Spike 0.5 — cookie lifetime by serving mode

Reached via Mode B — CNAME custom hostname · /

Three cookies, three mechanisms, all requesting a 1-year expiry. Visit this page through BOTH modes, then return after 8+ days.

Loading…

What we expect

Cookie	Set by	Safari after 8d
`_m1d_js`	document.cookie	gone (7-day cap)
`_m1d_cname`	Set-Cookie via CNAME host	gone — WebKit CNAME Cloaking Defense
`_m1d_origin`	Set-Cookie same-origin route	alive — the whole point

If _m1d_origin survives and _m1d_cname doesn't, ADR-006's revised ordering is confirmed: push for zone access, treat CNAME as degraded fallback. If neither survives, first-party cookies are not a lever at all in Safari and the value story rests entirely on server-side matching (which is unaffected either way).

Instructions

Open in Safari (macOS and iOS). Chrome/Firefox as controls.
Visit both URLs so all three cookies get minted.
Return after 8+ days. Don't clear cookies, don't use private browsing.
Record ages in RESULTS.md.

Note: Safari's ITP counts days of browser use, not calendar days — open Safari most days or the cookie may not age.