_if_needed(&settings, None)
+            .expect("should generate");
+        let created = ec.ec_value().expect("should create an identifier");
+        assert!(
+            created.starts_with("hmac~"),
+            "a fresh HMAC identifier should carry the hmac code, got {created}"
+        );
+
+        // A bare identifier with no module code still reads back under the
+        // hmac module.
+        let legacy = format!("{}.ABC123", "a".repeat(64));
+        let cookie = format!("ts-ec={legacy}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+        let ec = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            Some(legacy.as_str()),
+            "the legacy bare form should dual-read under the hmac module"
+        );
+    }
+
+    #[test]
+    fn the_request_path_hashes_an_ipv6_client_ip_by_its_64_prefix() {
+        // A device rotates the lower 64 bits of its IPv6 address, so the
+        // context keeps only the /64 prefix and the HMAC module hashes that.
+        // Two addresses in one /64 share an identity hash, and it is the hash
+        // of the prefix.
+        let settings = create_test_settings();
+        let geo = non_regulated_geo();
+        let req = create_test_request(&[]);
+        let prefix = "20010db885a30000";
+        let passphrase = crate::test_support::tests::hmac_passphrase(
+            &settings.ec,
+            crate::ec::module::HMAC_MODULE_KEY,
+        );
+        let expected = generation::generate_ec_id(passphrase, prefix)
+            .expect("should generate from the prefix");
+        for interface in [0x1234, 0xabcd] {
+            let ip = std::net::IpAddr::V6(std::net::Ipv6Addr::new(
+                0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, interface,
+            ));
+            let services = crate::platform::test_support::noop_services_with_client_ip(ip);
+            let mut ec =
+                EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+                    .expect("should read EC context");
+            assert_eq!(
+                ec.client_ip(),
+                Some(prefix),
+                "{ip}: the context should keep the /64 prefix alone"
+            );
+            ec.generate_if_needed(&settings, None)
+                .expect("should generate");
+            let created = ec
+                .ec_value()
+                .and_then(|value| value.strip_prefix("hmac~"))
+                .expect("should create an identifier under the hmac code");
+            assert_eq!(
+                generation::ec_hash(created),
+                generation::ec_hash(&expected),
+                "{ip}: the identity hash should be the hash of the /64 prefix"
+            );
+        }
+    }
+
+    #[test]
+    fn a_foreign_module_code_is_treated_as_absent() {
+        // An identifier carrying another module's code must never be adopted
+        // by the selected module, so switching modules cannot silently mix
+        // identity populations.
+        let settings = create_test_settings();
+        let foreign = format!("zz00~{}.ABC123", "a".repeat(64));
+        let cookie = format!("ts-ec={foreign}");
+        let req = create_test_request(&[("cookie", &cookie)]);
+        let ec = EcContext::read_from_request(&settings, &req, &noop_services())
+            .expect("should read EC context");
+        assert_eq!(
+            ec.ec_value(),
+            None,
+            "an identifier with a foreign module code is not this module's"
+        );
+    }
+
     #[test]
     fn kv_snapshot_distinguishes_non_present_states() {
         assert!(EcKvSnapshot::NotRead.entry_for("ec-1").is_none());
diff --git a/crates/trusted-server-core/src/ec/module.rs b/crates/trusted-server-core/src/ec/module.rs
new file mode 100644
index 000000000..acff56fc7
--- /dev/null
+++ b/crates/trusted-server-core/src/ec/module.rs
@@ -0,0 +1,1690 @@
+//! Edge Cookie identity modules.
+//!
+//! An [`EdgeCookieModule`] derives an Edge Cookie identifier. The module is
+//! selected by configuration, with no default, and [`build_module`] is the
+//! composition root that builds the selected one. A built-in module is
+//! constructed from its `[ec.<name>]` block, and a vendor module is taken
+//! from the adapter that injected it. Construction reads no request data,
+//! so a selection this deployment cannot satisfy fails at startup rather than
+//! leaving it running without an identity. Fastly, Cloudflare and Spin resolve
+//! the module once per application state and thread the result. Axum and
+//! embedders resolve per request.
+//!
+//! Request evidence reaches a module at call time rather than at
+//! construction. [`EdgeCookieModule::generate`] borrows a [`RequestInfo`],
+//! which carries the normalized client IP, the User-Agent and the request
+//! headers, for the life of the call, alongside an [`IdentityInput`] holding
+//! the request's gating context. A module reads what it needs and retains
+//! nothing. Core snapshots the headers, path and query it lends to the module
+//! at generate time, and the module itself keeps none of it.
+//!
+//! [`HmacModule`] is the built-in server-side implementation. It derives the
+//! identifier from the client IP using HMAC over the configured passphrase.
+
+use std::sync::Arc;
+
+use error_stack::Report;
+use serde::{Deserialize, Serialize};
+
+use crate::consent::ConsentContext;
+use crate::error::TrustedServerError;
+use crate::evidence::RequestInfo;
+use crate::redacted::Redacted;
+use crate::settings::{Ec, EcModuleBlock};
+
+use super::cookies::ec_id_has_only_allowed_chars;
+use super::generation;
+
+/// The Edge Cookie identity module a deployment has selected.
+///
+/// Deserialized from the `[ec] module` string and serialized back to the
+/// same string. Module names are open-ended (a vendor crate names its own),
+/// so every name other than the explicit `"none"` becomes
+/// [`Named`](Self::Named) rather than a parse failure, and whether the
+/// deployment can actually supply that module is decided by
+/// [`build_module`].
+///
+/// No module has a variant of its own, so every module is selected the
+/// same way, by name, and no caller can be written around one module being
+/// different.
+///
+/// This is the one place the selector is spelled. Everything that needs to ask
+/// which module is selected matches on this rather than comparing string
+/// literals.
+#[derive(Debug, Clone, Eq, Hash, PartialEq, Deserialize, Serialize)]
+#[serde(from = "String", into = "String")]
+pub enum EcModuleSelection {
+    /// Explicit statelessness, spelled `"none"`. The same meaning as omitting
+    /// the selector: no Edge Cookie is created and no module block may be
+    /// configured.
+    None,
+
+    /// A module selected by name, configured by the matching `[ec.<name>]`
+    /// block when it has settings. The name is the implementation unless that
+    /// block names one, and [`build_module`] resolves the implementation,
+    /// whether it is built into core or injected by the adapter.
+    Named(String),
+}
+
+impl EcModuleSelection {
+    /// The configuration spelling of explicit statelessness.
+    pub const NONE_KEY: &'static str = "none";
+
+    /// The configuration key this selection is written as.
+    #[must_use]
+    pub fn key(&self) -> &str {
+        match self {
+            Self::None => Self::NONE_KEY,
+            Self::Named(key) => key,
+        }
+    }
+}
+
+impl From<&str> for EcModuleSelection {
+    fn from(key: &str) -> Self {
+        match key {
+            EcModuleSelection::NONE_KEY => Self::None,
+            other => Self::Named(other.to_owned()),
+        }
+    }
+}
+
+impl From<String> for EcModuleSelection {
+    fn from(key: String) -> Self {
+        match key.as_str() {
+            EcModuleSelection::NONE_KEY => Self::None,
+            _ => Self::Named(key),
+        }
+    }
+}
+
+impl From<EcModuleSelection> for String {
+    fn from(selection: EcModuleSelection) -> Self {
+        match selection {
+            EcModuleSelection::None => EcModuleSelection::NONE_KEY.to_owned(),
+            EcModuleSelection::Named(key) => key,
+        }
+    }
+}
+
+/// The implementation id of the HMAC module built into core.
+///
+/// It is also [`HmacModule::id`]'s return value and the text of
+/// [`HMAC_MODULE_CODE`].
+pub const HMAC_MODULE_KEY: &str = "hmac";
+
+/// The type folder of every Edge Cookie crate, which a name written in
+/// `[ec] module` or an `implementation` line may leave off.
+pub const MODULE_TYPE: &str = "edgecookie";
+
+/// The implementation ids core supplies itself, one per resolution arm in
+/// [`resolve_named_module`].
+///
+/// [`build_module`] refuses an injected module under one of these ids
+/// rather than picking one of the two.
+const BUILTIN_MODULE_KEYS: &[&str] = &[HMAC_MODULE_KEY];
+
+/// The registry code of the built-in HMAC module.
+///
+/// The same text as [`HMAC_MODULE_KEY`], but a different role: this is the
+/// `{code}~` namespace stamped on every identifier the built-in module
+/// creates, and it is what [`generation`] matches when it decides whether an
+/// enveloped identifier is one of its own.
+pub const HMAC_MODULE_CODE: ModuleCode = crate::module_code!(HMAC_MODULE_KEY);
+
+/// The request-scoped gating context passed to [`EdgeCookieModule::generate`].
+///
+/// Request data reaches a module through the `request_info` parameter of
+/// [`EdgeCookieModule::generate`], not through this struct and not through
+/// anything injected into the module's constructor. This struct carries only
+/// the per-request gating context a module may read for behavior beyond
+/// gating. On the organic request path the gate has confirmed Edge Cookie
+/// storage is allowed before `generate` is called. A test calling
+/// `edge_cookie::generate_ec_id` reaches `generate` without that gate.
+#[derive(Default)]
+pub struct IdentityInput<'a> {
+    /// The request's consent context, when available, for module-specific
+    /// logic. The core gates generation before calling the module, so a
+    /// module reads this only to forward or record consent. [`HmacModule`]
+    /// ignores it.
+    pub consent: Option<&'a ConsentContext>,
+}
+
+/// The outcome of [`EdgeCookieModule::generate`].
+///
+/// Carries the derived identifier, if any, and any response headers the module
+/// needs set on the outbound response.
+#[derive(Debug, Default)]
+pub struct GeneratedEdgeCookie {
+    /// The derived Edge Cookie identifier, or `None` when the module produced
+    /// none for this request.
+    pub id: Option<String>,
+
+    /// Response headers the module needs set on the outbound response, for
+    /// example to request additional client evidence on later requests. Empty
+    /// for modules that set no headers, such as [`HmacModule`].
+    ///
+    /// Core checks every header here against its own reserved response surface
+    /// (see [`reserved_response_effect`]) before it is applied, so a module
+    /// may set its own cookies and headers but cannot reach into the surface
+    /// core manages.
+    pub response_headers: Vec<(http::HeaderName, http::HeaderValue)>,
+}
+
+/// The cookie-name namespace Trusted Server manages.
+///
+/// Every cookie core writes or reads as part of its own behavior is named
+/// `ts-<something>` (`ts-ec` in [`COOKIE_TS_EC`](crate::constants::COOKIE_TS_EC),
+/// `ts-eids` in [`COOKIE_TS_EIDS`](crate::constants::COOKIE_TS_EIDS), and
+/// `ts-tester` in [`COOKIE_TS_TESTER`](crate::constants::COOKIE_TS_TESTER)), so
+/// core defends the whole prefix rather than a list that a new managed cookie
+/// would silently outgrow. `sharedId` is deliberately not reserved: core only
+/// reads it, and it belongs to the page's own identity stack.
+const MANAGED_COOKIE_NAME_PREFIX: &[u8] = b"ts-";
+
+/// The response-header namespace Trusted Server reserves for itself.
+///
+/// Covers the fixed EC output headers and the per-partner
+/// `x-ts-<source_domain>` headers, which is why the prefix is reserved rather
+/// than the four names in
+/// [`INTERNAL_HEADERS`](crate::constants::INTERNAL_HEADERS).
+const RESERVED_RESPONSE_HEADER_PREFIX: &str = "x-ts-";
+
+/// Response headers that frame an HTTP message, are hop-by-hop, or govern
+/// caching.
+///
+/// The hop-by-hop set is RFC 7230 §6.1, plus `content-length`, which frames the
+/// body the adapter is about to write, and `cache-control`, which governs
+/// whether the response may be cached. A module that set any of these would
+/// be rewriting the response envelope rather than adding evidence to it, and a
+/// module setting `cache-control` could make an identity-bearing response
+/// publicly cacheable, so it is reserved with the rest.
+const FRAMING_OR_HOP_BY_HOP_HEADERS: &[&str] = &[
+    "cache-control",
+    "connection",
+    "content-length",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+];
+
+/// Why one module response header falls inside core's reserved surface.
+#[derive(Debug, Copy, Clone, Eq, PartialEq, derive_more::Display)]
+pub enum ReservedResponseEffect {
+    /// A `Set-Cookie` naming a cookie in the `ts-` namespace core manages.
+    #[display("sets a cookie in the `ts-` namespace Trusted Server manages")]
+    ManagedCookie,
+
+    /// A header in the `x-ts-` namespace core emits and strips.
+    #[display("sets a header in the reserved `x-ts-` namespace")]
+    ReservedHeader,
+
+    /// A framing, hop-by-hop, or caching header core manages.
+    #[display("sets a framing, hop-by-hop, or caching header core manages")]
+    FramingHeader,
+}
+
+/// The cookie name in a `Set-Cookie` value, as raw bytes.
+///
+/// Reads the bytes rather than a `&str` so a value that is not valid UTF-8
+/// cannot smuggle a managed cookie name past the check.
+fn set_cookie_name(value: &[u8]) -> &[u8] {
+    let pair_end = value.iter().position(|b| *b == b';').unwrap_or(value.len());
+    let pair = &value[..pair_end];
+    let name_end = pair.iter().position(|b| *b == b'=').unwrap_or(pair.len());
+    pair[..name_end].trim_ascii()
+}
+
+/// Classifies one module response header against core's reserved surface.
+///
+/// Returns `Some` when the header would reach into what core manages, and
+/// `None` for everything else, including a module's own cookie. Modules
+/// legitimately need to set cookies of their own (an evidence cookie for a
+/// later request, for example), so the rule reserves core's namespace rather
+/// than banning `Set-Cookie` outright.
+///
+/// A rejected effect is not simply dropped while the rest of the module
+/// response goes ahead. Generation returns an error instead, as it does for a
+/// module creating an identifier outside the cookie-safe alphabet, because a
+/// module reaching into the reserved surface has broken its contract in the
+/// same way. The check runs before anything from that module response is
+/// kept, so neither its identifier nor any of its headers is kept. The
+/// publisher proxy and integration proxy log the error and serve the response
+/// without an Edge Cookie, and orphan recovery in EC finalization leaves the
+/// visitor's existing cookie in place. Applying the header instead would let a
+/// module set `ts-ec` directly, bypassing core's identifier validation and
+/// its requirement that a created identifier have an identity-graph row.
+#[must_use]
+pub fn reserved_response_effect(
+    name: &http::HeaderName,
+    value: &http::HeaderValue,
+) -> Option<ReservedResponseEffect> {
+    let lower = name.as_str();
+    if lower == http::header::SET_COOKIE.as_str() {
+        let cookie_name = set_cookie_name(value.as_bytes());
+        if cookie_name.len() >= MANAGED_COOKIE_NAME_PREFIX.len()
+            && cookie_name[..MANAGED_COOKIE_NAME_PREFIX.len()]
+                .eq_ignore_ascii_case(MANAGED_COOKIE_NAME_PREFIX)
+        {
+            return Some(ReservedResponseEffect::ManagedCookie);
+        }
+        return None;
+    }
+    if lower.starts_with(RESERVED_RESPONSE_HEADER_PREFIX) {
+        return Some(ReservedResponseEffect::ReservedHeader);
+    }
+    if FRAMING_OR_HOP_BY_HOP_HEADERS.contains(&lower) {
+        return Some(ReservedResponseEffect::FramingHeader);
+    }
+    None
+}
+
+/// Appends a module's response headers to a response that already carries
+/// the publisher origin's own.
+///
+/// Appending keeps the origin's `Set-Cookie` and `Vary` lines, and lets a
+/// module set more than one cookie of its own.
+/// [`reserved_response_effect`] has already refused the single-valued headers
+/// core owns, so nothing a module may set here needs to replace a value.
+pub(crate) fn apply_module_response_headers<I>(headers: &mut http::HeaderMap, module_headers: I)
+where
+    I: IntoIterator<Item = (http::HeaderName, http::HeaderValue)>,
+{
+    for (name, value) in module_headers {
+        headers.append(name, value);
+    }
+}
+
+/// The registered short code that namespaces one Edge Cookie module's
+/// identifiers.
+///
+/// Exactly four characters from `[a-z0-9]`, allocated append-only in the
+/// module-code registry and never reused. The code appears as the
+/// `{code}~` prefix of every identifier the module creates, so identifiers
+/// from different modules can never collide in the cookie, the identity
+/// graph, or a withdrawal, and each identifier records which module
+/// created it.
+#[derive(Debug, Copy, Clone, Eq, Hash, PartialEq, derive_more::Display)]
+pub struct ModuleCode(&'static str);
+
+impl ModuleCode {
+    /// Creates a module code when `code` matches the registry format.
+    ///
+    /// Returns `None` when `code` is not exactly four characters of `[a-z0-9]`,
+    /// so a caller that assembles a code from anything other than a literal is
+    /// handed an answer it has to deal with rather than a panic. Nothing in
+    /// this function can panic, whatever it is called with and wherever it is
+    /// called from.
+    ///
+    /// Use [`module_code!`](crate::module_code) for a literal. That macro
+    /// runs this check while the crate is compiled, so a malformed code is a
+    /// build failure and the resulting value needs no unwrapping.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use trusted_server_core::ec::module::ModuleCode;
+    ///
+    /// assert_eq!(ModuleCode::new("t0ac").map(ModuleCode::as_str), Some("t0ac"));
+    /// assert_eq!(ModuleCode::new("nope!"), None);
+    /// ```
+    #[must_use]
+    pub const fn new(code: &'static str) -> Option<Self> {
+        let bytes = code.as_bytes();
+        if bytes.len() != 4 {
+            return None;
+        }
+        let mut i = 0;
+        while i < bytes.len() {
+            let b = bytes[i];
+            if !b.is_ascii_lowercase() && !b.is_ascii_digit() {
+                return None;
+            }
+            i += 1;
+        }
+        Some(Self(code))
+    }
+
+    /// The code as a string slice.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        self.0
+    }
+}
+
+/// Builds a [`ModuleCode`] from a constant, checked while the crate is
+/// compiled.
+///
+/// The check runs inside a `const` block, so a code that is not exactly four
+/// characters of `[a-z0-9]` fails the build instead of panicking at run time,
+/// and the value the macro produces needs no unwrapping. Every module code in
+/// this workspace is written through this macro, which is what makes
+/// [`ModuleCode::new`]'s fallible form safe to hand to anyone else.
+///
+/// # Examples
+///
+/// ```
+/// use trusted_server_core::module_code;
+///
+/// assert_eq!(module_code!("t0ac").as_str(), "t0ac");
+/// ```
+#[macro_export]
+macro_rules! module_code {
+    ($code:expr) => {
+        const {
+            match $crate::ec::module::ModuleCode::new($code) {
+                Some(code) => code,
+                None => panic!("module code must be exactly four characters of [a-z0-9]"),
+            }
+        }
+    };
+}
+
+/// The separator between a module code and the module's identifier value.
+///
+/// The tilde is inside the cookie-safe identifier alphabet and outside the
+/// built-in HMAC identifier's own characters, so a legacy bare identifier can
+/// never be misread as a coded one.
+pub const MODULE_CODE_SEPARATOR: char = '~';
+
+/// Splits a full identifier into its module-code prefix and value.
+///
+/// Returns `(Some(code), value)` when the identifier starts with a well-formed
+/// `{code}~` prefix, and `(None, full)` for a legacy bare identifier. The code
+/// here is the raw string, not a validated [`ModuleCode`]: an unknown code
+/// simply fails the ownership check against the selected module.
+#[must_use]
+pub fn split_module_code(full: &str) -> (Option<&str>, &str) {
+    if let Some((code, value)) = full.split_once(MODULE_CODE_SEPARATOR)
+        && code.len() == 4
+        && code
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit())
+    {
+        return (Some(code), value);
+    }
+    (None, full)
+}
+
+/// Whether the selected module owns `full` as one of its identifiers.
+///
+/// A coded identifier belongs to the module whose registered code it
+/// carries, with the value part accepted by that module's
+/// [`accepts_id`](EdgeCookieModule::accepts_id). An identifier with no code
+/// prefix is the built-in HMAC module's older form, still held in browsers,
+/// so the HMAC module alone owns it.
+#[must_use]
+pub fn module_owns_id(module: &dyn EdgeCookieModule, full: &str) -> bool {
+    match split_module_code(full) {
+        (Some(code), value) => code == module.code().as_str() && module.accepts_id(value),
+        (None, value) => module.id() == HMAC_MODULE_KEY && module.accepts_id(value),
+    }
+}
+
+/// The full created identifier for `value` under `module`'s code.
+#[must_use]
+pub fn apply_module_code(module: &dyn EdgeCookieModule, value: &str) -> String {
+    format!("{}{MODULE_CODE_SEPARATOR}{value}", module.code())
+}
+
+/// The KV-key form of a full identifier under `module`.
+///
+/// The code prefix is preserved verbatim and the module normalizes only its
+/// own value part, so distinct modules' rows can never share a key and a
+/// module never sees another module's syntax.
+#[must_use]
+pub fn module_kv_key(module: &dyn EdgeCookieModule, full: &str) -> String {
+    match split_module_code(full) {
+        (Some(code), value) => format!(
+            "{code}{MODULE_CODE_SEPARATOR}{}",
+            module.normalize_id_for_kv(value)
+        ),
+        (None, value) => module.normalize_id_for_kv(value),
+    }
+}
+
+/// The modules whose identifiers a partner or diagnostic path accepts.
+///
+/// Pull sync, batch sync, and the admin lookup each take an identifier from
+/// outside the organic request path and have to decide whether Trusted Server
+/// issued it. The answer is in two parts. The **global cookie bounds** (the
+/// length cap and the cookie-safe alphabet, see `ec_id_has_only_allowed_chars`)
+/// apply to every identifier whichever module created it. The rest is
+/// **dispatched by the `{code}~` prefix** to the module that owns that code,
+/// which canonicalizes its own value part and decides whether the canonical
+/// form is one of its own. A code no module in the set owns is rejected, so a
+/// second module's identifiers can never be adopted or written under this
+/// deployment's keys.
+///
+/// All three look rows up under the key
+/// [`canonical_kv_key`](Self::canonical_kv_key) returns rather than under the
+/// identifier as given, and pull sync and batch sync also write under that
+/// key, so a module whose canonical form differs from the cookie value still
+/// reaches the row it created. Batch sync and the admin lookup call
+/// `canonical_kv_key` directly. Pull sync calls `canonical_kv_key` through
+/// `EcContext::kv_key_for` and still sends partners the identifier as issued.
+///
+/// The set holds the deployment's active module, so an identifier another
+/// module created is rejected, one created under an earlier selection
+/// included. A stateless deployment, with no module in the set, falls back
+/// to the built-in HMAC grammar (see
+/// [`canonical_kv_key`](Self::canonical_kv_key)).
+pub struct AcceptedModules<'a> {
+    readers: Vec<&'a dyn EdgeCookieModule>,
+}
+
+impl<'a> AcceptedModules<'a> {
+    /// The set holding only the deployment's active module.
+    ///
+    /// `None` means no module is selected, so the deployment is stateless.
+    #[must_use]
+    pub fn active(module: Option<&'a dyn EdgeCookieModule>) -> Self {
+        Self {
+            readers: module.into_iter().collect(),
+        }
+    }
+
+    /// The module in the set that owns `full`'s code.
+    ///
+    /// Dispatch is on the code alone, before any module looks at a value, so
+    /// an identifier a partner echoed back in a different case still reaches
+    /// its own module to be canonicalized rather than being rejected first.
+    /// A legacy bare identifier predates the envelope and belongs to the
+    /// built-in HMAC module alone.
+    fn owner(&self, full: &str) -> Option<&'a dyn EdgeCookieModule> {
+        let (code, _) = split_module_code(full);
+        self.readers.iter().copied().find(|module| match code {
+            Some(code) => module.code().as_str() == code,
+            None => module.id() == HMAC_MODULE_KEY,
+        })
+    }
+
+    /// Whether `full` is an identifier this deployment accepts.
+    #[must_use]
+    pub fn accepts(&self, full: &str) -> bool {
+        self.canonical_kv_key(full).is_some()
+    }
+
+    /// The identity-graph key for `full`, or `None` when nothing in the set
+    /// accepts it.
+    ///
+    /// The owning module supplies the canonical form of its own value part
+    /// and the code prefix is preserved verbatim, so two modules' rows can
+    /// never share a key.
+    #[must_use]
+    pub fn canonical_kv_key(&self, full: &str) -> Option<String> {
+        if !ec_id_has_only_allowed_chars(full) {
+            return None;
+        }
+        match self.owner(full) {
+            Some(owner) => {
+                let key = module_kv_key(owner, full);
+                module_owns_id(owner, &key).then_some(key)
+            }
+            // No module is selected, so there is no code to dispatch on and
+            // the built-in HMAC grammar is the fallback for a stateless
+            // deployment.
+            None if self.readers.is_empty() => {
+                let key = generation::normalize_ec_id_for_kv(full);
+                generation::is_valid_ec_id(&key).then_some(key)
+            }
+            // A code that belongs to some other deployment's module.
+            None => None,
+        }
+    }
+}
+
+/// A strategy for deriving an Edge Cookie identifier.
+///
+/// Implementations are selected by configuration. A module derives the
+/// identifier at the edge in [`generate`](Self::generate), and the page
+/// response sets the `ts-ec` cookie.
+///
+/// A module that cannot derive an identifier at the edge returns a
+/// [`GeneratedEdgeCookie`] whose [`id`](GeneratedEdgeCookie::id) is `None`, so
+/// the request proceeds without an Edge Cookie rather than failing.
+pub trait EdgeCookieModule: Send + Sync + core::fmt::Debug {
+    /// Returns the stable implementation id for this module, used in
+    /// configuration and logs.
+    ///
+    /// This is what `[ec] module` selects the module by, or what an
+    /// `[ec.<name>] implementation` names when the module is configured
+    /// under a label of the operator's choosing.
+    fn id(&self) -> &'static str;
+
+    /// The module's registered code, the `{code}~` namespace of every
+    /// identifier it creates.
+    ///
+    /// Mandatory, with no default: a module must allocate a unique code in
+    /// the module-code registry before it can exist, so no two modules
+    /// can ever create colliding identifiers. Core applies the code at
+    /// creation and checks it at read-back, and the module itself only ever
+    /// sees its own value part.
+    fn code(&self) -> ModuleCode;
+
+    /// Derives an Edge Cookie identifier from the request evidence in
+    /// `request_info` and the gating context in `input`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::EdgeCookie`] when derivation fails.
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>>;
+
+    /// Returns whether `value` is a well-formed identifier this module issues.
+    ///
+    /// Core calls this to decide whether an incoming `ts-ec` cookie value is a
+    /// usable Edge Cookie identifier before reading it back, keying the KV
+    /// identity graph, or withdrawing it. Core strips the module's `{code}~`
+    /// prefix first, so this receives only the module's own value part.
+    /// This keeps the identifier opaque to
+    /// core: a module whose identifiers are not the built-in shape (for
+    /// example an opaque signed envelope) accepts its own format here, so its
+    /// identifier round-trips instead of being silently dropped on read-back.
+    /// Core also asks about the string
+    /// [`normalize_id_for_kv`](Self::normalize_id_for_kv) returns.
+    ///
+    /// The default accepts the built-in HMAC identifier shape
+    /// (`<64 hex>.<6 alphanumeric>`), which is correct for [`HmacModule`], the
+    /// one module core builds in.
+    fn accepts_id(&self, value: &str) -> bool {
+        generation::is_valid_ec_id(value)
+    }
+
+    /// Returns the identity two visits must share to be treated as the same
+    /// visitor, which is what core keys the identity graph by.
+    ///
+    /// Core builds the key from the module's code and the returned string, so
+    /// two identifiers that return the same string share one row and two that
+    /// differ never meet. A module whose identifier carries a signature, a
+    /// nonce, a timestamp or any other part that changes each time the
+    /// identifier is issued must return the stable part and not the value as
+    /// transported, or the identity does not survive a reissue. A module whose
+    /// whole identifier is stable returns it unchanged, keeping its case where
+    /// case matters, so distinct identifiers are not collapsed into one key.
+    ///
+    /// Core asks [`accepts_id`](Self::accepts_id) about the returned string as
+    /// well as about the identifier as issued, so a module must accept its own
+    /// canonical form, or no row is read or written for it.
+    ///
+    /// The default lowercases the leading HMAC hash segment and preserves the
+    /// suffix, matching the built-in identifier shape.
+    fn normalize_id_for_kv(&self, value: &str) -> String {
+        generation::normalize_ec_id_for_kv(value)
+    }
+}
+
+/// The built-in HMAC Edge Cookie module.
+///
+/// Derives the identifier from the client IP (read from the [`RequestInfo`]
+/// passed at call time) and the configured passphrase via
+/// [`generation::generate_ec_id`].
+///
+/// The client IP is this module's only input, so it is this module that
+/// requires one. On a host that cannot supply one, [`RequestInfo::client_ip`]
+/// is the empty string and [`generate`](Self::generate) fails rather than
+/// hashing the empty string into an identifier every visitor on that host
+/// would share. The failure is returned to the caller. The publisher proxy and
+/// integration proxy log it and serve the response without an Edge Cookie. A
+/// module that reads other evidence makes its own decision and is unaffected.
+#[derive(Debug, Clone)]
+pub struct HmacModule {
+    passphrase: Redacted<String>,
+}
+
+impl HmacModule {
+    /// Creates an HMAC module with the given passphrase.
+    #[must_use]
+    pub fn new(passphrase: Redacted<String>) -> Self {
+        Self { passphrase }
+    }
+}
+
+impl EdgeCookieModule for HmacModule {
+    fn id(&self) -> &'static str {
+        HMAC_MODULE_KEY
+    }
+
+    fn code(&self) -> ModuleCode {
+        HMAC_MODULE_CODE
+    }
+
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        _input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+        let client_ip = request_info.client_ip();
+        if client_ip.is_empty() {
+            return Err(Report::new(TrustedServerError::EdgeCookie {
+                message: "Edge Cookie module `hmac` requires the client IP, and this host \
+                          could not supply one"
+                    .to_owned(),
+            }));
+        }
+        let id = generation::generate_ec_id(self.passphrase.expose(), client_ip)?;
+        Ok(GeneratedEdgeCookie {
+            id: Some(id),
+            response_headers: Vec::new(),
+        })
+    }
+}
+
+/// Refuses an injected module that claims an implementation core supplies
+/// itself.
+///
+/// An adapter may inject a module whose id is also a built-in id, and the
+/// resolution order alone would silently prefer the built-in one and drop the
+/// injected module, so the pair is refused and the error names both
+/// claimants. The check runs before the selection is read, so the clash is
+/// reported at startup whatever the selector says, and selecting something
+/// else cannot hide it.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the injected module's id
+/// is one of [`BUILTIN_MODULE_KEYS`].
+fn ensure_no_name_collision(
+    injected: Option<&dyn EdgeCookieModule>,
+) -> Result<(), Report<TrustedServerError>> {
+    let Some(injected) = injected else {
+        return Ok(());
+    };
+    let Some(claimed) = BUILTIN_MODULE_KEYS
+        .iter()
+        .find(|key| **key == injected.id())
+    else {
+        return Ok(());
+    };
+    Err(Report::new(TrustedServerError::EdgeCookie {
+        message: format!(
+            "Edge Cookie module implementation `{claimed}` is claimed twice, by the \
+             module built into Trusted Server core and by the module this \
+             deployment's adapter injects. Give the injected module an implementation \
+             of its own and select it under that, because `{claimed}` cannot mean both \
+             of them."
+        ),
+    }))
+}
+
+/// Builds the Edge Cookie module named by the `[ec] module` selector.
+///
+/// This is the composition root for the Edge Cookie module. It reads the
+/// `[ec]` configuration and takes the adapter's optional injected module,
+/// resolving the selector to the built-in module or the injected one. The
+/// per-request [`RequestInfo`] is passed borrowed to
+/// [`generate`](EdgeCookieModule::generate) at call time rather than stored,
+/// so no request snapshot is cloned here. Returns `Ok(None)` when no module
+/// is selected, so the caller stays stateless.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the named module cannot be
+/// built, which is a built-in implementation whose configuration block is
+/// missing, or an implementation this deployment's adapter does not inject.
+/// Both fail loudly rather than leaving the deployment running stateless under
+/// a selector that says otherwise.
+pub fn build_module(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<Option<Box<dyn EdgeCookieModule>>, Report<TrustedServerError>> {
+    ensure_no_name_collision(injected.as_deref())?;
+    let Some(selection) = ec.module.as_ref() else {
+        return Ok(None);
+    };
+    let module: Option<Box<dyn EdgeCookieModule>> = match selection {
+        // Explicit statelessness: the same meaning as omitting the selector.
+        EcModuleSelection::None => None,
+        EcModuleSelection::Named(name) => Some(resolve_named_module(name, ec, injected)?),
+    };
+    Ok(module)
+}
+
+/// Resolves one module name to its implementation.
+///
+/// The implementation is the one the name's `[ec.<name>]` block names, or the
+/// name itself. It is looked for among the modules built into core first,
+/// and is otherwise the module the adapter injects through
+/// [`RuntimeServices`](crate::platform::RuntimeServices) when the
+/// implementation names that module's id, written in full or with the
+/// `edgecookie` type folder left off, so resolving an injected module
+/// needs no vendor name in core. The adapter reads the injected module's
+/// block when it builds it. Looking at core first cannot shadow an injected
