diff --git a/docs/orientation.md b/docs/orientation.md
index 365794f..dbb225f 100644
--- a/docs/orientation.md
+++ b/docs/orientation.md
@@ -182,6 +182,23 @@ These caught us once; don't let them catch you twice.
 - **`:22` on `10.250.50.70` is ana-docker's HOST sshd, not gitea.** A
   gitea deploy key there returns `Permission denied (publickey)` — gitea's
   git-SSH is the container port `:222`. (HTTP/clone-over-HTTPS is `:3000`.)
+- ⭐ **Override the NAME, not each repo's remote — and on `nh3-dev` this is
+  already done (2026-09-17).** `~/.ssh/config` there carries a
+  `Host gitea.phasefinal.com` block pointing at `10.250.50.70:222`, so every
+  repo on the box is routed internally whatever its remote URL says, including
+  a fresh clone that copied the public URL out of a README. Rewriting remotes
+  one by one fixes only the repos someone remembered to audit: brokkr-smithy,
+  sleipnir, Galdrabok and kvasir were all still on the public name when
+  brokkr-smithy-dev flagged it, and brokkr-smithy is pushed several times a
+  week — a recurring ban trigger, not a dormant one.
+  **Check before assuming a host inherits it; the alias is per-host:**
+  ```bash
+  ssh -G git@gitea.phasefinal.com | grep -E '^(hostname|port) '   # want 10.250.50.70 / 222
+  ```
+  ⚠ Verify both routes authenticate as the same user with the same key BEFORE
+  adding the alias, then prove it with a real `git ls-remote origin HEAD` — a
+  routing change that is only inspected, not exercised, is the classic
+  looks-right-and-is-broken.
 
 ### Workflow