Defer recovery restart until commit

Request host restart from post-commit hooks instead of from the JOINING transaction. Preserve trace-event-before-restart ordering in trace-enabled builds.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 46d56f8a-935f-4551-abe3-84bd4f951865

Author: achamayou

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [7.0.14]
+
+[7.0.14]: https://github.com/microsoft/CCF/releases/tag/ccf-7.0.14
+
+### Fixed
+
+- Recovery-decision-protocol nodes now request host restart only after the `JOINING` state transaction commits, preventing restart for an aborted transaction. (#8241)
+
 ## [7.0.13]
 
 [7.0.13]: https://github.com/microsoft/CCF/releases/tag/ccf-7.0.13

python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ccf"
-version = "7.0.13"
+version = "7.0.14"
 authors = [
   { name="CCF Team", email="CCF-Sec@microsoft.com" },
 ]

src/node/recovery_decision_protocol.cpp

@@ -64,6 +64,11 @@ namespace ccf
     node_state(node_state_)
   {}
 
+  void RecoveryDecisionProtocolSubsystem::restart_after_commit()
+  {
+    RINGBUFFER_WRITE_MESSAGE(AdminMessage::restart, node_state->to_host);
+  }
+
 #ifdef CCF_RECOVERY_TRACE
   void RecoveryDecisionProtocolSubsystem::initialise_trace(ccf::kv::Tx& tx)
   {
@@ -106,8 +111,7 @@ namespace ccf
               emit_trace_event(event.value());
               if (event->kind == "join_restart")
               {
-                RINGBUFFER_WRITE_MESSAGE(
-                  AdminMessage::restart, node_state->to_host);
+                restart_after_commit();
               }
             }
           }
@@ -375,6 +379,16 @@ namespace ccf
             start_message_retry_timers();
             start_failover_timers();
           }
+          else if (
+            w.has_value() &&
+            w.value() == recovery_decision_protocol::StateMachine::JOINING)
+          {
+#ifndef CCF_RECOVERY_TRACE
+            restart_after_commit();
+#else
+        // The trace-event commit hook emits join_restart before restarting.
+#endif
+          }
         }));
   }
 
@@ -530,10 +544,6 @@ namespace ccf
         auto service_cert =
           ccf::crypto::cert_der_to_pem(node_config->service_cert_der);
         LOG_INFO_FMT("{}", service_cert.str());
-
-#ifndef CCF_RECOVERY_TRACE
-        RINGBUFFER_WRITE_MESSAGE(AdminMessage::restart, node_state->to_host);
-#endif
       }
       case recovery_decision_protocol::StateMachine::OPENING:
       {

src/node/recovery_decision_protocol.h

@@ -106,6 +106,7 @@ namespace ccf
 
     // Stop periodic tasks
     void stop_timers();
+    void restart_after_commit();
 
     // Steady state operations
     recovery_decision_protocol::RequestNodeInfo& get_node_info(