diff --git a/docs/manual-checks.md b/docs/manual-checks.md
index ca81618..7947f78 100644
--- a/docs/manual-checks.md
+++ b/docs/manual-checks.md
@@ -1790,11 +1790,25 @@ curl -so /dev/null -w '%{http_code}\n' https://git.dodotech.cloud/api/v1/repos/D
 
 **Pass:** `200`.
 
-**Failure means:** `404` is a private repository — Gitea does not distinguish "not there" from "not yours" —
-and the clients read this address anonymously, because there is no token and deliberately nowhere to put
-one. Every check on every machine will answer 404 and the feature cannot work. See
+**Failure means:** `404` is a repository this caller may not see — Gitea does not distinguish "not there"
+from "not yours" — and the clients read this address anonymously, because there is no token and deliberately
+nowhere to put one. Every check on every machine will answer 404 and the feature cannot work. See
 [ADR 0013 §4](adr/0013-desktop-distribution-and-updates.md).
 
+**And check the organisation before the repository, because the organisation wins.** A Gitea org has its own
+visibility, and a *public repository inside a Limited or Private org is invisible to anyone not signed in* —
+so setting the repository public and stopping there changes nothing. This is what it looks like:
+
+```bash
+curl -so /dev/null -w '%{http_code}
+' https://git.dodotech.cloud/api/v1/orgs/DodoTech
+```
+
+`404` there means the org is the gate; `200` means it is not and the repository itself is. Both must answer
+`200`. One more, which tells the two apart from an instance that requires sign-in for everything:
+`/explore/repos` answering `200` means anonymous browsing is on, so a repo that is still invisible is
+invisible on purpose rather than by instance policy.
+
 **Do not check `/api/v1/version` instead.** It answers `200` from a forge that is up regardless of what is
 readable on it, and that is exactly what made this look fine while nothing worked.