diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index fb3cf69..d17f8a5 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -99,8 +99,9 @@ running a local daemon, for a host that only talks to another machine's.
 The daemon unit carries the same `KillMode=process` as the wizard-written one,
 so `systemctl --user restart maestro-daemon` leaves the tmux server and every
 terminal session alive. Structured sessions end their active turn on
-shutdown and resume once, from their event log, on the next daemon
-(`docs/RESTART.md#structured-sessions`).
+shutdown and resume once on the next daemon: ACP state comes back via
+`session/load`, while the event log only replays Maestro's own transcript
+projection (`docs/RESTART.md#structured-sessions`).
 
 ## Thin builds for single-role hosts
 
diff --git a/docs/STRUCTURED-VIEW.md b/docs/STRUCTURED-VIEW.md
index c843207..1885d0e 100644
--- a/docs/STRUCTURED-VIEW.md
+++ b/docs/STRUCTURED-VIEW.md
@@ -312,8 +312,11 @@ directory: the sidecar itself (`<id>.json`), plus two next to it:
 Three ways a structured session ends up `Dead`, each with different
 persistence consequences:
 
-1. **The adapter exits, or the log append fails, while the daemon keeps
-   running.** `mark_session_dead` applies the same natural-exit worktree rule
+1. **The adapter exits, or a notification append to the event log fails,
+   while the daemon keeps running.** (An approval-row append failure is
+   narrower: it cancels the pending approval and lets the session continue,
+   without marking it dead.) `mark_session_dead` applies the same
+   natural-exit worktree rule
    as a terminal session's own pane exiting (`docs/WORKTREES.md`): a pristine
    worktree is removed, one holding unsaved work is left on disk. No recovery
    marker is written. This death is permanent — a later daemon restart's