diff --git a/docs/gateway/bridge-protocol.md b/docs/gateway/bridge-protocol.md
index 850de1c2d51..48549ba811a 100644
--- a/docs/gateway/bridge-protocol.md
+++ b/docs/gateway/bridge-protocol.md
@@ -9,14 +9,9 @@ title: "Bridge Protocol"
 
 # Bridge protocol (legacy node transport)
 
-The Bridge protocol is a **legacy** node transport (TCP JSONL). New node clients
-should use the unified Gateway WebSocket protocol instead.
-
-If you are building an operator or node client, use the
-[Gateway protocol](/gateway/protocol).
-
-**Note:** Current OpenClaw builds no longer ship the TCP bridge listener; this document is kept for historical reference.
-Legacy `bridge.*` config keys are no longer part of the config schema.
+<Warning>
+The TCP bridge has been **removed**. Current OpenClaw builds do not ship the bridge listener and `bridge.*` config keys are no longer in the schema. This page is kept for historical reference only. Use the [Gateway Protocol](/gateway/protocol) for all node/operator clients.
+</Warning>
 
 ## Why we have both
 
diff --git a/docs/gateway/network-model.md b/docs/gateway/network-model.md
index f5fb9a258ea..1b9a9eb2605 100644
--- a/docs/gateway/network-model.md
+++ b/docs/gateway/network-model.md
@@ -7,6 +7,8 @@ title: "Network model"
 
 # Network Model
 
+> This content has been merged into [Network](/network#core-model). See that page for the current guide.
+
 Most operations flow through the Gateway (`openclaw gateway`), a single long-running
 process that owns channel connections and the WebSocket control plane.
 
diff --git a/docs/network.md b/docs/network.md
index f9bacafc949..516a724fb75 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -14,6 +14,15 @@ devices across localhost, LAN, and tailnet.
 
 ## Core model
 
+Most operations flow through the Gateway (`openclaw gateway`), a single long-running process that owns channel connections and the WebSocket control plane.
+
+- **Loopback first**: the Gateway WS defaults to `ws://127.0.0.1:18789`. Tokens are required for non-loopback binds.
+- **One Gateway per host** is recommended. For isolation, run multiple gateways with isolated profiles and ports ([Multiple Gateways](/gateway/multiple-gateways)).
+- **Canvas host** is served on the same port as the Gateway (`/__openclaw__/canvas/`, `/__openclaw__/a2ui/`), protected by Gateway auth when bound beyond loopback.
+- **Remote access** is typically SSH tunnel or Tailscale VPN ([Remote Access](/gateway/remote)).
+
+Key references:
+
 - [Gateway architecture](/concepts/architecture)
 - [Gateway protocol](/gateway/protocol)
 - [Gateway runbook](/gateway)