Say what the Session model is now, in the three comments that still describe the old one (#97)

shell/Sources/ShellCore/ControlPanel.swift

@@ -80,8 +80,9 @@ public struct LiveReading: Equatable, Sendable {
 ///
 /// It holds no policy and no state of its own. Every value it shows is read from
 /// Bridge Core over the same JSON-over-UDS control plane every other surface
-/// speaks, and every action it offers is one of the nine — there is no private
-/// protocol here, and no second path to anything.
+/// speaks, and every action it offers is one the control plane already
+/// publishes — there is no private protocol here, and no second path to
+/// anything.
 ///
 /// It reads on demand: when the dropdown opens, while it stays open, and after
 /// every action. No background timer — a poll nobody is reading is a permanent

src/gpt_voicecoding/core/bridge.py

@@ -223,9 +223,10 @@ def __init__(
         #: Empty when this hub generated none, and the interlock refuses to open
         #: a call on an empty one rather than this being checked at each caller.
         self._voice_instructions = self._instructions.voice.text if self._instructions else ""
-        #: Durations are measured with `clock`; anything written to disk is
-        #: stamped with `stamp`. A Session's `registered_at` is read back by the
-        #: next engine, and a monotonic reading would come back as the future.
+        #: Durations are measured with `clock`; anything read outside this
+        #: process is stamped with `stamp`. A Session's `first_seen` travels to
+        #: every surface in the `sessions` payload, and a monotonic reading
+        #: would name no moment on the far side.
         self._stamp = stamp
 
         self.interlock = CallInterlock(call)

src/gpt_voicecoding/core/clock.py

@@ -10,16 +10,18 @@
 because the system clock stepped, and a laptop that sleeps and wakes must not
 report a queued Relay as ten minutes stale when it was thirty seconds.
 
-**Nothing durable may be stamped from this clock.** A monotonic reading means
-nothing after a restart, and the durable subset — switch state and the Session
-registry — outlives the process. Those timestamps come from the surface that
-records them; this clock measures durations inside one engine run.
+**Nothing that will be read outside this process may be stamped from this
+clock.** A monotonic reading is an offset from an origin only this process
+knows, so it survives neither a restart nor the trip across the control plane,
+and on the far side it names no moment at all. This clock measures durations
+inside one engine run and answers no question asked from outside it.
 
 So there are two, and they are never interchangeable: `default_clock` measures
-elapsed time inside one run, and `wall_clock` stamps a record that outlives the
-run. A Session's `registered_at` is written to disk and read back by the next
-engine, so it is stamped from the second — a monotonic reading there would come
-back after a restart as a moment in the future.
+elapsed time inside one run, and `wall_clock` stamps a fact read outside it.
+A Session's `first_seen` is stamped from the second: the roster is not
+written to disk (#74), but every row of it travels to every surface in the
+`sessions` payload, and `first_seen` is the one field on that row this engine
+authored rather than observed.
 """
 
 from __future__ import annotations