Same about:blank + scripted no-gesture navigation as Case 1, but the FINAL download is a 302 to a REAL cross-origin object (AWS S3 / test-pages) that you upload and set in ivalua_download2.php. This matches the customer flow ivalua.docebosaas.com -> lmsfiles.s3.eu-west-1.amazonaws.com (Sec-Fetch-Site: cross-site) and uses a genuine pptx/zip with real scan time.