kvclient: require explicit acknowledgement from client on restart

[ajwerner]

Is your feature request related to a problem? Please describe.

Today, when a transaction hits some restart errors, it increments its epoch and remains open. When that happens a TransactionRetryWithProtoRefreshError makes its way to the client. In various situations we've seen sql code failing to properly propagate the error and update its state machine accordingly (#85677, #84448). In those cases, the transaction in question will silently lose the writes preceding the restart. We've seen other cases where the transaction is aborted internally and needs to be restarted, but methods continue to work.

Describe the solution you'd like

A transaction which has been restarted internally should require an explicit acknowledgement from the client before it becomes usable again. An aborted transaction should return more errors from various methods to prevent misuse.

Jira issue: CRDB-18513

[rafiss]

@nvanbenschoten points out that this is similar (or identical to) #22615, which was resolved in #74563

[ajwerner]

I've been reviewing the information from the one case where I saw the transparent loss of writes and it appears to have been a situation involving LeafTxn objects and distsql. I'll file a separate issue when I figure it out.

[rafiss]

I see a098962 (#74563) relates to LeafTxns - just throwing that out there.