I'm not convinced that this should be a CRITICAL error.  It's only critical once the the transaction executor has finished with retries and failed. Looking at the code of the other crash storage classes and the transaction classes, I find that we're inconsistent. We ought to reconcile the inconsistency.