diff --git a/Services.md b/Services.md
index e7226f0..fa5453c 100644
--- a/Services.md
+++ b/Services.md
@@ -36,6 +36,9 @@ AKILL and other X-lines, FORBID, SPAMFILTER, NOTIFY, DEFCON, JUPE, SESSION limit
 
     /msg OperServ NOTIFY ADD +0 cdn baddie*!*@* known ban-evader
     /msg OperServ NOTIFY ADD +7d j #recruiting watch who joins during the drive
+    /msg OperServ NOTIFY ADD +0 j #* every join, network-wide
+
+A deliberately broad mask like `#*` (every channel) or `*` (every user) is allowed — NOTIFY only observes, so there is no too-wide guard. Scope such a watch with flags (here just `j`) and lean on `notify_exclude` to keep relay noise out.
 
 **Keeping relay clients out of the feed.** A broad watch — a channel watch especially — will match every PyLink-relayed user (their nicks carry a `/network` suffix) and flood the log. Set the exclude list once and reload it live, no restart: