UNPROTECTED ORIGIN — S1 CSP nonce baseline
This page is the normal/before state. It has NO Content-Security-Policy header and NO nonce attributes on its script tags (except one stale origin nonce that the capability worker will replace).
Script count in this response: 64 (head, body, and noscript fixtures combined; >=50 by design).
Script fixtures appear before the noscript region, inside nested/malformed noscript blocks, and after the noscript region.