[copyrighthero]

Send the DELETE /v1/delete_user request for a retired context id from the ads client, over the same OHTTP channel as the ad request, instead of as a direct request from the embedded context_id component.

Changes

• Adds MARSClient::delete_user(context_id, ohttp): DELETE /v1/delete_user with {"context_id": ...} through MARSTransport, 5 s timeout on the relay request, over the ads-client OHTTP channel when asked. If OHTTP is asked for and the channel is not configured it fails with OhttpChannelNotConfigured; there is no fallback to a direct request.
• Disables the component's own request by passing DISABLE_CONTEXT_ID_COMPONENT_DELETION (true) as running_in_test_automation, the same thing Firefox does for its JS-side component in browser/modules/ContextId.sys.mjs. This replaces the cfg!(test) passed there before, which only disabled it in test builds.
• Adds ContextIdDeletionQueue as the ContextIdCallback: rotated ids are queued, and request_ads takes them before its ad fetch and sends their deletions right after it, with that call's OHTTP setting. The flush runs whether or not the fetch succeeded. Without OHTTP the deletion is skipped and logged; failures are logged and not retried.
• Behavior change for consumers without an OHTTP channel: consumers that do not configure a viaduct OHTTP channel named ads-client stop sending the deletion request after this lands. The context id still rotates on the same schedule. Configuring the channel and passing ohttp: true on ad requests makes it resume.
• Updates the ohttp row of MozAdsRequestOptions in the Kotlin, Swift and JavaScript usage docs to say it also applies to the deletion request.
• Adds unit tests for the request format, the fail-closed path, the skip-without-OHTTP path and flush-after-failed-fetch, plus an env-gated production contract test (ADS_CLIENT_PROD_DELETE_USER_CONTRACT=1 -- --ignored --nocapture). Ran it by hand: HTTP 200 observed 2026-10-14 through the production relay and gateway. It returns without sending unless the env var is set, so CI's --ignored run does not touch production.
• CHANGELOG entry under v160.0.

No changes to ffi.rs, the binding APIs, or components/context_id/.

For the reviewer: the flush is synchronous inside request_ads, so once per rotation one ad request can take longer (one relay request with a 5 s timeout, plus a 10 s gateway key fetch if the key cache is cold). If the worker direction in #7597 lands first it seems natural to move it there; happy to rebase either way. Two spots worth a close look: get_context_id() and take_all() are separate critical sections, so an overlapping call can drain an id a different call rotated. Since #7647, requests with relevance scores skip get_context_id(), so they never rotate the id, but they still flush any ids already queued. And scope: this changes which path carries the deletion, not when it is sent; it does not address correlation by request timing. The component's own request path will be removed in a follow-up. Thank you so much for taking a look!!

Pull Request checklist

• Breaking changes: This PR follows our breaking change policy
  • This PR follows the breaking change policy: no breaking API changes. The network behavior change for consumers without an OHTTP channel is described above.
• Quality: This PR builds and tests run cleanly
• Tests: Unit tests above, plus a manually run, env-gated production contract test
• Changelog: Entry added under v160.0 → Ads-Client
• Dependencies: No new dependencies