+/// module, because [`ensure_no_name_collision`] has already refused one that
+/// claims a built-in implementation.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the implementation matches
+/// no module this deployment can build, naming the implementations it has,
+/// or when a built-in implementation has no configuration block.
+fn resolve_named_module(
+    name: &str,
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<Box<dyn EdgeCookieModule>, Report<TrustedServerError>> {
+    let implementation = ec.module_blocks.implementation(name);
+
+    // Settings validation rejects a built-in implementation with no block
+    // before this runs, so reaching the error means the two checks have
+    // drifted apart. Stopping is the only safe answer, because returning no
+    // module would run the deployment stateless under a selector that says
+    // it has an identity module.
+    if implementation == HMAC_MODULE_KEY {
+        let config = ec
+            .module_blocks
+            .get(name)
+            .and_then(EcModuleBlock::hmac_settings)
+            .ok_or_else(|| {
+                Report::new(TrustedServerError::EdgeCookie {
+                    message: format!(
+                        "Edge Cookie module `{name}` uses the `hmac` implementation but \
+                         has no `[ec.{name}]` configuration"
+                    ),
+                })
+            })?;
+        return Ok(Box::new(HmacModule::new(config.passphrase.clone())));
+    }
+
+    let known = known_implementations(injected.as_deref());
+    injected
+        .filter(|module| {
+            crate::module_name::resolve(MODULE_TYPE, implementation, &[module.id()]).is_some()
+        })
+        .map(|module| Box::new(SharedModule(module)) as Box<dyn EdgeCookieModule>)
+        .ok_or_else(|| {
+            Report::new(TrustedServerError::EdgeCookie {
+                message: format!(
+                    "Edge Cookie module `{name}` is selected, but its implementation \
+                     `{implementation}` is not one this deployment has. Known \
+                     implementations: {known}"
+                ),
+            })
+        })
+}
+
+/// The implementations this deployment could build, for an error that has just
+/// refused one it could not.
+///
+/// The modules built into core, plus the one the adapter injects when there
+/// is one, which is the whole set [`resolve_named_module`] chooses from.
+fn known_implementations(injected: Option<&dyn EdgeCookieModule>) -> String {
+    BUILTIN_MODULE_KEYS
+        .iter()
+        .copied()
+        .chain(injected.map(EdgeCookieModule::id))
+        .map(|implementation| format!("`{implementation}`"))
+        .collect::<Vec<_>>()
+        .join(", ")
+}
+
+/// Checks once, at startup, that this deployment can build the module named
+/// by the `[ec] module` selector.
+///
+/// The composition root calls this while it builds application state, passing
+/// the same injected module it will put into
+/// [`RuntimeServices`](crate::platform::RuntimeServices) on every request.
+/// [`build_module`] reads no request data, so the answer is the same for
+/// every request and a selection the adapter can never supply fails at startup
+/// rather than on the first request. A stateless deployment (no selector, or
+/// `"none"`) passes.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError::EdgeCookie`] when the selected module cannot
+/// be built from the services this deployment injects.
+pub fn ensure_module_available(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<(), Report<TrustedServerError>> {
+    build_shared_module(ec, injected)?;
+    Ok(())
+}
+
+/// Resolves the selected module into a shared handle the composition root can
+/// keep and the request path can reuse.
+///
+/// The same resolution as [`build_module`], returned as an `Arc` rather than
+/// a `Box` so one instance can be threaded into
+/// [`RuntimeServices`](crate::platform::RuntimeServices) and read by every
+/// request without being built again. An adapter that calls this while it
+/// builds application state gets the startup check
+/// [`ensure_module_available`] performs and the module itself for one piece
+/// of work rather than two.
+///
+/// # Errors
+///
+/// The same errors as [`build_module`].
+pub fn build_shared_module(
+    ec: &Ec,
+    injected: Option<Arc<dyn EdgeCookieModule>>,
+) -> Result<Option<Arc<dyn EdgeCookieModule>>, Report<TrustedServerError>> {
+    Ok(build_module(ec, injected)?.map(Arc::from))
+}
+
+/// The Edge Cookie module to use for this request.
+///
+/// A module reaches the request path through one seam only. An adapter
+/// resolves `[ec] module` once while it builds application state and threads
+/// the answer into
+/// [`RuntimeServices::resolved_ec_module`](crate::platform::RuntimeServices::resolved_ec_module),
+/// and that same instance comes back here with nothing resolved or constructed
+/// again on the request path. When nothing was threaded, this builds from
+/// `[ec]` settings alone, which is what a deployment selecting only a built-in
+/// module does.
+///
+/// # Errors
+///
+/// The same errors as [`build_module`], and only when the adapter threaded
+/// nothing, because a threaded module has already been resolved successfully.
+pub fn request_module(
+    ec: &Ec,
+    services: &crate::platform::RuntimeServices,
+) -> Result<Option<Arc<dyn EdgeCookieModule>>, Report<TrustedServerError>> {
+    if let Some(resolved) = services.resolved_ec_module() {
+        return Ok(Some(resolved));
+    }
+    build_shared_module(ec, None)
+}
+
+/// Adapts an injected, shared [`EdgeCookieModule`] to the owned `Box` that
+/// [`build_module`] returns.
+///
+/// A vendor or host module is injected as an `Arc` so it can live in
+/// [`RuntimeServices`](crate::platform::RuntimeServices) and be cloned per
+/// request. Every method delegates to the inner module, so its behavior is
+/// unchanged.
+#[derive(Debug)]
+struct SharedModule(Arc<dyn EdgeCookieModule>);
+
+impl EdgeCookieModule for SharedModule {
+    fn code(&self) -> ModuleCode {
+        self.0.code()
+    }
+
+    fn id(&self) -> &'static str {
+        self.0.id()
+    }
+
+    fn generate(
+        &self,
+        request_info: &dyn RequestInfo,
+        input: &IdentityInput<'_>,
+    ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+        self.0.generate(request_info, input)
+    }
+
+    fn accepts_id(&self, value: &str) -> bool {
+        self.0.accepts_id(value)
+    }
+
+    fn normalize_id_for_kv(&self, value: &str) -> String {
+        self.0.normalize_id_for_kv(value)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_support::tests::select_hmac_module;
+
+    /// Settings selecting the built-in HMAC module under `name`, which is a
+    /// label whenever it is not the implementation's own name.
+    fn selected_hmac(name: &str) -> Ec {
+        let mut ec = Ec::default();
+        select_hmac_module(&mut ec, name, test_passphrase().expose());
+        ec
+    }
+
+    #[test]
+    fn a_malformed_module_code_is_refused_rather_than_panicking() {
+        // `ModuleCode::new` is public, so a vendor crate can reach it with a
+        // value it assembled rather than a literal. Every rejected shape has to
+        // come back as `None`, because a panic here would take down whatever
+        // request the caller was serving.
+        for malformed in ["", "abc", "abcde", "AB12", "t0a_", "t0a-", "t0a ", "t.ac"] {
+            assert_eq!(
+                ModuleCode::new(malformed),
+                None,
+                "`{malformed}` is outside the registry format and should be refused"
+            );
+        }
+
+        assert_eq!(
+            ModuleCode::new("t0ac").map(ModuleCode::as_str),
+            Some("t0ac"),
+            "a well-formed code should still be accepted"
+        );
+    }
+
+    #[test]
+    fn the_module_code_macro_keeps_the_compile_time_guarantee() {
+        // The macro checks a literal while the crate is compiled and yields the
+        // code itself, so the codes written across this workspace stay as
+        // strong as the old panicking constructor made them, with none of the
+        // run-time risk.
+        assert_eq!(
+            crate::module_code!("t0ac").as_str(),
+            "t0ac",
+            "the macro should yield the code it was given"
+        );
+        assert_eq!(
+            HMAC_MODULE_CODE.as_str(),
+            HMAC_MODULE_KEY,
+            "the built-in code should still be the built-in key"
+        );
+    }
+
+    #[test]
+    fn split_module_code_separates_coded_and_legacy_forms() {
+        assert_eq!(
+            split_module_code("hmac~abc.DEF123"),
+            (Some("hmac"), "abc.DEF123"),
+            "a four-character code before the first tilde splits off"
+        );
+        assert_eq!(
+            split_module_code("51dd~value~with~tildes"),
+            (Some("51dd"), "value~with~tildes"),
+            "only the first tilde splits, so a value may contain tildes"
+        );
+        assert_eq!(
+            split_module_code("abcdef.XYZ"),
+            (None, "abcdef.XYZ"),
+            "no tilde means the legacy bare form"
+        );
+        assert_eq!(
+            split_module_code("toolong~x"),
+            (None, "toolong~x"),
+            "a prefix that is not exactly four characters is not a code"
+        );
+        assert_eq!(
+            split_module_code("AB12~x"),
+            (None, "AB12~x"),
+            "uppercase is outside the code alphabet"
+        );
+    }
+
+    fn header(name: &str, value: &str) -> (http::HeaderName, http::HeaderValue) {
+        (
+            http::HeaderName::from_bytes(name.as_bytes()).expect("should parse header name"),
+            http::HeaderValue::from_str(value).expect("should parse header value"),
+        )
+    }
+
+    #[test]
+    fn reserved_response_effect_rejects_the_namespace_core_manages() {
+        for (name, value, expected) in [
+            (
+                "set-cookie",
+                "ts-ec=hmac~deadbeef.abc123; Path=/",
+                ReservedResponseEffect::ManagedCookie,
+            ),
+            (
+                "Set-Cookie",
+                "  TS-EIDS=x; Path=/",
+                ReservedResponseEffect::ManagedCookie,
+            ),
+            ("x-ts-ec", "spoofed", ReservedResponseEffect::ReservedHeader),
+            (
+                "X-TS-partner.example.com",
+                "uid",
+                ReservedResponseEffect::ReservedHeader,
+            ),
+            ("content-length", "0", ReservedResponseEffect::FramingHeader),
+            (
+                "Transfer-Encoding",
+                "chunked",
+                ReservedResponseEffect::FramingHeader,
+            ),
+            ("connection", "close", ReservedResponseEffect::FramingHeader),
+            (
+                "cache-control",
+                "public, max-age=31536000",
+                ReservedResponseEffect::FramingHeader,
+            ),
+            (
+                "Cache-Control",
+                "public",
+                ReservedResponseEffect::FramingHeader,
+            ),
+        ] {
+            let (name, value) = header(name, value);
+            assert_eq!(
+                reserved_response_effect(&name, &value),
+                Some(expected),
+                "`{name}` should be reserved"
+            );
+        }
+    }
+
+    #[test]
+    fn reserved_response_effect_allows_module_owned_effects() {
+        for (name, value) in [
+            ("set-cookie", "acme-evidence=abc; Path=/; Secure"),
+            ("set-cookie", "sharedId=abc"),
+            ("accept-ch", "Sec-CH-UA-Full-Version-List"),
+            ("x-acme-probe", "1"),
+            ("vary", "Sec-CH-UA"),
+        ] {
+            let (name, value) = header(name, value);
+            assert_eq!(
+                reserved_response_effect(&name, &value),
+                None,
+                "`{name}` is the module's own and should be allowed"
+            );
+        }
+    }
+
+    #[test]
+    fn reserved_response_effect_reads_a_non_utf8_set_cookie_as_bytes() {
+        // A `Set-Cookie` carrying a byte above 127 cannot be read as a string,
+        // so the cookie name is matched on raw bytes. Reading it as UTF-8 and
+        // giving up on failure would let this value through.
+        let name = http::header::SET_COOKIE;
+        let mut bytes = b"ts-ec=value".to_vec();
+        bytes.push(0xff);
+        bytes.extend_from_slice(b"; Path=/");
+        let value =
+            http::HeaderValue::from_bytes(&bytes).expect("should build a non-utf8 header value");
+        assert!(
+            value.to_str().is_err(),
+            "the test value should not be readable as UTF-8"
+        );
+        assert_eq!(
+            reserved_response_effect(&name, &value),
+            Some(ReservedResponseEffect::ManagedCookie),
+            "a non-UTF-8 Set-Cookie should still be matched on its cookie name"
+        );
+    }
+
+    /// A stand-in for a vendor module an adapter injects.
+    #[derive(Debug)]
+    struct VendorModule;
+
+    impl EdgeCookieModule for VendorModule {
+        fn id(&self) -> &'static str {
+            "acme"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0ac")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+    }
+
+    #[test]
+    fn accepted_modules_splits_global_bounds_from_module_dispatch() {
+        let hmac = HmacModule::new(Redacted::new("test-secret-key-32-bytes-minimum".to_owned()));
+        let hmac_value = format!("{}.ABC123", "a".repeat(64));
+        let active = AcceptedModules::active(Some(&hmac));
+
+        // The global bounds come first and apply whoever created the value. A
+        // character outside the cookie-safe alphabet, or a value over the
+        // length cap, never reaches a module.
+        assert!(
+            !active.accepts(&format!("hmac~{hmac_value} with spaces")),
+            "the cookie-safe alphabet is a global bound"
+        );
+        assert!(
+            !active.accepts(&format!("hmac~{}", "a".repeat(300))),
+            "the length cap is a global bound"
+        );
+
+        // Then dispatch by code to the module that owns it.
+        assert!(
+            active.accepts(&format!("hmac~{hmac_value}")),
+            "the active module's own code is accepted"
+        );
+        assert!(
+            active.accepts(&hmac_value),
+            "the legacy bare form belongs to the built-in module"
+        );
+        assert!(
+            !active.accepts(&format!("t0ac~{hmac_value}")),
+            "a code no configured module reads is rejected even in the HMAC shape"
+        );
+
+        // A vendor module's own identifiers are accepted when it is the
+        // active one, and the built-in bare form then belongs to nobody.
+        let vendor = AcceptedModules::active(Some(&VendorModule));
+        assert!(
+            vendor.accepts(&format!("t0ac~{hmac_value}")),
+            "the vendor module's code is accepted when it is active"
+        );
+        assert!(
+            !vendor.accepts(&hmac_value),
+            "the legacy bare form is the built-in module's alone"
+        );
+
+        // With no module selected the deployment is stateless, so the
+        // built-in grammar is the fallback, as it has always been.
+        let stateless = AcceptedModules::active(None);
+        assert!(
+            stateless.accepts(&hmac_value),
+            "a stateless deployment falls back to the built-in grammar"
+        );
+        assert!(
+            !stateless.accepts("not-an-identifier"),
+            "the fallback is still the built-in grammar, not anything goes"
+        );
+    }
+
+    #[test]
+    fn the_selector_round_trips_through_serialization() {
+        // The typed selector must not change the configuration surface. The
+        // same TOML has to parse to the same choice, and serializing has to
+        // write the same key back, so an existing operator configuration keeps
+        // working and a config push does not rewrite the selector.
+        for (key, expected) in [
+            (EcModuleSelection::NONE_KEY, EcModuleSelection::None),
+            (
+                HMAC_MODULE_KEY,
+                EcModuleSelection::Named(HMAC_MODULE_KEY.to_owned()),
+            ),
+            ("acme", EcModuleSelection::Named("acme".to_owned())),
+        ] {
+            let ec: Ec = toml::from_str(&format!("module = \"{key}\""))
+                .expect("should parse the [ec] section");
+            assert_eq!(
+                ec.module.as_ref(),
+                Some(&expected),
+                "`{key}` should select the module it names"
+            );
+            assert_eq!(
+                expected.key(),
+                key,
+                "`{key}` should report itself under the key it was written as"
+            );
+
+            // The serialized form is the string itself, byte for byte, so an
+            // operator configuration written before the selector was typed
+            // parses and is written back identically.
+            let value =
+                toml::Value::try_from(expected.clone()).expect("should serialize the selection");
+            assert_eq!(
+                value,
+                toml::Value::String(key.to_owned()),
+                "`{key}` should serialize to exactly its own string"
+            );
+
+            let written = toml::to_string(&ec).expect("should serialize the [ec] section");
+            assert!(
+                written.contains(&format!("module = \"{key}\"")),
+                "`{key}` should be written back unchanged, got: {written}"
+            );
+
+            // A full round trip through the document leaves the same choice.
+            let reparsed: Ec = toml::from_str(&written).expect("should reparse the [ec] section");
+            assert_eq!(
+                reparsed.module.as_ref(),
+                Some(&expected),
+                "`{key}` should survive a serialize and parse round trip"
+            );
+        }
+    }
+
+    #[test]
+    fn each_selection_builds_what_its_string_key_built_before() {
+        // `none` is stateless, exactly as omitting the selector is.
+        let none = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        assert!(
+            build_module(&none, None)
+                .expect("explicit statelessness should build")
+                .is_none(),
+            "`none` should select no module"
+        );
+
+        // `hmac` with its block builds the built-in module.
+        let hmac = selected_hmac(HMAC_MODULE_KEY);
+        let built = build_module(&hmac, None)
+            .expect("the hmac selection should build")
+            .expect("the hmac selection should yield a module");
+        assert_eq!(
+            built.id(),
+            HMAC_MODULE_KEY,
+            "`hmac` should select the built-in module"
+        );
+        assert_eq!(
+            built.code(),
+            HMAC_MODULE_CODE,
+            "the built-in module should carry the built-in code"
+        );
+
+        // An arbitrary vendor name selects the module the adapter injected
+        // under that same implementation.
+        let vendor = Ec {
+            module: Some(EcModuleSelection::Named("acme".to_owned())),
+            ..Ec::default()
+        };
+        let built = build_module(&vendor, Some(Arc::new(VendorModule)))
+            .expect("the vendor selection should build")
+            .expect("the vendor selection should yield a module");
+        assert_eq!(
+            built.id(),
+            "acme",
+            "a vendor name should select the injected module of that id"
+        );
+    }
+
+    #[test]
+    fn a_label_builds_the_implementation_its_block_names() {
+        // The selector names a block, and the block names the implementation,
+        // so everything that resolves the selection has to read the
+        // implementation rather than the label the operator chose.
+        let labeled_hmac = selected_hmac("primary");
+        let built = build_module(&labeled_hmac, None)
+            .expect("a labeled hmac block should build")
+            .expect("a labeled hmac block should yield a module");
+        assert_eq!(
+            built.id(),
+            HMAC_MODULE_KEY,
+            "the label should build the implementation its block names"
+        );
+        assert_eq!(
+            built.code(),
+            HMAC_MODULE_CODE,
+            "the identifiers it creates carry the implementation's own code"
+        );
+
+        // The same for a module the adapter injects, which is matched on the
+        // implementation its block names and not on the label.
+        let labeled_vendor: Ec = toml::from_str(
+            "module = \"main\"\n\n[main]\nimplementation = \"acme\"\nendpoint = \"https://ec.acme.example.com\"\n",
+        )
+        .expect("should parse a labeled vendor block");
+        let built = build_module(&labeled_vendor, Some(Arc::new(VendorModule)))
+            .expect("a labeled vendor block should build")
+            .expect("a labeled vendor block should yield a module");
+        assert_eq!(
+            built.id(),
+            "acme",
+            "the label should build the injected module its block names"
+        );
+    }
+
+    #[test]
+    fn module_ownership_follows_the_code() {
+        let module = HmacModule::new(test_passphrase());
+        let legacy = format!("{}.ABC123", "a".repeat(64));
+        let coded = format!("hmac~{legacy}");
+        let foreign = format!("zz00~{legacy}");
+        assert!(
+            module_owns_id(&module, &coded),
+            "the module owns identifiers carrying its own code"
+        );
+        assert!(
+            module_owns_id(&module, &legacy),
+            "the built-in hmac module dual-reads the legacy bare form"
+        );
+        assert!(
+            !module_owns_id(&module, &foreign),
+            "an identifier with another module's code is never owned"
+        );
+    }
+    use crate::redacted::Redacted;
+
+    fn test_passphrase() -> Redacted<String> {
+        Redacted::from("a-test-passphrase-32-bytes-minimum".to_owned())
+    }
+
+    #[test]
+    fn default_id_semantics_match_the_builtin_shape() {
+        let module = HmacModule::new(test_passphrase());
+
+        // The default `accepts_id` accepts the built-in HMAC shape and rejects
+        // anything else, so a built-in module's identifiers round-trip while an
+        // opaque value is left to a module that overrides the check.
+        let valid = format!("{}.{}", "a".repeat(64), "abc123");
+        assert!(module.accepts_id(&valid), "should accept the HMAC shape");
+        assert!(
+            !module.accepts_id("not-hmac-shaped"),
+            "should reject a non-HMAC identifier by default"
+        );
+
+        // The default `normalize_id_for_kv` lowercases the hash segment. This is
+        // exactly the transform that would corrupt an opaque case-sensitive
+        // identifier, which is why such a module overrides it.
+        let mixed = format!("{}.{}", "A".repeat(64), "abc123");
+        assert_eq!(
+            module.normalize_id_for_kv(&mixed),
+            format!("{}.{}", "a".repeat(64), "abc123"),
+            "the default should lowercase the hash segment"
+        );
+    }
+
+    #[test]
+    fn shared_module_delegates_id_semantics_to_the_inner_module() {
+        // `SharedModule` wraps an adapter-injected module. It must forward
+        // every trait method to the inner module, including `accepts_id` and
+        // `normalize_id_for_kv`; a wrapper that silently used the defaults would
+        // drop an opaque vendor identifier on read-back. This guards that
+        // delegation directly.
+        #[derive(Debug)]
+        struct Inner;
+
+        impl EdgeCookieModule for Inner {
+            fn id(&self) -> &'static str {
+                "inner"
+            }
+
+            fn code(&self) -> ModuleCode {
+                crate::module_code!("t0in")
+            }
+
+            fn generate(
+                &self,
+                _request_info: &dyn RequestInfo,
+                _input: &IdentityInput<'_>,
+            ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+                Ok(GeneratedEdgeCookie::default())
+            }
+
+            fn accepts_id(&self, value: &str) -> bool {
+                value == "opaque-ok"
+            }
+
+            fn normalize_id_for_kv(&self, value: &str) -> String {
+                format!("kv:{value}")
+            }
+        }
+
+        let shared = SharedModule(Arc::new(Inner));
+
+        assert_eq!(shared.id(), "inner", "should delegate id");
+        assert!(
+            shared.accepts_id("opaque-ok"),
+            "should delegate accepts_id acceptance to the inner module"
+        );
+        assert!(
+            !shared.accepts_id("something-else"),
+            "should delegate accepts_id rejection to the inner module"
+        );
+        assert_eq!(
+            shared.normalize_id_for_kv("x"),
+            "kv:x",
+            "should delegate normalize_id_for_kv to the inner module"
+        );
+    }
+
+    /// A module whose identifier is a stable part followed by a part that
+    /// changes each time the identifier is issued, as a signed envelope does.
+    #[derive(Debug)]
+    struct ReissuedEnvelopeModule;
+
+    impl ReissuedEnvelopeModule {
+        fn stable_part(value: &str) -> &str {
+            value.split_once('.').map_or(value, |(stable, _)| stable)
+        }
+    }
+
+    impl EdgeCookieModule for ReissuedEnvelopeModule {
+        fn id(&self) -> &'static str {
+            "reissued_envelope"
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0re")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+
+        fn accepts_id(&self, value: &str) -> bool {
+            // The identifier as issued, and its canonical form on its own.
+            Self::stable_part(value).starts_with("device-")
+        }
+
+        fn normalize_id_for_kv(&self, value: &str) -> String {
+            Self::stable_part(value).to_owned()
+        }
+    }
+
+    #[test]
+    fn two_issues_of_one_identity_share_one_identity_graph_key() {
+        // The key is the identity two visits must share. Two identifiers that
+        // differ only in the part reissued each time are one visitor and must
+        // reach one row, where a module returning the value unchanged would
+        // give each issue a row of its own.
+        let module = ReissuedEnvelopeModule;
+        let accepted = AcceptedModules::active(Some(&module));
+
+        let first = accepted
+            .canonical_kv_key("t0re~device-1.issued-monday")
+            .expect("should key the first issue");
+        let second = accepted
+            .canonical_kv_key("t0re~device-1.issued-tuesday")
+            .expect("should key the second issue");
+        assert_eq!(
+            first, second,
+            "two issues of one identity should share one identity-graph key"
+        );
+        assert_eq!(
+            first, "t0re~device-1",
+            "the key should be the module's code and the stable part"
+        );
+
+        let other = accepted
+            .canonical_kv_key("t0re~device-2.issued-monday")
+            .expect("should key another identity");
+        assert_ne!(
+            first, other,
+            "a different stable part should be a different visitor"
+        );
+    }
+
+    /// A vendor module that claims the name core already uses for its
+    /// built-in HMAC module.
+    #[derive(Debug)]
+    struct VendorNamedHmacModule;
+
+    impl EdgeCookieModule for VendorNamedHmacModule {
+        fn id(&self) -> &'static str {
+            HMAC_MODULE_KEY
+        }
+
+        fn code(&self) -> ModuleCode {
+            crate::module_code!("t0vh")
+        }
+
+        fn generate(
+            &self,
+            _request_info: &dyn RequestInfo,
+            _input: &IdentityInput<'_>,
+        ) -> Result<GeneratedEdgeCookie, Report<TrustedServerError>> {
+            Ok(GeneratedEdgeCookie::default())
+        }
+    }
+
+    #[test]
+    fn two_modules_claiming_one_name_are_refused_and_both_are_named() {
+        // An adapter may inject a module called `hmac` while core supplies
+        // one of its own. Resolution order alone would prefer the built-in one
+        // and drop the injected one with nothing said, which is the fault this
+        // guards.
+        let hmac = selected_hmac(HMAC_MODULE_KEY);
+
+        let err = build_module(&hmac, Some(Arc::new(VendorNamedHmacModule)))
+            .expect_err("two modules claiming `hmac` should be refused");
+        let message = err.to_string();
+        assert!(
+            message.contains(HMAC_MODULE_KEY),
+            "the error should name the contested name, got: {message}"
+        );
+        assert!(
+            message.contains("core") && message.contains("adapter"),
+            "the error should name both claimants, got: {message}"
+        );
+
+        // The clash is a wiring fault, not a property of the selection, so
+        // selecting something else does not hide it and the operator still
+        // learns at startup.
+        let selected_elsewhere = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        let err =
+            ensure_module_available(&selected_elsewhere, Some(Arc::new(VendorNamedHmacModule)))
+                .expect_err("the clash should be refused whatever the selector says");
+        assert!(
+            err.to_string().contains(HMAC_MODULE_KEY),
+            "the startup check should name the contested name too, got: {err}"
+        );
+
+        // A vendor name of its own is unaffected.
+        let vendor = Ec {
+            module: Some(EcModuleSelection::Named("acme".to_owned())),
+            ..Ec::default()
+        };
+        build_module(&vendor, Some(Arc::new(VendorModule)))
+            .expect("a vendor module under its own name should still build");
+    }
+
+    #[test]
+    fn an_unknown_implementation_fails_naming_the_known_ones() {
+        // A label hands the choice of implementation to its block, so a
+        // mistyped implementation has to be refused by name, alongside the
+        // implementations this deployment could have used instead.
+        let ec: Ec =
+            toml::from_str("module = \"primary\"\n\n[primary]\nimplementation = \"hmca\"\n")
+                .expect("should parse a labeled module block");
+
+        let err = build_module(&ec, None)
+            .expect_err("an implementation this deployment lacks should be refused");
+        let message = err.to_string();
+        assert!(
+            message.contains("`hmca`"),
+            "the error should name the unknown implementation, got: {message}"
+        );
+        assert!(
+            message.contains("`hmac`"),
+            "the error should name the built-in implementation, got: {message}"
+        );
+
+        let err = build_module(&ec, Some(Arc::new(VendorModule)))
+            .expect_err("an injected module of another implementation should not stand in");
+        let message = err.to_string();
+        assert!(
+            message.contains("`hmac`") && message.contains("`acme`"),
+            "the error should name every implementation this deployment has, got: {message}"
+        );
+    }
+
+    #[test]
+    fn selecting_hmac_without_its_block_fails_loudly() {
+        // `Ec::validate_module_selection` rejects this pair before settings
+        // reach the composition root, so the state is built directly here to
+        // reach the seam. If the two checks ever drift apart, `build_module`
+        // must still stop rather than hand back a stateless deployment.
+        let ec = Ec {
+            module: Some(EcModuleSelection::from(HMAC_MODULE_KEY)),
+            ..Ec::default()
+        };
+
+        let err = build_module(&ec, None)
+            .expect_err("selecting hmac with no [ec.hmac] block should error");
+        assert!(
+            err.to_string().contains("[ec.hmac]"),
+            "the error should name the missing block, got: {err}"
+        );
+    }
+
+    #[test]
+    fn the_request_path_reuses_the_module_the_composition_root_resolved() {
+        // A composition root resolves the selection once while it builds
+        // application state, which is the same work `build_module` does on a
+        // request, so doing both means doing it twice for every request. The
+        // resolved module is threaded into `RuntimeServices`, and this is the
+        // assertion that the request path takes it rather than resolving again:
+        // the same allocation, not merely an equal one.
+        let ec = Ec {
+            module: Some(EcModuleSelection::Named("acme".to_owned())),
+            ..Ec::default()
+        };
+        let resolved = build_shared_module(&ec, Some(Arc::new(VendorModule)))
+            .expect("the composition root should resolve the selection")
+            .expect("the selection should yield a module");
+
+        let services =
+            crate::platform::test_support::noop_services_with_ec_module(Arc::clone(&resolved));
+        let for_request = request_module(&ec, &services)
+            .expect("the request path should take the resolved module")
+            .expect("the resolved module should be there");
+
+        assert!(
+            Arc::ptr_eq(&resolved, &for_request),
+            "the request path should reuse the resolved module, not build a second one"
+        );
+
+        // With nothing threaded the request path builds the selection from the
+        // settings. No module is injected on that path, so only a built-in
+        // selection can be built there.
+        let hmac = selected_hmac(HMAC_MODULE_KEY);
+        let built = request_module(&hmac, &crate::platform::test_support::noop_services())
+            .expect("an unthreaded request path should build a built-in selection")
+            .expect("the selection should yield a module");
+        assert_eq!(
+            built.id(),
+            HMAC_MODULE_KEY,
+            "the request path should build the built-in module the settings select"
+        );
+    }
+
+    #[test]
+    fn an_uninjected_module_is_refused_and_statelessness_is_allowed() {
+        // A selection the adapter cannot supply is knowable without a request,
+        // so the composition root rejects it while application state is built.
+        // The startup check wraps `build_module`, so both refuse it.
+        let selected = Ec {
+            module: Some(EcModuleSelection::from("acme")),
+            ..Ec::default()
+        };
+        for (case, outcome) in [
+            ("build_module", build_module(&selected, None).map(|_| ())),
+            (
+                "the startup check",
+                ensure_module_available(&selected, None),
+            ),
+        ] {
+            let Err(err) = outcome else {
+                panic!("{case} should refuse a module the adapter does not inject");
+            };
+            assert!(
+                err.to_string().contains("acme"),
+                "{case}: the error should name the selected module, got: {err}"
+            );
+        }
+
+        // Statelessness is a supported deployment, spelled either way, and must
+        // never be turned into a startup error.
+        ensure_module_available(&Ec::default(), None)
+            .expect("should allow a deployment that selects no module");
+        let explicit_none = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        ensure_module_available(&explicit_none, None)
+            .expect("should allow the explicit `none` selection");
+    }
+}
diff --git a/crates/trusted-server-core/src/ec/pull_sync.rs b/crates/trusted-server-core/src/ec/pull_sync.rs
index 0f79d2a1d..325db3f90 100644
--- a/crates/trusted-server-core/src/ec/pull_sync.rs
+++ b/crates/trusted-server-core/src/ec/pull_sync.rs
@@ -19,7 +19,7 @@ use crate::platform::{
 };
 use crate::settings::Settings;
 
