Ads will use window.name as a way of doing one-time injection of content into a frame. The SafeFrame spec requires this. The problem is that window.name is meant for a different purpose, so has to be replicated across processes and data structures. 

We should consider building an explicit injection API and get them to migrate, then put a limit on the allowed length of window.name.

-srcdoc could almost be that, except they need to have the origin be their usual origin and you can't have both src and srcdoc.
-postMessage could be that if it queued up instead of failing when the iframe isn't loaded yet.

So, one possible implementation here could be an extra argument on postMessage to queue. That actually could solve a lot of problems with postMessage that would allow people to avoid things like polling while the iframe is booting up.