diff --git a/.changeset/add-tracker-execution-contracts.md b/.changeset/add-tracker-execution-contracts.md
new file mode 100644
index 0000000000..0e06a2bdb9
--- /dev/null
+++ b/.changeset/add-tracker-execution-contracts.md
@@ -0,0 +1,9 @@
+---
+"adcontextprotocol": minor
+---
+
+Add format-scoped production tracker execution contracts for first-class pixel,
+VAST, and DAAST tracker assets. Pin effective commitments, execution versions,
+placement scope, and digests in immutable package format snapshots so buyers can
+distinguish supported, unsupported, and undeclared tracker behavior before
+spend without coupling the production promise to preview observation.
diff --git a/docs/contributing/x-entity-annotation.md b/docs/contributing/x-entity-annotation.md
index 75e7ef075d..79a5784f25 100644
--- a/docs/contributing/x-entity-annotation.md
+++ b/docs/contributing/x-entity-annotation.md
@@ -106,7 +106,7 @@ High-level groupings (see the registry for full descriptions). *Categories below
 | Brand & rights | `advertiser_brand`, `rights_holder_brand`, `rights_grant` |
 | Account & party | `account`, `operator` |
 | Media buy | `media_buy`, `package`, `product`, `proposal`, `product_pricing_option`, `spot_airing` |
-| Creative | `creative`, `creative_revision`, `creative_representation`, `macro_declaration`, `creative_locale_variant`, `creative_format`, `build_variant`, `served_variant` |
+| Creative | `creative`, `creative_revision`, `creative_representation`, `macro_declaration`, `tracker_execution_selector`, `creative_locale_variant`, `creative_format`, `build_variant`, `served_variant` |
 | Data & targeting | `audience`, `audience_evidence`, `audience_evidence_snapshot`, `signal`, `signal_activation_id`, `demographic_interval_id`, `event_source` |
 | Lists & catalogs | `collection_list`, `property_list`, `catalog`, `catalog_generation`, `catalog_item`, `property` |
 | Plans & governance | `media_plan`, `governance_plan`, `governance_registry_policy`, `governance_inline_policy`, `governance_check`, `governance_delivery_statement`, `governance_delivery_observation`, `governance_outcome`, `governance_adjustment`, `governance_adjustment_evidence`, `seller_adjustment`, `content_standards`, `task`, `attestation_credential` |
diff --git a/docs/creative/asset-types.mdx b/docs/creative/asset-types.mdx
index 90b4706ca2..e0ec4340f6 100644
--- a/docs/creative/asset-types.mdx
+++ b/docs/creative/asset-types.mdx
@@ -34,7 +34,7 @@ The full set of asset types valid in a v2 format `slots` declaration's `asset_ty
 | `zip` | Zip archive (HTML5 banner bundle) | `/schemas/core/assets/zip-asset.json` |
 | `vast_tracker` | Single VAST `Tracking` event URL (decomposed) | `/schemas/core/assets/vast-tracker-asset.json` |
 | `daast_tracker` | Single DAAST `Tracking` event URL (decomposed) | `/schemas/core/assets/daast-tracker-asset.json` |
-| `pixel_tracker` | Renderer-fired HTTP tracker (image pixel or JS include) for any web-rendered canonical. `event` (impression / viewable_mrc_* / viewable_video_50 / audible_video_complete / click / custom) × `method` (img / js). Maps to IAB OpenRTB Native 1.2 `imptrackers[]` / `jstracker` / `eventtrackers[]` / `link.clicktrackers[]` event-type registry (types 1, 2, 3, 4, 500) | `/schemas/core/assets/pixel-tracker-asset.json` |
+| `pixel_tracker` | Renderer-fired HTTP tracker (image pixel or JS include) for any web-rendered canonical. `event` (impression / viewable_mrc_* / viewable_video_50 / audible_video_complete / click / custom) × `method` (img / js). Maps to IAB OpenRTB Native 1.2 `imptrackers[]` / `jstracker` / `eventtrackers[]` / `link.clicktrackers[]`; standardized event types 1-4 are reused, while audible completion is an AdCP-defined event and `custom` can carry exchange/vendor extensions | `/schemas/core/assets/pixel-tracker-asset.json` |
 | `object` | Structured object (image_carousel `cards`, `video_brief` for generative video) — sub-shape declared by the canonical | (no standalone schema; per-canonical sub-shape) |
 
 In a v2 manifest's `assets` map, the **slot key** is the canonical's `asset_group_id` (e.g., `image_main`, `video_main`, `script`, `cards`, `landing_page_url`) and the **value** carries the matching asset payload with its `asset_type` discriminator. The format declaration's `slots[].asset_type` tells the validator which payload schema applies.
@@ -335,7 +335,7 @@ VAST (Video Ad Serving Template) tags for third-party video ad serving.
 - `tracking_events`: Array of supported tracking events. Valid values are defined by the [VAST Tracking Event](https://adcontextprotocol.org/schemas/v3/enums/vast-tracking-event.json) enum. Aligned to the IAB VAST 4.2 XSD `TrackingEvents_type/Tracking/@event` enumeration (vast_4.2.xsd lines 112–136), plus AdCP-flattened representations of `Impression`, `Error`, `VideoClicks`, and `ViewableImpression` elements:
   - **Playback**: `impression` (billing event), `creativeView`, `loaded`, `start`, `firstQuartile`, `midpoint`, `thirdQuartile`, `complete`
   - **Interaction**: `mute`, `unmute`, `pause`, `resume`, `rewind`, `skip`, `playerExpand`, `playerCollapse`, `fullscreen` (VAST 2.x/3.x compat), `exitFullscreen` (VAST 2.x/3.x compat), `otherAdInteraction`, `interactiveStart` (SIMID)
-  - **Non-linear / companion**: `acceptInvitation`, `adExpand`, `adCollapse`, `minimize`, `overlayViewDuration`
+  - **Non-linear**: `acceptInvitation`, `adExpand`, `adCollapse`, `minimize`, `overlayViewDuration`
   - **Progress**: `progress` (for custom progress points via VAST `offset` attribute)
   - **Click & close**: `clickTracking`, `customClick`, `close`, `closeLinear`
   - **Verification**: `viewable`, `notViewable`, `viewUndetermined`, `measurableImpression` (AdCP extension), `viewableImpression`
@@ -373,8 +373,8 @@ A single URL bound to a VAST `TrackingEvents` event. Use this when the creative
 **Properties:**
 - `vast_event`: The event this URL fires on. Any VAST tracking-event enum value **except** `impression`, `clickTracking`, `customClick`, `error`, or any of `viewable` / `notViewable` / `viewUndetermined` / `measurableImpression` / `viewableImpression` — those live in dedicated VAST elements (`Impression`, `VideoClicks`, `Error`, `ViewableImpression`), not under `TrackingEvents` (see Tracker routing normative rule below). Common values: `start`, `firstQuartile`, `midpoint`, `thirdQuartile`, `complete`, `pause`, `resume`, `mute`, `unmute`, `skip`, `progress`.
 - `url`: Tracker URL. Supports [AdCP universal macros](/docs/creative/universal-macros).
-- `offset`: Required for `vast_event: "progress"`. VAST 4.2 offset format (`Tracking@offset`): `HH:MM:SS` or `HH:MM:SS.mmm` (two-digit hours, minutes 00–59, seconds 00–59, exactly 3 fractional digits when present) for absolute time, or an integer percentage 0–100 suffixed with `%`. Negative offsets are NOT permitted — the VAST 4.2 XSD pattern does not allow a leading minus.
-- `target`: Which VAST creative element scopes this tracker — `linear` (default), `non_linear`, or `companion`. VAST 4.2 places `<TrackingEvents>` under three different parents (`<Linear>`, `<NonLinearAds>`, `<CompanionAds>/<Companion>`) with different valid event sets — e.g., `acceptInvitation` is meaningful on `non_linear`/`companion`, `closeLinear` only on `linear`. Sales agents read this to place the tracker correctly during VAST assembly.
+- `offset`: Required for `vast_event: "progress"`. On other events it is ignored for compatibility with existing 3.x manifests and removed before tracker-contract matching. VAST 4.2 offset format (`Tracking@offset`): `HH:MM:SS` or `HH:MM:SS.mmm` (two-digit hours, minutes 00–59, seconds 00–59, exactly 3 fractional digits when present) for absolute time, or an integer percentage 0–100 suffixed with `%`. Negative offsets are NOT permitted — the VAST 4.2 XSD pattern does not allow a leading minus.
+- `target`: Which VAST creative element scopes this tracker — `linear` (default), `non_linear`, or `companion`. Existing 3.x manifests remain structurally permissive. When a product declares a tracker execution contract, matching applies the closed standards matrix: `acceptInvitation` is non-linear, `creativeView` is the only companion event, and `closeLinear` is linear. Sales agents read this to place the tracker correctly during VAST assembly.
 
 **Target with non-linear event:**
 ```json
@@ -451,8 +451,8 @@ Audio-side analogue of `vast_tracker`: a single URL bound to a DAAST `TrackingEv
 **Properties:**
 - `daast_event`: Any DAAST tracking-event enum value **except** `impression`, `clickTracking`, `customClick`, `error`, or any of `viewable` / `notViewable` / `viewUndetermined` / `measurableImpression` / `viewableImpression` (same element-routing rule as `vast_tracker` — those values belong in `Impression` / `<AdInteractions>` / `Error` / AdCP-extension verification slots, not `TrackingEvents`). Common values: `start`, `firstQuartile`, `midpoint`, `thirdQuartile`, `complete`, `pause`, `resume`, `mute`, `unmute`, `rewind`, `skip`, `progress`.
 - `url`: Tracker URL. Supports AdCP universal macros.
-- `offset`: Required for `daast_event: "progress"` (DAAST 1.1 §3.2.4.3). Same format as VAST 4.2 `Tracking@offset`. Negative offsets are NOT permitted.
-- `target`: Which DAAST creative element scopes this tracker — `linear` (default, DAAST 1.1 §3.2.1.7) or `companion` (DAAST 1.1 §3.2.2.7, where the only valid event is `creativeView`). DAAST has no `<NonLinearAds>` element — audio is linear or accompanied by a visual companion.
+- `offset`: Required for `daast_event: "progress"` (DAAST 1.1 §3.2.4.3). On other events it is ignored for compatibility with existing 3.x manifests and removed before tracker-contract matching. Same format as VAST 4.2 `Tracking@offset`. Negative offsets are NOT permitted.
+- `target`: Which DAAST creative element scopes this tracker — `linear` (default, DAAST 1.1 §3.2.1.7) or `companion` (DAAST 1.1 §3.2.2.7). Existing 3.x manifests remain structurally permissive; a tracker execution contract restricts companion matching to `creativeView`. DAAST has no `<NonLinearAds>` element — audio is linear or accompanied by a visual companion.
 
 ### Pixel Tracker Asset
 
@@ -469,10 +469,10 @@ Renderer-fired HTTP tracker — image pixel or JavaScript include — bound to a
 ```
 
 **Properties:**
-- `event`: `impression` | `viewable_mrc_50` | `viewable_mrc_100` | `viewable_video_50` | `audible_video_complete` | `click` | `custom`. Event enum mirrors IAB OpenRTB Native 1.2 event-type registry (types 1, 2, 3, 4, 500). `audible_video_complete` is distinct from `viewable_video_50` — the former is full-completion with audio on; the latter is 50% pixels for ≥2 seconds with audio on. Meaningful on non-VAST video formats (Meta Reels, YouTube Shorts, TikTok Spark); VAST formats use `vast_tracker` with `vast_event: complete` instead.
+- `event`: `impression` | `viewable_mrc_50` | `viewable_mrc_100` | `viewable_video_50` | `audible_video_complete` | `click` | `custom`. The first four measurement values map to IAB OpenRTB Native 1.2 event types 1-4. Native type 4 is 50% pixels for at least two seconds and does not require audio. `audible_video_complete` is a distinct AdCP-defined full-completion event with audio on; Native leaves event types 500+ exchange-specific rather than assigning this event a standard numeric type. These video events are meaningful on non-VAST video formats; VAST formats use `vast_tracker` with `vast_event: complete` and separate audible measurement where needed.
 - `method`: `img` (fired as `<img>` pixel) or `js` (fired as `<script>` include). Matches IAB Native 1.2 method enum (1=img, 2=js). Default `img`. Sellers without JS-tracker support MUST reject `method: js` declarations at sync_creatives time.
 - `url`: Tracker URL fired when `event` occurs. May carry AdCP universal macros.
-- `custom_event_name`: REQUIRED when `event: custom`, forbidden otherwise (if/then enforced at the schema layer). Adopter-defined event name; sellers without registered handling MUST silently no-op rather than reject.
+- `custom_event_name`: REQUIRED when `event: custom`, forbidden otherwise (if/then enforced at the schema layer). When tracker execution is undeclared, an unknown custom event is a forward-compatible probe and the seller silently no-ops rather than rejecting the creative. An effective `tracker_execution_contract` overrides that fallback: under `complete: true`, an unlisted custom selector is unsupported and produces `tracker_contract_mismatch`; a listed selector is an affirmative accept-and-initiate commitment.
 
 **Maps to IAB OpenRTB Native 1.2:**
 - `imptrackers[]` → `pixel_tracker` with `event: impression`, `method: img`
diff --git a/docs/creative/canonical-formats.mdx b/docs/creative/canonical-formats.mdx
index 2b6987ca8b..7ad1f958ab 100644
--- a/docs/creative/canonical-formats.mdx
+++ b/docs/creative/canonical-formats.mdx
@@ -328,7 +328,7 @@ Downstream platform authorization is separate from production source. If a forma
 
 When `asset_source` is `buyer_uploaded`, the buyer ships rendered assets and any tracker URLs attached to those assets are buyer-controlled (universal_macros for impression/click; `vast_tracker` / `daast_tracker` assets for decomposed VAST/DAAST trackers). When `asset_source` is any of the seller-rendered values (`seller_pre_rendered_from_brief`, `seller_human_designed`, `agent_synthesized`) or `publisher_host_recorded`, the buyer never sees the rendered artifact directly. Two normative paths apply:
 
-- **Capability-gated macro-substituted tracking.** Tracker URLs are explicit `pixel_tracker`, `vast_tracker`, or `daast_tracker` assets (or governed tracking extensions); `landing_page_url` remains the navigated destination, not a tracker. Exact macro capabilities declare whether occurrences such as `{IMPRESSION_ID}` and `{CACHEBUSTER}` can be processed, but they do not claim that the product accepts or fires the containing tracker. When the product tracking contract declares the asset type honored, the seller embeds and fires it according to that commitment. Until that contract is present, tracker acceptance and firing are undeclared and buyers MUST NOT infer them from macro compatibility.
+- **Capability-gated macro-substituted tracking.** Tracker URLs are explicit `pixel_tracker`, `vast_tracker`, or `daast_tracker` assets (or governed tracking extensions); `landing_page_url` remains the navigated destination, not a tracker. Exact macro capabilities declare whether occurrences such as `{IMPRESSION_ID}` and `{CACHEBUSTER}` can be processed, but they do not claim that the product accepts or fires the containing tracker. The selected format option's [tracker execution contract](/docs/creative/tracker-execution-contracts) makes that separate accept-and-initiate commitment. Until that contract is present, tracker acceptance and firing are undeclared and buyers MUST NOT infer them from macro compatibility.
 - **Sync-creatives tracker block.** For products where the seller produces a serving artifact that embeds tracker URLs directly (e.g., a generated VAST tag or a stitched companion banner), the seller's `sync_creatives` response SHOULD include a `tracker_block` field listing the impression URL pattern and click URL pattern. Buyers register those with their measurement vendor at sync time. This path covers the generative-DSP pattern where the serving artifact and the tracking shape are produced together.
 
 `vast_tracker` and `daast_tracker` decomposed tracker assets work for both `buyer_uploaded` and seller-rendered sources — when the seller renders, those tracker assets are inputs to the rendered tag, attached to the appropriate VAST/DAAST `<TrackingEvents>` block at production time. When the buyer ships a complete `vast` or `daast` tag, the trackers travel inside the tag.
diff --git a/docs/creative/representation-sets.mdx b/docs/creative/representation-sets.mdx
index 1031ae935f..69e40cf40b 100644
--- a/docs/creative/representation-sets.mdx
+++ b/docs/creative/representation-sets.mdx
@@ -85,8 +85,9 @@ Resolution follows this order:
 2. Filter candidates by canonical `format_kind` and the selected `format_option_ref`.
 3. Apply the option's asset shape and delivery-mechanism constraints.
 4. For VAST, intersect product and seller version sets.
-5. Evaluate every declared macro against product and seller macro capabilities.
-6. Select exactly one compatible representation.
+5. Normalize tracker defaults, bind one exact VAST/DAAST execution version, and match every first-class tracker against the destination's [tracker execution contract](/docs/creative/tracker-execution-contracts).
+6. Evaluate every declared macro against product and seller macro capabilities as a separate check.
+7. Select exactly one compatible representation.
 
 The buyer may perform these checks locally from seller discovery and submit the selected ordinary manifest. On the wire, `build_creative` representation resolution is intentionally narrower: only the destination sales agent may advertise `creative.representation_resolution.supported: true` and accept a set. A standalone creative agent does not own the product or seller execution ceilings and cannot claim seller compatibility. Silent guessing is never allowed.
 
@@ -94,6 +95,8 @@ The request carries `representation_destination.product_id` plus the exact effec
 
 Resolution requires explicit compatibility inputs. In particular, every `video_vast` source representation has an exact asset `vast_version`, while the selected product option and seller advertise non-empty plural `vast_versions`. An absent set is unproven and cannot be treated as accepting every version on this opt-in resolution path.
 
+When a first-class `vast_tracker` or `daast_tracker` has no sibling exact-version delivery document, `representation_destination` carries `execution_vast_version` or `execution_daast_version`. The value must belong to the destination acceptance set and is echoed in `representation_selection`. It joins the selected representation and output digest in the execution-review identity, so changing it requires re-resolution and ordinary re-review. Package assignment must preserve the same exact version.
+
 Equivalence is a buyer assertion, not something the set digest proves. The digest proves that the complete asserted set was not changed; it does not prove that two representations render the same ad or behave identically. A seller MUST apply its ordinary validation and review policy to the exact selected output before approving or serving it. The seller does not need to fetch, execute, or approve every unselected candidate, and it MUST NOT treat acceptance of one candidate as approval of another. Different sellers may select different candidates, but each selected output is separately submitted through `sync_creatives` and reviewed before it can serve. A later selection likewise requires an explicit buyer sync and ordinary re-review, so an unreviewed hidden candidate can never replace the approved execution.
 
 Pass a representation set to the destination seller's `build_creative` route with the product contract and an advertised strategy:
@@ -179,7 +182,7 @@ The paired redirect stays one asset. A receiver cannot combine its ad-request UR
 On `sync_creatives`, the seller enforces two different invariants:
 
 1. `(creative_id, revision_id, revision_content_digest)` binds immutable buyer source content—the complete representation set, never only the selected entry.
-2. `(selected_representation_id, selected_output_digest)` binds the current seller-bound execution submitted for review.
+2. `(selected_representation_id, selected_output_digest, execution_vast_version-or-null, execution_daast_version-or-null)` binds the current seller-bound execution submitted for review.
 
 Changing the source set requires a new buyer `revision_id`. Changing only the selected execution does not mint a buyer revision, but it is an `updated` creative and follows the ordinary re-review lifecycle; approval never transfers silently to different execution bytes. `list_creatives` returns the exact current `representation_selection` while that selected execution remains current. A downstream seller that receives only the selected manifest can verify its output digest and retain the asserted source-set digest, but cannot claim it independently inspected hidden source representations.
 