-use super::generation::{ec_hash, is_valid_ec_id};
+use super::generation::ec_hash;
 use super::kv::{KvIdentityGraph, PartnerIdUpdate};
 use super::kv_types::KvEntry;
 use super::rate_limiter::RateLimiter;
@@ -33,7 +33,11 @@ use super::current_timestamp;
 /// Inputs needed to dispatch pull sync after response flush.
 #[derive(Debug, Clone)]
 pub struct PullSyncContext {
+    /// The EC ID as issued, which partners receive.
     ec_id: String,
+    /// The identity-graph key for `ec_id`, the owning module's canonical form
+    /// of it, which every identity-graph read and write in pull sync uses.
+    kv_key: String,
     snapshot: EcKvSnapshot,
 }
 
@@ -58,8 +62,9 @@ struct PullSyncResponse {
 /// Builds post-send pull-sync context from the route EC context.
 ///
 /// Returns `None` when there are no pull-enabled partners, when consent denies
-/// EC, when there is no valid active EC ID, or when the request snapshot holds
-/// no consented row that is still missing at least one pull-partner UID.
+/// EC, when there is no active EC ID or no module this deployment reads owns
+/// it, or when the request snapshot holds no consented row that is still
+/// missing at least one pull-partner UID.
 #[must_use]
 pub fn build_pull_sync_context(
     ec_context: &EcContext,
@@ -69,26 +74,44 @@ pub fn build_pull_sync_context(
         return None;
     }
 
-    let ec_id_ref = ec_context.ec_value()?;
-    if !is_valid_ec_id(ec_id_ref) {
-        log::debug!("Pull sync: skipping dispatch because active EC ID is invalid format");
+    // Accept an identifier from whichever module this deployment reads,
+    // dispatched by the identifier's module code, rather than only the
+    // built-in HMAC shape. A host-signal or vendor module's identifiers are
+    // valid here for the same reason they are valid in the organic path. The
+    // owning module also supplies the identity-graph key, its canonical form
+    // of the identifier, and every identity-graph read and write in
+    // `dispatch_pull_sync` uses that key rather than the identifier as issued.
+    let ec_id = ec_context.ec_value()?;
+    let Some(kv_key) = ec_context.kv_key_for(ec_id) else {
+        log::debug!(
+            "Pull sync: skipping dispatch because the active EC ID is not one this \
+             deployment's modules accept"
+        );
         return None;
-    }
+    };
 
-    let entry = ec_context.kv_snapshot().entry_for(ec_id_ref)?;
+    let entry = ec_context.kv_snapshot().entry_for(&kv_key)?;
     if !entry.consent.ok || entry_is_pull_complete(entry, registry) {
         return None;
     }
 
-    let ec_id = ec_id_ref.to_owned();
-    let snapshot = ec_context.kv_snapshot().clone();
-    Some(PullSyncContext { ec_id, snapshot })
+    Some(PullSyncContext {
+        ec_id: ec_id.to_owned(),
+        kv_key,
+        snapshot: ec_context.kv_snapshot().clone(),
+    })
 }
 
 /// Dispatches partner pull-sync requests in the background.
 ///
 /// This function is best-effort: all errors are logged and swallowed.
 ///
+/// The request snapshot lookup, the revalidation read and the write-back all
+/// use the context's identity-graph key, the owning module's canonical form
+/// of the EC ID, because that is the key the row is stored under. Partners
+/// still receive the EC ID as issued, and the per-partner rate limit key uses
+/// `ec_hash` of that EC ID.
+///
 /// # Consent revalidation
 ///
 /// Pull sync runs *after* the page response has been flushed to the browser and
@@ -120,7 +143,7 @@ pub fn dispatch_pull_sync(
         return;
     }
 
-    let Some(request_entry) = context.snapshot.entry_for(context.ec_id()) else {
+    let Some(request_entry) = context.snapshot.entry_for(&context.kv_key) else {
         log::debug!(
             "Pull sync: skipping dispatch for '{}' because the request captured no usable \
              identity snapshot",
@@ -155,8 +178,8 @@ pub fn dispatch_pull_sync(
         return;
     }
 
-    let live_snapshot = kv.load_snapshot(context.ec_id());
-    let Some(live_entry) = live_snapshot.entry_for(context.ec_id()) else {
+    let live_snapshot = kv.load_snapshot(&context.kv_key);
+    let Some(live_entry) = live_snapshot.entry_for(&context.kv_key) else {
         log::warn!(
             "Pull sync: skipping dispatch for '{}' because the live identity row could not be \
              confirmed",
@@ -279,7 +302,7 @@ pub fn dispatch_pull_sync(
         // generation is current, so the first CAS attempt is not spent losing a
         // conflict against the read that authorized this dispatch.
         let outcome =
-            kv.upsert_partner_ids_from_snapshot(context.ec_id(), &updates, live_snapshot.clone());
+            kv.upsert_partner_ids_from_snapshot(&context.kv_key, &updates, live_snapshot.clone());
         if matches!(outcome, EcKvSnapshot::Failed { .. }) {
             log::warn!(
                 "Pull sync: failed to persist partner updates for '{}'",
@@ -576,6 +599,65 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_pull_sync_context_accepts_the_active_non_hmac_module() {
+        // An identifier the active non-HMAC module owns is dispatched, under
+        // the key that module gives it, exactly as the organic path reads it.
+        const OPAQUE_ID: &str = "t0op~Opaque_Value_MixedCase";
+
+        let mut settings = crate::test_support::tests::create_test_settings();
+        settings.ec.module = Some(crate::ec::module::EcModuleSelection::from("opaque"));
+        let services = crate::platform::test_support::noop_services_with_ec_module(
+            std::sync::Arc::new(crate::ec::tests::OpaqueModule),
+        );
+        let req = http::Request::builder()
+            .method("GET")
+            .uri("http://example.com")
+            .header("cookie", format!("ts-ec={OPAQUE_ID}"))
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        let geo = crate::geo::GeoInfo {
+            city: String::new(),
+            country: "US".to_owned(),
+            continent: "NorthAmerica".to_owned(),
+            latitude: 0.0,
+            longitude: 0.0,
+            metro_code: 0,
+            region: None,
+            asn: None,
+        };
+
+        let mut ec_context =
+            EcContext::read_from_request_with_geo(&settings, &req, &services, Some(&geo))
+                .expect("should read EC context");
+        assert_eq!(
+            ec_context.ec_value(),
+            Some(OPAQUE_ID),
+            "the opaque identifier should read back before pull sync sees it"
+        );
+        // Pull sync dispatches for a consented row still missing a pull
+        // partner's UID, under the key the owning module derives.
+        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
+            .expect("should build registry");
+        let graph = KvIdentityGraph::in_memory("pull_store");
+        let kv_key = ec_context
+            .kv_key_for(OPAQUE_ID)
+            .expect("the opaque module should key its own identifier");
+        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, &kv_key));
+
+        let context = build_pull_sync_context(&ec_context, &registry)
+            .expect("should dispatch pull sync for the active module's identifier");
+        assert_eq!(
+            context.ec_id(),
+            OPAQUE_ID,
+            "should carry the identifier through unchanged"
+        );
+        assert_eq!(
+            context.kv_key, OPAQUE_ID,
+            "the opaque module's identifier should be its own identity-graph key"
+        );
+    }
+
     #[test]
     fn build_pull_sync_context_rejects_invalid_ec_id() {
         let consent = ConsentContext {
@@ -855,11 +937,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_pull_sync_context_accepts_a_created_coded_ec_id() {
+        let consent = ConsentContext {
+            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+            ..ConsentContext::default()
+        };
+        // The form the creation path produces, under the module code.
+        let ec_id = format!("hmac~{}.ABC123", "a".repeat(64));
+        let mut ec_context = EcContext::new_for_test(Some(ec_id.clone()), consent);
+        let registry = PartnerRegistry::from_config(&[pull_enabled_ec_partner("ssp.example.com")])
+            .expect("should build registry");
+        let graph = KvIdentityGraph::in_memory("pull_store");
+        let kv_key = ec_context
+            .kv_key_for(&ec_id)
+            .expect("the built-in grammar should key a coded identifier");
+        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, &kv_key));
+
+        let context = build_pull_sync_context(&ec_context, &registry)
+            .expect("should build pull sync context for a coded HMAC identifier");
+        assert_eq!(
+            context.ec_id(),
+            ec_id,
+            "should dispatch the coded identifier as created"
+        );
+    }
+
     // -----------------------------------------------------------------------
     // Snapshot-driven eligibility and request-wide aggregation
     // -----------------------------------------------------------------------
 
     use crate::ec::kv::TombstoneOutcome;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule};
     use crate::error::TrustedServerError;
     use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
     use crate::settings::EcPartner;
@@ -932,6 +1041,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -986,6 +1096,7 @@ mod tests {
         let services = build_services_with_http_client(stub.clone());
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
 
@@ -1049,6 +1160,7 @@ mod tests {
         ] {
             let context = PullSyncContext {
                 ec_id: ec_id.clone(),
+                kv_key: ec_id.clone(),
                 snapshot,
             };
             dispatch_pull_sync(
@@ -1090,6 +1202,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1137,6 +1250,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1197,6 +1311,7 @@ mod tests {
 
         let context = PullSyncContext {
             ec_id: ec_id.clone(),
+            kv_key: ec_id.clone(),
             snapshot,
         };
         dispatch_pull_sync(
@@ -1213,4 +1328,72 @@ mod tests {
             "a fully synced entry must not dispatch pull sync"
         );
     }
+
+    #[test]
+    fn dispatch_pull_sync_reads_and_writes_the_canonical_row() {
+        // The row lives under the owning module's canonical form of the
+        // identifier, and the request snapshot is bound to that key, so pull
+        // sync reads and writes that key even when the canonical form differs
+        // from the cookie value.
+        let mut settings = create_test_settings();
+        settings.ec.pull_sync_concurrency = 4;
+        let registry =
+            PartnerRegistry::from_config(&[pull_enabled_ec_partner("alpha.example.com")])
+                .expect("should build registry");
+        let graph = KvIdentityGraph::in_memory("pull_store");
+        let consent = ConsentContext {
+            jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+            ..ConsentContext::default()
+        };
+        let mut ec_context =
+            EcContext::new_for_test(Some(CANONICAL_COOKIE_VALUE.to_owned()), consent)
+                .with_module_for_test(Arc::new(CanonicalizingModule));
+        ec_context.set_kv_snapshot(seed_present_snapshot(&graph, CANONICAL_KV_KEY));
+
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response(200, br#"{"uid":"synced-uid"}"#.to_vec());
+        let services = build_services_with_http_client(stub.clone());
+
+        let context = build_pull_sync_context(&ec_context, &registry)
+            .expect("should build pull sync context for the canonicalizing module");
+        dispatch_pull_sync(
+            &settings,
+            &graph,
+            &registry,
+            &AllowAllRateLimiter,
+            &context,
+            &services,
+        );
+
+        let (row, _) = graph
+            .get(CANONICAL_KV_KEY)
+            .expect("should read the canonical row")
+            .expect("the canonical row should still exist");
+        assert_eq!(
+            row.ids.get("alpha.example.com").map(|id| id.uid.as_str()),
+            Some("synced-uid"),
+            "the partner UID should be written to the row under the canonical key"
+        );
+        assert!(
+            graph
+                .get(CANONICAL_COOKIE_VALUE)
+                .expect("should read the graph")
+                .is_none(),
+            "pull sync should not create a row under the identifier as issued"
+        );
+        let sent_ec_id = stub
+            .recorded_request_uris()
+            .first()
+            .and_then(|uri| Url::parse(uri).ok())
+            .and_then(|url| {
+                url.query_pairs()
+                    .find(|(name, _)| name == "ec_id")
+                    .map(|(_, value)| value.into_owned())
+            });
+        assert_eq!(
+            sent_ec_id.as_deref(),
+            Some(CANONICAL_COOKIE_VALUE),
+            "partners should receive the identifier as issued"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/ec/pull_sync_marker.rs b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
index f2a2fe601..e23e8a81d 100644
--- a/crates/trusted-server-core/src/ec/pull_sync_marker.rs
+++ b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
@@ -9,7 +9,7 @@ use sha2::{Digest as _, Sha256};
 
 use crate::constants::COOKIE_TS_EC_PULL_COMPLETE;
 use crate::redacted::Redacted;
-use crate::settings::Settings;
+use crate::settings::{EcModuleBlock, Settings};
 
 use super::pull_sync::entry_is_pull_complete;
 use super::registry::PartnerRegistry;
@@ -290,12 +290,31 @@ fn validate_marker(
 }
 
 fn marker_key(settings: &Settings) -> [u8; 32] {
-    let mut mac = HmacSha256::new_from_slice(settings.ec.passphrase.expose().as_bytes())
+    let mut mac = HmacSha256::new_from_slice(marker_secret(settings).as_bytes())
         .expect("should create marker key HMAC");
     mac.update(MARKER_KEY_LABEL);
     mac.finalize().into_bytes().into()
 }
 
+/// The secret the marker key derives from.
+///
+/// A marker covers identifiers the selected module created, so when that
+/// module is the built-in HMAC one the marker is bound to its passphrase
+/// and a rotation retires the markers with the identifiers. A selected
+/// module with no passphrase binds the marker to the proxy secret.
+fn marker_secret(settings: &Settings) -> &str {
+    settings
+        .ec
+        .module
+        .as_ref()
+        .and_then(|selection| settings.ec.module_blocks.get(selection.key()))
+        .and_then(EcModuleBlock::hmac_settings)
+        .map_or_else(
+            || settings.publisher.proxy_secret.expose(),
+            |hmac| hmac.passphrase.expose(),
+        )
+}
+
 fn marker_payload(ec_id: &str, expires_at: u64, fingerprint: &str) -> String {
     format!("{MARKER_VERSION}\0{ec_id}\0{expires_at}\0{fingerprint}")
 }
@@ -329,9 +348,10 @@ fn sorted_pull_partner_domains(registry: &PartnerRegistry) -> Vec<String> {
 mod tests {
     use super::*;
     use crate::ec::kv_types::KvEntry;
+    use crate::ec::module::HMAC_MODULE_KEY;
     use crate::redacted::Redacted;
     use crate::settings::{EcPartner, Settings};
-    use crate::test_support::tests::create_test_settings;
+    use crate::test_support::tests::{create_test_settings, select_hmac_module};
 
     const EC_ID: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.ABC123";
 
@@ -667,8 +687,11 @@ mod tests {
         let marker =
             create_marker(&settings, &registry, EC_ID, 4_600).expect("should create marker");
         let mut changed_settings = settings.clone();
-        changed_settings.ec.passphrase =
-            Redacted::new("different-secret-key-32-bytes-minimum".to_owned());
+        select_hmac_module(
+            &mut changed_settings.ec,
+            HMAC_MODULE_KEY,
+            "different-secret-key-32-bytes-minimum",
+        );
         let empty = PartnerRegistry::empty();
 
         assert!(
diff --git a/crates/trusted-server-core/src/edge_cookie.rs b/crates/trusted-server-core/src/edge_cookie.rs
index a4cdb4730..32b458b72 100644
--- a/crates/trusted-server-core/src/edge_cookie.rs
+++ b/crates/trusted-server-core/src/edge_cookie.rs
@@ -1,7 +1,10 @@
-//! Edge Cookie (EC) ID generation using HMAC.
+//! Reading an inbound Edge Cookie (EC) identifier.
 //!
-//! This module provides functionality for generating privacy-preserving EC IDs
-//! based on the client IP address and a secret key.
+//! [`recognized_ec_id`] reads the identifier a request carries and recognizes
+//! it through the selected module, so only an identifier this deployment
+//! issued is handed on. The generation helpers here are compiled for tests
+//! only, and the production lifecycle creates identifiers through
+//! [`EcContext`](crate::ec::EcContext).
 
