backup: #904 v14 - fan out Redis encoder across all db_<N> directories

## Codex P1 v13: hardcoded db_0 silently dropped non-default Redis DBs

The Redis adapter runner in adapterRunners was hardcoded to
NewRedisEncoder(root, 0). RedisEncoder is scoped to a single
redis/db_<n>/ subdirectory; any Phase 1 multi-DB dump that included
redis/db_3/, redis/db_5/, etc. would silently drop those DBs from
the produced .fsm — a header-only encode for those keys, exactly
the silent-data-loss pattern the encoder is supposed to fail closed
against. With --self-test on, the same valid multi-DB dump would be
rejected at the diff stage (the decoded scratch tree would not match
the input's db_3 content).

Phase 0a/0b inputs only emit redis/db_0/, so this is a latent bug
that fires the moment Phase 1's multi-DB dumper lands; codex flagged
it as P1.

## Fix: enumerate redis/db_<N> directories and fan out per DB

Two new helpers in encode_snapshot.go:

- enumerateRedisDBs(inRoot) returns the sorted dbIndex values for
  which <inRoot>/redis/db_<N>/ exists as a directory. A missing
  redis/ returns nil (no-op, matching the per-DB encoder's
  missing-subdir convention). Non-canonical entries (non-numeric
  suffix, negative, leading-zero like "db_01", wrong prefix,
  regular files at the redis/ level) are silently skipped — they
  cannot be produced by the canonical decoder. A symlinked or
  regular-file redis/ path is rejected with ErrRedisEncodeNotDir
  (mirrors the per-DB encoder's symlink refusal).

- encodeAllRedisDBs(b, inRoot) invokes NewRedisEncoder per
  enumerated index in ascending order, wrapping per-DB errors with
  "redis encoder db_%d" for traceability.

The redis adapter runner now uses encodeAllRedisDBs as its function
value directly (gocritic unlambda).

## Pinned by

- TestEnumerateRedisDBsMissingDir: missing redis/ returns nil indices.
- TestEnumerateRedisDBsMixedEntries: only canonical db_<N> dirs
  kept; non-numeric, negative, leading-zero, empty-suffix, wrong-
  prefix, and regular-file entries are skipped; result sorted
  ascending (asserted via direct index comparison).
- TestEnumerateRedisDBsRedisIsRegularFile: regular file at redis/
  path triggers ErrRedisEncodeNotDir.
- TestEncodeSnapshotRedisMultiDB: a fixture under redis/db_3/ ONLY
  (no db_0) produces strictly more bytes than an empty-redis baseline
  through EncodeSnapshot. Pre-fix, the hardcoded db_0 path would
  have produced an identical header-only .fsm for both inputs.

## Caller audit per CLAUDE.md semantic-change rule

- adapterRunners.redis: closure replaced with encodeAllRedisDBs
  function value (gocritic unlambda). Error contract:
  - errors.Is(err, ErrEncodeAdapterData) — still true (errors.Mark
    in runAdapterEncoders is unchanged).
  - errors.Is(err, ErrRedisEncodeNotDir) etc. — still true
    (errors.Mark + errors.Wrap preserve the inner chain).
  - Error prefix changed from "redis encoder: ..." to
    "redis encoder db_%d: ..." (or "redis encoder enumerate: ..."
    for the enumeration step). More specific, not less.
- NewRedisEncoder direct callers (encode_redis_test.go,
  encode_redis_coll_test.go, encode_redis_hardlink_unix_test.go):
  unaffected — they call NewRedisEncoder directly, never through
  the adapter runner.
- enumerateRedisDBs / parseRedisDBDir / checkRedisRoot / encodeAllRedisDBs
  are new package-private functions; no external callers exist yet.

## Lint compliance

Two cyclop refactor splits required:
- enumerateRedisDBs (initially 12 branches) split into
  checkRedisRoot + parseRedisDBDir helpers. Each is ≤6 branches.
- TestEnumerateRedisDBs (initially 14 branches via t.Run) split
  into three top-level tests. Each is ≤4 branches.

