- name: job-after-commit
  where: "app/Actions/ConfirmOrder.php"
  ensure: >-
    The order-confirmation job is explicitly deferred until the surrounding database transaction commits: SendOrderConfirmation::dispatch($order->id) is chained with ->afterCommit(). Plain dispatch inside the transaction does not meet this requirement.

- name: reservation-conditional-write
  where: "app/Actions/ReserveStock.php"
  ensure: >-
    The inventory decrement must be conditional on available >= quantity in the same database query.

- name: order-owner-required
  where: "app/Policies/OrderPolicy.php"
  ensure: >-
    The update policy grants access only when the authenticated user id equals the order user_id. It must not return true for a different user.