docs: Self review of doc pages

docs/vantage/vulnerabilities.md

@@ -9,8 +9,8 @@ against the security advisories published by that server's own distribution and
 raises a finding for anything not yet patched.
 
 Requires the **vulnerability scanning** feature on your licence. Without it,
-agents collect nothing at all — there is no inventory stored and no findings
-page to read.
+nothing is collected and there is no findings page. See
+[Licensing and entitlements](../hq/licensing-and-entitlements.md).
 
 ## What gets scanned
 
@@ -20,10 +20,9 @@ report.
 
 Windows servers are not scanned.
 
-Some distributions publish no machine-readable advisory feed. Those servers
-show **unsupported** on their own page rather than appearing as having no
-vulnerabilities — the two are very different answers, and only one of them is
-good news.
+Some distributions publish no security advisories Vantage can read. Those
+servers are shown as **unsupported**, rather than as having no vulnerabilities.
+Those are very different answers, and only one of them is good news.
 
 ## Why versions look "wrong"
 
@@ -43,9 +42,9 @@ the accurate one for the package you are actually running.
 
 ## The board
 
-`/vulnerabilities` groups findings by CVE. One row per CVE with the number of
-affected servers, expandable to the individual servers — the same CVE across
-forty machines is one decision, not forty.
+The **Vulnerabilities** page groups findings by CVE, one row each, with the
+number of servers affected. Expand a row to see them. The same CVE across forty
+machines is usually one decision, not forty.
 
 Severity counts at the top filter the list when clicked. The state tabs switch
 between **open**, **accepted** and **fixed**.
@@ -60,8 +59,8 @@ A finding with a known fixed version gets an **Apply updates** button, which
 runs the same OS update the server page offers. There is no separate patching
 mechanism.
 
-Vantage never patches automatically. An unattended upgrade triggered by a third
-party's data feed is a fleet-wide change nobody chose.
+Vantage never patches automatically. Applying updates is always something you
+ask for.
 
 ## Accepting a finding
 
@@ -72,23 +71,21 @@ or one with no vendor fix published at all.
 a reason that is recorded in the audit log along with your name. On that date it
 reopens by itself.
 
-The expiry is required. A dismissal with no end date is how a finding gets
-forgotten, and it is exactly what an auditor will ask to see.
+An expiry date is required, so nothing is dismissed permanently by accident.
 
 ## Alerts
 
-Alert rules live with your notification channels, under
-**Settings → Notification Channels**. A rule has a minimum severity, an optional
-server tag filter, and one or more channels.
+Alert rules live with your
+[notification channels](./notification-channels.md). A rule has a minimum
+severity, an optional server tag filter, and the channels to notify.
 
-A rule sends **one digest per scan** summarising what newly opened — never one
-message per finding. A database refresh can open several hundred findings at
-once, and a message each would flood the channel.
+A rule sends **one summary per scan** covering everything newly found, rather
+than one message per finding. A single update to the security data can raise
+hundreds at once.
 
 Findings that were already open do not re-alert.
 
 ## Fleet-wide package search
 
-`GET /api/packages/search?name=openssl` answers which servers run a given
-package and at what version, across the whole fleet. Useful during an incident
-before a finding exists for it.
+Search your whole fleet for a package by name to see which servers have it and
+at what version. Useful during an incident, before there is a finding for it.