Where should extension business logic live?

I use controllers for request validation and response selection, then call an application service for the use case. The service owns transactions and collaboration between repositories or integrations.

Models can still shape list and form data, but cross-cutting work such as notifications, storage, and billing is easier to test behind explicit services.

The useful test is whether the same operation can be called from a web controller, CLI command, and scheduled task without copying its rules.