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::Report;
@@ -11,57 +14,91 @@ use crate::constants::{COOKIE_TS_EC, HEADER_X_TS_EC};
 use crate::cookies::handle_request_cookies;
 use crate::ec::cookies::ec_id_has_only_allowed_chars;
 #[cfg(test)]
-use crate::ec::generation::{generate_ec_id as generate_canonical_ec_id, normalize_ip};
+use crate::ec::generation::normalize_ip;
+#[cfg(test)]
+use crate::ec::module::IdentityInput;
+use crate::ec::module::{module_owns_id, request_module};
 use crate::error::TrustedServerError;
 #[cfg(test)]
+use crate::evidence::BorrowedRequestInfo;
 use crate::platform::RuntimeServices;
-#[cfg(test)]
 use crate::settings::Settings;
 
-/// Generates a fresh EC ID based on client IP address.
+/// Test helper that generates a fresh EC ID with the configured Edge Cookie
+/// module.
 ///
-/// Delegates to the canonical generator in [`crate::ec::generation`] so a
-/// single normalization + HMAC path produces EC IDs. The canonical
-/// `normalize_ip` format is a stable contract — EC hashes stored in KV
-/// depend on it, and a divergent normalization would mint non-correlating
-/// identities for the same client.
+/// The `[ec] module` selection decides the outcome. Returns `Ok(None)` when
+/// no module is configured, so no Edge Cookie is created. `request_headers`
+/// lets a module that derives identity from request evidence read it. The
+/// built-in HMAC module ignores it and uses only the normalized client IP.
+/// The production lifecycle creates identifiers through
+/// [`EcContext`](crate::ec::EcContext) instead.
 ///
 /// # Errors
 ///
-/// - [`TrustedServerError::EdgeCookie`] if HMAC generation fails
-///
-/// Currently exercised only by tests: the production EC lifecycle generates IDs
-/// through [`crate::ec`]/`EcContext` rather than this edge-cookie helper.
+/// - [`TrustedServerError::EdgeCookie`] if module generation fails
 #[cfg(test)]
 pub fn generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
-) -> Result<String, Report<TrustedServerError>> {
-    // Fallback to "unknown" when client IP is unavailable (e.g., local testing).
-    // All such requests share the same HMAC base; the random suffix provides uniqueness.
+    request_headers: Option<&http::HeaderMap>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    // Fall back to "unknown" when the client IP is unavailable (for example in
+    // local testing). All such requests share the same HMAC base; the random
+    // suffix provides uniqueness.
     let client_ip = services
-        .client_info
+        .client_info()
         .client_ip
         .map(normalize_ip)
         .unwrap_or_else(|| "unknown".to_string());
 
     log::trace!("Generating fresh EC ID from normalized client context");
 
-    generate_canonical_ec_id(settings, &client_ip)
+    let Some(module) = request_module(&settings.ec, services)? else {
+        log::info!("No Edge Cookie module configured; running statelessly");
+        return Ok(None);
+    };
+
+    // The module reads request data (for example the client IP) borrowed at
+    // call time, so nothing is cloned.
+    let request_info = BorrowedRequestInfo::new(&client_ip, request_headers);
+    // This helper skips the consent gate, and the built-in module does not
+    // read the consent context, so it is not threaded here.
+    let generated = module.generate(&request_info, &IdentityInput::default())?;
+    let generated = crate::ec::module::GeneratedEdgeCookie {
+        id: generated
+            .id
+            .map(|value| crate::ec::module::apply_module_code(module.as_ref(), &value)),
+        response_headers: generated.response_headers,
+    };
+    Ok(generated.id)
 }
 
-/// Gets an existing EC ID from the request.
+/// Reads whatever the request offers as an Edge Cookie identifier, before any
+/// check that this deployment could have issued it.
 ///
-/// Attempts to retrieve an existing EC ID from:
-/// 1. The `x-ts-ec` header
-/// 2. The `ts-ec` cookie
+/// Reads the `x-ts-ec` header first and then the `ts-ec` cookie. Both are
+/// client-controlled. `x-ts-ec` is stripped from responses but is not stripped
+/// from inbound requests, so a caller must treat the result as an attacker's
+/// choice of string.
+///
+/// The only checks applied here are the global cookie bounds, the length cap
+/// and the cookie-safe alphabet in
+/// [`ec_id_has_only_allowed_chars`](crate::ec::cookies::ec_id_has_only_allowed_chars),
+/// which every identifier must satisfy whichever module created it. Those
+/// bounds are a backstop on what may travel in a cookie, not a test of
+/// authenticity, and on their own they accept any run of `[A-Za-z0-9._~-]`.
 ///
-/// Returns `None` if neither source contains an EC ID.
+/// Deciding whether this deployment issued the value needs the selected
+/// module, which this function does not have, so it is deliberately not
+/// public. Use [`recognized_ec_id`], which applies module ownership on top.
 ///
 /// # Errors
 ///
 /// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
-pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<TrustedServerError>> {
+pub(crate) fn unvalidated_ec_id_from_request(
+    req: &Request<EdgeBody>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
     if let Some(ec_id) = req
         .headers()
         .get(HEADER_X_TS_EC)
@@ -93,13 +130,77 @@ pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<Trust
     Ok(None)
 }
 
+/// Gets an existing EC ID from the request, but only one the deployment's
+/// selected module recognizes.
+///
+/// [`unvalidated_ec_id_from_request`] applies the global cookie bounds alone,
+/// the length cap and the cookie-safe alphabet, which any value a browser can
+/// be persuaded to carry will pass. This adds module ownership on top, so the
+/// identifier's `{code}~` prefix is dispatched to the module that owns it,
+/// which decides whether the value is one of its own. That is the same test the
+/// EC lifecycle applies when it reads the cookie back, so both agree on what
+/// this deployment issued.
+///
+/// This is the validated way to read an inbound identifier from outside this
+/// module, because the bounds alone cannot tell an identifier this deployment
+/// issued from one an attacker typed. The module also exposes
+/// [`get_or_generate_ec_id`], which is `pub` and returns the raw cookie value
+/// without this ownership check, so prefer this function wherever the identifier
+/// will be trusted or egressed. A vendor identifier is not required to match the
+/// built-in HMAC shape, so the right test is the selected module's own
+/// [`accepts_id`](crate::ec::module::EdgeCookieModule::accepts_id) rather
+/// than the built-in strict format check.
+///
+/// Returns `None` for a value carrying another deployment's module code, for a
+/// value the selected module does not recognize, and for every value at all
+/// when no module is selected, because a stateless deployment issues no
+/// identifier and so has none to hand on.
+///
+/// Use this wherever the identifier leaves the edge (an outbound origin URL, a
+/// click target, a proxied request body), so nothing is egressed that this
+/// deployment did not issue.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
+/// - [`TrustedServerError::EdgeCookie`] if the selected module cannot be built
+pub fn recognized_ec_id(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request<EdgeBody>,
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    let Some(ec_id) = unvalidated_ec_id_from_request(req)? else {
+        return Ok(None);
+    };
+
+    let Some(module) = request_module(&settings.ec, services)? else {
+        log::debug!(
+            "No Edge Cookie module configured; withholding the request's EC ID from egress"
+        );
+        return Ok(None);
+    };
+
+    if module_owns_id(module.as_ref(), &ec_id) {
+        return Ok(Some(ec_id));
+    }
+
+    log::debug!(
+        "Withholding an EC ID module `{}` does not recognize from egress",
+        module.id(),
+    );
+    Ok(None)
+}
+
 /// Gets or creates an EC ID from the request.
 ///
 /// Attempts to retrieve an existing EC ID from:
 /// 1. The `x-ts-ec` header
 /// 2. The `ts-ec` cookie
 ///
-/// If neither exists, generates a new EC ID.
+/// If neither exists, generates a new EC ID via the configured module.
+///
+/// Returns `Ok(None)` when no existing EC ID is present and no Edge Cookie
+/// module is configured, so the caller proceeds statelessly.
 ///
 /// # Errors
 ///
@@ -109,14 +210,16 @@ pub(crate) fn get_or_generate_ec_id_from_http_request(
     settings: &Settings,
     services: &RuntimeServices,
     req: &Request<EdgeBody>,
-) -> Result<String, Report<TrustedServerError>> {
-    if let Some(id) = get_ec_id(req)? {
-        return Ok(id);
+) -> Result<Option<String>, Report<TrustedServerError>> {
+    if let Some(id) = unvalidated_ec_id_from_request(req)? {
+        return Ok(Some(id));
     }
 
-    // If no existing EC ID found, generate a fresh one
-    let ec_id = generate_ec_id(settings, services)?;
-    log::trace!("No existing EC ID found; generated a fresh EC ID");
+    // If no existing EC ID found, generate a fresh one through the module.
+    let ec_id = generate_ec_id(settings, services, Some(req.headers()))?;
+    if ec_id.is_some() {
+        log::trace!("No existing EC ID found; generated a fresh EC ID");
+    }
     Ok(ec_id)
 }
 
@@ -130,7 +233,7 @@ pub fn get_or_generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
     req: &Request<EdgeBody>,
-) -> Result<String, Report<TrustedServerError>> {
+) -> Result<Option<String>, Report<TrustedServerError>> {
     get_or_generate_ec_id_from_http_request(settings, services, req)
 }
 
@@ -139,34 +242,11 @@ mod tests {
     use super::*;
     use edgezero_core::body::Body as EdgeBody;
     use http::{HeaderName, header};
-    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+    use std::net::{IpAddr, Ipv4Addr};
 
     use crate::platform::test_support::{noop_services, noop_services_with_client_ip};
     use crate::test_support::tests::create_test_settings;
 
-    #[test]
-    fn test_generate_ec_id_matches_canonical_generator_for_ipv6() {
-        // Regression guard: this module must hash the same normalized IP as
-        // the canonical generator in ec::generation. A divergent IPv6 /64
-        // normalization would mint non-correlating identity prefixes for the
-        // same client depending on which path generated the ID.
-        let settings = create_test_settings();
-        let ip = IpAddr::V6(Ipv6Addr::new(
-            0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, 0x1234,
-        ));
-
-        let id_here = generate_ec_id(&settings, &noop_services_with_client_ip(ip))
-            .expect("should generate EC ID via edge_cookie");
-        let id_canonical = generate_canonical_ec_id(&settings, &normalize_ip(ip))
-            .expect("should generate EC ID via canonical generator");
-
-        assert_eq!(
-            crate::ec::ec_hash(&id_here),
-            crate::ec::ec_hash(&id_canonical),
-            "should produce the same identity hash prefix as the canonical generator"
-        );
-    }
-
     fn create_test_request(headers: &[(HeaderName, &str)]) -> Request<EdgeBody> {
         let mut builder = Request::builder().method("GET").uri("http://example.com");
         for (key, value) in headers {
@@ -178,6 +258,10 @@ mod tests {
     }
 
     fn is_ec_id_format(value: &str) -> bool {
+        // The coded envelope: hmac~<64hex>.<6alnum>.
+        let Some(value) = value.strip_prefix("hmac~") else {
+            return false;
+        };
         let mut parts = value.split('.');
         let hmac_part = match parts.next() {
             Some(part) => part,
@@ -202,15 +286,38 @@ mod tests {
         true
     }
 
+    // `generate_ec_id`, `get_or_generate_ec_id` and
+    // `get_or_generate_ec_id_from_http_request` are test helpers compiled for
+    // tests only, so the tests that call them test those helpers and not the
+    // production path. The production path, including how the client IP is
+    // normalized before it is hashed, is tested through `EcContext` in
+    // `crate::ec`.
+
     #[test]
     fn test_generate_ec_id() {
         let settings: Settings = create_test_settings();
 
-        let ec_id = generate_ec_id(&settings, &noop_services()).expect("should generate EC ID");
+        let ec_id = generate_ec_id(&settings, &noop_services(), None)
+            .expect("should generate EC ID")
+            .expect("should configure the hmac module in test settings");
         log::debug!("Generated EC ID: {}", ec_id);
         assert!(
             is_ec_id_format(&ec_id),
-            "should match EC ID format: {{64hex}}.{{6alnum}}"
+            "should match the coded EC ID format: hmac~{{64hex}}.{{6alnum}}"
+        );
+    }
+
+    #[test]
+    fn generate_ec_id_returns_none_when_no_module_is_configured() {
+        let mut settings = create_test_settings();
+        // No module selected: Trusted Server runs statelessly.
+        settings.ec.module = None;
+
+        let id = generate_ec_id(&settings, &noop_services(), None)
+            .expect("generation should not error when no module is configured");
+        assert!(
+            id.is_none(),
+            "no Edge Cookie module should mean no Edge Cookie is created"
         );
     }
 
@@ -219,10 +326,12 @@ mod tests {
         let settings = create_test_settings();
         let ip = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1));
 
-        let id_with_ip = generate_ec_id(&settings, &noop_services_with_client_ip(ip))
-            .expect("should generate EC ID with client IP");
-        let id_without_ip = generate_ec_id(&settings, &noop_services())
-            .expect("should generate EC ID without client IP");
+        let id_with_ip = generate_ec_id(&settings, &noop_services_with_client_ip(ip), None)
+            .expect("should generate EC ID with client IP")
+            .expect("should configure the hmac module in test settings");
+        let id_without_ip = generate_ec_id(&settings, &noop_services(), None)
+            .expect("should generate EC ID without client IP")
+            .expect("should configure the hmac module in test settings");
 
         let hmac_with_ip = id_with_ip.split_once('.').expect("should contain dot").0;
         let hmac_without_ip = id_without_ip.split_once('.').expect("should contain dot").0;
@@ -235,50 +344,109 @@ mod tests {
 
     #[test]
     fn test_is_ec_id_format_accepts_valid_value() {
-        let value = format!("{}.{}", "a".repeat(64), "Ab12z9");
+        let value = format!("hmac~{}.{}", "a".repeat(64), "Ab12z9");
         assert!(
             is_ec_id_format(&value),
-            "should accept a valid EC ID format"
+            "should accept a valid coded EC ID format"
         );
     }
 
     #[test]
     fn test_is_ec_id_format_rejects_invalid_values() {
-        let missing_suffix = "a".repeat(64);
+        let bare_legacy_shape = format!("{}.{}", "a".repeat(64), "Ab12z9");
+        assert!(
+            !is_ec_id_format(&bare_legacy_shape),
+            "a freshly created identifier always carries the module code"
+        );
+
+        let missing_suffix = format!("hmac~{}", "a".repeat(64));
         assert!(
             !is_ec_id_format(&missing_suffix),
             "should reject missing suffix"
         );
 
-        let invalid_hex = format!("{}.{}", "a".repeat(63) + "g", "Ab12z9");
+        let invalid_hex = format!("hmac~{}.{}", "a".repeat(63) + "g", "Ab12z9");
         assert!(
             !is_ec_id_format(&invalid_hex),
             "should reject non-hex HMAC content"
         );
 
-        let invalid_suffix = format!("{}.{}", "a".repeat(64), "ab-129");
+        let invalid_suffix = format!("hmac~{}.{}", "a".repeat(64), "ab-129");
         assert!(
             !is_ec_id_format(&invalid_suffix),
             "should reject non-alphanumeric suffix"
         );
 
-        let extra_segment = format!("{}.{}.{}", "a".repeat(64), "Ab12z9", "zz");
+        let extra_segment = format!("hmac~{}.{}.{}", "a".repeat(64), "Ab12z9", "zz");
         assert!(
             !is_ec_id_format(&extra_segment),
             "should reject extra segments"
         );
     }
 
+    #[test]
+    fn an_identifier_this_deployment_never_issued_is_not_recognized() {
+        // `x-ts-ec` is stripped from responses but not from inbound requests,
+        // so a client can put whatever it likes in it, and the raw reader
+        // prefers the header over the cookie. The global cookie bounds accept
+        // any run of `[A-Za-z0-9._~-]`, so they cannot tell an identifier this
+        // deployment created from one an attacker typed. Module ownership is
+        // what draws that line.
+        let settings = create_test_settings();
+        let services = noop_services();
+
+        for forged in [
+            // Passes the alphabet and the length cap, owned by nobody.
+            "not-an-identifier",
+            // The built-in shape under another deployment's module code.
+            "zz00~aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.Ab1234",
+            // This deployment's code carrying a value its module never creates.
+            "hmac~not-the-hmac-shape",
+        ] {
+            let req = create_test_request(&[(HEADER_X_TS_EC, forged)]);
+
+            // The raw reader hands it straight back, which is exactly why it is
+            // not the check anything may rely on.
+            assert_eq!(
+                unvalidated_ec_id_from_request(&req)
+                    .expect("should read the header")
+                    .as_deref(),
+                Some(forged),
+                "the global bounds alone should accept `{forged}`"
+            );
+
+            assert_eq!(
+                recognized_ec_id(&settings, &services, &req)
+                    .expect("should decide without erroring"),
+                None,
+                "`{forged}` was never issued here and must not be recognized"
+            );
+        }
+
+        // A value the selected module does own is still recognized, so the
+        // check rejects forgeries rather than everything.
+        let issued = format!("hmac~{}.Ab1234", "a".repeat(64));
+        let req = create_test_request(&[(HEADER_X_TS_EC, issued.as_str())]);
+        assert_eq!(
+            recognized_ec_id(&settings, &services, &req)
+                .expect("should decide without erroring")
+                .as_deref(),
+            Some(issued.as_str()),
+            "an identifier the selected module owns should still be recognized"
+        );
+    }
+
     #[test]
     fn test_get_ec_id_with_header() {
         let settings = create_test_settings();
         let req = create_test_request(&[(HEADER_X_TS_EC, "existing_ec_id")]);
 
-        let ec_id = get_ec_id(&req).expect("should get EC ID");
+        let ec_id = unvalidated_ec_id_from_request(&req).expect("should get EC ID");
         assert_eq!(ec_id, Some("existing_ec_id".to_string()));
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should reuse header EC ID");
+            .expect("should reuse header EC ID")
+            .expect("an existing EC should be present");
         assert_eq!(ec_id, "existing_ec_id");
     }
 
@@ -290,11 +458,12 @@ mod tests {
             &format!("{}=existing_cookie_id", COOKIE_TS_EC),
         )]);
 
-        let ec_id = get_ec_id(&req).expect("should get EC ID");
+        let ec_id = unvalidated_ec_id_from_request(&req).expect("should get EC ID");
         assert_eq!(ec_id, Some("existing_cookie_id".to_string()));
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should reuse cookie EC ID");
+            .expect("should reuse cookie EC ID")
+            .expect("an existing EC should be present");
         assert_eq!(ec_id, "existing_cookie_id");
     }
 
@@ -307,7 +476,8 @@ mod tests {
             .body(edgezero_core::body::Body::empty())
             .expect("should build test request");
 
-        let ec_id = get_ec_id(&req).expect("should get EC ID from http request");
+        let ec_id =
+            unvalidated_ec_id_from_request(&req).expect("should get EC ID from http request");
 
         assert_eq!(ec_id, Some("existing_http_ec_id".to_string()));
     }
@@ -326,7 +496,8 @@ mod tests {
             .expect("should build test request");
 
         let ec_id = get_or_generate_ec_id_from_http_request(&settings, &noop_services(), &req)
-            .expect("should reuse cookie EC ID from http request");
+            .expect("should reuse cookie EC ID from http request")
+            .expect("an existing EC should be present");
 
         assert_eq!(ec_id, "existing_http_cookie_id");
     }
@@ -334,7 +505,7 @@ mod tests {
     #[test]
     fn test_get_ec_id_none() {
         let req = create_test_request(&[]);
-        let ec_id = get_ec_id(&req).expect("should handle missing ID");
+        let ec_id = unvalidated_ec_id_from_request(&req).expect("should handle missing ID");
         assert!(ec_id.is_none());
     }
 
@@ -344,7 +515,8 @@ mod tests {
         let req = create_test_request(&[]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should get or generate EC ID");
+            .expect("should get or generate EC ID")
+            .expect("should configure the hmac module in test settings");
         assert!(!ec_id.is_empty());
     }
 
@@ -355,7 +527,8 @@ mod tests {
             (header::COOKIE, &format!("{}=valid_cookie_id", COOKIE_TS_EC)),
         ]);
 
-        let ec_id = get_ec_id(&req).expect("should handle invalid header gracefully");
+        let ec_id =
+            unvalidated_ec_id_from_request(&req).expect("should handle invalid header gracefully");
         assert_eq!(
             ec_id,
             Some("valid_cookie_id".to_string()),
@@ -369,7 +542,8 @@ mod tests {
         let req = create_test_request(&[(HEADER_X_TS_EC, "evil;injected")]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
-            .expect("should generate fresh ID on invalid header");
+            .expect("should generate fresh ID on invalid header")
+            .expect("should configure the hmac module in test settings");
         assert_ne!(
             ec_id, "evil;injected",
             "should not use tampered header value"
@@ -387,7 +561,8 @@ mod tests {
             &format!("{}=bad<script>value", COOKIE_TS_EC),
         )]);
 
-        let ec_id = get_ec_id(&req).expect("should handle invalid cookie gracefully");
+        let ec_id =
+            unvalidated_ec_id_from_request(&req).expect("should handle invalid cookie gracefully");
         assert!(
             ec_id.is_none(),
             "should reject cookie with disallowed characters"
diff --git a/crates/trusted-server-core/src/evidence.rs b/crates/trusted-server-core/src/evidence.rs
new file mode 100644
index 000000000..967223099
--- /dev/null
+++ b/crates/trusted-server-core/src/evidence.rs
@@ -0,0 +1,332 @@
+//! Request evidence passed to modules.
+//!
+//! A module is constructed once, from its own configuration block or by the
+//! adapter that injects it, and is handed the current request's evidence as a
+//! borrowed `&dyn` view on every call, for example the `request_info` argument
+//! of [`generate`](crate::ec::module::EdgeCookieModule::generate). Nothing
+//! per-request is stored on the module, so the same module serves every
+//! request.
+//!
+//! These traits are those views. Request-scoped data outlives the live request
+//! only when snapshotted, so an implementation owns its data where needed.
+//! [`BorrowedRequestInfo`] is the borrowed view core builds on the request
+//! path, and [`OwnedRequestInfo`] is the built-in owned snapshot.
+
+use http::HeaderMap;
+
+/// Read-only access to the current request's basic information.
+///
+/// The request data any host can supply: the normalized client IP, the
+/// User-Agent, and request headers. A module receives it by reference at call
+/// time (`generate`), reads what it needs, and does not retain it.
+pub trait RequestInfo: Send + Sync + core::fmt::Debug {
+    /// The normalized client IP, or `""` when the host cannot determine it.
+    fn client_ip(&self) -> &str;
+
+    /// The `User-Agent` header value, or `""` when absent.
+    fn user_agent(&self) -> &str;
+
+    /// An arbitrary request header by name (case-insensitive), or `None`.
+    ///
+    /// Request cookies are read through this, from the `Cookie` header (a
+    /// module that stores values in cookies parses them from it).
+    fn header(&self, name: &str) -> Option<&str>;
+
+    /// The names of all request headers present, for a module that enumerates
+    /// evidence (for example to forward client hints). The default is empty.
+    fn header_names(&self) -> Vec<&str> {
+        Vec::new()
+    }
+
+    /// The request path (the URL path, without the query string), or `""` when
+    /// request info was built without a URL.
+    ///
+    /// A module reads the request target through this together with
+    /// [`query`](Self::query); `RequestInfo` is the evidence abstraction, so more
+    /// request accessors can be added here (as defaulted methods) without
+    /// breaking existing implementations.
+    fn path(&self) -> &str {
+        ""
+    }
+
+    /// The raw request query string (the part after `?`, without the leading
+    /// `?`), or `""` when the request carried none.
+    ///
+    /// A module reads request parameters through this, or the
+    /// [`query_param`](Self::query_param) convenience. The default is empty, for
+    /// request info built without a URL.
+    fn query(&self) -> &str {
+        ""
+    }
+
+    /// The first value of query parameter `name`, percent-decoded, or `None`
+    /// when the parameter is absent.
+    ///
+    /// Parses [`query`](Self::query) with `application/x-www-form-urlencoded`
+    /// rules, matching how the browser encodes query parameters.
+    fn query_param(&self, name: &str) -> Option<String> {
+        url::form_urlencoded::parse(self.query().as_bytes())
+            .find_map(|(key, value)| (&*key == name).then(|| value.into_owned()))
+    }
+}
+
+/// An owned [`RequestInfo`] built from a request snapshot.
+///
+/// Owns the client IP and a header snapshot, for a context that cannot borrow
+/// the live request for the duration of the call. The request path uses
+/// [`BorrowedRequestInfo`]; this owned variant serves tests and any future
+/// host whose request data cannot be borrowed.
+#[derive(Debug, Default, Clone)]
+pub struct OwnedRequestInfo {
+    client_ip: String,
+    headers: HeaderMap,
+    path: String,
+    query: String,
+}
+
+impl OwnedRequestInfo {
+    /// Builds owned request info from the client IP and a header snapshot.
+    ///
+    /// The request target ([`path`](RequestInfo::path) and
+    /// [`query`](RequestInfo::query)) is empty; attach it with
+    /// [`with_request_target`](Self::with_request_target) when the caller has the
+    /// URL.
+    #[must_use]
+    pub fn new(client_ip: String, headers: HeaderMap) -> Self {
+        Self {
+            client_ip,
+            headers,
+            path: String::new(),
+            query: String::new(),
+        }
+    }
+
+    /// Attaches the request target (URL path and query string) to this snapshot,
+    /// so a module can read request parameters through
+    /// [`query_param`](RequestInfo::query_param).
+    #[must_use]
+    pub fn with_request_target(mut self, path: String, query: String) -> Self {
+        self.path = path;
+        self.query = query;
+        self
+    }
+}
+
+impl RequestInfo for OwnedRequestInfo {
+    fn client_ip(&self) -> &str {
+        &self.client_ip
+    }
+
+    fn user_agent(&self) -> &str {
+        self.headers
+            .get(http::header::USER_AGENT)
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default()
+    }
+
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).and_then(|value| value.to_str().ok())
+    }
+
+    fn header_names(&self) -> Vec<&str> {
+        self.headers.keys().map(http::HeaderName::as_str).collect()
+    }
+
+    fn path(&self) -> &str {
+        &self.path
+    }
+
+    fn query(&self) -> &str {
+        &self.query
+    }
+}
+
+/// A borrowed [`RequestInfo`] over the live request, with no allocation.
+///
+/// Built at generate time from the normalized client IP and an optional borrow
+/// of the request-header snapshot core captured at read time, then passed to a
+/// module by shared reference at call time (`generate`). It borrows rather
+/// than owns, so it must not outlive the request. A module reads it during the
+/// call and does not retain it. `BorrowedRequestInfo` itself allocates nothing;
+/// the one header clone is the snapshot core takes at read time, and only when a
+/// module is configured and the request carries no usable identifier.
+#[derive(Debug)]
+pub struct BorrowedRequestInfo<'a> {
+    client_ip: &'a str,
+    headers: Option<&'a HeaderMap>,
+    path: &'a str,
+    query: &'a str,
+}
+
+impl<'a> BorrowedRequestInfo<'a> {
+    /// Borrows request info from the client IP and optional request headers.
+    ///
+    /// Pass `None` for headers on a path that only needs the client IP. The
+    /// request target ([`path`](RequestInfo::path) and
+    /// [`query`](RequestInfo::query)) is empty; attach it with
+    /// [`with_request_target`](Self::with_request_target) when the caller has the
+    /// URL.
+    #[must_use]
+    pub fn new(client_ip: &'a str, headers: Option<&'a HeaderMap>) -> Self {
+        Self {
+            client_ip,
+            headers,
+            path: "",
+            query: "",
+        }
+    }
+
+    /// Attaches the borrowed request target (URL path and query string), so a
+    /// module can read request parameters through
+    /// [`query_param`](RequestInfo::query_param).
+    #[must_use]
+    pub fn with_request_target(mut self, path: &'a str, query: &'a str) -> Self {
+        self.path = path;
+        self.query = query;
+        self
+    }
+}
+
+impl RequestInfo for BorrowedRequestInfo<'_> {
+    fn client_ip(&self) -> &str {
+        self.client_ip
+    }
+
+    fn user_agent(&self) -> &str {
+        self.headers
+            .and_then(|headers| headers.get(http::header::USER_AGENT))
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default()
+    }
+
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .and_then(|headers| headers.get(name))
+            .and_then(|value| value.to_str().ok())
+    }
+
+    fn header_names(&self) -> Vec<&str> {
+        self.headers
+            .map(|headers| headers.keys().map(http::HeaderName::as_str).collect())
+            .unwrap_or_default()
+    }
+
+    fn path(&self) -> &str {
+        self.path
+    }
+
+    fn query(&self) -> &str {
+        self.query
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn request_info_lists_every_attached_header_name() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            http::header::USER_AGENT,
+            "ExampleAgent/1.0"
+                .parse()
+                .expect("should parse a User-Agent value"),
+        );
+        headers.insert(
+            http::header::ACCEPT_LANGUAGE,
+            "en".parse().expect("should parse an Accept-Language value"),
+        );
+        let owned = OwnedRequestInfo::new(String::new(), headers.clone());
+        let borrowed = BorrowedRequestInfo::new("", Some(&headers));
+
+        for (case, mut names) in [
+            ("the owned snapshot", owned.header_names()),
+            ("the borrowed view", borrowed.header_names()),
+        ] {
+            names.sort_unstable();
+            assert_eq!(
+                names,
+                vec!["accept-language", "user-agent"],
+                "{case} should list every attached header name"
+            );
+        }
+        assert!(
+            BorrowedRequestInfo::new("203.0.113.5", None)
+                .header_names()
+                .is_empty(),
+            "a borrowed view built without headers should list none"
+        );
+    }
+
+    fn headers_with_cookie() -> HeaderMap {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            "cookie",
+            "client-id=abc123; ts-ec=xyz"
+                .parse()
+                .expect("should parse cookie header"),
+        );
+        headers
+    }
+
+    #[test]
+    fn query_param_decodes_and_selects_the_first_value() {
+        let info = OwnedRequestInfo::new(String::new(), HeaderMap::new())
+            .with_request_target("/page".to_owned(), "id=a%20b&id=second&flag=1".to_owned());
+
+        assert_eq!(
+            info.query_param("id").as_deref(),
+            Some("a b"),
+            "should percent-decode and return the first value for a repeated key"
+        );
+        assert_eq!(info.query_param("flag").as_deref(), Some("1"));
+        assert_eq!(
+            info.query_param("missing"),
+            None,
+            "an absent parameter should be None"
+        );
+    }
+
+    #[test]
+    fn path_and_query_accessors_return_the_request_target() {
+        let info = OwnedRequestInfo::new(String::new(), HeaderMap::new())
+            .with_request_target("/a/b".to_owned(), "x=1".to_owned());
+        assert_eq!(info.path(), "/a/b");
+        assert_eq!(info.query(), "x=1");
+    }
+
+    #[test]
+    fn request_info_defaults_to_an_empty_target() {
+        let info = OwnedRequestInfo::new("203.0.113.5".to_owned(), HeaderMap::new());
+        assert_eq!(info.path(), "", "path should default to empty");
+        assert_eq!(info.query(), "", "query should default to empty");
+        assert_eq!(
+            info.query_param("id"),
+            None,
+            "query_param over an empty query should be None"
+        );
+    }
+
+    #[test]
+    fn a_module_reads_cookies_from_the_header() {
+        let info = OwnedRequestInfo::new("203.0.113.5".to_owned(), headers_with_cookie());
+        assert_eq!(
+            info.header("cookie"),
+            Some("client-id=abc123; ts-ec=xyz"),
+            "cookies are read through the Cookie header"
+        );
+    }
+
+    #[test]
+    fn borrowed_request_info_exposes_the_same_target() {
+        let headers = headers_with_cookie();
+        let info = BorrowedRequestInfo::new("203.0.113.5", Some(&headers))
+            .with_request_target("/page", "id=abc123");
+
+        assert_eq!(info.path(), "/page");
+        assert_eq!(info.query(), "id=abc123");
+        assert_eq!(info.query_param("id").as_deref(), Some("abc123"));
+        assert_eq!(info.header("cookie"), Some("client-id=abc123; ts-ec=xyz"));
+    }
+}
diff --git a/crates/trusted-server-core/src/integrations/google_tag_manager.rs b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
index 3b1c051a3..8dec90335 100644
--- a/crates/trusted-server-core/src/integrations/google_tag_manager.rs
+++ b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
@@ -3067,6 +3067,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [integrations.google_tag_manager]
@@ -3100,6 +3103,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [integrations.google_tag_manager]
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index f1d1d0b50..cab022ff4 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -3993,6 +3993,9 @@ origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 "#;
 
