fix(redis): carve standalone SET behind separate sub-gate (codex P1)

PR #943 round-1 codex P1: flipping onePhaseTxnDedup to default-on
exposed a pre-existing semantic divergence on the standalone SET path.
txnContext.applySet (adapter/redis.go:2356) returns WRONGTYPE when the
target key already holds a list/hash/set/zset/stream, while the legacy
setLegacy → executeSet → replaceWithStringTxn path correctly deletes
the collection's logical elements and writes the string. Real Redis
allows SET to overwrite any prior type unconditionally; the default
flip would have silently broken normal overwrite semantics for any
default-configured server.

This commit narrows the default flip — the standalone SET path now
requires *two* gates to route through runTransactionWithDedup:
onePhaseTxnDedup (the umbrella, default on) AND a new
standaloneSetDedup sub-gate (default off, opt-in via
WithStandaloneSetDedup or ELASTICKV_REDIS_ONEPHASE_DEDUP_SET=1). With
the default config, the standalone SET branch falls through to
setLegacy, preserving legacy overwrite semantics. MULTI/EXEC and
list-push paths — the parent design's actual M4-validated workloads —
keep the dedup default-on win unchanged.

Bringing applySet to parity (collection-deletion + string write inside
the dedup txn buffer) is a larger surgery tracked as a follow-up;
until then the sub-gate stays default-off.

Per the CLAUDE.md "add failing test then fix" convention:
- TestRedis_SET_OverwritesList_UnderDefaultGate (new file
  adapter/redis_set_overwrite_default_test.go) seeds RPUSH k x, runs
  SET k v under default config, asserts OK + GET returns v.
  Fails on the pre-fix build (WRONGTYPE), passes on the fixed build.
- Existing TestStandaloneSetDedup_* tests now set standaloneSetDedup:
  true alongside onePhaseTxnDedup: true to keep pinning the dedup-on
  routing they were designed to exercise.

Also addresses gemini medium: "[#937]" broken reference-style link in
the design doc replaced with an inline link.

Verified: go vet ./... clean, go build ./... clean,
golangci-lint run ./adapter/... 0 issues,
TestRedis_SET_OverwritesList_UnderDefaultGate + TestStandaloneSetDedup_*
+ Dedup/OnePhase test family all pass.

Author: bootjp

adapter/redis.go

@@ -251,23 +251,51 @@ type RedisServer struct {
 	// to opt out — kept as a one-env-var operator rollback.
 	onePhaseTxnDedup bool
 
+	// standaloneSetDedup gates whether the *standalone* SET command (not SET
+	// inside MULTI/EXEC) routes through runTransactionWithDedup. Default off
+	// because the dedup path's applySet does not match the legacy
+	// executeSet/replaceWithStringTxn semantics for SET-over-collection: a
+	// `SET k v` after `RPUSH k x` returns WRONGTYPE on the dedup path but
+	// overwrites correctly on the legacy path (PR #943 round-1 codex P1).
+	// Bringing applySet to parity (collection-deletion + string write inside
+	// the dedup txn) is tracked as a follow-up; until that lands, the
+	// standalone SET path stays on the legacy default-on-flip code path
+	// regardless of onePhaseTxnDedup's value. Enable explicitly via
+	// WithStandaloneSetDedup(true) or ELASTICKV_REDIS_ONEPHASE_DEDUP_SET=1
+	// only when applySet's parity is verified for the workload at hand.
+	standaloneSetDedup bool
+
 	route map[string]func(conn redcon.Conn, cmd redcon.Command)
 }
 
 type RedisServerOption func(*RedisServer)
 
 // WithOnePhaseTxnDedup enables (or disables) the option-2 one-phase
-// idempotency dedup on list-push, MULTI/EXEC, and standalone-write retries
+// idempotency dedup on list-push and MULTI/EXEC retries
 // (see RedisServer.onePhaseTxnDedup). On by default since the rollout
 // recorded in docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md;
 // pass false to opt out from code, or set ELASTICKV_REDIS_ONEPHASE_DEDUP=0
 // to opt out from the environment. The constructor option trumps the env var.
+// Standalone SET requires the separate WithStandaloneSetDedup gate; see
+// RedisServer.standaloneSetDedup.
 func WithOnePhaseTxnDedup(enabled bool) RedisServerOption {
 	return func(r *RedisServer) {
 		r.onePhaseTxnDedup = enabled
 	}
 }
 
