Fail-first regression proof

Always prove security- or correctness-sensitive fixes with deterministic failing-first regressions and independent mutation checks. Reproduce real lifecycle ordering: preexisting state, delete-then-recreate, and modify-while-disabled. Independently remove or invert every skip, early return, validation, rollback, projection, limit, and redaction guard—especially NOT EXISTS, operation-kind, and content-match checks—and confirm the regression fails for the intended reason. Restore after each mutation, rerun focused tests, then run the affected suite, typecheck, lint, formatting, and repository gates. Green final tests look persuasive but do not prove assertions discriminate the fixed behavior.