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index d3c09cd7d..ba1876513 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -1047,7 +1047,7 @@ impl IntegrationRegistry {
             // may lack consent signals such as the Sec-GPC header.
             if is_navigation_request(&req) {
                 if let Err(err) = ec_context.generate_if_needed(settings, kv) {
-                    log::warn!("EC generation failed for integration proxy: {err:?}");
+                    log::error!("EC generation failed for integration proxy: {err:?}");
                 }
             } else {
                 log::debug!(
diff --git a/crates/trusted-server-core/src/integrations/testlight.rs b/crates/trusted-server-core/src/integrations/testlight.rs
index 9e68492bd..371a56cc0 100644
--- a/crates/trusted-server-core/src/integrations/testlight.rs
+++ b/crates/trusted-server-core/src/integrations/testlight.rs
@@ -9,7 +9,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
 use validator::Validate;
 
-use crate::edge_cookie::get_ec_id;
+use crate::edge_cookie::recognized_ec_id;
 use crate::error::TrustedServerError;
 use crate::integrations::{
     AttributeRewriteAction, INTEGRATION_MAX_BODY_BYTES, IntegrationAttributeContext,
@@ -184,13 +184,17 @@ impl IntegrationProxy for TestlightIntegration {
                 .await?;
         let req = http::Request::from_parts(parts, EdgeBody::empty());
 
-        // Read EC ID from the ts-ec cookie forwarded by the client.
-        // The registry strips x-ts-ec before dispatching, so only the cookie is available here.
-        let ec_id = get_ec_id(&req)
+        // Read the EC ID from the ts-ec cookie forwarded by the client. The
+        // registry strips x-ts-ec before dispatching, so only the cookie is
+        // available here. The value goes into the proxied body as `user.id` and
+        // leaves the edge, so only one the selected module recognizes is
+        // accepted, and a stateless deployment supplies none.
+        let ec_id = recognized_ec_id(settings, services, &req)
             .change_context(Self::error("Failed to read EC ID"))?
             .ok_or_else(|| {
                 Report::new(Self::error(
-                    "EC ID not found in ts-ec cookie — the client must carry a valid EC cookie",
+                    "No EC ID this deployment's Edge Cookie module recognizes was found \
+                     in the ts-ec cookie",
                 ))
             })?;
 
@@ -469,4 +473,92 @@ mod tests {
             );
         });
     }
+
+    /// A well-formed identifier carrying a module code no deployment here
+    /// reads, the shape a partner or another deployment would hand back.
+    const FOREIGN_CODED_EC_ID: &str = "zz00~someone-elses-identifier";
+
+    fn testlight_auction_request(ec_id: &str) -> http::Request<EdgeBody> {
+        let mut req = http::Request::builder()
+            .method(Method::POST)
+            .uri("https://edge.example.com/integrations/testlight/auction")
+            .body(EdgeBody::from(br#"{"imp":[{"id":"slot-1"}]}"#.to_vec()))
+            .expect("should build request");
+        req.headers_mut().insert(
+            crate::constants::HEADER_X_TS_EC.clone(),
+            http::HeaderValue::from_str(ec_id).expect("should build EC header value"),
+        );
+        req
+    }
+
+    fn testlight_integration() -> Arc<TestlightIntegration> {
+        TestlightIntegration::new(TestlightConfig {
+            enabled: true,
+            endpoint: "https://example.com/openrtb".to_string(),
+            timeout_ms: 1000,
+            shim_src: tsjs::tsjs_unified_script_src(),
+            rewrite_scripts: true,
+        })
+    }
+
+    #[test]
+    fn handle_refuses_to_egress_an_ec_id_the_module_does_not_recognize() {
+        futures::executor::block_on(async {
+            // The identifier ends up in the proxied body as `user.id` and leaves
+            // the edge, so a value this deployment did not issue must stop here
+            // rather than be handed to the upstream endpoint.
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, br#"{"ok":true}"#.to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            let settings = create_test_settings();
+
+            let refused = testlight_integration()
+                .handle(
+                    &settings,
+                    &services,
+                    testlight_auction_request(FOREIGN_CODED_EC_ID),
+                )
+                .await
+                .expect_err("a foreign module code should not be proxied upstream");
+            drop(refused);
+
+            assert!(
+                stub.recorded_backend_names().is_empty(),
+                "no upstream call should be made with an unrecognized identifier"
+            );
+        });
+    }
+
+    #[test]
+    fn handle_refuses_to_egress_any_ec_id_in_a_stateless_deployment() {
+        futures::executor::block_on(async {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, br#"{"ok":true}"#.to_vec());
+            let services = build_services_with_http_client(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+            );
+            // The value is one the built-in module would recognize, so only
+            // the absence of a selected module can withhold it.
+            let mut settings = create_test_settings();
+            settings.ec.module = None;
+            settings.ec.module_blocks.clear();
+
+            let refused = testlight_integration()
+                .handle(
+                    &settings,
+                    &services,
+                    testlight_auction_request(VALID_SYNTHETIC_ID),
+                )
+                .await
+                .expect_err("a deployment that creates no identifier should proxy none");
+            drop(refused);
+
+            assert!(
+                stub.recorded_backend_names().is_empty(),
+                "no upstream call should be made without a recognized identifier"
+            );
+        });
+    }
 }
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index 249f741ab..03ccbe4fd 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -48,6 +48,7 @@ pub mod creative_opportunities;
 pub mod ec;
 pub(crate) mod edge_cookie;
 pub mod error;
+pub mod evidence;
 pub mod geo;
 pub mod host_header;
 pub(crate) mod host_rewrite;
@@ -55,6 +56,7 @@ pub mod html_processor;
 pub mod http_util;
 pub mod integrations;
 pub mod models;
+pub mod module_name;
 pub mod openrtb;
 pub mod platform;
 pub mod price_bucket;
diff --git a/crates/trusted-server-core/src/module_name.rs b/crates/trusted-server-core/src/module_name.rs
new file mode 100644
index 000000000..3e25831a8
--- /dev/null
+++ b/crates/trusted-server-core/src/module_name.rs
@@ -0,0 +1,247 @@
+//! The name a module is selected by, taken from the folder its crate lives in.
+//!
+//! A crate at `crates/geo/example` supplies the module `geo.example`: the path
+//! below the nearest `crates` directory, with `.` between the parts. A crate
+//! supplying several modules names each one after itself, as
+//! `middleware.example.hide`. A section may leave its own type folder off, so
+//! under `[geo]` the name `example` means `geo.example`. Core's own modules
+//! take bare names, such as `builtin`.
+
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock, PoisonError};
+
+/// The name of the module the calling crate supplies, or, given an entry, the
+/// name of that entry, as `<crate path>.<entry>`.
+///
+/// Derived from Cargo's `CARGO_MANIFEST_DIR` when the calling crate is built,
+/// so a name cannot drift from its folder. A crate built from outside a
+/// `crates` directory, such as a published package, is named by its package
+/// name.
+#[macro_export]
+macro_rules! module_name {
+    () => {
+        $crate::module_name::from_manifest(env!("CARGO_MANIFEST_DIR"), env!("CARGO_PKG_NAME"), None)
+    };
+    ($entry:expr) => {
+        $crate::module_name::from_manifest(
+            env!("CARGO_MANIFEST_DIR"),
+            env!("CARGO_PKG_NAME"),
+            Some($entry),
+        )
+    };
+}
+
+/// The module name for a crate built at `manifest_dir`, with `entry` after it
+/// when the crate supplies several.
+///
+/// Each distinct name is made once and kept for the life of the process, so
+/// a module can hand out `&'static str` without its crate holding a copy.
+#[must_use]
+pub fn from_manifest(manifest_dir: &str, package: &str, entry: Option<&str>) -> &'static str {
+    static NAMES: OnceLock<Mutex<HashMap<String, &'static str>>> = OnceLock::new();
+    let mut name = crate_path(manifest_dir).unwrap_or_else(|| package.to_owned());
+    if let Some(entry) = entry {
+        name.push('.');
+        name.push_str(entry);
+    }
+    let mut names = NAMES
+        .get_or_init(Mutex::default)
+        .lock()
+        .unwrap_or_else(PoisonError::into_inner);
+    if let Some(existing) = names.get(&name) {
+        return existing;
+    }
+    let leaked: &'static str = Box::leak(name.clone().into_boxed_str());
+    names.insert(name, leaked);
+    leaked
+}
+
+/// The path below the nearest `crates` directory, joined by `.`, or `None`
+/// when the folder is not below one.
+fn crate_path(manifest_dir: &str) -> Option<String> {
+    let parts: Vec<&str> = manifest_dir
+        .split(['/', '\\'])
+        .filter(|part| !part.is_empty())
+        .collect();
+    let crates = parts.iter().rposition(|part| *part == "crates")?;
+    let below = &parts[crates + 1..];
+    (!below.is_empty()).then(|| below.join("."))
+}
+
+/// The longest module name, in bytes.
+const MAX_NAME_BYTES: usize = 255;
+
+/// Whether `name` can name a module: parts joined by `.`, each of lower case
+/// letters, digits, `_` or `-`.
+///
+/// The same rule serves a crate's derived name and a name written in a
+/// section, so anything a crate can be called can also be written.
+#[must_use]
+pub fn is_valid(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= MAX_NAME_BYTES
+        && name.split('.').all(|part| {
+            !part.is_empty()
+                && part.bytes().all(|byte| {
+                    byte.is_ascii_lowercase()
+                        || byte.is_ascii_digit()
+                        || matches!(byte, b'_' | b'-')
+                })
+        })
+}
+
+/// The offered name that `written`, selected in a section of type
+/// `type_folder`, means.
+///
+/// The name as written wins, which is how a bare name reaches one of core's
+/// own modules and a full path reaches a module under another type. Otherwise
+/// the type folder is put in front, because a section is named exactly as its
+/// folder.
+#[must_use]
+pub fn resolve<'a>(type_folder: &str, written: &str, offered: &[&'a str]) -> Option<&'a str> {
+    if let Some(exact) = offered.iter().find(|name| **name == written) {
+        return Some(exact);
+    }
+    offered.iter().copied().find(|name| {
+        name.split_once('.')
+            .is_some_and(|(folder, rest)| rest == written && folder == type_folder)
+    })
+}
+
+/// The short form of `name` within a section of type `type_folder`, being the
+/// name with the type folder taken off, or the name itself when it lives
+/// under another type or is one of core's own.
+#[must_use]
+pub fn short_form<'a>(type_folder: &str, name: &'a str) -> &'a str {
+    match name.split_once('.') {
+        Some((folder, rest)) if folder == type_folder => rest,
+        _ => name,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_crate_is_named_by_its_path_below_crates() {
+        for (dir, expected) in [
+            (
+                "/home/runner/work/trusted-server/crates/geo/example",
+                "geo.example",
+            ),
+            (
+                "D:\\Workspace\\trusted-server\\crates\\permission-signal\\example-scheme",
+                "permission-signal.example-scheme",
+            ),
+            (
+                "/repo/vendor/trusted-server/crates/middleware/example",
+                "middleware.example",
+            ),
+            ("/repo/crates/demo/example", "demo.example"),
+        ] {
+            assert_eq!(crate_path(dir).as_deref(), Some(expected), "{dir}");
+        }
+    }
+
+    #[test]
+    fn the_nearest_crates_directory_counts() {
+        assert_eq!(
+            crate_path("/work/crates/tools/checkout/crates/geo/example").as_deref(),
+            Some("geo.example")
+        );
+    }
+
+    #[test]
+    fn a_crate_outside_a_crates_directory_takes_its_package_name() {
+        assert_eq!(
+            from_manifest("/registry/src/example-geo-0.1.0", "example-geo", None),
+            "example-geo"
+        );
+        assert_eq!(crate_path("/work/crates"), None);
+    }
+
+    #[test]
+    fn an_entry_follows_the_crate_path_and_each_name_is_kept_once() {
+        let first = from_manifest("/repo/crates/middleware/example", "x", Some("hide"));
+        let second = from_manifest("/repo/crates/middleware/example", "x", Some("hide"));
+
+        assert_eq!(first, "middleware.example.hide");
+        assert!(
+            std::ptr::eq(first, second),
+            "the same name is not made twice"
+        );
+    }
+
+    #[test]
+    fn this_crate_names_itself() {
+        assert_eq!(crate::module_name!(), "trusted-server-core");
+    }
+
+    #[test]
+    fn a_name_resolves_as_written_then_within_its_type() {
+        let offered = [
+            "builtin",
+            "geo.example",
+            "permission-signal.us-privacy",
+            "testing.mock",
+        ];
+
+        assert_eq!(resolve("device", "builtin", &offered), Some("builtin"));
+        assert_eq!(resolve("geo", "example", &offered), Some("geo.example"));
+        assert_eq!(resolve("geo", "geo.example", &offered), Some("geo.example"));
+        assert_eq!(
+            resolve("permission-signal", "us-privacy", &offered),
+            Some("permission-signal.us-privacy")
+        );
+        assert_eq!(
+            resolve("permission_signal", "us-privacy", &offered),
+            None,
+            "a section is named exactly as its folder"
+        );
+        assert_eq!(
+            resolve("ad-server", "testing.mock", &offered),
+            Some("testing.mock")
+        );
+        assert_eq!(
+            resolve("device", "example", &offered),
+            None,
+            "another type's module"
+        );
+        assert_eq!(resolve("geo", "missing", &offered), None);
+    }
+
+    #[test]
+    fn a_name_is_lower_case_parts_joined_by_dots() {
+        for good in [
+            "4example",
+            "us-privacy",
+            "host_signals",
+            "middleware.example.hide",
+        ] {
+            assert!(is_valid(good), "{good}");
+        }
+        for bad in [
+            "",
+            "Geo",
+            "geo..example",
+            ".geo",
+            "geo.",
+            "a b",
+            "geo/example",
+        ] {
+            assert!(!is_valid(bad), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn a_short_form_drops_only_the_sections_own_type() {
+        assert_eq!(short_form("geo", "geo.example"), "example");
+        assert_eq!(
+            short_form("permission-signal", "permission-signal.example-scheme"),
+            "example-scheme"
+        );
+        assert_eq!(short_form("ad-server", "testing.mock"), "testing.mock");
+        assert_eq!(short_form("geo", "platform"), "platform");
+    }
+}
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index 17813c77d..55ee5573b 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -941,6 +941,52 @@ pub(crate) fn noop_services() -> RuntimeServices {
     build_services_with_config(NoopConfigStore)
 }
 
+/// Build a [`RuntimeServices`] carrying an Edge Cookie module, threaded the
+/// way a composition root threads the module it resolved, so a test can
+/// exercise the seam a vendor module reaches core through and check that the
+/// request path reuses that instance.
+pub(crate) fn noop_services_with_ec_module(
+    ec_module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+) -> RuntimeServices {
+    // A fixed client IP, so a module that reads one (the built-in HMAC
+    // module does) can run.
+    noop_services_with_ec_module_and_ip(
+        ec_module,
+        Some("203.0.113.10".parse().expect("should parse test client IP")),
+    )
+}
+
+/// Build a [`RuntimeServices`] with an injected Edge Cookie module and no
+/// client IP, modeling a host that cannot determine one.
+///
+/// Whether that matters is the module's decision, so this exists to test both
+/// answers: a module reading other evidence still creates an identifier, and
+/// one that needs the IP refuses.
+pub(crate) fn noop_services_with_ec_module_without_client_ip(
+    ec_module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+) -> RuntimeServices {
+    noop_services_with_ec_module_and_ip(ec_module, None)
+}
+
+fn noop_services_with_ec_module_and_ip(
+    ec_module: Arc<dyn crate::ec::module::EdgeCookieModule>,
+    client_ip: Option<IpAddr>,
+) -> RuntimeServices {
+    RuntimeServices::builder()
+        .config_store(Arc::new(NoopConfigStore))
+        .secret_store(Arc::new(NoopSecretStore))
+        .kv_store(Arc::new(edgezero_core::key_value_store::NoopKvStore))
+        .backend(Arc::new(NoopBackend))
+        .http_client(Arc::new(NoopHttpClient))
+        .geo(Arc::new(NoopGeo))
+        .client_info(ClientInfo {
+            client_ip,
+            ..ClientInfo::default()
+        })
+        .resolved_ec_module(ec_module)
+        .build()
+}
+
 /// Build a [`RuntimeServices`] whose auction telemetry sink is the supplied
 /// recording (or otherwise custom) sink, so tests can assert which terminal
 /// auction events were emitted.
diff --git a/crates/trusted-server-core/src/platform/types.rs b/crates/trusted-server-core/src/platform/types.rs
index 3570bdc10..bfad4e776 100644
--- a/crates/trusted-server-core/src/platform/types.rs
+++ b/crates/trusted-server-core/src/platform/types.rs
@@ -9,6 +9,7 @@ use super::{
     PlatformBackend, PlatformConfigStore, PlatformGeo, PlatformHttpClient, PlatformKvStore,
     PlatformSecretStore,
 };
+use crate::ec::module::EdgeCookieModule;
 
 /// Geographic information extracted from a request.
 ///
@@ -18,7 +19,7 @@ use super::{
 pub struct GeoInfo {
     /// City name.
     pub city: String,
-    /// Two-letter country code.
+    /// ISO 3166-1 alpha-2 country code, for example `US` or `GB`.
     pub country: String,
     /// Continent name.
     pub continent: String,
@@ -28,7 +29,8 @@ pub struct GeoInfo {
     pub longitude: f64,
     /// DMA (Designated Market Area) / metro code.
     pub metro_code: i64,
-    /// Region code.
+    /// ISO 3166-2 subdivision code without the country prefix, for example `CA`
+    /// for California, or `None` when no region resolves.
     pub region: Option<String>,
     /// Autonomous System Number (e.g. `7922` = Comcast).
     /// Used to distinguish home ISP vs. corporate VPN.
@@ -188,6 +190,13 @@ pub struct RuntimeServices {
     pub(crate) auction_telemetry_sink: Arc<dyn AuctionTelemetrySink>,
     /// Per-request client metadata extracted at the entry point.
     pub(crate) client_info: ClientInfo,
+    /// The Edge Cookie module this deployment already resolved from
+    /// `[ec] module` while it built application state.
+    ///
+    /// `None` when the adapter resolved nothing here, in which case the request
+    /// path resolves the selection itself, which is what a deployment that
+    /// selects no module, the Axum adapter, and the core tests all do.
+    pub(crate) resolved_ec_module: Option<Arc<dyn EdgeCookieModule>>,
 }
 
 impl RuntimeServices {
@@ -275,6 +284,21 @@ impl RuntimeServices {
         &self.client_info
     }
 
+    /// Returns the Edge Cookie module the composition root already resolved,
+    /// when the adapter threaded one through.
+    ///
+    /// Resolving `[ec] module` reads no request data, so the answer is the
+    /// same for every request and an adapter that resolves it once while it
+    /// builds application state can hand the result here instead of the
+    /// request path resolving the same settings again. `None` means nothing was
+    /// threaded, so the request path resolves for itself. Read this through
+    /// [`request_module`](crate::ec::module::request_module) rather than
+    /// directly, so both answers are handled in one place.
+    #[must_use]
+    pub fn resolved_ec_module(&self) -> Option<Arc<dyn EdgeCookieModule>> {
+        self.resolved_ec_module.clone()
+    }
+
     /// Wrap the KV store in a [`super::KvHandle`] for ergonomic access to
     /// JSON helpers, pagination, and validation.
     #[must_use]
@@ -295,6 +319,25 @@ impl RuntimeServices {
         }
     }
 
+    /// Returns a clone of this instance with the resolved Edge Cookie module
+    /// replaced.
+    ///
+    /// Adapters that build their per-request services through a shared helper
+    /// with no application state in hand use this to thread the module the
+    /// composition root resolved. `None` leaves the request path to resolve
+    /// `[ec] module` for itself, which is what the Axum adapter and a
+    /// deployment selecting no module both do.
+    #[must_use]
+    pub fn with_resolved_ec_module(
+        self,
+        resolved_ec_module: Option<Arc<dyn EdgeCookieModule>>,
+    ) -> Self {
+        Self {
+            resolved_ec_module,
+            ..self
+        }
+    }
+
     /// Returns a clone of this instance with the template cache replaced.
     #[must_use]
     pub fn with_template_cache(self, cache: Arc<dyn super::PlatformTemplateCache>) -> Self {
@@ -340,6 +383,7 @@ pub struct RuntimeServicesBuilder {
     geo: Option<Arc<dyn PlatformGeo>>,
     auction_telemetry_sink: Option<Arc<dyn AuctionTelemetrySink>>,
     client_info: Option<ClientInfo>,
+    resolved_ec_module: Option<Arc<dyn EdgeCookieModule>>,
 }
 
 impl RuntimeServicesBuilder {
@@ -355,6 +399,7 @@ impl RuntimeServicesBuilder {
             geo: None,
             auction_telemetry_sink: None,
             client_info: None,
+            resolved_ec_module: None,
         }
     }
 
