diff --git a/README.md b/README.md
index 71177ab..4ab970b 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,17 @@ This host runs two layers of web services: native services managed by
 system Apache, and containerized services managed by Docker (visible in
 Portainer). Apache reverse-proxies into the Docker layer where needed.
 
+## Domain namespace
+
+`jayfield.org` covers two distinct things under one name:
+- The root domain and its public subdomains (`alpha`, `www`, `mail`,
+  `dyndns`, `cloud`, `web`, `portainer`, `git`, ...) all point at this
+  host, `89.58.8.149` — everything this doc is about.
+- `home.jayfield.org` is a separate, deliberately private namespace for
+  the home intranet (`vlda-01` and other home-LAN devices, see
+  `SYNC-PLAN.md`) — not part of this host's authoritative zone, not
+  publicly resolvable, kept off public DNS by design.
+
 ## Native services (systemd / apt)
 
 | Service | Role |
diff --git a/SYNC-PLAN.md b/SYNC-PLAN.md
index c439f2c..73e4c87 100644
--- a/SYNC-PLAN.md
+++ b/SYNC-PLAN.md
@@ -1,10 +1,15 @@
 # alpha.jayfield.org — Intranet Sync Plan (vlda-01 → alpha)
 
-**Status: planning only, nothing implemented yet.** This is a point-in-time
-plan for later reference, not a live inventory (`README.md` is the live
-inventory) and not a build runbook (`SETUP.md` is that). Update this file
-as decisions get made and pieces get built; move finished work into
-`README.md` once it's live, the way the KeePass/Nextcloud migration did.
+**Status: item 1 (Gitea) done, the rest still planning-only.** This is a
+point-in-time plan for later reference, not a live inventory (`README.md`
+is the live inventory) and not a build runbook (`SETUP.md` is that).
+Update this file as decisions get made and pieces get built; move
+finished work into `README.md` once it's live, the way the
+KeePass/Nextcloud migration and Gitea did.
+
+`vlda-01` itself, and anything else on the home LAN, lives under the
+private `home.jayfield.org` namespace — not part of `alpha`'s public,
+authoritative `jayfield.org` zone (see README.md's "Domain namespace").
 
 ## Problem