test(stack): couple negative live assertions to internal controls

An assertion of absence proves nothing unless something in the same test
shows the row was reachable to begin with. A sibling `it` does not couple
them: vitest runs on past a failure, so the control can go red while the
negative test stays green in the same run.

beforeAll already throws on a failed seed, so an unseeded fixture is not
the live risk. The risk it cannot catch is an operator that silently
matches nothing — a constant-false predicate, or encryption no-op'ing —
which produces exactly the empty result each negative test asserts.

- operators-live-pg: fold the intersecting `and` pair into the disjoint
  block, so [] cannot pass via a constant-false `and`. Add a present-needle
  control to the `contains` no-match block, whose only proof that contains
  can match lived in a sibling test.
- operators-lock-context-live-pg: assert the same eq WITH the lock context
  finds ROW_A before asserting it is unreachable without one.
- matrix-live-pg: two-sample domains (date, timestamp) have an empty strict
  interior, so `gt`/`lt` were unproven there. Add one-sided bounds, which
  are non-empty for every domain.
- operators-null-live-pg: guard the [row] destructure so a missing fixture
  reads as a missing fixture, not a null-handling bug.

Found by audit while triaging CodeRabbit's decrypt-denial comment on #607;
same defect class, sites it did not reach.

Author: tobyhede

packages/stack/__tests__/drizzle-v3/operators-live-pg.test.ts

@@ -601,6 +601,15 @@ describeLivePg('v3 drizzle operators (live pg matrix)', () => {
         await ops.contains(matrixColumn(eqlType), needle),
       )
       expect(rows).toEqual([])
+
+      // The control. An over-rejecting guard would have thrown above, and a
+      // fail-open `contains` would have returned every row — but a
+      // constant-false `contains` also returns [], and nothing above catches
+      // it. Prove the same column still answers a needle that IS present.
+      const present = await selectRowKeys(
+        await ops.contains(matrixColumn(eqlType), 'ada'),
+      )
+      expect(present.length).toBeGreaterThan(0)
     },
     30000,
   )
@@ -661,25 +670,29 @@ describeLivePg('v3 drizzle operators (live pg matrix)', () => {
       ops.gte(matrixColumn('public.integer_ord'), 0),
     ] as const
 
-  it('and requires both encrypted predicates, unlike or', async () => {
-    const rows = await selectRowKeys(await ops.and(...disjointPredicates()))
-    expect(rows).toEqual([])
-  }, 30000)
-
-  // The disjoint pair above proves `and` is not `or`, but every `and` assertion
-  // over it expects []. A constant-false `and` would satisfy that too, and the
-  // `or` tests exercise a different operator. This pins the positive path:
-  // an intersecting pair that must actually return its row.
+  // Two assertions, one block, deliberately. The disjoint pair proves `and` is
+  // not `or`: swapping the operator turns [] into [A,B,C]. But [] is also what
+  // a constant-false `and` returns, and `beforeAll` cannot catch that — it only
+  // catches a failed seed. The intersecting pair is the control that can: it
+  // must return its row, so it dies on a constant-false `and` and on an eq/lt
+  // term that silently matches nothing. Keeping it in a sibling `it` would not
+  // couple them, since vitest runs on past a failure and the sibling could go
+  // red while this stayed green.
   //   text_eq = 'ada@example.com' -> ROW_B only
+  //   integer_ord >= 0            -> ROW_A (0), ROW_C (2147483647), not ROW_B (-42)
   //   integer_ord < 0             -> ROW_B (-42) only
-  it('and returns the rows satisfying both encrypted predicates', async () => {
-    const rows = await selectRowKeys(
+  it('and requires both encrypted predicates, unlike or', async () => {
+    expect(await selectRowKeys(await ops.and(...disjointPredicates()))).toEqual(
+      [],
+    )
+
+    const intersecting = await selectRowKeys(
       await ops.and(
         ops.eq(matrixColumn('public.text_eq'), 'ada@example.com'),
         ops.lt(matrixColumn('public.integer_ord'), 0),
       ),
     )
-    expect(rows).toEqual([ROW_B])
+    expect(intersecting).toEqual([ROW_B])
   }, 30000)
 
