- name: tenant-scoped-update
  where: "orders.py"
  ensure: >-
    The cancellation UPDATE must constrain tenant_id to actor.tenant_id before changing the order. An id-only or owner-only update breaks this requirement.

- name: outbox-no-early-commit
  where: "confirmation.py"
  ensure: >-
    The order update and outbox insertion stay in the same transaction. The function must not explicitly commit inside the session.begin block before it finishes successfully.

- name: discount-limit
  where: "main.py"
  ensure: >-
    The discount percentage accepted by the checkout endpoint must be constrained to the inclusive range 0 to 20 before a total is calculated.