@@ -434,6 +479,18 @@ impl RuntimeServicesBuilder {
         self
     }
 
+    /// Set the Edge Cookie module the composition root already resolved.
+    ///
+    /// Optional. This is the module the selector actually chose, so setting
+    /// it keeps the request path from resolving the same settings a second
+    /// time. It is the single seam through which a vendor or host Edge Cookie
+    /// module reaches the request path.
+    #[must_use]
+    pub fn resolved_ec_module(mut self, module: Arc<dyn EdgeCookieModule>) -> Self {
+        self.resolved_ec_module = Some(module);
+        self
+    }
+
     /// Construct [`RuntimeServices`] from the accumulated configuration.
     ///
     /// # Panics
@@ -474,6 +531,7 @@ impl RuntimeServicesBuilder {
             client_info: self
                 .client_info
                 .expect("should set client_info before building RuntimeServices"),
+            resolved_ec_module: self.resolved_ec_module,
         }
     }
 }
diff --git a/crates/trusted-server-core/src/proxy.rs b/crates/trusted-server-core/src/proxy.rs
index 5d659cdbf..46d3c3f9e 100644
--- a/crates/trusted-server-core/src/proxy.rs
+++ b/crates/trusted-server-core/src/proxy.rs
@@ -21,7 +21,7 @@ use crate::constants::{
     HEADER_USER_AGENT, HEADER_X_FORWARDED_FOR,
 };
 use crate::creative::{CreativeCssProcessor, CreativeHtmlProcessor};
-use crate::edge_cookie::get_ec_id;
+use crate::edge_cookie::recognized_ec_id;
 use crate::error::TrustedServerError;
 use crate::platform::{
     DEFAULT_FIRST_BYTE_TIMEOUT, PlatformBackendSpec, PlatformHttpRequest, PlatformResponse,
@@ -790,7 +790,7 @@ pub async fn proxy_request(
     })?;
 
     if forward_ec_id {
-        append_ec_id(&req, &mut target_url_parsed);
+        append_ec_id(settings, services, &req, &mut target_url_parsed);
     }
 
     proxy_with_redirects(
@@ -1201,8 +1201,19 @@ fn upsert_ec_query_param(url: &mut url::Url, ec_id: &str) {
     url.set_query(Some(&serializer.finish()));
 }
 
-fn append_ec_id(req: &Request<EdgeBody>, target_url_parsed: &mut url::Url) {
-    let ec_id_param = match get_ec_id(req) {
+/// Forwards the request's Edge Cookie identifier to the outbound target URL.
+///
+/// Only an identifier the selected module recognizes is forwarded. A value
+/// carrying another deployment's module code, and any value at all in a
+/// stateless deployment, is withheld, so nothing this deployment did not issue
+/// reaches the origin.
+fn append_ec_id(
+    settings: &Settings,
+    services: &RuntimeServices,
+    req: &Request<EdgeBody>,
+    target_url_parsed: &mut url::Url,
+) {
+    let ec_id_param = match recognized_ec_id(settings, services, req) {
         Ok(id) => id,
         Err(e) => {
             log::warn!("failed to extract EC ID for forwarding: {:?}", e);
@@ -1544,7 +1555,7 @@ pub async fn handle_first_party_proxy(
 /// Returns an error if the signed target cannot be reconstructed or validation fails.
 pub async fn handle_first_party_click(
     settings: &Settings,
-    _services: &RuntimeServices,
+    services: &RuntimeServices,
     req: Request<EdgeBody>,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let SignedTarget {
@@ -1553,7 +1564,10 @@ pub async fn handle_first_party_click(
         had_params,
     } = reconstruct_and_validate_signed_target(settings, &req.uri().to_string())?;
 
-    let ec_id = match get_ec_id(&req) {
+    // The redirect target is a third party's URL, so only an identifier the
+    // selected module recognizes is added to it. A stateless deployment adds
+    // nothing.
+    let ec_id = match recognized_ec_id(settings, services, &req) {
         Ok(id) => id,
         Err(e) => {
             log::warn!("failed to extract EC ID for forwarding: {:?}", e);
@@ -2167,16 +2181,17 @@ mod tests {
 
     use super::{
         AssetProxyCachePolicy, IMAGE_FALLBACK_CONTENT_TYPE, ProxyRequestConfig,
-        SUPPORTED_ENCODINGS, asset_origin_host_header, asset_path_skips_image_optimizer,
-        build_asset_proxy_target_url, handle_asset_proxy_request, handle_first_party_click,
-        handle_first_party_proxy, handle_first_party_proxy_rebuild, handle_first_party_proxy_sign,
-        is_host_allowed, is_host_permitted, proxy_request, rebuild_response_with_body,
-        reconstruct_and_validate_signed_target, stream_asset_body,
+        SUPPORTED_ENCODINGS, append_ec_id, asset_origin_host_header,
+        asset_path_skips_image_optimizer, build_asset_proxy_target_url, handle_asset_proxy_request,
+        handle_first_party_click, handle_first_party_proxy, handle_first_party_proxy_rebuild,
+        handle_first_party_proxy_sign, is_host_allowed, is_host_permitted, proxy_request,
+        rebuild_response_with_body, reconstruct_and_validate_signed_target, stream_asset_body,
     };
     use crate::cache_policy::{CachePolicy, EdgeCacheHeader};
     use crate::constants::{HEADER_ACCEPT, HEADER_X_FORWARDED_FOR};
     use crate::creative;
     use crate::error::{IntoHttpResponse, TrustedServerError};
+    use crate::platform::RuntimeServices;
     use crate::platform::test_support::{
         HashMapSecretStore, StubHttpClient, build_services_with_http_client,
         build_services_with_secret_and_http_client, noop_services,
@@ -2196,6 +2211,7 @@ mod tests {
     use edgezero_core::body::Body as EdgeBody;
     use edgezero_core::http::response_builder as edge_response_builder;
     use error_stack::Report;
+    use http::Request;
     use http::{HeaderValue, Method, Request as HttpRequest, Response, StatusCode, header};
 
     #[test]
@@ -2918,7 +2934,8 @@ mod tests {
             );
             req.headers_mut().insert(
                 crate::constants::HEADER_X_TS_EC,
-                HeaderValue::from_static("ec-123"),
+                HeaderValue::from_str(&recognized_hmac_ec_id())
+                    .expect("should build EC header value"),
             );
 
             let resp = handle_first_party_click(&settings, &noop_services(), req)
@@ -2936,11 +2953,166 @@ mod tests {
                 .map(|(k, v)| (k.into_owned(), v.into_owned()))
                 .collect();
             assert_eq!(pairs.remove("foo").as_deref(), Some("1"));
-            assert_eq!(pairs.remove("ts-ec").as_deref(), Some("ec-123"));
+            assert_eq!(
+                pairs.remove("ts-ec").as_deref(),
+                Some(recognized_hmac_ec_id().as_str())
+            );
             assert!(pairs.is_empty());
         });
     }
 
+    /// An identifier the built-in HMAC module, the module
+    /// `create_test_settings` selects, recognizes as its own.
+    fn recognized_hmac_ec_id() -> String {
+        format!("hmac~{}", crate::test_support::tests::VALID_SYNTHETIC_ID)
+    }
+
+    /// A well-formed identifier carrying a module code no deployment here
+    /// reads, the shape a partner or another deployment would hand back.
+    const FOREIGN_CODED_EC_ID: &str = "zz00~someone-elses-identifier";
+
+    fn stateless_settings() -> Settings {
+        let mut settings = create_test_settings();
+        settings.ec.module = None;
+        settings.ec.module_blocks.clear();
+        settings
+    }
+
+    fn signed_click_request(settings: &Settings, ec_id: &str) -> Request<EdgeBody> {
+        let tsurl = "https://cdn.example/a.png";
+        let full = format!("{tsurl}?foo=1");
+        let sig = crate::http_util::compute_encrypted_sha256_token(settings, &full);
+        let mut req = build_http_request(
+            Method::GET,
+            format!(
+                "https://edge.example/first-party/click?tsurl={}&foo=1&tstoken={}",
+                url::form_urlencoded::byte_serialize(tsurl.as_bytes()).collect::<String>(),
+                sig
+            ),
+        );
+        req.headers_mut().insert(
+            crate::constants::HEADER_X_TS_EC,
+            HeaderValue::from_str(ec_id).expect("should build EC header value"),
+        );
+        req
+    }
+
+    fn click_ts_ec_param(
+        settings: &Settings,
+        services: &RuntimeServices,
+        req: Request<EdgeBody>,
+    ) -> Option<String> {
+        let resp = futures::executor::block_on(handle_first_party_click(settings, services, req))
+            .expect("should redirect");
+        let loc = resp
+            .headers()
+            .get(header::LOCATION)
+            .and_then(|h| h.to_str().ok())
+            .expect("Location header should be present and valid")
+            .to_owned();
+        url::Url::parse(&loc)
+            .expect("Location should be a valid URL")
+            .query_pairs()
+            .find(|(k, _)| k == "ts-ec")
+            .map(|(_, v)| v.into_owned())
+    }
+
+    #[test]
+    fn click_withholds_an_ec_id_the_module_does_not_recognize() {
+        let settings = create_test_settings();
+        let param = click_ts_ec_param(
+            &settings,
+            &noop_services(),
+            signed_click_request(&settings, FOREIGN_CODED_EC_ID),
+        );
+
+        assert_eq!(
+            param, None,
+            "a value carrying another deployment's module code should not reach the click target"
+        );
+    }
+
+    #[test]
+    fn click_withholds_every_ec_id_in_a_stateless_deployment() {
+        let settings = stateless_settings();
+        // The value is one the built-in module would recognize, so only the
+        // absence of a selected module can withhold it.
+        let param = click_ts_ec_param(
+            &settings,
+            &noop_services(),
+            signed_click_request(&settings, &recognized_hmac_ec_id()),
+        );
+
+        assert_eq!(
+            param, None,
+            "a deployment that creates no identifier should hand none to the click target"
+        );
+    }
+
+    #[test]
+    fn append_ec_id_forwards_only_what_the_module_recognizes() {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let recognized = recognized_hmac_ec_id();
+
+        let mut url =
+            url::Url::parse("https://origin.example/page?foo=1").expect("should parse origin URL");
+        append_ec_id(
+            &settings,
+            &services,
+            &request_with_ec_cookie(&recognized),
+            &mut url,
+        );
+        assert_eq!(
+            ts_ec_param(&url),
+            Some(recognized.clone()),
+            "the deployment's own identifier should still reach the origin"
+        );
+
+        let mut url =
+            url::Url::parse("https://origin.example/page?foo=1").expect("should parse origin URL");
+        append_ec_id(
+            &settings,
+            &services,
+            &request_with_ec_cookie(FOREIGN_CODED_EC_ID),
+            &mut url,
+        );
+        assert_eq!(
+            ts_ec_param(&url),
+            None,
+            "a foreign module code should not reach the origin"
+        );
+
+        let mut url =
+            url::Url::parse("https://origin.example/page?foo=1").expect("should parse origin URL");
+        append_ec_id(
+            &stateless_settings(),
+            &services,
+            &request_with_ec_cookie(&recognized),
+            &mut url,
+        );
+        assert_eq!(
+            ts_ec_param(&url),
+            None,
+            "a stateless deployment should forward nothing to the origin"
+        );
+    }
+
+    fn request_with_ec_cookie(ec_id: &str) -> Request<EdgeBody> {
+        let mut req = build_http_request(Method::GET, "https://edge.example/page");
+        req.headers_mut().insert(
+            http::header::COOKIE,
+            HeaderValue::from_str(&format!("ts-ec={ec_id}")).expect("should build cookie header"),
+        );
+        req
+    }
+
+    fn ts_ec_param(url: &url::Url) -> Option<String> {
+        url.query_pairs()
+            .find(|(k, _)| k == "ts-ec")
+            .map(|(_, v)| v.into_owned())
+    }
+
     #[test]
     fn proxy_rebuild_adds_and_removes_params() {
         futures::executor::block_on(async {
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 61bc7efe5..a8137f7a7 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -4478,6 +4478,11 @@ pub async fn handle_publisher_request(
     // ID, keeping the withdrawal CAS off the post-origin latency path.
     let active_ec_id_owned = ec_context.ec_value().map(str::to_owned);
     let active_ec_id = active_ec_id_owned.as_deref();
+    // The identity-graph key for the active EC ID, the owning module's
+    // canonical form of it. The snapshot preload reads and compares the row
+    // under this key, the key the row was written under, rather than under the
+    // identifier as issued.
+    let active_kv_key = ec_context.ec_kv_key();
     let ec_id_owned = active_ec_id_owned.clone().filter(|_| ec_allowed);
     let ec_id = ec_id_owned.as_deref();
     let cookie_jar = handle_request_cookies(&req)?;
@@ -4862,16 +4867,17 @@ pub async fn handle_publisher_request(
                 })?,
         );
     }
-    if should_preload_ec && let (Some(graph), Some(active_ec_id)) = (kv, active_ec_id) {
-        let refreshed = graph.load_snapshot(active_ec_id);
+    if should_preload_ec && let (Some(graph), Some(active_kv_key)) = (kv, active_kv_key.as_deref())
+    {
+        let refreshed = graph.load_snapshot(active_kv_key);
         // Never downgrade an in-request Add-confirmed Present snapshot: a
         // freshly created row can read back Missing/Failed on an
         // eventually-consistent store, and rotating or suppressing that
         // just-generated identity would fragment it. Adopt the refresh only
         // when it keeps or upgrades to a Present row (the intended
         // generation-refresh) — otherwise retain the confirmed entry.
-        let keep_present = ec_context.kv_snapshot().entry_for(active_ec_id).is_some()
-            && refreshed.entry_for(active_ec_id).is_none();
+        let keep_present = ec_context.kv_snapshot().entry_for(active_kv_key).is_some()
+            && refreshed.entry_for(active_kv_key).is_none();
         if !keep_present {
             ec_context.set_kv_snapshot(refreshed);
         }
@@ -7057,9 +7063,16 @@ pub async fn handle_page_bids(
             // actually running (enabled, consent-granted, slots matched, not a
             // bot/prefetch) and a partner registry exists to consume server-side
             // EIDs. Kill-switch, no-slot, bot/prefetch, and no-registry requests
-            // never reach here, so they incur no billable KV read.
+            // never reach here, so they incur no billable KV read. The row is
+            // read under the owning module's canonical form of the
+            // identifier, the key it is stored under, rather than under the
+            // identifier as issued.
             let page_bids_kv_snapshot = match (kv, ec_id.as_deref(), auction.registry) {
-                (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
+                (Some(graph), Some(_), Some(_)) => ec_context
+                    .ec_kv_key()
+                    .map_or(crate::ec::EcKvSnapshot::NotRead, |kv_key| {
+                        graph.load_snapshot(&kv_key)
+                    }),
                 _ => crate::ec::EcKvSnapshot::NotRead,
             };
             // Hand the loaded row to the request context so response
@@ -24486,6 +24499,11 @@ mod tests {
     /// tests drive the real handlers with a divergent edge host and assert on
     /// the auction request the orchestrator dispatched and on the telemetry rows
     /// the handler emitted.
+    ///
+    /// The same capturing setup also covers how both paths key the identity
+    /// graph. A module whose canonical form differs from the cookie value has
+    /// its row read under the canonical key, so the partner ID stored there
+    /// reaches the dispatched auction request.
     mod navigation_publisher_domain_tests {
         use super::*;
         use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
@@ -24493,6 +24511,7 @@ mod tests {
         use crate::auction::types::AuctionRequest;
         use crate::auction::{AuctionContext, AuctionOrchestrator};
         use crate::creative_opportunities::{CreativeOpportunityFormat, CreativeOpportunitySlot};
+        use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingModule};
         use crate::platform::test_support::{
             NoopConfigStore, NoopGeo, NoopSecretStore, StubBackend,
         };
@@ -24895,5 +24914,271 @@ mod tests {
 
             assert_only_renderable_slot_was_auctioned(&captured);
         }
+
+        /// The bidstream partner whose stored ID the canonical row carries.
+        const CANONICAL_ROW_PARTNER: &str = "ssp.example.com";
+
+        /// The partner ID the canonical row stores for [`CANONICAL_ROW_PARTNER`].
+        const CANONICAL_ROW_UID: &str = "partner-uid-123";
+
+        /// An identity graph holding one live row under [`CANONICAL_KV_KEY`],
+        /// and a registry that forwards that row's partner ID as an EID.
+        fn canonical_row_graph_and_registry() -> (KvIdentityGraph, PartnerRegistry) {
+            let graph = KvIdentityGraph::in_memory("navigation-canonical-store");
+            graph
+                .create(
+                    CANONICAL_KV_KEY,
+                    &crate::ec::kv_types::KvEntry::minimal(
+                        CANONICAL_ROW_PARTNER,
+                        CANONICAL_ROW_UID,
+                        1_741_824_000,
+                    ),
+                )
+                .expect("should seed the row under the canonical key");
+            let registry = PartnerRegistry::from_config(&[crate::settings::EcPartner {
+                name: "Canonical row partner".to_owned(),
+                source_domain: CANONICAL_ROW_PARTNER.to_owned(),
+                openrtb_atype: crate::settings::EcPartner::default_openrtb_atype(),
+                bidstream_enabled: true,
+                api_token: Some(crate::redacted::Redacted::new(
+                    "canonical-row-partner-token-32-bytes".to_owned(),
+                )),
+                batch_rate_limit: crate::settings::EcPartner::default_batch_rate_limit(),
+                pull_sync_enabled: false,
+                pull_sync_url: None,
+                pull_sync_allowed_domains: vec![],
+                pull_sync_ttl_sec: crate::settings::EcPartner::default_pull_sync_ttl_sec(),
+                pull_sync_rate_limit: crate::settings::EcPartner::default_pull_sync_rate_limit(),
+                ts_pull_token: None,
+            }])
+            .expect("should build a registry with one bidstream partner");
+            (graph, registry)
+        }
+
+        /// A returning visitor carrying the identifier [`CanonicalizingModule`]
+        /// creates, with consent that permits the server-side auction.
+        fn canonicalizing_returning_visitor() -> EcContext {
+            let consent = crate::consent::ConsentContext {
+                jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                ..Default::default()
+            };
+            EcContext::new_for_test(Some(CANONICAL_COOKIE_VALUE.to_owned()), consent)
+                .with_module_for_test(Arc::new(CanonicalizingModule))
+        }
+
+        /// Asserts the dispatched auction request carried the partner ID the
+        /// canonical row stores, and the request snapshot is bound to the
+        /// canonical key.
+        fn assert_auction_used_the_canonical_row(
+            captured: &Arc<Mutex<Option<AuctionRequest>>>,
+            ec_context: &EcContext,
+        ) {
+            let request = captured
+                .lock()
+                .expect("should lock captured request")
+                .clone()
+                .expect("should dispatch an auction request");
+            let eids = request
+                .user
+                .eids
+                .expect("the auction should carry server-side EIDs from the identity graph");
+            assert!(
+                eids.iter().any(|eid| eid.source == CANONICAL_ROW_PARTNER
+                    && eid.uids.iter().any(|uid| uid.id == CANONICAL_ROW_UID)),
+                "the auction should carry the partner ID stored under the canonical key, got {eids:?}"
+            );
+            assert!(
+                ec_context
+                    .kv_snapshot()
+                    .entry_for(CANONICAL_KV_KEY)
+                    .is_some(),
+                "the request snapshot should be bound to the canonical key"
+            );
+        }
+
+        #[tokio::test]
+        async fn initial_navigation_reads_the_identity_row_under_the_canonical_key() {
+            // The identity graph stores a row under the owning module's
+            // canonical form of the identifier. Preloaded and resolved under
+            // the identifier as issued, a module whose canonical form differs
+            // from the cookie value found no row, so the auction carried no
+            // server-side EIDs.
+            let settings = settings_with_capturing_provider();
+            let captured = Arc::new(Mutex::new(None));
+            let orchestrator = orchestrator_capturing_request(&settings, &captured);
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"<html><head></head><body>ok</body></html>".to_vec());
+            let services = services_with(
+                Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>,
+                Arc::new(RecordingTelemetrySink::default()),
+            );
+            let (graph, registry) = canonical_row_graph_and_registry();
+            let mut ec_context = canonicalizing_returning_visitor();
+            let req = HttpRequest::builder()
+                .method(Method::GET)
+                .uri(format!("https://{EDGE_HOST}/2024/01/my-article/"))
+                .header(header::HOST, EDGE_HOST)
+                .header("sec-fetch-dest", "document")
+                .body(EdgeBody::empty())
+                .expect("should build test request");
+
+            let _ = handle_publisher_request(
+                &settings,
+                &services,
+                Some(&graph),
+                &mut ec_context,
+                AuctionDispatch {
+                    orchestrator: &orchestrator,
+                    slots: &article_slot(),
+                    registry: Some(&registry),
+                },
+                req,
+                EdgeCacheHeader::SMaxageFallback,
+            )
+            .await
+            .expect("should proxy publisher request");
+
+            assert_auction_used_the_canonical_row(&captured, &ec_context);
+        }
+
+        #[tokio::test]
+        async fn initial_navigation_keeps_a_new_identifiers_cookie() {
+            // Generation binds the request snapshot to the canonical key. The
+            // navigation preload that follows read under the identifier as
+            // issued, found nothing there, and replaced that snapshot with a
+            // miss, so EC finalization skipped the cookie for the identifier
+            // this request had just created. The second store's first point
+            // read misses the row generation just wrote, as an eventually
+            // consistent store can right after a write. The preload keeps
+            // generation's snapshot in that case only when it compares both
+            // snapshots under the canonical key.
+            let stores = [
+                (
+                    "a consistent store",
+                    KvIdentityGraph::in_memory("navigation-new-identifier-store"),
+                ),
+                (
+                    "a store whose first point read misses",
+                    KvIdentityGraph::stale_lookup("navigation-stale-read-store", 1),
+                ),
+            ];
+            for (store, graph) in stores {
+                let settings = settings_with_capturing_provider();
+                let captured = Arc::new(Mutex::new(None));
+                let orchestrator = orchestrator_capturing_request(&settings, &captured);
+                let stub = Arc::new(StubHttpClient::new());
+                stub.push_response(200, b"<html><head></head><body>ok</body></html>".to_vec());
+                let services = services_with(
+                    Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>,
+                    Arc::new(RecordingTelemetrySink::default()),
+                );
+                let consent = crate::consent::ConsentContext {
+                    jurisdiction: crate::consent::jurisdiction::Jurisdiction::NonRegulated,
+                    ..Default::default()
+                };
+                let mut ec_context = EcContext::new_for_test(None, consent)
+                    .with_module_for_test(Arc::new(CanonicalizingModule));
+                ec_context
+                    .generate_if_needed(&settings, Some(&graph))
+                    .expect("should create the identifier through the module");
+                assert_eq!(
+                    ec_context.ec_value(),
+                    Some(CANONICAL_COOKIE_VALUE),
+                    "test precondition: the module should create its identifier"
+                );
+                let req = HttpRequest::builder()
+                    .method(Method::GET)
+                    .uri(format!("https://{EDGE_HOST}/2024/01/my-article/"))
+                    .header(header::HOST, EDGE_HOST)
+                    .header("sec-fetch-dest", "document")
+                    .body(EdgeBody::empty())
+                    .expect("should build test request");
+
+                let _ = handle_publisher_request(
+                    &settings,
+                    &services,
+                    Some(&graph),
+                    &mut ec_context,
+                    AuctionDispatch {
+                        orchestrator: &orchestrator,
+                        slots: &[],
+                        registry: None,
+                    },
+                    req,
+                    EdgeCacheHeader::SMaxageFallback,
+                )
+                .await
+                .expect("should proxy publisher request");
+
+                let mut response = Response::new(EdgeBody::empty());
+                crate::ec::finalize::ec_finalize_response(
+                    &settings,
+                    &mut ec_context,
+                    Some(&graph),
+                    &PartnerRegistry::empty(),
+                    None,
+                    None,
+                    &mut response,
+                );
+
+                let cookies: Vec<&str> = response
+                    .headers()
+                    .get_all(header::SET_COOKIE)
+                    .iter()
+                    .filter_map(|value| value.to_str().ok())
+                    .collect();
+                assert!(
+                    cookies
+                        .iter()
+                        .any(|cookie| cookie.starts_with("ts-ec=") && !cookie.contains("Max-Age=0")),
+                    "the identifier this request created should reach the browser with {store}, \
+                     got {cookies:?}"
+                );
+            }
+        }
+
+        #[tokio::test]
+        async fn page_bids_reads_the_identity_row_under_the_canonical_key() {
+            // The same keying for the SPA re-auction endpoint, which loads the
+            // row itself only once a live auction will run.
+            let settings = settings_with_capturing_provider();
+            let captured = Arc::new(Mutex::new(None));
+            let orchestrator = orchestrator_capturing_request(&settings, &captured);
+            let services = services_with(
+                Arc::new(crate::platform::test_support::NoopHttpClient),
+                Arc::new(RecordingTelemetrySink::default()),
+            );
+            let (graph, registry) = canonical_row_graph_and_registry();
+            let mut ec_context = canonicalizing_returning_visitor();
+            let mut req = HttpRequest::builder()
+                .method(Method::GET)
+                .uri(format!(
+                    "https://{EDGE_HOST}/_ts/page-bids?path=/2024/01/my-article/"
+                ))
+                .header(header::HOST, EDGE_HOST)
+                .body(EdgeBody::empty())
+                .expect("should build test request");
+            req.headers_mut().insert(
+                header::HeaderName::from_static("sec-fetch-site"),
+                HeaderValue::from_static("same-origin"),
+            );
+
+            let _ = handle_page_bids(
+                &settings,
+                &services,
+                Some(&graph),
+                AuctionDispatch {
+                    orchestrator: &orchestrator,
+                    slots: &article_slot(),
+                    registry: Some(&registry),
+                },
+                &mut ec_context,
+                req,
+            )
+            .await
+            .expect("should return ok response");
+
+            assert_auction_used_the_canonical_row(&captured, &ec_context);
+        }
     }
 }
diff --git a/crates/trusted-server-core/src/response_privacy.rs b/crates/trusted-server-core/src/response_privacy.rs
index 46ff4bf5b..65e53c7c7 100644
--- a/crates/trusted-server-core/src/response_privacy.rs
+++ b/crates/trusted-server-core/src/response_privacy.rs
@@ -220,6 +220,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                module = "hmac"
+
+                [ec.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
diff --git a/crates/trusted-server-core/src/secret_resolution.rs b/crates/trusted-server-core/src/secret_resolution.rs
index f362a0b7b..721bfaca0 100644
--- a/crates/trusted-server-core/src/secret_resolution.rs
+++ b/crates/trusted-server-core/src/secret_resolution.rs
@@ -1,8 +1,10 @@
 //! Runtime resolution of `EdgeZero` app-config secret references.
 //!
 //! Config blobs carry secret-store key names at rest. This module walks the
-//! public `EdgeZero` metadata contract and replaces those names only in the
-//! in-memory value used to build runtime [`crate::settings::Settings`].
+//! public `EdgeZero` metadata contract, together with the leaves
+//! [`ConfiguredSecretFields`] reads out of the configuration itself, and
+//! replaces those names only in the in-memory value used to build runtime
+//! [`crate::settings::Settings`].
 
 use edgezero_core::app_config::{AppConfigMeta, SecretField, SecretKind, SecretPathSegment};
 use error_stack::Report;
@@ -11,8 +13,27 @@ use serde_json::Value;
 use crate::error::TrustedServerError;
 use crate::platform::{PlatformSecretStore, StoreName};
 