Tests + lint green.

Author: bootjp

internal/backup/encode_snapshot.go

@@ -356,6 +356,106 @@ func encodeBuffered(b *snapshotBuilder, opts EncodeOptions, enabled []string, ou
 	return result, nil
 }
 
+// redisDBDirPrefix is the canonical "db_" prefix produced by the
+// decoder for redis/db_<N>/ directories. Mirrored by encoder
+// enumeration (encodeAllRedisDBs) so a multi-DB dump round-trips.
+const redisDBDirPrefix = "db_"
+
+// enumerateRedisDBs returns the sorted dbIndex values for which
+// <inRoot>/redis/db_<N>/ exists as a directory. A missing redis/
+// directory returns nil; the caller treats it as no-op (same convention
+// as the per-DB encoder, which is a no-op when its db_<n> subdir is
+// absent). Non-db_<N> entries (regular files, symlinks at the redis/
+// level, non-numeric or non-canonical suffixes like "db_-1" or
+// "db_01") are silently skipped — they cannot have been produced by
+// the canonical decoder and are not the encoder's concern.
+//
+// Codex P1 v13 #904: replaces the prior hardcoded NewRedisEncoder(_, 0)
+// in adapterRunners that silently dropped non-default DBs from any
+// future Phase 1 multi-DB dump.
+func enumerateRedisDBs(inRoot string) ([]int, error) {
+	redisDir := filepath.Join(inRoot, "redis")
+	if err := checkRedisRoot(redisDir); err != nil {
+		return nil, err
+	}
+	entries, err := os.ReadDir(redisDir)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, errors.WithStack(err)
+	}
+	var indices []int
+	for _, ent := range entries {
+		if idx, ok := parseRedisDBDir(ent); ok {
+			indices = append(indices, idx)
+		}
+	}
+	sort.Ints(indices)
+	return indices, nil
+}
+
+// checkRedisRoot stats <inRoot>/redis/ and rejects symlink / non-dir
+// shapes. Missing is allowed (caller returns nil indices). Split out
+// of enumerateRedisDBs to keep that function under the cyclop bound.
+func checkRedisRoot(redisDir string) error {
+	info, err := os.Lstat(redisDir)
+	switch {
+	case errors.Is(err, os.ErrNotExist):
+		return nil
+	case err != nil:
+		return errors.WithStack(err)
+	case info.Mode()&os.ModeSymlink != 0:
+		// Symlinked redis/ would let os.OpenRoot in the per-DB encoder
+		// resolve outside the dump tree (mirrors the per-DB encoder's
+		// symlink refusal on redis/db_<n>).
+		return errors.Wrapf(ErrRedisEncodeNotDir, "redis path %q is a symlink", redisDir)
+	case !info.IsDir():
+		return errors.Wrapf(ErrRedisEncodeNotDir, "redis path %q is not a directory", redisDir)
+	}
+	return nil
+}
+
+// parseRedisDBDir returns (dbIndex, true) when ent names a canonical
+// db_<N> directory (N is a non-negative decimal with no leading zeros).
+// Non-matching entries return (0, false) so the caller can skip without
+// erroring — they cannot have been produced by the canonical decoder.
+// Reject non-canonical decimals so a hypothetical Phase 1 dumper cannot
+// double-emit the same db under two distinct directory names.
+func parseRedisDBDir(ent os.DirEntry) (int, bool) {
+	if !ent.IsDir() {
+		return 0, false
+	}
+	name := ent.Name()
+	if !strings.HasPrefix(name, redisDBDirPrefix) {
+		return 0, false
+	}
+	suffix := name[len(redisDBDirPrefix):]
+	idx, err := strconv.Atoi(suffix)
+	if err != nil || idx < 0 || strconv.Itoa(idx) != suffix {
+		return 0, false
+	}
+	return idx, true
+}
+
+// encodeAllRedisDBs invokes NewRedisEncoder per discovered db_<N>
+// directory in ascending index order. A missing redis/ directory is a
+// no-op. Codex P1 v13 #904: replaces the prior hardcoded db_0 fan-out
+// which would silently drop non-default DBs from any Phase 1 multi-DB
+// dump. Per-DB errors are wrapped with the db index for traceability.
+func encodeAllRedisDBs(b *snapshotBuilder, inRoot string) error {
+	indices, err := enumerateRedisDBs(inRoot)
+	if err != nil {
+		return errors.Wrap(err, "redis encoder enumerate")
+	}
+	for _, idx := range indices {
+		if err := NewRedisEncoder(inRoot, idx).Encode(b); err != nil {
+			return errors.Wrapf(err, "redis encoder db_%d", idx)
+		}
+	}
+	return nil
+}
+
 // adapterRunner pairs an enabled-check with an Encode call, keeping
 // runAdapterEncoders's per-iteration body to two branches (cyclop).
 type adapterRunner struct {
@@ -366,9 +466,7 @@ type adapterRunner struct {
 
