diff --git a/.agents/skills/missing_docs/references/changelog_decisions.md b/.agents/skills/missing_docs/references/changelog_decisions.md
index d9d0ec5d6..3d503d1e8 100644
--- a/.agents/skills/missing_docs/references/changelog_decisions.md
+++ b/.agents/skills/missing_docs/references/changelog_decisions.md
@@ -32,6 +32,13 @@ Newest first. One row per PR number — usually a `warpdotdev/warp` changelog it
 
 | PR | Decided | Verdict | Gate / disqualifier | Reason and outcome |
 |---|---|---|---|---|
+| n/a (2026-09-16 exhaustive re-verification sweep) | 2026-09-16 | n/a | Not a verdict | A second exhaustive drift-watch pass over the same stable release, two days after the 2026-09-14 pass that opened this PR. Nothing new to decide: **no tracked surface changed in the interval.** Running `--update-snapshot` against fresh `warp` (`master`, `91dad6a70`) and `warp-server` (`develop`, `91b349221`) checkouts, both dated 2026-09-16, reproduced this branch's `surface_snapshot.json` **byte for byte** across 296 flags, 91 CLI commands, 220 API routes, 65 slash commands, 232 settings, 23 web routes, 72 server tools, and 17 bundled skills. Both audit modes exited 0 with `audits_skipped: []` and an empty `unaccounted` bucket. Against `main` the run reproduced the 2026-09-14 findings exactly — one `undocumented_api_endpoints` entry, one `surface_changes` entry, both `GET /networking/egress-ranges`, plus the 24 staleness rows; with this branch's map entry applied, the first two drop to 0 and only the already-decided staleness rows remain. Independently re-verified the load-bearing evidence rather than carrying it forward: the `networking` tag and the `getEgressRanges` operation both still carry `x-internal: true` in warp-server `public_api/openapi.yaml` (lines 31-33 and 42-43), and five staleness term classes were re-checked at their source lines (`warp ai` → the historical FAQ heading; `generate command` → the live "Generate commands as command-line input" heading; `ai command` → AI Command Search; `ai credits` → the bucket name; `warp terminal` → the permitted distinguishing usage). The skill's three test suites pass (19 + 18 + release-gate tests), so no extractor has rotted. `npm ci && npm run build` passes on this branch at 386 Markdown docs and 388 HTML files. `suggest_reviewers.py` again resolves only the `@warpdotdev/fa-warp-3` team, with `router/handlers/public_api/networking.go` unowned, so the PR keeps no requested reviewer. No feature PR, and no second bookkeeping PR — this branch was extended per the skill's one-open-bookkeeping-PR rule. |
+| GET /networking/egress-ranges | 2026-09-14 | deferred | Gate 0 | Returns the canonical outbound IP ranges for Warp-hosted agents, scoped to the authenticated principal's active team (`RegisterNetworkingRoutes` / `EgressRangesHandler`, `router/handlers/public_api/networking.go:17-77`, behind `middleware.EnforceAuth()`). The only new surface this run — it is both the sole `undocumented_api_endpoints` finding and the sole `surface_changes` entry. Gate 0 fails twice over in warp-server's canonical `public_api/openapi.yaml`: the `networking` tag carries `x-internal: true` and so does the `getEgressRanges` operation, and `sync_openapi.py` drops `x-internal` operations wholesale, so the route cannot reach `developers/agent-api-openapi.yaml` while the markers stand (that file has zero `networking` paths and zero `x-internal` entries today). It backs the Admin Panel's hosted-agent egress CIDR list (`client/src/components/admin/team/platform/HostedAgentEgressCIDRs.tsx`), not the released public Agent API. Not a content gap either: the ranges themselves are already published on `platform/warp-hosting.mdx` under "Networking". Mapped `-> internal`. Re-check if the `x-internal` markers come off, and route it through sync-openapi-spec rather than hand-drafting. |
