Transactions from the Application

Map only the few failures the domain genuinely models, close to the code that knows the rule, and let the rest travel outward with their kind intact to a single handler. Blanket wrapping destroys the retry decision; blanket leaking spreads persistence vocabulary through every layer.

Routing every read-only unit by default maximises offload but makes correctness depend on each marking also being stale-tolerant, which it never meant. Opt-in is safe and under-used; most systems vet a few paths and pin after writes.

When the effect is reconstructible from committed state, cheap to redo, and its temporary absence costs only staleness. Effects that move money, are irreversible, or hold the only copy of something must be recorded inside the transaction instead.

Put versions where concurrent editing is real and where an invariant needs protecting. A version on a parent guards rules spanning its children but makes independent child edits collide; versions only on children collide less and guard nothing across rows.