diff --git a/agents/hermes-chaos.md b/agents/hermes-chaos.md
new file mode 100644
index 0000000..f0b0c48
--- /dev/null
+++ b/agents/hermes-chaos.md
@@ -0,0 +1,60 @@
+---
+title: Hermes Chaos
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+verified_on: 2026-08-08
+confidence: high
+tags: [hermes, chaos, ct450, experimental, agent]
+sources: [live-probe, phase-one-review]
+---
+
+# Hermes Chaos
+
+## Purpose
+
+Experimental Hermes instance for testing new configurations, skills, themes, model routing, and plugin changes before promoting them to production. Changes here must not affect CT460 production without explicit approval.
+
+## Location
+
+- **Container:** LXC CT450 (`hermesagent`)
+- **Tailscale IP:** `100.98.205.112`
+- **Hostname:** `hermesagent`
+- **Software:** przbadu/hermes-ui (Vite web app for browser use)
+
+## Current State
+
+- **Status:** Active (experimental)
+- **Hermes UI:** przbadu/hermes-ui running on CT450
+- **Duplicate cron jobs:** 11 paused (no post-pause execution records since 2026-08-01)
+- **Production counterparts:** CT460 has 11 enabled jobs with successful latest runs
+
+## Phase One Review (2026-08-08)
+
+Phase One seven-day review completed and independently live-verified:
+- CT450 duplicate jobs remained paused with no post-pause execution records
+- CT460 counterparts remain enabled with successful latest runs
+- CT333 schedules remained enabled and healthy
+- **Phase Two is ready for consideration but is NOT approved**
+
+## Key Rules
+
+- **Do not promote changes to production without explicit approval.** Chaos is for testing.
+- **Duplicate cron jobs are paused.** Do not re-enable without approval.
+- **Separate state.** Memory, skills, and config are independent from CT460.
+
+## Relationship to Production
+
+Hermes Chaos (CT450) and Hermes Production (CT460) are separate Hermes instances with:
+- Separate configs
+- Separate skills
+- Separate cron jobs
+- Separate memory state
+- Separate Tailscale identities
+
+## Related
+
+- [[agents/hermes-production]] — The production instance
+- [[infrastructure/hosts]] — Host inventory
+- [[systems/hermes-agent]] — Hermes Agent system details
diff --git a/agents/hermes-production.md b/agents/hermes-production.md
new file mode 100644
index 0000000..a085e18
--- /dev/null
+++ b/agents/hermes-production.md
@@ -0,0 +1,85 @@
+---
+title: Hermes Production
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+verified_on: 2026-08-15
+confidence: high
+tags: [hermes, production, ct460, agent]
+sources: [live-probe, config-inspection]
+---
+
+# Hermes Production
+
+## Purpose
+
+Primary personal agent for Anthony. Runs automation, research, communication, knowledge management, browser control, and scheduled tasks. This is the production instance — changes here affect live workflows.
+
+## Location
+
+- **Container:** LXC CT460 (`hermes`)
+- **Tailscale IP:** `100.96.100.82`
+- **Hostname:** `hermes`
+- **Port:** 8082 (HTTP), 9119 (gateway)
+- **Memory:** 14GB (upgraded from 5096MB on 2026-08-07)
+
+## Current State
+
+- **Status:** Active
+- **Hermes version:** v0.19.0
+- **Python:** 3.11.15
+- **Install directory:** `/home/hermes/.hermes/hermes-agent`
+- **Config:** `~/.hermes/config.yaml`
+- **Profile:** `default` (`~/.hermes/profiles/default/`)
+- **Soul:** Rhino — trickster-mentor in a green jacket 🎩
+
+## Profiles
+
+| Profile | Telegram Chats | Purpose |
+|---------|---------------|---------|
+| default | `-1004321904721` (Rhino chat) | Main agent |
+| ops | `-1003914987043` (Elephant ops), `-1003932503629` (OPS Tember rescue) | Operations/infra agent (Tusk) |
+
+## Providers & Routing
+
+- **Default provider:** `custom:litellm` → `http://litellm:4000/v1`
+- **Fallback provider:** `custom:omniroute` → `http://omniroute:20128/v1`
+- **Default model:** `freellmapi-auto`
+- See [[systems/model-providers]] for full breakdown.
