diff --git a/authelia/access-rules.md b/authelia/access-rules.md
index 973dd9d..df886ce 100644
--- a/authelia/access-rules.md
+++ b/authelia/access-rules.md
@@ -14,7 +14,7 @@ Four hostnames join the existing `HTTPS_UserAccess` `two_factor` rule in
 | Hostname | Phase | Serves |
 |---|---|---|
 | `lf.yokogawa.tech` | 2 | Langfuse — traces, prompts, eval runs |
-| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API |
+| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API — **not essential**, see below |
 | `api.yokogawa.tech` | 6 | `ai-api` FastAPI |
 | `ai.yokogawa.tech` | 7 | `ai-web` operator UI |
 
@@ -43,6 +43,15 @@ Add each hostname at the phase that needs it. Every domain added here must also
 have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
 every Caddyfile block must have a rule here. One without the other is a hole.
 
+**`cube.yokogawa.tech` is the one to drop first** if the host is being tidied or the
+hostname is wanted for something else. Nothing depends on it — `ai-api` reaches Cube as
+`cube:4000` over the proxy network and never by name, and the operator UI never touches
+Cube. It exists so an engineer can open the playground to hand-verify a measure, which an
+SSH tunnel does equally well. Removing it means deleting the Caddy block **and** this
+domain; batch that with an Authelia restart that is happening anyway rather than spending
+an all-user logout on it. The same note is on the host, in `~/Caddyfile` above the block
+and inline on this rule.
+
 **Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on
 2026-08-27, in one Authelia restart. Backup
 `~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the
diff --git a/caddy/ai-routes.caddy b/caddy/ai-routes.caddy
index 22e6e3d..76a216f 100644
--- a/caddy/ai-routes.caddy
+++ b/caddy/ai-routes.caddy
@@ -53,6 +53,14 @@ lf.yokogawa.tech {
 }
 
 # --- Phase 5 -----------------------------------------------------------------
+# NOT ESSENTIAL. Nothing depends on this hostname: ai-api reaches Cube over the
+# proxy network as cube:4000 and never by name, and the operator's screen never
+# touches Cube at all. It exists so an engineer can open Cube's playground to
+# hand-verify a measure - an SSH tunnel does the same job. If this host is being
+# tidied, or a name is wanted for something else, drop this one first. Removing
+# it means deleting this block AND the domain from the Authelia rule; batch that
+# with an Authelia restart that is happening anyway, rather than spending an
+# all-user logout on it.
 cube.yokogawa.tech {
   import authelia
   reverse_proxy cube:4000