paranoid() does survive power loss.

While it’s important to make this explicit, at what point do we just assume a high-reliability UPS is table stakes?

Of course, if you need SIL2 type reliability then you need to assume any given hardware component can spontaneously combust and become a total loss, at which point the data loss caused by a power cut is a rounding error.