Add the partial-restic-failure regression that writes one of three recorded files, rolls it back, preserves the full folded ledger state, and proves a later offload run cannot append a remnant-only event for that segment. Tighten the acceptance traps: same-size different-digest verification, rollback only touching recorded paths, both sides of the free-space guard, restore-all summed refusal, terminal last_restore recording, default-stream rediscovery, fresh degraded ledger status under the measurement cache, and direct route/CLI restore seams.