+// WithStandaloneSetDedup enables the option-2 dedup path on the *standalone*
+// SET command (not SET inside MULTI/EXEC). Off by default because the dedup
+// path's applySet does not yet match the legacy executeSet semantics for
+// SET-over-collection — see RedisServer.standaloneSetDedup. Enable only
+// after verifying applySet parity for the workload (no SET-over-list /
+// SET-over-hash / SET-over-set / SET-over-zset / SET-over-stream issued).
+func WithStandaloneSetDedup(enabled bool) RedisServerOption {
+	return func(r *RedisServer) {
+		r.standaloneSetDedup = enabled
+	}
+}
+
 func WithRedisActiveTimestampTracker(tracker *kv.ActiveTimestampTracker) RedisServerOption {
 	return func(r *RedisServer) {
 		r.readTracker = tracker
@@ -506,10 +534,13 @@ func NewRedisServer(listen net.Listener, redisAddr string, store store.MVCCStore
 		// ELASTICKV_REDIS_ONEPHASE_DEDUP=0 opts out; the WithOnePhaseTxnDedup
 		// constructor option still trumps the env var.
 		onePhaseTxnDedup: os.Getenv("ELASTICKV_REDIS_ONEPHASE_DEDUP") != "0",
-		baseCtx:          baseCtx,
-		baseCancel:       baseCancel,
-		streamWaiters:    newKeyWaiterRegistry(),
-		zsetWaiters:      newKeyWaiterRegistry(),
+		// standaloneSetDedup defaults off; see field comment for the
+		// applySet-vs-executeSet parity gap that gates this separately.
+		standaloneSetDedup: os.Getenv("ELASTICKV_REDIS_ONEPHASE_DEDUP_SET") == "1",
+		baseCtx:            baseCtx,
+		baseCancel:         baseCancel,
+		streamWaiters:      newKeyWaiterRegistry(),
+		zsetWaiters:        newKeyWaiterRegistry(),
 	}
 	r.relay.Bind(r.publishLocal)
 
@@ -1137,7 +1168,13 @@ func (r *RedisServer) set(conn redcon.Conn, cmd redcon.Command) {
 	// SET there is exactly one element with the same redisResult shape as
 	// the standalone reply (resultString OK / resultNil for NX/XX miss /
 	// resultBulk for GET).
-	if r.onePhaseTxnDedup {
+	// Both gates must be on to route standalone SET through the dedup path.
+	// onePhaseTxnDedup covers the MULTI/EXEC and list-push retries that the
+	// parent design's M4 validated; standaloneSetDedup is a separate sub-gate
+	// (default off) because applySet diverges from executeSet on SET-over-
+	// collection — flipping onePhaseTxnDedup default-on without this guard
+	// would change normal Redis overwrite behaviour (PR #943 round-1 codex P1).
+	if r.onePhaseTxnDedup && r.standaloneSetDedup {
 		// Call runTransactionWithDedup directly instead of going through
 		// runTransaction. runTransaction re-checks the same
 		// r.onePhaseTxnDedup gate and routes here anyway; the indirection

adapter/redis_set_dedup_test.go

@@ -28,7 +28,12 @@ func TestStandaloneSetDedup_LandedPriorAttempt_ReturnsOK(t *testing.T) {
 	ctx := context.Background()
 	st := store.NewMVCCStore()
 	coord := newDedupTestCoordinator(st, 1, true) // attempt 1 lands then errors
-	srv := &RedisServer{store: st, coordinator: coord, scriptCache: map[string]string{}, onePhaseTxnDedup: true}
+	// Both gates: onePhaseTxnDedup is the umbrella; standaloneSetDedup is
+	// the per-path sub-gate that opts the *standalone* SET branch into
+	// the dedup routing. The sub-gate defaults off (PR #943 round-1 codex
+	// P1 — applySet diverges from executeSet on SET-over-collection).
+	// Tests that pin the dedup-on routing must explicitly enable both.
+	srv := &RedisServer{store: st, coordinator: coord, scriptCache: map[string]string{}, onePhaseTxnDedup: true, standaloneSetDedup: true}
 
