fix(omdb): bulk-create fallback defers commit/rollback to a caller-managed transaction

createObjectsBatchFallback unconditionally committed on success and rolled
back on failure. When the connection arrived already non-autocommit — reachable
when an inTransaction(...) lambda (which sets autoCommit=false) calls
createObjectsBulk and the driver has no native bulk support — this prematurely
committed the OUTER transaction on success and double-rolled-back on failure.

Gate the commit and rollback on originalAutoCommit (the flag already captured):
manage the transaction boundary only when THIS method opened it. When the
caller owns the transaction, issue no commit and no rollback here and let
exceptions propagate, mirroring single createObject. The autoCommit restore in
finally was already gated.

Tests (embedded Derby): a bulk insert inside an inTransaction lambda whose
later statement fails must NOT survive the outer rollback; and a successful
fallback under a caller-managed (autoCommit=false) connection must not commit
on its own (the owner's rollback removes the rows). Both fail before the gating
fix (rows survive) and pass after.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dmealing

server/java/omdb/src/main/java/com/metaobjects/manager/db/ObjectManagerDB.java

@@ -1251,8 +1251,16 @@ public void updateObjectsBulk(ObjectConnection c, MetaObject mc, Collection<Obje
      *
      * <p>The per-1000-row mid-commit of the prior implementation was removed:
      * intermediate commits made earlier chunks unrecoverable on a later
-     * failure, defeating atomicity. Auto-commit is disabled for the batch and
-     * restored in {@code finally}.
+     * failure, defeating atomicity.
+     *
+     * <p><strong>Transaction ownership.</strong> Commit / rollback / auto-commit
+     * restore are performed ONLY when this method opened the transaction (the
+     * connection arrived with auto-commit on). When the caller already owns the
+     * transaction — e.g. inside an {@code ObjectManager.inTransaction(...)} lambda
+     * which sets auto-commit off — this method commits nothing, rolls back nothing,
+     * and lets exceptions propagate so the caller's transaction boundary stays
+     * authoritative (no premature commit, no double rollback). This mirrors single
+     * {@link #createObject}, which never manages a commit of its own.
      */
     private void createObjectsBatchFallback(ObjectConnection c, MetaObject mc, ObjectMappingDB mapping, Collection<Object> objects) throws SQLException {
         Connection conn = (Connection) c.getDatastoreConnection();
@@ -1273,13 +1281,24 @@ private void createObjectsBatchFallback(ObjectConnection c, MetaObject mc, Objec
                 postPersistence(c, mc, obj, CREATE);
             }
 
-            conn.commit();
+            // Only commit when THIS method opened the transaction. If the caller
+            // arrived already non-autocommit (e.g. inside an inTransaction lambda),
+            // the boundary is theirs to manage — committing here would prematurely
+            // commit the outer unit of work.
+            if (originalAutoCommit) {
+                conn.commit();
+            }
         } catch (SQLException | RuntimeException e) {
-            // All-or-nothing: undo every row inserted in this batch.
-            try {
-                conn.rollback();
-            } catch (SQLException rollbackEx) {
-                e.addSuppressed(rollbackEx);
+            // All-or-nothing: undo every row inserted in this batch — but only when
+            // we own the transaction. When the caller owns it, let the exception
+            // propagate untouched (the caller rolls back); rolling back here would
+            // double-rollback the outer transaction.
+            if (originalAutoCommit) {
+                try {
+                    conn.rollback();
+                } catch (SQLException rollbackEx) {
+                    e.addSuppressed(rollbackEx);
+                }
             }
             throw e;
         } finally {

server/java/omdb/src/test/java/com/metaobjects/manager/db/BulkCreateFallbackTest.java

@@ -105,6 +105,8 @@ private ValueObject sample(MetaObject mo, String label) {
         vo.setLong("bignum", 1L);
         vo.setBoolean("active", true);
         vo.setDouble("ratio", 1.0d);
+        vo.setFloat("rate", 1.0f);
+        vo.setObject("amount", new java.math.BigDecimal("1.00"));
         vo.setString("label", label);
         vo.setDate("createdAt", new java.util.Date(1_700_000_000_000L));
         return vo;
@@ -146,6 +148,91 @@ public void happyPathBulkCreatePassesLiveConnectionToHooks() throws Exception {
         omdb.postConns.forEach(c -> assertNotNull("postPersistence received a live (non-null) ObjectConnection", c));
     }
 
