diff --git a/tests/oracle/DELTAS.md b/tests/oracle/DELTAS.md
index 8e364f066..53b29040f 100644
--- a/tests/oracle/DELTAS.md
+++ b/tests/oracle/DELTAS.md
@@ -24,3 +24,12 @@ is that wording; behavior, exit codes, and every other byte are unchanged.
 - `hook-session-fresh-then-pending-then-stop`, `hook-session-two-sessions`, `hbe-denial-downgrade-after-6`: the short footer names `impeccable hooks ignore-value`.
 - `live-help`, `live-accept-help`, `live-inject-help`, `live-insert-help`, `live-server-help`, `live-resume-help`, `live-commit-help`, `live-discard-help`, `live-complete-help`, `live-complete-no-id`: usage text names `impeccable live*` verbs.
 - `live-server-already-running`, `live-daemon-server-status-poll-complete`, `live-status-empty`, `live-status-generating`, `live-status-many-sessions`, `live-status-stale-server-json`, `live-status-legacy-sessions-dir`, `live-status-from-subdir`, `live-status-manual-apply`, `live-resume-manual-apply`, `live-status-mount-failed`, `live-resume-mount-failed`, `live-resume-generating`, `live-resume-by-id`, `live-resume-first-active-sorted`, `live-resume-accept-requested`, `live-resume-carbonize-required`: recovery hints and next-command lines spell `<self> live-poll` / `live-server` / `live-complete` / `live-commit-manual-edits` instead of the `.mjs` names.
+
+## Recorded 2026-08-17: live-inject adds `'wasm-unsafe-eval'` to a CSP meta script-src
+
+The detector the live overlay loads from the helper origin is a WebAssembly
+module in the engine (its `docs/WASM-BUNDLE.md`); a `script-src` that names the
+origin but not `'wasm-unsafe-eval'` still refuses to compile it. The JS
+`patchCspMeta` predates the wasm bundle and appended only the origin.
+
+- `live-inject-csp-meta-no-connect-src`: the patched `<meta http-equiv="Content-Security-Policy">` reads `script-src 'self' http://localhost:8412 'wasm-unsafe-eval'` (was `script-src 'self' http://localhost:8412`). The `data-impeccable-csp-original` marker, the `connect-src` and `img-src` additions, idempotence, and the revert on unpatch are unchanged. `live-inject-vite-csp-meta` and `live-inject-next-jsx` carry meta tags the patch does not touch, so their goldens did not move.
diff --git a/tests/oracle/golden/live-inject-csp-meta-no-connect-src.json b/tests/oracle/golden/live-inject-csp-meta-no-connect-src.json
index f479d35e7..7ab9439bb 100644
--- a/tests/oracle/golden/live-inject-csp-meta-no-connect-src.json
+++ b/tests/oracle/golden/live-inject-csp-meta-no-connect-src.json
@@ -7,6 +7,6 @@
     ".gitignore": "# impeccable-live-ignore-start\n.impeccable/hook.cache.json\n.impeccable/hook.pending.json\n.impeccable/config.local.json\n.impeccable/live/server.json\n.impeccable/live/roots.json\n.impeccable/live/app-root.json\n.impeccable/live/inject-journal.json\n.impeccable/live/sessions/\n.impeccable/live/previews/\n.impeccable/live/annotations/\n.impeccable/live/artifacts/\n.impeccable/live/accept-receipts/\n.impeccable/live/locks/\n.impeccable/live/cache/\n.impeccable/live/manual-edit-apply-transaction.json\n.impeccable/live/manual-edit-events.jsonl\n.impeccable/live/manual-edit-evidence/\n.impeccable/live/pending-manual-edits.json\n.impeccable/live/deferred-svelte-component-accepts.json\n.impeccable-live.json\n.impeccable-live/\napp/.impeccable-live/\nsrc/.impeccable-live/\nnode_modules/.impeccable-live/\nsrc/lib/impeccable/ImpeccableLiveRoot.svelte\nsrc/lib/impeccable/__runtime.js\nsrc/lib/impeccable/[0-9a-f]*/\nplugins/impeccable-live.client.ts\napp/plugins/impeccable-live.client.ts\nsrc/plugins/impeccable-live.client.ts\n# impeccable-live-ignore-end\n",
     ".impeccable/live/config.json": "{\n  \"files\": [\"index.html\", \"public/**/*.html\"],\n  \"insertBefore\": \"</body>\",\n  \"commentSyntax\": \"html\"\n}\n",
     ".impeccable/live/inject-journal.json": "{\n  \"version\": 1,\n  \"appRoot\": \"<WS>\",\n  \"framework\": \"static-html\",\n  \"port\": 8412,\n  \"pid\": <PID>,\n  \"recordedAt\": \"<ISO>\",\n  \"artifacts\": [\n    {\n      \"kind\": \"patched\",\n      \"path\": \"index.html\",\n      \"patch\": \"live-tag\",\n      \"markers\": [\n        \"impeccable-live-start\",\n        \"data-impeccable-csp-original\"\n      ]\n    },\n    {\n      \"kind\": \"patched\",\n      \"path\": \"public/docs/guide.html\",\n      \"patch\": \"live-tag\",\n      \"markers\": [\n        \"impeccable-live-start\",\n        \"data-impeccable-csp-original\"\n      ]\n    }\n  ]\n}\n",
-    "index.html": "<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'self'; script-src 'self' http://localhost:8412; connect-src 'self' http://localhost:8412; img-src 'self' blob:\" data-impeccable-csp-original=\"ZGVmYXVsdC1zcmMgJ3NlbGYnOyBzY3JpcHQtc3JjICdzZWxmJw==\">\n</head>\n<body>\n<h1 class=\"hero-title\">Hi</h1>\n<!-- impeccable-live-start -->\n<script src=\"http://localhost:8412/live.js?token=t\"></script>\n<!-- impeccable-live-end -->\n</body>\n</html>\n"
+    "index.html": "<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'self'; script-src 'self' http://localhost:8412 'wasm-unsafe-eval'; connect-src 'self' http://localhost:8412; img-src 'self' blob:\" data-impeccable-csp-original=\"ZGVmYXVsdC1zcmMgJ3NlbGYnOyBzY3JpcHQtc3JjICdzZWxmJw==\">\n</head>\n<body>\n<h1 class=\"hero-title\">Hi</h1>\n<!-- impeccable-live-start -->\n<script src=\"http://localhost:8412/live.js?token=t\"></script>\n<!-- impeccable-live-end -->\n</body>\n</html>\n"
   }
 }