Restore consumes resume-state.json per session: each successfully resumed session is removed from the persisted set immediately (atomic write). A crash or kill during restoration can no longer lose the remaining sessions; the next boot continues with what is left. Failed resumes stay recorded and are retried on the next boot.