- name: tenant-is-in-update
  where: "src/cancel.rs"
  ensure: >-
    The order UPDATE must include tenant_id=$2 and bind actor.tenant_id so the write is scoped to the verified tenant.

- name: worker-has-shutdown-branch
  where: "src/worker.rs"
  ensure: >-
    run_worker must select on stop.cancelled and break on cancellation, rather than wait indefinitely for another message.