@@ -251,12 +254,19 @@ When no candidate works, return `CREATIVE_REPRESENTATION_UNRESOLVED`. `error.det
         "representation_id": "source-vast-4",
         "code": "macro_unsupported",
         "message": "A required player-owned macro is not supported on this execution path"
+      },
+      {
+        "representation_id": "source-vast-trackers",
+        "code": "tracker_contract_mismatch",
+        "message": "The complete destination contract does not honor this normalized tracker selector"
       }
     ]
   }
 }
 ```
 
+`tracker_contract_mismatch` and `macro_unsupported` are deliberately distinct. A seller reports the former with the manifest asset path, normalized selector identity, and destination option reference. Library-only `sync_creatives` can preserve a selected output and validate its structure, but package assignment must revalidate the trackers against the immutable package snapshot before spend.
+
 ## VAST representations
 
 One VAST asset declares one exact `vast_version`; a product option and seller declare accepted sets.
diff --git a/docs/creative/tracker-execution-contracts.mdx b/docs/creative/tracker-execution-contracts.mdx
new file mode 100644
index 0000000000..993d501a08
--- /dev/null
+++ b/docs/creative/tracker-execution-contracts.mdx
@@ -0,0 +1,202 @@
+---
+title: Tracker execution contracts
+description: "Declare which buyer-supplied pixel, VAST, and DAAST trackers a product accepts and initiates, then preserve that commitment in the package snapshot."
+"og:title": "AdCP — Tracker Execution Contracts"
+---
+
+AdCP 3.2 separates two questions that a buyer must answer before assigning a creative:
+
+1. **Will the seller accept and initiate this tracker?** Read the selected product format option's `tracker_execution_contract`.
+2. **How will the tracker URL's macros be processed?** Match each occurrence against the exact [`macro_resolution_capabilities`](/docs/creative/universal-macros).
+
+Neither promise implies the other. A seller can resolve `{CACHEBUSTER}` without accepting the containing tracker, and it can accept a tracker whose required macro is unsupported. Buyers must satisfy both contracts before committing spend.
+
+This 3.2 surface covers only first-class `pixel_tracker`, `vast_tracker`, and `daast_tracker` manifest assets. It does not inspect trackers embedded in fetched VAST/DAAST documents, wrappers, JavaScript responses, or generic URL assets. Runtime preview observation is a separate, later capability; the production commitment does not depend on it.
+
+## Product-format authority
+
+The binding commitment is `Product.format_options[].tracker_execution_contract`, alongside `format_kind` and `params`. It is seller execution behavior, not a canonical-format parameter. A product option carrying the contract must have a stable `format_option_id` so the buyer can bind resolution and package assignment to exactly one option.
+
+```json
+{
+  "format_option_id": "acme_display_300x250",
+  "format_kind": "image",
+  "params": {
+    "width": 300,
+    "height": 250,
+    "slots": [
+      { "asset_group_id": "image_main", "asset_type": "image", "required": true },
+      { "asset_group_id": "impression_tracker", "asset_type": "pixel_tracker", "required": false },
+      { "asset_group_id": "click_tracker", "asset_type": "pixel_tracker", "required": false }
+    ]
+  },
+  "tracker_execution_contract": {
+    "complete": true,
+    "honored": [
+      {
+        "selector_id": "display_impression_pixel",
+        "asset_type": "pixel_tracker",
+        "event": "impression",
+        "method": "img",
+        "execution_actor": "seller",
+        "firing_paths": ["client"]
+      },
+      {
+        "selector_id": "display_click_pixel",
+        "asset_type": "pixel_tracker",
+        "event": "click",
+        "method": "img",
+        "execution_actor": "seller",
+        "firing_paths": ["client"]
+      }
+    ]
+  }
+}
+```
+
+Publisher and placement declarations may narrow an upstream contract, but the seller-returned product option contains the complete effective contract used for selection and purchase. Creative-agent `supported_formats[]`, transformer inputs, manifests, representations, and deprecated format projections cannot create seller authority; those projections strip the contract and its digest.
+
+Every asset type named in `honored[]` must also have at least one matching first-class slot in the effective selected format declaration. A contract cannot promise a `pixel_tracker`, `vast_tracker`, or `daast_tracker` that the same format rejects structurally. This is why the image example explicitly adds tracker slots instead of relying on the image canonical's default slots.
+
+Publisher, placement, and seller derivation is directional. Expand each selector to atomic tuples of `(normalized non-version selector identity, exact version or null, execution_actor, firing_path)`. When the parent contract is complete, every tuple in the child effective contract must exist in its parent; only then may tuples be compressed back into selector arrays. For example, a complete parent that permits VAST 4.2 on `client` and VAST 4.3 on `server` does not permit a child selector containing both versions and both paths, because that cross-product invents 4.2/server and 4.3/client commitments.
+
+An incomplete or omitted parent is not a closed ceiling. A downstream declaration may add or omit affirmative tuples for its narrower scope, but the effective contract remains incomplete until every applicable layer is complete. An omitted tuple in an incomplete child is undeclared, not an assertion that the tuple is unsupported. A complete parent remains complete after valid subset narrowing, and every child tuple must exist in that parent.
+
+## Exact selectors
+
+Each `honored[]` entry selects one exact tracker/event combination. It is not a cross-product of all declared events, versions, targets, actors, and paths.
+
+| Branch | Required identity | Important restrictions |
+|---|---|---|
+| `pixel_tracker` | `event`, `method: img` | `event: custom` requires a nonempty `custom_event_name`. JavaScript tracker execution is not supported by the 3.2 contract. |
+| `vast_tracker` | `vast_versions[]`, `vast_event`, `target` | `progress` requires `offset`; other events forbid it. The event/target pair must be valid in every listed version. |
+| `daast_tracker` | `daast_versions[]`, `daast_event`, `target` | `progress` requires `offset`; other events forbid it. The event/target pair must be valid in every listed version. |
+
+Every branch also requires a stable `selector_id`, one `execution_actor` (`seller` or `request_executor`), and a nonempty `firing_paths[]` set (`client`, `server`, or both). Multiple paths mean that one path may perform the single initiation for a logical event; they do not authorize duplicate client-and-server firing.
+
+Asset defaults are normalized before matching: omitted `pixel_tracker.method` is `img`, omitted VAST/DAAST `target` is `linear`, and a legacy `offset` on a non-`progress` asset is ignored and removed before comparison. Contract selectors themselves must omit `offset` for non-`progress` events. Existing 3.x asset schemas remain permissive about event/target combinations; the strict standards matrix is applied when matching those assets to a contract-bearing product. Two byte-identical URLs in different manifest slots are still two tracker instances. For each logical occurrence of the selected event, the named actor initiates every accepted instance exactly once. This promises construction and handoff of the outbound action—not network delivery, HTTP success, attribution, or reporting credit.
+
+The following VAST/DAAST contract is valid only on an effective option whose `params.slots[]` includes first-class `vast_tracker` and `daast_tracker` slots:
+
+```json
+[
+  {
+    "format_option_id": "acme_video_trackers",
+    "format_kind": "video_hosted",
+    "params": {
+      "slots": [
+        { "asset_group_id": "video_main", "asset_type": "video", "required": true },
+        { "asset_group_id": "video_start_tracker", "asset_type": "vast_tracker", "required": false }
+      ]
+    },
+    "tracker_execution_contract": {
+      "complete": true,
+      "honored": [{
+        "selector_id": "linear_vast_start",
+        "asset_type": "vast_tracker",
+        "vast_versions": ["4.2", "4.3"],
+        "vast_event": "start",
+        "target": "linear",
+        "execution_actor": "request_executor",
+        "firing_paths": ["client", "server"]
+      }]
+    }
+  },
+  {
+    "format_option_id": "acme_audio_trackers",
+    "format_kind": "audio_hosted",
+    "params": {
+      "slots": [
+        { "asset_group_id": "audio_main", "asset_type": "audio", "required": true },
+        { "asset_group_id": "audio_quartile_tracker", "asset_type": "daast_tracker", "required": false }
+      ]
+    },
+    "tracker_execution_contract": {
+      "complete": true,
+      "honored": [{
+        "selector_id": "linear_daast_quartile",
+        "asset_type": "daast_tracker",
+        "daast_versions": ["1.1"],
+        "daast_event": "firstQuartile",
+        "target": "linear",
+        "execution_actor": "request_executor",
+        "firing_paths": ["client"]
+      }]
+    }
+  }
+]
+```
+
+`close` remains accepted in legacy DAAST asset payloads for AdCP 3.x compatibility, but it is not in the DAAST 1.0/1.1 standards event enum and therefore cannot appear in a closed 3.2 execution selector.
+
+`complete: true` makes unlisted combinations explicitly unsupported; `complete: true, honored: []` explicitly accepts no buyer-supplied trackers. An omitted contract or `complete: false` leaves omissions undeclared, never unsupported. Listed entries remain affirmative commitments in either case.
+
+## VAST and DAAST execution versions
+
+A first-class VAST/DAAST selector is matched against one exact execution version, never a guessed member of a plural acceptance set.
+
+- When the manifest includes the exact sibling VAST or DAAST delivery document, its version supplies the execution version.
+- When the seller assembles trackers without such a sibling document, `build_creative.representation_destination` must carry `execution_vast_version` or `execution_daast_version`.
+- The chosen value must belong to the destination format's accepted version set and the selector's version set.
+- `representation_selection` echoes the exact version as lineage through sync and list readback.
+
+The seller reviews the tuple `(selected_representation_id, selected_output_digest, execution_vast_version-or-null, execution_daast_version-or-null)`. Changing an execution version requires re-resolution and ordinary re-review even when the selected manifest bytes are unchanged. Later package assignment must use the same exact version; it cannot silently rebind an approved execution to a different package version.
+
+## Resolution, sync, and package assignment
+
+Seller-bound representation resolution follows this order:
+
+1. Normalize tracker defaults and select one exact VAST/DAAST execution version.
+2. Match every first-class manifest tracker against the destination option's effective contract.
+3. Match every declared macro occurrence independently against the exact macro-capability tuple.
+4. Select only a representation that satisfies both checks.
+
+With a complete contract, an unlisted tracker makes the candidate incompatible. A failed representation receives `tracker_contract_mismatch`, with the representation ID, manifest asset JSON Pointer, normalized selector identity, and destination format-option reference. Macro incompatibility remains the separate `macro_unsupported` rejection; an implementation must not collapse the two causes.
+
+Library-only `sync_creatives` can validate manifest structure and preserve revision/selection lineage, but it does not prove that an arbitrary product accepts the tracker. Package assignment and `create_media_buy` revalidate the selected manifest against the immutable package snapshot before spend. A mismatch rejects assignment; it never silently removes a tracker or weakens the package contract.
+
+## Immutable package snapshots
+
+Every package that selects a contract-bearing format stores a `PackageFormatSnapshot` in `formats_to_provide[]`, even when creative coverage is already complete. `formats_pending[]` may be empty, but the snapshot remains because serving uses the package-time commitment rather than mutable product discovery.
+
+```json
+{
+  "product_id": "prod_acme_video",
+  "format_option_id": "acme_vast_preroll",
+  "format_kind": "video_vast",
+  "params": {
+    "vast_versions": ["4.2", "4.3"]
+  },
+  "tracker_execution_contract": {
+    "complete": true,
+    "honored": []
+  },
+  "execution_vast_version": "4.3",
+  "placement_refs": [
+    {
+      "publisher_domain": "publisher.example",
+      "placement_id": "preroll"
+    }
+  ],
+  "tracker_execution_contract_digest": "sha256:11ba6e00858e9da168d855433c21052b6c2599abbc8b59e3a587e207b10669e0",
+  "product_snapshot_digest": "sha256:9f3abb83f15c6d16940d4ada694476397a71a9adc3a5dbc602f432bfd194bff2"
+}
+```
+
+`tracker_execution_contract_digest` is SHA-256 over RFC 8785 canonical JSON of the contract object. `product_snapshot_digest` covers the product ID, complete selected format declaration, sorted effective placement references, exact execution version when applicable, and the tracker-contract digest. Optional fields are omitted rather than encoded as `null`, schema defaults are not materialized, and duplicate JSON members are rejected before canonicalization.
+
+The snapshot and both digests are immutable for the package lifetime. Changing the selected format, placement set, execution version, or tracker contract requires a replacement package with a new `package_id`. A package spanning placements can snapshot only their common effective intersection; differing contracts require separate snapshots with disjoint placement sets or separate packages.
+
+## Buyer checklist
+
+Before assigning a creative, a buyer should verify:
+
+- the product option has a stable ID and matches the creative's `format_option_ref`;
+- each first-class tracker matches one honored selector after default normalization;
+- the exact VAST/DAAST execution version is accepted at every layer;
+- every required macro declaration matches the product and seller macro capabilities;
+- a complete contract contains no unlisted tracker instance;
+- the package snapshot and digests match the contract used during selection; and
+- assignment revalidation succeeds before spend.
+
+Absence is not rejection. If the contract is omitted or incomplete, the missing combinations are undeclared and the buyer must resolve the uncertainty out of band or choose another product.
diff --git a/docs/creative/universal-macros.mdx b/docs/creative/universal-macros.mdx
index 07b30728ec..250218fff1 100644
--- a/docs/creative/universal-macros.mdx
+++ b/docs/creative/universal-macros.mdx
@@ -224,7 +224,7 @@ The occurrence contract extends the existing lifecycle; it does not replace it:
 3. `translateUniversalMacros` has a raw `native` arm and a one-pass encoded `value` arm. With declarations, a native mapping performs `translate_to_native`, emits the exact target token unchanged, and replaces the source declaration with its `translation_target`; a concrete mapping follows the declaration's encoding. Existing unmapped/frozen-consent diagnostics remain mandatory.
 4. Dropping an unmapped query parameter is behavior of that explicitly invoked legacy helper. It is not the ingest or transport default. Assets without declarations retain opaque-token transport and are not proven compatible.
 5. Webhook `supported_macros` describes runtime webhook arguments, while preview/build `macros` are sample values. Neither is a creative-token resolution capability.
-6. The proposed #6207 product tracking contract remains responsible for whether a seller honors and fires buyer tracker asset types. When it lands, its detailed substitution claims reuse these exact macro capability entries; it does not redefine dialect, ownership, or encoding.
+6. The product [tracker execution contract](/docs/creative/tracker-execution-contracts) remains responsible for whether a seller accepts and initiates each exact buyer tracker/event combination. Its macro checks reuse these exact capability entries; it does not redefine dialect, ownership, or encoding. Passing one check never implies passing the other.
 
 Catalog-item universal semantics retain their existing stricter rule: UTF-8/NFC values receive exactly one RFC 3986 unreserved-set encoding pass. A declaration cannot weaken or add nesting to that governed catalog substitution profile; nested redirect encoding applies only to a separately cited click-redirect mapping.
 
diff --git a/docs/media-buy/media-buys/index.mdx b/docs/media-buy/media-buys/index.mdx
index 5f65214fa7..f647bbb5e7 100644
--- a/docs/media-buy/media-buys/index.mdx
+++ b/docs/media-buy/media-buys/index.mdx
@@ -62,7 +62,8 @@ include:
 | `targeting_overlay` | Complete effective targeting, including seller resolution |
 | `start_time` / `end_time` | Executable package flight |
 | `budget` / `daily_budget_cap` | Package-level spend constraints when applicable |
-| `formats_pending` | Canonical creative requirements that still lack coverage |
+| `formats_to_provide` | Immutable package-time format snapshots; contract-bearing entries remain after coverage and pin product, placement, execution version, and digests |
+| `formats_pending` | Canonically equal subset of `formats_to_provide` that still lacks coverage |
 | `creative_approvals[]` | Current assignment review state |
 | `indicators[]` | Current seller observations such as pacing or inventory risk |
 
diff --git a/docs/media-buy/task-reference/create_media_buy.mdx b/docs/media-buy/task-reference/create_media_buy.mdx
index 04f425a476..721e0a8980 100644
--- a/docs/media-buy/task-reference/create_media_buy.mdx
+++ b/docs/media-buy/task-reference/create_media_buy.mdx
@@ -332,10 +332,10 @@ A provider portfolio bidding strategy illustrates the current abstraction bounda
 | `confirmed_at` | ISO 8601 timestamp when the seller committed to the media buy. Stable after it is set. May be `null` in deferred/manual approval flows until seller commitment occurs. |
 | `creative_deadline` | ISO 8601 timestamp for creative upload deadline |
 | `revision` | Initial media-buy revision. Use this value as the `revision` token on the next [`update_media_buy`](/docs/media-buy/task-reference/update_media_buy) call intended to change state. |
-| `packages` | Array of created packages with complete state. Packages MAY include a per-package `creative_deadline` and SHOULD echo canonical selectors supplied on create so read surfaces are lossless. When additional creative coverage is required, each package carries `formats_to_provide[]`: full canonical ProductFormatDeclaration snapshots normalized from the selected product contract. When the request included audience-evidence pins or requirements, each package MUST return matching `audience_evidence_selections` with `decision_use: "package_construction"`. |
+| `packages` | Array of created packages with complete state. Packages MAY include a per-package `creative_deadline` and SHOULD echo canonical selectors supplied on create so read surfaces are lossless. When additional creative coverage is required, each package carries `formats_to_provide[]`. A package whose selected option has `tracker_execution_contract` MUST carry it even when coverage is already complete. Entries are immutable `PackageFormatSnapshot` values that bind the effective Product declaration, `product_id`, stable option identity, applicable placements, exact VAST/DAAST execution version, and RFC 8785 digests. When the request included audience-evidence pins or requirements, each package MUST return matching `audience_evidence_selections` with `decision_use: "package_construction"`. |
 | `warnings` | Structured non-blocking observations. The buy was still created. A continuing condition also appears on [`get_media_buys`](/docs/media-buy/task-reference/get_media_buys); see [Indicators and Warnings](/docs/media-buy/media-buys/indicators). |
 
-Treat `packages[].formats_to_provide[]` as the stable creative checklist established at booking time. Each full declaration can be matched against a creative agent's live `creative.supported_formats[].format`, even when the product option has no `format_option_id`. After uploads or assignments, call [`get_media_buys`](/docs/media-buy/task-reference/get_media_buys): `packages[].formats_pending[]` contains the declarations that still lack creative coverage. The deprecated `format_ids_to_provide` / `format_ids_pending` projections exist only for older 3.x peers.
+Treat `packages[].formats_to_provide[]` as the immutable checklist and production-contract snapshot established at booking time. An ordinary checklist entry can be ID-less, but a contract-bearing snapshot always has `format_option_id`, `product_id`, `tracker_execution_contract_digest`, and `product_snapshot_digest`. It remains present after upload or assignment because validation and serving use the package-time contract, never mutable Product discovery. After uploads or assignments, call [`get_media_buys`](/docs/media-buy/task-reference/get_media_buys): `packages[].formats_pending[]` is the canonically equal subset that still lacks creative coverage and may be empty. The deprecated `format_ids_to_provide` / `format_ids_pending` projections exist only for older 3.x peers.
 
 `confirmed_at` is seller commitment time, not a delivery-status timestamp. Do not update it when a buy later pauses, resumes, starts delivery, completes, or reports performance. A committed synchronous create stamps it immediately. Use the `submitted` response branch when no `media_buy_id` is being returned to the buyer. Sellers MAY instead return synchronous success with `media_buy_id`, `packages`, and `confirmed_at: null` for a provisional buy; such buys MUST be retrievable via `get_media_buys` and MUST transition by setting `confirmed_at` exactly once on commitment. A provisional buy with `confirmed_at: null` MUST NOT be `active` and MUST NOT include `packages[].committed_metrics`.
 
diff --git a/docs/media-buy/task-reference/get_media_buys.mdx b/docs/media-buy/task-reference/get_media_buys.mdx
index 58ae532a22..956960c7f1 100644
--- a/docs/media-buy/task-reference/get_media_buys.mdx
+++ b/docs/media-buy/task-reference/get_media_buys.mdx
@@ -126,7 +126,8 @@ Returns an array of media buys with current status, creative approval state, and
 | `context` | Opaque package-level correlation data echoed unchanged from the `create_media_buy` package request. Sellers MUST include persisted context when the package was created through AdCP with context, and MAY omit it for packages created outside AdCP or without context. Buyers targeting mixed seller populations can use the per-package correlation value they included on create, commonly `context.buyer_ref`, to map `package_id` back to their line items when a legacy create response did not echo `product_id`. |
 | `creative_approvals` | Array of creative approval states (see below) |
 | `indicators` | Current package-level seller indicators such as diversity, audience saturation, inventory forecast, pacing, or budget constraint |
-| `formats_pending` | Canonical package-time format declarations from `formats_to_provide` that do not yet have creative coverage. Full declarations let buyers select a compatible creative agent even when no option ID exists. |
+| `formats_to_provide` | Immutable package-time `PackageFormatSnapshot` checklist. A contract-bearing snapshot remains present after creative coverage is complete and binds the effective Product declaration, product/option/placement identity, exact VAST/DAAST execution version, and contract/product digests used for assignment and serving. |
+| `formats_pending` | Canonically equal subset of `formats_to_provide` that still lacks creative coverage. It may be empty even while the retained contract-bearing snapshot remains in `formats_to_provide`; omission means readiness was not reported. |
 | `format_ids_pending` | **Deprecated in 3.2.** Legacy named-format projection of `formats_pending` for older 3.x peers. |
 | `snapshot_unavailable_reason` | Reason code when `include_snapshot: true` but no snapshot is returned for this package |
 | `snapshot` | Near-real-time delivery snapshot (when `include_snapshot: true`) |
diff --git a/docs/reference/test-vectors/index.mdx b/docs/reference/test-vectors/index.mdx
index 82a72d446b..f5078016c0 100644
--- a/docs/reference/test-vectors/index.mdx
+++ b/docs/reference/test-vectors/index.mdx
@@ -37,6 +37,7 @@ SDKs SHOULD fetch versioned paths where available and record the version under t
 | [`universal-macro-translation`](https://github.com/adcontextprotocol/adcp/blob/main/static/compliance/source/test-vectors/universal-macro-translation.json) | Producer-side universal-macro translation: RFC 3986 unreserved-whitelist value encoding, verbatim native insertion, unmapped-macro param dropping, privacy/consent macro advisory, suspect native-value detection, single-pass substitution, and control-character rejection in native mappings | `static/compliance/source/test-vectors/universal-macro-translation.json` | `/compliance/latest/test-vectors/universal-macro-translation.json` |
