docs: Updated docs

docs/getting-started/first-server.md

@@ -4,41 +4,39 @@ title: Add your first server
 sidebar_label: Add your first server
 ---
 
-Enrolling a machine means running one command on it. The control plane issues a
+Enrolling a server means running one command on it. The control plane issues a
 short-lived token, the install script fetches the agent and writes a config, and
 the machine registers itself.
 
 ## 1. Create the enrolment
 
-In the UI, go to **Servers → Add server**. That calls `POST /api/servers/new`,
-which generates a server ID and a pre-registration token and hands back a ready
-one-liner.
+In the UI, go to **Servers → Add server** Then click the **Generate Install Command** button.
+This generates a server ID and a pre-registration token
 
 :::warning The token is single-use and lives one hour
-It is the only credential in the flow, and it is spent the moment the agent
-calls `Register`. If you paste it somewhere and come back tomorrow, create a new
-enrolment instead nothing is lost by doing so.
+It is the only credential in the flow, and it is spent the moment the agent registers.
 :::
 
 ## 2. Run the one-liner
 
 ### Linux
 
+Run the generated install script as root.
+
+Here is an example of the install script:
+
 ```bash
 curl -fsSL "https://vantage.example.com/install?server_id=<id>&token=<token>" | bash
 ```
 
-Run it as root. The script:
+What the script does:
 
 1. Detects architecture `x86_64` and `aarch64` only; anything else exits.
-2. Asks the Gitea API for the newest `agent/v*` release.
-3. Downloads the binary and `checksums.txt`, and **verifies the SHA-256**,
-   aborting on a mismatch.
-4. Installs to `/usr/local/bin/vantage-agent`, mode `0755`.
-5. Writes `/etc/vantage/config.yaml` (directory `0700`, file `0600`) containing
-   the server ID, the pre-registration token and the gRPC host.
-6. Writes `/etc/systemd/system/vantage-agent.service` with `Restart=always`, and
-   runs `systemctl enable --now vantage-agent`.
+2. Downloads the binary and `checksums.txt`, and **verifies the SHA-256**, aborting on a mismatch.
+3. Installs to `/usr/local/bin/vantage-agent`, mode `0755`.
+4. Writes the config file at `/etc/vantage/config.yaml`
+    1. This contains the server ID, the pre-registration token and the gRPC host.
+5. Writes the systemd service file `/etc/systemd/system/vantage-agent.service` and starts the agent.
 
 ### Windows
 
@@ -46,42 +44,30 @@ Run it as root. The script:
 irm "https://vantage.example.com/install.ps1?server_id=<id>&token=<token>" | iex
 ```
 
-Run from an elevated PowerShell. The agent is registered as a service through
-NSSM, with the config at `%ProgramData%\vantage\config.yaml`. There is also an
-MSI built by CI if you would rather deploy that.
+Run from an elevated PowerShell.
 
-:::info Windows agents are second-class on purpose
-They register, heartbeat, run workflow steps and report inventory. They do
-**not** manage `authorized_keys` the key subsystem is Linux-only, and a
-Windows agent stops after the heartbeat portion of the poll.
+What the script does:
+
+1. Creates the config at `%ProgramData%\vantage\config.yaml`.
+    1. This contains the server ID, the pre-registration token and the gRPC host.
+2. Downloads the agent MSI from Gitea.
+3. Installs the MSI and creates the Windows service.
+4. Starts the agent.
+
+:::info Windows agents do **not** manage `authorized_keys` as this is a Linux-only function.
 :::
 
 ## 3. Watch it come up
 
-The server appears immediately as `pending`. Within one poll interval 30
-seconds it flips to `active`.
+The server appears immediately as `pending`. Within one poll interval, 30 seconds it becomes `active`.
 
-On the machine:
+Check the systemd logs using the following commands:
 
 ```bash
 systemctl status vantage-agent
 journalctl -u vantage-agent -f
 ```
 
-What happens on that first run:
-
-```
-1. Load /etc/vantage/config.yaml
-2. pre_reg_token present  → register → save agent_token, clear pre_reg_token
-3. Reconnect with the permanent token
-4. Start: command stream · hourly update check · inventory · monitors
-5. Enter the key poll loop
-```
-
-After registration the config no longer contains the pre-registration token; it
-contains a permanent agent token instead. The control plane stores only the
-SHA-256 of that token, never the token itself.
-
 ## 4. Confirm it works
 
 Open the server's detail page. Within a minute or two you should see:
@@ -104,7 +90,7 @@ Open the server's detail page. Within a minute or two you should see:
 A server is marked `offline` when its last-seen time passes the threshold; that
 sweep runs every two minutes, so allow for it before concluding anything.
 
-## Next
+## Next Steps
 
 - [Assign an SSH key](../vantage/ssh-keys.md)
 - [Run a workflow](../vantage/workflows.md)