The policy that half-deployed itself
Response headers were not available on the static host, so the whole policy went into a meta tag. Script violations report correctly, the browser reports the policy as active, and everything looked deployed.
Three of the directives in that tag are discarded before the policy is applied, and one of the three is the reporting directive — so the failure is invisible in the console and in the report stream at the same time.
Boundaries, outermost first: Delivered in a meta tag: frame-ancestors 'none' (who may embed us), form-action 'self' (where forms may post), base-uri 'none' (pins the document base), script-src 'nonce-…' (the nonce rule), sandbox (restricts this document), report-uri /csp (where reports go) Outside every boundary: Attacker's frame (embedded it anyway; FAILED: framed), The page (policy in a meta tag) Connections: Attacker's frame calls The page — framed it anyway (step 1)