@blamejs/blamejs-shop 0.4.61 → 0.4.63

package/lib/preorder.js

@@ -245,29 +245,67 @@ function create(opts) {
   // order surface they used). The per-campaign counter is NOT
   // decremented on conversion — the reserved capacity is consumed by
   // the order, not freed.
+  //
+  // Returns `{ won: <bool>, orderId }`. `won` is false when the
+  // conditional claim lost the race (the row was already flipped out
+  // of 'active' by a concurrent converter) — the caller skips the
+  // exactly-once side-effect for that row.
+  //
+  // Concurrency: the status flip is the atomic claim and runs FIRST,
+  // gated by `AND status = 'active'`, so two concurrent converters
+  // can't both mint an order for the same reservation. SQLite
+  // serialises writers, so exactly one UPDATE matches; the loser sees
+  // rowCount 0 and bails without calling `createFromCart`. When the
+  // order side-effect throws after the claim, the claim is reverted
+  // (self-targeting `WHERE id=? AND status='converted'`) so the row
+  // isn't stranded in 'converted' with no backing order.
   async function _convertOne(reservation, campaign, ts) {
+    var claim = await query(
+      "UPDATE preorder_reservations SET status = 'converted', converted_at = ?1 " +
+      "WHERE id = ?2 AND status = 'active'",
+      [ts, reservation.id],
+    );
+    if (Number(claim.rowCount || 0) !== 1) {
+      // Lost the race — a concurrent converter already claimed this
+      // reservation. Skip the side-effect; the winner mints the order.
+      return { won: false, orderId: null };
+    }
     var convertedOrderId = null;
     if (orderHandle) {
-      var orderResult = await orderHandle.createFromCart({
-        customer_id: reservation.customer_id,
-        lines: [{
-          sku:             campaign.sku,
-          variant_id:      campaign.variant_id,
-          quantity:        reservation.quantity,
-          unit_price_minor: campaign.full_price_minor,
-          currency:        campaign.currency,
-        }],
-        preorder_reservation_id: reservation.id,
-        preorder_campaign_slug:  campaign.slug,
-      });
+      var orderResult;
+      try {
+        orderResult = await orderHandle.createFromCart({
+          customer_id: reservation.customer_id,
+          lines: [{
+            sku:             campaign.sku,
+            variant_id:      campaign.variant_id,
+            quantity:        reservation.quantity,
+            unit_price_minor: campaign.full_price_minor,
+            currency:        campaign.currency,
+          }],
+          preorder_reservation_id: reservation.id,
+          preorder_campaign_slug:  campaign.slug,
+        });
+      } catch (e) {
+        // The order create failed after we claimed the row — revert
+        // the claim so the reservation returns to 'active' and a retry
+        // (or the next launch sweep) can convert it cleanly.
+        await query(
+          "UPDATE preorder_reservations SET status = 'active', converted_at = NULL " +
+          "WHERE id = ?1 AND status = 'converted'",
+          [reservation.id],
+        );
+        throw e;
+      }
       convertedOrderId = orderResult && orderResult.id ? orderResult.id : null;
     }
+    // Backfill the order id onto the already-claimed row.
     await query(
-      "UPDATE preorder_reservations SET status = 'converted', converted_at = ?1, " +
-      "converted_order_id = ?2 WHERE id = ?3 AND status = 'active'",
-      [ts, convertedOrderId, reservation.id],
+      "UPDATE preorder_reservations SET converted_order_id = ?1 " +
+      "WHERE id = ?2 AND status = 'converted'",
+      [convertedOrderId, reservation.id],
     );
-    return convertedOrderId;
+    return { won: true, orderId: convertedOrderId };
   }
 
   return {
@@ -369,6 +407,15 @@ function create(opts) {
         throw new TypeError("preorder.reserve: campaign is " + campaign.status +
           ", only active campaigns accept reservations");
       }
+      // The JS cap pre-check below stays for a precise, friendly error
+      // message on the common (uncontended) path — but it is NOT the
+      // guard. Two concurrent reserves could both pass this read-time
+      // check against the same `units_reserved` and both insert,
+      // overshooting `max_units_available` (oversell). The ATOMIC guard
+      // is the conditional increment further down: the cap is folded
+      // into the UPDATE's WHERE so the increment only applies when it
+      // stays within the cap, and SQLite serialises the two writers so
+      // exactly one wins.
       if (campaign.max_units_available !== null && campaign.max_units_available !== undefined) {
         if (campaign.units_reserved + input.quantity > campaign.max_units_available) {
           throw new TypeError("preorder.reserve: would exceed max_units_available " +
@@ -378,23 +425,46 @@ function create(opts) {
       }
 
