Short answer: use a staged retrieval architecture with explicit collections, bounded queries, traceable source context, and a deletion gate that must pass before a changed restaurant menu is eligible to answer users.

For a media property aggregating restaurant listings from multiple sources, the least complex safe design is an active collection plus an audit ledger outside the serving path. The collection holds only records eligible for retrieval; the ledger holds source identity, ingestion version, and deletion evidence. This keeps user-facing answers fast without pretending that deletion and historical audit are the same storage problem.

The bill is made of retained searchable records, query fan-out, and re-index churn. Before choosing a service, measure those three terms. A useful test fixture might contain 12,000 active menu items, 800 source-deleted items, and 200 changed items, but those are experiment inputs, not production claims.…