docs: Updated docs

docs/operations/upgrading.md

@@ -5,7 +5,12 @@ sidebar_label: Upgrading
 ---
 
 Upgrading the control plane is a pull and a recreate. Agents are versioned and
-upgraded separately — see [Agent updates](./agent-updates.md).
+upgraded separately see [Agent updates](./agent-updates.md).
+
+:::info Cloud instances upgrade themselves
+This page is for self-hosted installs. If your instance is hosted by us, there
+is nothing here for you to do.
+:::
 
 ## Upgrade
 
@@ -25,7 +30,7 @@ renamed or removed.
 2. **Indexes** are ensured. Auth and settings index builders are fatal on
    failure; secret and workflow ones only warn.
 3. **Default steps** are reseeded from the image, overwriting the `default`
-   library — which is why those steps are read-only.
+   library which is why those steps are read-only.
 
 Watch it:
 
@@ -52,28 +57,15 @@ is the reason the backup is not optional.
 The stack is not designed for it. `docker compose up -d` recreates the server
 container, which is a short interruption:
 
-- Agents reconnect on their own — they retry, and the poll loop is idempotent.
+- Agents reconnect on their own they retry, and the poll loop is idempotent.
 - Workflow runs in progress lose their command stream. Steps already dispatched
   finish on the agent, but their results have nowhere to go. **Do not upgrade
   during a run.**
 - Sessions survive, because they live in Redis rather than in the server.
 
-## Upgrading the hosted deployment
-
-Both Compose files, together:
-
-```bash
-cd /opt/vantage
-docker compose -f docker-compose.yml -f docker-compose.site.yml pull
-docker compose -f docker-compose.yml -f docker-compose.site.yml up -d --remove-orphans
-```
-
-CI builds and pushes images but does **not** deploy them; rolling out is this
-manual step. See [CI/CD](./ci-cd.md).
-
 ## After upgrading
 
 - Confirm every service is `running`.
 - Confirm servers return to `active` within a couple of poll intervals.
-- Open a page that touches encryption — a secret group — to confirm
+- Open a page that touches encryption a secret group to confirm
   `KEY_ENCRYPTION_KEY` came through.