- name: verified-token-write-scope
  where: "orders.ts"
  ensure: >-
    The cancellation handler must reject a verified token without orders:write before invoking cancelOrder.

- name: persist-notification-before-dispatch
  where: "confirm.ts"
  ensure: >-
    The confirm function persists a durable notification record by calling tx.insertOutbox inside the same db.transaction callback as tx.confirmOrder, before scheduling dispatchCommittedOutbox with waitUntil. Confirming the order and scheduling dispatch without inserting an outbox record violates this requirement.