diff --git a/.agents/configs/site-inventory.json.txt b/.agents/configs/site-inventory.json.txt
index 6dcb355468..caf852174a 100644
--- a/.agents/configs/site-inventory.json.txt
+++ b/.agents/configs/site-inventory.json.txt
@@ -24,7 +24,7 @@
       "hosting": { "provider": "hostinger", "account_ref": "shared-hosting-account", "deployment_path": "/domains/example.com/public_html" },
       "provenance": "manual",
       "last_verified": "2026-01-01T00:00:00Z",
-      "children": { "store": { "hostname": "store.example.com", "identity": "store", "deployment_path": "/domains/example.com/public_html" } }
+      "children": { "store": { "hostname": "store.example.com", "aliases": ["store-alias.example.com"], "identity": "store", "deployment_path": "/domains/example.com/public_html" } }
     }
   }
 }
diff --git a/.agents/reference/site-operations.md b/.agents/reference/site-operations.md
index 80a87f4042..00d3d4c3c3 100644
--- a/.agents/reference/site-operations.md
+++ b/.agents/reference/site-operations.md
@@ -30,8 +30,10 @@ Each `sites` entry identifies a canonical hostname, aliases, platform, environme
 DNS provider/zone reference, hosting provider/account boundary, deployment path,
 provenance, freshness, and optional multisite `children`. `hosting_accounts` holds
 reusable connection metadata once per account. The helper matches an exact site key
-or canonical hostname first, then an alias, then a child hostname. A child inherits
-its parent hosting account and path unless it overrides the path.
+or canonical hostname first, then an alias, then a child hostname or child `aliases`.
+Children may have an `aliases` array, matched after their hostname. A child inherits
+its parent hosting account and path unless it overrides the path. Its `dns` record
+overrides the parent DNS record when present; otherwise it inherits parent DNS.
 
 The helper is read-only. `discover` reports configured local evidence and gaps but
 does not call providers or persist anything; provider discovery must be explicitly
diff --git a/.agents/scripts/site-context-helper.sh b/.agents/scripts/site-context-helper.sh
index 784d08615b..816aaf3813 100755
--- a/.agents/scripts/site-context-helper.sh
+++ b/.agents/scripts/site-context-helper.sh
@@ -36,11 +36,11 @@ validate_inventory() {
 lookup_record() {
 	local hostname="$1"
 	jq -ce --arg hostname "$hostname" '
-		def selected: to_entries[] | select(.key == $hostname or .value.canonical_hostname == $hostname or (.value.aliases // [] | index($hostname)) or (.value.children // {} | to_entries[]? | select(.value.hostname == $hostname)));
+		def selected: to_entries[] | select(.key == $hostname or .value.canonical_hostname == $hostname or (.value.aliases // [] | index($hostname)) or (.value.children // {} | to_entries[]? | select(.value.hostname == $hostname or (.value.aliases // [] | index($hostname)))));
 		(.sites | selected) as $match
-		| ([($match.value.children // {} | to_entries[]? | select(.value.hostname == $hostname) | .value)][0] // null) as $child
+		| ([($match.value.children // {} | to_entries[]? | select(.value.hostname == $hostname or (.value.aliases // [] | index($hostname))) | .value)][0] // null) as $child
 		| (.hosting_accounts[$match.value.hosting.account_ref] // {}) as $account
-		| {status:"found", matched_hostname:$hostname, site_id:$match.key, name:$match.value.name, canonical_hostname:$match.value.canonical_hostname, platform:$match.value.platform, environment:$match.value.environment, dns:$match.value.dns, hosting:($match.value.hosting + {deployment_path:($child.deployment_path // $match.value.hosting.deployment_path), ssh_host:$account.ssh_host, ssh_port:$account.ssh_port, ssh_user:$account.ssh_user, credential_env:$account.credential_env, last_verified:$account.last_verified}), child:$child, provenance:$match.value.provenance, last_verified:$match.value.last_verified}
+		| {status:"found", matched_hostname:$hostname, site_id:$match.key, name:$match.value.name, canonical_hostname:$match.value.canonical_hostname, platform:$match.value.platform, environment:$match.value.environment, dns:($child.dns // $match.value.dns), hosting:($match.value.hosting + {deployment_path:($child.deployment_path // $match.value.hosting.deployment_path), ssh_host:$account.ssh_host, ssh_port:$account.ssh_port, ssh_user:$account.ssh_user, credential_env:$account.credential_env, last_verified:$account.last_verified}), child:$child, provenance:$match.value.provenance, last_verified:$match.value.last_verified}
 	' "$INVENTORY_PATH"
 	return $?
 }