diff --git a/work/projects/cpm-web-extension-breakage-findings.md b/work/projects/cpm-web-extension-breakage-findings.md
index 79031984..93f1b1b2 100644
--- a/work/projects/cpm-web-extension-breakage-findings.md
+++ b/work/projects/cpm-web-extension-breakage-findings.md
@@ -548,7 +548,7 @@ Repro: 10+ restored tabs, quit, relaunch; several restored tabs have no CPM unti
 
 ### 4. Tab/window routing: sender page not found
 
-The only chain that explains "one window broken, new window fine". `getCurrentTab` iterates `windowControllersManager.mainWindowControllers` → `loadedPinnedTabs + loadedTabs` → `Tab.webView`; a web view outside that set fails with `runtime.sendMessage(): tab not found` before any wake-up (`WebExtensionContextAPIRuntimeCocoa.mm:141-147`). Requires a `MainWindowController` missing from `mainWindowControllers` while its window is still open, or a `Tab` not in `loadedTabs`. Trigger not identified in source; needs the "Tab not found for message for content script message" log correlated with window registration. Probability unknown; ranked here because it matches a reported observation, not because a trigger is known.
+The only chain that explains "one window broken, new window fine". **[corrected 2026-09-09]** `getCurrentTab` iterates WebKit's own `openTabs()` = `m_tabMap` entries with `m_isOpen && isValid()` (`WebExtensionContextCocoa.mm:1105-1114, 1251-1260`; `WebExtensionTabCocoa.mm:373`), i.e. the set built by `populateWindowsAndTabs()` at load plus `didOpenTab`/`didCloseTab` afterwards — not a live query of the app's window provider. A `Tab` whose `didOpenTab` was dropped (`droppedCallbacksCount`), suppressed (`withTabLifecycleEventsSuppressed`), or followed by a stray `didCloseTab`, fails with `runtime.sendMessage(): tab not found` before any wake-up (`WebExtensionContextAPIRuntimeCocoa.mm:141-147`). Directly testable from the app: `context.openTabs.contains { $0 === tab }`. Trigger not identified in source; needs the "Tab not found for message for content script message" log correlated with window registration. Probability unknown; ranked here because it matches a reported observation, not because a trigger is known.
 
 ### 5. Repeatable registration failure (SW script unreadable)