- name: stock-never-negative
  where: "reserve.cjs"
  ensure: >-
    The stock UPDATE must include available >= the requested quantity in its WHERE predicate, so concurrent reservations cannot decrement below zero.

- name: transaction-releases-client
  where: "transaction.cjs"
  ensure: >-
    The withTransaction helper returns every acquired PostgreSQL client to its pool by executing client.release() in finally, including when the operation or rollback throws. A finally block containing only a comment leaves the acquired client unreleased.

- name: discount-limit
  where: "server.cjs"
  ensure: >-
    The checkout route rejects discountPercent unless it is a finite number in the inclusive range 0 to 20, before calculating the discounted total.