diff --git a/webchannel/benchmark/lens/2026-10-08_13-39_binary-cold-20ms-rerun_JST/audit.md b/webchannel/benchmark/lens/2026-10-08_13-39_binary-cold-20ms-rerun_JST/audit.md
index f183d05..3848748 100644
--- a/webchannel/benchmark/lens/2026-10-08_13-39_binary-cold-20ms-rerun_JST/audit.md
+++ b/webchannel/benchmark/lens/2026-10-08_13-39_binary-cold-20ms-rerun_JST/audit.md
@@ -8,7 +8,9 @@ The early POST HTTP status comes from the saved Xcode response metadata for `AID
 
 A fresh HTTP/2 connection was verified for each trial's first transport request, not inferred from creating a new service or process. In ON trials, the early POST could create the connection first and the handshake GET could reuse it. DNS, radio, and server state may remain warm. Repeated response-metadata callbacks for one request are counted once.
 
-| Scenario | Pair | Setting | Test status | Early POST HTTP | Cold source | Handshake protocol | Handshake reused | Fresh TCP (ms) | Fresh TLS (ms) | Remote address |
+Connection setup is `connectEndDate - connectStartDate` and includes the TLS handshake. TLS handshake is `secureConnectionEndDate - secureConnectionStartDate`, a portion of connection setup; do not add the two values.
+
+| Scenario | Pair | Setting | Test status | Early POST HTTP | Cold source | Handshake protocol | Handshake reused | Connection setup (incl. TLS, ms) | TLS handshake (ms) | Remote address |
 |---|---:|:---:|---|:---:|---|---|:---:|---:|---:|---|
 | omnient | 1 | OFF | completed | — | handshake | h2 | false | 24.000 | 15.000 | 2404:6800:400b:c015::451 |
 | omnient | 1 | ON | completed | 400 | handshake | h2 | false | 25.000 | 16.000 | 2404:6800:400b:c015::451 |
diff --git a/webchannel/benchmark/lens/summarize-cold-benchmark.py b/webchannel/benchmark/lens/summarize-cold-benchmark.py
index cb39a94..59f4f7d 100644
--- a/webchannel/benchmark/lens/summarize-cold-benchmark.py
+++ b/webchannel/benchmark/lens/summarize-cold-benchmark.py
@@ -252,7 +252,8 @@ def main():
         "The table lists the actual handshake task, identified by its request ID. In ON trials, either the handshake GET or the concurrent early POST may create the fresh connection; the other request can reuse it within that trial.", "",
         "The early POST HTTP status comes from the saved Xcode response metadata for `AID=-1`. HTTP 400 confirms rejection of that POST, but does not identify whether soft stickiness failed, requests arrived out of order, or another server-side condition caused it. OFF has no early POST.", "",
         "A fresh HTTP/2 connection was verified for each trial's first transport request, not inferred from creating a new service or process. In ON trials, the early POST could create the connection first and the handshake GET could reuse it. DNS, radio, and server state may remain warm. Repeated response-metadata callbacks for one request are counted once.", "",
-        "| Scenario | Pair | Setting | Test status | Early POST HTTP | Cold source | Handshake protocol | Handshake reused | Fresh TCP (ms) | Fresh TLS (ms) | Remote address |",
+        "Connection setup is `connectEndDate - connectStartDate` and includes the TLS handshake. TLS handshake is `secureConnectionEndDate - secureConnectionStartDate`, a portion of connection setup; do not add the two values.", "",
+        "| Scenario | Pair | Setting | Test status | Early POST HTTP | Cold source | Handshake protocol | Handshake reused | Connection setup (incl. TLS, ms) | TLS handshake (ms) | Remote address |",
         "|---|---:|:---:|---|:---:|---|---|:---:|---:|---:|---|",
     ]
     for (scenario, pair, setting), row in trials.items():