docs/release-notifications.md: before a site pins openvibe-shared 1.17.0, its CSP connect-src must allow https://events.openvibe.network (Live and Community do; Network, Wiki, Blog, Codes, Search, Reviews, VIP, Tips, Host, News, Deals and Coupons do not). Otherwise each page load logs one CSP refusal and release-watch stays on polling (state blocked)

ddiff --git a/docs/release-notifications.md b/docs/release-notifications.md
iindex f6c0388..321aea4 100644
---- a/docs/release-notifications.md
++++ b/docs/release-notifications.md
@@@ -123,6 +123,15 @@ All commands run on the production host. None of them prints a secret.
     ```
     No dependency changed.
  
++## Before a site pins openvibe-shared 1.17.0
++
++The tab's EventSource is subject to the site's Content-Security-Policy, so `connect-src` must allow
++`https://events.openvibe.network`. As of 2026-09-26, Live and Community allow it. Network, Wiki, Blog, Codes,
++Search, Reviews, VIP, Tips, Host (Stage B dashboard), News, Deals and Coupons do not. Without it, the
++browser refuses the stream and logs one CSP error per page load (the browser check counts it).
++release-watch then stops, with state `blocked`, and keeps polling. Add the origin in the same change that
++moves the pin, or set `data-events="off"` on the `ov-release` meta tag.
++
  ## Verifying end to end
  
  1. Subscribe the way a signed-out browser does, from any machine: