The backup is a valid snapshot of yesterday. It is not an authority for what can be disclosed today. A restore can bring back old postings, vector chunks, snippets, response caches, or ACL material even if the live source removed them. Before it receives traffic, put the restored generation in quarantine. Keep current authorization at the disclosure boundary, including current group membership and source state, and fail closed on an unavailable decision. But do not confuse a current permission check with deletion: a user could still be permitted to see a document whose source object was deleted. Deletion and content validity need their own current-state check or reconciled tombstone view.

Record a restore checkpoint: backup generation, the source versions it contains, a consistent stream position from which changes can be replayed, and the latest source watermark you intend to claim. If the snapshot and stream position were captured separately, prove that changes between them were not lost. Replay every available change through a staging index, with idempotent per-object version application, then compare with authoritative current source state. Promote only after required data and permission reconciliations pass for the declared scope. Do not reuse old response or semantic caches simply because the index files restored cleanly. An answer in progress should pin a coherent generation and still pass live authorization and deletion checks before private text leaves the service.

The missing tombstone is the hard probe. Log compaction systems can discard delete markers after a configured retention window. Kafka's topic configuration says its tombstone retention bounds how long a consumer replaying from offset zero can reconstruct the final state. If the restore point predates a deletion whose marker is gone, a replay from that point cannot prove completeness.

Reconcile against an authoritative inventory of currently existing objects, including versions and ACLs, or rebuild from a fresh complete snapshot plus change stream with a safe handoff. If that inventory is unavailable, do not serve the affected corpus as complete. Show the service as degraded or unavailable for that scope.

The incident test should restore a backup behind live traffic and inject a delete, a group revocation, a moved source, a duplicated event, and a log gap. Check actual answer and citation paths, not merely document counts. If the deletion system has a separate immutable suppression registry, apply it before any restored index lookup can expose bytes. Keep it maintained independently of the backup generation. Recovery is complete when the source truth and serving view agree at a known watermark, not when the search process starts listening on a port.