+
+## Memory
+
+- **Backend:** Mnemosyne (local native)
+- **Vector type:** int8
+- **Shared surface:** `data/shared/mnemosyne.db`
+- See [[systems/memory-backend]] for details.
+
+## Scheduled Tasks
+
+- **Cron jobs:** 25+ active jobs
+- Delivery targets: Telegram (primary), Discord, origin, local
+- Notable: Birthday checker, job radar, newsletter digests, mnemosyne health/watchdog/backup
+- See [[systems/scheduled-tasks]] for full table.
+
+## Messaging
+
+- Telegram, Discord, Slack, Email, Mattermost, ntfy
+- See [[systems/messaging-integrations]] for details.
+
+## Key Differences from Chaos
+
+| Aspect | Production (CT460) | Chaos (CT450) |
+|--------|-------------------|---------------|
+| Purpose | Stable daily operations | Experimental/testing |
+| Cron jobs | 25+ enabled | 11 paused duplicates |
+| Config changes | Requires verification | Safe to experiment |
+| Memory | Production Mnemosyne | Separate state |
+
+## Related
+
+- [[agents/hermes-chaos]] — The experimental twin
+- [[agents/nanobot]] — Scout agent on CT333
+- [[systems/hermes-agent]] — Hermes Agent system details
+- [[systems/current-profile]] — Active profile details
+- [[infrastructure/hosts]] — Host inventory
diff --git a/agents/index.md b/agents/index.md
new file mode 100644
index 0000000..712eaec
--- /dev/null
+++ b/agents/index.md
@@ -0,0 +1,57 @@
+---
+title: Agent Estate
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+confidence: high
+tags: [agents, estate, overview]
+---
+
+# Agent Estate
+
+> Map of all AI agents, their locations, and their roles in Anthony's setup.
+
+## Overview
+
+The agent estate consists of multiple Hermes instances, a QwenPaw deployment, ZeroClaw, Open-Claw, and Nanobot — each with a defined role and home container.
+
+## Agents
+
+| Agent | Container | Role | Status |
+|-------|-----------|------|--------|
+| [[agents/hermes-production]] | CT460 | Production Command Centre | Active |
+| [[agents/hermes-chaos]] | CT450 | Experimental Chaos Lab | Active |
+| [[agents/nanobot]] | CT333 | Scout (quota notifications, daily briefing) | Active |
+| [[agents/qwenpaw]] | CT465 | Multi-agent gateway | Active |
+| [[agents/zeroclaw]] | CT333 | Autonomous daemon (TOML config) | Active |
+| [[agents/open-claw]] | VM 403 | Autonomous gateway node | Active |
+
+## Shared Infrastructure
+
+All agents share:
+- [[systems/omniroute]] — model routing and provider management
+- [[systems/model-providers]] — LiteLLM + OmniRoute provider catalog
+- [[infrastructure/proxmox]] — PVE host and containers
+- [[infrastructure/tailscale]] — VPN and serve routes
+- [[infrastructure/domains-and-tunnels]] — Cloudflare Tunnel routing
+
+## Relationships
+
+- Hermes production (CT460) and Hermes Chaos (CT450) are separate Hermes instances with separate configs, skills, and cron jobs.
+- ZeroClaw and Nanobot share the same LXC container (CT333) but are different software with different configs (TOML vs JSON).
+- Open-Claw (VM 403) is a completely separate Docker-based gateway, not related to ZeroClaw despite the similar name.
+- QwenPaw (CT465) is a separate agent platform with its own workspace and model routing.
