[datlechin]

Summary

• New tablepro-driver-redis crate on redis-rs 1.7 (aio, tokio-comp, no TLS features): every stream comes from Transport::open, with TLS through tokio-rustls on aws-lc-rs, so direct and SSH-tunnelled connections work alike.
• The contract now fits an engine without SQL (ADR 0021 in linux/docs/decisions/0021-engines-without-sql.md, and linux/docs/adding-drivers.md, Engines without SQL): DriverCapabilities::data_model and username_required, Connection::scan_keys and read_key, ReadOnlyEnforcement::ClientGuard, ServerCode::Redis, and a SqlGrammar::Redis with its own rules in sql_syntax/redis (one command per line read as redis-cli does, command access, history rules).
• The sidebar lists the keys of the connection's database with their types, read with SCAN and TYPE, never KEYS. The search goes to the server: plain text matches anywhere, text with *, ? or [ is a glob. A banner says when the list stops at 5,000 keys.
• A key opens in a key tab by type (string, hash, list, set, sorted set with scores, stream), 500 entries at a time with Load More, under its length and expiry. A failed read is asked again on the next link, and key tabs are restored and reopened like other tabs.
• The editor takes Redis commands with no SQL highlighting, completion, formatter or comment toggle. Replies show as redis-cli lays them out. MULTI is tracked as a transaction (Commit sends EXEC, Roll Back DISCARD). Pub/sub, MONITOR and other commands that stop one-reply-per-command are refused.
• A waiting command stops with CLIENT UNBLOCK from a link of its own, then CLIENT KILL ID past the grace.
• Read-Only refuses every command that is not a read before it is sent, in the editor and in exports; the connect dialog's Safe Mode subtitles say so in commands. Database Number and an optional username in the connect dialog.
• History withholds AUTH, HELLO ... AUTH, MIGRATE ... AUTH, ACL SETUSER, CONFIG SET of password parameters, SENTINEL SET and scripts that name them.
• A TLS 1.3 refusal for a missing client certificate reports as a TLS failure, not a lost connection.
• Engine-neutral wording where Redis showed SQL terms: the grid's Copy As IN Clause is hidden, the empty workspace says Select a Key and Open Editor, and a saved connection with no username is listed without a dangling @.
• Fixes a host with no Secret Service failing every connect that needs a password: the keyring's ServiceUnknown came back wrapped as a service error and read as a backend failure, instead of asking for the password.
• keyspace_conformance_suite! for key-value engines, a Redis fixture (plain, TLS-only, certificate-only), Redis 7.4 and 8.10 in CI, and a session test through OpenSSH.
• Allows BSL-1.0 in deny.toml and about.toml for xxhash-rust, which redis-rs depends on; license notices regenerated.
• Bumps ctutils to 0.4.4 for RUSTSEC-2026-0385, published today, which failed the supply chain check.
• Docs: docs/drivers/redis.md, adding-drivers.md, testing.md, README, ROADMAP, ARCHITECTURE, storage and error handling.

Test plan

• cargo nextest run -p tablepro-driver-redis --run-ignored only on Redis 8.10: the keyspace and TLS suites and the driver's own cases, 39 of 39.
• keys_list_and_commands_run_through_openssh in tablepro-session, through a real OpenSSH tunnel.
• New unit and gtk tests: the Redis lexer, command access, history rules and plan; the dialect, reply and key decoding; the key sidebar, its server-side search and limit banner, the key tab's windows, refresh, reconnect retry, type change and failures, key tab restore, the command editor, the connect form, the Safe Mode subtitles and the keyring mapping.
• verify.sh build, lint (both clippy runs) and l10n, the workspace unit suite, cargo deny, shear and the license notices.

Screenshots

	Light	Dark
Engines, before
Engines, after
Redis connect form
Keys sidebar
Key tab
Command editor

Fixes #3647