docs: Self review of doc pages

docs/vantage/servers.md

@@ -5,8 +5,8 @@ sidebar_label: Servers
 ---
 
 The fleet. Every managed machine runs an agent that connects outbound to the
-control plane, and everything else in Vantage keys, workflows, monitors,
-consoles targets these records.
+control plane. Keys, workflows, monitors and consoles all point at these
+records.
 
 ## Enrolling a server
 
@@ -23,18 +23,17 @@ a one-liner to run as root on the target machine.
 | `offline` | Last-seen passed the threshold                      |
 
 The offline sweep runs every two minutes, so a machine that has just gone away
-takes a little while to be marked as such. That delay is intentional a single
-missed poll is not an outage.
+takes a little while to be marked as such.
 
 ## Tags
 
 A tag is a `key:value` label you put on a server. Tags are how you say what a
-machine **is** `env:prod`, `role:web`, `team:core-infra` so that you can find
-it later, and so that a [workflow](./workflows.md) can target it without you
+machine is, such as `env:prod`, `role:web` or `team:core-infra`, so that you can
+find it later and so a [workflow](./workflows.md) can target it without you
 naming it by hand.
 
-There is no tag library to manage first. A tag exists because a server carries
-it, and it stops existing when the last server carrying it drops it.
+There is no tag library to set up first. A tag exists as soon as a server
+carries it, and disappears when the last server carrying it drops it.
 
 ### The rules
 
@@ -45,25 +44,22 @@ it, and it stops existing when the last server carrying it drops it.
 | Value length | up to 64 characters                             |
 | Per server | up to 20 tags                                     |
 
-Neither half may be empty, and keys beginning `sys:` are reserved for tags
-Vantage may derive from inventory later, so a tag you write today can never
-collide with one invented for you tomorrow.
+Neither half may be empty, and keys beginning `sys:` are reserved for Vantage's
+own use.
 
-Anything outside those rules is refused with a message naming the rule, rather
-than quietly saved in a shape you did not intend. Uppercase is not folded to
-lowercase for you `Env` is a mistake, not a synonym for `env`.
+Anything outside those rules is refused, with a message naming the rule.
+Uppercase is not corrected for you, so `Env` and `env` are different tags.
 
 ### Editing a server's tags
 
-On the server detail page, **Edit** beside the tag chips. Saving replaces the
-whole set: what you see in the editor is exactly what the server will have.
-There is no per-tag merge, so if two people edit the same server at once, the
-last save wins outright rather than producing a blend of the two.
+On the server's page, click **Edit** beside the tags. Saving replaces the whole
+set, so what you see in the editor is exactly what the server ends up with. If
+two people edit the same server at once, the last save wins.
 
 ### Filtering the fleet
 
 The **Servers** list has a picker per tag key in use. Choosing values from more
-than one key narrows the list a server must match **all** of them, not any.
+than one key narrows the list, because a server must match **all** of them.
 Untagged servers appear only when no filter is set.
 
 :::tip A filtered fleet view is a link
@@ -96,16 +92,13 @@ metrics is normal rather than a fault.
 Agents check for pending package updates hourly and report the count. From the
 server page you can:
 
-- **Apply updates** pushes `ApplyUpdatesCmd` down the command stream. The
-  agent runs the platform's package manager and reports back.
-- **Update agent** pushes `UpdateAgentCmd` with a target version; the agent
-  downloads the release, verifies it and replaces itself. See
+- **Apply updates** runs the machine's own package manager and reports back.
+- **Update agent** upgrades the Vantage agent on that machine. See
   [Agent updates](../operations/agent-updates.md).
 
 :::warning Applying updates is not scheduled or staged
-It runs now, on that machine. If you need ordering, health gates or a canary,
-build it as a [workflow](./workflows.md) instead that is what workflows exist
-for.
+It runs immediately, on that machine. If you need ordering, health checks or a
+test machine first, build it as a [workflow](./workflows.md) instead.
 :::
 
 ### Console
@@ -114,10 +107,8 @@ Opens a browser SSH, RDP or VNC session. See [Browser console](./browser-console
 
 ## Windows servers
 
-Windows agents register, heartbeat, run workflow steps and report inventory.
-They do not manage `authorized_keys` the poll loop stops after the heartbeat
-on any non-Linux host. This is a deliberate scope decision, not a gap being
-worked on.
+Windows agents register, run workflow steps and report inventory. They do not
+manage `authorized_keys`.
 
 ## Removing a server
 
@@ -138,7 +129,6 @@ no longer running to remove them. Revoke and let the agent apply the change
 
 ## Agent tokens
 
-Each server has its own token. The control plane stores only its SHA-256; the
-plaintext exists in the agent's `0600` config and nowhere else. There is no way
-to read a token back out of the control plane if one is lost, re-enrol the
-machine.
+Each server has its own token, which exists in full only in the agent's config
+file on that machine. Vantage stores a fingerprint of it and cannot show it to
+you again. If a token is lost, enrol the machine again.