Sync the self-hosting stack

README.md

@@ -497,6 +497,16 @@ Four things worth knowing about it:
   whole of the trail. Linux and macOS are not supported yet, and a session opened against one is
   refused rather than silently downgraded.
 
+**How Jarvis tells machines apart.** An agent is its key: running the install command again on a
+machine reuses the key it has, and re-enrolls the same agent onto the same asset. A reinstall from
+scratch, its key gone, is recognised by the machine's fingerprint — a hash of its machine ID
+(`/etc/machine-id`, Windows' `MachineGuid`) and its hardware UUID, or the Mac's hardware UUID — when
+the agent that sent it before is offline and has the same hostname. Anything else enrolls as a machine
+of its own, so a clone of a VM or container template never replaces the machine it was cloned from.
+When two agents do share a fingerprint, the Agents page marks both **Duplicate ID**: give the clone its
+own machine ID (on Linux, `rm /etc/machine-id && systemd-machine-id-setup`) and run the install
+command on it again.
+
 **What an enrolled agent can do.** Inventory the machine, run commands, read, write and fetch files,
 list and control services, list processes, update itself, carry that shell, and — on Windows — show
 its screen. It runs as root on Linux and macOS and as LocalSystem on Windows, deliberately: its