Select one complete object graph.

Make object storage authoritative

A small conditionally replaced HEAD names the visible manifest and transaction boundary. Manifests, commit batches, SST runs, snapshots, and compaction outputs are immutable. Listing supports discovery and garbage collection only; it never establishes visibility or normal recovery.

Memory and local files can accelerate execution. Removing every process-local cache must not remove an acknowledged durable transaction.

Publish only from the state the writer read

A writer first stores one complete immutable commit batch. It then asks object storage to replace the metadata pointer only if the pointer still has the exact generation that the writer read. Confirmation completes the publication result. A changed generation fences the stale writer.

This compare-and-swap step is the conditional HEAD transition in the public contracts. If the provider may have accepted the transition but the response is lost, the outcome remains unknown. Resolution retains the same transaction and batch identity, authenticates the visible graph, and performs no additional publication.

Keep one global commit order

The initial topology has one fenced writer, one database-wide sequence, and one transaction log. A transaction reads from its snapshot plus its own mutations. Snapshot isolation rejects later write conflicts. Serializable mode also records point reads and normalized scan ranges.

Singleton commits and atomic groups use the same publication coordinator. Groups contain two through eight members in the current public policy. Pre-admission failure preserves every transaction; successful admission consumes them as one immutable batch.

Checkpoint without hiding policy

Each column family owns independent physical runs while all families share the global logical sequence. Flush publishes immutable SST runs and a new manifest checkpoint. A later Flush adds suffix-delta runs for affected families.

Compaction replaces an exact caller-selected adjacent or complete run view. Current public operations retain predecessor objects. They do not choose fanout, pruning, deletion, or a garbage-collection schedule.

A family append installs one higher stable ID and exact name over a retained checkpoint. Rename, drop, reorder, and mutation of an existing family remain unavailable.

Recover a complete authenticated view

Open reads HEAD, validates the manifest and persisted limits, authenticates every referenced immutable object, reconstructs checkpoint state, and replays only the later transaction suffix. It installs the candidate only after the complete graph passes validation.

Commit authority can move an already returned unknown receipt across process teardown. The exported envelope contains application keys and values and acts as bearer authority. Its CRC detects accidental corruption, not substitution. The caller must use authenticated, confidential durable storage and bind the blob to the intended higher-level request.

This handoff begins after a commit returned Outcome_Unknown. It does not cover termination inside the commit call or another receipt family.

Keep provider policy outside the database

The Object Storage binding accepts a caller-owned provider backend or authenticated client. The caller supplies the bucket, database prefix, endpoint, region, addressing style, timeout, credentials, and relevant request policy. Those owners must outlive every database that borrows them.

The database creates no bucket, performs no provider cleanup, and chooses no retry or retention policy. Files and supported S3-compatible implementations exercise the same complete database-level workflow.

Use each assurance layer for its question

These layers support the current experimental boundary. They do not establish production readiness, general cloud compatibility, performance, or a refinement proof for the complete implementation.