 	conn := &recordingConn{}
 	cmd := redcon.Command{Args: [][]byte{[]byte(cmdSet), []byte("k"), []byte("v1")}}
@@ -61,7 +66,12 @@ func TestStandaloneSetDedup_NXMissReturnsNil(t *testing.T) {
 	require.NoError(t, st.PutAt(ctx, redisStrKey([]byte("k")), encodeRedisStr([]byte("seed"), nil), 5, 0))
 
 	coord := newDedupTestCoordinator(st, 1, true) // attempt 1 lands then errors
-	srv := &RedisServer{store: st, coordinator: coord, scriptCache: map[string]string{}, onePhaseTxnDedup: true}
+	// Both gates: onePhaseTxnDedup is the umbrella; standaloneSetDedup is
+	// the per-path sub-gate that opts the *standalone* SET branch into
+	// the dedup routing. The sub-gate defaults off (PR #943 round-1 codex
+	// P1 — applySet diverges from executeSet on SET-over-collection).
+	// Tests that pin the dedup-on routing must explicitly enable both.
+	srv := &RedisServer{store: st, coordinator: coord, scriptCache: map[string]string{}, onePhaseTxnDedup: true, standaloneSetDedup: true}
 
 	conn := &recordingConn{}
 	// SET k v1 NX -- attempt 1 records resultNil because NX miss.
@@ -99,7 +109,12 @@ func TestStandaloneSetDedup_GETOptionReturnsOldBulk(t *testing.T) {
 	require.NoError(t, st.PutAt(ctx, redisStrKey([]byte("k")), encodeRedisStr([]byte("prior"), nil), 5, 0))
 
 	coord := newDedupTestCoordinator(st, 1, true) // attempt 1 lands then errors
-	srv := &RedisServer{store: st, coordinator: coord, scriptCache: map[string]string{}, onePhaseTxnDedup: true}
+	// Both gates: onePhaseTxnDedup is the umbrella; standaloneSetDedup is
+	// the per-path sub-gate that opts the *standalone* SET branch into
+	// the dedup routing. The sub-gate defaults off (PR #943 round-1 codex
+	// P1 — applySet diverges from executeSet on SET-over-collection).
+	// Tests that pin the dedup-on routing must explicitly enable both.
+	srv := &RedisServer{store: st, coordinator: coord, scriptCache: map[string]string{}, onePhaseTxnDedup: true, standaloneSetDedup: true}
 
 	conn := &recordingConn{}
 	// SET k v1 GET -- attempt 1 records resultBulk("prior").

