diff --git a/api/tests/test_tombstone.py b/api/tests/test_tombstone.py
index 514109ed..f9cfe57f 100644
--- a/api/tests/test_tombstone.py
+++ b/api/tests/test_tombstone.py
@@ -92,9 +92,7 @@ def test_read_documents_deduplicates(self):
             assert len(result) == 1
             assert result[0]["body"]["text"] == "new"
             call_args = mock_client.query.call_args[0][0]
-            assert "QUALIFY" in call_args
-
-    def test_read_document_by_id_returns_latest(self):
+            assert "row_number()" in call_args
         """read_document_by_id must return the latest version."""
         with _patch_client() as mock_client:
             mock_client.query.return_value = _mock_result_rows(
@@ -135,7 +133,7 @@ def test_delete_group_tombstones(self):
             calls = [c[0][0] for c in mock_client.command.call_args_list]
             for call in calls:
                 assert "deleted" in call.lower()
-                assert "now()" in call.lower()
+                assert "now64(6)" in call.lower()
 
 
 # ---------------------------------------------------------------------------
@@ -205,7 +203,7 @@ def test_is_origin_allowed_deduplicates(self):
             assert "ORDER BY updated_at DESC LIMIT 1" in call_args
 
     def test_get_app_contracts_deduplicates(self):
-        """get_app_contracts must deduplicate via QUALIFY."""
+        """get_app_contracts must deduplicate via window function."""
         with _patch_client() as mock_client:
             mock_client.query.return_value = _mock_result_rows(
                 [
@@ -215,7 +213,7 @@ def test_get_app_contracts_deduplicates(self):
             result = ch.get_app_contracts("alice")
             assert len(result) == 1
             call_args = mock_client.query.call_args[0][0]
-            assert "QUALIFY" in call_args
+            assert "row_number()" in call_args
 
     def test_revoke_app_contract_tombstones(self):
         """revoke_app_contract must INSERT a tombstoned version."""
@@ -223,7 +221,7 @@ def test_revoke_app_contract_tombstones(self):
             ch.revoke_app_contract("alice", "https://app.com")
             call_args = mock_client.command.call_args[0][0]
             assert "INSERT INTO app_contracts" in call_args
-            assert "now()" in call_args
+            assert "now64(6)" in call_args
             assert "deleted" in call_args
 
 
@@ -333,7 +331,7 @@ def test_is_provider_origin_allowed_deduplicates(self):
             assert "ORDER BY updated_at DESC LIMIT 1" in call_args
 
     def test_get_provider_service_contracts_deduplicates(self):
-        """get_provider_service_contracts must deduplicate via QUALIFY."""
+        """get_provider_service_contracts must deduplicate via window function."""
         with _patch_client() as mock_client:
             mock_client.query.return_value = _mock_result_rows(
                 [
@@ -343,7 +341,7 @@ def test_get_provider_service_contracts_deduplicates(self):
             result = ch.get_provider_service_contracts("api.web10.app")
             assert len(result) == 1
             call_args = mock_client.query.call_args[0][0]
-            assert "QUALIFY" in call_args
+            assert "row_number()" in call_args
 
 
 # ---------------------------------------------------------------------------
diff --git a/knowledge/changelogs/CHANGELOG.md b/knowledge/changelogs/CHANGELOG.md
index 6ae1e1f6..6016e4c8 100644
--- a/knowledge/changelogs/CHANGELOG.md
+++ b/knowledge/changelogs/CHANGELOG.md
@@ -1,3 +1,6 @@
+3.0.57 || 18.08.2026
+fix(tests): align tombstone test assertions with actual SQL — 5 tests asserted `QUALIFY` and `now()` but the code uses `row_number() OVER(...)` subqueries and `now64(6)`. Fixes PR #643's api (lint + test) CI failure.
+
 3.0.56 || 17.08.2026
 fix(notes+hello demos): notes — createNote() now reads from #curr textarea (was undefined), removed closeAuthPopup() crash, added dense [notes-demo] logging, fixed displayNotes CSS classes + HTML escaping. hello — removed closeAuthPopup() crash, added dense [hello-demo] logging, added null-token guard. New gauntlet E2E tests: e2e/tests/notes-demo.spec.ts and e2e/tests/hello-demo.spec.ts — each captures console logs from BOTH the demo page AND the auth popup, verifying the full round-trip (demo sends contract → auth receives → auth logs in → auth approves → auth sends token → demo receives → demo does CRUD). Log sequence ordering asserted on both sides. Plus API-level CRUD + 403 tests. Plan updated: Phase 1 now includes hello demo.