 func adapterRunners() []adapterRunner {
 	return []adapterRunner{
-		{"redis", func(s AdapterSet) bool { return s.Redis }, func(b *snapshotBuilder, root string) error {
-			return errors.Wrap(NewRedisEncoder(root, 0).Encode(b), "redis encoder")
-		}},
+		{"redis", func(s AdapterSet) bool { return s.Redis }, encodeAllRedisDBs},
 		{"dynamodb", func(s AdapterSet) bool { return s.DynamoDB }, func(b *snapshotBuilder, root string) error {
 			return errors.Wrap(NewDynamoDBEncoder(root).Encode(b), "dynamodb encoder")
 		}},

internal/backup/encode_snapshot_test.go

@@ -388,6 +388,125 @@ func TestEncodeSnapshotRejectsZeroAdapterSet(t *testing.T) {
 	}
 }
 
+// TestEnumerateRedisDBsMissingDir pins codex P1 v13 #904: a missing
+// redis/ directory returns nil indices (no-op), matching the per-DB
+// encoder's "missing db_<n> = nothing to encode" convention.
+func TestEnumerateRedisDBsMissingDir(t *testing.T) {
+	t.Parallel()
+	indices, err := enumerateRedisDBs(t.TempDir())
+	if err != nil {
+		t.Fatalf("err = %v, want nil", err)
+	}
+	if indices != nil {
+		t.Errorf("indices = %v, want nil for missing redis/", indices)
+	}
+}
+
+// TestEnumerateRedisDBsMixedEntries pins codex P1 v13 #904: only
+// canonical db_<N> entries are kept; non-numeric, negative, leading-
+// zero, empty-suffix, wrong-prefix, and non-directory entries are
+// silently skipped. The returned slice is sorted ascending.
+func TestEnumerateRedisDBsMixedEntries(t *testing.T) {
+	t.Parallel()
+	in := t.TempDir()
+	for _, name := range []string{"db_0", "db_1", "db_5"} {
+		if err := os.MkdirAll(filepath.Join(in, "redis", name), 0o755); err != nil {
+			t.Fatalf("MkdirAll %s: %v", name, err)
+		}
+	}
+	// Entries that MUST be skipped:
+	//   db_garbage  — non-numeric suffix
+	//   db_-1       — negative
+	//   db_01       — non-canonical leading zero
+	//   db_         — empty suffix
+	//   notdb_2     — wrong prefix
+	for _, name := range []string{"db_garbage", "db_-1", "db_01", "db_", "notdb_2"} {
+		if err := os.MkdirAll(filepath.Join(in, "redis", name), 0o755); err != nil {
+			t.Fatalf("MkdirAll %s: %v", name, err)
+		}
+	}
+	// A regular file under redis/ must be skipped (not enumerable).
+	if err := os.WriteFile(filepath.Join(in, "redis", "README"), []byte("x"), 0o600); err != nil {
+		t.Fatalf("WriteFile README: %v", err)
+	}
+	indices, err := enumerateRedisDBs(in)
+	if err != nil {
+		t.Fatalf("enumerateRedisDBs: %v", err)
+	}
+	want := []int{0, 1, 5}
+	if len(indices) != len(want) {
+		t.Fatalf("indices = %v, want %v", indices, want)
+	}
+	for i, v := range want {
+		if indices[i] != v {
+			t.Errorf("indices[%d] = %d, want %d", i, indices[i], v)