 | [`creative-representation-resolution`](https://github.com/adcontextprotocol/adcp/blob/main/static/compliance/source/test-vectors/creative-representation-resolution.json) | Deterministic creative-representation selection across product and seller capability intersections: paired redirects, highest-compatible VAST selection, representation-order tie breaking, retained alternatives, and exhaustive rejection output when no representation is compatible | `static/compliance/source/test-vectors/creative-representation-resolution.json` | `/compliance/latest/test-vectors/creative-representation-resolution.json` |
 | [`macro-processing`](https://github.com/adcontextprotocol/adcp/blob/main/static/compliance/source/test-vectors/macro-processing.json) | Creative macro-processing capability matching: byte-preserving unknown tokens, exact dialect/namespace/registry-revision/operation/context/owner/depth checks, seller-side universal-token translation, and the required two RFC 3986 encoding passes for nested click values | `static/compliance/source/test-vectors/macro-processing.json` | `/compliance/latest/test-vectors/macro-processing.json` |
+| [`tracker-execution-contracts`](https://github.com/adcontextprotocol/adcp/blob/main/static/compliance/source/test-vectors/tracker-execution-contracts.json) | Product and package tracker execution commitments: normalized pixel/VAST/DAAST selectors, exact event/version/actor/path matching, completeness semantics, package snapshot digests, and narrowing rules | `static/compliance/source/test-vectors/tracker-execution-contracts.json` | `/compliance/latest/test-vectors/tracker-execution-contracts.json` |
 | [`attestations`](https://github.com/adcontextprotocol/adcp/tree/main/static/compliance/source/test-vectors/attestations) | Portable attestation trust and resolution: allowlist checks, delivery selection, validity windows, revocation, subject and digest comparison, stable outcomes, and the no-network rule for off-policy inputs. Uses a fictional proof format; cryptographic verification bytes are format-specific and tested by each format's own suite | `static/compliance/source/test-vectors/attestations/` | `/compliance/latest/test-vectors/attestations/` |
 | [`rights-attestations`](https://github.com/adcontextprotocol/adcp/tree/main/static/compliance/source/test-vectors/rights-attestations) | Rights-grant profile composed with portable attestations: holder/claim/resolver policy, rights-subject checks, JWKS purpose binding, issuer-bound status evidence, constraint-digest comparison, and fail-closed outcomes for paused, revoked, stale, or untrusted grants | `static/compliance/source/test-vectors/rights-attestations/` | `/compliance/latest/test-vectors/rights-attestations/` |
 | [`governance-runtime-attestations`](https://github.com/adcontextprotocol/adcp/tree/main/static/compliance/source/test-vectors/governance-runtime-attestations) | `check_governance` signal-activation with portable attestations: normalized outcome and governance verdict, binding-digest computation, deactivation negative-policy, and cache-reuse validity constraints | `static/compliance/source/test-vectors/governance-runtime-attestations/` | `/compliance/latest/test-vectors/governance-runtime-attestations/` |
diff --git a/package.json b/package.json
index 1b63f51df8..6c2208d4ec 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "deploy:cdn-artifacts-cutover:dry-run": "wrangler deploy --config workers/artifact-cdn/wrangler.cutover.toml --dry-run",
     "verify:cdn-artifacts-cutover": "node scripts/verify-cdn-artifacts-cutover.mjs",
     "typecheck": "tsc --project server/tsconfig.json --noEmit",
-    "test:schemas": "node tests/schema-validation.test.cjs && node --test tests/outcome-target.test.cjs tests/trusted-match-offer-creative-data.test.cjs tests/accessibility-violation-details.test.cjs tests/portfolio-routing-scope.test.cjs tests/catalog-item-availability-updates.test.cjs tests/compact-product-lifecycle-storyboards.test.cjs tests/timezone-resolution-storyboards.test.cjs tests/schema-deprecation-metadata.test.cjs tests/products-only-brief-compatibility.test.cjs tests/async-identity-convergence.test.cjs tests/creative-rotation.test.cjs tests/creative-revisions.test.cjs tests/creative-delivery-contracts.test.cjs tests/metric-identity-coherence.test.cjs tests/sort-contract-delivery-reporting.test.cjs tests/time-based-views-contract.test.cjs tests/metric-qualifier-parity.test.cjs tests/requested-metrics-contract.test.cjs tests/auto-breakdown-negotiation-contract.test.cjs tests/format-delivery-reporting-contract.test.cjs tests/lint-schema-enum-drift.test.cjs tests/synthetic-depiction.test.cjs tests/creative-rendering-authority.test.cjs && npm run test:premium-display-formats && npm run test:geo-region-targeting",
+    "test:schemas": "node tests/schema-validation.test.cjs && node --test tests/outcome-target.test.cjs tests/trusted-match-offer-creative-data.test.cjs tests/accessibility-violation-details.test.cjs tests/portfolio-routing-scope.test.cjs tests/catalog-item-availability-updates.test.cjs tests/compact-product-lifecycle-storyboards.test.cjs tests/timezone-resolution-storyboards.test.cjs tests/schema-deprecation-metadata.test.cjs tests/products-only-brief-compatibility.test.cjs tests/async-identity-convergence.test.cjs tests/creative-rotation.test.cjs tests/creative-revisions.test.cjs tests/creative-delivery-contracts.test.cjs tests/tracker-execution-contracts.test.cjs tests/tracker-execution-package-integration.test.cjs tests/metric-identity-coherence.test.cjs tests/sort-contract-delivery-reporting.test.cjs tests/time-based-views-contract.test.cjs tests/metric-qualifier-parity.test.cjs tests/requested-metrics-contract.test.cjs tests/auto-breakdown-negotiation-contract.test.cjs tests/format-delivery-reporting-contract.test.cjs tests/lint-schema-enum-drift.test.cjs tests/synthetic-depiction.test.cjs tests/creative-rendering-authority.test.cjs && npm run test:premium-display-formats && npm run test:geo-region-targeting",
     "test:performance-feedback": "node --test --test-force-exit --test-timeout=30000 tests/performance-feedback-contract.test.cjs",
     "test:dist-schema-version-ids": "node --test --test-force-exit --test-timeout=30000 tests/dist-schema-version-ids.test.cjs",
     "test:examples": "node tests/example-validation-simple.test.cjs && npm run test:tmp-context-merge",
diff --git a/scripts/lint-schema-enum-drift.cjs b/scripts/lint-schema-enum-drift.cjs
index ea6a915393..26ee688591 100644
--- a/scripts/lint-schema-enum-drift.cjs
+++ b/scripts/lint-schema-enum-drift.cjs
@@ -80,6 +80,10 @@ const ALLOWED = new Set([
   'core/event-surface.json|*',
   // Creative format base has broader asset types and different watermark types
   'formats/canonical/_base.json|*',
+  // First-class tracker constraints intentionally narrow the flattened event
+  // vocabularies by XML element, target, and exact standards version.
+  'core/vast-tracker-constraints.json|*',
+  'core/daast-tracker-constraints.json|*',
   // Sponsored placement supported_id_types includes asin (broader than content-id-type)
   'formats/canonical/sponsored_placement.json|/properties/supported_id_types',
   // Delivery status is a superset of media-buy-status (includes failed, pending, etc.)
diff --git a/scripts/x-entity-field-map.json b/scripts/x-entity-field-map.json
index a6d6f11fc9..f7639b2f85 100644
--- a/scripts/x-entity-field-map.json
+++ b/scripts/x-entity-field-map.json
@@ -8,6 +8,7 @@
     "opportunity_id": "opportunity",
     "spot_id": "spot_airing",
     "creative_id": "creative",
+    "selector_id": "tracker_execution_selector",
     "audience_id": "audience",
     "snapshot_id": "audience_evidence_snapshot",
     "event_source_id": "event_source",
diff --git a/server/src/capabilities.ts b/server/src/capabilities.ts
index 8f4a3ecc51..be9d0d4f3b 100644
--- a/server/src/capabilities.ts
+++ b/server/src/capabilities.ts
@@ -124,7 +124,8 @@ export interface AgentCapabilityProfile {
 const SOURCE_SCHEMAS_DIR = path.resolve(fileURLToPath(
   new URL('../../static/schemas/source/', import.meta.url),
 ));
-let productFormatValidatorPromise: Promise<ValidateFunction> | null = null;
+let creativeOperationFormatValidatorPromise: Promise<ValidateFunction> | null = null;
+const canonicalParamsValidatorPromises = new Map<string, Promise<ValidateFunction>>();
 
 function loadLocalSchema(uri: string): object {
   if (!uri.startsWith('/schemas/')) {
@@ -137,9 +138,9 @@ function loadLocalSchema(uri: string): object {
   return JSON.parse(readFileSync(fullPath, 'utf8')) as object;
 }
 
-function getProductFormatValidator(): Promise<ValidateFunction> {
-  if (!productFormatValidatorPromise) {
-    productFormatValidatorPromise = (async () => {
+function getCreativeOperationFormatValidator(): Promise<ValidateFunction> {
+  if (!creativeOperationFormatValidatorPromise) {
+    creativeOperationFormatValidatorPromise = (async () => {
       const ajv = new Ajv({
         strict: false,
         allErrors: true,
@@ -147,13 +148,32 @@ function getProductFormatValidator(): Promise<ValidateFunction> {
         loadSchema: async (uri: string) => loadLocalSchema(uri),
       });
       addFormats(ajv);
-      return ajv.compileAsync(loadLocalSchema('/schemas/core/product-format-declaration.json'));
+      return ajv.compileAsync(loadLocalSchema('/schemas/core/creative-operation-format-declaration.json'));
     })().catch(error => {
-      productFormatValidatorPromise = null;
+      creativeOperationFormatValidatorPromise = null;
       throw error;
     });
   }
-  return productFormatValidatorPromise;
+  return creativeOperationFormatValidatorPromise;
+}
+
+function getCanonicalParamsValidator(formatKind: string): Promise<ValidateFunction> {
+  const existing = canonicalParamsValidatorPromises.get(formatKind);
+  if (existing) return existing;
+  const promise = (async () => {
+    const ajv = new Ajv({
+      strict: false,
+      allErrors: true,
+      loadSchema: async (uri: string) => loadLocalSchema(uri),
+    });
+    addFormats(ajv);
+    return ajv.compileAsync(loadLocalSchema(`/schemas/formats/canonical/${formatKind}.json`));
+  })().catch(error => {
+    canonicalParamsValidatorPromises.delete(formatKind);
+    throw error;
+  });
+  canonicalParamsValidatorPromises.set(formatKind, promise);
+  return promise;
 }
 
 function schemaErrors(validate: ValidateFunction): string {
@@ -176,7 +196,7 @@ export async function sanitizeCreativeCapabilities(raw: unknown): Promise<Creati
     throw new Error('creative.supported_formats: exceeds 500 entries');
   }
 
-  const validateFormat = await getProductFormatValidator();
+  const validateFormat = await getCreativeOperationFormatValidator();
   const capabilityIds = new Set<string>();
   const supportedFormats: CreativeCapabilities['supported_formats'] = [];
   for (const [index, rawEntry] of (rawFormats ?? []).entries()) {
@@ -199,6 +219,14 @@ export async function sanitizeCreativeCapabilities(raw: unknown): Promise<Creati
     if (!validateFormat(format)) {
       throw new Error(`creative.supported_formats[${index}].format: ${schemaErrors(validateFormat)}`);
     }
+    const formatDeclaration = format as Record<string, unknown>;
+    const formatKind = formatDeclaration.format_kind as string;
+    if (formatKind !== 'custom') {
+      const validateParams = await getCanonicalParamsValidator(formatKind);
+      if (!validateParams(formatDeclaration.params)) {
+        throw new Error(`creative.supported_formats[${index}].format.params: ${schemaErrors(validateParams)}`);
+      }
+    }
     if (!Array.isArray(operations)
       || operations.length === 0
       || new Set(operations).size !== operations.length
diff --git a/static/compliance/source/test-vectors/tracker-execution-contracts.json b/static/compliance/source/test-vectors/tracker-execution-contracts.json
new file mode 100644
index 0000000000..1b134494a7
--- /dev/null
+++ b/static/compliance/source/test-vectors/tracker-execution-contracts.json
@@ -0,0 +1,268 @@
+{
+  "$schema": "./tracker-execution-contracts.schema.json",
+  "vectors": [
+    {
+      "name": "pixel asset default method normalizes to img",
+      "contract": {
+        "complete": true,
+        "honored": [
+          {
+            "selector_id": "display-impression",
+            "asset_type": "pixel_tracker",
+            "event": "impression",
+            "method": "img",
+            "execution_actor": "seller",
+            "firing_paths": ["client"]
+          }
+        ]
+      },
+      "format_slots": [
+        { "asset_group_id": "impression_tracker", "asset_type": "pixel_tracker" }
+      ],
+      "tracker": {
+        "asset_type": "pixel_tracker",
+        "event": "impression",
+        "url": "https://measure.example/imp"
+      },
+      "expected": {
+        "status": "matched",
+        "selector_id": "display-impression"
+      }
+    },
+    {
+      "name": "VAST target default and exact version match",
+      "contract": {
+        "complete": true,
+        "honored": [
+          {
+            "selector_id": "vast-progress",
+            "asset_type": "vast_tracker",
+            "vast_versions": ["4.2", "4.3"],
+            "vast_event": "progress",
+            "target": "linear",
+            "offset": "25%",
+            "execution_actor": "request_executor",
+            "firing_paths": ["client", "server"]
+          }
+        ]
+      },
+      "format_slots": [
+        { "asset_group_id": "vast_progress_tracker", "asset_type": "vast_tracker" }
+      ],
+      "tracker": {
+        "asset_type": "vast_tracker",
+        "vast_event": "progress",
+        "offset": "25%",
+        "url": "https://measure.example/vast-progress"
+      },
+      "execution_version": "4.3",
+      "expected": {
+        "status": "matched",
+        "selector_id": "vast-progress"
+      }
+    },
+    {
+      "name": "exact VAST execution version outside selector is rejected by a complete contract",
+      "contract": {
+        "complete": true,
+        "honored": [
+          {
+            "selector_id": "vast-start-43",
+            "asset_type": "vast_tracker",
+            "vast_versions": ["4.3"],
+            "vast_event": "start",
+            "target": "linear",
+            "execution_actor": "request_executor",
+            "firing_paths": ["client"]
+          }
+        ]
+      },
+      "format_slots": [
+        { "asset_group_id": "vast_start_tracker", "asset_type": "vast_tracker" }
+      ],
+      "tracker": {
+        "asset_type": "vast_tracker",
+        "vast_event": "start",
+        "target": "linear",
+        "url": "https://measure.example/vast-start"
+      },
+      "execution_version": "4.2",
+      "expected": {
+        "status": "rejected",
+        "rejection_code": "tracker_contract_mismatch"
+      }
+    },
+    {
+      "name": "an unlisted tracker remains undeclared under an incomplete contract",
+      "contract": {
+        "complete": false,
+        "honored": []
+      },
+      "format_slots": [
+        { "asset_group_id": "click_tracker", "asset_type": "pixel_tracker" }
+      ],
+      "tracker": {
+        "asset_type": "pixel_tracker",
+        "event": "click",
+        "method": "img",
+        "url": "https://measure.example/click"
+      },
+      "expected": {
+        "status": "undeclared"
+      }
+    },
+    {
+      "name": "DAAST companion creativeView matches the exact 1.1 selector",
+      "contract": {
+        "complete": true,
+        "honored": [
+          {
+            "selector_id": "daast-companion-view",
+            "asset_type": "daast_tracker",
+            "daast_versions": ["1.1"],
+            "daast_event": "creativeView",
+            "target": "companion",
+            "execution_actor": "request_executor",
+            "firing_paths": ["client"]
+          }
+        ]
+      },
+      "format_slots": [
+        { "asset_group_id": "daast_companion_tracker", "asset_type": "daast_tracker" }
+      ],
+      "tracker": {
+        "asset_type": "daast_tracker",
+        "daast_event": "creativeView",
+        "target": "companion",
+        "url": "https://measure.example/daast-companion"
+      },
+      "execution_version": "1.1",
+      "expected": {
+        "status": "matched",
+        "selector_id": "daast-companion-view"
+      }
+    },
+    {
+      "name": "an honored tracker without a matching first-class format slot is rejected",
+      "contract": {
+        "complete": true,
+        "honored": [
+          {
+            "selector_id": "impossible-image-pixel",
+            "asset_type": "pixel_tracker",
+            "event": "impression",
+            "method": "img",
+            "execution_actor": "seller",
+            "firing_paths": ["client"]
+          }
+        ]
+      },
+      "format_slots": [
+        { "asset_group_id": "image_main", "asset_type": "image" }
+      ],
+      "tracker": {
+        "asset_type": "pixel_tracker",
+        "event": "impression",
+        "url": "https://measure.example/impossible"
+      },
+      "expected": {
+        "status": "rejected",
+        "rejection_code": "tracker_contract_mismatch"
+      }
+    }
+  ],
+  "derivation_vectors": [
+    {
+      "name": "an incomplete empty parent permits affirmative incomplete child knowledge",
+      "parent": {
+        "complete": false,
+        "honored": []
+      },
+      "child": {
+        "complete": false,
+        "honored": [{
+          "selector_id": "child-impression",
+          "asset_type": "pixel_tracker",
+          "event": "impression",
+          "method": "img",
+          "execution_actor": "seller",
+          "firing_paths": ["client"]
+        }]
+      },
+      "expected_valid": true
+    },
+    {
+      "name": "a complete parent forbids compressed version path cross-products",
+      "parent": {
+        "complete": true,
+        "honored": [
+          {
+            "selector_id": "parent-v42-client",
+            "asset_type": "vast_tracker",
+            "vast_versions": ["4.2"],
+            "vast_event": "start",
+            "target": "linear",
+            "execution_actor": "request_executor",
+            "firing_paths": ["client"]
+          },
+          {
+            "selector_id": "parent-v43-server",
+            "asset_type": "vast_tracker",
+            "vast_versions": ["4.3"],
+            "vast_event": "start",
+            "target": "linear",
+            "execution_actor": "request_executor",
+            "firing_paths": ["server"]
+          }
+        ]
+      },
+      "child": {
+        "complete": true,
+        "honored": [{
+          "selector_id": "child-cross-product",
+          "asset_type": "vast_tracker",
+          "vast_versions": ["4.2", "4.3"],
+          "vast_event": "start",
+          "target": "linear",
+          "execution_actor": "request_executor",
+          "firing_paths": ["client", "server"]
+        }]
+      },
+      "expected_valid": false
+    }
+  ],
+  "package_snapshot": {
+    "product_id": "prod-acme-video",
+    "format_option_id": "acme-vast-preroll",
+    "format_kind": "video_vast",
+    "params": {
+      "vast_versions": ["4.2", "4.3"],
+      "slots": [
+        { "asset_group_id": "vast_start_tracker", "asset_type": "vast_tracker" }
+      ]
+    },
+    "tracker_execution_contract": {
+      "complete": true,
+      "honored": [
+        {
+          "selector_id": "vast-start",
+          "asset_type": "vast_tracker",
+          "vast_versions": ["4.2", "4.3"],
+          "vast_event": "start",
+          "target": "linear",
+          "execution_actor": "request_executor",
+          "firing_paths": ["client"]
+        }
+      ]
+    },
+    "execution_vast_version": "4.3",
+    "placement_refs": [
+      {
+        "publisher_domain": "publisher.example",
+        "placement_id": "preroll"
+      }
+    ],
+    "tracker_execution_contract_digest": "sha256:e916445d0d6619903d2a151388efa1dc8f260b0111d4437f94c1b53108708e29",
+    "product_snapshot_digest": "sha256:763e49570a0fc8c27e4e4562c9c1070620b1afcc20fab6936b542e012d0b7c68"
+  }
+}
diff --git a/static/compliance/source/test-vectors/tracker-execution-contracts.schema.json b/static/compliance/source/test-vectors/tracker-execution-contracts.schema.json
new file mode 100644
index 0000000000..0ae2ceff75
--- /dev/null
+++ b/static/compliance/source/test-vectors/tracker-execution-contracts.schema.json
@@ -0,0 +1,70 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "tracker-execution-contracts.schema.json",
+  "title": "Tracker execution contract vectors",
+  "type": "object",
+  "properties": {
+    "$schema": { "type": "string" },
+    "vectors": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "contract": { "$ref": "/schemas/core/tracker-execution-contract.json" },
+          "format_slots": {
+            "type": "array",
+            "items": { "$ref": "/schemas/formats/canonical/_base.json#/properties/slots/items" }
+          },
+          "tracker": {
+            "oneOf": [
+              { "$ref": "/schemas/core/assets/pixel-tracker-asset.json" },
+              { "$ref": "/schemas/core/assets/vast-tracker-asset.json" },
+              { "$ref": "/schemas/core/assets/daast-tracker-asset.json" }
+            ]
+          },
+          "execution_version": {
+            "type": "string",
+            "minLength": 1
+          },
+          "expected": {
+            "type": "object",
+            "properties": {
+              "status": {
+                "type": "string",
+                "enum": ["matched", "rejected", "undeclared"]
+              },
+              "selector_id": { "type": "string", "minLength": 1 },
+              "rejection_code": { "type": "string", "const": "tracker_contract_mismatch" }
+            },
+            "required": ["status"],
+            "additionalProperties": false
+          }
+        },
+        "required": ["name", "contract", "format_slots", "tracker", "expected"],
+        "additionalProperties": false
+      }
+    },
+    "derivation_vectors": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "parent": { "$ref": "/schemas/core/tracker-execution-contract.json" },
+          "child": { "$ref": "/schemas/core/tracker-execution-contract.json" },
+          "expected_valid": { "type": "boolean" }
+        },
+        "required": ["name", "parent", "child", "expected_valid"],
+        "additionalProperties": false
+      }
+    },
+    "package_snapshot": {
+      "$ref": "/schemas/core/package-format-snapshot.json"
+    }
+  },
+  "required": ["vectors", "derivation_vectors", "package_snapshot"],
+  "additionalProperties": false
+}
diff --git a/static/schemas/source/core/assets/asset-union.json b/static/schemas/source/core/assets/asset-union.json
index 635bfcb360..61dd747173 100644
--- a/static/schemas/source/core/assets/asset-union.json
+++ b/static/schemas/source/core/assets/asset-union.json
@@ -3,6 +3,7 @@
   "$id": "/schemas/core/assets/asset-union.json",
   "title": "AssetVariant",
   "description": "Canonical union of all asset variant schemas. Referenced from creative-asset.json and creative-manifest.json to ensure a single named type is emitted by schema-to-TypeScript tooling. Add new asset types here and to the creative/asset-types registry.",
+  "x-adcp-hoist": true,
   "type": "object",
   "oneOf": [
     { "$ref": "/schemas/core/assets/image-asset.json" },
diff --git a/static/schemas/source/core/assets/daast-tracker-asset.json b/static/schemas/source/core/assets/daast-tracker-asset.json
index f13fa79fb5..50173bef63 100644
--- a/static/schemas/source/core/assets/daast-tracker-asset.json
+++ b/static/schemas/source/core/assets/daast-tracker-asset.json
@@ -12,9 +12,7 @@
     },
     "daast_event": {
       "allOf": [
-        {
-          "$ref": "/schemas/enums/daast-tracking-event.json"
-        },
+        { "$ref": "/schemas/enums/daast-tracking-event.json" },
         {
           "not": {
             "enum": [
@@ -50,14 +48,14 @@
     },
     "offset": {
       "type": "string",
-      "description": "DAAST `offset` attribute. Required when `daast_event` is `progress` (DAAST 1.1 §3.2.4.3); ignored otherwise. Same format as VAST 4.2 `Tracking@offset`: `HH:MM:SS` or `HH:MM:SS.mmm` for absolute time (two-digit hours, minutes 00–59, seconds 00–59), or an integer percentage 0–100 suffixed with `%`. Negative offsets are NOT permitted.",
-      "pattern": "^(\\d{2}:[0-5]\\d:[0-5]\\d(\\.\\d{3})?|(100|\\d{1,2})%)$"
+      "pattern": "^(\\d{2}:[0-5]\\d:[0-5]\\d(\\.\\d{3})?|(100|\\d{1,2})%)$",
+      "description": "DAAST `offset` attribute. Required when `daast_event` is `progress` (DAAST 1.1 §3.2.4.3); ignored otherwise for compatibility with existing 3.x manifests. Same format as VAST 4.2 `Tracking@offset`: `HH:MM:SS` or `HH:MM:SS.mmm` for absolute time (two-digit hours, minutes 00–59, seconds 00–59), or an integer percentage 0–100 suffixed with `%`. Negative offsets are NOT permitted."
     },
     "target": {
       "type": "string",
       "enum": ["linear", "companion"],
       "default": "linear",
-      "description": "Which DAAST creative element this tracker scopes to — `linear` for `<Linear>/<TrackingEvents>` (DAAST 1.1 §3.2.1.7), `companion` for `<CompanionAds>/<Companion>/<TrackingEvents>` (DAAST 1.1 §3.2.2.7, where the only valid event is `creativeView`). DAAST has no `<NonLinearAds>` element. Defaults to `linear`. Sales agents use this to place the tracker in the correct location during DAAST assembly."
