@@ -16,8 +16,11 @@
 
 @test "talos and installer are excluded from the parallel matrix" {
   out=$(hack/build-matrix.sh)
-  ! echo "$out" | grep -q '"packages/core/talos"'
-  ! echo "$out" | grep -q '"packages/core/installer"'
+  # `! cmd` would be vacuous: cozytest.sh runs each @test under `set -e`, which
+  # is suppressed for a `!`-negated pipeline, so a regression that wrongly
+  # included these paths would not fail the test. Assert via `if cmd; then ...`.
+  if echo "$out" | grep -q '"packages/core/talos"'; then echo "FAIL: packages/core/talos must be excluded from the parallel matrix"; false; fi
+  if echo "$out" | grep -q '"packages/core/installer"'; then echo "FAIL: packages/core/installer must be excluded from the parallel matrix"; false; fi
 }
 
 @test "talos-only diff selects nothing (handled by the dedicated leg)" {
 
@@ -53,8 +53,11 @@ E2E_CAPTURE_DATAPLANE_LIB=1
   [ "$(printf '%s\n' "$out" | grep -c .)" -eq 2 ]
   printf '%s\n' "$out" | grep -q '^tenant|app|LoadBalancer|192.0.2.50|'
   printf '%s\n' "$out" | grep -q '^tenant|db|LoadBalancer|192.0.2.51|'
-  ! printf '%s\n' "$out" | grep -q 'kube-dns'
-  ! printf '%s\n' "$out" | grep -q 'pending'
+  # `! cmd` is vacuous under cozytest's `set -e` (errexit is suppressed for a
+  # `!`-negated pipeline), so a filter regression that let these rows through
+  # would not fail the test. Assert the absence via `if cmd; then ...; false`.
+  if printf '%s\n' "$out" | grep -q 'kube-dns'; then echo "FAIL: lb_filter_services must drop the kube-dns row"; false; fi
+  if printf '%s\n' "$out" | grep -q 'pending'; then echo "FAIL: lb_filter_services must drop the pending (no external IP) row"; false; fi
 }
 
 @test "lb_first_ready_endpoint picks the first addressed endpoint that is not NotReady" {
 
@@ -85,9 +85,12 @@ EOF
   # Viewer can download
   mc cp --insecure ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
 
-  # Viewer cannot upload (must fail with Access Denied)
+  # Viewer cannot upload (must fail with Access Denied). A bare `! mc cp` is
+  # vacuous under cozytest's `set -e` (errexit is suppressed for a `!` pipeline),
+  # so a real access-control regression that let the upload through would pass
+  # silently — assert via `if mc cp; then ...; false` so it fails loudly.
   echo "readonly test" > /tmp/ro-test.txt
-  ! mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
+  if mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt; then echo "FAIL: read-only user must NOT be able to upload (bucket access-control regression)"; false; fi
 
   # --- Cleanup ---
   mc rm --insecure rw-user/$BUCKET_NAME/rw-test.txt
 
@@ -540,8 +540,11 @@ EOF
   echo "$cozyvalues" | grep -E '^\s*gateway:\s*"tenant-test-gwparent"\s*$' >/dev/null
 
   # The child must NOT have its own gateway HelmRelease — inheritance
-  # means no separate Gateway resource for the child tenant.
-  ! kubectl -n tenant-test-gwparent-gwchild get helmrelease gateway 2>/dev/null
+  # means no separate Gateway resource for the child tenant. A bare `! kubectl`
+  # is vacuous under cozytest's `set -e` (suppressed for a `!` pipeline), so if
+  # the child wrongly got its own HelmRelease the test would still pass; assert
+  # via `if kubectl get; then ...; false`.
+  if kubectl -n tenant-test-gwparent-gwchild get helmrelease gateway 2>/dev/null; then echo "FAIL: child tenant must NOT have its own gateway HelmRelease (gateway inheritance broken)"; false; fi
 
   # Teardown child before parent, waiting out each uninstall: deleting
   # the parent while the child is still uninstalling wedges the parent's
 
@@ -244,12 +244,15 @@ EOF
   # kuberture-e2e-public.cozystack.test (kuberture-e2e-public Service carries
   # external-dns.alpha.kubernetes.io/hostname=...) and must NOT see the
   # internal hostname (kuberture-e2e-internal carries only the internal prefix).
+  # A bare `! echo | grep` is vacuous under cozytest's `set -e` (errexit is
+  # suppressed for a `!` pipeline), so a leak of the wrong hostname into a probe
+  # would not fail the test; assert the absence via `if ... grep; then ...; false`.
   echo "${pub_logs}" | grep -F "${pub_host}" >/dev/null
-  ! echo "${pub_logs}" | grep -F "${int_host}" >/dev/null
+  if echo "${pub_logs}" | grep -F "${int_host}" >/dev/null; then echo "FAIL: public-prefix probe must NOT see the internal hostname ${int_host}"; false; fi
 
   # And the inverse for the internal-prefix probe.
   echo "${int_logs}" | grep -F "${int_host}" >/dev/null
-  ! echo "${int_logs}" | grep -F "${pub_host}" >/dev/null
+  if echo "${int_logs}" | grep -F "${pub_host}" >/dev/null; then echo "FAIL: internal-prefix probe must NOT see the public hostname ${pub_host}"; false; fi
 
   # _cleanup deletes the probe Pods, their SA, the ClusterRole+ClusterRoleBinding,
   # and finally the Package CR. Inlined here for the success path so a re-run
 
@@ -289,8 +289,10 @@ EOF
   # generic DNS-1035 errors and from network/auth failures).
   echo "$output" | grep -q "tenant names must"
   # And assert kubectl did NOT report creation — if validation regressed
-  # into a "warn" variant, the server could still accept the object.
-  ! echo "$output" | grep -qi "created"
+  # into a "warn" variant, the server could still accept the object. A bare
+  # `! echo | grep` is vacuous under cozytest's `set -e` (suppressed for a `!`
+  # pipeline), so the regression would slip through; assert via `if ...; false`.
+  if echo "$output" | grep -qi "created"; then echo "FAIL: kubectl reported the tenant as created — validation must reject it, not warn"; false; fi
 
   # Post-condition cleanup: even though we expect validation to reject the
   # create, removing foo-bar unconditionally keeps the cluster clean for
@@ -395,7 +397,10 @@ EOF
   version=$(kubectl get configmap cozystack-version -n cozy-system \
     -o jsonpath='{.data.version}')
   kubectl delete configmap cozystack-version -n cozy-system
-  ! kubectl get configmap cozystack-version -n cozy-system 2>/dev/null
+  # A bare `! kubectl get` is vacuous under cozytest's `set -e` (errexit is
+  # suppressed for a `!` pipeline), so a delete that silently failed would not
+  # fail the test; assert the absence via `if kubectl get; then ...; false`.
+  if kubectl get configmap cozystack-version -n cozy-system 2>/dev/null; then echo "FAIL: cozystack-version configmap must be gone after delete with the no-delete label removed"; false; fi
   # Reconstruct: declarative apply matches the chart template at
   # packages/core/platform/templates/cozystack-version.yaml — same label set
   # AND the helm.sh/resource-policy: keep annotation that pins the ConfigMap