S809 — cross-site zero-click plant

This page is on a different registrable domain from clerk.com (vercel.app is on the Public Suffix List, so this really is cross-site). Loading it fires one <img> subresource request to img.clerk.com. No clicks, no navigation, no user gesture.

status: waiting for a URL

Then, in DevTools

1. Application → Cookies → https://clerk.com. Look for __session / __session_<suffix> / __client_uat* at Domain=.clerk.com; Path=/apps, and __client at Path=/v1.
   Present → the cross-site zero-click plant works. Absent → it does not.
2. Flip the SAMESITE env to Lax, redeploy, hard-reload this page. The blob is unchanged. Cookies should now fail to land — that reproduces Gate B′ and isolates the attribute as the sole cause.
3. The F-730 / F-728 residual. Go to dashboard.clerk.com (signed in as the victim account) and run document.cookie in the console. Report the order of the two __session_<suffix> entries. Nothing in the corpus yet proves document.cookie ordering for a genuine Domain=.clerk.com cookie against a host-only one on a real registrable domain — this retires it.
4. Repeat with Chrome third-party cookies blocked (Settings → Privacy and security → Third-party cookies → Block). That measures the immune population and bounds the severity honestly.

Note: this page cannot read clerk.com cookies — it is cross-origin. It only triggers the request. DevTools is the oracle.