+      "description": "Which DAAST creative element this tracker scopes to — `linear` for `<Linear>/<TrackingEvents>` (DAAST 1.1 §3.2.1.7), `companion` for `<CompanionAds>/<Companion>/<TrackingEvents>` (DAAST 1.1 §3.2.2.7). DAAST has no `<NonLinearAds>` element. Defaults to `linear`. Existing 3.x assets remain structurally permissive; a tracker execution contract applies the standards-valid event/target matrix when matching a creative to a product."
     },
     "provenance": {
       "$ref": "/schemas/core/provenance.json",
diff --git a/static/schemas/source/core/assets/pixel-tracker-asset.json b/static/schemas/source/core/assets/pixel-tracker-asset.json
index 2c1b78c41d..ed9aec47b2 100644
--- a/static/schemas/source/core/assets/pixel-tracker-asset.json
+++ b/static/schemas/source/core/assets/pixel-tracker-asset.json
@@ -11,17 +11,8 @@
       "description": "Discriminator identifying this as a renderer-fired pixel tracker asset. See /schemas/creative/asset-types for the registry."
     },
     "event": {
-      "type": "string",
-      "enum": [
-        "impression",
-        "viewable_mrc_50",
-        "viewable_mrc_100",
-        "viewable_video_50",
-        "audible_video_complete",
-        "click",
-        "custom"
-      ],
-      "description": "Which event this tracker fires on. Event enum mirrors IAB OpenRTB Native 1.2 event-tracker registry (event types 1, 2, 3, 4, 500); the events themselves are generic web-pixel measurement events that apply to any renderer:\n- `impression` (IAB type 1) — fires when the ad is served. Covers both `imptrackers[]` and `jstracker` from the IAB shape, distinguished by `method`.\n- `viewable_mrc_50` (IAB type 2) — IAB MRC viewable, 50% pixels for ≥1 second.\n- `viewable_mrc_100` (IAB type 3) — IAB MRC viewable, 100% pixels for ≥1 second.\n- `viewable_video_50` (IAB type 4) — video-specific viewable, 50% pixels for ≥2 seconds with audio on. On video_hosted; ignored on image/html5.\n- `audible_video_complete` (IAB type 500) — video reached 100% completion with audio on. Distinct from `viewable_video_50` (50% pixels + 2s threshold) — this is the full-completion audible-view event. Meaningful on non-VAST video formats (Meta Reels, YouTube Shorts, TikTok Spark) where audible-complete is a measured event but VAST `<TrackingEvents>` isn't the wire format; VAST formats use `vast_tracker` with `vast_event: complete` plus a separate audible tracker instead.\n- `click` — fires when the user clicks the creative (`link.clicktrackers[]`).\n- `custom` — adopter-defined event for anything not in the standardized enum. MUST also set `custom_event_name`. Reserved for IAB Native event types 555+ (exchange-specific) and any vendor-defined event not yet promoted to a first-class enum value."
+      "$ref": "/schemas/enums/pixel-tracking-event.json",
+      "description": "Which event this tracker fires on. The event enum maps its first four measurement values to IAB OpenRTB Native 1.2 event types 1-4 and adds explicit AdCP events for renderer behavior that Native does not assign a standard event type:\n- `impression` (IAB type 1) — fires when the ad is served. Covers both `imptrackers[]` and `jstracker` from the IAB shape, distinguished by `method`.\n- `viewable_mrc_50` (IAB type 2) — IAB MRC viewable, 50% pixels for ≥1 second.\n- `viewable_mrc_100` (IAB type 3) — IAB MRC viewable, 100% pixels for ≥1 second.\n- `viewable_video_50` (IAB type 4) — video-specific viewable, 50% pixels for ≥2 seconds. Native type 4 does not require audio. On video_hosted; ignored on image/html5.\n- `audible_video_complete` (AdCP-defined) — video reached 100% completion with audio on. Native reserves event types 500+ for exchange-specific use and does not assign this event a standard numeric type. Meaningful on non-VAST video formats where audible-complete is measured but VAST `<TrackingEvents>` is not the wire format; VAST formats use `vast_tracker` with `vast_event: complete` plus a separate audible tracker instead.\n- `click` — fires when the user clicks the creative (`link.clicktrackers[]`).\n- `custom` — adopter-defined event for anything not in the standardized enum. MUST also set `custom_event_name`; it can represent Native's exchange-specific 500+ range or another qualified vendor event without assigning an IAB numeric identity."
     },
     "method": {
       "type": "string",
@@ -46,7 +37,7 @@
     },
     "custom_event_name": {
       "type": "string",
-      "description": "REQUIRED when `event` is `custom`; otherwise MUST be absent. Adopter-defined event name. Sellers without registered handling for a given custom_event_name MUST silently no-op (do not fire) rather than reject — custom events are forward-compatible probes."
+      "description": "REQUIRED when `event` is `custom`; otherwise MUST be absent. Adopter-defined event name. When tracker execution is undeclared, an unknown custom event is a forward-compatible probe and the seller silently no-ops instead of rejecting the creative. An effective tracker_execution_contract overrides that legacy fallback: with complete:true an unlisted custom selector is unsupported and rejects compatibility with tracker_contract_mismatch; a listed custom selector is an affirmative accept-and-initiate commitment."
     },
     "provenance": {
       "$ref": "/schemas/core/provenance.json",
diff --git a/static/schemas/source/core/assets/vast-tracker-asset.json b/static/schemas/source/core/assets/vast-tracker-asset.json
index 0efec7cc37..082deaff42 100644
--- a/static/schemas/source/core/assets/vast-tracker-asset.json
+++ b/static/schemas/source/core/assets/vast-tracker-asset.json
@@ -12,9 +12,7 @@
     },
     "vast_event": {
       "allOf": [
-        {
-          "$ref": "/schemas/enums/vast-tracking-event.json"
-        },
+        { "$ref": "/schemas/enums/vast-tracking-event.json" },
         {
           "not": {
             "enum": [
@@ -50,14 +48,14 @@
     },
     "offset": {
       "type": "string",
-      "description": "VAST `offset` attribute. Required when `vast_event` is `progress`; ignored otherwise. Format matches the VAST 4.2 XSD `Tracking@offset` pattern: `HH:MM:SS` or `HH:MM:SS.mmm` for absolute time (two-digit hours, minutes 00–59, seconds 00–59), or an integer percentage 0–100 suffixed with `%`. Negative offsets are NOT permitted — the VAST 4.2 XSD pattern does not allow a leading minus.",
-      "pattern": "^(\\d{2}:[0-5]\\d:[0-5]\\d(\\.\\d{3})?|(100|\\d{1,2})%)$"
+      "pattern": "^(\\d{2}:[0-5]\\d:[0-5]\\d(\\.\\d{3})?|(100|\\d{1,2})%)$",
+      "description": "VAST `offset` attribute. Required when `vast_event` is `progress`; ignored otherwise for compatibility with existing 3.x manifests. Format matches the VAST 4.2 XSD `Tracking@offset` pattern: `HH:MM:SS` or `HH:MM:SS.mmm` for absolute time (two-digit hours, minutes 00–59, seconds 00–59), or an integer percentage 0–100 suffixed with `%`. Negative offsets are NOT permitted — the VAST 4.2 XSD pattern does not allow a leading minus."
     },
     "target": {
       "type": "string",
       "enum": ["linear", "non_linear", "companion"],
       "default": "linear",
-      "description": "Which VAST creative element this tracker scopes to — `linear` for `<Linear>/<TrackingEvents>`, `non_linear` for `<NonLinearAds>/<TrackingEvents>`, `companion` for `<CompanionAds>/<Companion>/<TrackingEvents>`. VAST 4.2 places these under separate XML elements with separate event semantics (e.g., `acceptInvitation` is meaningful on non-linear / companion; `closeLinear` only on linear). Defaults to `linear`. Sales agents use this to place the tracker in the correct location during VAST assembly."
+      "description": "Which VAST creative element this tracker scopes to — `linear` for `<Linear>/<TrackingEvents>`, `non_linear` for `<NonLinearAds>/<TrackingEvents>`, `companion` for `<CompanionAds>/<Companion>/<TrackingEvents>`. Defaults to `linear`. Existing 3.x assets remain structurally permissive; a tracker execution contract applies the standards-valid event/target matrix when matching a creative to a product."
     },
     "provenance": {
       "$ref": "/schemas/core/provenance.json",
diff --git a/static/schemas/source/core/canonical-format-option.json b/static/schemas/source/core/canonical-format-option.json
index 47178bf7c5..9854ccdfd0 100644
--- a/static/schemas/source/core/canonical-format-option.json
+++ b/static/schemas/source/core/canonical-format-option.json
@@ -7,6 +7,10 @@
   "properties": {
     "format_option_id": { "type": "string", "minLength": 1 },
     "publisher_domain": { "type": "string", "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$" },
+    "tracker_execution_contract": {
+      "$ref": "/schemas/core/tracker-execution-contract.json",
+      "description": "Seller- or publisher-authored production commitment for first-class manifest tracker execution. Presence requires a stable format_option_id. Creative-agent projections MUST strip this authority-bearing field."
+    },
     "macro_resolution_capabilities": {
       "type": "array",
       "minItems": 1,
@@ -44,6 +48,14 @@
   },
   "required": ["format_kind", "params"],
   "allOf": [
+    {
+      "if": { "required": ["tracker_execution_contract"] },
+      "then": { "required": ["format_option_id"] }
+    },
+    {
+      "if": { "required": ["publisher_domain"] },
+      "then": { "required": ["format_option_id"] }
+    },
     {
       "if": { "properties": { "format_kind": { "const": "custom" } }, "required": ["format_kind"] },
       "then": { "required": ["format_shape", "format_schema", "canonical_formats_only"] },
diff --git a/static/schemas/source/core/creative-operation-format-declaration.json b/static/schemas/source/core/creative-operation-format-declaration.json
new file mode 100644
index 0000000000..dc6fe20269
--- /dev/null
+++ b/static/schemas/source/core/creative-operation-format-declaration.json
@@ -0,0 +1,124 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/core/creative-operation-format-declaration.json",
+  "title": "Creative Operation Format Declaration",
+  "description": "Authority-free canonical format declaration used by creative.supported_formats[]. It describes what a creative agent can build, validate, or preview. It preserves canonical parameter validation and creative-route macro processing capabilities, but MUST NOT carry seller production authority such as tracker_execution_contract or tracker_execution_contract_digest.",
+  "type": "object",
+  "required": ["format_kind", "params"],
+  "properties": {
+    "format_option_id": {
+      "type": "string",
+      "description": "Stable publisher- or product-declaration identity that this creative operation can satisfy. When publisher_domain is present, this field is required."
+    },
+    "publisher_domain": {
+      "type": "string",
+      "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$",
+      "description": "Publisher namespace for format_option_id when this operation claims compatibility with a publisher declaration."
+    },
+    "macro_resolution_capabilities": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "/schemas/core/macro-resolution-capability.json" },
+      "description": "Creative-route processing capabilities for exact macro dialect identities, semantics, operations, actors, contexts, and encodings. These capabilities describe build, validation, or preview processing and do not grant seller production authority.",
+      "x-adcp-validation": {
+        "verifier_constraints": {
+          "translation_chain_closure": "every translate_to_native entry must have an exact matching resolve_value entry for its translation_target in this same array"
+        }
+      }
+    },
+    "technical_requirements_complete": { "type": "boolean" },
+    "display_name": { "type": "string" },
+    "sample_render_url": { "type": "string", "format": "uri", "pattern": "^https://" },
+    "applies_to_channels": {
+      "type": "array",
+      "items": { "$ref": "/schemas/enums/channels.json" },
+      "uniqueItems": true
+    },
+    "seller_preference": { "type": "string", "enum": ["preferred", "accepted", "discouraged"] },
+    "locale_policy": { "$ref": "/schemas/core/creative-locale-policy.json" },
+    "canonical_formats_only": { "type": "boolean", "default": false },
+    "experimental": { "type": "boolean", "default": false },
+    "format_shape": { "type": "string" },
+    "v1_format_ref": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "/schemas/core/format-id.json" }
+    },
+    "format_schema": { "$ref": "/schemas/core/platform-extension-ref.json" },
+    "format_kind": {
+      "$ref": "/schemas/core/canonical-format-kind.json"
+    },
+    "params": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Canonical creative-shape parameters. Validate against the schema selected by format_kind; custom params validate against the fetched format_schema."
+    }
+  },
+  "allOf": [
+    {
+      "$comment": "Creative operation declarations never carry seller production authority. The explicit prohibition remains effective even though the object is open for forward-compatible creative metadata.",
+      "not": {
+        "anyOf": [
+          { "required": ["tracker_execution_contract"] },
+          { "required": ["tracker_execution_contract_digest"] }
+        ]
+      }
+    },
+    {
+      "if": { "required": ["publisher_domain"] },
+      "then": { "required": ["format_option_id"] }
+    },
+    {
+      "if": {
+        "properties": { "format_kind": { "const": "custom" } },
+        "required": ["format_kind"]
+      },
+      "then": {
+        "required": ["format_shape", "format_schema"],
+        "anyOf": [
+          {
+            "properties": { "canonical_formats_only": { "const": true } },
+            "required": ["canonical_formats_only"]
+          },
+          { "required": ["v1_format_ref"] }
+        ]
+      },
+      "else": {
+        "not": {
+          "anyOf": [
+            { "required": ["format_shape"] },
+            { "required": ["format_schema"] }
+          ]
+        }
+      }
+    },
+    {
+      "not": {
+        "allOf": [
+          {
+            "properties": { "canonical_formats_only": { "const": true } },
+            "required": ["canonical_formats_only"]
+          },
+          { "required": ["v1_format_ref"] }
+        ]
+      }
+    },
+    { "not": { "required": ["capability_id"] } },
+    {
+      "if": { "required": ["locale_policy"] },
+      "then": {
+        "properties": { "canonical_formats_only": { "const": true } },
+        "required": ["canonical_formats_only"]
+      }
+    }
+  ],
+  "x-adcp-validation": {
+    "verifier_constraints": {
+      "canonical_params": {
+        "non_custom": "validate params against /schemas/formats/canonical/{format_kind}.json",
+        "custom": "validate params against fetched format_schema uri and digest",
+        "on_violation": "reject_capability_declaration"
+      }
+    }
+  }
+}
diff --git a/static/schemas/source/core/daast-tracker-constraints.json b/static/schemas/source/core/daast-tracker-constraints.json
new file mode 100644
index 0000000000..ce6049af15
--- /dev/null
+++ b/static/schemas/source/core/daast-tracker-constraints.json
@@ -0,0 +1,100 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/core/daast-tracker-constraints.json",
+  "title": "DAAST Tracker Constraints",
+  "description": "Shared DAAST tracker vocabulary and execution-selector constraints. The legacy asset vocabulary retains AdCP's historical close extension, while the closed standards selector matrix excludes it. Progress alone carries offset in selectors.",
+  "type": "object",
+  "definitions": {
+    "daast_event": {
+      "type": "string",
+      "enum": [
+        "creativeView",
+        "start",
+        "firstQuartile",
+        "midpoint",
+        "thirdQuartile",
+        "complete",
+        "mute",
+        "unmute",
+        "pause",
+        "resume",
+        "rewind",
+        "skip",
+        "progress",
+        "close"
+      ]
+    },
+    "daast_target": {
+      "type": "string",
+      "enum": ["linear", "companion"],
+      "default": "linear"
+    },
+    "daast_offset": {
+      "type": "string",
+      "pattern": "^(\\d{2}:[0-5]\\d:[0-5]\\d(\\.\\d{3})?|(100|\\d{1,2})%)$"
+    },
+    "daast_versions": {
+      "type": "array",
+      "items": { "$ref": "/schemas/enums/daast-version.json" },
+      "minItems": 1,
+      "uniqueItems": true
+    }
+  },
+  "properties": {
+    "daast_event": { "$ref": "#/definitions/daast_event" },
+    "target": { "$ref": "#/definitions/daast_target" },
+    "offset": { "$ref": "#/definitions/daast_offset" },
+    "daast_versions": { "$ref": "#/definitions/daast_versions" }
+  },
+  "allOf": [
+    {
+      "if": {
+        "anyOf": [
+          { "not": { "required": ["target"] } },
+          {
+            "properties": { "target": { "const": "linear" } },
+            "required": ["target"]
+          }
+        ]
+      },
+      "then": {
+        "properties": {
+          "daast_event": {
+            "enum": [
+              "creativeView",
+              "start",
+              "firstQuartile",
+              "midpoint",
+              "thirdQuartile",
+              "complete",
+              "mute",
+              "unmute",
+              "pause",
+              "resume",
+              "rewind",
+              "skip",
+              "progress"
+            ]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "target": { "const": "companion" } },
+        "required": ["target"]
+      },
+      "then": {
+        "properties": { "daast_event": { "const": "creativeView" } }
+      }
+    },
+    {
+      "if": {
+        "properties": { "daast_event": { "const": "progress" } },
+        "required": ["daast_event"]
+      },
+      "then": { "required": ["offset"] },
+      "else": { "not": { "required": ["offset"] } }
+    }
+  ]
+}
diff --git a/static/schemas/source/core/format.json b/static/schemas/source/core/format.json
index 0ad2665f8f..d4a1791dee 100644
--- a/static/schemas/source/core/format.json
+++ b/static/schemas/source/core/format.json
@@ -708,9 +708,19 @@
       "description": "Optional v2 canonical-projection annotation. Always an object — bare-string shorthand (`canonical: \"image\"`) is not supported; the minimal form is `canonical: { \"kind\": \"image\" }`. Carries `kind` (which canonical the v1 format projects to) plus optional `asset_source` and `slots_override` for cases where the v1 format's shape doesn't follow the canonical's defaults (e.g., generative entries whose input is `generation_prompt: text` instead of `image_main: image`).\n\nWhen set, SDKs use this annotation as the authoritative v1 → v2 mapping for this format, bypassing the [v1 canonical mapping registry](/schemas/registries/v1-canonical-mapping.json) lookup. Combined with the slot-level `asset_group_id` declarations on each `assets[i]` entry, a v1 format declaration with `canonical` set is fully self-describing for v1↔v2 translation.\n\nResolution order for SDK projection from v1 wire shape to v2 (per RFC #3305 amendment #3767):\n1. If this `canonical` field is set, use it (seller-declared, highest priority). Apply `asset_source` and `slots_override` from the projection ref when present; otherwise inherit the canonical's defaults.\n2. Else, look up `format_id` in the canonical mapping registry's `format_id_glob` entries.\n3. Else, attempt structural match against the registry's `structural` entries (asset types, slot shape, vast_versions, etc.).\n4. Else, fail closed: SDK MUST NOT emit `format_options` for products carrying this format. Surface `FORMAT_PROJECTION_FAILED` on the response `errors[]` suggesting the seller add an explicit `canonical` annotation or file a registry entry.\n\nWhen `canonical.kind` is `custom`, the seller MUST also declare `canonical_format_shape` and `canonical_format_schema` (parallel to ProductFormatDeclaration's `format_shape` and `format_schema`) so buyer SDKs can fetch the seller's custom format schema.\n\nSee `canonical-projection-ref.json` for full projection semantics and examples (default-slot case, generative case, brief-driven case)."
     },
     "canonical_parameters": {
-      "$ref": "/schemas/core/product-format-declaration.json",
       "deprecated": true,
-      "description": "**DEPRECATED in 3.1. Removed at 4.0.** Use `v1_format_ref` on the v2 `ProductFormatDeclaration` instead — the seller authors a v2 declaration (in `Product.format_options` or `creative.supported_formats`) and links it back to this v1 format via `v1_format_ref: { agent_url, id }`. The directional link from v2 → v1 is the same fact as `canonical_parameters` without the parallel-shape drift surface (v1 file and `canonical_parameters` were two declarations of the same thing; hand-authored, drifting silently).\n\nMigration: every seller currently authoring `canonical_parameters` SHOULD migrate to authoring a v2 declaration on the corresponding product (or capability) with `v1_format_ref` pointing back at this v1 format. v1 files become pure v1 again — no v2-shape mirroring.\n\n*Legacy behavior, retained for 3.1–3.x backward compatibility:* When `canonical` is set, this field carries the full ProductFormatDeclaration that the SDK projects this v1 format into. The `format_kind` MUST equal the `canonical` field value (validators enforce). When set, this is the authoritative source for SDK v1→v2 projection — the registry's structural-match parameter inference is bypassed. SDKs reading 3.1 catalogs MUST continue to honor `canonical_parameters` when present; 4.0+ SDKs MAY reject the field. New code SHOULD NOT emit this field.\n\n**Drift contract (still normative while supported).** Hand-authored `canonical_parameters` MUST satisfy the *narrows* relation against this v1 format's `requirements` and `assets[*]` shape (see canonical-formats.mdx 'Narrows — formal definition'). SDKs that read this v1 file SHOULD lint-time check the equivalence at build/load and emit `FORMAT_PROJECTION_FAILED` if the two disagree."
+      "description": "**DEPRECATED in 3.1. Removed at 4.0.** Use `v1_format_ref` on the v2 `ProductFormatDeclaration` instead — the seller authors a v2 declaration (in `Product.format_options` or `creative.supported_formats`) and links it back to this v1 format via `v1_format_ref: { agent_url, id }`. The directional link from v2 → v1 is the same fact as `canonical_parameters` without the parallel-shape drift surface (v1 file and `canonical_parameters` were two declarations of the same thing; hand-authored, drifting silently).\n\nMigration: every seller currently authoring `canonical_parameters` SHOULD migrate to authoring a v2 declaration on the corresponding product (or capability) with `v1_format_ref` pointing back at this v1 format. v1 files become pure v1 again — no v2-shape mirroring.\n\n*Legacy behavior, retained for 3.1–3.x backward compatibility:* When `canonical` is set, this field carries the full ProductFormatDeclaration that the SDK projects this v1 format into. The `format_kind` MUST equal the `canonical` field value (validators enforce). When set, this is the authoritative source for SDK v1→v2 projection — the registry's structural-match parameter inference is bypassed. SDKs reading 3.1 catalogs MUST continue to honor `canonical_parameters` when present; 4.0+ SDKs MAY reject the field. New code SHOULD NOT emit this field. Seller execution authority is never projected through this deprecated field, so tracker_execution_contract and tracker_execution_contract_digest are forbidden.\n\n**Drift contract (still normative while supported).** Hand-authored `canonical_parameters` MUST satisfy the *narrows* relation against this v1 format's `requirements` and `assets[*]` shape (see canonical-formats.mdx 'Narrows — formal definition'). SDKs that read this v1 file SHOULD lint-time check the equivalence at build/load and emit `FORMAT_PROJECTION_FAILED` if the two disagree.",
+      "allOf": [
+        { "$ref": "/schemas/core/product-format-declaration.json" },
+        {
+          "not": {
+            "anyOf": [
+              { "required": ["tracker_execution_contract"] },
+              { "required": ["tracker_execution_contract_digest"] }
+            ]
+          }
+        }
+      ]
     }
   },
   "required": [
diff --git a/static/schemas/source/core/package-format-snapshot.json b/static/schemas/source/core/package-format-snapshot.json
new file mode 100644
index 0000000000..8579f77b3d
--- /dev/null
+++ b/static/schemas/source/core/package-format-snapshot.json
@@ -0,0 +1,77 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/core/package-format-snapshot.json",
+  "title": "Package Format Snapshot",
+  "description": "Immutable package-time snapshot of one selected Product format declaration. Product-format fields remain flattened at the root for 3.x compatibility; product, placement, exact execution-version, and digest fields bind the seller's package-time decision. A contract-bearing snapshot is durably identified even when no preview or observation feature is offered.",
+  "type": "object",
+  "properties": {
+    "product_id": {
+      "type": "string",
+      "minLength": 1,
+      "x-entity": "product",
+      "description": "Product whose effective selected format was snapshotted. Required whenever tracker_execution_contract is present."
+    },
+    "placement_refs": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "allOf": [
+          { "$ref": "/schemas/core/placement-ref.json" },
+          { "required": ["publisher_domain"] }
+        ]
+      },
