AIKIDO-2026-286337

TL;DR

On a Redis Cluster connection, an aborted transaction returns without sending DISCARD or UNWATCH, so the server side MULTI stays open on the reused node connection. A later GET on that connection returns a Predis\Response\Status object with payload QUEUED, which PHP treats as truthy even when the requested key does not exist, and a later SET on the same connection is queued instead of applied. Under persistent connections the dirty socket keeps serving queued responses to the next request handled by the same PHP-FPM worker, exposing stale values and false truthy reads to unrelated callers. After the fix, initialization, queueing, and EXEC errors cause UNWATCH or DISCARD to be sent and the transaction state to be reset before the node connection is reused.