I'm working on a project that is based on modules and plug-ins. Any of these modules might alter some part of a database in various ways. One module might write or edit one table, while another module might write or edit other tables.

The modules all communicate via events raised on a common object. Therefore, when a person using module A enters a certain change that would edit data managed by module A, the module raises a Proposed Edit event such that all other modules that might be affected by the edit will have a chance to accept or reject the edit. If no module rejects the edit, then module A makes its changes and raises an Edit event, at which time all the other modules make any changes they need to make.

That's the basic pattern, but there's a problem. If I don't share a transaction during the edit, then module A can successfully edit their tables, but module B might fail to edit their table. In some cases, the failure by B should rollback the changes made by A. Therefore, it would make sense for module A to share an open transaction for all the other modules to use while making their changes, and this gets either committed or rolled back, depending on whether everyone was successful, or not.

The problem with that design is that a person could write a new module C that had a bug which caused it to fail to update correctly. That would cause it to signal that the transaction failed, such that all the other modules, which had been working up to that point, would no longer work because this new module kept canceling the transactions. In other words, the modularity of the program has now been lost. Every module depends entirely on every other module that even cares about its data.

In most cases, what would be lost if certain modules failed would be minor, whereas what would be lost if other modules failed would be catastrophic, as there would be no way to re-create the lost data with any kind of ease.

As long as this explanation is, it may not be sufficient. At least it might start a discussion. Do the actions of all the modules act in the same transaction, or should they be left to succeed or fail on their own?