Treat unknown as a real outcome
Commit can return Outcome_Unknown when object storage may have accepted the metadata update but the response did not arrive. The application must not submit the transaction again under a new ID.
The receipt retains the transaction member, batch, attempted metadata transition, and expected predecessor. That identity is the only authority for later resolution.
Resolve with the original receipt
Call the Commit resolver while the database remains open. Resolution reads authoritative state. Resolution performs no new batch, manifest, or metadata publication.
The result becomes conclusive when recovery observes the attempted transition or a conclusive successor. Otherwise, the result remains unknown and the receipt stays usable.
Export before process teardown
When an unknown result has reached the caller, use Commit_Resolution_Authority_Length to obtain the exact required extent. A zero result means the receipt is not a complete exportable authority.
Call Export_Commit_Resolution_Authority with a caller-owned byte array. Export changes neither the receipt nor object storage. It leaves the destination unchanged on failure.
Import after a fresh open
Reopen the same database from object storage. Then pass the exact stored bytes to Import_Commit_Resolution_Authority.
Import validates the database identity, persisted limits, batch relations, metadata transition, transaction member, sequence, lengths, and checksums. On success, resolve the imported receipt through reads. On failure, the database and destination receipt remain unchanged.
Store the blob as bearer authority
The exported bytes contain application keys and values. Anyone who can replace the blob can substitute resolution authority.
Store it in authenticated, confidential durable storage. Bind it to the intended higher-level request. The envelope CRC detects accidental corruption; it does not authenticate the blob.
Keep the handoff boundary exact
- The handoff starts only after Commit returned Outcome_Unknown to the caller.
- It does not cover process termination inside Commit.
- It does not apply to Create, Add_Column_Family, Flush, or another receipt family.
- It supports singleton Commit and each member receipt from Commit_Group.