Iframe embed, customer B

A byte-for-byte copy of the plain iframe case on a second site. Its only job is to hold the embed mode constant so the thing that changes is which customer you are.

Player runs on	`control.jefflowery.dev` — third-party to this page
Config comes from	query params on the frame src, mapped to `data-*` by `standAlone()`
Sign-in transport	iframe, escalating to a popup when storage is unreachable
This page can read the viewer id	no — the result is addressed to the player’s origin
Differs from “iframe” by	the top-level site, and nothing else

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  allow="autoplay; fullscreen"
  allowfullscreen="true"
  title="Resi player"></iframe>

Expected

Sign in on the iframe case, then load this page: you are asked to sign in again.
That is storage partitioning, not a defect. The Firebase session lives in firebase:authUser:<apiKey>:[DEFAULT] in a bucket keyed to the top-level site, so customer A’s bucket is not customer B’s.
It also means the same viewer gets a different sign-in prompt per customer — the first question product will ask, and the answer is that only a Resi-owned session could change it.
Each pages.dev project is its own site under the Public Suffix List, which is what makes this a real test rather than two hostnames sharing a jar.

Messages reaching this page

Same as the plain iframe case.

include same-origin messages (browser extensions)

nothing yet