docs: trim README explanations, keep steps short

README.md

@@ -52,7 +52,7 @@ helm version
 sudo dnf install -y httpd-tools
 ```
 
-`htpasswd` is used in Phase 3.1 to generate the admin password hash. No `.env` file, no `envsubst` — the password never touches Git.
+`htpasswd` generates the admin password hash used in Phase 3.1.
 
 ---
 
@@ -68,31 +68,23 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD:
+Install ArgoCD (`values.yaml` has no `configs.secret` block — chart auto-generates a random admin password):
 
 ```bash
 helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
 ```
 
-`values.yaml` deliberately has no `configs.secret` block — the chart auto-generates a random admin password, stored in `argocd-initial-admin-secret`. That's replaced with your own in 3.1.
-
-Wait for ArgoCD to be ready:
+Wait for ready:
 
 ```bash
 kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s
 ```
 
-Check pods are up:
+(Optional) inspect manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443` → `https://localhost:8080`. Not needed for bootstrap.
 
-```bash
-kubectl get pods -n argocd
-```
+### 3.1 Set admin password on the Secret
 
-> UI login isn't needed for bootstrap (Phase 4 applies the root Application via `kubectl`). Only port-forward if you want to inspect ArgoCD manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443`, then open `https://localhost:8080` with `admin` / your chosen password.
-
-### 3.1 Set your own admin password directly on the Secret
-
-Set it once, straight on `argocd-secret` (the Secret ArgoCD actually reads) — never in `values.yaml`, never committed to Git:
+Patched directly on `argocd-secret`, never in `values.yaml`/Git — keeps `configs.secret` absent so self-heal (wave -1) never touches it, password stays stable forever:
 
 ```bash
 read -s -p "ArgoCD admin password: " PW; echo
@@ -102,21 +94,19 @@ kubectl patch secret argocd-secret -n argocd --type merge -p \
 unset PW HASH
 ```
 
-**Why this stays stable across self-management:** `values.yaml` never declares `configs.secret.argocdServerAdminPassword`, so the Helm chart's rendered manifest never includes `admin.password`/`admin.passwordMtime`. Once ArgoCD self-manages (wave -1, `selfHeal: true`), it only reconciles fields present in its own rendered output — it has no opinion on keys it never declared, so your patched hash survives every sync, forever. If that block is ever added back to `values.yaml`, the next self-heal overwrites it — don't add it.
-
-To rotate later: repeat the same `kubectl patch` with a new hash and a new `admin.passwordMtime` (ArgoCD only accepts the change if the Mtime also changes).
+Rotate: repeat with new hash + new `admin.passwordMtime` (required for ArgoCD to accept the change).
 
 ---
 
 ## Phase 4 — Apply the root bootstrap Application
 
-`bootstrap-app.yaml` (repo root) is the one seed manifest — it lives in Git, not created ad-hoc via UI/CLI. Per GitOps practice, every Application ArgoCD runs must be recreatable from Git; a UI-created app that's stored nowhere can't survive a rebuild. This is the only manifest ever applied by hand — everything downstream (including ArgoCD managing itself, wave -1) is reached by ArgoCD syncing `bootstrap/apps/` from here.
+`bootstrap-app.yaml` (repo root) is the seed manifest, committed to Git — not created via UI/CLI. Only manifest ever applied by hand:
 
 ```bash
 kubectl apply -f bootstrap-app.yaml
 ```
 
-ArgoCD syncs all child Applications in wave order automatically, including self-managing itself via `bootstrap/apps/argocd.yaml` (wave -1).
+ArgoCD syncs all child Applications in wave order automatically, including self-managing itself (`bootstrap/apps/argocd.yaml`, wave -1).
 
 Monitor progress: