---
id: ADR-COM-FUL-006
title: Enforce register transitions and immutable history in the database
product_area: commerce
module: fulfillment
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
decision: >-
  Enforce obligation lifecycle transitions in the database and restrict
  application history writers to append operations.
constrains:
  - DOM-COM-FUL-001
  - DOM-COM-FUL-004
  - DOM-COM-FUL-005
  - STATE-COM-FUL-001
origin: >-
  services-commerce:db/migrations/20261018004016_obligation_register.sql;
  docs/migrations/obligation-register/README.md#D-P4-15; Platform's
  row-level-security and persistence standards as cited by AGENTS.md
alternatives:
  - option: Validate obligation moves only in services.
    why_not: >-
      Service-only validation cannot prevent other database writers from making
      invalid obligation moves.
  - option: Add database transition guards to every warehouse lifecycle.
    why_not: Equivalent warehouse transition triggers have not been implemented.
consequences:
  - >-
    Database lifecycle enforcement protects obligation writes beyond the owning
    service.
  - Append-only logs use retained sequence order for their history.
  - >-
    Warehouse lifecycles retain application checks rather than equivalent
    transition triggers.
supersedes: []
evidence:
  - >-
    services-commerce at c8b66a98: modules/fulfillment/db/obligations.table.ts,
    obligation-attempts.table.ts, intervention-logs.table.ts;
    modules/shipping/db/shipment-events.table.ts;
    modules/inventory/db/inventory-movements.table.ts; db/row-level-security.ts.
---

# Enforce register transitions and immutable history in the database

## Context

Other modules and background work can write delivery records whose histories must remain dependable.

## Decision

Enforce obligation lifecycle transitions in the database and restrict application history writers to append operations.

## Alternatives Considered

Validate obligation moves only in services. Service-only validation cannot prevent other database writers from making invalid obligation moves.

Add database transition guards to every warehouse lifecycle. Equivalent warehouse transition triggers have not been implemented.

## Consequences

Warehouse state checks remain weaker than obligation guards. Database ownership and administrative access remain distinct from application-role grants.