This page is served from miv-cme-host.pages.dev; the widget is served
from miv-cme-spike.pages.dev. Different origin, so every frame below is a
genuine third-party embed — the same relationship the widget has inside Wix, minus Wix.
Wix is unavailable, so this is standing in for it.
Each frame varies exactly one thing. Read each widget's own debug panel for its
readings; the shared log at the bottom shows what reached this parent.
?mode=fixed — 16:9 box. Parent acks resize messages. The baseline
we expect to ship. It sends ping, not resize, so the
ack proves the channel while the box deliberately stays put.
?mode=auto — natural height, resize protocol live, parent applies the
height it is asked for. This is the "self-sizing works" case, and the only
frame whose box should visibly change size.
?probe=1 — the widget sends resize, the parent acks but
refuses to apply it. Separates "acks arrive" from "the height was actually
applied", which are different failures on Wix.
?mode=auto, but this parent deliberately ignores messages from this
frame and never acks. This is the plain Wix HTML embed with no Velo code.
Its panel should read N sent / 0 ack → NO PARENT LISTENER. Everything
else about it is identical to frame 2, so the difference is attributable.
Sandbox set to allow-scripts allow-same-origin allow-popups allow-forms
allow-presentation — the permissive set an embed host typically uses.
Because allow-same-origin is present the origin stays real, so this
should behave like frame 2.
Sandbox is allow-scripts only. This is the risk case: dropping
allow-same-origin gives the document an opaque origin.
Expect window.origin: null, storage APIs throwing, and the server
seeing Origin: null — which would defeat an origin allow-list. This is
our early reading on whether Wix's HTML-code mode is viable at all.