conclusions
guarantees expose relationships between subsystems and with trans.
protocols prescribe ok behavior
achieve separation of concerns:
- recovery knows what to ensure, not why
- apps/trans know what to expect, not how
broad applicability: workflows, db, ...