make sure tx failure visible to caller