       var ts = _now();
+      // Claim capacity FIRST via a conditional increment that gates on
+      // the cap inside its own WHERE. rowCount 0 means the cap would be
+      // exceeded (or the campaign vanished) — refuse before writing any
+      // reservation row, so the counter never overshoots the cap under
+      // concurrency.
+      var claim = await query(
+        "UPDATE preorder_campaigns SET units_reserved = units_reserved + ?1, updated_at = ?2 " +
+        "WHERE slug = ?3 AND status = 'active' " +
+        "AND (max_units_available IS NULL OR units_reserved + ?1 <= max_units_available)",
+        [input.quantity, ts, input.campaign_slug],
+      );
+      if (Number(claim.rowCount || 0) !== 1) {
+        throw new TypeError("preorder.reserve: would exceed max_units_available " +
+          "(cap=" + campaign.max_units_available + ", reserved=" + campaign.units_reserved +
+          ", requested=" + input.quantity + ")");
+      }
       // Pass the monotonic ts into uuid.v7 so the 48-bit timestamp
       // prefix is strictly increasing across consecutive reservations
       // — the (id) keyset cursor used by reservationsForCustomer is
       // monotonic without depending on Date.now() ticking between
       // calls.
       var id = b.uuid.v7({ now: ts });
-      await query(
-        "INSERT INTO preorder_reservations (id, campaign_slug, customer_id, quantity, " +
-        "payment_intent_id, status, reservation_at) " +
-        "VALUES (?1, ?2, ?3, ?4, ?5, 'active', ?6)",
-        [id, input.campaign_slug, input.customer_id, input.quantity, paymentIntentId, ts],
-      );
-      await query(
-        "UPDATE preorder_campaigns SET units_reserved = units_reserved + ?1, updated_at = ?2 " +
-        "WHERE slug = ?3",
-        [input.quantity, ts, input.campaign_slug],
-      );
+      try {
+        await query(
+          "INSERT INTO preorder_reservations (id, campaign_slug, customer_id, quantity, " +
+          "payment_intent_id, status, reservation_at) " +
+          "VALUES (?1, ?2, ?3, ?4, ?5, 'active', ?6)",
+          [id, input.campaign_slug, input.customer_id, input.quantity, paymentIntentId, ts],
+        );
+      } catch (e) {
+        // The reservation insert failed after we claimed capacity —
+        // compensate by releasing the units we reserved so the counter
+        // doesn't strand capacity the customer never got.
+        await query(
+          "UPDATE preorder_campaigns SET units_reserved = MAX(0, units_reserved - ?1), " +
+          "updated_at = ?2 WHERE slug = ?3",
+          [input.quantity, _now(), input.campaign_slug],
+        );
+        throw e;
+      }
       return await _getReservation(id);
     },
 
