- name: nuxt-mutation-tenant-scope
  where: "server/api/orders/[id]/cancel.post.ts"
  ensure: >-
    The API cancellation must use tenantId from the required user session in its database mutation.

- name: ssr-state-request-isolation
  where: "composables/useOrderDraft.ts"
  ensure: >-
    useOrderDraft must use Nuxt useState, not a module-level ref shared by server requests.