---
id: ADR-COM-FUL-014
title: Compete with handoff by fencing the same shipment-line records
product_area: commerce
module: fulfillment
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
decision: >-
  Decide the race through conditional writes on shipment-line records and retain
  the cancellation fence.
constrains:
  - WF-COM-FUL-012
  - WF-COM-FUL-013
  - STATE-COM-FUL-005
  - DOM-COM-FUL-004
origin: 'services-commerce:docs/migrations/shipping/README.md#D-P8S-11 (build decision)'
alternatives:
  - option: Read shipment state before deciding cancellation.
    why_not: >-
      Reading status does not resolve a concurrent handoff; conditional writes
      do.
  - option: Block cancellation at whole-shipment granularity.
    why_not: >-
      A whole-shipment restriction would prevent preserving unrelated units
      during partial cancellation.
consequences:
  - >-
    Shipment lines use contiguous unit ranges, which determine
    cancellation-fence granularity.
  - Handoff refusal is retained after transaction rollback.
  - Departed goods use return receiving rather than cancellation release.
supersedes: []
evidence:
  - >-
    services-commerce at c8b66a98:
    modules/shipping/services/persistence/shipments.ts;
    services/fulfillment/cancellation-fence.ts, handoff.ts;
    db/shipment-lines.table.ts.
---

# Compete with handoff by fencing the same shipment-line records

## Context

Cancellation can race the warehouse’s final handoff.

## Decision

Decide the race through conditional writes on shipment-line records and retain the cancellation fence.

## Alternatives Considered

Read shipment state before deciding cancellation. Reading status does not resolve a concurrent handoff; conditional writes do.

Block cancellation at whole-shipment granularity. A whole-shipment restriction would prevent preserving unrelated units during partial cancellation.

## Consequences

The fence covers shipment-line ranges. Goods that have departed need returns, and carrier-label cleanup can remain unfinished.