GSI-687 repro: three same-origin scripts at 200,000 / 307,100 / 400,000 bytes.
Hypothesis: client-side security fetches+hashes the first two, never the third.