+/// Secret leaves whose paths come from the configuration rather than the type.
+///
+/// [`AppConfigMeta::secret_fields`] is an associated function of the type, so
+/// every path it can return is fixed, and `EdgeZero`'s path segments have no
+/// way to say "whatever name the operator chose". A configuration can hold
+/// secrets under such a name, as an Edge Cookie module block under a label
+/// does, and an implementation of this trait finds those by reading the
+/// configuration being loaded.
+pub trait ConfiguredSecretFields: AppConfigMeta {
+    /// The secret leaves `data` holds under names the operator chose, each
+    /// with its full path from the configuration root.
+    fn configured_secret_fields(data: &Value) -> Vec<SecretField>;
+}
+
 /// Resolve all secret references in a serialized Trusted Server app config.
 ///
+/// Both the fixed leaves [`AppConfigMeta::secret_fields`] lists and the ones
+/// [`ConfiguredSecretFields::configured_secret_fields`] reads out of `data`
+/// are resolved in one pass, so a failure in either leaves the configuration
+/// as it was.
+///
 /// The input is mutated in memory; the verified envelope is never rewritten.
 /// Secret values are not included in structural or platform errors.
 ///
@@ -21,13 +42,17 @@ use crate::platform::{PlatformSecretStore, StoreName};
 /// Returns [`TrustedServerError::Configuration`] when a required path or key
 /// is malformed, a secret is unavailable, is not valid UTF-8, or resolves to an
 /// empty value.
-pub fn resolve_secret_references<C: AppConfigMeta>(
+pub fn resolve_secret_references<C: ConfiguredSecretFields>(
     data: &mut Value,
     secret_store: &dyn PlatformSecretStore,
     default_store_name: &StoreName,
 ) -> Result<(), Report<TrustedServerError>> {
+    let fields = C::secret_fields()
+        .into_iter()
+        .chain(C::configured_secret_fields(data))
+        .collect::<Vec<_>>();
     let mut resolved_data = data.clone();
-    for field in C::secret_fields() {
+    for field in fields {
         if matches!(field.kind, SecretKind::StoreRef) {
             continue;
         }
@@ -238,6 +263,28 @@ mod tests {
 
     struct Fixture;
 
+    impl ConfiguredSecretFields for Fixture {
+        /// Every key under `labeled` holds its secret at
+        /// `labeled.<name>.secret`, which is the shape a fixed path cannot
+        /// name.
+        fn configured_secret_fields(data: &Value) -> Vec<SecretField> {
+            data.get("labeled")
+                .and_then(Value::as_object)
+                .into_iter()
+                .flatten()
+                .map(|(name, _)| SecretField {
+                    kind: SecretKind::KeyInDefault,
+                    optional: false,
+                    path: vec![
+                        SecretPathSegment::Field("labeled".into()),
+                        SecretPathSegment::Field(name.clone().into()),
+                        SecretPathSegment::Field("secret".into()),
+                    ],
+                })
+                .collect()
+        }
+    }
+
     impl AppConfigMeta for Fixture {
         fn secret_fields() -> Vec<SecretField> {
             vec![
@@ -316,6 +363,38 @@ mod tests {
         assert_eq!(present["feature"]["credential"], "resolved-feature");
     }
 
+    #[test]
+    fn resolves_a_secret_under_a_name_only_the_configuration_holds() {
+        let mut data = serde_json::json!({
+            "outer": [{"token": "token-a"}],
+            "labeled": {"chosen": {"secret": "feature-key"}},
+        });
+
+        resolve_secret_references::<Fixture>(&mut data, &store(), &StoreName::from("secrets"))
+            .expect("should resolve a secret the fixed paths cannot name");
+
+        assert_eq!(data["outer"][0]["token"], "resolved-a");
+        assert_eq!(data["labeled"]["chosen"]["secret"], "resolved-feature");
+    }
+
+    #[test]
+    fn a_failed_configured_field_leaves_the_fixed_ones_unresolved() {
+        // Fixed and configured leaves resolve in one pass, so a failure in
+        // either hands back the configuration exactly as it arrived.
+        let mut data = serde_json::json!({
+            "outer": [{"token": "token-a"}],
+            "labeled": {"chosen": {"secret": "missing"}},
+        });
+        let original = data.clone();
+
+        let err =
+            resolve_secret_references::<Fixture>(&mut data, &store(), &StoreName::from("secrets"))
+                .expect_err("should reject a missing configured secret");
+
+        assert!(err.to_string().contains("labeled.chosen.secret"));
+        assert_eq!(data, original, "should preserve unresolved data on failure");
+    }
+
     #[test]
     fn rejects_missing_required_path_without_secret_values() {
         for mut data in [
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index bf4ff7999..770897d01 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -6,20 +6,22 @@ use regex::Regex;
 use serde::{Deserialize, Deserializer, Serialize, de::DeserializeOwned};
 use serde_json::Value as JsonValue;
 use sha2::{Digest as _, Sha256};
-use std::collections::{HashMap, HashSet};
+use std::borrow::Cow;
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::ops::{Deref, DerefMut};
 use std::str::FromStr;
 use std::sync::OnceLock;
 use std::time::Duration;
 use subtle::ConstantTimeEq as _;
 use url::Url;
-use validator::{Validate, ValidationError};
+use validator::{Validate, ValidationError, ValidationErrors, ValidationErrorsKind};
 
 use crate::auction_config_types::AuctionConfig;
 use crate::cache_policy::{CachePolicy, CacheVisibility};
 use crate::consent_config::ConsentConfig;
 use crate::constants::INTERNAL_HEADERS;
 use crate::creative_opportunities::CreativeOpportunitiesConfig;
+use crate::ec::module::{EcModuleSelection, HMAC_MODULE_KEY};
 use crate::error::TrustedServerError;
 use crate::host_header::validate_host_header_override_value;
 use crate::platform::PlatformImageOptimizerRegion;
@@ -537,12 +539,45 @@ impl EcPartner {
 ///
 /// Mapped from the `[ec]` TOML section. Controls EC identity generation,
 /// KV store names, and partner registry.
-#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
-#[serde(deny_unknown_fields)]
+///
+/// Every key in the section other than the fields below is one module's
+/// `[ec.<name>]` settings table, held in
+/// [`module_blocks`](Self::module_blocks), so the field names below are
+/// reserved and cannot name a module.
+#[derive(Debug, Default, Clone, Deserialize, Serialize)]
 pub struct Ec {
-    /// Publisher passphrase used as HMAC key for EC generation.
-    #[validate(custom(function = Ec::validate_passphrase))]
-    pub passphrase: Redacted<String>,
+    /// The name of the Edge Cookie identity module to activate.
+    ///
+    /// Set it in the `[ec]` TOML section, for example `"hmac"`. The name is
+    /// the module's implementation unless its `[ec.<name>]` block names a
+    /// different one, in which case the name is a label of the operator's
+    /// choosing (see [`module_blocks`](Self::module_blocks)). Deployment
+    /// tooling can merge a `TRUSTED_SERVER__EC__MODULE` environment value
+    /// into the published configuration before it is loaded, so the same
+    /// compiled WebAssembly can switch modules at deployment. The running
+    /// server reads its settings from the platform config store, not the
+    /// environment. When absent, no Edge Cookie is generated and Trusted
+    /// Server runs statelessly, and the explicit `"none"` spells the same
+    /// choice. A selection whose implementation needs settings it has no block
+    /// for is rejected at startup by
+    /// [`validate_module_selection`](Self::validate_module_selection).
+    ///
+    /// Typed as [`EcModuleSelection`], which reads and writes the same
+    /// string, so every check that asks which module is selected matches on
+    /// one vocabulary rather than comparing string literals.
+    #[serde(default)]
+    pub module: Option<EcModuleSelection>,
+
+    /// Deprecated location of the HMAC passphrase, read so a configuration
+    /// written for the previous release still starts.
+    ///
+    /// [`migrate_legacy_ec_layout`](Self::migrate_legacy_ec_layout) maps it
+    /// to `module = "hmac"` with the passphrase in the `[ec.hmac]` block and
+    /// logs a deprecation warning, so a fleet can move configuration and
+    /// binaries independently. A configuration carrying both the old and the
+    /// new form is rejected rather than guessed at.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub passphrase: Option<Redacted<String>>,
 
     /// Fastly KV store name for the EC identity graph.
     #[serde(default)]
@@ -568,8 +603,20 @@ pub struct Ec {
 
     /// Partners (SSPs, DSPs, identity vendors) for EC identity sync.
     #[serde(default, deserialize_with = "vec_from_seq_or_map")]
-    #[validate(nested)]
     pub partners: Vec<EcPartner>,
+
+    /// The settings tables of the Edge Cookie identity modules, keyed by the
+    /// name each is written under.
+    ///
+    /// A module has a block only when it has settings of its own, so
+    /// `[ec] module = "hmac"` needs an `[ec.hmac]` block for its required
+    /// passphrase while a module with no settings needs none. The
+    /// [`module`](Self::module) selector names the active module and
+    /// [`validate_module_selection`](Self::validate_module_selection)
+    /// rejects a block it does not name, so at most one block survives
+    /// startup.
+    #[serde(flatten)]
+    pub module_blocks: EcModuleBlocks,
 }
 
 impl Ec {
@@ -631,6 +678,468 @@ impl Ec {
         }
         Ok(())
     }
+
+    /// Validates the module selection against the configured blocks.
+    ///
+    /// When [`module`](Self::module) is set, the selection has to resolve
+    /// to an implementation this deployment can configure, and every block in
+    /// [`module_blocks`](Self::module_blocks) has to be the one the
+    /// selector names, so a deployment that selects a module (in TOML or via
+    /// the environment override) but has not configured it fails fast at
+    /// startup rather than silently running stateless. When no module is
+    /// selected, Trusted Server runs statelessly and this check passes.
+    ///
+    /// Whether the named implementation exists at all is settled by
+    /// [`build_module`](crate::ec::module::build_module), which is the
+    /// one place that knows both the implementations built into core and the
+    /// one this deployment's adapter injects.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when a module name or
+    /// implementation is not a module name, when a block is configured with no
+    /// selector or alongside `"none"`, when the selector names a key `[ec]`
+    /// reads as its own setting, when a block the selector does not name is
+    /// configured, or when the selected module resolves to an
+    /// implementation that needs settings and has no block.
+    pub fn validate_module_selection(&self) -> Result<(), Report<TrustedServerError>> {
+        for (name, block) in self.module_blocks.iter() {
+            Self::validate_module_name(name)?;
+            if let Some(implementation) = &block.implementation {
+                Self::validate_module_name(implementation)?;
+            }
+        }
+
+        let Some(selection) = self.module.as_ref() else {
+            if !self.module_blocks.is_empty() {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "[ec.<name>] module blocks are configured but no [ec] module \
+                              is selected. Set [ec] module = \"<name>\" to activate one, or \
+                              remove the blocks to run statelessly"
+                        .to_owned(),
+                }));
+            }
+            return Ok(());
+        };
+
+        // `"none"` is explicit statelessness, the same meaning as omitting the
+        // selector, spelled out. It is subject to the same rule that no
+        // module blocks may be left configured.
+        let EcModuleSelection::Named(name) = selection else {
+            if !self.module_blocks.is_empty() {
+                return Err(Report::new(TrustedServerError::Configuration {
+                    message: "[ec] module = \"none\" selects stateless operation, but \
+                              [ec.<name>] module blocks are configured. Remove the blocks, \
+                              or select the module they configure"
+                        .to_owned(),
+                }));
+            }
+            return Ok(());
+        };
+
+        let name = name.as_str();
+        Self::validate_module_name(name)?;
+        if EC_SECTION_KEYS.contains(&name) || name == REMOVED_EC_PROVIDERS_TABLE {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "[ec] module = \"{name}\" names a key the `[ec]` section reads as its \
+                     own setting, so no module can be configured under it. Give the \
+                     module a name of its own"
+                ),
+            }));
+        }
+
+        // A module has a block only when it has settings, and core knows
+        // which of its own implementations need them. A module an adapter
+        // injects has the contents of its block read by that adapter when it
+        // builds the module, so core cannot say whether it needs one.
+        if self.module_blocks.implementation(name) == HMAC_MODULE_KEY
+            && !self.module_blocks.contains_key(name)
+        {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "Edge Cookie module `{name}` is selected but has no `[ec.{name}]` configuration"
+                ),
+            }));
+        }
+
+        // Every configured block must be the selected one. An unreferenced
+        // block is almost always a mistake (a mistyped selector or a stale
+        // block), and accepting it silently invites configuration drift.
+        let unreferenced: Vec<&str> = self
+            .module_blocks
+            .keys()
+            .map(String::as_str)
+            .filter(|configured| *configured != name)
+            .collect();
+        if unreferenced.is_empty() {
+            Ok(())
+        } else {
+            Err(Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "[ec.{}] is configured but `{name}` is selected. Remove the unselected \
+                     block, or correct the selector",
+                    unreferenced.join("], [ec.")
+                ),
+            }))
+        }
+    }
+
+    /// Validates one module name or implementation id.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when `name` is not a
+    /// module name, see [`crate::module_name::is_valid`].
+    fn validate_module_name(name: &str) -> Result<(), Report<TrustedServerError>> {
+        if crate::module_name::is_valid(name) {
+            return Ok(());
+        }
+        Err(Report::new(TrustedServerError::Configuration {
+            message: format!(
+                "Edge Cookie module name `{name}` is not a module name, which is parts \
+                 joined by `.`, each of lower case letters, digits, `_` or `-`"
+            ),
+        }))
+    }
+
+    /// Migrates the deprecated `[ec] passphrase` form to the module layout.
+    ///
+    /// A configuration still carrying the old key keeps working for one
+    /// release cycle, mapping to `module = "hmac"` with the passphrase in
+    /// the `[ec.hmac]` block, and a deprecation warning names the new
+    /// location. A configuration carrying both forms is rejected so a
+    /// half-edited file fails loudly instead of one form silently winning.
+    ///
+    /// The deprecated key is held to the same passphrase rules as the new
+    /// `[ec.hmac]` block. Validation runs before this migration and the
+    /// deprecated field carries no check of its own, so without the check here
+    /// a short or empty passphrase in the old location would start a
+    /// deployment that the new location rejects.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`TrustedServerError::Configuration`] when both the deprecated
+    /// key and any part of the module configuration are present, or when the
+    /// deprecated passphrase fails [`Self::validate_passphrase`].
+    pub fn migrate_legacy_ec_layout(&mut self) -> Result<(), Report<TrustedServerError>> {
+        let Some(passphrase) = self.passphrase.take() else {
+            return Ok(());
+        };
+        if self.module.is_some() || !self.module_blocks.is_empty() {
+            return Err(Report::new(TrustedServerError::Configuration {
+                message: "[ec] passphrase (deprecated) and the [ec] module configuration \
+                          are both present. Keep exactly one form, moving the passphrase to \
+                          [ec.hmac] and deleting the old key"
+                    .to_owned(),
+            }));
+        }
+        Self::validate_passphrase(&passphrase).map_err(|err| {
+            Report::new(TrustedServerError::Configuration {
+                message: format!(
+                    "[ec] passphrase (deprecated) is invalid ({err}). Use a random secret \
+                     of at least {} bytes, placed in [ec.hmac]",
+                    Self::MIN_PASSPHRASE_LENGTH,
+                ),
+            })
+        })?;
+        log::warn!(
+            "[ec] passphrase is deprecated. Move it to [ec.hmac] passphrase and set \
+             [ec] module = \"hmac\""
+        );
+        self.module = Some(EcModuleSelection::from(HMAC_MODULE_KEY));
+        self.module_blocks.insert(
+            HMAC_MODULE_KEY.to_owned(),
+            EcModuleBlock::from(HmacModuleConfig { passphrase }),
+        );
+        Ok(())
+    }
+}
+
+impl Validate for Ec {
+    /// Validates the partner entries and the settings of every block that
+    /// configures the built-in HMAC module.
+    ///
+    /// Written out rather than derived because each block's errors are keyed
+    /// by the name the operator wrote the block under, so a passphrase
+    /// `[ec.primary]` rejects is reported at `ec.primary.passphrase`. A
+    /// derived nested validation would key them under this struct's own field
+    /// name, which is a path no configuration has.
+    fn validate(&self) -> Result<(), ValidationErrors> {
+        let mut errors = ValidationErrors::new();
+        errors.merge_self("partners", self.partners.validate());
+        for (name, config) in self.module_blocks.hmac_blocks() {
+            if let Err(block_errors) = config.validate() {
+                errors.errors_mut().insert(
+                    Cow::Owned(name.to_owned()),
+                    ValidationErrorsKind::Struct(Box::new(block_errors)),
+                );
+            }
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(errors)
+        }
+    }
+}
+
+/// The keys the `[ec]` section reads as its own settings.
+///
+/// Every other key in the section is one module's `[ec.<name>]` settings
+/// table, so these names are reserved and cannot name a module. They are
+/// written out because serde reads the [`Ec`] fields by name and has no way to
+/// report the list back for an error message.
+const EC_SECTION_KEYS: &[&str] = &[
+    "module",
+    "passphrase",
+    "ec_store",
+    "pull_sync_concurrency",
+    "cluster_trust_threshold",
+    "cluster_recheck_secs",
+    "partners",
+];
+
+/// The removed table that used to hold every module's settings.
+const REMOVED_EC_PROVIDERS_TABLE: &str = "providers";
+
+/// The key in a module block that names the implementation it configures.
+///
+/// Anything reading a module block out of a serialized configuration rather
+/// than out of [`EcModuleBlock`] reads the same key from here, so the two
+/// cannot drift apart.
+pub(crate) const MODULE_IMPLEMENTATION_KEY: &str = "implementation";
+
+/// The `[ec.<name>]` settings tables of the Edge Cookie identity modules,
+/// keyed by the name each is written under.
+///
+/// A module that has settings is configured in its own table, for example:
+///
+/// ```toml
+/// [ec]
+/// module = "hmac"
+///
+/// [ec.hmac]
+/// passphrase = "replace-with-32-plus-byte-random-secret"
+/// ```
+///
+/// A table may name the implementation it configures, which makes its own name
+/// a label of the operator's choosing, so the same configuration can also be
+/// written as:
+///
+/// ```toml
+/// [ec]
+/// module = "primary"
+///
+/// [ec.primary]
+/// implementation = "hmac"
+/// passphrase = "replace-with-32-plus-byte-random-secret"
+/// ```
+///
+/// The active module is chosen by the [`Ec::module`] selector, and the one
+/// table present must be the one it names (see
+/// [`Ec::validate_module_selection`]).
+#[derive(Debug, Default, Clone, Serialize)]
+#[serde(transparent)]
+pub struct EcModuleBlocks(BTreeMap<String, EcModuleBlock>);
+
+impl EcModuleBlocks {
+    /// The implementation the module `name` resolves to.
+    ///
+    /// A block may name the implementation it configures. Without one, and
+    /// when the module has no block at all, the module's name is its
+    /// implementation.
+    #[must_use]
+    pub fn implementation<'a>(&'a self, name: &'a str) -> &'a str {
+        self.0
+            .get(name)
+            .and_then(|block| block.implementation.as_deref())
+            .unwrap_or(name)
+    }
+
+    /// Every configured block that sets the built-in HMAC module up, with
+    /// the name it is written under.
+    ///
+    /// The name is the label the operator chose, so a caller reporting one of
+    /// these settings names the path the operator wrote rather than the
+    /// implementation's own.
+    pub fn hmac_blocks(&self) -> impl Iterator<Item = (&str, &HmacModuleConfig)> {
+        self.0
+            .iter()
+            .filter_map(|(name, block)| block.hmac_settings().map(|config| (name.as_str(), config)))
+    }
+}
+
+impl Deref for EcModuleBlocks {
+    type Target = BTreeMap<String, EcModuleBlock>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl DerefMut for EcModuleBlocks {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+impl<'de> Deserialize<'de> for EcModuleBlocks {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        struct BlocksVisitor;
+
+        impl<'de> serde::de::Visitor<'de> for BlocksVisitor {
+            type Value = EcModuleBlocks;
+
+            fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                formatter.write_str("the `[ec.<name>]` module settings tables")
+            }
+
+            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
+            where
+                A: serde::de::MapAccess<'de>,
+            {
+                let mut blocks = BTreeMap::new();
+                while let Some(name) = map.next_key::<String>()? {
+                    let table = map.next_value::<JsonValue>()?;
+                    blocks.insert(name.clone(), read_module_block::<A::Error>(&name, table)?);
+                }
+                Ok(EcModuleBlocks(blocks))
+            }
+        }
+
+        deserializer.deserialize_map(BlocksVisitor)
+    }
+}
+
+/// Reads one key left over from the `[ec]` section as the module block it
+/// names.
+///
+/// This is where the `[ec]` section gets the unknown-key check that the fixed
+/// fields lose by holding the module blocks alongside them. A key that is
+/// not a table cannot be a module, so it is reported as the mistyped setting
+/// it almost certainly is.
+fn read_module_block<E>(name: &str, table: JsonValue) -> Result<EcModuleBlock, E>
+where
+    E: serde::de::Error,
+{
+    if name == REMOVED_EC_PROVIDERS_TABLE {
+        return Err(E::custom(
+            "[ec.providers] is no longer read. Each module's settings moved to a table of \
+             its own under [ec], so a block written as [ec.providers.hmac] is now [ec.hmac]",
+        ));
+    }
+    let JsonValue::Object(mut table) = table else {
+        let known = EC_SECTION_KEYS
+            .iter()
+            .map(|key| format!("`{key}`"))
+            .collect::<Vec<_>>()
+            .join(", ");
+        return Err(E::custom(format!(
+            "unknown field `{name}`, expected one of {known}, or an [ec.<name>] module \
+             settings table"
+        )));
+    };
+    let implementation = match table.remove(MODULE_IMPLEMENTATION_KEY) {
+        None => None,
+        Some(JsonValue::String(implementation)) => Some(implementation),
+        Some(_) => {
+            return Err(E::custom(format!(
+                "`implementation` in [ec.{name}] must be a string naming the module \
+                 implementation the block configures"
+            )));
+        }
+    };
+
+    // The implementation decides how the rest of the table is read. Core reads
+    // its own modules' settings here, so a mistyped key fails where the
+    // configuration is read rather than at the request that needed it, and
+    // keeps the settings of a module an adapter injects as the raw values
+    // that adapter deserializes for itself.
+    let settings = if implementation.as_deref().unwrap_or(name) == HMAC_MODULE_KEY {
+        let config = serde_json::from_value(JsonValue::Object(table))
+            .map_err(|err| E::custom(format!("[ec.{name}] is invalid ({err})")))?;
+        EcModuleSettings::Hmac(config)
+    } else {
+        EcModuleSettings::Injected(table)
+    };
+    Ok(EcModuleBlock {
+        implementation,
+        settings,
+    })
+}
+
+/// One module's `[ec.<name>]` settings table.
+#[derive(Debug, Clone, Serialize)]
+pub struct EcModuleBlock {
+    /// The implementation this block configures, written as
+    /// `implementation = "<id>"`, when the block's own name is not it.
+    ///
+    /// Setting it makes the block name a label of the operator's choosing, so
+    /// one implementation can be configured under any name. Everything that
+    /// resolves the selected module reads the implementation rather than the
+    /// label.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub implementation: Option<String>,
+
+    /// Everything the block holds other than `implementation`.
+    #[serde(flatten)]
+    pub settings: EcModuleSettings,
+}
+
+impl EcModuleBlock {
+    /// The built-in HMAC module's settings, when this block configures it.
+    #[must_use]
+    pub fn hmac_settings(&self) -> Option<&HmacModuleConfig> {
+        match &self.settings {
+            EcModuleSettings::Hmac(config) => Some(config),
+            EcModuleSettings::Injected(_) => None,
+        }
+    }
+}
+
+impl From<HmacModuleConfig> for EcModuleBlock {
+    /// Builds the `[ec.hmac]` block, the built-in HMAC module configured
+    /// under its own name. A block under a label names its implementation
+    /// instead.
+    fn from(config: HmacModuleConfig) -> Self {
+        Self {
+            implementation: None,
+            settings: EcModuleSettings::Hmac(config),
+        }
+    }
+}
+
+/// The settings one module block holds, read according to the
+/// implementation the block configures.
+#[derive(Debug, Clone, Serialize)]
+#[serde(untagged)]
+pub enum EcModuleSettings {
+    /// The built-in HMAC module's settings.
+    Hmac(HmacModuleConfig),
+
+    /// The settings of a module an adapter injects, kept as the raw values
+    /// the block held. The adapter that builds the module deserializes them
+    /// into the vendor crate's own config type, so core never names a vendor
+    /// and a new module adds nothing here.
+    Injected(serde_json::Map<String, JsonValue>),
+}
+
+/// Configuration for the built-in HMAC Edge Cookie module.
+///
+/// Mapped from the `[ec.hmac]` TOML block, or from a block under a label whose
+/// `implementation` is `hmac`. Unknown keys are rejected, so a mistyped
+/// setting fails at startup instead of being accepted silently and leaving the
+/// intended setting at its default.
+#[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
+#[serde(deny_unknown_fields)]
+pub struct HmacModuleConfig {
+    /// Publisher passphrase used as the HMAC key for EC generation.
+    #[validate(custom(function = Ec::validate_passphrase))]
+    pub passphrase: Redacted<String>,
 }
 
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
@@ -3012,6 +3521,8 @@ impl Settings {
             })
         })?;
 
+        settings.ec.migrate_legacy_ec_layout()?;
+        settings.ec.validate_module_selection()?;
         settings.validate_admin_coverage()?;
         settings.validate_admin_handler_passwords()?;
 
@@ -3096,8 +3607,10 @@ impl Settings {
     pub fn reject_placeholder_secrets(&self) -> Result<(), Report<TrustedServerError>> {
         let mut insecure_fields: Vec<String> = Vec::new();
 
-        if Ec::is_placeholder_passphrase(self.ec.passphrase.expose()) {
-            insecure_fields.push("ec.passphrase".to_owned());
+        for (name, hmac) in self.ec.module_blocks.hmac_blocks() {
+            if Ec::is_placeholder_passphrase(hmac.passphrase.expose()) {
+                insecure_fields.push(format!("ec.{name}.passphrase"));
+            }
         }
         if Publisher::is_placeholder_proxy_secret(self.publisher.proxy_secret.expose()) {
             insecure_fields.push("publisher.proxy_secret".to_owned());
@@ -3781,7 +4294,10 @@ mod tests {
         prebid::PrebidIntegrationConfig,
     };
     use crate::redacted::Redacted;
-    use crate::test_support::tests::{crate_test_settings_str, create_test_settings};
+    use crate::test_support::tests::{
+        crate_test_settings_str, crate_test_settings_str_with_ec_section, create_test_settings,
+        hmac_passphrase, select_hmac_module,
+    };
 
     fn trusted_client_ip_toml(ip_header: &str, auth_header: &str, shared_secret: &str) -> String {
         format!(
@@ -3931,7 +4447,7 @@ mod tests {
         let mut settings = create_test_settings();
 
         settings.publisher.proxy_secret = Redacted::new(CANARY_PROXY_SECRET.to_string());
-        settings.ec.passphrase = Redacted::new(CANARY_EC_PASSPHRASE.to_string());
+        select_hmac_module(&mut settings.ec, HMAC_MODULE_KEY, CANARY_EC_PASSPHRASE);
 
         settings.handlers = vec![Handler {
             path: "^/secure".to_string(),
@@ -4013,7 +4529,7 @@ mod tests {
 
         let canaries = [
             ("publisher.proxy_secret", CANARY_PROXY_SECRET),
-            ("ec.passphrase", CANARY_EC_PASSPHRASE),
+            ("ec.hmac.passphrase", CANARY_EC_PASSPHRASE),
             ("handlers[].username", CANARY_HANDLER_USERNAME),
             ("handlers[].password", CANARY_HANDLER_PASSWORD),
             ("ec.partners[].api_token", CANARY_EC_PARTNER_API_TOKEN),
@@ -4798,7 +5314,12 @@ mod tests {
         );
         assert_eq!(settings.publisher.origin_host_header_override, None);
         assert_eq!(
-            settings.ec.passphrase.expose(),
+            settings.ec.module.as_ref(),
+            Some(&EcModuleSelection::from(HMAC_MODULE_KEY)),
+            "test settings should select the hmac EC module"
+        );
+        assert_eq!(
+            hmac_passphrase(&settings.ec, HMAC_MODULE_KEY),
             "test-secret-key-32-bytes-minimum"
         );
 
