Compete with handoff by fencing the same shipment-line records

Context

Cancellation can race the warehouse’s final handoff.

Decide the race through conditional writes on shipment-line records and retain the cancellation fence.

Read shipment state before deciding cancellation. Reading status does not resolve a concurrent handoff; conditional writes do.

Block cancellation at whole-shipment granularity. A whole-shipment restriction would prevent preserving unrelated units during partial cancellation.

The fence covers shipment-line ranges. Goods that have departed need returns, and carrier-label cleanup can remain unfinished.