fix(command): return queued tx error - #3933

Mark successful cluster transaction outcomes that carried HIMPORT
commands so the caller still runs himportAfterBatch after the
read path changes made for queued EXEC arrays.

Refs redis#3933

Keep queued transaction state visible across short EXEC arrays,
cluster redirect drain failures, and RESP3 push-drain errors while
preserving HIMPORT post-batch semantics on both standalone and
cluster readers.

Refs redis#3933

Keep queued transaction state visible across queue-reply push failures,
short EXEC arrays, and cluster redirect drain failures while preserving
HIMPORT post-batch semantics on both standalone and cluster readers.

Refs redis#3933

Keep queued transaction state visible across queue-reply push failures, short EXEC arrays, and cluster redirect drain failures while preserving HIMPORT post-batch semantics on both standalone and cluster readers.

Refs redis#3933

Preserve command replies that were already read from a successful EXEC
array when surfacing a queued transaction error, instead of stamping
the whole batch with the queued failure afterward.

Refs redis#3933

Preserve handler context and exact HIMPORT bookkeeping while\nkeeping queued transaction drain failures sticky-safe across\nstandalone and cluster readers.\n\nRefs redis#3933

Handle RESP3 attribute frames while discarding successful EXEC arrays,
stamp discarded replies with the queued error, and reject malformed
negative EXEC array lengths.

Refs redis#3933

Use the same EXEC discard helper in the cluster queued-array paths
so RESP3 attribute frames are skipped before counting a discarded
transaction result.

Refs redis#3933

Do not overwrite successfully read HIMPORT command replies when a queued
transaction error is surfaced after a successful EXEC array.

Refs redis#3933

Discard non-HIMPORT EXEC-array results on queued transaction error paths while still preserving HIMPORT post-batch side effects for the slots that actually executed.

Refs redis#3933

Cluster readTxPipelineReplies parsed the EXEC array length but did not
guard n<0, so a malformed RESP frame could panic on cmds[readCount:].
Mirror the standalone n<0 guard on both the firstFatal and firstRedirect
drain paths and cover it with a cluster test.

Also rename tx_pipeline_issue3800_test.go to tx_pipeline_queued_error_test.go
per review (behavior-based naming), keeping redis#3800 as a header reference.

Route the EXEC-line read error (both transport errors and typed Redis
errors) through classifyExecError instead of handling the transport case
inline in readTxPipelineReplies. The non-Redis prefix wraps any queued
root cause in txQueuedReadError with unreadReplies so the connection is
discarded, while Redis errors keep the connection reusable as before.

Behavior is unchanged; the inline firstRedirect switch that duplicated
classifyExecError is removed. The added doc comment records the
N+2/N+3 reply invariant so the connection-reuse boundary is explicit.

Per review by @cxljs.

When a queued Redis error was followed by an EOF/timeout reading a later
+QUEUED reply, the failing command kept the raw read error while Exec
returned the wrapped txQueuedReadError. setCmdsErr skips commands with a
non-nil rawErr, so callers inspecting that command lost the queued root
cause and typed-error helpers missed it. Store the wrapped error on the
command before returning.

Covered by TestTxPipelineExecQueuedReplyReadFailureStampsWrappedError.

When a queued command error was recorded but the EXEC reply was a
non-array RESP frame (the malformed/proxy case this PR targets), the
generic protocol error was returned without the queued root cause, so
typed-error helpers (IsOOMError, IsExecAbortError, ...) could not see
it. Wrap the protocol error in txQueuedReadError so the queued cause is
preserved; the connection is discarded (forceBad, unreadReplies) since a
non-array reply may leave bytes on the wire.

Covered by TestTxPipelineExecQueuedErrorNonArrayReplyPreservesQueuedError
and TestClusterTxPipelineQueuedErrorNonArrayReplyPreservesQueuedError.

Early exits inside the queued-error EXEC-array drain returned
txQueuedReadError without himportedIndexes, so callers never ran
himportAfterBatch for HIMPORT replies already decoded — losing side
effects such as PREPARE root-cause swaps on HImportSet. Similarly, the
cluster processTxPipeline txFatal branch stamped every command whose
Err() was nil, overwriting successfully-drained HIMPORT slots with the
queued fatal error.

- Add himportedIndexes to txQueuedReadError; populate it on mid-drain
  failures; run himportAfterBatch and skip HIMPORT slots when stamping
  (standalone).
- Set himportedIndexes on mid-drain txOutcome returns so the cluster
  caller runs himportAfterBatch.
- Skip himportedIndexes in the cluster txFatal stamping loop.

