diff --git a/server/scripts/swaggerFragment.js b/server/scripts/swaggerFragment.js
index 511e05e..2b2e0c0 100644
--- a/server/scripts/swaggerFragment.js
+++ b/server/scripts/swaggerFragment.js
@@ -76,6 +76,15 @@ const SLOT_MOUNT = {
   'admin.users.detail': '/api/v1/admin/users/:id',
 }
 
+// A router mounted INSIDE a registered one with `use()` needs nothing here, and
+// that was worth finding out: swagger-autogen reads a FILE and follows its
+// `require`s, so `/rust/permissions` is generated with the right prefix from
+// `rust.router.js` alone. It is the opposite of the hole phase 6 found with the
+// slot — the registration walk cannot see a nested router, and the generator can.
+//
+// A nested router exists at all because a mount prefix is ONE path segment
+// (core's `PREFIX` is `/^\/[a-z0-9][a-z0-9-]*$/`), so `/rust/permissions` cannot
+// be declared in `module.json` and has to be a `use()` under `/rust`.
 
 /**
  * Run `register()` with a recording api and return `[{ file, prefix, what }]`.