diff --git a/deployment/src-tauri/README.md b/deployment/src-tauri/README.md
index 96b31a741..49e842dab 100644
--- a/deployment/src-tauri/README.md
+++ b/deployment/src-tauri/README.md
@@ -62,8 +62,16 @@ capability-5 app, not the gallery index. 1440×900 is the viewport the SPA is ve
 renders 11 rows there: 6 curated + 5 auto-discovered).
 
 `security.csp` is `null` so the page inherits whatever it declares when served, matching CDN
-behaviour. Do not tighten it without re-running the mount check: the bundles self-host `mapbox-gl`
-from `public/assets/vendor/` (the no-CDN rule), so a naive `script-src` would break every map.
+behaviour. Do not tighten it without re-running the mount check: the leaf pages load their map
+engine from a **CDN** — `api.mapbox.com/mapbox-gl-js/…` for Mapbox and `cdn.jsdelivr.net/npm/
+maplibre-gl@5/…` for MapLibre (see the `ENGINES` registry in
+`library/composables/useMapInstance.js`). A naive `script-src 'self'` would break every map.
+
+> **Corrected 2026-09-21.** This previously claimed the bundles "self-host `mapbox-gl` from
+> `public/assets/vendor/` (the no-CDN rule)". That is **false** — measured: `vendor/` contains only
+> `tabulator`, and the leaves carry `src="https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js"`.
+> A CSP written from the old sentence would have been wrong in exactly the way that produces a
+> blank map, so the error mattered.
 
 ## Commands