Iframe embed, sandboxed correctly

The same hardening with the flags sign-in actually needs. This is the recipe to hand a customer who insists on a sandbox.

Player runs on	`control.jefflowery.dev` — third-party to this page
Sandbox	`allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox`
Sign-in transport	iframe, escalating to a popup when storage is unreachable
This page can read the viewer id	no

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  class="resi-video-frame"
  sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  allow="autoplay; fullscreen"
  title="Resi player"></iframe>

Expected

Identical to the plain iframe case in every browser, including the Safari popup escalation.
allow-popups lets the window open at all. allow-popups-to-escape-sandbox is the one people miss: without it the popup inherits the sandbox, and the provider’s login page runs crippled inside it.
allow-same-origin is required too, or the frame gets an opaque origin and has no storage of its own to sign into.

Messages reaching this page

Every postMessage delivered to this window, newest last, with repeats collapsed. In this case:

Nothing at all, in the normal case. There is no page.min.js here, so nobody sends PING_PLAYER and the player has nothing to answer — the parent contract is opt-in. See the page script case for what it looks like when it runs.
Nothing after signing in either. The sign-in page posts to the window running the player, which is the frame, not this page. That absence is the check: the counter for viewer ids must stay at zero.
Extension chatter under [this page] if you tick the box. Not ours.

cross-origin 0 this page 0 carrying a viewer id 0 show this page’s own messages

Messages tagged [this page] come from this document’s own origin and are hidden by default. They are browser extensions: password managers, React DevTools and the like all inject content scripts that post on this page’s behalf. Nothing from the player or the sign-in page can appear under that tag.