We may currently have undefined behavior in the case that the write to the underlying bucket document fails. Currently we handle the update-a-missing-document case by simply clearing the bucket from the BucketCatalog and aborting any pending writes to that bucket. But any other error case seems to be ignored, and the bucket is left with some (likely invalid) state and it's allowed to be used for future measurement insertions. We may need to either clear the bucket in this case as well or think rather carefully about the bucket state (stats, and especially min/max) and how to manage it. At the very least, we need to test such cases, and possibly fix them.