you keep naming CORS but the SharedArrayBuffer requires COEP

the sync_main_only = true is mostly legacy, right now we don't care about that config so it should probably go.

PyScript does its best to work out of the box, when it cannot use SharedArrayBuffer it warns you that you cannot access document or window from workers, that's it ... that's the current story.

I won't work on this topic because there's nothing we can do, it's the way SharedArrayBuffer landed on the Web that is complicated, more than a warning and docs around SharedArrayBuffer I don't think we should waste our time there.