Spike 2 — loam-subapp-host

Real *.loamusercontent.com origin. Token-gated HTML from the private apps bucket. Sandbox has no allow-same-origin.

waiting
    Open unauthorized framer

    Add a journal entry in the iframe, wait for sync ok, then Reload iframe. Then confirm the row in app_data via SQL.

    Cloud snapshot (from worker)
    {}
    Log