+      "description": "Nonempty, duplicate-free effective placement set, sorted by publisher_domain then placement_id using ascending UTF-8 bytes without Unicode normalization. Omission binds the product-wide common effective contract; it never means an inferred list of all current placements."
+    },
+    "execution_vast_version": {
+      "$ref": "/schemas/enums/vast-version.json",
+      "description": "Exact VAST execution version selected for first-class VAST tracker matching when no sibling delivery document supplies one. The value is immutable for the package."
+    },
+    "execution_daast_version": {
+      "$ref": "/schemas/enums/daast-version.json",
+      "description": "Exact DAAST execution version selected for first-class DAAST tracker matching when no sibling delivery document supplies one. The value is immutable for the package."
+    },
+    "tracker_execution_contract_digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "description": "SHA-256 of RFC 8785 canonical JSON for tracker_execution_contract alone. Required if and only if the snapshot contains that contract."
+    },
+    "product_snapshot_digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "description": "Immutable SHA-256 digest of the package format snapshot's closed product-binding preimage. Required for every contract-bearing snapshot and paired with product_id whenever present."
+    }
+  },
+  "required": ["format_kind", "params"],
+  "allOf": [
+    { "$ref": "/schemas/core/product-format-declaration.json" },
+    {
+      "if": { "required": ["tracker_execution_contract"] },
+      "then": {
+        "required": [
+          "format_option_id",
+          "product_id",
+          "tracker_execution_contract_digest",
+          "product_snapshot_digest"
+        ]
+      },
+      "else": {
+        "not": { "required": ["tracker_execution_contract_digest"] }
+      }
+    },
+    {
+      "if": { "required": ["product_snapshot_digest"] },
+      "then": { "required": ["product_id"] }
+    }
+  ],
+  "x-adcp-validation": {
+    "verifier_constraints": {
+      "tracker_execution_contract_digest": "lowercase-hex SHA-256 of RFC 8785 canonical JSON of tracker_execution_contract alone, with transmitted values and no materialized defaults",
+      "product_snapshot_digest": "lowercase-hex SHA-256 of RFC 8785 canonical JSON of the closed object {product_id, format, placement_refs?, execution_vast_version?, execution_daast_version?, tracker_execution_contract_digest?}; format contains every transmitted ProductFormatDeclaration field and excludes every package-only field",
+      "placement_order": "placement_refs sorted by publisher_domain then placement_id using ascending transmitted UTF-8 bytes without Unicode normalization",
+      "execution_version": "when a first-class VAST or DAAST tracker selector has no sibling exact-version delivery document, the matching execution_*_version is required and belongs to the selected option acceptance set",
+      "immutability": "changing selected format, placement set, execution version, or tracker contract requires a replacement package_id; never mutate this snapshot in place"
+    }
+  },
+  "additionalProperties": true
+}
diff --git a/static/schemas/source/core/package.json b/static/schemas/source/core/package.json
index edad086572..9594e9a363 100644
--- a/static/schemas/source/core/package.json
+++ b/static/schemas/source/core/package.json
@@ -184,17 +184,27 @@
     },
     "formats_to_provide": {
       "type": "array",
-      "description": "Canonical creative contracts that the buyer must satisfy for this package. Each entry is a package-time snapshot of a selected Product.format_options declaration (or the equivalent declaration normalized from a direct format_kind + params selector) and MUST equal or narrow that product contract. Full declarations keep the requirement stable if the live product or publisher catalog later changes and remain usable when format_option_id is absent. Sellers SHOULD emit this field whenever additional creative coverage is required.",
+      "description": "Immutable canonical creative contracts established for this package. Each entry is a PackageFormatSnapshot of the selected effective Product format declaration. A package whose selected format carries tracker_execution_contract MUST retain and return this checklist even after creative coverage is complete; the live Product is never substituted for the package snapshot.",
       "items": {
-        "$ref": "/schemas/core/product-format-declaration.json"
+        "$ref": "/schemas/core/package-format-snapshot.json"
       },
-      "minItems": 1
+      "minItems": 1,
+      "x-adcp-validation": {
+        "verifier_constraints": {
+          "snapshot_identity": "every present product_snapshot_digest is unique within the package; contract-bearing snapshots always carry one"
+        }
+      }
     },
     "formats_pending": {
       "type": "array",
-      "description": "The declarations from formats_to_provide that do not yet have creative coverage through sync_creatives or inline creative assignment. An empty emitted array means every required format is covered. Absence means readiness was not reported, so buyers MUST NOT infer full coverage from omission. Sellers SHOULD emit this field with formats_to_provide when returning current package readiness.",
+      "description": "PackageFormatSnapshot entries from formats_to_provide that do not yet have creative coverage through sync_creatives or inline assignment. Every entry MUST equal its formats_to_provide snapshot after RFC 8785 canonicalization and, when product_snapshot_digest is present, carry the identical digest. An empty emitted array means every required format is covered. Absence means readiness was not reported.",
       "items": {
-        "$ref": "/schemas/core/product-format-declaration.json"
+        "$ref": "/schemas/core/package-format-snapshot.json"
+      },
+      "x-adcp-validation": {
+        "verifier_constraints": {
+          "subset_identity": "every item equals exactly one formats_to_provide item after RFC 8785 canonicalization and, when product_snapshot_digest is present, carries the identical digest"
+        }
       }
     },
     "format_ids_to_provide": {
@@ -322,6 +332,32 @@
           }
         }
       }
+    },
+    {
+      "if": {
+        "anyOf": [
+          {
+            "properties": {
+              "formats_to_provide": {
+                "contains": { "required": ["tracker_execution_contract"] }
+              }
+            },
+            "required": ["formats_to_provide"]
+          },
+          {
+            "properties": {
+              "formats_pending": {
+                "contains": { "required": ["tracker_execution_contract"] }
+              }
+            },
+            "required": ["formats_pending"]
+          }
+        ]
+      },
+      "then": {
+        "required": ["product_id"],
+        "properties": { "product_id": { "minLength": 1 } }
+      }
     }
   ],
   "dependencies": {
@@ -329,5 +365,12 @@
       "format_kind"
     ]
   },
+  "x-adcp-validation": {
+    "verifier_constraints": {
+      "package_snapshot_product": "every formats_to_provide and formats_pending item product_id equals the enclosing package product_id; a contract-bearing snapshot requires the enclosing product_id",
+      "contract_snapshot_required": "a selected format carrying tracker_execution_contract requires the enclosing product_id and a retained nonempty formats_to_provide checklist even when formats_pending is empty",
+      "snapshot_immutability": "a selected format, placement set, exact execution version, or tracker contract change creates a replacement package_id rather than mutating an existing snapshot"
+    }
+  },
   "additionalProperties": true
 }
diff --git a/static/schemas/source/core/product-format-declaration.json b/static/schemas/source/core/product-format-declaration.json
index 9504317349..48c1685f7a 100644
--- a/static/schemas/source/core/product-format-declaration.json
+++ b/static/schemas/source/core/product-format-declaration.json
@@ -16,6 +16,10 @@
       "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$",
       "description": "Namespace for `format_option_id` when this declaration references or narrows a publisher-declared format option from that publisher's adagents.json top-level `formats[]`. Product-local options omit this field and are selected by `format_option_id` within the target product."
     },
+    "tracker_execution_contract": {
+      "$ref": "/schemas/core/tracker-execution-contract.json",
+      "description": "Seller- or publisher-authored commitment describing which first-class manifest trackers the selected format option accepts and initiates in production. The seller-returned Product declaration is binding; publisher and placement declarations are upstream inputs that the seller resolves into that effective contract. Presence requires a stable format_option_id. Creative-agent capability projections, transformer inputs, and deprecated canonical_parameters MUST reject this seller-authority field rather than copying it."
+    },
     "macro_resolution_capabilities": {
       "type": "array",
       "minItems": 1,
@@ -82,6 +86,14 @@
     }
   },
   "allOf": [
+    {
+      "$comment": "A production tracker commitment must be durably addressable; ID-less unique-kind declarations cannot carry seller execution authority.",
+      "if": { "required": ["tracker_execution_contract"] },
+      "then": {
+        "required": ["format_option_id"],
+        "properties": { "format_option_id": { "minLength": 1 } }
+      }
+    },
     {
       "$comment": "Publisher-scoped canonical declarations are addressable only by the complete {publisher_domain, format_option_id} identity pair.",
       "if": {
diff --git a/static/schemas/source/core/representation-destination.json b/static/schemas/source/core/representation-destination.json
index 13aa7a1320..35b855c371 100644
--- a/static/schemas/source/core/representation-destination.json
+++ b/static/schemas/source/core/representation-destination.json
@@ -8,7 +8,8 @@
       "seller_authority": "the build_creative endpoint MUST be the sales agent that owns product_id",
       "current_product_match": "format_option MUST exactly match one effective current format option for product_id after every applicable placement and publisher narrowing",
       "placement_scope": "when placement_refs is omitted, the representation must satisfy the common effective contract for every placement where the product may deliver",
-      "execution_intersection": "resolution additionally intersects the seller's current media_buy.execution.creative_specs VAST and macro ceilings; the request does not override those capabilities"
+      "execution_intersection": "resolution additionally intersects the seller's current media_buy.execution.creative_specs VAST and macro ceilings; the request does not override those capabilities",
+      "tracker_execution_version": "when a candidate contains first-class vast_tracker or daast_tracker assets and no sibling VAST/DAAST delivery document supplies one exact version, the matching execution_*_version is required, MUST belong to the destination acceptance set, and MUST be preserved in representation_selection; the seller MUST NOT guess or defer it to a later package"
     },
     "spec": "docs/creative/representation-sets.mdx#seller-bound-resolution"
   },
@@ -30,6 +31,14 @@
       "uniqueItems": true,
       "items": { "$ref": "/schemas/core/placement-ref.json" },
       "description": "Optional placements the derived manifest must satisfy. Omission means every placement in the intended product route, not an unconstrained destination."
+    },
+    "execution_vast_version": {
+      "$ref": "/schemas/enums/vast-version.json",
+      "description": "Exact VAST execution version selected for seller-assembled first-class VAST trackers when no sibling exact-version VAST document supplies it. Must be accepted by format_option and is preserved in selection lineage."
+    },
+    "execution_daast_version": {
+      "$ref": "/schemas/enums/daast-version.json",
+      "description": "Exact DAAST execution version selected for seller-assembled first-class DAAST trackers when no sibling exact-version DAAST document supplies it. Must be accepted by format_option and is preserved in selection lineage."
     }
   },
   "required": ["product_id", "format_option"],
diff --git a/static/schemas/source/core/representation-rejection.json b/static/schemas/source/core/representation-rejection.json
index b369408428..c80399818c 100644
--- a/static/schemas/source/core/representation-rejection.json
+++ b/static/schemas/source/core/representation-rejection.json
@@ -14,6 +14,7 @@
         "unsupported_delivery_type",
         "vast_version_mismatch",
         "macro_unsupported",
+        "tracker_contract_mismatch",
         "asset_requirement_failed",
         "other"
       ]
diff --git a/static/schemas/source/core/representation-selection.json b/static/schemas/source/core/representation-selection.json
index 9e26f37c41..a9b0702c6b 100644
--- a/static/schemas/source/core/representation-selection.json
+++ b/static/schemas/source/core/representation-selection.json
@@ -17,7 +17,8 @@
         "canonical_content": "RFC 8785 JCS of the manifest projection after removing exactly top-level $schema, representation_selection, creative_id, revision_id, name, tags, status, weight, placement_refs, placement_ids, and inputs properties; every other field, including unknown delivery fields, is included",
         "shared_projection": "apply the same exclusion list to the returned CreativeManifest and to its later CreativeAsset sync wrapper so library metadata never changes the digest",
         "selected_output_digest": "must equal lowercase-hex SHA-256 of derived-output canonical content before receiving-seller normalization",
-        "review_identity": "the receiving seller tracks selected_representation_id plus selected_output_digest separately from the source revision; changing either is an updated execution that follows ordinary re-review without minting a buyer revision",
+        "review_identity": "the receiving seller tracks (selected_representation_id, selected_output_digest, execution_vast_version-or-null, execution_daast_version-or-null) separately from the source revision; changing any member is an updated execution that follows ordinary re-review without minting a buyer revision",
+        "execution_version": "each execution version MUST equal the verified representation destination and later immutable package snapshot; a package mismatch requires re-resolution and ordinary re-review rather than silent rebinding",
         "approval_boundary": "the exact selected output MUST complete the receiving seller's ordinary validation and review before serving; approval of one candidate never approves another",
         "runtime_selection": "selection is pinned at trafficking time and MUST NOT be changed per viewer or device; device and player fallback stays within the selected manifest or VAST document",
         "selection_stability": "after sync_creatives accepts this lineage, later product, placement, VAST, macro, or seller-capability changes MUST NOT cause implicit re-resolution, lineage replacement, or buyer re-review; only an explicit buyer-submitted selected output may replace it",
@@ -49,6 +50,14 @@
       "pattern": "^sha256:[a-f0-9]{64}$",
       "description": "Digest of the derived seller-bound manifest projection, computed with RFC 8785 JCS after removing exactly top-level `$schema`, `representation_selection`, `creative_id`, `revision_id`, `name`, `tags`, `status`, `weight`, `placement_refs`, `placement_ids`, and `inputs`. Every other field, including unknown delivery fields, is included. The identical exclusion list applies to the returned CreativeManifest and its later CreativeAsset sync wrapper. A selected sync item cannot carry localization in this version. This is the review/execution fingerprint for the projection, distinct from revision_content_digest, which binds the complete source set."
     },
+    "execution_vast_version": {
+      "$ref": "/schemas/enums/vast-version.json",
+      "description": "Exact VAST version verified for seller-assembled first-class VAST trackers. This is selection lineage and part of the execution review identity; it is not included in selected_output_digest."
+    },
+    "execution_daast_version": {
+      "$ref": "/schemas/enums/daast-version.json",
+      "description": "Exact DAAST version verified for seller-assembled first-class DAAST trackers. This is selection lineage and part of the execution review identity; it is not included in selected_output_digest."
+    },
     "resolved_by": {
       "type": "string",
       "enum": ["buyer", "seller"],
diff --git a/static/schemas/source/core/requirements/daast-asset-requirements.json b/static/schemas/source/core/requirements/daast-asset-requirements.json
index 18ce2b5658..cc7159ee9b 100644
--- a/static/schemas/source/core/requirements/daast-asset-requirements.json
+++ b/static/schemas/source/core/requirements/daast-asset-requirements.json
@@ -6,10 +6,15 @@
   "type": "object",
   "properties": {
     "daast_version": {
-      "type": "string",
-      "enum": ["1.0"],
-      "description": "Required DAAST version. DAAST 1.0 is the current IAB standard."
+      "$ref": "/schemas/enums/daast-version.json",
+      "deprecated": true,
+      "description": "Deprecated one-element alias for `daast_versions`. Producers use either the singular legacy alias or the plural 3.2 field, never both."
+    },
+    "daast_versions": {
+      "$ref": "/schemas/core/daast-tracker-constraints.json#/definitions/daast_versions",
+      "description": "Accepted DAAST version set for this asset requirement."
     }
   },
-  "additionalProperties": true
+  "additionalProperties": true,
+  "not": { "required": ["daast_version", "daast_versions"] }
 }
diff --git a/static/schemas/source/core/tracker-execution-contract.json b/static/schemas/source/core/tracker-execution-contract.json
new file mode 100644
index 0000000000..5180d0682b
--- /dev/null
+++ b/static/schemas/source/core/tracker-execution-contract.json
@@ -0,0 +1,30 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/core/tracker-execution-contract.json",
+  "title": "Tracker Execution Contract",
+  "description": "Seller-authored production commitment for first-class buyer-supplied tracker occurrences accepted by one effective product format option. Listed selectors are affirmative commitments. When complete is true, every unlisted combination is explicitly unsupported; when false, omissions are undeclared.",
+  "type": "object",
+  "properties": {
+    "complete": {
+      "type": "boolean",
+      "description": "Whether honored is the complete set. complete:true with an empty honored array explicitly supports no buyer-supplied trackers."
+    },
+    "honored": {
+      "type": "array",
+      "items": { "$ref": "/schemas/core/tracker-execution-selector.json" },
+      "uniqueItems": true,
+      "description": "Exact tracker/event selectors the seller accepts and initiates once per manifest instance for each logical event occurrence. selector_id and structural selector identity are each unique within this array."
+    }
+  },
+  "required": ["complete", "honored"],
+  "x-adcp-validation": {
+    "selector_id_unique": true,
+    "structural_selector_identity_unique": true,
+    "version_sets": "For one non-version selector identity, version sets must be identical or disjoint; overlapping unequal sets are invalid.",
+    "asset_normalization": "Before selector matching, omitted pixel_tracker.method becomes img, omitted VAST/DAAST target becomes linear, and offset on a non-progress asset is ignored and removed. Existing 3.x asset schemas remain structurally permissive; the selector schema supplies the closed event/target matrix for contract matching.",
+    "format_slot_satisfiability": "Every asset_type named by honored MUST have at least one matching first-class slot in the effective selected canonical format declaration. A contract cannot promise execution for an asset shape that the same format rejects structurally.",
+    "layer_derivation": "Publisher, placement, and seller effective-contract derivation is evaluated over atomic tuples of normalized non-version selector identity, one exact version (or null for pixel), execution_actor, and one firing_path. For a complete parent, every child tuple MUST exist in the parent, the child remains complete, and array compression MUST NOT create a version/path cross-product. An incomplete or omitted parent is not a ceiling: a child may add or omit affirmative tuples for its narrower scope, but remains incomplete until every applicable layer is complete. Omission from an incomplete child is undeclared, not an assertion that the tuple is unsupported.",
+    "cardinality": "Each accepted manifest tracker instance is initiated exactly once in total for each logical event occurrence; identical URLs are not deduplicated."
+  },
+  "additionalProperties": false
+}
diff --git a/static/schemas/source/core/tracker-execution-selector.json b/static/schemas/source/core/tracker-execution-selector.json
new file mode 100644
index 0000000000..5faf9da631
--- /dev/null
+++ b/static/schemas/source/core/tracker-execution-selector.json
@@ -0,0 +1,164 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/core/tracker-execution-selector.json",
+  "title": "Tracker Execution Selector",
+  "description": "One exact first-class manifest tracker selector in a seller production execution contract. AdCP 3.2 supports pixel_tracker, vast_tracker, and daast_tracker only; URL-slot selectors are not part of this union.",
+  "oneOf": [
+    {
+      "type": "object",
+      "properties": {
+        "selector_id": {
+          "type": "string",
+          "minLength": 1,
+          "x-entity": "tracker_execution_selector",
+          "description": "Stable identifier unique within the materialized execution contract."
+        },
+        "asset_type": {
+          "type": "string",
+          "const": "pixel_tracker"
+        },
+        "event": { "$ref": "/schemas/enums/pixel-tracking-event.json" },
+        "method": {
+          "type": "string",
+          "const": "img",
+          "description": "AdCP 3.2 execution contracts cover image-pixel initiation only; JavaScript response evaluation is outside this contract version."
+        },
+        "custom_event_name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Required only when event is custom."
+        },
+        "execution_actor": {
+          "$ref": "/schemas/enums/tracker-execution-actor.json"
+        },
+        "firing_paths": {
+          "type": "array",
+          "items": { "$ref": "/schemas/enums/tracker-firing-path.json" },
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Complete set of permitted initiation environments. Exactly one path is selected for each logical event occurrence."
+        }
+      },
+      "required": [
+        "selector_id",
+        "asset_type",
+        "event",
+        "method",
+        "execution_actor",
+        "firing_paths"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": { "event": { "const": "custom" } },
+            "required": ["event"]
+          },
+          "then": { "required": ["custom_event_name"] },
+          "else": { "not": { "required": ["custom_event_name"] } }
+        }
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "selector_id": {
+          "type": "string",
+          "minLength": 1,
+          "x-entity": "tracker_execution_selector",
+          "description": "Stable identifier unique within the materialized execution contract."
+        },
+        "asset_type": {
+          "type": "string",
+          "const": "vast_tracker"
+        },
+        "vast_versions": {
+          "$ref": "/schemas/core/vast-tracker-constraints.json#/definitions/vast_versions"
+        },
+        "vast_event": {
+          "$ref": "/schemas/core/vast-tracker-constraints.json#/definitions/vast_event"
+        },
+        "target": {
+          "$ref": "/schemas/core/vast-tracker-constraints.json#/definitions/vast_target"
+        },
+        "offset": {
+          "$ref": "/schemas/core/vast-tracker-constraints.json#/definitions/vast_offset"
+        },
+        "execution_actor": {
+          "$ref": "/schemas/enums/tracker-execution-actor.json"
+        },
+        "firing_paths": {
+          "type": "array",
+          "items": { "$ref": "/schemas/enums/tracker-firing-path.json" },
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Complete set of permitted initiation environments. Exactly one path is selected for each logical event occurrence."
+        }
+      },
+      "required": [
+        "selector_id",
+        "asset_type",
+        "vast_versions",
+        "vast_event",
+        "target",
+        "execution_actor",
+        "firing_paths"
+      ],
+      "allOf": [
+        { "$ref": "/schemas/core/vast-tracker-constraints.json" }
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "selector_id": {
+          "type": "string",
+          "minLength": 1,
+          "x-entity": "tracker_execution_selector",
+          "description": "Stable identifier unique within the materialized execution contract."
+        },
+        "asset_type": {
+          "type": "string",
+          "const": "daast_tracker"
+        },
+        "daast_versions": {
