The site sends script-src 'self'. The panel's logic was an inline <script>
block, so the browser refused to run it: window.agBoot was never defined,
admin.js's guarded call did nothing, and the "What" select stayed empty with
no console-visible cause beyond the CSP report.
admin.html had no inline scripts before this panel — the extraction restores
that, so the next person adding a panel copies a pattern that works.
Fourth thing this CSP has silently broken. Inline scripts are not an option
on this site; new panels ship as files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
martbost