- embedCsp is connectSrc + wasmUnsafeEval + blob (all default off), not per-directive lists - cross-origin script/worker loading is unsupported; fetch + Blob is the supported path - check-app.sh/selftest validate flags and platform capability boundaries