Binding every saved URI made a URI the user explicitly set to "Never" match (match=5) a valid fill target — wider than the manager's own policy. Filter those out; all other URIs keep exact-origin semantics. Review finding: match=5 (Never) URIs became fill origins.