diff --git a/serverAppConfigs-docs/Dankclaw/SearXNG.md b/serverAppConfigs-docs/Dankclaw/SearXNG.md
index 808ac92..b9e52c0 100644
--- a/serverAppConfigs-docs/Dankclaw/SearXNG.md
+++ b/serverAppConfigs-docs/Dankclaw/SearXNG.md
@@ -138,7 +138,17 @@ root cause, the suspend-model table, the `engines:` config, and the
 ### Gotchas
 
 - The JSON API rate cap (4 per 3600s per IP) is hardcoded in Python, not settable in `limiter.toml`. The only bypass is `pass_ip`. Local subagents are covered because their slirp/loopback/LAN sources are in `pass_ip`.
-- The limiter stays armed for untrusted sources (a spoofed public IP still 429s). Do not disable it. Widen only `pass_ip` for sources you trust on this host.
+- **Agent-API contract (verified live 2026-08-31):** the guarded path
+  (`search.franksdank.cloud`) answers non-browser API clients with Anubis'
+  JS-challenge page at HTTP **200** — a status-code-only client silently gets
+  HTML where it expected JSON. Check `content-type`, not just status. There is
+  deliberately no way for an API client through the guard (JS challenge + UA
+  deny-list); the agent path is the direct published port
+  `http://192.168.0.143:8081/search?q=…&format=json` from trusted sources —
+  same instance, VPN-bound egress via Gluetun, unreachable from outside the
+  LAN by construction (no public route to the LAN IP). No second agent-only
+  instance is needed; a duplicate would double upstream request volume from the
+  same rate-sensitive VPN exit IP for zero benefit.
 - The config file is root-owned (uid of the rootless podman namespace). Update it with a one-off `sudo cp`, then run `systemctl --user restart searxng.service` to reload.
 - `base_url` must match the public address or proxy rewrites break.
 - Keep the valkey cache container on the same podman network as searxng.