Wolverine 6.51.3

Wolverine 6.51.3 is a durability release. Nearly everything in it came out of a run of reports against the durable inbox and outbox, plus a new durable receiver compliance rig (src/Testing/DurableComplianceRig, Bobcat specs across PostgreSQL, SQL Server, Marten and EF Core over local, database, RabbitMQ and SQS endpoints) that turned up the rest. There are no breaking API changes; the one schema addition (a nullable envelope_id column on the deduplication table) is optional and an unmigrated table keeps working.

Many thanks to everyone who reported these with reproductions: @billshuck, @dbelinsky-accureference, @endava-marinela-marchitan, @devployment, @kowalczb, @Patrick2607 and @ahmetvayhan.

Durable inbox hardening

• Durable inbox hardening, part 1: transactions, idempotency, deduplication, GH-5123 and the CISqlServer split by @jeremydmiller in #5129
  • A late DbTransaction dispose in MessageContext.ClearState() could kill another handler's Npgsql transaction
  • Eager idempotency now writes its placeholder inside the handler's transaction (Marten, EF Core, Polecat, Fisher), so a requeued failure is no longer dead lettered as a duplicate of itself
  • EF Core marks the inbox row Handled only after its own commit, and inside the tenant transaction for database-per-tenant
  • A handler that calls ReScheduleAsync and then returns normally keeps its retry
  • A [Deduplicated] claim stranded by a crash can be taken over by the same envelope (new nullable envelope_id column, opt-in IEnvelopeAwareDeduplicationStore)
  • Envelope.DeduplicationId now crosses RabbitMQ, the generic EnvelopeMapper brokers and MQTT
  • Two copies of one envelope in a single batch are reported as DuplicateIncomingEnvelopeException instead of pausing the listener or tripping the tenant write brake (PostgreSQL, SQL Server, MySQL, SQLite, Oracle)
  • RabbitMQ quorum queues: opt-in x-delivery-limit (.DeliveryLimit(n), DeliveryLimitForDurableQuorumQueues(n)), a startup warning, and DeferAsync publishes before it acks. New docs section "Quorum Queues and the Durable Inbox"
• Durable receiver hardening, part 2: batch member settlement, inbox ownership, paused local queues by @jeremydmiller in #5157
• Durable receiver hardening, part 3: drain release vs. a new receiver's first claim; heartbeat only while holding (F18) by @jeremydmiller in #5158

Durable bug fixes

• GH-5107 PostgreSQL queue sender moves the outbox row atomically for every durable send by @jeremydmiller in #5109
• GH-5107 SQL Server queue sender moves the outbox row atomically for every durable send by @jeremydmiller in #5112
• GH-5107 MySQL queue sender moves the outbox row atomically for every durable send by @jeremydmiller in #5113
• GH-5107 Oracle queue sender moves the outbox row atomically for every durable send by @jeremydmiller in #5114
• GH-5107 SQLite queue sender moves the outbox row atomically for every durable send by @jeremydmiller in #5115
• GH-5105 Durable receiver awaits the dead-letter write; a failed write is never reported as dead lettered by @jeremydmiller in #5110
• GH-5108 Logical deduplication claim rides the EF Core transaction by @jeremydmiller in #5111
• GH-5116 A disposed message store refuses a dead letter instead of dropping it by @jeremydmiller in #5118
• GH-5119 Durable receivers settle the inbox row even when the broker delivery is already acked (durable SQS listeners since 6.40.0) by @jeremydmiller in #5121
• GH-5120 A durable batch's scheduled retry is held in memory instead of lost by @jeremydmiller in #5122

Testing

• GH-5106 Bobcat failure reports carry the message, correlation, causation and trace ids by @jeremydmiller in #5117

Full Changelog: V6.51.2...V6.51.3