diff --git a/data/vendor/tabulator/LICENSE b/data/vendor/tabulator/LICENSE
new file mode 100644
index 000000000..3388c4491
--- /dev/null
+++ b/data/vendor/tabulator/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2026 Oli Folkerd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/data/vendor/vue/LICENSE b/data/vendor/vue/LICENSE
new file mode 100644
index 000000000..8fd17290c
--- /dev/null
+++ b/data/vendor/vue/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018-present, Yuxi (Evan) You and Vue contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/documentation/THIRD-PARTY.md b/documentation/THIRD-PARTY.md
new file mode 100644
index 000000000..bcfe354fb
--- /dev/null
+++ b/documentation/THIRD-PARTY.md
@@ -0,0 +1,44 @@
+# Third-party content in the shipped tree
+
+Every non-original thing `dx-maps/` ships, what licenses it, and whether the licence or
+attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the
+source lists -- the question is what a recipient receives.
+
+Notes live HERE and not beside the assets: `check:public-hygiene` fails on "documentation in a
+served folder". The licence travels with the asset; the explanation travels with the repo.
+
+| Item | Source | Licence | Does it travel? | Gap |
+|---|---|---|---|---|
+| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | **Yes** — each `LICENSE` is the family's own upstream OFL, verbatim, with its real copyright line | none (closed 2026-09-28) |
+| `vendor/vue/vue.global.prod.js` | vuejs/core | MIT | **Partly** — the minified banner carries `(c) 2018-present Yuxi (Evan) You` and `@license MIT`, but NOT the permission notice MIT asks to include | closed: upstream `LICENSE` now vendored beside it |
+| `vendor/tabulator/tabulator.min.js` + `.min.css` | olifolkerd/tabulator v6.3.1 | MIT | **No** — the `.js` had only `(c) Oliver Folkerd 2025`; the `.css` had nothing | closed: upstream `LICENSE` now vendored beside it |
+| `boundaries/gb-*.geojson` (4 files) | geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records **CC BY 2.5 IN**, sourced from DataMeet/Election Commission of India | **Partly** — provenance sits in ONE sidecar, `gb-IND-ADM1-full.meta.json` (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships | **OPEN** — CC BY requires attribution to accompany the work |
+| `boundaries/world-adm0*.geojson` | not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | **OPEN** — provenance unconfirmed for this file |
+| `people-groups/*` (3 files, 8 MB) | peoplegroups.org | **not established** | no terms ship | **OPEN, judgment** — redistribution terms unknown |
+| `pplr/*` (6 files, 16 MB) | not resolved from `plugin-designs/pplr-data-maps/scripts/build-data.mjs` | **not established** | nothing ships | **OPEN, judgment** — owner should name the upstream |
+| `tables/*` (304 files, 36 MB) | derived by `library/scripts/research/fetch-*.mjs` from several upstream APIs | **varies, not established per table** | nothing ships; there is no source or licence doc in `tables/` | **OPEN, judgment** — the largest gap by volume |
+| `images/worldmap.svg` | recorded in `images/PROVENANCE` | see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed |
+| `previews/*` (378 files) | our own poster previews | ours | n/a | none |
+| Natural Earth 1:10m populated places (`library/scripts/posters/data/ne-places.json`) | naturalearthdata.com | **public domain**, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation |
+
+## Provenance records
+
+| Vendored file | Upstream URL | sha256 |
+|---|---|---|
+| `data/vendor/tabulator/LICENSE` | `https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE` | `191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7` |
+| `data/vendor/vue/LICENSE` | `https://raw.githubusercontent.com/vuejs/core/main/LICENSE` | `49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac` |
+| `data/fonts/bebas-neue/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | see `documentation/vendored-fonts.md` |
+| `data/fonts/poppins/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt` | see `documentation/vendored-fonts.md` |
+
+## What is NOT closed, and why it is not mine to close
+
+Four rows above are marked OPEN. Two are simply unverified and someone should look
+(`world-adm0` provenance, the `pplr` upstream). Two need a decision rather than a fetch:
+**people-groups** and the 304 **tables** carry data whose redistribution terms are not established,
+and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not
+confirmed would be worse than the present gap, so those go to the Driver.
+
+The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to
+accompany the data, and the pattern already exists in this repo -- the `.meta.json` sidecar. Extending
+it to the other boundary files plus one shipped attribution line would close it.
+
diff --git a/internal/generate-tree.mjs b/internal/generate-tree.mjs
index 1bf0b5f2b..bcb4408e7 100644
--- a/internal/generate-tree.mjs
+++ b/internal/generate-tree.mjs
@@ -1637,6 +1637,12 @@ function main() {
       // vendor — DataTable/TabulatorTable inject Tabulator from assetsBase at runtime.
       'vendor/tabulator/tabulator.min.js',
       'vendor/tabulator/tabulator.min.css',
+      // ★ AND THEIR LICENCES, because this list is what decides whether a notice TRAVELS. Both are MIT,
+      // which requires the permission notice to be included with the software. Tabulator's minified .js
+      // carried only a copyright line and its .css carried nothing; Vue's banner names MIT but omits the
+      // permission text. Shipping the code without the notice is the gap, and an allowlist that omits
+      // the LICENSE guarantees it stays open however carefully the file is vendored.
+      'vendor/tabulator/LICENSE',
       // vendor/vue — the GALLERY SHELL's own Vue (generate-gallery.mjs loadVue()), not a bundle's.
       //
       // ★ ADDED 2026-09-22, and it had never been staged. generate-gallery.mjs:542 requests
@@ -1652,6 +1658,7 @@ function main() {
       // claim was false. A tree dropped on a foreign host or opened over file:// is exactly the
       // case the self-hosted rung exists for.
       'vendor/vue/vue.global.prod.js',
+      'vendor/vue/LICENSE',
     ]) {
       const from = join(pubAssets, rel)
       if (!existsSync(from)) { console.warn(`[generate-tree] WARN missing tree asset: assets/${rel}`); continue }