fix(ci): track restarted provider evidence

test/back/ql3PluginPackageRecoveryE2ELiveAudit.test.cjs

@@ -11,6 +11,7 @@ const producerPath = path.join(
   'scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs',
 );
 const {
+  CONTRACT_VERSION,
   FIXTURE,
   GATE_KEYS,
   MIGRATION_COUNT,
@@ -64,7 +65,7 @@ function validReport() {
     },
     database: {
       migrationCount: MIGRATION_COUNT,
-      capabilityVersion: 64,
+      capabilityVersion: CONTRACT_VERSION,
       initialState: 'active',
       initialActiveLockDigest: lock,
       upgradeState: 'failed',

test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs

@@ -7,9 +7,11 @@ const {
   createFixture,
 } = require('../../scripts/ql3-plugin-package-recovery-e2e-fixture.cjs');
 const {
+  CONTRACT_VERSION,
   MIGRATION_COUNT,
 } = require('../../scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs');
 const {
+  postgresqlControlSchemaContract,
   postgresqlMainMigrationStream,
 } = require('../../packages/ql3-cluster-postgres/dist/migration/migration.js');
 
@@ -64,6 +66,10 @@ test('fixture uses a real HTTPS and content-addressed OCI Distribution surface',
 
 test('report migration evidence follows the complete PostgreSQL stream', () => {
   assert.equal(MIGRATION_COUNT, postgresqlMainMigrationStream.migrations.length);
+  assert.equal(
+    CONTRACT_VERSION,
+    postgresqlControlSchemaContract.contractVersion,
+  );
 });
 
 test('fixture locks are bound to durable version-three approval dispatches', () => {
@@ -127,7 +133,7 @@ test('gate runs migration, healthy activation and a durable rejected upgrade', (
   assert.match(live, /initialSeed\.state, 'queued'/);
   assert.match(live, /upgradeSeed\.state, 'queued'/);
   assert.match(live, /value\.migrationCount, MIGRATION_COUNT/);
-  assert.match(live, /value\.capabilityVersion, 64/);
+  assert.match(live, /value\.capabilityVersion, CONTRACT_VERSION/);
   assert.match(live, /postgresEnvironment\(\s*'PACKAGE_EXECUTOR'/);
   assert.match(fixture, /assertPostgresPackageExecutorSchemaReady/);
   assert.match(live, /value\.initialState, 'active'/);

test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs

@@ -12,6 +12,7 @@ const {
   canI,
   deployProvider,
   executorJob,
+  providerObservationKey,
   providerServerSource,
   terminalJobSnapshot,
 } = require('../../scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs');
@@ -349,6 +350,19 @@ test('reads provider evidence from the exact ready Pod with trusted TLS SNI', ()
   );
 });
 
+test('starts a fresh provider request baseline after a container restart', () => {
+  const pod = {
+    metadata: { uid: 'provider-uid' },
+    status: {
+      containerStatuses: [{ name: 'provider', restartCount: 0 }],
+    },
+  };
+
+  assert.equal(providerObservationKey(pod), 'provider-uid:0');
+  pod.status.containerStatuses[0].restartCount = 1;
+  assert.equal(providerObservationKey(pod), 'provider-uid:1');
+});
+
 test('provider fixture logs only generation and authorization decision', () => {
   const source = providerServerSource();
   assert.match(source, /event:'provider_request',generation,allowed/);