@@ -4967,6 +5488,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn module_selection_allows_no_module_for_stateless_operation() {
+        let ec = Ec::default();
+        assert!(ec.module.is_none(), "default Ec selects no module");
+        ec.validate_module_selection()
+            .expect("should allow no module selected and run statelessly");
+    }
+
+    #[test]
+    fn selecting_an_implementation_that_needs_settings_without_its_block_is_rejected() {
+        // The built-in HMAC module has a required passphrase, so selecting
+        // it with no `[ec.hmac]` block is a deployment that would run
+        // stateless under a selector saying otherwise.
+        let toml_str = crate_test_settings_str_with_ec_section("[ec]\nmodule = \"hmac\"\n");
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("an implementation with no settings block should fail at startup");
+        assert!(
+            format!("{err:?}").contains("`hmac` is selected but has no `[ec.hmac]` configuration"),
+            "should name the missing block: {err:?}"
+        );
+    }
+
+    #[test]
+    fn selecting_a_module_with_no_settings_needs_no_block() {
+        // A block exists only when a module has settings, and only the
+        // adapter that injects a module knows whether it has any, so a
+        // selector naming one core does not supply is left to
+        // `build_module`, which is where the injected modules are known.
+        let toml_str = crate_test_settings_str_with_ec_section("[ec]\nmodule = \"acme\"\n");
+
+        let settings =
+            Settings::from_toml(&toml_str).expect("a module with no settings should need no block");
+        assert!(
+            settings.ec.module_blocks.is_empty(),
+            "the selection should stand on its own with no block configured"
+        );
+    }
+
     #[test]
     fn cache_asset_rule_globs_respect_path_separators() {
         let toml_str = format!(
@@ -5073,6 +5633,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn module_blocks_without_a_selector_are_rejected() {
+        // A half-migrated configuration that carries an [ec.hmac] block but
+        // never selects it would silently run stateless, so it is rejected at
+        // startup instead.
+        let toml_str = crate_test_settings_str().replace("module = \"hmac\"\n", "");
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a module block with no selector should fail at startup");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
     #[test]
     fn cache_asset_rule_policy_validation_rejects_unsafe_config() {
         let missing_ttl = format!(
@@ -5186,6 +5765,78 @@ mod tests {
         );
     }
 
+    #[test]
+    fn legacy_passphrase_migrates_to_the_hmac_module() {
+        let mut ec = Ec {
+            passphrase: Some(Redacted::new("test-secret-key-32-bytes-minimum".to_owned())),
+            ..Ec::default()
+        };
+        ec.migrate_legacy_ec_layout()
+            .expect("should migrate the deprecated form");
+        assert_eq!(
+            ec.module.as_ref(),
+            Some(&EcModuleSelection::from(HMAC_MODULE_KEY)),
+            "the deprecated passphrase should select the hmac module"
+        );
+        assert_eq!(
+            hmac_passphrase(&ec, HMAC_MODULE_KEY),
+            "test-secret-key-32-bytes-minimum",
+            "the passphrase should move into the hmac block"
+        );
+        assert!(
+            ec.passphrase.is_none(),
+            "the deprecated field should be consumed by the migration"
+        );
+    }
+
+    /// The crate test configuration with its `[ec]` section rewritten to the
+    /// deprecated single-passphrase form.
+    fn legacy_ec_settings_str(passphrase: &str) -> String {
+        let legacy = crate_test_settings_str_with_ec_section(&format!(
+            "[ec]\npassphrase = \"{passphrase}\"\n"
+        ));
+        assert!(
+            !legacy.contains("[ec.hmac]"),
+            "the legacy configuration should carry no module block"
+        );
+        legacy
+    }
+
+    #[test]
+    fn a_legacy_passphrase_is_held_to_the_passphrase_rules() {
+        // Validation runs before the migration and the deprecated field
+        // carries no check of its own, so the migration itself has to apply
+        // the passphrase rules. Without that, a value the new `[ec.hmac]`
+        // block rejects would still start a deployment from the old location.
+        let short = Settings::from_toml(&legacy_ec_settings_str("short"))
+            .expect_err("a short legacy passphrase should be rejected");
+        assert!(
+            format!("{short:?}").contains("passphrase (deprecated) is invalid"),
+            "should name the deprecated passphrase as the fault: {short:?}"
+        );
+
+        let empty = Settings::from_toml(&legacy_ec_settings_str(""))
+            .expect_err("an empty legacy passphrase should be rejected");
+        assert!(
+            format!("{empty:?}").contains("passphrase (deprecated) is invalid"),
+            "should name the deprecated passphrase as the fault: {empty:?}"
+        );
+
+        let settings =
+            Settings::from_toml(&legacy_ec_settings_str("test-secret-key-32-bytes-minimum"))
+                .expect("a legacy passphrase of adequate length should still start");
+        assert_eq!(
+            settings.ec.module.as_ref(),
+            Some(&EcModuleSelection::from(HMAC_MODULE_KEY)),
+            "an adequate legacy passphrase should still select the hmac module"
+        );
+        assert_eq!(
+            hmac_passphrase(&settings.ec, HMAC_MODULE_KEY),
+            "test-secret-key-32-bytes-minimum",
+            "an adequate legacy passphrase should still move into the hmac block"
+        );
+    }
+
     #[test]
     fn cache_asset_rule_validation_rejects_invalid_config() {
         let duplicate_ids = format!(
@@ -5263,6 +5914,287 @@ mod tests {
         );
     }
 
+    #[test]
+    fn legacy_passphrase_alongside_module_config_is_rejected() {
+        let mut ec = Ec {
+            passphrase: Some(Redacted::new("test-secret-key-32-bytes-minimum".to_owned())),
+            module: Some(EcModuleSelection::from(HMAC_MODULE_KEY)),
+            ..Ec::default()
+        };
+        let err = ec
+            .migrate_legacy_ec_layout()
+            .expect_err("both forms present should be rejected");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
+    #[test]
+    fn an_unknown_key_in_the_hmac_module_block_is_rejected() {
+        // A mistyped key dropped silently would leave the setting the
+        // operator meant to change at its default.
+        let toml_str = crate_test_settings_str().replace(
+            "passphrase = \"test-secret-key-32-bytes-minimum\"",
+            "passphrase = \"test-secret-key-32-bytes-minimum\"\n            typo_key = \"x\"",
+        );
+        assert!(
+            toml_str.contains("typo_key"),
+            "the test configuration should carry the unknown key"
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("an unknown key in [ec.hmac] should be rejected");
+        assert!(
+            format!("{err:?}").contains("typo_key"),
+            "should name the unknown key: {err:?}"
+        );
+    }
+
+    #[test]
+    fn module_none_is_explicit_stateless() {
+        let ec = Ec {
+            module: Some(EcModuleSelection::None),
+            ..Ec::default()
+        };
+        ec.validate_module_selection()
+            .expect("explicit none with no blocks should be valid");
+    }
+
+    #[test]
+    fn module_none_with_configured_blocks_is_rejected() {
+        let mut ec = Ec::default();
+        select_hmac_module(&mut ec, HMAC_MODULE_KEY, "test-secret-key-32-bytes-minimum");
+        ec.module = Some(EcModuleSelection::None);
+        assert!(
+            ec.validate_module_selection().is_err(),
+            "none alongside configured blocks should be rejected"
+        );
+    }
+
+    #[test]
+    fn an_unselected_module_block_is_rejected() {
+        // A vendor selector with the vendor block present, plus a stray hmac
+        // block, is almost always a stale or mistyped configuration.
+        let toml_str = crate_test_settings_str().replace(
+            "module = \"hmac\"",
+            "module = \"acme\"\n\n            [ec.acme]\n            api_key = \"example\"",
+        );
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a configured but unselected block should fail at startup");
+        assert!(
+            matches!(
+                err.current_context(),
+                TrustedServerError::Configuration { .. }
+            ),
+            "should be a configuration error, got: {:?}",
+            err.current_context()
+        );
+    }
+
+    #[test]
+    fn a_labeled_block_the_selector_does_not_name_is_rejected() {
+        // A block under a label is still a module block, so it is held to
+        // the rule every block is held to, which is that the selector names
+        // it.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            r#"[ec]
+module = "hmac"
+
+[ec.hmac]
+passphrase = "test-secret-key-32-bytes-minimum"
+
+[ec.primary]
+implementation = "hmac"
+passphrase = "another-test-secret-key-32-bytes"
+"#,
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("a labeled block the selector does not name should fail at startup");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("[ec.primary] is configured but `hmac` is selected"),
+            "should name the unselected labeled block, got: {message}"
+        );
+    }
+
+    #[test]
+    fn the_removed_providers_table_is_rejected_with_its_new_location() {
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"hmac\"\n\n[ec.providers.hmac]\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("the removed [ec.providers] table should be rejected");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("[ec.providers] is no longer read") && message.contains("[ec.hmac]"),
+            "should send the operator to the new location, got: {message}"
+        );
+    }
+
+    #[test]
+    fn a_key_under_ec_that_is_not_a_table_is_an_unknown_field() {
+        // Holding the module blocks alongside the fixed keys costs the
+        // section serde's own unknown-key check, so a mistyped setting has to
+        // be caught where the blocks are read.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"hmac\"\nec_stor = \"ec_identity_store\"\n\n[ec.hmac]\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        );
+
+        let err =
+            Settings::from_toml(&toml_str).expect_err("a mistyped [ec] key should be rejected");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("unknown field `ec_stor`") && message.contains("`ec_store`"),
+            "should name the mistyped key and the keys it could have been, got: {message}"
+        );
+    }
+
+    #[test]
+    fn the_reserved_ec_keys_are_the_ones_the_section_reads() {
+        // The list is written out for the unknown-field message and the
+        // reserved-name check, so it has to stay level with the struct.
+        let ec = Ec {
+            passphrase: Some(Redacted::new("test-secret-key-32-bytes-minimum".to_owned())),
+            ..Ec::default()
+        };
+        let value = serde_json::to_value(&ec).expect("should serialize the [ec] section");
+        let written = value
+            .as_object()
+            .expect("the section should serialize as a table")
+            .keys()
+            .map(String::as_str)
+            .collect::<HashSet<_>>();
+
+        assert_eq!(
+            written,
+            EC_SECTION_KEYS.iter().copied().collect::<HashSet<_>>(),
+            "EC_SECTION_KEYS should name every key the [ec] section reads as its own"
+        );
+    }
+
+    #[test]
+    fn a_reserved_key_cannot_name_a_module() {
+        let toml_str = crate_test_settings_str_with_ec_section("[ec]\nmodule = \"ec_store\"\n");
+
+        let err =
+            Settings::from_toml(&toml_str).expect_err("a reserved key should not name a module");
+        assert!(
+            format!("{err:?}").contains("names a key the `[ec]` section reads as its own setting"),
+            "should say why the name cannot be used: {err:?}"
+        );
+    }
+
+    #[test]
+    fn module_names_and_implementations_follow_the_module_name_rule() {
+        for ec_section in [
+            "[ec]\nmodule = \"Primary\"\n",
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"Hmac\"\n",
+            "[ec]\nmodule = \"primary\"\n\n[ec.Primary]\nimplementation = \"hmac\"\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        ] {
+            let err = Settings::from_toml(&crate_test_settings_str_with_ec_section(ec_section))
+                .expect_err("a name that is not a module name should be rejected");
+            assert!(
+                format!("{err:?}").contains("is not a module name"),
+                "should hold `{ec_section}` to the module name rule: {err:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_hmac_block_without_its_passphrase_names_the_block() {
+        // The implementation the block names decides how its settings are
+        // read, so the block the operator wrote is what the error names.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"hmac\"\n",
+        );
+
+        let err = Settings::from_toml(&toml_str)
+            .expect_err("an hmac block without its passphrase should be rejected");
+        let message = format!("{err:?}");
+        assert!(
+            message.contains("[ec.primary] is invalid") && message.contains("passphrase"),
+            "should name the block and the setting it lacks, got: {message}"
+        );
+    }
+
+    #[test]
+    fn a_labeled_block_round_trips_through_serialization() {
+        // The pushed configuration is the serialized settings, so a label and
+        // the implementation it names have to survive being written back.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"primary\"\n\n[ec.primary]\nimplementation = \"hmac\"\npassphrase = \"test-secret-key-32-bytes-minimum\"\n",
+        );
+        let settings = Settings::from_toml(&toml_str).expect("should parse a labeled module block");
+
+        let value = serde_json::to_value(&settings).expect("should serialize settings");
+        assert_eq!(
+            value["ec"]["primary"]["implementation"], "hmac",
+            "the label should keep the implementation it names"
+        );
+
+        let reparsed =
+            Settings::from_json_value(value).expect("should reparse the serialized settings");
+        assert_eq!(
+            reparsed.ec.module_blocks.implementation("primary"),
+            HMAC_MODULE_KEY,
+            "the implementation should survive the round trip"
+        );
+        assert_eq!(
+            hmac_passphrase(&reparsed.ec, "primary"),
+            "test-secret-key-32-bytes-minimum"
+        );
+
+        // A block under the implementation's own name is written back as it
+        // was, without gaining a key the operator never wrote.
+        let written = serde_json::to_value(create_test_settings())
+            .expect("should serialize the test settings");
+        assert!(
+            written["ec"]["hmac"].get("implementation").is_none(),
+            "an unlabeled block should not gain an implementation key: {}",
+            written["ec"]["hmac"]
+        );
+    }
+
+    #[test]
+    fn an_injected_modules_settings_are_kept_as_written() {
+        // Core never names a vendor, so the block of a module an adapter
+        // injects is kept as the values it held for that adapter to read.
+        let toml_str = crate_test_settings_str_with_ec_section(
+            "[ec]\nmodule = \"acme\"\n\n[ec.acme]\nendpoint = \"https://ec.acme.example.com\"\n",
+        );
+        let settings = Settings::from_toml(&toml_str).expect("should parse a vendor module block");
+
+        let block = settings
+            .ec
+            .module_blocks
+            .get("acme")
+            .expect("should configure the acme block");
+        assert_eq!(
+            settings.ec.module_blocks.implementation("acme"),
+            "acme",
+            "a block that names no implementation is its own name's"
+        );
+        let EcModuleSettings::Injected(injected) = &block.settings else {
+            panic!("a vendor block should keep its settings as the raw values it held");
+        };
+        assert_eq!(injected["endpoint"], "https://ec.acme.example.com");
+
+        // They survive being written back into the pushed configuration, so
+        // the adapter reads what the operator wrote.
+        let written = serde_json::to_value(&settings).expect("should serialize settings");
+        assert_eq!(
+            written["ec"]["acme"]["endpoint"],
+            "https://ec.acme.example.com"
+        );
+    }
+
     #[test]
     fn validate_rejects_trailing_slash_in_origin_url() {
         let toml_str = crate_test_settings_str().replace(
@@ -5675,7 +6607,11 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
+        select_hmac_module(
+            &mut settings.ec,
+            HMAC_MODULE_KEY,
+            "test-secret-key-32-bytes-minimum",
+        );
         settings.handlers[0].password =
             Redacted::new("replace-with-admin-password-32-bytes".to_owned());
 
@@ -5714,7 +6650,6 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
         settings.ec.partners = vec![test_partner_with_pull_token(
             "partner-api-token-32-bytes-minimum",
         )];
@@ -5733,7 +6668,6 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
         settings.ec.partners = vec![test_partner_with_pull_token(
             "unit-test-realistic-pull-sync-token-32-bytes-min",
         )];
@@ -5748,7 +6682,6 @@ source_domain = "partner.example.com"
         let mut settings =
             Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings");
         settings.publisher.proxy_secret = Redacted::new("unit-test-proxy-secret".to_owned());
-        settings.ec.passphrase = Redacted::new("test-secret-key-32-bytes-minimum".to_owned());
         settings.ec.partners = vec![test_partner_with_tokens(
             Some("partner-api-token-32-bytes-minimum"),
             "replace-with-partner-api-token-32-bytes-minimum",
@@ -6313,6 +7246,9 @@ source_domain = "partner.example.com"
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -6344,6 +7280,9 @@ source_domain = "partner.example.com"
             max_buffered_body_bytes = 0
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         );
@@ -7475,6 +8414,9 @@ source_domain = "partner.example.com"
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -7810,6 +8752,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -7894,6 +8839,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -7930,6 +8878,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
@@ -7972,6 +8923,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "secret"
 
 [ec]
+module = "hmac"
+
+[ec.hmac]
 passphrase = "test-secret-key-32-bytes-minimum"
 
 [creative_opportunities]
diff --git a/crates/trusted-server-core/src/test_support.rs b/crates/trusted-server-core/src/test_support.rs
index d6e85a167..34c032d47 100644
--- a/crates/trusted-server-core/src/test_support.rs
+++ b/crates/trusted-server-core/src/test_support.rs
@@ -1,6 +1,8 @@
 #[cfg(test)]
 pub mod tests {
-    use crate::settings::Settings;
+    use crate::ec::module::{EcModuleSelection, HMAC_MODULE_KEY};
+    use crate::redacted::Redacted;
+    use crate::settings::{Ec, EcModuleBlock, HmacModuleConfig, Settings};
 
     #[must_use]
     pub fn crate_test_settings_str() -> String {
@@ -33,7 +35,11 @@ pub mod tests {
             rewrite_attributes = ["href", "link", "url"]
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
+
             [request_signing]
             config_store_id = "test-config-store-id"
             secret_store_id = "test-secret-store-id"
@@ -41,6 +47,26 @@ pub mod tests {
         .to_owned()
     }
 
+    /// The crate test configuration with its whole `[ec]` section replaced by
+    /// `ec_section`, which carries its own `[ec]` header and any module
+    /// blocks.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the embedded TOML configuration no longer has an `[ec]`
+    /// section followed by a `[request_signing]` section.
+    #[must_use]
+    pub fn crate_test_settings_str_with_ec_section(ec_section: &str) -> String {
+        let base = crate_test_settings_str();
+        let (before, rest) = base
+            .split_once("[ec]")
+            .expect("should find the [ec] section in the test settings");
+        let (_, after) = rest
+            .split_once("[request_signing]")
+            .expect("should find the [request_signing] section in the test settings");
+        format!("{before}{ec_section}\n\n[request_signing]{after}")
+    }
+
     #[must_use]
     /// Creates test settings from embedded TOML configuration.
     ///
@@ -54,6 +80,39 @@ pub mod tests {
         settings
     }
 
+    /// Selects the built-in HMAC module under `name` with `passphrase`,
+    /// replacing whatever Edge Cookie module the settings carried.
+    ///
+    /// A `name` other than `hmac` is a label, so the block names the
+    /// implementation it configures.
+    pub fn select_hmac_module(ec: &mut Ec, name: &str, passphrase: &str) {
+        let mut block = EcModuleBlock::from(HmacModuleConfig {
+            passphrase: Redacted::new(passphrase.to_owned()),
+        });
+        if name != HMAC_MODULE_KEY {
+            block.implementation = Some(HMAC_MODULE_KEY.to_owned());
+        }
+        ec.module = Some(EcModuleSelection::from(name));
+        ec.module_blocks.clear();
+        ec.module_blocks.insert(name.to_owned(), block);
+    }
+
+    /// The passphrase the block `name` holds.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `name` has no block, or if its block configures another
+    /// module.
+    #[must_use]
+    pub fn hmac_passphrase<'a>(ec: &'a Ec, name: &str) -> &'a str {
+        ec.module_blocks
+            .get(name)
+            .and_then(EcModuleBlock::hmac_settings)
+            .unwrap_or_else(|| panic!("settings should configure the hmac module under `{name}`"))
+            .passphrase
+            .expose()
+    }
+
     /// A valid EC ID in `{64-hex}.{6-alnum}` format for use in tests.
     pub const VALID_SYNTHETIC_ID: &str =
         "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.Ab1234";
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index c3d9ff53d..743fc25ea 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -10,10 +10,13 @@ origin_url = "http://127.0.0.1:8888"
 proxy_secret = "integration_proxy_secret"
 
 [ec]
-passphrase = "integration_ec_passphrase"
+module = "hmac"
 ec_store = "ec_identity_store"
 pull_sync_concurrency = 3
 
+[ec.hmac]
+passphrase = "integration_ec_passphrase"
+
 [[ec.partners]]
 name = "Integration Test Partner"
 source_domain = "inttest.example.com"
diff --git a/crates/trusted-server-integration-tests/tests/parity.rs b/crates/trusted-server-integration-tests/tests/parity.rs
index 2428d7799..88444913a 100644
--- a/crates/trusted-server-integration-tests/tests/parity.rs
+++ b/crates/trusted-server-integration-tests/tests/parity.rs
@@ -46,6 +46,9 @@ fn test_settings() -> Settings {
             proxy_secret = "parity-test-proxy-secret"
 
             [ec]
+            module = "hmac"
+
+            [ec.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
diff --git a/docs/guide/api-reference.md b/docs/guide/api-reference.md
index e444ec147..4861443b4 100644
--- a/docs/guide/api-reference.md
+++ b/docs/guide/api-reference.md
@@ -862,13 +862,13 @@ The examples below use fictional IDs and values only.
 
 ### GET /\_ts/admin/ec/`{id}`
 
-Reads an EC identity-graph record for troubleshooting. The explicit route accepts an EC ID in `{64 lowercase hex}.{6 alphanumeric}` format. The bare route uses the request's `ts-ec` cookie.
+Reads an EC identity-graph record for troubleshooting. The explicit route accepts an EC ID created by the module this deployment selects, such as the built-in HMAC module's `hmac~{64 hex}.{6 alphanumeric}` form. The built-in HMAC module also still reads the bare legacy `{64 hex}.{6 alphanumeric}` form, and a deployment with no module selected accepts both of those forms. The bare route uses the request's `ts-ec` cookie.
 
 This lookup is implemented only by the Fastly adapter because the identity graph is stored in Fastly KV. Other adapters return `501 Not Implemented`.
 
 **Response fields:**
 
-- `ec_id`, `store`, and `generation` identify the raw KV lookup.
+- `ec_id` is the EC ID as requested, and `kv_key` is the identity-graph key the record was read from. The key is `ec_id` in the normalized form the identity graph stores, which is the same string as `ec_id` for an identifier the built-in HMAC module issued. `store` and `generation` identify the raw KV lookup.
 - `entry` preserves the stored JSON shape, including unknown and legacy fields. Derived `created_iso` and `consent.updated_iso` fields are added only when absent.
 - `metadata` preserves the stored metadata JSON shape.
 - `tombstone` reports whether consent has been withdrawn. It is absent when the entry body cannot be parsed as JSON or deserialized as the typed EC schema.
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index e841515ae..0a7c5add6 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -6,10 +6,13 @@
 # `trusted-server.toml`. Copy it (`ts config init`), fill in the required
 # values, and push it (`ts config push`) as an EdgeZero app-config blob.
 #
-# Only three sections are REQUIRED for the server to start and pass validation:
+# Only two sections are REQUIRED for the server to start and pass validation:
 #   1. [[handlers]] covering /_ts/admin  (admin authentication)
 #   2. [publisher]                       (domain + origin)
-#   3. [ec] passphrase                   (Edge Cookie identity secret)
+#
+# Edge Cookie identity is optional and stays off until an [ec] module is
+# selected, so no identity secret is needed to start. See the Edge Cookie
+# section below.
 #
 # Everything below those is OPTIONAL. Most optional blocks are commented out —
 # uncomment and edit one to enable it — but a few integrations are kept as active
@@ -70,11 +73,20 @@ proxy_secret = "publisher_proxy_secret"
 
 
 # -----------------------------------------------------------------------------
-# REQUIRED — Edge Cookie (EC) identity
+# OPTIONAL — Edge Cookie (EC) identity
 # -----------------------------------------------------------------------------
 [ec]
-# Secret Store key for the secret used to derive EC identifiers.
-passphrase = "ec_passphrase"
+# Edge Cookie identity is OFF by default. With no module selected, Trusted
+# Server runs statelessly and generates no Edge Cookie. Activate one by
+# uncommenting the selector below, together with that module's own
+# [ec.<name>] block when it has settings (a block the selector does not name
+# is rejected at startup). Deployment tooling can merge a
+# TRUSTED_SERVER__EC__MODULE environment value into the published
+# configuration before it is loaded, and the running server itself reads its
+# settings from the platform config store rather than the environment. The
+# built-in hmac module is host-neutral, and a vendor module ships in its
+# own crate that the adapter composes in.
+# module = "hmac"
 # KV store that persists EC identity state. This is the physical store name
 # bound per adapter (e.g. `ec_identity_store` in fastly.toml); edgezero.toml's
 # logical KV id is `trusted_server_kv`.
@@ -85,6 +97,25 @@ pull_sync_concurrency = 3
 # cluster_trust_threshold = 10    # entries with cluster_size <= this are individual users
 # cluster_recheck_secs = 3600     # re-evaluate cluster_size after this many seconds
 
+# Built-in HMAC module block. Uncomment it together with the
+# `module = "hmac"` selector above. `passphrase` names the Secret Store key
+# holding the secret used to derive EC identifiers. That secret must be
+# >= 32 bytes and non-placeholder in production. Provision referenced keys in
+# trusted_server_secrets before validating/pushing.
+# [ec.hmac]
+# passphrase = "ec_passphrase"
+
+# A block can name the implementation it configures, which makes the block's
+# own name a label of your choosing. The same module could therefore be
+# selected as `module = "primary"` and configured in the block below
+# instead, which is how a deployment gives a module a name that means
+# something to the people running it.
+# A module from a crate is named by its folder below crates/, and may be
+# written in full, as edgecookie.<name>, or with that type folder left off.
+# [ec.primary]
+# implementation = "hmac"
+# passphrase = "ec_passphrase"
+
 # Example partner configuration. Provision referenced keys in
 # trusted_server_secrets before validating/pushing.
 # [[ec.partners]]