docs(site+web): the durability story where users actually read

How-it-works reframes ownership honestly (sessions own their shells,
and outlive the daemon too), the FAQ answers the update question
directly, and the update dialog stops implying a restart costs
anything.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: karngyan

site/src/routes/docs.faq.tsx

@@ -119,8 +119,21 @@ const QUESTIONS: { q: string; verdict: string; body?: ReactNode }[] = [
     verdict: 'Nothing. Closing detaches the session. It does not kill it.',
     body: (
       <P>
-        The daemon owns the shell and its scrollback, so the build keeps running. Reattach from any
-        device and it replays what you missed.
+        The session owns its shell and its scrollback, so the build keeps running. Reattach from
+        any device and it replays what you missed.
+      </P>
+    ),
+  },
+  {
+    q: 'What happens to my sessions when flue updates or restarts?',
+    verdict: 'Nothing. Sessions outlive the daemon.',
+    body: (
+      <P>
+        Every session runs in its own small holder process, separate from the daemon. Update flue,
+        restart it, even have it crash: the shells and agents keep running, and the next daemon
+        picks them back up with their scrollback intact. A machine reboot is the one thing that
+        ends a session, and even then flue brings it back with its history, a fresh shell, and the
+        command that resumes the agent conversation it was in.
       </P>
     ),
   },

site/src/routes/docs.how-it-works.tsx

@@ -26,10 +26,11 @@ const COMMANDS: { cmd: string; what: string }[] = [
 function HowItWorks() {
   return (
     <DocPage slug="how-it-works" title={DOC.title} blurb={DOC.blurb}>
-      <Section title="One daemon owns the shells">
+      <Section title="Sessions own their shells">
         <Lead>
-          A small Go daemon holds the terminals and their scrollback. Everything that draws them is
-          a client, including the tab you are reading this in.
+          Every session is a small process of its own that holds the shell and its scrollback. A Go
+          daemon coordinates them, and everything that draws them is a client, including the tab
+          you are reading this in.
         </Lead>
         <P>
           The whole product rests on that one move. Normally a shell belongs to the window that
@@ -38,9 +39,13 @@ function HowItWorks() {
         </P>
         <P>
           Closing the tab does not kill the session. It only detaches it. The build keeps running,
-          the agent keeps working, the SSH session stays up. Reattach and the daemon replays the
+          the agent keeps working, the SSH session stays up. Reattach and the session replays the
           scrollback you missed.
         </P>
+        <P>
+          It outlives the daemon too. Updating flue, restarting it, even a crash: sessions keep
+          running through all of it, and the next daemon picks them back up where they were.
+        </P>
       </Section>
 
       <Section title="Every device is another view">

web/src/components/update-notice.tsx

@@ -250,7 +250,8 @@ function UpgradeDialog({
           <DialogTitle>{latest ? `Update to flue ${latest}` : 'Update flue'}</DialogTitle>
           <DialogDescription className="text-sm/6 text-pretty text-zinc-600 sm:text-xs/5 dark:text-zinc-400">
             Replacing the binary is something only this machine can do, so it happens in a terminal
-            rather than here. Whichever way flue was installed, run its line and restart the daemon.{' '}
+            rather than here. Whichever way flue was installed, run its line and restart the
+            daemon. Your sessions keep running through the restart.{' '}
             {url !== undefined && (
               <>
                 <TextLink href={url} target="_blank">