diff --git a/services/zoraxy.md b/services/zoraxy.md
index 692070e..2ffb57f 100644
--- a/services/zoraxy.md
+++ b/services/zoraxy.md
@@ -4,18 +4,18 @@
 
 ## Current route table
 
-Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat backends swapped). 21 active public routes have:
+Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat backends swapped, arcane.nuclide.systems removed). 20 active public routes have:
 - `EnableAutoHTTPS: true` — Zoraxy requests LE certs for `*.nuclide.systems`
 - `EnableWebsocketCustomHeaders: true` — preserves WS upgrade headers through the proxy
 - `DisableHopByHopHeaderRemoval: true` — keeps hop-by-hop headers intact for upstream
 
-`SkipWebSocketOriginCheck` is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, Arcane, abs, ai, chat, ha, mcp, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed).
+`SkipWebSocketOriginCheck` is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, abs, ai, chat, ha, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed).
 
 | Domain | Upstream | SkipWSOrigin | Notes |
 |--------|----------|:---:|-------|
 | abs.nuclide.systems | 192.168.1.40:13003 | ✓ | Audiobookshelf |
 | ai.nuclide.systems | 192.168.1.40:14003 | ✓ | Bifrost LLM gateway (LiteLLM decommissioned 2026-05-26) |
-| arcane.nuclide.systems | **192.168.1.8:10002** | ✓ | Arcane (moved to CT 109 2026-05-23) |
+| ~~arcane.nuclide.systems~~ | ~~192.168.1.8:10002~~ | — | **DECOMMISSIONED 2026-05-26** — replaced by Portainer |
 | chat.nuclide.systems | 192.168.1.40:14002 | ✓ | Open WebUI (LobeChat decommissioned 2026-05-26) |
 | dev.nuclide.systems | 192.168.1.42:7080 | ✓ | Coder (CT 111) |
 | git.nuclide.systems | 192.168.1.42:3000 | — | Gitea (CT 111) |
@@ -96,9 +96,10 @@ ssh root@192.168.1.4 'cp /tmp/zoraxy-backup-2026-05-21/<domain>.config /opt/zora
 - `daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20`
 - `id.daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20`
 - `mcp.nuclide.systems.config` — removed 2026-05-26 (mcp-gateway decommissioned; MCP now via Bifrost at `ai.nuclide.systems/mcp`)
+- `arcane.nuclide.systems.config` — removed 2026-05-26 (Arcane decommissioned; replaced by Portainer at `http://192.168.1.8:9000` LAN-only)
 
 ## Auth posture
 
 No routes have `ForwardAuthURL` set (no Tinyauth/auth middleware). Pocket-ID (`id.nuclide.systems`) is the OIDC IdP; apps that require auth implement it themselves (Open WebUI, Coder, Gitea, Nextcloud). Public-facing routes like `ha.nuclide.systems` and `ocpp.nuclide.systems` have no proxy-level auth — upstream apps handle it.
 
-**Pending**: Tinyauth or similar on unauthenticated-but-sensitive routes (arcane, gotify). Planned for CT 109 deployment.
+**Pending**: Tinyauth or similar on unauthenticated-but-sensitive routes (gotify). Planned for CT 109 deployment.