A transaction spanning three services does not exist, and the pattern that replaces it is a sequence of local transactions each with an operation that undoes it.
reserve stock → compensate: release stock
charge the card → compensate: refund
create the shipment → compensate: cancel it
if step 3 fails, run the compensations for 2 and 1, in reverse.
the part nobody mentions: a compensation can fail too, and
there is no compensation for that. it goes to a human.Compensations are not rollbacks — the intermediate state was visible to everybody, so a refund is a new fact rather than an undo, and the customer sees both. That visibility is the actual cost and it is a business decision rather than a technical one. Anything that cannot be compensated, such as an email that has been sent, has to be ordered last in the sequence, which is a design constraint on the whole flow.