+
+## Key Rules
+
+- **Never assume one agent's config applies to another.** Each agent has its own config format, paths, and provider routing.
+- **CT333 has two agents.** ZeroClaw (root, TOML) and Nanobot (JSON) coexist. Do not restart one without checking the other.
+- **CT450 Chaos is experimental.** Changes here must not affect CT460 production without explicit approval.
+- **Phase Two (estate consolidation) is not approved.** CT450 duplicate cron jobs remain paused; CT460 counterparts remain enabled.
+
+## Related
+
+- [[systems/hermes-agent]] — Hermes Agent system details
+- [[systems/nanobot]] — Nanobot system details
+- [[infrastructure/hosts]] — Host and container inventory
diff --git a/agents/nanobot.md b/agents/nanobot.md
new file mode 100644
index 0000000..2887ad7
--- /dev/null
+++ b/agents/nanobot.md
@@ -0,0 +1,56 @@
+---
+title: Nanobot
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+verified_on: 2026-08-08
+confidence: high
+tags: [nanobot, ct333, scout, agent]
+sources: [live-probe, phase-one-review]
+---
+
+# Nanobot
+
+## Purpose
+
+Scout agent for Anthony's estate. Handles quota notifications and daily agent briefings. Runs on CT333 alongside ZeroClaw (different software, same container).
+
+## Location
+
+- **Container:** LXC CT333 (`clawtest`)
+- **Tailscale IP:** `100.122.189.81`
+- **Port:** 8766 (Nanobot), 8900 (previously, now DOWN)
+- **Shares container with:** [[agents/zeroclaw]]
+
+## Current State
+
+- **Status:** Active (scout role)
+- **Cron schedules:** Enabled with recent ok status
+- **Quota notifications:** Enabled — kept active per Anthony's direction
+- **Daily briefing:** Enabled
+
+## Phase One Review (2026-08-08)
+
+CT333 schedules remained enabled and healthy during the seven-day review.
+
+## Key Rules
+
+- **Nanobot schedules remain enabled unless Anthony explicitly approves changes.**
+- **Do not conflate with ZeroClaw.** They share CT333 but are different software.
+- **Do not conflate with Open-Claw.** Open-Claw is VM 403, not CT333.
+
+## Relationship to ZeroClaw
+
+Nanobot and ZeroClaw share LXC CT333 (`clawtest`):
+- **Nanobot:** JSON config, Telegram gateway bot
+- **ZeroClaw:** TOML config, autonomous daemon (root)
+
+They are different software with different configs, different users, and different purposes. Restarting one does not affect the other.
+
+## Related
+
+- [[agents/zeroclaw]] — Autonomous daemon on same container
+- [[agents/open-claw]] — Separate gateway on VM 403
+- [[systems/nanobot]] — Detailed system page
+- [[comparisons/hermes-vs-nanobot]] — Comparison
diff --git a/agents/open-claw.md b/agents/open-claw.md
new file mode 100644
index 0000000..1d6f9c2
--- /dev/null
+++ b/agents/open-claw.md
@@ -0,0 +1,63 @@
+---
+title: Open-Claw
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+verified_on: 2026-08-15
+confidence: high
+tags: [openclaw, open-claw, vm403, gateway, agent]
+sources: [skill-inspection, config-reference]
+---
+
+# Open-Claw
+
+## Purpose
+
+Autonomous AI agent gateway running on a separate QEMU VM. Docker-based with Tailscale networking, serving a control UI and gateway for AI agent operations. Completely separate from ZeroClaw despite the similar name.
