Introduce a provider registry that allows multiple durability backends
(AOF fsync, replicas, etc.) to register and contribute to a consensus
offset. The overall durability consensus is the MIN (AND) of all enabled
providers' acknowledged offsets.

Include the built-in AOF provider that tracks fsynced_reploff_pending
when appendfsync=always, and transparently passes through when not.

Add pause/resume support for providers (used via DEBUG commands) to
enable deterministic testing by freezing a provider's acknowledged
offset at a point-in-time snapshot.

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Add a task registry that defers side-effects (keyspace notifications,
key invalidations, flush invalidations) until durability providers
acknowledge the associated write offset.

Each task type registers create/destroy/execute/onClientDestroy
handlers. Tasks are created during command execution with a deferred
offset, then moved to an official waiting list once the replication
offset is known. When the consensus offset advances past a task's
offset, the task is executed and freed.

Key invalidation tasks track the originating client pointer and
properly handle client disconnection before task execution.

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Track which keys have been modified but not yet acknowledged by
durability providers using a per-database hashtable. This enables
rejecting reads of uncommitted keys to ensure clients only see
durable data (zero-data-loss semantics).

Each uncommitted key stores the replication offset at which it was
last modified. Keys are purged when the durability consensus offset
advances past their stored offset.

Include incremental cleanup via serverCron that scans databases
round-robin with a configurable time limit, plus immediate purging
on read access (lazy cleanup).

Also handle database-level modifications (FLUSHDB, FLUSHALL, SWAPDB)
and function store dirty tracking for transactions.

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Add the core orchestration layer that blocks client responses in the
client output buffer (COB) until durability providers confirm the write
offset, then unblocks and flushes responses to clients.

reply_blocking.c/h contains:
- durabilityInit/Cleanup/Reset lifecycle management
- beforeCommandTrackReplOffset/afterCommandTrackReplOffset for tracking
  which replication offsets each command produces
- preCommandExec: rejects commands accessing uncommitted keys
- postCommandExec: blocks client responses until providers acknowledge
- notifyDurabilityProgress: called from beforeSleep to unblock clients
  whose offsets have been acknowledged
- blockClientOnReplOffset/unblockResponsesWithAckOffset
- Function store dirty tracking for FUNCTION LOAD/DELETE
- INFO durability stats generation

Integration points across the server:
- server.c: init/cleanup in server lifecycle, pre/post command hooks in
  call() and processCommand(), notifyDurabilityProgress in beforeSleep,
  uncommitted keys cleanup in serverCron, per-DB init, INFO section
- server.h: durable_t in server struct, clientDurabilityInfo in client,
  uncommitted_keys/dirty_repl_offset in serverDb, new client flag
- config.c: 'durability' bool config with dynamic update callback
- db.c: durabilitySignalModifiedKey/durabilitySignalFlushedDb hooks
- networking.c: client durability init/reset, COB reply limiting
- notify.c: defer keyspace notifications when durability is enabled
- script.c/module.c: pre-script checks for uncommitted data access
- replication.c: clear durability state on primary change
- debug.c: durability-provider-pause/resume DEBUG subcommands
- object.c: getIntFromObject utility

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Add reply_blocking.c, durable_task.c, durability_provider.c, and
uncommitted_keys.c to the build system (both Makefile and CMake).

Also fix a clang compatibility issue in unit test CMakeLists.txt:
-fno-var-tracking-assignments is GCC-only, so guard it with a
compiler ID check.

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Add comprehensive gtest-based unit tests covering the reply blocking
subsystem including:
- Client output buffer blocking and unblocking mechanics
- Offset tracking through command execution
- Multi-command transaction (MULTI/EXEC) offset handling
- Durability provider consensus calculations
- Deferred task lifecycle (create, execute, cleanup)
- Uncommitted key tracking and purging
- Edge cases: client disconnection, provider pause/resume

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Add Tcl-based integration tests (1,051 lines) covering end-to-end
durability behavior including:
- AOF-based response blocking with appendfsync=always
- Provider pause/resume via DEBUG commands for deterministic testing
- Uncommitted key rejection (reads return error for dirty keys)
- MULTI/EXEC transaction durability semantics
- Lua script and FCALL durability checks
- Function store (FUNCTION LOAD/DELETE) durability blocking
- Client disconnection during blocked state
- Multiple concurrent clients with interleaved blocking/unblocking
- INFO durability stats verification

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

… queue

Separate the two concerns in uncommitted key tracking:

1. Is a key dirty? Mark it immediately when mutated, even inside
   MULTI/EXEC (using LLONG_MAX as placeholder offset so reads block).

