Where should exceptions be caught in a .NET application, and what is the difference between throw and throw ex when rethrowing?

I keep cancellation distinct from failure: OperationCanceledException tied to the active token is normally allowed to flow to a boundary that understands cancellation rather than being logged as an application error. Wrapping an exception can add domain meaning, but I preserve the original as InnerException and avoid translating so early that useful provider details vanish. Cleanup belongs in using, await using, or finally, not in a catch that only runs for selected failures. In production I define one logging owner per failure path, redact sensitive values, and test status mapping plus stack preservation. Retries happen only around an idempotent operation with classified transient failures, not around an entire request after arbitrary side effects.