prove contract across restarts using tests