Record Cloud migration restore drill

docs/agent-skill-sharing-implementation-checklist.md

@@ -99,6 +99,11 @@ Validated so far:
 - Cloud PR `#349` merged as `6a812c5e11` after proving an older API migration runner preserves a
   newer additive column/table and continues using its existing SQL. Build, lint, typecheck, tests,
   Terraform initialization, and validation passed; no service or infrastructure was deployed.
+- Cloud PR `#350` merged as `c22007384a` and added a required disposable PostgreSQL 16/17 drill.
+  Real old and future-additive Node processes coexist and write against one database, the database
+  is dumped and restored, and both processes write again after restoration. PR run `31624484826`
+  and merged-main run `31624717796` passed every code, Terraform, and database job; no staging or
+  production resource was accessed or deployed.
 - The immutable API deploy path stamps every artifact and skill literal variable plus exactly one
   approved skill-database secret, and rejects secret, Cloud SQL, service-account, scaling, CPU,
   memory, volume, mount, probe, or unexpected-environment drift before traffic promotion.
@@ -805,14 +810,15 @@ does not mean the surrounding phase is complete.
       custom metadata. Published-object metadata contains only aggregate archive/package digests
       and immutable generation identity; per-file paths, sizes, modes, and hashes remain inside the
       authorized archive manifest and immutable PostgreSQL version record.
-- [ ] Test forward migration, rollback strategy, backup restoration, and migration compatibility
+- [x] Test forward migration, rollback strategy, backup restoration, and migration compatibility
       during mixed API versions. Unit coverage proves atomic forward/idempotent migration, ignores
       an additive schema version written by a newer API, and leaves no recorded or partial schema
       after failure. PostgreSQL 16/17 integration coverage proves transactional DDL rollback and
       eight concurrent startup callers converge on one version. Cloud PR `#349` additionally proves
       the older runner and its existing SQL preserve and operate beside a simulated newer additive
-      column/table. A live mixed-binary coexistence run and database backup restore drill remain
-      open.
+      column/table. Cloud PR `#350` requires real old/new Node-process coexistence, writes before
+      and after a `pg_dump`/`pg_restore`, and full cleanup on disposable PostgreSQL 16 and 17; both
+      PR and merged-main runs passed.
 
 ### Authorization and lifecycle model
 

docs/agent-skill-sharing-installation-plan.md

@@ -58,7 +58,8 @@ Cloud bundle ingestion and bearer-link work merged through `stablyai/orca-cloud#
 the bundle desktop smoke update merged through `#329` as `eddb144afe`, generation-aware GCS
 recovery merged through `#330` as `8045c85dad`, and the bounded finalization load gate plus cleanup
 hardening merged through `#332`-`#335` as `bb8bf8b9ac`. The encrypted physical-host credential
-handoff merged through `#336` as `8fce3298ef`.
+handoff merged through `#336` as `8fce3298ef`. The isolated migration coexistence and database
+restore drill merged through `#350` as `c22007384a`.
 The authenticated OIDC smoke landed in `#313`; the narrow Auth release-metadata convergence
 follow-up landed in `#314`; the finalization and lifecycle fixes landed in `#317`. The final
 anonymous bearer-link candidate and canonical smoke now pass in staging. Production remains
@@ -74,6 +75,13 @@ caught and corrected assumptions about the Linux executable name and packaged ru
 location before the gate can protect a real release. Physical packaged ARM64 execution remains an
 explicit separate proof.
 
+Cloud verification now requires a disposable PostgreSQL 16/17 migration-and-restore drill. An old
+migration process remains connected while a future-additive process advances the schema; both
+write successfully, the database is dumped and restored, and both write again against the restored
+copy. PR run `31624484826` and merged-main run `31624717796` passed all code, Terraform, and
+database jobs. The drill is localhost-only, cleans both schemas and its backup, and does not touch
+staging or production services.
+
 The local redesign now has an independently implemented Agent Plugins 1.0.0 skills-only bundle
 manifest, deterministic one-or-many archive creation, bounded bundle extraction, additive bundle
 install contracts, per-skill conflict/results orchestration, and bundle provenance on installed