Align setup completion with auto-token handoff

docs/release-control/v6/internal/subsystems/agent-lifecycle.md

@@ -179,7 +179,11 @@ management, and fleet control surfaces.
    dashboard CTAs across multiple sections. Once the first monitored host is
    already connected, that same surface must pivot its primary CTA and headline
    to `/` so the operator is sent to the dashboard rather than being told to
-   install the first host again.
+   install the first host again. While the first host is still pending, that
+   same completion narrative must describe Infrastructure Install as the place
+   where the first-host scoped install token is prepared from setup handoff,
+   not as a second manual token-generation task the operator still needs to
+   figure out.
 
 ## Current State
 

frontend-modern/src/components/SetupWizard/SetupCompletionPanel.tsx

@@ -55,7 +55,7 @@ const UNIFIED_RESOURCE_GUIDANCE = {
     {
       title: 'Open Infrastructure Install',
       description:
-        'Use the canonical install workspace to generate the right install token and connection settings.',
+        'Use the canonical install workspace where Pulse prepares the first-host install token from setup and keeps the connection settings together.',
     },
     {
       title: 'Copy the command for your target system',
@@ -273,7 +273,7 @@ Infrastructure Install Workspace:
 ${installWorkspaceUrl}
 
 Use the Infrastructure Install workspace to:
-- generate Unified Agent tokens
+- continue with the first-host install token Pulse prepares from setup
 - choose the agent connection URL
 - configure TLS and custom CA options
 - copy Linux, macOS, Windows, and related install commands
@@ -645,7 +645,7 @@ Keep these credentials secure!
               <p class="mt-2 text-xs text-muted max-w-xl">
                 {hasConnectedAgents()
                   ? 'Pulse already has a live monitored system. Open the dashboard to confirm the first overview, then return to Infrastructure Install any time you want to add more hosts or regenerate commands.'
-                  : 'The canonical install flow now lives in Infrastructure Operations. Open that workspace to generate an install token, set the agent connection URL, configure TLS or custom CA options, and copy the correct command for the first system you want Pulse to monitor.'}
+                  : 'The canonical install flow now lives in Infrastructure Operations. Open that workspace to continue with the first-host install token Pulse prepares from setup, adjust the agent connection URL only if needed, configure TLS or custom CA options, and copy the correct command for the first system you want Pulse to monitor.'}
               </p>
             </div>
             <div class="rounded-sm bg-blue-50 px-2 py-1 text-[10px] font-medium text-blue-700 dark:bg-blue-900 dark:text-blue-300">

frontend-modern/src/components/SetupWizard/__tests__/SetupCompletionPanel.guardrails.test.ts

@@ -12,7 +12,9 @@ describe('SetupCompletionPanel guardrails', () => {
     expect(setupCompletionPanelSource).toContain('Shown during setup');
     expect(setupCompletionPanelSource).toContain('props.onComplete(INFRASTRUCTURE_INSTALL_PATH);');
     expect(setupCompletionPanelSource).toContain('Use the Infrastructure Install workspace to:');
-    expect(setupCompletionPanelSource).toContain('generate Unified Agent tokens');
+    expect(setupCompletionPanelSource).toContain(
+      'continue with the first-host install token Pulse prepares from setup',
+    );
     expect(setupCompletionPanelSource).toContain('configure TLS and custom CA options');
     expect(setupCompletionPanelSource).toContain('runStartProTrialAction({');
     expect(setupCompletionPanelSource).not.toContain('getUpgradeActionUrlOrFallback');
@@ -22,6 +24,9 @@ describe('SetupCompletionPanel guardrails', () => {
     expect(setupCompletionPanelSource).toContain("title: 'What happens next'");
     expect(setupCompletionPanelSource).toContain('Pulse is now secured.');
     expect(setupCompletionPanelSource).toContain("title: 'Open Infrastructure Install'");
+    expect(setupCompletionPanelSource).toContain(
+      'Pulse prepares the first-host install token from setup',
+    );
     expect(setupCompletionPanelSource).toContain("title: 'Run it on the first host you want to monitor'");
     expect(setupCompletionPanelSource).toContain('What to expect');
     expect(setupCompletionPanelSource).toContain('First host first');

frontend-modern/src/components/SetupWizard/__tests__/SetupCompletionPanel.test.tsx

@@ -121,6 +121,11 @@ describe('SetupCompletionPanel', () => {
         'Infrastructure Install owns the token, connection URL, TLS/CA settings, and platform-specific commands.',
       ),
     ).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'Use the canonical install workspace where Pulse prepares the first-host install token from setup and keeps the connection settings together.',
+      ),
+    ).toBeInTheDocument();
 
     expect(screen.queryByText('Connection URL (Agent → Pulse)')).not.toBeInTheDocument();
     expect(screen.queryByText('Custom CA certificate path (optional)')).not.toBeInTheDocument();
@@ -163,6 +168,9 @@ describe('SetupCompletionPanel', () => {
     expect(content).toContain('Admin API Token:');
     expect(content).toContain('Infrastructure Install Workspace:');
     expect(content).toContain('https://pulse.example.com/settings/infrastructure/install');
+    expect(content).toContain(
+      'continue with the first-host install token Pulse prepares from setup',
+    );
     expect(content).not.toContain('Example Install Command');
     expect(content).not.toContain('Example Windows Install Command');