@@ -447,11 +517,24 @@ function create(opts) {
           ", only active reservations can be cancelled");
       }
       var ts = _now();
-      await query(
+      // Claim the cancel atomically, gated on `status = 'active'`. The
+      // JS check above is advisory; this conditional UPDATE is the
+      // guard. Two concurrent cancels of the same reservation would
+      // otherwise both pass the JS check and both decrement the
+      // counter — double-freeing capacity. SQLite serialises writers,
+      // so exactly one UPDATE matches; the loser sees rowCount 0 and
+      // refuses WITHOUT decrementing, so the counter stays correct.
+      var claim = await query(
         "UPDATE preorder_reservations SET status = 'cancelled', cancelled_at = ?1, " +
-        "cancel_reason = ?2 WHERE id = ?3",
+        "cancel_reason = ?2 WHERE id = ?3 AND status = 'active'",
         [ts, reason, reservation.id],
       );
+      if (Number(claim.rowCount || 0) !== 1) {
+        throw new TypeError("preorder.cancelReservation: reservation " +
+          JSON.stringify(reservation.id) + " was already cancelled or converted concurrently");
+      }
+      // Only the winner of the claim frees capacity. MAX(0, …) clamps
+      // the counter against out-of-band corruption.
       await query(
         "UPDATE preorder_campaigns SET units_reserved = MAX(0, units_reserved - ?1), " +
         "updated_at = ?2 WHERE slug = ?3",
@@ -484,10 +567,18 @@ function create(opts) {
           JSON.stringify(reservation.campaign_slug) + " not found");
       }
       var ts = _now();
-      var orderId = await _convertOne(reservation, campaign, ts);
+      // `_convertOne` does the atomic claim internally. If a concurrent
+      // converter beat us to this reservation we lose the race and
+      // refuse — the JS `status === "active"` check above is advisory;
+      // the conditional UPDATE is the real guard.
+      var outcome = await _convertOne(reservation, campaign, ts);
+      if (!outcome.won) {
+        throw new TypeError("preorder.convertReservationToOrder: reservation " +
+          JSON.stringify(reservation.id) + " was already converted concurrently");
+      }
       return {
         reservation_id:     reservation.id,
-        converted_order_id: orderId,
+        converted_order_id: outcome.orderId,
         status:             "converted",
       };
     },
@@ -516,22 +607,54 @@ function create(opts) {
         throw new TypeError("preorder.launchCampaign: now (" + input.now +
           ") is before launch_at (" + campaign.launch_at + ")");
       }
+      var ts = _now();
+      // Claim the campaign FIRST, gated on `status = 'active'`. The JS
+      // status check above is advisory; this conditional UPDATE is the
+      // atomic guard. SQLite serialises writers, so exactly one of two
+      // concurrent launches matches — the loser sees rowCount 0 and
+      // refuses, so the reservation-conversion sweep below runs at most
+      // once for the campaign. (Each individual reservation is ALSO
+      // claim-guarded inside `_convertOne`, so even a torn interleave
+      // can't double-mint an order.)
+      var claim = await query(
+        "UPDATE preorder_campaigns SET status = 'launched', launched_at = ?1, updated_at = ?1 " +
+        "WHERE slug = ?2 AND status = 'active'",
+        [ts, input.slug],
+      );
+      if (Number(claim.rowCount || 0) !== 1) {
+        throw new TypeError("preorder.launchCampaign: campaign " +
+          JSON.stringify(input.slug) + " was already launched concurrently");
+      }
       var activeRows = (await query(
         "SELECT * FROM preorder_reservations WHERE campaign_slug = ?1 AND status = 'active' " +
         "ORDER BY id ASC",
         [input.slug],
       )).rows;
-      var ts = _now();
       var converted = [];
-      for (var i = 0; i < activeRows.length; i += 1) {
-        var orderId = await _convertOne(activeRows[i], campaign, ts);
-        converted.push({ reservation_id: activeRows[i].id, converted_order_id: orderId });
+      try {
+        for (var i = 0; i < activeRows.length; i += 1) {
+          var outcome = await _convertOne(activeRows[i], campaign, ts);
+          // A reservation cancelled/converted out-of-band between the
+          // SELECT and the per-row claim is skipped silently — it's no
+          // longer 'active', so it isn't ours to convert.
+          if (outcome.won) {
+            converted.push({ reservation_id: activeRows[i].id, converted_order_id: outcome.orderId });
+          }
+        }
+      } catch (convErr) {
+        // A conversion threw mid-sweep. Revert the campaign claim back to
+        // 'active' so a retry can re-launch and pick up the reservations
+        // still left active (the ones already converted stay converted —
+        // _convertOne skips non-active rows on the retry). Without this
+        // the campaign is stranded 'launched' and the unconverted
+        // reservations can never be swept into orders.
+        await query(
+          "UPDATE preorder_campaigns SET status = 'active', launched_at = NULL, updated_at = ?1 " +
+          "WHERE slug = ?2 AND status = 'launched'",
+          [_now(), input.slug],
+        );
+        throw convErr;
       }
-      await query(
-        "UPDATE preorder_campaigns SET status = 'launched', launched_at = ?1, updated_at = ?1 " +
-        "WHERE slug = ?2",
-        [ts, input.slug],
-      );
       return {
         slug:              input.slug,
         launched_at:       ts,

