Say what the Session model is now, in the three comments that still describe the old one (#97)

[Simon-AI-coding]

Closes #97. Comments only — three doc blocks, no behaviour, no code change.

The two Python sites

core/clock.py and core/bridge.py both justified wall_clock with a Session's registered_at being written to disk and read back by the next engine. #74 renamed the field to first_seen and deleted the Session half of core/state.py, so the sentence was false twice over — and it was the only example either comment offered for why two clocks exist at all. registered_at occurs nowhere else in the tree.

Renaming the field in the sentence would not have fixed it, because the durability claim is gone too. Nothing durable carries a timestamp any more:

• PersistedState is switch state and nothing else (core/persistence.py:57-76)
• the roster is deliberately not persisted (core/state.py:9-12), because discovery re-reads it on a cadence (Build 1/7 — Discovery, roster and reachability: lock the one Session-inspection type #74)
• SwitchSnapshot has no time field

The fact that still holds is that first_seen leaves the process. It travels to every surface in the sessions payload (control_plane/payloads.py:151), where a monotonic reading is an offset from an origin only the engine knows and names no moment at all. So the rule is restated as "nothing read outside this process may be stamped from this clock", which is broader than the durability rule it replaces and covers it. wall_clock's one caller today is BridgeCore._stamp → SessionRegistry._admit(now=…) → Session.first_seen.

The Swift site

ControlPanel.swift said every action it offers "is one of the nine". The Action enum has seven members today (STATUS SWITCH SESSIONS LIVE RELAY APPROVE VERIFY) and #76 makes it eight.

#97 offered pointing at tests/test_app_bundle.py::TestTheThingsThatMustAgree instead of a count, but that class does not hold the two action sets together yet — its seven tests cover the protocol version, the socket path, the interpreter path, the bundle identity, the example config (twice) and the wheel contents. That guard arrives with #76. Rather than point at a test that does not exist, the sentence is written to need no count and no pointer: the claim it was always making is "no private protocol, no second path", and that survives the count changing.

Left alone on purpose

docs/control-plane.md:121,129 carries the same stale registered_at — including as the payload's key name, which makes it a public-interface error rather than a comment. #76 already rewrites both lines in its branch (first_seen, and a correct justification), so fixing it here would produce nothing but a merge conflict with in-flight work.

tests/acceptance/test_lanes.py:62's "one of the nine" is a different nine — the nine acceptance step names, which is still nine. Correct as written.

Legacy citation

Comments only, no runtime behaviour, so there is nothing in GPT-VoiceCoding-legacy@1d32845 to port, adapt or drop.

Gates

All six CI run: lines, locally:

gate	result
ruff check .	pass
ruff format --check .	pass (196 files)
pytest	1267 passed, 3 deselected
swift build --package-path shell	pass
swift test --package-path shell --disable-xctest	123 tests, 14 suites, pass
swift format lint --recursive --strict Sources Tests Package.swift	pass

🤖 Generated with Claude Code