[DPS0340]

Summary

Add an optional Redis-backed per-IP rate limiter for #403. The existing local limiter is unchanged.

Cause

The current limiter stores token buckets in process-local memory. Separate processes cannot share that state. The existing Redis pool also has unbounded waits and blocking I/O, so a request-path Redis command needs a bounded alternative.

Changes

• Add cwist_mw_rate_limit_ip_redis(const cwist_rate_limit_redis_cfg_t *).
• Use one atomic Lua EVAL to increment and set a first-hit 60-second expiry. Active windows are not extended; missing expiry is repaired.
• Share the same prefix and limit across independently created process-local pools.
• Return 429 with Retry-After for excess requests. Default backend policy is fail-open; configurable fail-closed returns 503.
• Add a typed pooled Redis command with one monotonic deadline for slot wait, reconnect, write and reply I/O. Timed-out connections are discarded; ambiguous commands are not retried.
• Cache the resolved peer for reconnects, reject inherited pools, and contain SIGPIPE on the timed path.
• Add actual two-process Redis tests, fake-peer deadline tests, CI, API baseline and English/Korean docs.

Verification

• Isolated Redis: 40 attempts from two processes share exactly seven admissions and 33 rejections.

• TTL preservation, TTL repair, expiry reset, namespace isolation and IPv6 peer isolation passed.

• Redis command errors, missing peers and paused-backend failure policies passed.

• Fourteen fake-peer deadline, stale-response, reconnect, fork, SIGPIPE, malformed-reply and concurrency tests passed.

• Extra resource-failure regression: a 120 ms pool-wait budget took 257.8 ms before the fallback fix and about 120 ms after it.

• The integration and relevant sibling tests passed under ASan/UBSan on macOS. Leak detection was disabled there. ABI layout checks passed.

• API baseline, API coverage ratchet, test wiring, changed-file formatting, Python lint and workflow parse passed.

• Public-API tutorial gate passed: 30 tutorials built and 10 document snippets compiled.

• Fat archive built and passed the same isolated-Redis integration when linked without separate vendor archives.

• macOS amalgamation compilation is blocked by an undeclared SQLite getpagesize call. The exact base commit fails the same way under the same command; this is not a new failure from this diff. Linux CI passed both default and tiny amalgamation distribution jobs at 0de355143.

The full independent review and the follow-up review passed. The pre-publication findings are resolved: per-process first-error diagnostics, explicit fresh-connection/no-AUTH/no-SELECT contract, prefix-per-policy and IPv6 /128 limits. The diagnostic regression failed before the fix and passed afterwards, including ASan/UBSan.

CI follow-up

The GCC test warnings are fixed; Linux TSan and the shared Redis job passed at cf80a6a1a. CodeQL alert #36 prompted explicit formatter-result, capacity and final-length checks before any pool I/O. The checked encoder, error cleanup and fault/bounds tests passed independent security review and local GCC/ASan/UBSan checks. The maintainer Autofix commit is preserved in history. Current head 0de355143 also merges dev and preserves both additive API sets (790 functions). Final CI at 0de355143: 37 success, 1 skipped, 1 neutral; no failures or pending checks. Linux Redis integration, all 14 deadline tests and the new encoder bounds/fault regression passed. C/C++ CodeQL analysis passed; alert #36 is fixed on the PR merge ref, which has no open alerts. The CodeQL comparison check remains neutral because the base has an Actions-language configuration absent from this PR's analysis; this configuration warning was not suppressed.

Limits

This is bounded blocking middleware, not an async reactor API. Initial pool creation/DNS and application logging are outside the Redis command budget. Scheduling and large trusted caller buffers are not real-time guarantees.

Use a dedicated DB 0 pool with the default user and no AUTH. Reconnects do not restore AUTH, SELECT, or other connection state. A server that requires AUTH applies the chosen failure policy to every request, with one first-error warning per config and process. Different policies need different key prefixes; IPv6 keys use full /128 addresses.

Pools must be created separately in each serving process after fork and outlive callbacks. The example uses cwist_app_listen_ex with one worker. There is no new automatic worker-start hook, and inherited pools are rejected.

Keys use the actual connected socket peer, not forwarded headers. A QUIC request without a TCP peer follows the configured missing-peer policy; QUIC path extraction is not added. Redis RESP2 needs a private network or TLS tunnel. Eviction, failover or external deletion can reset counters.

No merge or release is part of this change.

Closes #403.

[gg582]

yo, LGTM.