feat(redis): flip one-phase txn dedup default-off to default-on

Implements the proposal in
docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md.
The Redis adapter's one-phase idempotency dedup
(adapter.RedisServer.onePhaseTxnDedup) now defaults on. The
ELASTICKV_REDIS_ONEPHASE_DEDUP env var inverts from opt-in (=1
enabled, anything else disabled) to opt-out (=0 disabled, anything
else enabled). The WithOnePhaseTxnDedup constructor option still
trumps the env var.

Authorization for the flip is the parent design's M4 7-day green
criterion in the dedup-mode Jepsen workflow
(.github/workflows/jepsen-test-scheduled-dedup.yml), met by 12
consecutive green runs over 10 days (2026-05-31 → 2026-06-10) on the
stress profile that produced the parent design's trigger anomaly. The
parent's R5 (FSM determinism across a rolling upgrade) is discharged
— the probe code has shipped on every production node for months, so
the writer (emission) flipping on is uniformly understood.

To preserve the legacy-path coverage during the post-flip observation
window, the control workflow
(.github/workflows/jepsen-test-scheduled.yml) now sets
ELASTICKV_REDIS_ONEPHASE_DEDUP=0 explicitly at the job env level so
its semantics survive the default change. Retirement of that workflow
is a 30-day follow-up.

Closes #937 — the failure that triggered this work is the control
baseline's expected unprotected behaviour; with default-on it falls
back into the path the dedup-mode workflow has been exercising clean
for 12 consecutive days.

Verified:
- go vet ./... clean
- go build ./... clean
- go test -run 'Dedup|OnePhase|PrevCommit|Idempot' ./adapter/ — pass
- go test -run 'TestRedis|TestList|TestSet|TestZSet|TestStream|TestExec|TestMulti'
  ./adapter/ — pass (169s)
- golangci-lint run ./adapter/... — 0 issues

Author: bootjp

.github/workflows/jepsen-test-scheduled.yml

@@ -39,6 +39,19 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GOCACHE: /tmp/go-build
+      # Explicit dedup-OFF control baseline. The Redis adapter's
+      # onePhaseTxnDedup flipped to default-on in
+      # docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md;
+      # this workflow is preserved as the legacy-path coverage so anomalies
+      # the dedup gate prevents (`:duplicate-elements`, `:future-read`,
+      # `:G-single-item-realtime`) continue to be measured against an
+      # unprotected build. Pair with the dedup-ON workflow
+      # (.github/workflows/jepsen-test-scheduled-dedup.yml) which sets
+      # ELASTICKV_REDIS_ONEPHASE_DEDUP=1 explicitly. Retirement of this
+      # workflow is a follow-up after 30 days of post-flip data; until
+      # then, do NOT remove this env var — without it the two workflows
+      # would exercise the same path under the new default.
+      ELASTICKV_REDIS_ONEPHASE_DEDUP: "0"
     steps:
       - uses: actions/checkout@v6
         with:

adapter/redis.go

@@ -243,21 +243,25 @@ type RedisServer struct {
 	// retryable write error, list-push retries reuse the failed attempt's
 	// write set and carry prev_commit_ts so the FSM can dedup a commit that
 	// landed under leadership churn (see
-	// docs/design/2026_05_21_proposed_txn_secondary_idempotency.md). It
-	// MUST stay off until every node runs a probe-aware binary — see R5
-	// (FSM determinism across a rolling upgrade). Default off; enabled via
-	// WithOnePhaseTxnDedup / the ELASTICKV_REDIS_ONEPHASE_DEDUP env var
-	// after a full rollout.
+	// docs/design/2026_05_21_proposed_txn_secondary_idempotency.md). The
+	// FSM probe ships on every node in production, satisfying R5 (FSM
+	// determinism across a rolling upgrade), so the gate now defaults on
+	// per docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md.
+	// Set ELASTICKV_REDIS_ONEPHASE_DEDUP=0 (or WithOnePhaseTxnDedup(false))
+	// to opt out — kept as a one-env-var operator rollback.
 	onePhaseTxnDedup bool
 
 	route map[string]func(conn redcon.Conn, cmd redcon.Command)
 }
 
 type RedisServerOption func(*RedisServer)
 
-// WithOnePhaseTxnDedup enables the option-2 one-phase idempotency dedup on
-// list-push retries (see RedisServer.onePhaseTxnDedup). Off by default;
-// enable only after the whole cluster runs a probe-aware binary.
+// WithOnePhaseTxnDedup enables (or disables) the option-2 one-phase
+// idempotency dedup on list-push, MULTI/EXEC, and standalone-write retries
+// (see RedisServer.onePhaseTxnDedup). On by default since the rollout
+// recorded in docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md;
+// pass false to opt out from code, or set ELASTICKV_REDIS_ONEPHASE_DEDUP=0
+// to opt out from the environment. The constructor option trumps the env var.
 func WithOnePhaseTxnDedup(enabled bool) RedisServerOption {
 	return func(r *RedisServer) {
 		r.onePhaseTxnDedup = enabled
@@ -495,11 +499,13 @@ func NewRedisServer(listen net.Listener, redisAddr string, store store.MVCCStore
 		// getLuaPool, which honors luaPoolMaxIdle the same way.
 		luaPool:       nil,
 		traceCommands: os.Getenv("ELASTICKV_REDIS_TRACE") == "1",
-		// onePhaseTxnDedup honors the documented opt-in env var; the
-		// WithOnePhaseTxnDedup option below can still override either way.
-		// Default off — see R5 in the design doc (the writer must not be
-		// enabled until the whole cluster runs a probe-aware binary).
-		onePhaseTxnDedup: os.Getenv("ELASTICKV_REDIS_ONEPHASE_DEDUP") == "1",
+		// onePhaseTxnDedup defaults on — the parent design's R5 rolling-upgrade
+		// constraint is discharged (FSM probe shipped on every node months ago,
+		// 12 consecutive green dedup-mode Jepsen runs 2026-05-31 → 2026-06-10).
+		// See docs/design/2026_06_10_proposed_redis_onephase_dedup_default_on.md.
+		// ELASTICKV_REDIS_ONEPHASE_DEDUP=0 opts out; the WithOnePhaseTxnDedup
+		// constructor option still trumps the env var.
+		onePhaseTxnDedup: os.Getenv("ELASTICKV_REDIS_ONEPHASE_DEDUP") != "0",
 		baseCtx:          baseCtx,
 		baseCancel:       baseCancel,
 		streamWaiters:    newKeyWaiterRegistry(),