Cover restore engine behavior for daily-key restic calls, _default stream layout, operated append-only sessions, BYO hosted seams, free-space refusal, no-op folding, partial restore sweeps, rollback, and callosum staying untouched. Pin the real restic contract that drove the design: restic restore <snapshot_id>:<segment_dir> --target <segment_dir> --include /<name> may exit 0 while restoring zero files for a missing include, so tests assert missing files are caught by existence, size, and sha256 verification. Also cover the exact five offload routes, the three journal backup offload CLI verbs, last_restore state, device_total_bytes(), and resolve_segment_dir() default-stream behavior.