diff --git a/AGENTS.md b/AGENTS.md
index d53d27e..937446b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -190,6 +190,12 @@ the linked documents — this file points, it does not duplicate.
 > and never treat a single native change as a reason to. What ships without Xcode does not belong in
 > that file: app UI travels in the OTA bundle, panel and backend in the integration's self-update.
 
+> **Port `18123` is the test instance. Host port `8123` is the owner's REAL instance — never open
+> it, never fetch it, never change it (binding, stated by the owner 2026-09-07).** Not even a
+> connectivity check: looking is touching. The mapping `0.0.0.0:18123->8123/tcp` is the trap — the
+> `8123` in it is *inside* the container and is fine; `localhost:8123` on the machine is not. Every
+> URL in a command, a browser tab or a proxy target must read `18123`.
+
 > **The test instance is called `Data-Metric-360` (binding, renamed by the owner 2026-09-07).**
 > It is the Docker container on `:18123` and **the only instance that may ever be touched** — the
 > owner's real instance is never worked on (their own hard line, section W). The container was