- name: ring-write-permission
  where: "src/shop/orders.clj"
  ensure: >-
    The handler must reject a session actor without :orders/write before calling cancel-pending.

- name: reader-owned-by-with-open
  where: "src/shop/storage.clj"
  ensure: >-
    The reader must be owned by with-open so it closes when parsing succeeds or throws. A let binding without cleanup breaks this rule.