docs: patching - maintenance windows, patch policies and runs

docs/vantage/servers.md

@@ -93,16 +93,16 @@ Agents check for pending package updates hourly and report the count - the
 machine's own package manager on Linux, the Windows Update COM API on Windows.
 From the server page you can:
 
-- **Apply updates** runs that check's install path and reports back. The agent
-  never reboots the machine; if one is owed, a **reboot required** badge
-  appears on the next inventory snapshot instead.
+- **Apply updates** installs every pending update now, without rebooting, and
+  opens the [patch run](./patching.md#patch-runs) recording the result. If a
+  reboot is owed, a **reboot required** badge appears on the next inventory
+  snapshot.
 - **Update agent** upgrades the Vantage agent on that machine. See
   [Agent updates](../operations/agent-updates.md).
 
-:::warning Applying updates is not scheduled or staged
-It runs immediately, on that machine. If you need ordering, health checks or a
-test machine first, build it as a [workflow](./workflows.md) instead.
-:::
+The panel also shows which [patch policy](./patching.md) covers the server and
+when its next window opens. To patch on a schedule, security-only, or with
+reboots, use a patch policy.
 
 ### Console