🧩 App — app.test

This stands in for an app on its own registrable domain. It embeds an 16.146.49.190.sslip.io iframe and tries to read the IdP session cross-site — exactly like Audible's crossDomainAuthContext probe against amazon.com.

Step 0 (once) — open https://16.146.49.190.sslip.io/, click its button (sets the cookie + first-party interaction), then come back here.
Automatic — the iframe below runs on load. On a first visit it shows a one-time grant button (browsers require one gesture to bootstrap). Grant it once, then reload this page: the iframe now grants silently, zero clicks, and the server sees sid + presence. That silent-on-reload path is the visit-2..N behavior the design's presence flag relies on.

Embedded IdP iframe

A) Iframe read — requestStorageAccess() (universal, all engines)

What the app received from the iframe via postMessage:

waiting for iframe…

B) Top-level cross-origin CORS read — the Audible crossDomainAuthContext shape

app.test itself fetches https://16.146.49.190.sslip.io/whoami with credentials:'include'. This uses a different grant than the iframe. Run it under the same 3PC/grant state and compare to (A).

not run yet