- name: locked-stock-availability
  where: "app/services/reserve_stock.rb"
  ensure: >-
    Inside the row lock, available stock must be checked against quantity before it is decremented. Reject reservations that exceed the locked stock.

- name: submitted-order-version
  where: "app/services/cancel_order.rb"
  ensure: >-
    The cancellation must reject when the supplied expected_version differs from order.lock_version before changing status.

- name: profile-field-allowlist
  where: "app/controllers/profiles_controller.rb"
  ensure: >-
    The profile_params method permits only display_name and timezone. It must not permit admin, role, or all parameters with permit! or an empty-hash allowlist.