adapter/redis_set_overwrite_default_test.go

@@ -0,0 +1,54 @@
+package adapter
+
+import (
+	"context"
+	"testing"
+
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedis_SET_OverwritesList_UnderDefaultGate locks in the legacy
+// SET-over-collection overwrite semantics under the new default-on dedup
+// gate landed in PR #943. The dedup path's applySet returns WRONGTYPE on
+// a SET that hits a key already holding a list/hash/set/zset/stream,
+// while the legacy setLegacy / executeSet / replaceWithStringTxn path
+// deletes the collection's logical elements and writes the string.
+// Codex flagged this as a P1 regression on PR #943 round-1: flipping
+// onePhaseTxnDedup default-on without a separate gate on the standalone
+// SET path would have changed normal Redis overwrite behaviour. The fix
+// is the standaloneSetDedup sub-gate, which defaults off — so
+// `SET k v` after `RPUSH k x` must still return OK and let the next
+// GET observe the string value, not WRONGTYPE.
+//
+// This is a regression test (CLAUDE.md self-review §5 + the
+// "when code review surfaces a defect, first add a failing test"
+// convention). If a future change re-enables standaloneSetDedup as
+// default-on without bringing applySet to parity with executeSet, this
+// test must fail.
+func TestRedis_SET_OverwritesList_UnderDefaultGate(t *testing.T) {
+	t.Parallel()
+	nodes, _, _ := createNode(t, 3)
+	defer shutdown(nodes)
+
+	ctx := context.Background()
+	rdb := redis.NewClient(&redis.Options{Addr: nodes[0].redisAddress})
+	defer func() { _ = rdb.Close() }()
+
+	// Seed the key as a list — the encoding that the dedup path's
+	// applySet hard-fails against.
+	require.NoError(t, rdb.Do(ctx, "RPUSH", "setover:list", "elem-a").Err())
+
+	// Real Redis behaviour: SET unconditionally replaces the value,
+	// dropping the previous type. The legacy path implements this; the
+	// dedup path returns WRONGTYPE. With the default config
+	// (onePhaseTxnDedup on, standaloneSetDedup off) we must take the
+	// legacy path and observe OK + string value.
+	res, err := rdb.Do(ctx, "SET", "setover:list", "replaced").Result()
+	require.NoError(t, err, "SET must overwrite an existing list under default config")
+	require.Equal(t, "OK", res)
+
+	got, err := rdb.Get(ctx, "setover:list").Result()
+	require.NoError(t, err, "GET after SET-over-list must succeed")
+	require.Equal(t, "replaced", got)
+}

docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md

@@ -80,7 +80,8 @@ profile that produced the parent design's trigger anomaly. M4 is met.
 
 The control workflow (`jepsen-test-scheduled.yml`, gate off) continues
 to surface `:duplicate-elements` and the related real-time cycle
-anomalies as expected; the 2026-06-05 18:37 failure ([#937]) is the
+anomalies as expected; the 2026-06-05 18:37 failure
+([#937](https://github.com/bootjp/elastickv/issues/937)) is the
 most recent observation. The control's purpose ends when default-on
 lands — see *§Control workflow disposition* below.
 
@@ -110,6 +111,37 @@ Comment and `WithOnePhaseTxnDedup`'s godoc are updated to describe the
 new default; the in-file pointer to R5 stays (now reframed as "the
 ordering constraint that authorized this default flip").
 
+### M1a — Carve out standalone `SET` behind a separate sub-gate
+
+PR #943 round-1 codex P1 flagged that `txnContext.applySet`
+(`adapter/redis.go:2356-2360`) returns `WRONGTYPE` when the existing
+key is a list/hash/set/zset/stream, while the legacy `setLegacy` →
+`executeSet` → `replaceWithStringTxn` path correctly deletes the
+collection's logical elements and writes the string. Real Redis lets
+`SET k v` overwrite any existing type unconditionally; flipping
+`onePhaseTxnDedup` default-on therefore would have silently changed
+normal Redis overwrite behaviour for every standalone-`SET`-against-
+collection configuration.
+
+This proposal does not bring `applySet` to parity (collection-deletion
+inside the dedup txn is a larger surgery, tracked as a separate
+follow-up). Instead it introduces a dedicated sub-gate
+`RedisServer.standaloneSetDedup` (default off, opt-in via
+`WithStandaloneSetDedup(true)` or
+`ELASTICKV_REDIS_ONEPHASE_DEDUP_SET=1`). The standalone-`SET` branch
+in `set()` now requires **both** `onePhaseTxnDedup` **and**
+`standaloneSetDedup` to be true before routing through
+`runTransactionWithDedup`; the previous behaviour is preserved as the
+default. MULTI/EXEC and list-push paths (the parent design's actual
+M4-validated workloads) are unaffected.
+
+The new field, option, env var, and the regression test
+`TestRedis_SET_OverwritesList_UnderDefaultGate`
+(`adapter/redis_set_overwrite_default_test.go`) all land in this PR.
+The test seeds `RPUSH k x`, calls `SET k v`, asserts `OK` + a
+subsequent `GET` returns `v` — it fails on the pre-fix build
+(WRONGTYPE) and passes on the fixed build.
+
 ### M2 — Control workflow disposition
 
 After default-on, `jepsen-test-scheduled.yml` would silently exercise