+| n/a (hardcoded egress CIDR list on platform/warp-hosting.mdx) | 2026-09-14 | no | Not a docs gap / noted for the owner | Surfaced while triaging the route above, recorded so it is not silently dropped. `platform/warp-hosting.mdx` publishes the hosted-agent egress ranges as a hardcoded bullet list, and warp-server now computes the same set server-side (`logic/ai/ambient_agents/networking/egress_ranges.go`). The page can therefore drift from the canonical source with nothing to catch it. No docs change is available: the endpoint is `x-internal`, so the page cannot point readers at it, and the current list is not known to be wrong. Flagging the durability question for the docs owner rather than editing correct content. |
+| n/a (24 potentially_stale_docs, 2026-09-14 run) | 2026-09-14 | no | Already decided (2026-09-11) / owned by style_lint | Identical file set and term set to the 2026-09-11 row; re-verified rather than carried forward. 13 files are the `ai credits` bucket-name false positive (still the unresolved style-policy question in the Notes below — deliberately left for a human owner, so `stale_terms.md` was not narrowed unattended). All 13 `warp terminal` hits are the distinguishing usage the rule's own reason exempts: client vs. backend in `enterprise/`, the product-list entry in `enterprise/index.mdx`, and local terminal vs. cloud harness across `platform/harnesses/` and `guides/`. `warp ai` is the historical FAQ heading "What happened to the old Warp AI chat panel?" (`agents/getting-started/faqs.mdx:18`). `generate command` matches the live headings on `agents/local-agents/generate.mdx`, a page titled "Generate (Legacy)". `ai command` matches AI Command Search (`terminal/entry/index.mdx:11`). No missing content. |
+| n/a (82 --weak-coverage feature findings, 2026-09-14 run) | 2026-09-14 | no | Disqualified: not a docs gap / heuristic false positive | Ran `--weak-coverage` for exhaustiveness. 82, up one from the 81 on 2026-09-09, entirely because `ShellWidgetHandoff` moved off the ignore list onto `command-search.mdx` on 2026-09-11 and so re-entered the mapped pool the check scores. Every hit is a mapped page that lacks a phrase derived from an internal CamelCase flag name. Spot-verified four this run: `GroupedTabs` → `terminal/windows/tabs.mdx` has a full "## Tab groups" section; `CloudRunners` → `platform/runners.mdx` documents runner CRUD end to end; `BundledSkills` → covered by "## Pre-built skills" on `agents/capabilities/skills.mdx` plus the `~/.warp/skills/` paths on `terminal/settings/file-locations.mdx`; `AskUserQuestion` → `agents/local-agents/interacting-with-agents/agent-questions.mdx` plus the `ask_user_question` profile key. Keyword artifacts, which is why the flag is off by default. |
+| n/a (zero findings in seven categories, 2026-09-14) | 2026-09-14 | n/a | Not a verdict | Recording the clean categories so a later run can tell "checked and empty" from "not checked": `undocumented_features`, `undocumented_cli_commands`, `undocumented_slash_commands`, `undocumented_settings`, `stale_doc_references`, `unlisted_pages`, and `map_hygiene` all returned zero. Both audit modes exited 0 with `audits_skipped: null`, and the completeness accounting reported an empty `unaccounted` bucket across 296 flags, 91 CLI commands, 220 API routes, 65 slash commands, and 232 settings. |
+| n/a (release gate no-op, 2026-09-14) | 2026-09-14 | n/a | Not a verdict | `check_new_release.py` exited 10: current stable is still `v0.2026.09.09.08.26.stable_02`, already recorded in `last_release_processed.json` by bookkeeping PR #736 (merged 2026-09-13). No new changelog entries and no new `oz_updates` bullets, which is why `changelog_review` is empty. `last_release_processed.json` deliberately left unchanged, and `check_new_release.py --commit` was not run. The rest of the run is the exhaustive standing-coverage and snapshot-diff sweep requested on top of the gate. |