package/lib/print-queue.js

@@ -437,12 +437,28 @@ function create(opts) {
           JSON.stringify(input.station_id));
       }
       var ts = _now();
-      await query(
+      // The in_progress -> failed transition IS the atomic claim: gate
+      // it on `status = 'in_progress'` in the WHERE so two concurrent
+      // markFailed callers (e.g. an operator retry plus an automated
+      // jam-detector) can't both win the JS check above and both fire
+      // the retry INSERT below. SQLite serializes writers, so exactly
+      // one UPDATE flips the row; the loser sees rowCount === 0 and
+      // returns the already-failed state WITHOUT re-requeueing —
+      // otherwise a single failure could mint two duplicate queued
+      // jobs (double-print).
+      var upd = await query(
         "UPDATE print_jobs SET status = 'failed', failed_at = ?1, fail_reason = ?2 " +
-        "WHERE id = ?3",
+        "WHERE id = ?3 AND status = 'in_progress'",
         [ts, reason, jobId],
       );
       var failed = await _getRow(jobId);
+      if (Number(upd.rowCount || 0) !== 1) {
+        // Another caller already transitioned this job out of
+        // in_progress. Return its current state; do not re-insert a
+        // retry row (that's the exactly-once side-effect we're
+        // protecting).
+        return { failed: failed };
+      }
       var out = { failed: failed };
 
       if (retry) {

package/lib/purchase-orders.js

@@ -599,17 +599,103 @@ function create(opts) {
         }
       }
 
-      // Compose inventoryReceive.draft + apply BEFORE advancing the
-      // PO counters. If the catalog refuses (unknown SKU, decimal
-      // qty, etc.) the PO state stays consistent with the catalog —
-      // a half-applied receipt across two writeable surfaces is the
-      // worst-case for reconciliation. The receipt primitive's draft
-      // step requires a unique `reference`; when the caller didn't
-      // supply one, derive a deterministic-per-call value from the
-      // PO id + occurrence timestamp so two recordPartialReceipt
-      // calls on the same PO produce distinct receipt rows.
-      var ts = _now();
+      var ts          = _now();
+      var priorStatus = current.status;
+
+      // Claim the receipt atomically by advancing the per-line
+      // counters BEFORE composing the inventoryReceive restock — the
+      // line counter is the true exactly-once gate here. A PO-level
+      // status claim can't serialize two concurrent receipts on its
+      // own: 'partially_received' is both a legal source AND a legal
+      // destination (a partial receipt that leaves the PO still
+      // partial is a status self-loop), so a status-only WHERE matches
+      // for both racers. Instead each line increment is guarded by the
+      // exact prior quantity the caller observed AND the ordered cap:
+      //   SET quantity_received = quantity_received + addQ
+      //   WHERE id = lineId
+      //     AND quantity_received = observedPrior   -- optimistic CAS
+      //     AND quantity_received + addQ <= quantity_ordered  -- cap
+      // Two concurrent receipts both observe prior=P; the winner's
+      // increment lands (P -> P+addQ), the loser's `= P` no longer
+      // matches (the row now reads P+addQ) so its rowCount is 0 — it
+      // refuses, and the restock + counter advance run for exactly one
+      // caller. The cap clause also makes over-receipt a hard refusal
+      // at write time, not just at the JS pre-flight above.
+      var claimed = [];
+      for (var c = 0; c < rxSkus.length; c += 1) {
+        var cLine  = skuToLine[rxSkus[c]];
+        var cRxe   = rxMap[rxSkus[c]];
+        var cPrior = Number(cLine.quantity_received || 0);
+        var cAdd   = cRxe.quantity_received;
+        var lineClaim;
+        if (cRxe.unit_cost_minor != null) {
+          lineClaim = await query(
+            "UPDATE purchase_order_lines SET quantity_received = quantity_received + ?1, " +
+            "unit_cost_minor = ?2, updated_at = ?3 " +
+            "WHERE id = ?4 AND quantity_received = ?5 AND quantity_received + ?1 <= quantity_ordered",
+            [cAdd, cRxe.unit_cost_minor, ts, cLine.id, cPrior],
+          );
+        } else {
+          lineClaim = await query(
+            "UPDATE purchase_order_lines SET quantity_received = quantity_received + ?1, " +
+            "updated_at = ?2 " +
+            "WHERE id = ?3 AND quantity_received = ?4 AND quantity_received + ?1 <= quantity_ordered",
+            [cAdd, ts, cLine.id, cPrior],
+          );
+        }
+        if (Number(lineClaim.rowCount || 0) !== 1) {
+          // Lost the race on this line (a concurrent receipt already
+          // advanced it past the value we observed) — roll back the
+          // line claims we already won this call, self-targeting the
+          // exact amount each added so a concurrent winner isn't
+          // clobbered, then refuse. No restock has fired yet.
+          for (var rb = 0; rb < claimed.length; rb += 1) {
+            if (claimed[rb].costChanged) {
+              await query(
+                "UPDATE purchase_order_lines SET quantity_received = quantity_received - ?1, " +
+                "unit_cost_minor = ?2, updated_at = ?3 WHERE id = ?4 AND quantity_received >= ?1",
+                [claimed[rb].add, claimed[rb].priorCost, ts, claimed[rb].id],
+              );
+            } else {
+              await query(
+                "UPDATE purchase_order_lines SET quantity_received = quantity_received - ?1, updated_at = ?2 " +
+                "WHERE id = ?3 AND quantity_received >= ?1",
+                [claimed[rb].add, ts, claimed[rb].id],
+              );
+            }
+          }
+          var lost = new Error("purchase-orders.recordPartialReceipt: refused — PO " +
+            poId + " line for sku " + JSON.stringify(rxSkus[c]) +
+            " changed under us (receipt recorded by a concurrent call)");
+          lost.code = "PO_TRANSITION_REFUSED";
+          throw lost;
+        }
+        claimed.push({
+          id: cLine.id, add: cAdd,
+          // Capture whether this claim overwrote unit_cost_minor and its
+          // prior value, so a rollback can restore the cost — not just
+          // the quantity — when no stock ends up landing.
+          costChanged: cRxe.unit_cost_minor != null,
+          priorCost:   cLine.unit_cost_minor,
+        });
+      }
+
+      // From here the line claims are held. Any throw past this point
+      // must release them (self-targeting subtraction) so the PO isn't
+      // stranded with advanced counters but no restock landed.
       var receiptResult = null;
+      try {
+
+      // Compose inventoryReceive.draft + apply for the winner. If the
+      // catalog refuses (unknown SKU, decimal qty, etc.) the rollback
+      // below releases the line claims so the PO state stays
+      // consistent with the catalog — a half-applied receipt across
+      // two writeable surfaces is the worst-case for reconciliation.
+      // The receipt primitive's draft step requires a unique
+      // `reference`; when the caller didn't supply one, derive a
+      // deterministic-per-call value from the PO id + occurrence
+      // timestamp so two recordPartialReceipt calls on the same PO
+      // produce distinct receipt rows.
       if (receiveHandle) {
         var receiptRef = reference != null
           ? reference
@@ -645,33 +731,18 @@ function create(opts) {
         };
       }
 
