Add KV unit test reproducing stale pending tx (#8293)

[Amaury Chamayou (achamayou)]

Reject stale-view transactions in Store::commit() regardless of node role, under the existing version lock and before updating last_committable or inserting into pending_txs. This prevents rolled-back writes from being replicated after a later election and blocking subsequent replication.

Closes #8293.

• Keep a deterministic KV regression covering primary, backup and candidate roles, with and without sequence-number reuse after rollback. Check stale-write rejection, absence of rolled-back data and continued replication using entry counts.
• Leave rollback and follower replay unchanged, with no new locks or allocations on the normal commit path.
• Add the fix to the 7.0.15 release notes and align the Python package version.

Validation: kv_test and history_test pass via tests.sh; all 14 scripts/ci-checks.sh -f groups pass (WSL, Clang 21.1.8, Debug, USE_SNMALLOC=OFF).

[Copilot]

🟡 Changes recommended

A couple of the new test’s messages/assertions are misleading/ambiguous in ways that reduce the test’s value as a clear reproduction and future regression indicator.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new KV-only unit test in kv_test to deterministically reproduce issue #8293 (stale pending transactions surviving a rollback/election boundary and being replicated in a later term), using StubConsensus state transitions and a write-set observer to trigger the view change mid-commit.

Changes:

• Add a new test case covering the “version allocated before view change, Store::commit() reached after view change” interleaving.
• Assert today’s observed (buggy) outcomes to document the failure mode and make future fixes explicitly update expectations.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

File summaries

File	Description
src/kv/test/kv_test.cpp	Adds a new KV unit test that reproduces #8293 by simulating rollback/election ordering and observing stale pending-tx replication effects.

Review details

Suppressed comments (1)

src/kv/test/kv_test.cpp:3167

• The final assertion only checks replicated_to() == 4, which is already true immediately before this write in the buggy path. Capturing the pre-write value and asserting it does not change makes it explicit that this commit was not handed to consensus (and makes the intent of the comment unambiguous).

    REQUIRE(write("lost", "4") == ccf::kv::CommitResult::SUCCESS);
    CHECK(read("lost") == "4");

    // BUG (#8293): reported as committed, but never handed to consensus
    CHECK(replicated_to() == 4);

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.