Add backup:offload as the composition pass that selects gate-eligible raw media from disk, archives one segment at a time, confirms every archived file, records the offload result, and exposes dry-run planning without side effects. The ordering is load-bearing: archive confirmation must happen before deletion, and the offload ledger append is the durable pre-delete witness for the backed-up media copy. The pruning audit remains post-hoc, so raw media is unlinked only after the ledger append returns. Archive backups now retry restic locks for the archive step only, last_offload carries ok history plus honest per-pass counters, and raw_media_offload is an explicit pruning audit kind for this path.