docs+ux: say out loud that sessions outlive flue

flue restart and flue update now report that sessions kept running
(suppressed under the FLUE_NO_HOLDER escape hatch, whose sessions
still ride snapshots), usage stops promising snapshots where none are
needed, and the README gets the durability story in one paragraph.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: karngyan

README.md

@@ -81,6 +81,15 @@ not lost, but nothing runs until it wakes.
 
 The full version is at [flue.sh/docs/setup](https://flue.sh/docs/setup).
 
+## Sessions outlive flue
+
+Every session runs in its own small holder process, not inside the daemon.
+Updating flue, restarting it, even the daemon crashing outright: the shells
+and agents keep running, and the next daemon picks them back up with their
+scrollback where you left it. A machine reboot is the one thing that ends a
+session, and even then flue brings it back with its history, a fresh shell,
+and the command that resumes the agent conversation it was in.
+
 ## The CLI
 
 ```

cmd/flue/main.go

@@ -114,7 +114,7 @@ const usageText = `flue — your terminal, as a browser tab
 
   flue enable             install the login service, start the daemon, open the UI
   flue disable            remove the login service
-  flue restart            restart the daemon; live sessions ride across on snapshots
+  flue restart            restart the daemon; sessions keep running through it
   flue status             daemon, login service, and session diagnostics
   flue relay setup        deploy a relay to your own Cloudflare account
   flue relay join URL --secret S --fleet K   point this machine at an existing relay
@@ -1611,6 +1611,14 @@ func runRestart(w io.Writer, wait time.Duration) error {
 		return err
 	}
 	fmt.Fprintf(w, "  ✓ daemon running on 127.0.0.1:%d\n", port)
+	// True by construction, not aspiration: sessions live in their own
+	// holder processes, and the daemon that just restarted reattached to
+	// them on its way up. The one exception is a daemon running with
+	// FLUE_NO_HOLDER, whose sessions still ride snapshots; that escape
+	// hatch's users chose the old behaviour and know what it costs.
+	if os.Getenv("FLUE_NO_HOLDER") == "" {
+		fmt.Fprintf(w, "  ✓ sessions kept running; tabs reconnect on their own\n")
+	}
 	return nil
 }
 

cmd/flue/update.go

@@ -365,6 +365,12 @@ func restartForUpdate(w io.Writer, latest string) error {
 				return err
 			}
 			fmt.Fprintf(w, "  ✓ daemon restarted, running flue %s on 127.0.0.1:%d\n", got, port)
+			// Same honesty rule as runRestart: holder-backed sessions rode
+			// across the bounce; only the FLUE_NO_HOLDER escape hatch still
+			// pays for an update with its sessions.
+			if os.Getenv("FLUE_NO_HOLDER") == "" {
+				fmt.Fprintf(w, "  ✓ sessions kept running; tabs reconnect on their own\n")
+			}
 			return nil
 		}
 	}