Resolve no-cors Fetch responses at their headers in Window and worker realms, preserving header policy checks and cancellation. Keep suspect opaque bytes in capture storage until the existing ORB classifier approves them, including clone, CacheStorage and service-worker consumers.
Verify unfinished streams and real connection closure across Window, child Window and worker realms. All workspace gates pass; 83 related WPT cases gain two abort subtests without regressions.