2. When can we clean it? Use a FIFO offset tracker queue in the
   durability system. After a transaction completes, update the
   placeholder to the real offset and enqueue for cleanup.

drainCommittedKeys() pops from the queue head when the committed
offset advances, replacing the old periodic scan-based
clearUncommittedKeysAcknowledged() cron job entirely.

- Removed keys_cleanup_time_limit_ms and curr_db_scan_idx from durable_t
- Removed getUncommittedKeysCleanupTimeLimit()
- drainCommittedKeys() called from notifyDurabilityProgress()
- Removed periodic clearUncommittedKeysAcknowledged() from serverCron

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

…e cap fix

Naming refactor:
- Rename durability* → replyBlocking*/postCommit* across all files
- Rename durable_task.c/h → post_commit_task.c/h
- Rename INFO fields: durability_* → reply_blocking_*
- Fix comment style (single-line /* */ → //)

Write cap fix:
- Cap _writeToClient() and writevToClient() at disallowed_byte_offset
- Prevents single syscall from flushing past the reply-blocking boundary

Module boundary cleanup:
- Move all_dbs_dirty_in_current_cmd into uncommitted_keys module
- Pass previous_acked_offset as parameter instead of reading server struct
- Decouple uncommitted_keys from reply_blocking internals

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

Signed-off-by: Jules Lasarte <jules.lasarte@gmail.com>

Address review comments from @murphyjacob4:

- Add a dedicated CMD_KEYSPACE_INFORMATIONAL command flag instead of
  overloading the KEYSPACE ACL category to identify read-only keyspace
  introspection commands; tag the 18 matching commands and simplify the
  IS_KEYSPACE_INFORMATIONAL macro.
- Rename call-site-named reply-blocking hooks to describe behavior:
  recordReplOffsetBaseline, computeCommandBlockingOffset,
  beginCommandReplyBlocking, validateScriptForReplyBlocking,
  finalizeCommandReplyBlocking.
- Move NOTIFY_IN_POST_COMMIT_TASK into the NOTIFY_ flag block in server.h.
- Use C-style comments and fresh bitfield numbering in reply_blocking.h
  and drop redundant macro comments.
- Replace the ambiguous "ZDL" comment with "reply-blocking".

Also fix an incomplete rename from the durability -> reply-blocking
refactor: aof.c still called notifyDurabilityProgress(); renamed it to
notifyReplyBlockingProgress() so the build links.

Signed-off-by: jjuleslasarte <jules.lasarte@gmail.com>

…io#3381)

clientHasPendingReplies() compares io_last_written.bufpos against the
blocked-response boundary, which is only valid when both refer to the
same buffer. That holds today via implicit invariants but is fragile.
Add a debugServerAssert (active only under enable-debug-assert) that
io_last_written.buf is NULL or the exact buffer the boundary sits in, so
a future change that breaks the invariants fails tests.

Also add an integration test for the previously-untested reply-list
branch: a multi-block allowed prefix is released while a pipelined
blocked write reply is withheld until the provider acks.

Signed-off-by: Chris Li <1070743423@qq.com>

…e list (valkey-io#3381)

A rejected MOVE (e.g. MOVE key 100000) reaches the reply-blocking offset path and indexed server.db[dest_dbid] without checking dbnum, an out-of-bounds read. Bound dest_dbid to [0, dbnum) in both MOVE branches (COPY was already guarded via getDbIdFromRobj) and add a MOVE/COPY out-of-range regression test.

Also point the CMake source list at the renamed post_commit_task.c (was durable_task.c), which broke cmake configure.

Signed-off-by: Chris Li <1070743423@qq.com>

…#3381)

Per the maintainers' decision, reply-blocking observability is internal
and test-only, not customer-facing. Move the reply_blocking_* fields out
of the standalone (all/everything-visible) INFO section and into the
hidden Debug section, which is emitted only for an explicit INFO debug --
excluded from INFO, INFO all, and INFO everything.

Update the durability tests to read INFO debug. Further field-level
changes (dropping reply_blocking_enabled and the offset fields, and
relocating the committed/uncommitted offsets to the Replication section)
are tracked separately pending TSC approval.

Signed-off-by: Chris Li <1070743423@qq.com>