# Restore Runbook

Executable via `RestoreGateService`/`scripts/restore_test.py` as of M6-05
(steps 1-8; step 9's scheduled trigger and step 10's operational traffic
cutover remain manual/operational). See `artifacts/evidence/M6-05/` for a
known, confirmed external blocker on this development host: Qdrant's own
snapshot-recovery mechanism currently fails here for reasons unrelated to
this code (root-caused in detail there) -- the code is complete and
unit-tested, and expected to pass real-infra validation unchanged once
that environment issue is resolved.

1. Select a completed verified backup and validate checksums.
2. Create an empty isolated restore environment with matching supported software.
3. Restore configuration references/secrets separately.
4. Restore PostgreSQL and apply only documented compatible migrations.
5. Restore immutable blobs and parsed artifacts; verify sampled hashes.
6. Restore Qdrant snapshots and collection aliases.
7. Run reconciliation for missing/orphan points and artifacts.
8. Run database integrity, counts, citations, golden retrieval and security denial tests.
9. Record evidence and only then allow traffic.
10. Keep the failed/current environment intact until restore acceptance.

A production incident restore follows the same proof, with an explicit incident commander and rollback decision.