I am also seeing the IEEE 502/retry pattern, and have isolated a more general difference in cookie and referrer handling between Zotero.HTTP.download() and Zotero.HTTP.request() (XHR).

Environment tested: Zotero 10.0.5, Gecko 140.15.0, macOS 26.7.1.

The self-contained MWE below calls the actual core downloader against a temporary local server. It needs no IEEE subscription, publisher URL, Python, or plugin. The server separately requires a dummy cookie, the supplied Referer, or both.

Observed results:

Server requirement          HTTP.request (XHR)   HTTP.download
None (download sanity check)  not tested           200, file saved
Dummy cookie only             200                  403, no file
Supplied Referer only         200                  403, no file
Both                          200                  403, no file

For all three protected cases, XHR sent the dummy cookie and the exact supplied Referer. The core downloader sent neither, even though both methods received the same Referer header option. Cookie and referrer requirements therefore fail independently in this fixture.

Important: the fixture deliberately returns 403 for missing test context. This reproduces the request-handling difference, not IEEE's particular 502 response or its access policy. In my real IEEE test, XHR and fetch with explicit credentials/referrer downloaded the PDF successfully while the default fetch request returned 502; an IEEE-only XHR compatibility wrapper restored normal updates.

To reproduce: in Zotero 10, open Tools → Developer → Run JavaScript, check “Run as async function”, paste the script, and run it. Everything stays on localhost. It creates and cleans up temporary files, its uniquely named dummy cookie, and the local listener; it does not change library items or preferences. The output includes only test-cookie presence and referrer-match flags, not real cookie values.

// Zotero: Tools > Developer > Run JavaScript; select "Run as async function".
// No publisher, Python, or plugin required. No library/preferences change.
// Creates a loopback fixture, a dummy cookie, and temporary files; cleans them.
const { HttpServer } = ChromeUtils.importESModule("chrome://remote/content/server/httpd.sys.mjs");
const server = new HttpServer();
const token = Services.uuid.generateUUID().toString().replace(/[{}-]/g, "");
const cookieName = "zotero_mwe_" + token, prefix = "/zotero-mwe-" + token + "/";
const files = [], results = [];
let started = false, base, article;
const cookieHeader = age => `${cookieName}=1; Path=${prefix}; Max-Age=${age}; SameSite=None; Secure; HttpOnly`;
function endpoint(name, needsCookie, needsReferrer) {
  server.registerPathHandler(prefix + name, (request, response) => {
    const cookie = request.hasHeader("Cookie") && request.getHeader("Cookie")
      .split(";").some(value => value.trim() === cookieName + "=1");
    const referrer = request.hasHeader("Referer") && request.getHeader("Referer") === article;
    const ok = (!needsCookie || cookie) && (!needsReferrer || referrer);
    // Synthetic 403 tests missing context; this is not a publisher response.
    response.setStatusLine(request.httpVersion, ok ? 200 : 403, ok ? "OK" : "Missing test context");
    response.setHeader("Cache-Control", "no-store", false);
    response.setHeader("Content-Type", "text/plain", false);
    response.setHeader("X-MWE-Cookie", cookie ? "present" : "absent", false);
    response.setHeader("X-MWE-Referrer", referrer ? "matches" : "missing-or-different", false);
    response.write(ok ? "Local fixture download succeeded\n" : "Required dummy context missing\n");
  });
}
async function probe(method, name) {
  const options = { headers: { Referer: article }, timeout: 10000,
    errorDelayMax: 0, noRetryOnThrottle: true, successCodes: false };
  let file;
  try {
    let response;
    if (method === "XHR") {
      response = await Zotero.HTTP.request("GET", base + prefix + name,
        { ...options, responseType: "arraybuffer" });
    } else {
      file = Services.dirsvc.get("TmpD", Components.interfaces.nsIFile).clone();
      file.append("zotero-http-mwe-" + token + "-" + name + ".tmp");
      files.push(file.path);
      response = await Zotero.HTTP.download(base + prefix + name, file.path, options);
    }
    const header = name => response.headers ? response.headers.get(name) : response.getResponseHeader(name);
    results.push({ method, test: name, status: response.status,
      dummyCookie: header("X-MWE-Cookie"), suppliedReferrer: header("X-MWE-Referrer"),
      ...(file ? { fileSaved: file.exists() } : {}) });
    if (response.status !== 200 && response.arrayBuffer) await response.arrayBuffer();
    return response.status;
  } catch (error) { results.push({ method, test: name, error: String(error) }); }
}
try {
  server.start(-1); // Bundled API binds loopback only on an unused port.
  started = true;
  base = "http://localhost:" + server.identity.primaryPort;
  article = base + prefix + "article";
  for (const [name, age] of [["seed", 300], ["cleanup", 0]]) {
    server.registerPathHandler(prefix + name, (request, response) => {
      response.setHeader("Set-Cookie", cookieHeader(age), false);
      response.write("Dummy cookie only");
    });
  }
  endpoint("public", false, false);
  endpoint("cookie", true, false);
  endpoint("referrer", false, true);
  endpoint("both", true, true);
  await Zotero.HTTP.request("GET", base + prefix + "seed", { timeout: 10000, errorDelayMax: 0 });
  await probe("HTTP.download", "public");
  for (const name of ["cookie", "referrer", "both"]) {
    if (await probe("XHR", name) !== 200)
      results.push({ test: name, note: "XHR control failed; this case is inconclusive." });
    await probe("HTTP.download", name);
  }
} finally {
  for (const file of files) await Zotero.File.removeIfExists(file)
    .catch(error => results.push({ cleanupError: String(error) }));
  if (started) {
    await Zotero.HTTP.request("GET", base + prefix + "cleanup", { timeout: 10000, errorDelayMax: 0 })
      .catch(error => results.push({ cookieCleanupError: String(error) }));
    await server.stop();
  }
}
return JSON.stringify({ zotero: Zotero.version, gecko: Services.appinfo.platformVersion,
  fixture: "Loopback only; synthetic 403 means required dummy context was absent", results }, null, 2);

Could this be a request-context regression from the switch to streaming fetch? Would a core PR preserving streaming while restoring the appropriate cookie/referrer behavior, with regression tests, be welcome?