diff --git a/skills/omni-providers/references/endpoints.md b/skills/omni-providers/references/endpoints.md
index 3a2b613c3ca..9365c48f1ab 100644
--- a/skills/omni-providers/references/endpoints.md
+++ b/skills/omni-providers/references/endpoints.md
@@ -172,6 +172,8 @@ curl -X POST https://localhost:20128/api/providers/test-batch \
 
 Validate provider credentials
 
+Spawns a fixed ACP summarizer binary to validate credentials — loopback-only (Hard Rules #15/#17, audit #15159 S-01).
+
 ```bash
 curl -X POST https://localhost:20128/api/providers/validate \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
@@ -495,6 +497,8 @@ curl -X POST https://localhost:20128/api/providers/{id}/sync-models \
 
 POST providers › bulk
 
+Reaches the same spawn as /api/providers/validate (webProvidersB.ts) — loopback-only (Hard Rules #15/#17, audit #15159 S-01).
+
 ```bash
 curl -X POST https://localhost:20128/api/providers/bulk \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
@@ -694,6 +698,8 @@ curl https://localhost:20128/api/providers/health-matrix \
 
 POST providers › import
 
+Reaches the same spawn as /api/providers/validate (webProvidersB.ts) — loopback-only (Hard Rules #15/#17, audit #15159 S-01).
+
 ```bash
 curl -X POST https://localhost:20128/api/providers/import \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN" \