Fail-first regression proof

Always prove security- or correctness-sensitive fixes with deterministic failing-first evidence: fail on the literal base, pass on the fix, then fail when each relevant guard is removed or inverted. Every adversarial-review defect needs that regression in the same PR; prioritize skip and early-return branches, and reproduce real lifecycle ordering, rollback, cancellation, fan-out, preexisting state, and delete/recreate boundaries. Run property tests 10 times, restore mutants byte-for-byte, then run focused suites, typecheck, lint, formatting, and repository gates.