+    /**
+     * Task 1.6 (remediation) — when the bulk fallback runs inside a
+     * caller-managed transaction (an {@code inTransaction} lambda), it must NOT
+     * commit the outer unit of work. A later failure in the same lambda must
+     * roll back EVERYTHING, including the bulk-inserted rows. If the fallback
+     * prematurely committed, those rows would survive the rollback.
+     */
+    @Test
+    public void bulkInsideInTransactionDefersToCallerOnLaterFailure() throws Exception {
+        MetaObject mo = registry.findMetaObjectByName("codectest::Sample");
+
+        ObjectConnection before = omdb.getConnection();
+        long start;
+        try {
+            start = omdb.getObjects(before, mo,
+                    new com.metaobjects.manager.QueryOptions(
+                            new com.metaobjects.manager.exp.Expression("label", "txn-bulk-", com.metaobjects.manager.exp.Expression.START_WITH))).size();
+        } finally {
+            omdb.releaseConnection(before);
+        }
+
+        try {
+            omdb.inTransaction(c -> {
+                Collection<Object> batch = new ArrayList<>();
+                for (int i = 0; i < 4; i++) batch.add(sample(mo, "txn-bulk-" + i));
+                omdb.createObjectsBulk(c, mo, batch);   // hits the fallback (Derby has no native bulk)
+                // Now fail LATER in the same lambda. If the bulk path committed,
+                // these rows survive; if it correctly deferred, the inTransaction
+                // rollback removes them.
+                throw new IllegalStateException("later work fails");
+            });
+            fail("expected the lambda's later failure to propagate");
+        } catch (IllegalStateException expected) {
+            // good — inTransaction rolled the whole unit back
+        }
+
+        ObjectConnection verify = omdb.getConnection();
+        try {
+            long after = omdb.getObjects(verify, mo,
+                    new com.metaobjects.manager.QueryOptions(
+                            new com.metaobjects.manager.exp.Expression("label", "txn-bulk-", com.metaobjects.manager.exp.Expression.START_WITH))).size();
+            assertEquals("bulk insert inside inTransaction must NOT survive the outer rollback "
+                    + "(the fallback must not prematurely commit a caller-managed transaction)",
+                    start, after);
+        } finally {
+            omdb.releaseConnection(verify);
+        }
+    }
+
+    /**
+     * Task 1.6 (remediation), connection-level corroboration — when the
+     * connection arrives already non-autocommit (caller owns the transaction),
+     * a SUCCESSFUL fallback must NOT commit on its own. We prove "no premature
+     * commit" from the OWNER connection: roll back after a successful fallback;
+     * if the fallback had committed, the rows would survive the rollback. They
+     * must not. (We deliberately avoid a second connection here: embedded Derby
+     * takes a write lock on the uncommitted rows, so a concurrent read on the
+     * same in-memory DB would block on lock timeout rather than see "0 rows".)
+     */
+    @Test
+    public void successfulFallbackDoesNotCommitUnderCallerManagedTransaction() throws Exception {
+        MetaObject mo = registry.findMetaObjectByName("codectest::Sample");
+
+        ObjectConnection oc = omdb.getConnection();
+        try {
+            oc.setAutoCommit(false);   // caller takes ownership of the transaction
+            Collection<Object> batch = new ArrayList<>();
+            for (int i = 0; i < 3; i++) batch.add(sample(mo, "nocommit-" + i));
+            omdb.createObjectsBulk(oc, mo, batch);   // fallback runs successfully but must NOT commit
+
+            // Owner rolls back. If the fallback prematurely committed, these rows
+            // would persist through the rollback; with the fix they vanish.
+            oc.rollback();
+
+            long visible = omdb.getObjects(oc, mo,
+                    new com.metaobjects.manager.QueryOptions(
+                            new com.metaobjects.manager.exp.Expression("label", "nocommit-", com.metaobjects.manager.exp.Expression.START_WITH))).size();
+            assertEquals("a successful fallback must NOT commit when the caller owns the transaction; "
+                    + "the owner's rollback must remove every fallback-inserted row",
+                    0, visible);
+        } finally {
+            omdb.releaseConnection(oc);
+        }
+    }
+
     @Test
     public void midBatchFailureRollsBackEntireBatch() throws Exception {
         MetaObject mo = registry.findMetaObjectByName("codectest::Sample");

server/java/omdb/src/test/resources/meta.codec.json

@@ -50,6 +50,18 @@
                 "@maxLength": 100
               }
             },
+            {
+              "field.float": {
+                "name": "rate",
+                "@column": "rate"
+              }
+            },
+            {
+              "field.decimal": {
+                "name": "amount",
+                "@column": "amount"
+              }
+            },
             {
               "field.date": {
                 "name": "createdAt",