все оказалось проще чем я думал)) если открыть гайд к друпал коммерц -
Important Note: Beware giving away products for free
If you have business logic that depends on payment being completed, you should add rules to the When an order is first paid in full event instead. It is a common Drupal Commerce configuration mistake to fulfill the order at the point of checkout completion which can lead to giving the product away for free. Malicious users may figure out how to trigger order completion without paying. Instead, assign rules that deliver the product to the event When an order is first paid in full.
Короче нужно в рулсах поменять событие с "окончание" на "полностью оплачен"
