diff --git a/20-product-tdd/extension-documentation-hosting.md b/20-product-tdd/extension-documentation-hosting.md
index 5d0e926..e8a3fc0 100644
--- a/20-product-tdd/extension-documentation-hosting.md
+++ b/20-product-tdd/extension-documentation-hosting.md
@@ -95,7 +95,11 @@ content within its management origin, and links to hosted sites sever opener acc
 The serving topology must support root-relative static assets without rewriting the author's build.
 When an author needs an absolute hostname during a build, tooling may reserve an opaque snapshot
 address before computing the final content digest. An address can never be rebound to different
-bytes. Concrete domain, DNS, TLS, and storage deployment choices remain Registry-owned.
+bytes. DNS routing and TLS coverage may intentionally accept a wider hostname set than the
+documentation address template. Registry must still admit only the exact host pattern generated by
+that template; resolving through the same wildcard or completing TLS does not make another host a
+documentation origin. Concrete domain, DNS, TLS, and storage deployment choices remain
+Registry-owned.
 
 ## Release Lifecycle