diff --git a/.gitattributes b/.gitattributes
index 874572b..e71100a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,18 +3,30 @@
 # (.goreleaser.yaml), so these entries are the actual filter for the
 # release source tarball — not the archive block's own file globs, which
 # have no negation syntax and cannot exclude anything.
-# WARNING (v0.2 final review wave, 2026-08-20): vendor/ is safe to
-# export-ignore ONLY because every current go.mod dependency
-# (github.com/stretchr/testify, its go.yaml.in/yaml/v3 indirect) is a
-# TEST-only dependency, imported solely by *_test.go files — which are
-# themselves export-ignored below, so the released tarball never contains
-# code that imports them and never needs vendor/ to build. go.mod itself
-# is NOT export-ignored and ships in every release tarball as-is. The
-# moment any non-test .go file (production code, not *_test.go) imports a
-# third-party package, this line MUST be removed: otherwise the tarball
-# ships a go.mod requiring a module its own vendor/ was stripped out of,
-# and the extracted source cannot build standalone.
-vendor/ export-ignore
+# vendor/ is deliberately NOT export-ignored, and must stay that way.
+#
+# It WAS export-ignored until 2026-08-23, on the reasoning that every
+# dependency was test-only (github.com/stretchr/testify and its
+# go.yaml.in/yaml/v3 indirect), imported solely by *_test.go files that
+# are themselves export-ignored below — so the tarball never contained
+# code needing vendor/ to build. That comment carried an explicit warning
+# to remove the line the moment production code imported a third-party
+# package.
+#
+# That happened, and the warning was missed: llmgateway.go took on
+# github.com/lukaszraczylo/oss-telemetry as a RUNTIME dependency. The
+# release tarball then shipped a go.mod requiring a module whose source
+# had been stripped, and the Traefik Plugin Catalog analyzer (piceus)
+# rejected v1.0.43 with:
+#
+#   import "github.com/lukaszraczylo/oss-telemetry" error:
+#   unable to find source related to: "github.com/lukaszraczylo/oss-telemetry"
+#
+# piceus fetches the source ARCHIVE at the released tag and interprets it
+# with Yaegi. It never runs `go mod download`, so every non-stdlib import
+# in production code must be present in the archive's own vendor/ tree.
+# Shipping vendor/ also costs the test-only deps a few hundred KB in the
+# tarball, which is the correct trade against being unimportable.
 integration/ export-ignore
 tools/ export-ignore
 docs/ export-ignore