   it('or requires either encrypted predicate, unlike and', async () => {

packages/stack/__tests__/drizzle-v3/operators-lock-context-live-pg.test.ts

@@ -256,8 +256,18 @@ describeLivePg('v3 drizzle operators with lock context (live pg)', () => {
   // No `USER_JWT_B` exists, so that remains a follow-up.
   it('an identity-bound row does not match an eq issued with no lock context', async () => {
     if (skipUnlessJwt()) return
-    const condition = await ops.eq(secretTable.secret, SECRET_A)
-    expect(await selectRowKeys(condition)).toEqual([])
+
+    // The control, in this test rather than a sibling one. `[]` is what a held
+    // identity boundary and an unseeded fixture both look like, so the empty
+    // assertion below proves nothing on its own — it only means something
+    // against a demonstration that the row IS reachable with the context.
+    const bound = await ops.eq(secretTable.secret, SECRET_A, {
+      lockContext: IDENTITY_CLAIM as never,
+    })
+    expect(await selectRowKeys(bound)).toEqual([ROW_A])
+
+    const unbound = await ops.eq(secretTable.secret, SECRET_A)
+    expect(await selectRowKeys(unbound)).toEqual([])
   }, 30000)
 
   it('an identity-bound row does not decrypt without its lock context', async () => {

packages/stack/__tests__/drizzle-v3/operators-null-live-pg.test.ts

@@ -159,6 +159,9 @@ describeLivePg('v3 drizzle NULL persistence across tiers (live pg)', () => {
          WHERE test_run_id = $1 AND row_key = $2`,
       [RUN, ROW_A],
     )
+    // Without this, a missing fixture makes `row.value` raise a TypeError and
+    // the failure reads as a null-handling bug rather than an absent row.
+    expect(row).toBeDefined()
     expect(row.value).toBeNull()
   }, 30000)
 

packages/stack/__tests__/v3-matrix/matrix-live-pg.test.ts

@@ -550,6 +550,35 @@ describeLivePg('v3 matrix live Postgres coverage (all 35 domains)', () => {
       [ORDER_RUN_ID, ids, lo, hi],
     )
     expect(new Set(exclusive.map((r) => r.id))).toEqual(new Set(interiorIds))
+
+    // The controls. Domains with only two distinct samples (date, timestamp)
+    // have an empty interior, so the assertion above is satisfied by a
+    // constant-false `gt`/`lt` as well as by a correct one. One-sided strict
+    // bounds are non-empty for every domain: `gt(lo)` must return everything
+    // above the minimum, `lt(hi)` everything below the maximum. Both die on a
+    // constant-false operator, and on a constant-true one (which would drag in
+    // the excluded endpoint).
+    const aboveLo = await sql.unsafe<Row[]>(
+      `SELECT id FROM ${TABLE_NAME}
+         WHERE test_run_id = $1
+           AND id = ANY($2)
+           AND eql_v3.gt("${col}", $3::jsonb)`,
+      [ORDER_RUN_ID, ids, lo],
+    )
+    expect(new Set(aboveLo.map((r) => r.id))).toEqual(
+      new Set(sortedIdx.slice(1).map((i) => ids[i])),
+    )
+
+    const belowHi = await sql.unsafe<Row[]>(
+      `SELECT id FROM ${TABLE_NAME}
+         WHERE test_run_id = $1
+           AND id = ANY($2)
+           AND eql_v3.lt("${col}", $3::jsonb)`,
+      [ORDER_RUN_ID, ids, hi],
+    )
+    expect(new Set(belowHi.map((r) => r.id))).toEqual(
+      new Set(sortedIdx.slice(0, L - 1).map((i) => ids[i])),
+    )
   })
 
   it.each(