diff --git a/docs/api-reference.md b/docs/api-reference.md
index 0a785d11..6838cb8d 100644
--- a/docs/api-reference.md
+++ b/docs/api-reference.md
@@ -776,7 +776,7 @@ The target is judged before anything is written:
 
 - It must be absolute with no `..` and none of the shell metacharacters a session working directory is rejected for (spaces are fine). `400 INVALID_INPUT` otherwise.
 - It must not be a system directory (`/etc`, `/usr`, `/proc`, ...), the home folder itself, Codeman's own data folder, or a credential/config tree (`~/.ssh`, `~/.aws`, `~/.claude`, ...). Judged on the path as typed and on its symlink-resolved form, against both the given and the symlink-resolved roots. `400`.
-- It must not be, or be inside, the cases directory (the caller's own and the shared one): a case there is a plain create without `path`. `400`.
+- It must not be the cases directory (the caller's own or the shared one) or a direct child of it, since those are what `GET /api/cases` lists as local cases: a case there is a plain create without `path`. A folder further down is allowed. `400`.
 - Its parent must already exist (one folder is created, never a chain): `404 NOT_FOUND`. A parent that does not answer (an unreachable network mount) or cannot be read is `422 OPERATION_FAILED`, checked through the bounded path probe before anything else touches it.
 - The folder must not exist, or must be an **empty** directory; a folder with contents is Link Existing's job: `409 ALREADY_EXISTS`. A symlink or a plain file at the target is `400`.
 - `409 ALREADY_EXISTS` also for a case name already in use (in the cases dir or the registry) and for a folder that is already a case.
diff --git a/src/web/case-path.ts b/src/web/case-path.ts
index c6401531..df950396 100644
--- a/src/web/case-path.ts
+++ b/src/web/case-path.ts
@@ -12,8 +12,10 @@
  *     its symlink-resolved form, against both the given and the symlink-resolved roots (a home reached
  *     through a link, macOS's `/etc` -> `/private/etc`), so a link into a blocked tree is not a way
  *     around it;
- *   - it must not be, or be inside, a cases directory: a case there is a plain Create New, and the same
- *     folder listed both as a local case and as a linked one would make deleting it remove files;
+ *   - it must not be a cases directory or a direct child of one: those are what `GET /api/cases` lists
+ *     as local cases, so a case there is a plain Create New, and the same folder listed both as a local
+ *     case and as a linked one would make deleting it remove files. A folder further down is not
+ *     listed and is allowed;
  *   - its parent must already exist (one folder is created, never a whole chain), and the folder
  *     itself must not exist or must be an EMPTY directory (a folder with contents is Link Existing's
  *     job, and silently scaffolding into someone's project is the one thing this must never do);