feat(tui): add safe session resume flow

docs/core-data-structures/persistence.md

@@ -34,6 +34,18 @@ interface SessionLocation {
 }
 ```
 
+## `SessionLiveLease` — live ownership capability
+
+`claimLive(id)` returns one idempotent release capability. The base service tracks only its own process; first-party backends additionally reject another live process and reclaim a dead owner's lease. `isLive(id)` reports either local or backend ownership without claiming it.
+
+```ts type-equiv
+/** Idempotent capability releasing one acquired live-session lease reference. */
+interface SessionLiveLease {
+  /** Release this caller's lease reference after its live session reaches quiescence. */
+  release(): Promise<void>
+}
+```
+
 ## `SessionHeader` — metadata beside the log
 
 Per-session metadata travels **separately** from the event log: format version, cwd, lineage, and the seed boundary are storage concerns, not conversation events, so they stay out of `SessionEventMap` and never reach `deriveMessages()`. The header is attached to a `Session` via `session.header`.

docs/core-data-structures/session-query.md

@@ -25,7 +25,17 @@ interface SessionRecord {
 }
 ```
 
-`SessionSurfaceSnapshot` is one exact-read observation rather than a retained subscription. Its raw-log boundary and folded events come from the same live-preferred load.
+`SessionLogSnapshot` is the complete detached, replay-validated raw log used by resume preflight. `SessionSurfaceSnapshot` is one exact-read surface observation rather than a retained subscription.
+
+```ts type-equiv
+/** One validated detached observation of a logical session's complete raw log. */
+interface SessionLogSnapshot {
+  /** Cloned session header selected from the same observation as `events`. */
+  session: SessionHeader
+  /** Cloned contiguous raw events after persistence repair and replay validation. */
+  events: SessionEvent[]
+}
+```
 
 ```ts type-equiv
 /** One atomic live-preferred observation of a session's current model surface. */