+
+## Location
+
+- **VM:** QEMU VM 403 (`open-claw`)
+- **Hostname:** `open-claw`
+- **LAN IP:** `192.168.178.193` (DHCP)
+- **Tailscale IP:** `100.64.172.34`
+- **Tailscale Domain:** `open-claw.kangaroo-eel.ts.net`
+- **Control UI:** `https://open-claw.kangaroo-eel.ts.net`
+- **OS User:** `openclaw` (sudo-capable)
+
+## Current State
+
+- **Status:** Active
+- **Config format:** JSON
+- **Auth:** Password-based (not paired tokens)
+- **Software:** Docker-based (community-scripts template)
+
+## Key Differences from ZeroClaw
+
+| Aspect | Open-Claw (VM 403) | ZeroClaw (CT333) |
+|--------|-------------------|------------------|
+| Type | QEMU VM | LXC container |
+| Config format | JSON | TOML |
+| OS user | `openclaw` | `root` |
+| Auth | Password | Paired tokens |
+| Tailscale | `100.64.172.34` | `100.122.189.81` |
+
+## Access
+
+Via Tailscale:
+```bash
+ssh openclaw@open-claw.kangaroo-eel.ts.net
+```
+
+Via PVE:
+```bash
+sshpass -p 'admin' ssh -o StrictHostKeyChecking=no root@192.168.178.39 "qm guest cmd 403 exec-status"
+```
+
+## Related
+
+- [[agents/zeroclaw]] — Different daemon on CT333 (not the same!)
+- [[agents/nanobot]] — Also on CT333 (different from both)
+- [[infrastructure/proxmox]] — PVE host
+- [[infrastructure/tailscale]] — VPN routing
diff --git a/agents/qwenpaw.md b/agents/qwenpaw.md
new file mode 100644
index 0000000..3d0762b
--- /dev/null
+++ b/agents/qwenpaw.md
@@ -0,0 +1,70 @@
+---
+title: QwenPaw
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+verified_on: 2026-08-15
+confidence: medium
+tags: [qwenpaw, ct465, agent, paseo]
+sources: [skill-inspection, config-reference]
+---
+
+# QwenPaw
+
+## Purpose
+
+Multi-agent gateway platform. Runs on CT465 with its own workspace, agent profiles, and model routing. Used for group chats and specialised agent tasks.
+
+## Location
+
+- **Container:** LXC CT465 (`qwenpaw`)
+- **Hostname:** `qwenpaw`
+- **Software:** QwenPaw with Paseo daemon
+
+## Current State
+
+- **Status:** Active
+- **Default chat model:** OmniRoute Smart Route (`auto/smart`)
+- **Config format:** JSON (`agent.json` per workspace)
+- **Daemon:** `paseo.service`
+
+## Operating Layers
+
+QwenPaw has several layers that must not be conflated:
+
+1. **PVE/LXC layer:** container status, guest access, resources
+2. **Paseo layer:** long-running daemon/supervisor (`paseo.service`)
+3. **Workspace layer:** agent profiles with `agent.json` and `active_model`
+4. **Provider layer:** remote providers (Kilo/OpenRouter) or local (Ollama)
+5. **Channel layer:** Telegram or other messaging adapters
+
+## Key Rules
+
+- **Do not assume "process is running" means "agent works."** Model resolution and a real response are separate checks.
+- **Verify model resolution per agent.** A default agent can work while a specialist agent silently has no model.
+- **Preserve existing provider/model routes.** Do not repin unrelated agents or replace known-good routes.
+- **Default chat model:** Use OmniRoute Smart Route (`auto/smart`) per Anthony's preference.
