Transaction started in controller/API layer

How to fix

1. Move transaction orchestration into the application service.
2. Keep controllers focused on request/response handling.
3. Test transaction behavior at the service boundary.

What it means

A controller or API route appears to own transaction orchestration.

Why it matters

Transaction policy belongs near application workflows, not HTTP transport concerns.

Common causes

• A controller directly uses the ORM transaction API.
• A route handler grew into an orchestration method.
• Service boundaries were skipped for a mutation.

Example bad pattern

POST /billing/checkout starts prisma.$transaction in the controller method.

Example good pattern

The controller calls BillingService.createCheckoutSession(...), which owns the transaction.

Related files/config

• apps/api/src
• apps/web
• packages

Related CLI commands

• archpilot validate
• archpilot validate --ci