- name: unknown-mutation-fields-rejected
  where: "src/main.ts"
  ensure: >-
    The global ValidationPipe must enable both whitelist and forbidNonWhitelisted to reject unknown mutation fields instead of silently accepting or stripping them.

- name: outbox-transaction-manager
  where: "src/confirm-order.ts"
  ensure: >-
    The Order and OutboxEvent writes both use the transaction callback parameter named manager. In particular, OutboxEvent is saved with manager.save(OutboxEvent, ...). Saving it with db.manager.save uses the global manager and violates the shared transaction requirement.