diff --git a/AGENTS.md b/AGENTS.md
index 35e3daf..e6519a0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -637,6 +637,10 @@ live in the centralized store at `~/.creds/discourse.env`.
 |--------|---------|
 | [`scripts/check-rules.sh`](scripts/check-rules.sh) | Rule audit engine (shellcheck, image pinning, Discourse pointers, required files) |
 | [`scripts/setup-hooks.sh`](scripts/setup-hooks.sh) | Install git hooks (pre-commit, pre-push) |
+| [`scripts/pve-snapshot.sh`](scripts/pve-snapshot.sh) | PVE host snapshot/backup pass — hard-protects prod before risky windows (verified 2026-09) |
+| [`scripts/audit-fleet.sh`](scripts/audit-fleet.sh) | Fleet-wide audit sweep (hosts, services, drift) |
+| [`scripts/garden.sh`](scripts/garden.sh) | Repo/workspace gardening loop (strays, cruft, staleness) |
+| `scripts/kuma-*.py` suite | Uptime Kuma management (add-ping, fleet-sync, inventory, maintenance, notifications, regroup) |
 | [`tests/remote.sh`](tests/remote.sh) | **SSH chokepoint** — all Proxmox host + sandbox VM access routes here |
 | KNEL/netinfra: `dns-cluster-setup/remote-dns.sh` | SSH chokepoint for DNS infra hosts (netinfra-01/02, netboot) |
 | KNEL/netinfra: `dns/technitium/zone-snapshot.sh` | Refresh git SoR Technitium zone snapshots from the primary — **required after every DNS change** |
@@ -845,3 +849,7 @@ All work is tracked in [Redmine](https://projects.knownelement.com)
   force-remount (`umount -f -l`, recreate the mountpoint dir if the lazy
   umount removed it, fresh mount). `pvesm status` "active" can be stale —
   verify with a real read, not the status line.
+- **PMG pmgproxy restart hang (#696):** `systemctl restart pmgproxy` can hang
+  in "deactivating (stop)" on old workers ignoring TERM. If stuck >90s:
+  `systemctl kill -s KILL pmgproxy && systemctl start pmgproxy` — API/UI
+  only, mail flow unaffected. Postfix restarts don't hang.