-      // Now advance the PO counters. The pre-flight cap above
-      // guarantees no over-receipt; the inventoryReceive composition
-      // (if wired) has already landed without throwing.
-      for (var v = 0; v < rxSkus.length; v += 1) {
-        var line2  = skuToLine[rxSkus[v]];
-        var rxe2   = rxMap[rxSkus[v]];
-        var newQty = Number(line2.quantity_received || 0) + rxe2.quantity_received;
-        if (rxe2.unit_cost_minor != null) {
-          await query(
-            "UPDATE purchase_order_lines SET quantity_received = ?1, " +
-            "unit_cost_minor = ?2, updated_at = ?3 WHERE id = ?4",
-            [newQty, rxe2.unit_cost_minor, ts, line2.id],
-          );
-        } else {
-          await query(
-            "UPDATE purchase_order_lines SET quantity_received = ?1, updated_at = ?2 WHERE id = ?3",
-            [newQty, ts, line2.id],
-          );
-        }
-      }
-
-      // Recompute the PO-level status from the now-current line
-      // state. The status transition only flips forward (no
-      // 'received' -> 'partially_received' regression).
+      // The line counters were already advanced by the claim loop
+      // above (the SET quantity_received = quantity_received + addQ
+      // increment); no further per-line write is needed. Recompute the
+      // PO-level status from the now-current line state and flip it
+      // forward (any-received -> partially_received, every-line-full ->
+      // received). The status read is from the freshest line state so a
+      // concurrent winner that advanced a different line is reflected;
+      // the transition only moves forward (no received -> partial
+      // regression).
       var updatedLines = await _getLinesRaw(poId);
-      var nextStatus   = _statusAfterReceipt(updatedLines, current.status);
-      if (nextStatus !== current.status) {
+      var nextStatus   = _statusAfterReceipt(updatedLines, priorStatus);
+      if (nextStatus !== priorStatus) {
         await query(
           "UPDATE purchase_orders SET status = ?1, updated_at = ?2 WHERE id = ?3",
           [nextStatus, ts, poId],
@@ -683,6 +754,30 @@ function create(opts) {
         );
       }
 