+          "$ref": "/schemas/core/daast-tracker-constraints.json#/definitions/daast_versions"
+        },
+        "daast_event": {
+          "$ref": "/schemas/core/daast-tracker-constraints.json#/definitions/daast_event"
+        },
+        "target": {
+          "$ref": "/schemas/core/daast-tracker-constraints.json#/definitions/daast_target"
+        },
+        "offset": {
+          "$ref": "/schemas/core/daast-tracker-constraints.json#/definitions/daast_offset"
+        },
+        "execution_actor": {
+          "$ref": "/schemas/enums/tracker-execution-actor.json"
+        },
+        "firing_paths": {
+          "type": "array",
+          "items": { "$ref": "/schemas/enums/tracker-firing-path.json" },
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Complete set of permitted initiation environments. Exactly one path is selected for each logical event occurrence."
+        }
+      },
+      "required": [
+        "selector_id",
+        "asset_type",
+        "daast_versions",
+        "daast_event",
+        "target",
+        "execution_actor",
+        "firing_paths"
+      ],
+      "allOf": [
+        { "$ref": "/schemas/core/daast-tracker-constraints.json" }
+      ],
+      "additionalProperties": false
+    }
+  ],
+  "discriminator": { "propertyName": "asset_type" }
+}
diff --git a/static/schemas/source/core/transformer.json b/static/schemas/source/core/transformer.json
index b906e62c28..4f11db4090 100644
--- a/static/schemas/source/core/transformer.json
+++ b/static/schemas/source/core/transformer.json
@@ -76,8 +76,20 @@
     },
     "input_formats": {
       "type": "array",
-      "description": "Canonical format declarations this transformer accepts as input. Omitted means it builds from a brief or raw assets rather than transforming an existing creative. Compatibility uses canonical constraint satisfaction, not identifier equality.",
-      "items": { "$ref": "/schemas/core/product-format-declaration.json" },
+      "description": "Canonical format declarations this transformer accepts as input. Omitted means it builds from a brief or raw assets rather than transforming an existing creative. Compatibility uses canonical constraint satisfaction, not identifier equality. Transformer self-description has no seller production authority, so tracker_execution_contract and tracker_execution_contract_digest are forbidden.",
+      "items": {
+        "allOf": [
+          { "$ref": "/schemas/core/product-format-declaration.json" },
+          {
+            "not": {
+              "anyOf": [
+                { "required": ["tracker_execution_contract"] },
+                { "required": ["tracker_execution_contract_digest"] }
+              ]
+            }
+          }
+        ]
+      },
       "minItems": 1
     },
     "output_capability_ids": {
diff --git a/static/schemas/source/core/vast-tracker-constraints.json b/static/schemas/source/core/vast-tracker-constraints.json
new file mode 100644
index 0000000000..6a20f734ce
--- /dev/null
+++ b/static/schemas/source/core/vast-tracker-constraints.json
@@ -0,0 +1,243 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/core/vast-tracker-constraints.json",
+  "title": "VAST Tracker Constraints",
+  "description": "Shared VAST TrackingEvents constraints used by tracker assets and production execution selectors. The target/event matrix is closed, progress alone carries offset, and selector version arrays may contain only versions in which the event exists.",
+  "type": "object",
+  "definitions": {
+    "vast_event": {
+      "type": "string",
+      "enum": [
+        "creativeView",
+        "loaded",
+        "start",
+        "firstQuartile",
+        "midpoint",
+        "thirdQuartile",
+        "complete",
+        "mute",
+        "unmute",
+        "pause",
+        "resume",
+        "rewind",
+        "skip",
+        "playerExpand",
+        "playerCollapse",
+        "fullscreen",
+        "exitFullscreen",
+        "progress",
+        "acceptInvitation",
+        "adExpand",
+        "adCollapse",
+        "minimize",
+        "overlayViewDuration",
+        "otherAdInteraction",
+        "interactiveStart",
+        "close",
+        "closeLinear"
+      ]
+    },
+    "vast_target": {
+      "type": "string",
+      "enum": ["linear", "non_linear", "companion"],
+      "default": "linear"
+    },
+    "vast_offset": {
+      "type": "string",
+      "pattern": "^(\\d{2}:[0-5]\\d:[0-5]\\d(\\.\\d{3})?|(100|\\d{1,2})%)$"
+    },
+    "vast_versions": {
+      "type": "array",
+      "items": { "$ref": "/schemas/enums/vast-version.json" },
+      "minItems": 1,
+      "uniqueItems": true
+    }
+  },
+  "properties": {
+    "vast_event": { "$ref": "#/definitions/vast_event" },
+    "target": { "$ref": "#/definitions/vast_target" },
+    "offset": { "$ref": "#/definitions/vast_offset" },
+    "vast_versions": { "$ref": "#/definitions/vast_versions" }
+  },
+  "allOf": [
+    {
+      "if": {
+        "anyOf": [
+          { "not": { "required": ["target"] } },
+          {
+            "properties": { "target": { "const": "linear" } },
+            "required": ["target"]
+          }
+        ]
+      },
+      "then": {
+        "properties": {
+          "vast_event": {
+            "enum": [
+              "creativeView",
+              "loaded",
+              "start",
+              "firstQuartile",
+              "midpoint",
+              "thirdQuartile",
+              "complete",
+              "mute",
+              "unmute",
+              "pause",
+              "resume",
+              "rewind",
+              "skip",
+              "playerExpand",
+              "playerCollapse",
+              "fullscreen",
+              "exitFullscreen",
+              "progress",
+              "otherAdInteraction",
+              "interactiveStart",
+              "closeLinear"
+            ]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "target": { "const": "non_linear" } },
+        "required": ["target"]
+      },
+      "then": {
+        "properties": {
+          "vast_event": {
+            "enum": [
+              "creativeView",
+              "acceptInvitation",
+              "adExpand",
+              "adCollapse",
+              "minimize",
+              "overlayViewDuration",
+              "otherAdInteraction",
+              "close"
+            ]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "target": { "const": "companion" } },
+        "required": ["target"]
+      },
+      "then": {
+        "properties": { "vast_event": { "const": "creativeView" } }
+      }
+    },
+    {
+      "if": {
+        "properties": { "vast_event": { "const": "progress" } },
+        "required": ["vast_event"]
+      },
+      "then": { "required": ["offset"] },
+      "else": { "not": { "required": ["offset"] } }
+    },
+    {
+      "if": {
+        "properties": {
+          "vast_event": { "enum": ["skip", "progress"] }
+        },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": {
+            "items": { "enum": ["3.0", "4.0", "4.1", "4.2", "4.3"] }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "vast_event": { "const": "fullscreen" }
+        },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": { "items": { "enum": ["2.0", "3.0"] } }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "vast_event": { "const": "exitFullscreen" } },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": { "items": { "const": "3.0" } }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "vast_event": {
+            "enum": [
+              "playerExpand",
+              "playerCollapse",
+              "adExpand",
+              "adCollapse",
+              "minimize",
+              "overlayViewDuration",
+              "otherAdInteraction"
+            ]
+          }
+        },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": {
+            "items": { "enum": ["4.0", "4.1", "4.2", "4.3"] }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "vast_event": { "const": "loaded" } },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": { "items": { "enum": ["4.1", "4.2", "4.3"] } }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "vast_event": { "const": "interactiveStart" } },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": { "items": { "enum": ["4.2", "4.3"] } }
+        }
+      }
+    },
+    {
+      "$comment": "VAST 4.0 omitted closeLinear; VAST 4.1 restored it from VAST 3.0. The 4.0 gap is intentional.",
+      "if": {
+        "properties": { "vast_event": { "const": "closeLinear" } },
+        "required": ["vast_event"]
+      },
+      "then": {
+        "properties": {
+          "vast_versions": {
+            "items": { "enum": ["3.0", "4.1", "4.2", "4.3"] }
+          }
+        }
+      }
+    }
+  ]
+}
diff --git a/static/schemas/source/core/x-entity-types.json b/static/schemas/source/core/x-entity-types.json
index 0c635d56c6..2f5e1b4c7d 100644
--- a/static/schemas/source/core/x-entity-types.json
+++ b/static/schemas/source/core/x-entity-types.json
@@ -23,6 +23,7 @@
     "creative_revision",
     "creative_representation",
     "macro_declaration",
+    "tracker_execution_selector",
     "creative_locale_variant",
     "creative_format",
     "transformer",
@@ -82,6 +83,7 @@
     "creative_revision": "A buyer-assigned immutable input-content state beneath one durable creative. Identity is the tuple `(creative_id, revision_id)`. `revision_id` round-trips through sync_creatives, list_creatives, creative status webhooks, and delivery readback. Seller transcoding, normalization, and alternate delivery representations do not create a new revision.",
     "creative_representation": "One equivalent trafficking representation inside a complete creative representation set. `representation_id` is scoped to the parent creative revision and is echoed in selection and rejection results. Selecting, transcoding, or delivering one representation does not mint a new buyer revision or reuse a served variant identity.",
     "macro_declaration": "One occurrence-level macro processing declaration within a creative asset. `declaration_id` in core/macro-declaration.json is echoed by core/macro-resolution-result.json so validation and sync results correlate to the exact declared occurrence. Scoped to the enclosing asset and not globally unique.",
+    "tracker_execution_selector": "One stable first-class tracker commitment inside an effective Product tracker execution contract. `selector_id` is scoped to the materialized contract, is retained unchanged in the immutable PackageFormatSnapshot, and is later used to attribute contract matching and execution evidence. It is not globally unique without the product or package snapshot identity.",
     "creative_locale_variant": "A buyer-assigned stable locale execution within one localized creative. `locale_variant_id` round-trips from core/creative-localization.json into sync_creatives and list_creatives readback, then attributes localized executions in get_creative_delivery. Scoped to the parent creative and deliberately distinct from build_variant (a build_creative output leaf) and variant_id (a provider execution observed in reporting).",
     "creative_format": "A format spec identified by the composite of `agent_url` + `id` (see core/format-id.json).",
     "transformer": "An account-scoped creative build capability offered by a creative agent (the creative analog of a product) — a voice, model, style, or director with typed config params and per-account pricing. `transformer_id` via `core/transformer.json`, discovered in `creative/list-transformers-response` and selected in `media-buy/build-creative-request`. Scoped to the issuing creative agent.",
diff --git a/static/schemas/source/enums/pixel-tracking-event.json b/static/schemas/source/enums/pixel-tracking-event.json
new file mode 100644
index 0000000000..36f4ff8651
--- /dev/null
+++ b/static/schemas/source/enums/pixel-tracking-event.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/enums/pixel-tracking-event.json",
+  "title": "Pixel Tracking Event",
+  "description": "Closed AdCP event vocabulary for renderer-fired pixel trackers. Impression and viewability values through `viewable_video_50` map to IAB OpenRTB Native event tracker types 1-4. `audible_video_complete` is an AdCP-defined first-class event, not an assigned IAB Native event type; Native reserves 500+ for exchange-specific use. `click` represents Native click trackers and `custom` is the explicit adopter-defined extension point.",
+  "type": "string",
+  "enum": [
+    "impression",
+    "viewable_mrc_50",
+    "viewable_mrc_100",
+    "viewable_video_50",
+    "audible_video_complete",
+    "click",
+    "custom"
+  ]
+}
diff --git a/static/schemas/source/enums/tracker-execution-actor.json b/static/schemas/source/enums/tracker-execution-actor.json
new file mode 100644
index 0000000000..5145da67ed
--- /dev/null
+++ b/static/schemas/source/enums/tracker-execution-actor.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/enums/tracker-execution-actor.json",
+  "title": "Tracker Execution Actor",
+  "description": "Actor responsible for initiating a buyer-supplied tracker under a seller-authored execution contract. This v1 vocabulary is intentionally narrower than the macro resolver actor vocabulary.",
+  "type": "string",
+  "enum": ["seller", "request_executor"]
+}
diff --git a/static/schemas/source/enums/tracker-firing-path.json b/static/schemas/source/enums/tracker-firing-path.json
new file mode 100644
index 0000000000..ffa1d6265f
--- /dev/null
+++ b/static/schemas/source/enums/tracker-firing-path.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/enums/tracker-firing-path.json",
+  "title": "Tracker Firing Path",
+  "description": "Environment in which the responsible actor initiates a tracker. A selector may permit both values, but exactly one path is used for each logical event occurrence.",
+  "type": "string",
+  "enum": ["client", "server"]
+}
diff --git a/static/schemas/source/formats/canonical/audio_daast.json b/static/schemas/source/formats/canonical/audio_daast.json
index f008149932..83fa0bbf78 100644
--- a/static/schemas/source/formats/canonical/audio_daast.json
+++ b/static/schemas/source/formats/canonical/audio_daast.json
@@ -13,8 +13,13 @@
       "description": "Default slots for audio_daast canonical. Buyer ships a DAAST tag (URL or inline XML, 1.0 or 1.1) plus an optional clickthrough URL. Tracking events are inherent to DAAST and don't require explicit slots."
     },
     "daast_version": {
-      "type": "string",
-      "enum": ["1.0", "1.1"]
+      "$ref": "/schemas/enums/daast-version.json",
+      "deprecated": true,
+      "description": "Deprecated one-element alias for `daast_versions`. Producers use either the singular legacy alias or the plural 3.2 field, never both."
+    },
+    "daast_versions": {
+      "$ref": "/schemas/core/daast-tracker-constraints.json#/definitions/daast_versions",
+      "description": "Accepted DAAST versions for this format option. A tracker execution selector's daast_versions must be a nonempty subset of this set."
     },
     "duration_ms_range": {
       "type": "array",
@@ -42,5 +47,6 @@
       "type": "boolean"
     }
   },
+  "not": { "required": ["daast_version", "daast_versions"] },
   "additionalProperties": true
 }
diff --git a/static/schemas/source/index.json b/static/schemas/source/index.json
index 80fa600f25..1cd77347be 100644
--- a/static/schemas/source/index.json
+++ b/static/schemas/source/index.json
@@ -53,6 +53,10 @@
           "$ref": "/schemas/core/canonical-format-option.json",
           "description": "Compact canonical format declaration without legacy named-format links"
         },
+        "creative-operation-format-declaration": {
+          "$ref": "/schemas/core/creative-operation-format-declaration.json",
+          "description": "Authority-free canonical declaration for creative-agent build, validation, and preview capabilities"
+        },
         "canonical-placement": {
           "$ref": "/schemas/core/canonical-placement.json",
           "description": "Compact canonical product placement"
@@ -113,6 +117,10 @@
           "$ref": "/schemas/core/package.json",
           "description": "A specific product within a media buy (line item)"
         },
+        "package-format-snapshot": {
+          "$ref": "/schemas/core/package-format-snapshot.json",
+          "description": "Immutable package-time selected product format, placement, execution-version, and tracker-contract binding"
+        },
         "committed-metric": {
           "$ref": "/schemas/core/committed-metric.json",
           "description": "One metric in a package's binding reporting contract"
@@ -622,6 +630,22 @@
           "$ref": "/schemas/core/product-format-declaration.json",
           "description": "v2 inline format declaration on products. Keyed by canonical format name; product narrows exactly one canonical with platform-specific parameters."
         },
+        "tracker-execution-contract": {
+          "$ref": "/schemas/core/tracker-execution-contract.json",
+          "description": "Seller production commitment for accepted first-class manifest tracker execution"
+        },
+        "tracker-execution-selector": {
+          "$ref": "/schemas/core/tracker-execution-selector.json",
+          "description": "Exact pixel, VAST, or DAAST tracker selector in a production execution contract"
+        },
+        "vast-tracker-constraints": {
+          "$ref": "/schemas/core/vast-tracker-constraints.json",
+          "description": "Shared version-aware VAST tracker event and target constraints"
+        },
+        "daast-tracker-constraints": {
+          "$ref": "/schemas/core/daast-tracker-constraints.json",
+          "description": "Shared DAAST tracker event and target constraints"
+        },
         "downstream-connection-requirement": {
           "$ref": "/schemas/core/downstream-connection-requirement.json",
           "description": "Seller/platform-side connection or grant required by a product, format, or request, distinct from the AdCP caller credential."
@@ -1205,6 +1229,18 @@
           "$ref": "/schemas/enums/vast-tracking-event.json",
           "description": "Standard VAST tracking events for video playback and interaction"
         },
+        "pixel-tracking-event": {
+          "$ref": "/schemas/enums/pixel-tracking-event.json",
+          "description": "Canonical first-class pixel tracker event vocabulary"
+        },
+        "tracker-execution-actor": {
+          "$ref": "/schemas/enums/tracker-execution-actor.json",
+          "description": "Actor responsible for initiating an accepted tracker"
+        },
+        "tracker-firing-path": {
+          "$ref": "/schemas/enums/tracker-firing-path.json",
+          "description": "Permitted client or server tracker initiation path"
+        },
         "property-type": {
           "$ref": "/schemas/enums/property-type.json",
           "description": "Types of addressable advertising properties with verifiable ownership"
diff --git a/static/schemas/source/media-buy/get-media-buys-response.json b/static/schemas/source/media-buy/get-media-buys-response.json
index d10d78b1cf..239401c841 100644
--- a/static/schemas/source/media-buy/get-media-buys-response.json
+++ b/static/schemas/source/media-buy/get-media-buys-response.json
@@ -583,17 +583,27 @@
                 },
                 "formats_to_provide": {
                   "type": "array",
-                  "description": "The immutable canonical creative contracts established for this package at booking time. Each entry is the selected Product.format_options declaration, or the equivalent declaration normalized from a direct format_kind + params selector. Compare this full checklist with formats_pending to determine current creative readiness.",
+                  "description": "The immutable PackageFormatSnapshot checklist established for this package at booking time. Contract-bearing snapshots remain present after creative coverage is complete so readback, assignment, and serving never fall back to a mutable live Product declaration.",
                   "items": {
-                    "$ref": "/schemas/core/product-format-declaration.json"
+                    "$ref": "/schemas/core/package-format-snapshot.json"
                   },
-                  "minItems": 1
+                  "minItems": 1,
+                  "x-adcp-validation": {
+                    "verifier_constraints": {
+                      "snapshot_identity": "every present product_snapshot_digest is unique within the package; contract-bearing snapshots always carry one"
+                    }
+                  }
                 },
                 "formats_pending": {
                   "type": "array",
-                  "description": "Canonical package-time format declarations from formats_to_provide that do not yet have creative coverage through sync_creatives or inline creative assignment. Each entry preserves the full contract needed to select a compatible creative agent, including ID-less unique-kind and direct canonical selections. An empty emitted array means every formats_to_provide requirement is covered. Absence means readiness was not reported, so buyers MUST NOT infer full coverage from omission.",
+                  "description": "PackageFormatSnapshot entries from formats_to_provide that do not yet have creative coverage. Each entry MUST be canonically equal to the corresponding checklist snapshot and, when product_snapshot_digest is present, carry the identical digest. An empty emitted array means all requirements are covered; absence means readiness was not reported.",
                   "items": {
-                    "$ref": "/schemas/core/product-format-declaration.json"
+                    "$ref": "/schemas/core/package-format-snapshot.json"
+                  },
+                  "x-adcp-validation": {
+                    "verifier_constraints": {
+                      "subset_identity": "every item equals exactly one formats_to_provide item after RFC 8785 canonicalization and carries the identical product_snapshot_digest when present"
+                    }
                   }
                 },
                 "format_ids_to_provide": {
@@ -739,11 +749,42 @@
                       }
                     }
                   }
+                },
+                {
+                  "if": {
+                    "anyOf": [
+                      {
+                        "properties": {
+                          "formats_to_provide": {
+                            "contains": { "required": ["tracker_execution_contract"] }
+                          }
+                        },
+                        "required": ["formats_to_provide"]
+                      },
+                      {
+                        "properties": {
+                          "formats_pending": {
+                            "contains": { "required": ["tracker_execution_contract"] }
+                          }
+                        },
+                        "required": ["formats_pending"]
+                      }
+                    ]
+                  },
+                  "then": {
+                    "required": ["product_id"],
+                    "properties": { "product_id": { "minLength": 1 } }
+                  }
                 }
               ],
               "dependencies": {
                 "params": ["format_kind"]
               },
+              "x-adcp-validation": {
+                "verifier_constraints": {
+                  "package_snapshot_product": "every formats_to_provide and formats_pending item product_id equals this readback package product_id; a contract-bearing snapshot requires the enclosing product_id"
+                }
+              },
               "additionalProperties": true
             }
           },
diff --git a/static/schemas/source/protocol/get-adcp-capabilities-response.json b/static/schemas/source/protocol/get-adcp-capabilities-response.json
index 8c627c22b6..3e2537acf6 100644
--- a/static/schemas/source/protocol/get-adcp-capabilities-response.json
+++ b/static/schemas/source/protocol/get-adcp-capabilities-response.json
@@ -2132,7 +2132,7 @@
         },
         "supported_formats": {
           "type": "array",
-          "description": "Canonical-format capability catalog for this creative agent. This is the 3.2 source of truth for discovering which format contracts the agent can build, validate, or preview; it replaces the deprecated `list_creative_formats` task. Each entry uses the same `ProductFormatDeclaration` shape as a product's inline `format_options[i]`. New 3.2 producers MUST publish a stable agent-local `capability_id` and explicit `operations` for task routing. Every emitted `capability_id` MUST be unique within this catalog so a route selects exactly one entry. During the 3.x compatibility window, consumers MUST also accept legacy entries that omit either field; absent `operations` means `[\"build\"]`, while an absent `capability_id` means the entry is discoverable by canonical contract but cannot be selected through a capability-ID route.\n\n**Publisher-specific support.** To claim exact support for a publisher declaration, `format` carries the declaration's `{publisher_domain, format_option_id}` pair plus its canonical `format_kind` and narrowed `params`. Generic creative agents MAY instead advertise a canonical parameter envelope without publisher identity. A generic capability matches a target declaration only when the capability can satisfy every target constraint; matching canonical names alone is insufficient. Registries MAY reverse-index these entries by `format.format_kind`, `format.publisher_domain`, and `format.format_option_id`.\n\nThis catalog describes creative operations, not sales-agent inventory deliverability. Sales agents publish the purchasable closed set on each `Product.format_options[]`; publisher acceptance lives in `adagents.json.formats[]`.",
