- name: tenant-scoped-lock
  where: "orders/cancellation.py"
  ensure: >-
    Before mutating an order, the locked queryset must filter tenant_id by actor.tenant_id. Matching owner_id without the tenant restriction is insufficient.

- name: outbox-same-atomic-block
  where: "orders/confirmation.py"
  ensure: >-
    OutboxEvent.objects.create must run inside the same transaction.atomic block as order.save. Moving event insertion after the atomic block breaks the rule.

- name: notify-after-commit
  where: "orders/services.py"
  ensure: >-
    Order notification callbacks are registered with transaction.on_commit inside the atomic block, so a rolled-back order update does not send a notification.