+
+## Diagnostics
+
+```bash
+qwenpaw doctor --deep --timeout 10 --llm-timeout 20
+qwenpaw models list
+qwenpaw daemon status
+```
+
+## Provider Verification
+
+When adding an OpenAI-compatible provider from Proxmox:
+- Verify target by VMID and hostname before writing config
+- CT600/`omniroute` is the OmniRoute service at `100.88.81.19:20128`
+- CT601/`omni` is a separate guest at `100.93.204.4`
+- Query `/v1/models` using the exact API key stored for QwenPaw, not a management key
+
+## Related
+
+- [[agents/hermes-production]] — Production Hermes
+- [[systems/omniroute]] — Model routing
+- [[systems/model-providers]] — Provider catalog
+- [[infrastructure/proxmox]] — PVE host
diff --git a/agents/zeroclaw.md b/agents/zeroclaw.md
new file mode 100644
index 0000000..d2e6a4b
--- /dev/null
+++ b/agents/zeroclaw.md
@@ -0,0 +1,66 @@
+---
+title: ZeroClaw
+type: system
+status: active
+created: 2026-08-15
+updated: 2026-08-15
+verified_on: 2026-08-15
+confidence: high
+tags: [zeroclaw, ct333, daemon, agent]
+sources: [skill-inspection, config-reference]
+---
+
+# ZeroClaw
+
+## Purpose
+
+Autonomous AI daemon running on CT333. Handles independent agent operations with TOML configuration. Runs alongside Nanobot on the same container but is completely separate software.
+
+## Location
+
+- **Container:** LXC CT333 (`clawtest`)
+- **Tailscale IP:** `100.122.189.81`
+- **User:** root
+- **Shares container with:** [[agents/nanobot]]
+
+## Current State
+
+- **Status:** Active
+- **Config format:** TOML (`/root/.zeroclaw/config.toml`)
+- **Daemon binary:** `/root/.local/bin/zeroclaw daemon`
+- **Workspace:** `/root/.zeroclaw/workspace`
+- **State:** `/root/.zeroclaw/state/`
+
+## Key Paths
+
+| Item | Path |
+|------|------|
+| Config | `/root/.zeroclaw/config.toml` |
+| Config dir | `/root/.zeroclaw/` |
+| Daemon binary | `/root/.local/bin/zeroclaw` |
+| Workspace | `/root/.zeroclaw/workspace` |
+| State | `/root/.zeroclaw/state/` |
+
+## Access
+
+```bash
+sshpass -p 'admin' ssh -o StrictHostKeyChecking=no root@192.168.178.39 "pct exec 333 -- <command>"
+```
+
+## Critical Pitfalls
+
+- **Duplicate daemons break Telegram replies.** If Telegram shows typing then no message, check for multiple daemon processes before changing providers.
+- **Do not confuse with Open-Claw.** Open-Claw is VM 403, not CT333. Different config format (TOML vs JSON), different user (root vs openclaw), different auth (paired tokens vs password).
+- **Do not confuse with Nanobot.** Nanobot is JSON config, ZeroClaw is TOML. Both on CT333 but completely separate.
+
+## Scope Discipline
+
+- No destructive operations without confirmation
+- No modifying running state without saving config first
+- No changes that could create lock-out scenarios without a safety net
+
+## Related
+
+- [[agents/nanobot]] — Different agent, same container
+- [[agents/open-claw]] — Different VM, similar name
+- [[infrastructure/proxmox]] — PVE host
diff --git a/index.md b/index.md
index 4cffc4d..a1344e4 100644
--- a/index.md
+++ b/index.md
@@ -4,9 +4,19 @@
 
 ## Start here
 - [[current-state]] — Current systems status
+- [[agents/index]] — Agent estate map (start here for "what runs where")
 - [[systems/hermes-agent]] — Hermes Agent overview and version
 - [[systems/current-profile]] — Active Hermes profile details
 
+## Agent Estate
+- [[agents/index]] — Estate overview and relationships
+- [[agents/hermes-production]] — CT460 production Command Centre (Rhino)
+- [[agents/hermes-chaos]] — CT450 experimental Chaos Lab
+- [[agents/nanobot]] — CT333 Scout (quota notifications, daily briefing)
+- [[agents/qwenpaw]] — CT465 multi-agent gateway
+- [[agents/zeroclaw]] — CT333 autonomous daemon (TOML config)
+- [[agents/open-claw]] — VM 403 autonomous gateway node
+
 ## Systems
 ### Core
 - [[systems/hermes-agent]] — Agent version, install, config paths