+          "description": "Canonical-format capability catalog for this creative agent. This is the 3.2 source of truth for discovering which format contracts the agent can build, validate, or preview; it replaces the deprecated `list_creative_formats` task. Each entry uses the authority-free `CreativeOperationFormatDeclaration` projection of a product format declaration: canonical shape and creative-route macro processing are preserved, while seller production commitments are excluded. New 3.2 producers MUST publish a stable agent-local `capability_id` and explicit `operations` for task routing. Every emitted `capability_id` MUST be unique within this catalog so a route selects exactly one entry. During the 3.x compatibility window, consumers MUST also accept legacy entries that omit either field; absent `operations` means `[\"build\"]`, while an absent `capability_id` means the entry is discoverable by canonical contract but cannot be selected through a capability-ID route.\n\n**Publisher-specific support.** To claim exact support for a publisher declaration, `format` carries the declaration's `{publisher_domain, format_option_id}` pair plus its canonical `format_kind` and narrowed `params`. Generic creative agents MAY instead advertise a canonical parameter envelope without publisher identity. A generic capability matches a target declaration only when the capability can satisfy every target constraint; matching canonical names alone is insufficient. Registries MAY reverse-index these entries by `format.format_kind`, `format.publisher_domain`, and `format.format_option_id`.\n\nThis catalog describes creative operations, not sales-agent inventory deliverability. Sales agents publish the purchasable closed set on each `Product.format_options[]`; publisher acceptance lives in `adagents.json.formats[]`.",
           "items": {
             "type": "object",
             "properties": {
@@ -2142,8 +2142,8 @@
                 "description": "Stable identifier for this format capability within the creative agent (e.g., 'audio_narration_30s'). The value MUST be unique across this agent's supported_formats catalog. Route the advertised operation with this ID: build_creative.target_capability_id(s) for build, preview_creative.target_capability_id for preview, or validate_input targets[] kind capability for validate. Capability IDs are agent-local routes and do not appear on portable manifests or products."
               },
               "format": {
-                "$ref": "/schemas/core/product-format-declaration.json",
-                "description": "Format declaration on which this agent can perform the listed operations. Same shape as a product's inline format_options entry: format_kind plus params and slots."
+                "description": "Format declaration on which this agent can perform the listed operations. Creative-agent capability self-description has no seller production authority, so tracker_execution_contract and tracker_execution_contract_digest are forbidden.",
+                "$ref": "/schemas/core/creative-operation-format-declaration.json"
               },
               "operations": {
                 "type": "array",
diff --git a/static/schemas/source/trusted-match/available-package.json b/static/schemas/source/trusted-match/available-package.json
index 5362ee51b3..1581032896 100644
--- a/static/schemas/source/trusted-match/available-package.json
+++ b/static/schemas/source/trusted-match/available-package.json
@@ -28,9 +28,15 @@
     },
     "format_options": {
       "type": "array",
-      "description": "Canonical creative contracts eligible for this package. These are the seller-resolved package options, not a global agent format list.",
-      "items": { "$ref": "/schemas/core/product-format-declaration.json" },
-      "minItems": 1
+      "description": "Immutable seller-resolved PackageFormatSnapshots eligible for this package. A sender projects this field only when the Trusted Match transport profile supports the highest AdCP release version of every field in every snapshot. It MUST NOT strip an unsupported selector or digest field from a snapshot; for an older or version-unknown provider, omit the entire contract-bearing snapshot and do not claim production-path evidence from a legacy projection.",
+      "items": { "$ref": "/schemas/core/package-format-snapshot.json" },
+      "minItems": 1,
+      "x-adcp-validation": {
+        "verifier_constraints": {
+          "protocol_version": "the Trusted Match transport profile supports the highest AdCP release version of every field in each projected snapshot",
+          "authority_stripping": "an unsupported contract-bearing snapshot is omitted whole; a sender never removes individual selectors, execution versions, or digests from an immutable snapshot"
+        }
+      }
     },
     "catalogs": {
       "type": "array",
diff --git a/tests/build-schemas-hoist-marked.test.cjs b/tests/build-schemas-hoist-marked.test.cjs
index 38d2a79236..97bd1dfa82 100644
--- a/tests/build-schemas-hoist-marked.test.cjs
+++ b/tests/build-schemas-hoist-marked.test.cjs
@@ -14,11 +14,24 @@
 
 const test = require('node:test');
 const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
 
 const { hoistMarkedSchemas } = require('../scripts/build-schemas.cjs');
 
 function clone(o) { return JSON.parse(JSON.stringify(o)); }
 
+test('keeps the repeated creative asset union on the named hoist path', () => {
+  const assetUnion = JSON.parse(fs.readFileSync(
+    path.join(__dirname, '../static/schemas/source/core/assets/asset-union.json'),
+    'utf8'
+  ));
+
+  assert.equal(assetUnion.title, 'AssetVariant');
+  assert.equal(assetUnion['x-adcp-hoist'], true,
+    'inlining AssetVariant repeatedly makes build_creative validators exceed the JS call stack');
+});
+
 test('hoists a marked schema and replaces all inline occurrences with $ref', () => {
   const schema = {
     type: 'object',
diff --git a/tests/canonical-negative-fixtures.test.cjs b/tests/canonical-negative-fixtures.test.cjs
index d3a4ecaa8a..cdfc896bfa 100644
--- a/tests/canonical-negative-fixtures.test.cjs
+++ b/tests/canonical-negative-fixtures.test.cjs
@@ -479,7 +479,7 @@ const NEGATIVE_CASES = {
       },
     },
     {
-      label: 'valid pixel_tracker for audible_video_complete (IAB event 500)',
+      label: 'valid pixel_tracker for AdCP audible_video_complete',
       expected: true,
       doc: {
         asset_type: 'pixel_tracker',
diff --git a/tests/capabilities.test.ts b/tests/capabilities.test.ts
index c147b0c703..5fc8f157ac 100644
--- a/tests/capabilities.test.ts
+++ b/tests/capabilities.test.ts
@@ -45,12 +45,33 @@ describe('sanitizeCreativeCapabilities', () => {
     });
   });
 
-  it('rejects incomplete ProductFormatDeclaration objects', async () => {
+  it('rejects incomplete creative operation format declarations', async () => {
     await expect(sanitizeCreativeCapabilities({
       supported_formats: [{ ...validEntry, format: { format_kind: 'image' } }],
     })).rejects.toThrow('supported_formats[0].format');
   });
 
+  it('validates params against the selected canonical format without compiling the seller graph', async () => {
+    await expect(sanitizeCreativeCapabilities({
+      supported_formats: [{
+        ...validEntry,
+        format: { format_kind: 'image', params: { width: 0, height: 250 } },
+      }],
+    })).rejects.toThrow('supported_formats[0].format.params');
+  });
+
+  it('rejects seller tracker authority without compiling it into creative routes', async () => {
+    await expect(sanitizeCreativeCapabilities({
+      supported_formats: [{
+        ...validEntry,
+        format: {
+          ...validEntry.format,
+          tracker_execution_contract: { complete: true, honored: [] },
+        },
+      }],
+    })).rejects.toThrow('supported_formats[0].format');
+  });
+
   it('rejects duplicate capability IDs', async () => {
     await expect(sanitizeCreativeCapabilities({ supported_formats: [validEntry, validEntry] }))
       .rejects.toThrow("duplicate 'image_300x250'");
diff --git a/tests/mcp-schema-projection.test.cjs b/tests/mcp-schema-projection.test.cjs
index 7996a78e86..7d165bfc0e 100644
--- a/tests/mcp-schema-projection.test.cjs
+++ b/tests/mcp-schema-projection.test.cjs
@@ -44,12 +44,13 @@ const LATEST_DIR = path.join(REPO_ROOT, 'dist', 'schemas', 'latest');
 const PROJECTION_DIR = path.join(LATEST_DIR, 'mcp', MCP_PROTOCOL_VERSION);
 const PRODUCTION_PROFILE_DIR = path.join(PROJECTION_DIR, 'profiles', 'production');
 // Macro occurrence contracts and representation-set resolution add shared,
-// structurally enforced graphs to media-buy tasks. Keep those measured
-// increases isolated from the creative profile and retain main's 400 KiB hard
-// ceiling while the shared-dictionary projection is still experimental.
+// structurally enforced graphs to media-buy tasks. The 3.2 tracker contract
+// adds one seller-bound destination contract to build_creative; keep that
+// measured increase isolated to the creative profile while retaining the
+// 400 KiB media-buy ceiling and a tight prompt-view bound.
 const MODEL_CONTEXT_BUDGET_KIB = {
   'media-buy': 400,
-  creative: 400,
+  creative: 410,
 };
 // Keep parity compilation materially tighter than the 4 MiB protocol schema
 // bound while allowing example-bearing schemas to carry the complete Product
diff --git a/tests/tracker-execution-contracts.test.cjs b/tests/tracker-execution-contracts.test.cjs
new file mode 100644
index 0000000000..4f5e79011a
--- /dev/null
+++ b/tests/tracker-execution-contracts.test.cjs
@@ -0,0 +1,653 @@
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+const Ajv = require('ajv').default;
+const addFormats = require('ajv-formats').default;
+
+const ROOT = path.resolve(__dirname, '..');
+const SCHEMAS = path.join(ROOT, 'static/schemas/source');
+const VECTORS = path.join(
+  ROOT,
+  'static/compliance/source/test-vectors/tracker-execution-contracts.json'
+);
+const VECTOR_SCHEMA = path.join(
+  ROOT,
+  'static/compliance/source/test-vectors/tracker-execution-contracts.schema.json'
+);
+
+function loadAllSchemas(ajv) {
+  function walk(directory) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const full = path.join(directory, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.endsWith('.json')) {
+        const schema = JSON.parse(fs.readFileSync(full, 'utf8'));
+        if (schema.$id && !ajv.getSchema(schema.$id)) ajv.addSchema(schema, schema.$id);
+      }
+    }
+  }
+  walk(SCHEMAS);
+}
+
+function makeAjv() {
+  const ajv = new Ajv({ allErrors: true, strict: false, discriminator: true });
+  addFormats(ajv);
+  ajv.addFormat('uri-template', true);
+  loadAllSchemas(ajv);
+  return ajv;
+}
+
+const ajv = makeAjv();
+
+const pixelSelector = (overrides = {}) => ({
+  selector_id: 'pixel-impression',
+  asset_type: 'pixel_tracker',
+  event: 'impression',
+  method: 'img',
+  execution_actor: 'seller',
+  firing_paths: ['client'],
+  ...overrides
+});
+
+const vastSelector = (overrides = {}) => ({
+  selector_id: 'vast-start',
+  asset_type: 'vast_tracker',
+  vast_versions: ['4.2'],
+  vast_event: 'start',
+  target: 'linear',
+  execution_actor: 'request_executor',
+  firing_paths: ['client'],
+  ...overrides
+});
+
+const daastSelector = (overrides = {}) => ({
+  selector_id: 'daast-start',
+  asset_type: 'daast_tracker',
+  daast_versions: ['1.1'],
+  daast_event: 'start',
+  target: 'linear',
+  execution_actor: 'request_executor',
+  firing_paths: ['client'],
+  ...overrides
+});
+
+function selectorMatches(selector, tracker, executionVersion) {
+  if (selector.asset_type !== tracker.asset_type) return false;
+  if (selector.asset_type === 'pixel_tracker') {
+    return selector.event === tracker.event &&
+      selector.method === (tracker.method ?? 'img') &&
+      selector.custom_event_name === tracker.custom_event_name;
+  }
+  if (selector.asset_type === 'vast_tracker') {
+    const trackerOffset = tracker.vast_event === 'progress' ? tracker.offset : undefined;
+    return selector.vast_event === tracker.vast_event &&
+      selector.target === (tracker.target ?? 'linear') &&
+      selector.offset === trackerOffset &&
+      selector.vast_versions.includes(executionVersion);
+  }
+  const trackerOffset = tracker.daast_event === 'progress' ? tracker.offset : undefined;
+  return selector.daast_event === tracker.daast_event &&
+    selector.target === (tracker.target ?? 'linear') &&
+    selector.offset === trackerOffset &&
+    selector.daast_versions.includes(executionVersion);
+}
+
+function evaluateTracker(contract, tracker, executionVersion, formatSlots) {
+  if (Array.isArray(formatSlots) && !formatSlots.some(slot => slot.asset_type === tracker.asset_type)) {
+    return { status: 'rejected', rejection_code: 'tracker_contract_mismatch' };
+  }
+  const selector = contract.honored.find(candidate =>
+    selectorMatches(candidate, tracker, executionVersion)
+  );
+  if (selector) return { status: 'matched', selector_id: selector.selector_id };
+  if (contract.complete) {
+    return { status: 'rejected', rejection_code: 'tracker_contract_mismatch' };
+  }
+  return { status: 'undeclared' };
+}
+
+function structuralIdentity(selector) {
+  const value = structuredClone(selector);
+  delete value.selector_id;
+  delete value.execution_actor;
+  delete value.firing_paths;
+  if (value.vast_versions) value.vast_versions.sort();
+  if (value.daast_versions) value.daast_versions.sort();
+  return JSON.stringify(value, Object.keys(value).sort());
+}
+
+function validateOperationalContract(contract) {
+  const ids = new Set();
+  const identities = new Set();
+  for (const selector of contract.honored) {
+    if (ids.has(selector.selector_id)) return 'duplicate_selector_id';
+    ids.add(selector.selector_id);
+    const identity = structuralIdentity(selector);
+    if (identities.has(identity)) return 'duplicate_structural_identity';
+    identities.add(identity);
+  }
+
+  for (let leftIndex = 0; leftIndex < contract.honored.length; leftIndex++) {
+    const left = contract.honored[leftIndex];
+    const leftVersions = left.vast_versions ?? left.daast_versions;
+    if (!leftVersions) continue;
+    for (let rightIndex = leftIndex + 1; rightIndex < contract.honored.length; rightIndex++) {
+      const right = contract.honored[rightIndex];
+      const rightVersions = right.vast_versions ?? right.daast_versions;
+      if (!rightVersions) continue;
+      const leftWithoutVersions = structuredClone(left);
+      const rightWithoutVersions = structuredClone(right);
+      for (const value of [leftWithoutVersions, rightWithoutVersions]) {
+        delete value.selector_id;
+        delete value.execution_actor;
+        delete value.firing_paths;
+        delete value.vast_versions;
+        delete value.daast_versions;
+      }
+      if (JSON.stringify(leftWithoutVersions) !== JSON.stringify(rightWithoutVersions)) continue;
+      const overlap = leftVersions.some(version => rightVersions.includes(version));
+      const equal = leftVersions.length === rightVersions.length &&
+        leftVersions.every(version => rightVersions.includes(version));
+      if (overlap && !equal) return 'overlapping_version_sets';
+    }
+  }
+  return null;
+}
+
+function contractHasSatisfiableSlots(contract, effectiveSlots = []) {
+  const slotTypes = new Set(effectiveSlots.map(slot => slot.asset_type));
+  return contract.honored.every(selector => slotTypes.has(selector.asset_type));
+}
+
+function atomicTuples(contract) {
+  const tuples = new Set();
+  for (const selector of contract.honored) {
+    const identity = structuredClone(selector);
+    delete identity.selector_id;
+    delete identity.execution_actor;
+    delete identity.firing_paths;
+    delete identity.vast_versions;
+    delete identity.daast_versions;
+    const versions = selector.vast_versions ?? selector.daast_versions ?? [null];
+    for (const version of versions) {
+      for (const path of selector.firing_paths) {
+        tuples.add(JSON.stringify([
+          identity,
+          version,
+          selector.execution_actor,
+          path
+        ]));
+      }
+    }
+  }
+  return tuples;
+}
+
+function contractNarrowingIsValid(parent, child) {
+  if (!parent.complete) return child.complete === false;
+  if (!child.complete) return false;
+  const parentTuples = atomicTuples(parent);
+  return [...atomicTuples(child)].every(tuple => parentTuples.has(tuple));
+}
+
+test('tracker execution selector schema accepts only the three first-class 3.2 branches', () => {
+  const validate = ajv.getSchema('/schemas/core/tracker-execution-selector.json');
+  assert.ok(validate);
+  assert.equal(validate(pixelSelector()), true, JSON.stringify(validate.errors));
+  assert.equal(validate(vastSelector()), true, JSON.stringify(validate.errors));
+  assert.equal(validate(daastSelector()), true, JSON.stringify(validate.errors));
+  assert.equal(validate({
+    selector_id: 'generic-url',
+    asset_type: 'url',
+    event: 'impression',
+    execution_actor: 'seller',
+    firing_paths: ['client']
+  }), false, 'URL-slot selectors are deferred from the 3.2 union');
+});
+
+test('pixel selector rejects invalid method, custom shape, actor, and path', () => {
+  const validate = ajv.getSchema('/schemas/core/tracker-execution-selector.json');
+  assert.equal(validate(pixelSelector({ method: 'js' })), false);
+  assert.equal(validate(pixelSelector({ event: 'custom' })), false,
+    'custom events require a qualified custom name');
+  assert.equal(validate(pixelSelector({ custom_event_name: 'unexpected' })), false,
+    'non-custom events forbid a custom name');
+  assert.equal(validate(pixelSelector({ execution_actor: 'creative_agent' })), false);
+  assert.equal(validate(pixelSelector({ firing_paths: [] })), false);
+  assert.equal(validate(pixelSelector({ firing_paths: ['mixed'] })), false);
+
+  const pixelAsset = JSON.parse(fs.readFileSync(
+    path.join(SCHEMAS, 'core/assets/pixel-tracker-asset.json'),
+    'utf8'
+  ));
+  const customSemantics = pixelAsset.properties.custom_event_name.description;
+  assert.match(customSemantics, /complete:true/,
+    'complete contracts must override the legacy unknown-custom no-op behavior');
+  assert.match(customSemantics, /tracker_contract_mismatch/);
+  const eventSemantics = pixelAsset.properties.event.description;
+  assert.match(eventSemantics, /audible_video_complete` \(AdCP-defined\)/);
+  assert.match(eventSemantics, /reserves event types 500\+ for exchange-specific use/);
+  assert.match(eventSemantics, /type 4 does not require audio/);
+  assert.doesNotMatch(eventSemantics, /audible_video_complete` \(IAB type 500\)/);
+});
+
+test('VAST selector enforces event, target, progress, and per-version constraints', () => {
+  const validate = ajv.getSchema('/schemas/core/tracker-execution-selector.json');
+  assert.equal(validate(vastSelector({ vast_event: 'creativeView' })), true,
+    'creativeView is valid for linear VAST execution');
+  assert.equal(validate(vastSelector({ vast_event: 'progress', offset: '25%' })), true,
+    JSON.stringify(validate.errors));
+  assert.equal(validate(vastSelector({ vast_event: 'progress' })), false);
+  assert.equal(validate(vastSelector({ offset: '25%' })), false,
+    'non-progress selectors forbid offset');
+  assert.equal(validate(vastSelector({ vast_event: 'acceptInvitation', target: 'linear' })), false);
+  assert.equal(validate(vastSelector({
+    vast_event: 'acceptInvitation',
+    target: 'companion'
+  })), false, 'companion trackers accept only creativeView in the closed matrix');
+  assert.equal(validate(vastSelector({
+    vast_event: 'acceptInvitation',
+    target: 'non_linear',
+    vast_versions: ['4.2']
+  })), true, JSON.stringify(validate.errors));
+  assert.equal(validate(vastSelector({ vast_event: 'loaded', vast_versions: ['4.0'] })), false,
+    'loaded is accepted only in its ratified exact versions');
+  assert.equal(validate(vastSelector({ vast_event: 'impression' })), false,
+    'VAST Impression is not a TrackingEvents selector');
+
+  const vastVersions = ['2.0', '3.0', '4.0', '4.1', '4.2', '4.3'];
+  const versionRules = [
+    { event: 'skip', allowed: ['3.0', '4.0', '4.1', '4.2', '4.3'] },
+    { event: 'progress', allowed: ['3.0', '4.0', '4.1', '4.2', '4.3'], offset: '25%' },
+    { event: 'fullscreen', allowed: ['2.0', '3.0'] },
+    { event: 'exitFullscreen', allowed: ['3.0'] },
+    { event: 'playerExpand', allowed: ['4.0', '4.1', '4.2', '4.3'] },
+    { event: 'loaded', allowed: ['4.1', '4.2', '4.3'] },
+    { event: 'interactiveStart', allowed: ['4.2', '4.3'] },
+    { event: 'closeLinear', allowed: ['3.0', '4.1', '4.2', '4.3'] }
+  ];
+  for (const rule of versionRules) {
+    for (const version of vastVersions) {
+      const selector = vastSelector({
+        vast_event: rule.event,
+        vast_versions: [version],
+        ...(rule.offset ? { offset: rule.offset } : {})
+      });
+      const expected = rule.allowed.includes(version);
+      assert.equal(validate(selector), expected,
+        `${rule.event} VAST ${version} expected ${expected}: ${JSON.stringify(validate.errors)}`);
+    }
+  }
+
+  const vastConstraints = JSON.parse(fs.readFileSync(
+    path.join(SCHEMAS, 'core/vast-tracker-constraints.json'),
+    'utf8'
+  ));
+  const closeLinearRule = vastConstraints.allOf.find(rule =>
+    rule.if?.properties?.vast_event?.const === 'closeLinear'
+  );
+  assert.match(closeLinearRule.$comment, /4\.0 omitted closeLinear.*4\.1 restored/i);
+
+  const validateAsset = ajv.getSchema('/schemas/core/assets/vast-tracker-asset.json');
+  assert.equal(validateAsset({
+    asset_type: 'vast_tracker',
+    vast_event: 'creativeView',
+    url: 'https://measurement.example/tracker'
+  }), true, 'default linear VAST assets accept creativeView');
+  for (const legacyAsset of [
+    { vast_event: 'start', offset: '00:00:05.000' },
+    { vast_event: 'close' },
+    { vast_event: 'start', target: 'companion' }
+  ]) {
+    assert.equal(validateAsset({
+      asset_type: 'vast_tracker',
+      url: 'https://measurement.example/legacy',
+      ...legacyAsset
+    }), true, `existing 3.x VAST asset became invalid: ${JSON.stringify(legacyAsset)}`);
+  }
+  assert.deepEqual(evaluateTracker({
+    complete: true,
+    honored: [vastSelector()]
+  }, {
+    asset_type: 'vast_tracker',
+    vast_event: 'start',
+    offset: '00:00:05.000'
+  }, '4.2'), {
+    status: 'matched',
+    selector_id: 'vast-start'
+  }, 'ignored non-progress asset offsets are removed before contract matching');
+});
+
+test('DAAST selector enforces event, target, progress, and version shape', () => {
+  const validate = ajv.getSchema('/schemas/core/tracker-execution-selector.json');
+  assert.equal(validate(daastSelector({ daast_event: 'progress', offset: '00:00:05.000' })), true,
+    JSON.stringify(validate.errors));
+  assert.equal(validate(daastSelector({ daast_event: 'progress' })), false);
+  assert.equal(validate(daastSelector({ offset: '10%' })), false);
+  assert.equal(validate(daastSelector({ daast_event: 'start', target: 'companion' })), false);
+  assert.equal(validate(daastSelector({
+    daast_event: 'creativeView',
+    target: 'companion'
+  })), true, JSON.stringify(validate.errors));
+  assert.equal(validate(daastSelector({ daast_versions: [] })), false);
+  assert.equal(validate(daastSelector({ daast_versions: ['1.1', '1.1'] })), false);
+  assert.equal(validate(daastSelector({ daast_event: 'close' })), false,
+    'DAAST close is a legacy AdCP asset extension, not a standards execution selector');
+
+  const validateFormat = ajv.getSchema('/schemas/formats/canonical/audio_daast.json');
+  assert.equal(validateFormat({ daast_versions: ['1.0', '1.1'] }), true,
+    JSON.stringify(validateFormat.errors));
+  assert.equal(validateFormat({ daast_version: '1.1' }), true,
+    'the deprecated singular alias remains valid for legacy declarations');
+  assert.equal(validateFormat({ daast_versions: ['9.9'] }), false);
+  assert.equal(validateFormat({ daast_version: '1.1', daast_versions: ['1.1'] }), false,
+    'producers must not send the singular alias and plural acceptance set together');
+
+  const validateAsset = ajv.getSchema('/schemas/core/assets/daast-tracker-asset.json');
+  for (const legacyAsset of [
+    { daast_event: 'start', offset: '10%' },
+    { daast_event: 'start', target: 'companion' },
+    { daast_event: 'close' }
+  ]) {
+    assert.equal(validateAsset({
+      asset_type: 'daast_tracker',
+      url: 'https://measurement.example/legacy',
+      ...legacyAsset
+    }), true, `existing 3.x DAAST asset became invalid: ${JSON.stringify(legacyAsset)}`);
+  }
+});
+
+test('complete and empty contract semantics validate and operational uniqueness stays closed', () => {
+  const validate = ajv.getSchema('/schemas/core/tracker-execution-contract.json');
+  assert.equal(validate({ complete: true, honored: [] }), true, JSON.stringify(validate.errors));
+  assert.equal(validate({ complete: false, honored: [pixelSelector()] }), true,
