Restore Is Not Rollback: Monotonic Recovery for Stateful Safety Systems

State restoration is normally understood as replacement of current state with an earlier snapshot. That model is unsafe for systems in which authority, revocation, expiry, lineage, or safety policy may have changed after the snapshot was created. A literal rollback can restore not only historical data but also historical capability, resurrecting permissions that were subsequently revoked or expired. This paper defines a monotonic recovery model in which historical state may be restored without restoring historical authority. Recovery is treated as a typed state transition rather than time reversal. The restore operator reconstructs recoverable historical state while reconciling it against a current protection floor containing non-resurrectable revocations, expirations, prohibitions, lineage restrictions, and capability invalidations.