fix(vector): harden backup restore parity gates

.superpowers/sdd/pgvector-task-4-report.md

@@ -62,3 +62,24 @@ comparison and create/restore the selected objects. This is intentionally an adm
 recovery operation, not a runtime reader/writer action. `--force-nonempty` is explicit but still
 uses `pg_restore --clean --if-exists`; operators should prefer a new database/volume and validate
 migration status, health, and known retrieval before endpoint cutover.
+
+## Post-review hardening
+
+All five final review findings were addressed in a follow-up commit:
+
+- Restore now requires a physically separate PostgreSQL cluster and refuses any equal
+  `system_identifier`, independent of database OID or hostname.
+- `pg_restore` combines `--single-transaction` with `--exit-on-error`. The live drill creates an
+  existing vector sentinel, deliberately fails late during a forced restore, and proves the
+  original sentinel row/hash remains unchanged before performing the successful restore.
+- Backup uses a mode-0600 `mktemp` in the output directory, atomically renames it, and cleans only
+  that owned path. A fake-command test pins symlink-clobber resistance and preserves an adversarial
+  legacy `.partial` symlink and its target.
+- HTTP parity now traverses the real `VectorRestClient` transport boundary. It asserts RPC URL/key
+  and kinds payloads, legacy 404 fallback, response conversion, malformed metadata tolerance, and
+  canonical `VectorRestError` to `VectorStoreError` mapping.
+- The restored target runs role/secret reconciliation and a real `PgVectorStore` with separate
+  reader/writer logins. Health, known-record search, writer upsert, hash probe, schema/table/column/
+  sequence authority, and 768-dimensional compatibility are therefore verified through the
+  production adapter. Reconciliation now restores group-role schema `USAGE`, which table-selected
+  archives cannot carry.