diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs
index c6e709d0..673d70a2 100644
--- a/hive-c0re/src/gateway_nginx.rs
+++ b/hive-c0re/src/gateway_nginx.rs
@@ -90,12 +90,8 @@ fn render(names: &[String], frontend_dir: Option<&str>) -> String {
         // legacy prefix-location path keeps the trailing `/` so nginx
         // strips `/agent/<name>/` automatically; the named-location
         // path strips the prefix via `rewrite` and uses a bare upstream.
-        //
-        // Always use the unix socket path. The old TCP fallback
-        // (`127.0.0.1:<port>`) was removed: agents run in private netns
-        // (always-on isolation) so the host loopback is unreachable from
-        // the gateway's netns. When the socket is not yet bound, nginx
-        // returns 502 which is handled by the error_page directive below.
+        // When the socket is not yet bound, nginx returns 502, caught by
+        // the error_page directive below.
         let sock = agent_sockets::socket_path_for(name).display().to_string();
         let upstream_prefix = format!("http://unix:{sock}:/");
         let upstream_bare = format!("http://unix:{sock}:");
@@ -298,7 +294,6 @@ mod tests {
 
     #[test]
     fn render_uds_upstream_unconditional() {
-        // TCP fallback removed — always UDS regardless of socket marker.
         let names = vec!["iris".to_owned()];
         let body = render(&names, None);
         // UDS form present