Complete runtime resilience and audit controls

tests/kind/wp09-run.sh

@@ -340,6 +340,12 @@ while IFS=$'\t' read -r lane coordination oidc target; do
     "UPDATE mutations SET request_deadline_at = now() + interval '60 seconds', worker_lease_until = now() + interval '60 seconds' WHERE operation_id = 'recovery-after-dispatch'; SELECT 1" \
     >/dev/null
   deploy_recovery "$lane" "$profile"
+  before_pg_restarts="$(
+    kube --namespace "$FIXTURE_NAMESPACE" get pods \
+      --selector="app=nuthatch-$lane" \
+      --output json |
+      jq '[.items[].status.containerStatuses[].restartCount] | add'
+  )"
   set_service_available postgres false
   terminate_database_connections "$database"
   sleep 6
@@ -348,7 +354,7 @@ while IFS=$'\t' read -r lane coordination oidc target; do
       --selector="app=nuthatch-$lane" \
       --output json |
       jq '[.items[].status.containerStatuses[].restartCount] | add'
-  )" -gt 0
+  )" = "$before_pg_restarts"
   set_service_available postgres true
   wait_for_value "$database" "SELECT 1" 1 "PostgreSQL recovery"
   pg_value \