Keep captured policy origins ahead of native-origin and Document URL
fallbacks without cloning and mutating a shared parsed policy for each
check. Reuse the same connect check entry point for the top Document.
Cover fallback priority, per-check isolation, and report attribution and
relative endpoint resolution for both policy dispositions.
Resolve relative report-uri endpoints against the full response URL at policy
delivery, and retain them with the policy across popup and srcdoc inheritance.
Keep the actual Document URL in connect checks and supply native origin only
as a self-matching fallback for unbound local policies.
Reuse the existing owner policy snapshot for child and popup checks. Capture
actual report POST paths for both WebSocket constructors, cover policy clones
and report-only disposition, and preserve local popup meta CSP matching.
Capture response policy self-origins at delivery and use them independently
of the protected document URL for source-list checks. Inherited policies
retain this identity when sandboxing makes the request origin opaque.
Use effective inherited connect policies for child documents and resolve
their popup owner before falling back to the host document. Cover real TLS
handshakes with Origin: null, base changes, popup ownership, and blocked
foreign targets with CSP violation events and no network request.
ldm0