- name: tenant-is-in-update
  where: "src/cancel.rs"
  ensure: >-
    The order UPDATE must include tenant_id=$2 and bind actor.tenant_id so the write is scoped to the verified tenant.