diff --git a/README.md b/README.md
index 84b2bcf..7831644 100644
--- a/README.md
+++ b/README.md
@@ -216,6 +216,13 @@ Known gaps:
 
 ### Rollout order (existing instance with a captcha)
 
+> **Hosted instance (gitea.seamtro.ai), 15 Oct 2026:** the owner chose to skip the edge-rate-limit
+> gate below until there is actual abuse, and turned the captcha off with password basic auth still
+> on. If abuse appears, the emergency switch is `REGISTER_MANUAL_CONFIRM = true` plus a restart, which
+> holds new accounts for admin activation. Then add the edge rules in step 1 and 2.
+> Self-hosters should still follow the order below.
+
+
 1. Add the edge rate limit on `POST /user/sign_up` and `POST /user/login`, and verify it: a burst
    from one IP gets 429.
 2. **Gate while password basic auth is still on.** If `ENABLE_BASIC_AUTHENTICATION` must stay `true`