Capture the loader's browser cookie scope on the retained Service Worker
request before a synthetic redirect advances its SameSite restrictions.
Reuse the transport binding to preserve frame partition keys and Storage
Access settings without applying the network-only policy early.
Add a lightweight initial-blank popup regression with a direct network
control, a synthetic SW redirect, and server-side Cookie/Referer assertions.
Bind the request retained by the CORS redirect loop to the loader's cookie
scope before dispatching single-hop transport copies. Reuse the transport
binding so frame partition keys and Storage Access settings stay intact.
Preserve the selected referrer before Cookie origin adaptation, including
an absent referrer. Keep this in Request::follow_redirect and remove the
navigation-only duplicate.
Add live-server regressions for inherited-origin iframe fetch and sync/async
XHR, plus a multi-hop referrer test with a permissive response policy.
Keep request origin independent of URL resolution and referrer context,
including local blob fetches and inherited or sandboxed srcdoc documents.
Reject missing browser origins at the resource client boundary and retain
one Request across Service Worker redirects and network fallback.
Cover dispatch rejection, wire Origin/Cookie headers, memory-cache
partitioning and preserved Service Worker request metadata.
Validation: workspace fmt and Clippy passed; Nextest passed 17,517 tests
with 13 existing skips. Renderer test debug symbols were disabled to fit
available build memory; tests and debug assertions were unchanged.
ldm0