The limiter itself should be able to ensure consistency via pessimistic row level locking, even at lower isolation levels.

What I don't want is long running unrelated transactions keeping old tuples alive just it case they're needed. My third suggestion where transactions attempting to read old versions fail is probably better than the first two where isolation gets silently downgraded, since it avoid that problem.