This is a pretty disappointing result.

I've noted TiDB's weak transaction isolation guarantees before, which were not well documented. In particular, they claimed phantom reads were not possible, which this test shows isn't true.

That said, it looks like these issues aren't fundamental design problems and can be fixed.