================================================================================
Run 1: --disable-site-isolation-trials  (matches Android default partial SI)
        -> exercises IsCrossOriginToOutermostMainFrame() == false branch
================================================================================
[PAGE] fake AR device connected; window.top===window: false
[PAGE] attacker.html ready, waiting for click
[PAGE] user activation: true
[PAGE] immersive-ar + dom-overlay session created in cross-origin subframe (origin B = http://127.0.0.1:8765)
[PAGE] VICTIM  (origin-A iframe, same-origin as top, cross-origin to B): select=true beforexrselect=true targetRayPose=NON-NULL inputSources.length=1
[PAGE] CONTROL (data: iframe, cross-origin to top): select=false beforexrselect=false targetRayPose=NON-NULL inputSources.length=1
[PAGE] VULNERABLE: origin B observed XR input over origin-A content (select=true, beforexrselect=true, pose=exposed). Spec requires suppression because the iframe is cross-origin to the XR session document; Chromium only checked against the outermost main frame.
[PAGE] DONE

================================================================================
Run 2: default desktop site isolation (inner origin-A iframe is OOPIF)
        -> exercises contentDocument()==nullptr fall-through
================================================================================
[PAGE] fake AR device connected; window.top===window: false
[PAGE] attacker.html ready, waiting for click
[PAGE] user activation: true
[PAGE] immersive-ar + dom-overlay session created in cross-origin subframe (origin B = http://127.0.0.1:8765)
[PAGE] VICTIM  (origin-A iframe, same-origin as top, cross-origin to B): select=true beforexrselect=true targetRayPose=NON-NULL inputSources.length=1
[PAGE] CONTROL (data: iframe, cross-origin to top): select=false beforexrselect=false targetRayPose=NON-NULL inputSources.length=1
[PAGE] VULNERABLE: origin B observed XR input over origin-A content (select=true, beforexrselect=true, pose=exposed). Spec requires suppression because the iframe is cross-origin to the XR session document; Chromium only checked against the outermost main frame.
[PAGE] DONE