Covered by TestTxPipelineExecMidDrainFailurePreservesHImportAfterBatch
and TestClusterTxPipelineMidDrainFailurePreservesHImportIndexes.

When a queue-phase Redis error or redirect had already set firstFatal /
firstRedirect, a later transport error reading another +QUEUED reply
returned bare txReadFatal, dropping the root cause. Standalone already
wraps this case in txQueuedReadError; cluster now mirrors that so typed
helpers and callers see the original queued cause. The connection is
discarded (unreadReplies) since replies remain on the wire.

Covered by TestClusterTxPipelineQueuedReplyReadFailurePreservesQueuedError.

…rors

Three cursor bugbot findings:

1. Push-processor failures during the queued-reply loop and before the
   EXEC line returned txQueuedReadError without forceBad. When the
   processor error was a Redis-typed error (e.g. custom OOM), isBadConn
   kept the connection pooled while EXEC and later replies remained
   unread, desynchronizing the stream for the next borrower. Set
   forceBad on all push-drain failure paths (standalone).

2. Parse failures and negative EXEC array lengths dropped queuedErr /
   firstFatal / firstRedirect, returning a bare protocol error so
   typed helpers lost the queued root cause. Wrap these in
   txQueuedReadError (standalone and cluster) with forceBad and
   unreadReplies to preserve the root cause and discard the conn.

3. The cluster queue-reply IO failure was already fixed in 3294282;
   this commit also applies forceBad to the cluster classifyExecError
   transport paths (already done) and the parse/negative-length paths.

Three bot findings on the firstRedirect EXEC-array drain paths:

1. Malformed EXEC length (parse failure / negative) returned txFatal
   instead of the matching retry kind (MOVED/ASK/TRYAGAIN). Other
   desync paths with firstRedirect preserve the redirect; now this one
   does too, via a txRedirectOutcome helper.

2. The non-array EXEC reply branch stamped setCmdsErr on every command
   before returning a retry. If the redirected attempt later failed,
   callers saw the discarded attempt's protocol error instead of the
   final failure. Deferred stamping on retry outcomes.

3. The redirect drain loop discarded every EXEC element without tracking
   himportedIndexes, so HIMPORT side effects already executed (e.g.
   PREPARE/DISCARD) were never applied. Added HIMPORT-aware draining
   mirroring the firstFatal path, carrying himportedIndexes on the
   outcome so the caller runs himportAfterBatch.

Covered by TestClusterTxPipelineRedirectPreservedOnMalformedExecArrayLen.

… indexes

Four bot findings:

1. (P1) Once a redirect's EXEC array had any element consumed (HIMPORT
   reply or discarded result), retrying the whole TxPipeline could
   double-apply non-idempotent commands. Track readCount in the redirect
   drain; if readCount > 0, return txFatal. If a drain failure occurs
   before any element is consumed (readCount == 0), preserve the retry.

2. (cursor + codex P2) Redirect mid-drain failures now carry
   himportedIndexes on the txOutcome so processTxPipelineNodeConn runs
   himportAfterBatch for already-decoded HIMPORT replies, mirroring the
   firstFatal path.

3. (codex P2) Store the wrapped txQueuedReadError on the HIMPORT command
   before returning, so callers inspecting that command see the queued
   root cause instead of the raw read error (standalone + cluster).

4. himportedIndexes is now recorded after a successful HIMPORT readReply,
   not before, so a failed read does not register a side effect that
   never completed.

Tests updated for the new P1 semantics; added
TestClusterTxPipelineRedirectMidDrainFailurePreservesHImportIndexes.

A positive EXEC array header means the transaction may already have executed commands, even if the first element is truncated. Return a fatal dirty outcome instead of retrying the whole transaction. Preserve HIMPORT indexes and wrapped root causes on redirect drain failures, and keep HIMPORT read errors visible on their commands.

Address the remaining bot findings around push draining:

- Use a forceBadConnError wrapper when a custom push processor fails in the
  +QUEUED loop or right before the EXEC line before any queued Redis error has
  been recorded. This preserves the original error while forcing connection
  removal so unread replies cannot poison the next borrower.
- Add a release-time Buffered variant for VoidProcessor and use it from
  drainPushNotificationsOnRelease so mid-frame errors are propagated instead of
  being swallowed.
- Cover both cases with focused regression tests.