+    JSON.stringify(validate.errors));
+  assert.equal(validate({ honored: [] }), false);
+  assert.equal(validate({ complete: true }), false);
+
+  assert.equal(validateOperationalContract({
+    complete: true,
+    honored: [pixelSelector(), pixelSelector({ event: 'click' })]
+  }), 'duplicate_selector_id');
+  assert.equal(validateOperationalContract({
+    complete: true,
+    honored: [pixelSelector(), pixelSelector({ selector_id: 'same-shape' })]
+  }), 'duplicate_structural_identity');
+  assert.equal(validateOperationalContract({
+    complete: true,
+    honored: [
+      vastSelector({ selector_id: 'v42', vast_versions: ['4.2'] }),
+      vastSelector({ selector_id: 'v42-v43', vast_versions: ['4.2', '4.3'] })
+    ]
+  }), 'overlapping_version_sets');
+  assert.match(validate.schema['x-adcp-validation'].asset_normalization,
+    /non-progress asset is ignored and removed/);
+  assert.match(validate.schema['x-adcp-validation'].format_slot_satisfiability,
+    /matching first-class slot/);
+  assert.match(validate.schema['x-adcp-validation'].layer_derivation,
+    /atomic tuples/);
+  assert.match(validate.schema['x-adcp-validation'].layer_derivation,
+    /child may add or omit affirmative tuples/);
+  assert.doesNotMatch(validate.schema['x-adcp-validation'].layer_derivation,
+    /genuinely excludes/);
+});
+
+test('contracts require matching first-class slots and narrowing cannot invent version/path tuples', () => {
+  const pixelContract = { complete: true, honored: [pixelSelector()] };
+  assert.equal(contractHasSatisfiableSlots(pixelContract, [
+    { asset_group_id: 'image_main', asset_type: 'image' }
+  ]), false, 'an image option cannot promise a pixel without a pixel_tracker slot');
+  assert.equal(contractHasSatisfiableSlots(pixelContract, [
+    { asset_group_id: 'image_main', asset_type: 'image' },
+    { asset_group_id: 'impression_tracker', asset_type: 'pixel_tracker' }
+  ]), true);
+
+  const parent = {
+    complete: true,
+    honored: [
+      vastSelector({ selector_id: 'v42-client', vast_versions: ['4.2'], firing_paths: ['client'] }),
+      vastSelector({ selector_id: 'v43-server', vast_versions: ['4.3'], firing_paths: ['server'] })
+    ]
+  };
+  assert.equal(contractNarrowingIsValid(parent, {
+    complete: true,
+    honored: [vastSelector({
+      selector_id: 'unsafe-cross-product',
+      vast_versions: ['4.2', '4.3'],
+      firing_paths: ['client', 'server']
+    })]
+  }), false, 'compression must not invent 4.2/server or 4.3/client');
+  assert.equal(contractNarrowingIsValid(parent, {
+    complete: true,
+    honored: [vastSelector({
+      selector_id: 'safe-subset',
+      vast_versions: ['4.2'],
+      firing_paths: ['client']
+    })]
+  }), true);
+  assert.equal(contractNarrowingIsValid(parent, { complete: false, honored: [] }), false,
+    'a complete parent remains complete after narrowing');
+  assert.equal(contractNarrowingIsValid({ complete: false, honored: [] }, {
+    complete: false,
+    honored: [pixelSelector({ selector_id: 'new-child-knowledge' })]
+  }), true, 'an incomplete empty parent is undeclared, not a closed ceiling');
+  assert.equal(contractNarrowingIsValid({ complete: false, honored: [] }, {
+    complete: true,
+    honored: [pixelSelector({ selector_id: 'prematurely-complete' })]
+  }), false, 'a child cannot claim completeness while an applicable parent is incomplete');
+});
+
+test('golden vectors normalize defaults, bind exact versions, and keep incomplete omissions undeclared', () => {
+  const fixture = JSON.parse(fs.readFileSync(VECTORS, 'utf8'));
+  const validateFixture = ajv.compile(JSON.parse(fs.readFileSync(VECTOR_SCHEMA, 'utf8')));
+  assert.equal(validateFixture(fixture), true, JSON.stringify(validateFixture.errors));
+
+  for (const vector of fixture.vectors) {
+    assert.deepEqual(
+      evaluateTracker(vector.contract, vector.tracker, vector.execution_version, vector.format_slots),
+      vector.expected,
+      vector.name
+    );
+  }
+  for (const vector of fixture.derivation_vectors) {
+    assert.equal(
+      contractNarrowingIsValid(vector.parent, vector.child),
+      vector.expected_valid,
+      vector.name
+    );
+  }
+});
+
+test('contract-bearing products require stable option identity and authority projections strip contracts', () => {
+  const contract = { complete: true, honored: [pixelSelector()] };
+  const declaration = {
+    format_option_id: 'acme-image',
+    format_kind: 'image',
+    params: {
+      width: 300,
+      height: 250,
+      slots: [
+        { asset_group_id: 'image_main', asset_type: 'image', required: true },
+        { asset_group_id: 'impression_tracker', asset_type: 'pixel_tracker', required: false }
+      ]
+    },
+    tracker_execution_contract: contract
+  };
+  const validateDeclaration = ajv.getSchema('/schemas/core/product-format-declaration.json');
+  assert.equal(validateDeclaration(declaration), true, JSON.stringify(validateDeclaration.errors));
+  assert.equal(contractHasSatisfiableSlots(contract, declaration.params.slots), true);
+  const { format_option_id: ignored, ...idless } = declaration;
+  assert.equal(validateDeclaration(idless), false, 'seller execution authority must be addressable');
+
+  const capabilities = ajv.getSchema('/schemas/protocol/get-adcp-capabilities-response.json').schema;
+  const supportedFormatSchema = capabilities.properties.creative.properties.supported_formats.items;
+  const validateSupportedFormat = ajv.compile(supportedFormatSchema);
+  assert.equal(validateSupportedFormat({
+    capability_id: 'image-build',
+    operations: ['build'],
+    format: { format_kind: 'image', params: { width: 300, height: 250 } }
+  }), true, JSON.stringify(validateSupportedFormat.errors));
+  assert.equal(validateSupportedFormat({
+    capability_id: 'image-build',
+    operations: ['build'],
+    format: declaration
+  }), false, 'creative capability self-description cannot acquire seller authority');
+
+  const validateTransformer = ajv.getSchema('/schemas/core/transformer.json');
+  const transformer = {
+    transformer_id: 'image-transform',
+    name: 'Image transform',
+    input_formats: [{ format_kind: 'image', params: { width: 300, height: 250 } }],
+    output_capability_ids: ['image-build']
+  };
+  assert.equal(validateTransformer(transformer), true, JSON.stringify(validateTransformer.errors));
+  assert.equal(validateTransformer({ ...transformer, input_formats: [declaration] }), false,
+    'transformer inputs cannot acquire seller authority');
+});
+
+test('package snapshot digests bind the contract, product, format, placement, and exact execution version', async () => {
+  const canonicalize = (await import('canonicalize')).default;
+  const fixture = JSON.parse(fs.readFileSync(VECTORS, 'utf8'));
+  const snapshot = fixture.package_snapshot;
+  const sha256 = value => `sha256:${crypto.createHash('sha256').update(canonicalize(value)).digest('hex')}`;
+  const packageOnly = new Set([
+    'product_id',
+    'placement_refs',
+    'execution_vast_version',
+    'execution_daast_version',
+    'tracker_execution_contract_digest',
+    'product_snapshot_digest'
+  ]);
+  const format = Object.fromEntries(
+    Object.entries(snapshot).filter(([key]) => !packageOnly.has(key))
+  );
+  const preimage = {
+    product_id: snapshot.product_id,
+    format,
+    placement_refs: snapshot.placement_refs,
+    execution_vast_version: snapshot.execution_vast_version,
+    tracker_execution_contract_digest: snapshot.tracker_execution_contract_digest
+  };
+
+  assert.equal(sha256(snapshot.tracker_execution_contract), snapshot.tracker_execution_contract_digest);
+  assert.equal(sha256(preimage), snapshot.product_snapshot_digest);
+
+  const validateSnapshot = ajv.getSchema('/schemas/core/package-format-snapshot.json');
+  assert.equal(validateSnapshot(snapshot), true, JSON.stringify(validateSnapshot.errors));
+  assert.equal(validateSnapshot({ ...snapshot, product_id: undefined }), false);
+  assert.equal(validateSnapshot({ ...snapshot, format_option_id: undefined }), false);
+  assert.equal(validateSnapshot({ ...snapshot, tracker_execution_contract_digest: undefined }), false);
+  assert.equal(validateSnapshot({ ...snapshot, product_snapshot_digest: undefined }), false);
+  assert.equal(validateSnapshot({
+    format_kind: 'image',
+    params: { width: 300, height: 250 },
+    tracker_execution_contract_digest: snapshot.tracker_execution_contract_digest
+  }), false, 'a contract digest cannot appear without its contract');
+
+  const packageSchema = ajv.getSchema('/schemas/core/package.json').schema;
+  assert.equal(
+    packageSchema.properties.formats_to_provide.items.$ref,
+    '/schemas/core/package-format-snapshot.json'
+  );
+  assert.equal(
+    packageSchema.properties.formats_pending.items.$ref,
+    '/schemas/core/package-format-snapshot.json'
+  );
+  assert.match(
+    packageSchema.properties.formats_to_provide['x-adcp-validation']
+      .verifier_constraints.snapshot_identity,
+    /product_snapshot_digest is unique/
+  );
+});
+
+test('representation resolution carries exact tracker execution versions and distinct mismatch reasons', () => {
+  const destination = ajv.getSchema('/schemas/core/representation-destination.json');
+  const baseDestination = {
+    product_id: 'prod-video',
+    format_option: {
+      format_option_id: 'acme-vast',
+      format_kind: 'video_vast',
+      params: { vast_versions: ['4.2', '4.3'] },
+      tracker_execution_contract: { complete: true, honored: [vastSelector()] }
+    },
+    execution_vast_version: '4.2'
+  };
+  assert.equal(destination(baseDestination), true, JSON.stringify(destination.errors));
+  assert.equal(destination({ ...baseDestination, execution_vast_version: '4.4' }), false);
+
+  const selection = ajv.getSchema('/schemas/core/representation-selection.json');
+  const lineage = {
+    creative_id: 'cr-video',
+    revision_id: 'rev-1',
+    revision_content_digest: `sha256:${'1'.repeat(64)}`,
+    selected_representation_id: 'source-vast',
+    strategy: 'representation_order',
+    selected_output_digest: `sha256:${'2'.repeat(64)}`,
+    execution_vast_version: '4.2',
+    resolved_by: 'seller'
+  };
+  assert.equal(selection(lineage), true, JSON.stringify(selection.errors));
+  assert.match(
+    selection.schema['x-adcp-validation'].verifier_constraints.derived_output.review_identity,
+    /execution_vast_version-or-null/
+  );
+  assert.match(
+    selection.schema['x-adcp-validation'].verifier_constraints.derived_output.execution_version,
+    /re-resolution and ordinary re-review/
+  );
+
+  const rejection = ajv.getSchema('/schemas/core/representation-rejection.json');
+  assert.equal(rejection({
+    representation_id: 'source-vast',
+    code: 'tracker_contract_mismatch',
+    message: 'The normalized tracker selector is not honored'
+  }), true, JSON.stringify(rejection.errors));
+  assert.equal(rejection({
+    representation_id: 'source-vast',
+    code: 'macro_unsupported',
+    message: 'The tracker macro cannot be processed'
+  }), true, JSON.stringify(rejection.errors));
+});
+
+test('tracker contract and supporting vocabularies are discoverable in the schema registry', () => {
+  const registry = JSON.parse(fs.readFileSync(path.join(SCHEMAS, 'index.json'), 'utf8'));
+  const refs = [];
+  const visit = value => {
+    if (Array.isArray(value)) value.forEach(visit);
+    else if (value && typeof value === 'object') {
+      if (typeof value.$ref === 'string') refs.push(value.$ref);
+      Object.values(value).forEach(visit);
+    }
+  };
+  visit(registry);
+  for (const ref of [
+    '/schemas/core/tracker-execution-contract.json',
+    '/schemas/core/tracker-execution-selector.json',
+    '/schemas/core/package-format-snapshot.json',
+    '/schemas/enums/pixel-tracking-event.json',
+    '/schemas/enums/tracker-execution-actor.json',
+    '/schemas/enums/tracker-firing-path.json'
+  ]) {
+    assert.ok(refs.includes(ref), `${ref} must be discoverable in static/schemas/source/index.json`);
+  }
+});
+
+test('package task references retain contract snapshots after creative coverage', () => {
+  const createDocs = fs.readFileSync(
+    path.join(ROOT, 'docs/media-buy/task-reference/create_media_buy.mdx'),
+    'utf8'
+  );
+  const readDocs = fs.readFileSync(
+    path.join(ROOT, 'docs/media-buy/task-reference/get_media_buys.mdx'),
+    'utf8'
+  );
+  for (const docs of [createDocs, readDocs]) {
+    assert.match(docs, /PackageFormatSnapshot/);
+    assert.match(docs, /formats_to_provide/);
+    assert.match(docs, /formats_pending/);
+  }
+  assert.match(createDocs, /remains present after upload or assignment/);
+  assert.match(readDocs, /remains present after creative coverage is complete/);
+});
diff --git a/tests/tracker-execution-package-integration.test.cjs b/tests/tracker-execution-package-integration.test.cjs
new file mode 100644
index 0000000000..fae3b94828
--- /dev/null
+++ b/tests/tracker-execution-package-integration.test.cjs
@@ -0,0 +1,269 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+const Ajv = require('ajv');
+const addFormats = require('ajv-formats');
+
+const SCHEMA_BASE_DIR = path.join(__dirname, '../static/schemas/source');
+const DIGEST_A = `sha256:${'1'.repeat(64)}`;
+const DIGEST_B = `sha256:${'2'.repeat(64)}`;
+
+function schemaPathFromId(schemaId) {
+  return path.join(SCHEMA_BASE_DIR, schemaId.replace('/schemas/', ''));
+}
+
+async function loadExternalSchema(uri) {
+  if (!uri.startsWith('/schemas/')) throw new Error(`Cannot load external schema: ${uri}`);
+  return JSON.parse(fs.readFileSync(schemaPathFromId(uri), 'utf8'));
+}
+
+async function compile(schemaId) {
+  const ajv = new Ajv({
+    allErrors: true,
+    strict: false,
+    discriminator: true,
+    loadSchema: loadExternalSchema
+  });
+  addFormats(ajv);
+  return ajv.compileAsync(JSON.parse(fs.readFileSync(schemaPathFromId(schemaId), 'utf8')));
+}
+
+const contract = {
+  complete: true,
+  honored: []
+};
+
+const contractDeclaration = {
+  format_option_id: 'homepage_image',
+  format_kind: 'image',
+  params: { width: 300, height: 250 },
+  tracker_execution_contract: contract
+};
+
+const contractSnapshot = {
+  ...contractDeclaration,
+  product_id: 'homepage_sponsorship',
+  placement_refs: [{
+    publisher_domain: 'daily-pulse.example',
+    placement_id: 'homepage_leaderboard'
+  }],
+  tracker_execution_contract_digest: DIGEST_A,
+  product_snapshot_digest: DIGEST_B
+};
+
+test('contract-bearing product and compact declarations require stable option identity', async () => {
+  for (const schemaId of [
+    '/schemas/core/product-format-declaration.json',
+    '/schemas/core/canonical-format-option.json'
+  ]) {
+    const validate = await compile(schemaId);
+    assert.equal(validate(contractDeclaration), true, JSON.stringify(validate.errors, null, 2));
+    const { format_option_id: _omitted, ...withoutId } = contractDeclaration;
+    assert.equal(validate(withoutId), false, `${schemaId} accepted seller authority without stable identity`);
+    assert.equal(validate({ ...contractDeclaration, format_option_id: '' }), false,
+      `${schemaId} accepted an empty seller-authority identity`);
+  }
+
+  const validateLegacyProduct = await compile('/schemas/core/product-format-declaration.json');
+  assert.equal(validateLegacyProduct({
+    format_option_id: '',
+    format_kind: 'image',
+    params: { width: 300, height: 250 }
+  }), true, 'legacy non-contract Product declarations retain 3.1 empty-ID compatibility');
+
+  const validateCompact = await compile('/schemas/core/canonical-format-option.json');
+  assert.equal(validateCompact({
+    publisher_domain: 'daily-pulse.example',
+    format_kind: 'image',
+    params: { width: 300, height: 250 }
+  }), false, 'publisher-scoped compact options require their complete namespace pair');
+  assert.equal(validateCompact({
+    format_option_id: 'homepage_image',
+    publisher_domain: 'daily-pulse.example',
+    format_kind: 'image',
+    params: { width: 300, height: 250 }
+  }), true, JSON.stringify(validateCompact.errors, null, 2));
+});
+
+test('package snapshots pair contract, product identity, and immutable digests', async () => {
+  const validate = await compile('/schemas/core/package-format-snapshot.json');
+  assert.equal(validate(contractSnapshot), true, JSON.stringify(validate.errors, null, 2));
+
+  for (const requiredField of [
+    'format_option_id',
+    'product_id',
+    'tracker_execution_contract_digest',
+    'product_snapshot_digest'
+  ]) {
+    const invalid = { ...contractSnapshot };
+    delete invalid[requiredField];
+    assert.equal(validate(invalid), false, `contract snapshot accepted without ${requiredField}`);
+  }
+
+  assert.equal(validate({
+    format_kind: 'image',
+    params: { width: 300, height: 250 },
+    tracker_execution_contract_digest: DIGEST_A
+  }), false, 'tracker contract digest cannot exist without its contract');
+  assert.equal(validate({
+    format_kind: 'image',
+    params: { width: 300, height: 250 },
+    product_snapshot_digest: DIGEST_B
+  }), false, 'product snapshot digest must be paired with product identity');
+  assert.equal(validate({
+    ...contractSnapshot,
+    placement_refs: [{ placement_id: 'homepage_leaderboard' }]
+  }), false, 'new immutable placement snapshots require publisher-qualified identity');
+  assert.equal(validate({
+    ...contractSnapshot,
+    product_snapshot_digest: 'sha256:ABC'
+  }), false, 'snapshot digests use lowercase-hex SHA-256');
+});
+
+test('package and readback surfaces publish PackageFormatSnapshot rather than mutable declarations', async () => {
+  const validatePackage = await compile('/schemas/core/package.json');
+  assert.equal(validatePackage({
+    package_id: 'pkg_homepage',
+    product_id: 'homepage_sponsorship',
+    formats_to_provide: [contractSnapshot],
+    formats_pending: []
+  }), true, JSON.stringify(validatePackage.errors, null, 2));
+  assert.equal(validatePackage({
+    package_id: 'pkg_homepage',
+    product_id: 'homepage_sponsorship',
+    formats_to_provide: [contractDeclaration]
+  }), false, 'package checklist accepted a contract without immutable package identity');
+  assert.equal(validatePackage({
+    package_id: 'pkg_homepage',
+    formats_to_provide: [contractSnapshot],
+    formats_pending: []
+  }), false, 'package accepted a contract snapshot without enclosing product_id');
+  assert.equal(validatePackage({
+    package_id: 'pkg_legacy',
+    product_id: ''
+  }), true, 'legacy non-contract packages retain 3.1 empty-ID compatibility');
+  assert.equal(validatePackage({
+    package_id: 'pkg_homepage',
+    product_id: '',
+    formats_to_provide: [contractSnapshot],
+    formats_pending: []
+  }), false, 'contract-bearing packages require a nonempty enclosing product identity');
+
+  const validateReadback = await compile('/schemas/media-buy/get-media-buys-response.json');
+  const response = {
+    status: 'completed',
+    media_buys: [{
+      media_buy_id: 'mb_homepage',
+      status: 'pending_creatives',
+      currency: 'USD',
+      total_budget: 1000,
+      confirmed_at: '2026-08-23T12:00:00Z',
+      revision: 1,
+      packages: [{
+        package_id: 'pkg_homepage',
+        product_id: 'homepage_sponsorship',
+        formats_to_provide: [contractSnapshot],
+        formats_pending: []
+      }]
+    }]
+  };
+  assert.equal(validateReadback(response), true, JSON.stringify(validateReadback.errors, null, 2));
+  const legacyResponse = structuredClone(response);
+  legacyResponse.media_buys[0].packages = [{
+    package_id: 'pkg_legacy',
+    product_id: ''
+  }];
+  assert.equal(validateReadback(legacyResponse), true,
+    'legacy non-contract package readback retains 3.1 empty-ID compatibility');
+  delete response.media_buys[0].packages[0].product_id;
+  assert.equal(validateReadback(response), false,
+    'get_media_buys readback accepted a contract snapshot without enclosing product_id');
+  response.media_buys[0].packages[0].product_id = 'homepage_sponsorship';
+  response.media_buys[0].packages[0].formats_to_provide = [contractDeclaration];
+  assert.equal(validateReadback(response), false,
+    'get_media_buys readback accepted a mutable contract declaration in place of the snapshot');
+});
+
+test('Trusted Match receives the immutable package snapshot shape', async () => {
+  const validate = await compile('/schemas/trusted-match/available-package.json');
+  const available = {
+    package_id: 'pkg_homepage',
+    media_buy_id: 'mb_homepage',
+    seller_agent: { agent_url: 'https://seller.example/mcp' },
+    format_options: [contractSnapshot]
+  };
+  assert.equal(validate(available), true, JSON.stringify(validate.errors, null, 2));
+  available.format_options = [contractDeclaration];
+  assert.equal(validate(available), false,
+    'Trusted Match accepted a contract-bearing format without immutable package identity');
+});
+
+test('creative and legacy projection surfaces reject seller tracker authority', async () => {
+  const creativeOperationSchema = JSON.parse(fs.readFileSync(
+    path.join(SCHEMA_BASE_DIR, 'core/creative-operation-format-declaration.json'), 'utf8'
+  ));
+  assert.equal(
+    JSON.stringify(creativeOperationSchema).includes('/schemas/core/tracker-execution-contract.json'),
+    false,
+    'creative operation declaration must not compile the seller tracker graph'
+  );
+
+  const validateCapabilities = await compile('/schemas/protocol/get-adcp-capabilities-response.json');
+  assert.equal(validateCapabilities({
+    status: 'completed',
+    adcp: { major_versions: [3], idempotency: { supported: false } },
+    supported_protocols: ['creative'],
+    creative: {
+      supported_formats: [{
+        capability_id: 'homepage_image_builder',
+        operations: ['build'],
+        format: contractDeclaration
+      }]
+    }
+  }), false, 'creative.supported_formats leaked seller production authority');
+
+  const validateTransformer = await compile('/schemas/core/transformer.json');
+  assert.equal(validateTransformer({
+    transformer_id: 'homepage_transformer',
+    name: 'Homepage transformer',
+    input_formats: [contractDeclaration],
+    output_capability_ids: ['homepage_image_builder']
+  }), false, 'transformer input_formats leaked seller production authority');
+
+  const validateLegacyFormat = await compile('/schemas/core/format.json');
+  assert.equal(validateLegacyFormat({
+    format_id: { agent_url: 'https://creative.example/mcp', id: 'homepage_image' },
+    name: 'Homepage image',
+    canonical: { kind: 'image' },
+    canonical_parameters: contractDeclaration
+  }), false, 'deprecated canonical_parameters leaked seller production authority');
+});
+
+test('package snapshot is registered and all package projections reference it', () => {
+  const index = JSON.parse(fs.readFileSync(path.join(SCHEMA_BASE_DIR, 'index.json'), 'utf8'));
+  assert.equal(index.schemas.core.schemas['creative-operation-format-declaration'].$ref,
+    '/schemas/core/creative-operation-format-declaration.json');
+  assert.equal(index.schemas.core.schemas['package-format-snapshot'].$ref,
+    '/schemas/core/package-format-snapshot.json');
+
+  const packageSchema = JSON.parse(fs.readFileSync(
+    path.join(SCHEMA_BASE_DIR, 'core/package.json'), 'utf8'
+  ));
+  assert.equal(packageSchema.properties.formats_to_provide.items.$ref,
+    '/schemas/core/package-format-snapshot.json');
+  assert.equal(packageSchema.properties.formats_pending.items.$ref,
+    '/schemas/core/package-format-snapshot.json');
+  assert.match(packageSchema.properties.formats_pending.description,
+    /when product_snapshot_digest is present/);
+  assert.match(
+    packageSchema.properties.formats_pending['x-adcp-validation'].verifier_constraints.subset_identity,
+    /when product_snapshot_digest is present/
+  );
+
+  const trustedMatch = JSON.parse(fs.readFileSync(
+    path.join(SCHEMA_BASE_DIR, 'trusted-match/available-package.json'), 'utf8'
+  ));
+  assert.equal(trustedMatch.properties.format_options.items.$ref,
+    '/schemas/core/package-format-snapshot.json');
+});
diff --git a/tests/tracking-event-enums.test.cjs b/tests/tracking-event-enums.test.cjs
index 7646f86047..9734ea6a53 100644
--- a/tests/tracking-event-enums.test.cjs
+++ b/tests/tracking-event-enums.test.cjs
@@ -82,7 +82,12 @@ async function compileSchema(schemaPath) {
 
 // VAST 4.2 tracking events (includes flattened Impression, Error, VideoClicks, ViewableImpression)
 const VAST_PLAYBACK_EVENTS = ['impression', 'creativeView', 'loaded', 'start', 'firstQuartile', 'midpoint', 'thirdQuartile', 'complete'];
-const VAST_INTERACTION_EVENTS = ['mute', 'unmute', 'pause', 'resume', 'rewind', 'skip', 'playerExpand', 'playerCollapse', 'fullscreen', 'exitFullscreen', 'acceptInvitation', 'adExpand', 'adCollapse', 'minimize', 'overlayViewDuration', 'otherAdInteraction', 'interactiveStart'];
+const VAST_INTERACTION_EVENTS = [
+  'mute', 'unmute', 'pause', 'resume', 'rewind', 'skip',
+  'playerExpand', 'playerCollapse', 'fullscreen', 'exitFullscreen',
+  'acceptInvitation', 'adExpand', 'adCollapse', 'minimize',
+  'overlayViewDuration', 'otherAdInteraction', 'interactiveStart'
+];
 const VAST_PROGRESS_EVENTS = ['progress'];
 const VAST_CLICK_CLOSE_EVENTS = ['clickTracking', 'customClick', 'close', 'closeLinear'];
 const VAST_VERIFICATION_EVENTS = ['error', 'viewable', 'notViewable', 'viewUndetermined', 'measurableImpression', 'viewableImpression'];