diff --git a/next.config.ts b/next.config.ts
index 650e217..9d11568 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -11,6 +11,15 @@ function getSupabaseHostname(): string {
   return "*.supabase.co";
 }
 
+// Drafted but NOT wired into headers() yet — enabling it blanked the entire
+// app (ClerkProvider wraps the whole tree in layout.tsx; a blocked resource
+// during its client-side init throws, and nothing catches it, so the app
+// crashes to a blank page instead of just breaking the login widget).
+// Confirmed live on 2026-08-10 that disabling this CSP fixes it; adding
+// wss://clerk.pawfeed.org to connect-src did NOT fix it, so the real blocked
+// directive is still unidentified. Next attempt should ship as
+// Content-Security-Policy-Report-Only first (with a /api/csp-report endpoint)
+// to see actual violation reports before enforcing on production again.
 function buildCsp(): string {
   const supabase = `https://${getSupabaseHostname()}`;
   const directives: Record<string, string[]> = {