+      } catch (e) {
+        // A step after the line claims threw (catalog refusal). Release
+        // every line claim this call won, self-targeting the exact
+        // amount each added (guarded by `>= add` so a concurrent winner
+        // that advanced the line further isn't clobbered) so the PO
+        // isn't stranded with advanced counters but no restock landed.
+        for (var rk = 0; rk < claimed.length; rk += 1) {
+          if (claimed[rk].costChanged) {
+            await query(
+              "UPDATE purchase_order_lines SET quantity_received = quantity_received - ?1, " +
+              "unit_cost_minor = ?2, updated_at = ?3 WHERE id = ?4 AND quantity_received >= ?1",
+              [claimed[rk].add, claimed[rk].priorCost, ts, claimed[rk].id],
+            );
+          } else {
+            await query(
+              "UPDATE purchase_order_lines SET quantity_received = quantity_received - ?1, updated_at = ?2 " +
+              "WHERE id = ?3 AND quantity_received >= ?1",
+              [claimed[rk].add, ts, claimed[rk].id],
+            );
+          }
+        }
+        throw e;
+      }
+
       var hydrated = await _hydrated(poId);
       hydrated.receipt = receiptResult;
       return hydrated;

package/lib/seller-signup.js

@@ -842,6 +842,29 @@ function create(opts) {
         throw notReady;
       }
 
+      // Atomic claim FIRST: flip in_review -> approved gated on the
+      // status. The JS checks above only refuse a sequential re-approve;
+      // two concurrent approvals would both read 'in_review', both pass,
+      // and both call registerVendor — which mints a fresh vendor row
+      // each time, leaving a DUPLICATE vendor for one application. The
+      // `AND status = 'in_review'` predicate lets exactly one caller win;
+      // the loser is refused before registering anything. vendor_slug is
+      // stamped in a second UPDATE after the (winner-only) registration.
+      var ts = _now();
+      var claim = await query(
+        "UPDATE seller_applications " +
+        "SET status = 'approved', approved_at = ?1, approved_by = ?2, updated_at = ?1 " +
+        "WHERE id = ?3 AND status = 'in_review'",
+        [ts, approvedBy, applicationId],
+      );
+      if (Number(claim.rowCount || 0) !== 1) {
+        var raced = new Error(
+          "seller-signup.approveApplication: refused — application is no longer in_review (concurrent approval)"
+        );
+        raced.code = "APPLICATION_NOT_READY";
+        throw raced;
+      }
+
       // Compose vendors.registerVendor — the operator-facing v1
       // defaults a fresh marketplace seller to bank_transfer payout +
       // 70% commission split; the operator tunes both via
@@ -860,6 +883,17 @@ function create(opts) {
           status:               "active",
         });
       } catch (e) {
+        // Roll the claim back so the application returns to in_review and
+        // can be re-approved — the winning claim must not strand the app
+        // in 'approved' with no vendor behind it.
+        try {
+          await query(
+            "UPDATE seller_applications " +
+            "SET status = 'in_review', approved_at = NULL, approved_by = NULL, updated_at = ?1 " +
+            "WHERE id = ?2 AND status = 'approved'",
+            [_now(), applicationId],
+          );
+        } catch (_e2) { /* drop-silent — the registerVendor error is the caller's signal */ }
         // Surface the vendors error with our typed-code wrapper so
         // operators can distinguish a vendors-layer refusal from an
         // application-layer refusal.
@@ -872,13 +906,10 @@ function create(opts) {
         throw wrapped;
       }
 
