The transaction is the simplest object in the engine. That is by design.

Begin → enqueue (validated) → commit OR rollback OR destructor-rollback. done_ flips exactly once.

From docs/internals/transaction-engine.md: TransactionVault holds a non-owning pointer to its parent Transaction. Validation runs at enqueue time. commit() walks the op list under the database write lock and applies via per-vault place() / erase(). The destructor rolls back if neither commit nor rollback was called.

cpp

class Transaction {
public:
    TransactionVault vault(std::string name);
    void commit();
    void rollback();
    ~Transaction();   // rollback() if !done_
private:
    bool done_{false};
    std::vector<Op> ops_;
};