 | GET /factory/{uid}/setup-progress, POST /factory/{uid}/setup-progress/dismiss | 2026-09-12 | deferred | Gate 0 | Both marked `x-internal: true` in warp-server `public_api/openapi.yaml` (`getFactorySetupProgress`, dismiss counterpart) inside the unreleased `/factory` namespace. Released `developers/agent-api-openapi.yaml` has zero `/factory` paths. Missed in the 2026-09-11 map pass that covered sibling factory routes; mapped both `-> internal` on this bookkeeping extension. Re-check when the factory API is published. |
 | appearance.window.backdrop (map residual) | 2026-09-12 | yes | Gate 1 (map only) | Setting already verdicted yes on 2026-09-11 with feature PR docs#733, but the surface-map entry was never added so coverage kept flagging it. Mapped `appearance.window.backdrop -> terminal/settings/all-settings.mdx` on this extension. |
 | n/a (third residual sweep of v0.2026.09.09.08.26.stable_02, 2026-09-12) | 2026-09-12 | n/a | Not a verdict | Drift-watch re-entry after the release gate on `main` still reported this stable as new (bookkeeping PR #736 unmerged). Checked out and extended #736 rather than opening a second bookkeeping PR. Independently re-verified Gate 0 for the two remaining unmapped factory routes above; re-confirmed #15913 docker-registry flags still deferred (Gate 0, not in any stable); re-confirmed the 15 changelog/`oz_updates` bullets and three flag promotions already carry ledger verdicts; `potentially_stale_docs` (24) still style_lint-owned. Feature PRs docs#733, docs#734, docs#735 remain open with reviewer `dannyneira`. Regenerated `surface_snapshot.json` so setup-progress leaves the `--diff` added bucket; #15913 flags enter the baseline and rely on the deferred ledger row plus the next stable changelog for re-surface. No new feature PR. |
diff --git a/.agents/skills/missing_docs/references/feature_surface_map.md b/.agents/skills/missing_docs/references/feature_surface_map.md
index 837030f4e..8cb974a0d 100644
--- a/.agents/skills/missing_docs/references/feature_surface_map.md
+++ b/.agents/skills/missing_docs/references/feature_surface_map.md
@@ -626,6 +626,18 @@ POST /agent/events/{run_id} -> internal
 # on the RTC host, so it is not a released public API operation.
 GET /agent/events/stream -> internal
 
+# Canonical outbound IP ranges for Warp-hosted agents, scoped to the
+# authenticated principal's active team (RegisterNetworkingRoutes /
+# EgressRangesHandler, router/handlers/public_api/networking.go). Both the
+# `networking` tag and the getEgressRanges operation are marked
+# `x-internal: true` in warp-server's canonical spec, so the publish filter
+# strips the route from the docs OpenAPI copy; it backs the Admin Panel's
+# hosted-agent egress CIDR list rather than the released public Agent API. Not
+# a docs gap either: the ranges themselves are already published on
+# src/content/docs/platform/warp-hosting.mdx under "Networking". Revisit and
+# route through sync-openapi-spec if the x-internal marker comes off.
+GET /networking/egress-ranges -> internal
+
 # Agent Memory REST API — research preview (gating flag AIMemories is non-GA),
 # deferred via `gated:` and auto-surfaces when AIMemories goes GA. See
 # "Public vs. private surfaces" in SKILL.md.
diff --git a/.agents/skills/missing_docs/references/surface_snapshot.json b/.agents/skills/missing_docs/references/surface_snapshot.json
index 91acabfb0..79266fc97 100644
--- a/.agents/skills/missing_docs/references/surface_snapshot.json
+++ b/.agents/skills/missing_docs/references/surface_snapshot.json
@@ -949,6 +949,7 @@
     "GET /api/v1/memory_stores/{uid}/memories",
     "GET /api/v1/memory_stores/{uid}/memories/{memoryUid}",
     "GET /api/v1/memory_stores/{uid}/memories/{memoryUid}/versions",
+    "GET /api/v1/networking/egress-ranges",
     "GET /api/v1/oauth/authorize",
     "GET /api/v1/oauth/consent/info",
     "GET /api/v1/oauth/grants",