-      var ts = _now();
+      // Stamp the registered vendor slug onto the now-approved application.
       await query(
-        "UPDATE seller_applications " +
-        "SET status = 'approved', approved_at = ?1, approved_by = ?2, " +
-        "    vendor_slug = ?3, updated_at = ?1 " +
-        "WHERE id = ?4",
-        [ts, approvedBy, vendor.slug, applicationId],
+        "UPDATE seller_applications SET vendor_slug = ?1, updated_at = ?2 WHERE id = ?3",
+        [vendor.slug, _now(), applicationId],
       );
 
       return {

package/lib/split-shipments.js

@@ -603,26 +603,67 @@ function create(opts) {
       }
 
       var hydrated = _hydratePlan(row);
+      var ts = _now();
+      // Atomic claim BEFORE any shipment is created. The JS status
+      // check above is racy: two concurrent callers both read a
+      // `proposed` row and both fall through to createShipment,
+      // double-creating shipments. The conditional UPDATE is the real
+      // gate — SQLite serializes writers, so exactly one caller flips
+      // proposed → executed and gets rowCount === 1; the loser sees 0
+      // and refuses without touching orderTracking.
+      var claim = await query(
+        "UPDATE split_shipment_plans SET status = 'executed', executed_at = ?1 " +
+        "WHERE id = ?2 AND status = 'proposed'",
+        [ts, input.plan.id],
+      );
+      if (Number(claim.rowCount || 0) !== 1) {
+        // Lost the race (or the row was concurrently cancelled/executed
+        // between the read above and the claim). Re-read so the message
+        // reflects the row's actual current status.
+        var lost = await _getPlanRow(input.plan.id);
+        throw new TypeError("split-shipments.executeSplit: plan " + input.plan.id +
+          " is " + ((lost && lost.status) || "gone") +
+          ", only proposed plans can be executed");
+      }
+
       var shipmentIds = [];
-      for (var i = 0; i < hydrated.shipments.length; i += 1) {
-        var parcel = hydrated.shipments[i];
-        var notes = "split:" + parcel.rationale + " (" + (i + 1) + "/" + hydrated.shipments.length + ")";
-        var createInput = {
-          order_id: input.order_id,
-          carrier:  carrier,
-          notes:    notes,
-        };
-        if (carrier === "other") {
-          createInput.carrier_other_name = carrierOtherName;
+      try {
+        for (var i = 0; i < hydrated.shipments.length; i += 1) {
+          var parcel = hydrated.shipments[i];
+          var notes = "split:" + parcel.rationale + " (" + (i + 1) + "/" + hydrated.shipments.length + ")";
+          var createInput = {
+            order_id: input.order_id,
+            carrier:  carrier,
+            notes:    notes,
+          };
+          if (carrier === "other") {
+            createInput.carrier_other_name = carrierOtherName;
+          }
+          var s = await orderTracking.createShipment(createInput);
+          shipmentIds.push(s.id);
         }
-        var s = await orderTracking.createShipment(createInput);
-        shipmentIds.push(s.id);
+      } catch (e) {
+        // A createShipment throw after the claim would strand the plan
+        // in `executed` with a partial shipment set. Revert the claim
+        // (self-targeting WHERE so it only fires on the row WE claimed)
+        // and rethrow so the operator can retry once the underlying
+        // failure clears. Any shipment rows already written by earlier
+        // parcels are reconciled via the orderTracking primitive's own
+        // per-shipment flow — the plan returns to `proposed`.
+        await query(
+          "UPDATE split_shipment_plans SET status = 'proposed', executed_at = NULL " +
+          "WHERE id = ?1 AND status = 'executed'",
+          [input.plan.id],
+        );
+        throw e;
       }
-      var ts = _now();
+
+      // Second UPDATE persists the shipment-id list now that every
+      // parcel landed. Self-targeting WHERE id keyed off the row we
+      // already claimed — the status gate was the first UPDATE.
       await query(
-        "UPDATE split_shipment_plans SET status = 'executed', executed_shipment_ids_json = ?1, " +
-        "executed_at = ?2 WHERE id = ?3",
-        [JSON.stringify(shipmentIds), ts, input.plan.id],
+        "UPDATE split_shipment_plans SET executed_shipment_ids_json = ?1 WHERE id = ?2",
+        [JSON.stringify(shipmentIds), input.plan.id],
       );
       return _hydratePlan(await _getPlanRow(input.plan.id));
     },