+		}
+	}
+}
+
+// TestEnumerateRedisDBsRedisIsRegularFile pins fail-closed when the
+// "redis" path inside the dump is a regular file rather than a
+// directory — distinct from the missing case.
+func TestEnumerateRedisDBsRedisIsRegularFile(t *testing.T) {
+	t.Parallel()
+	in := t.TempDir()
+	if err := os.WriteFile(filepath.Join(in, "redis"), []byte("not a dir"), 0o600); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+	_, err := enumerateRedisDBs(in)
+	if !errors.Is(err, ErrRedisEncodeNotDir) {
+		t.Errorf("err = %v, want errors.Is ErrRedisEncodeNotDir", err)
+	}
+}
+
+// TestEncodeSnapshotRedisMultiDB pins codex P1 v13 #904: the Redis
+// fan-out in adapterRunners enumerates redis/db_<N>/ and invokes the
+// per-DB encoder for each. The fixture places a single string under
+// redis/db_3/ ONLY (no db_0). Pre-fix, the encoder hardcoded
+// NewRedisEncoder(root, 0) and produced a header-only .fsm for this
+// input — silent data loss. Post-fix, the db_3 string is included.
+//
+// Assertion is content-free: compare encoded byte count against an
+// empty-redis baseline. With multi-DB fan-out, the db_3 fixture
+// produces MORE bytes than an empty tree. Without it, both encodes
+// would produce identical header-only output.
+func TestEncodeSnapshotRedisMultiDB(t *testing.T) {
+	t.Parallel()
+	emptyIn := t.TempDir()
+	var emptyBuf bytes.Buffer
+	emptyResult, err := EncodeSnapshot(EncodeOptions{
+		InputRoot:    emptyIn,
+		Adapters:     AdapterSet{Redis: true},
+		LastCommitTS: 1,
+	}, &emptyBuf)
+	if err != nil {
+		t.Fatalf("EncodeSnapshot empty: %v", err)
+	}
+
+	in := t.TempDir()
+	encKey := EncodeSegment([]byte("k3"))
+	db3Strings := filepath.Join(in, "redis", "db_3", "strings")
+	if err := os.MkdirAll(db3Strings, 0o755); err != nil {
+		t.Fatalf("MkdirAll db_3/strings: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(db3Strings, encKey+".bin"), []byte("v3"), 0o600); err != nil {
+		t.Fatalf("WriteFile db_3 string: %v", err)
+	}
+	var buf bytes.Buffer
+	result, err := EncodeSnapshot(EncodeOptions{
+		InputRoot:    in,
+		Adapters:     AdapterSet{Redis: true},
+		LastCommitTS: 1,
+	}, &buf)
+	if err != nil {
+		t.Fatalf("EncodeSnapshot db_3-only: %v", err)
+	}
+	if result.BytesWritten <= emptyResult.BytesWritten {
+		t.Errorf("BytesWritten with redis/db_3 fixture (%d) <= empty (%d); pre-fix, hardcoded db_0 fan-out dropped db_3 silently",
+			result.BytesWritten, emptyResult.BytesWritten)
+	}
+}
+
 // TestEncodeSnapshotMarksAdapterDataErrors pins codex P2 v9 #904: when
 // an adapter encoder rejects the input tree's contents (e.g. a
 // malformed DynamoDB _schema.json), EncodeSnapshot must surface the