Restore to a point in time you trust

A snapshot has no value until it has been restored. The restore is the part almost never exercised, so it is the part most likely to fail when it is finally needed.

Capture what the agent depends on

A snapshot that misses a record the agent reads is a snapshot that restores into a fault. List the records the agent depends on and include them all.

Verify into a scratch place

Restore into a scratch place and read the data back before the live system is touched. A restore first tried on the live system is a test with the worst possible stakes.

def restorable(snapshot):
    return snapshot.verified and snapshot.records

Aim at a named point

Restoring to whatever is latest is a guess about what latest means. Name the point so the restore lands where it was intended rather than wherever the clock left off.