Stratara 4.1.0

The Orleans execution model ships as two new packages, Stratara.Orleans and
Stratara.Orleans.EntityFrameworkCore: one writer per aggregate across a cluster, accepted commands that
survive a crash, and projections and sagas that never miss a committed fact. Every host on the Entity
Framework store generates one migration when it upgrades, whether or not it adopts the execution model.
Telemetry type tags now carry the simple type name on every instrument, so a dashboard that filters the
projection, saga or conflict series on the qualified name needs its filter updated. Eight fixes land on
the retry, conflict, redaction and encryption work of 4.0.4, with one new warning to know about.

Added

• The Orleans execution model: Stratara.Orleans and Stratara.Orleans.EntityFrameworkCore.
  Commands, projections, sagas, durable timers and singleton work run as virtual actors on an Orleans
  10.3 cluster. One aggregate has one writer across the deployment; a command the execution model's
  dispatcher accepts is recorded before the call returns and resumed after a crash, a bounded number of
  times, through the same mediator pipeline as on the bus; projections and sagas read the store in
  commit order from a checkpoint, so a crash costs latency and never a committed fact; singleton work
  runs once per cluster without a lock; a failing entry stops its partition and is retried instead of
  being dropped. Handlers, projections and sagas are unchanged, each role is adopted with one
  registration after its composite, and both models can run side by side during a rollout. Every
  setting is validated at start. See Choose an Execution Model, Migrate to the Orleans Execution
  Model and Operate the Orleans Execution Model on the documentation site.
• Schema additions — every host on the Entity Framework store generates a migration. The framework's
  write context declares event_stream_entry.partition_position, the partition_position table, on
  PostgreSQL event_stream_entry.commit_transaction_id, and the outbox_entry columns aggregate_id,
  heavy, attempt_count, last_handed_over_at, kept_at and last_failure; the read context declares
  projection_checkpoint. They are part of the model whether or not a host adopts the execution model, so
  every host on Stratara.EventSourcing.EntityFrameworkCore generates and applies a migration after
  upgrading — without it, appends and outbox writes fail on the missing columns. A store that never runs
  the execution model carries them unfilled; on PostgreSQL an append also reads back the transaction id.
• Composites without the bus-fed worker. AddEventProjectionServices() and AddSagaServices()
  register the projection and saga runtimes without their bus workers; AddProjectionHandling and
  AddSagaHandling do the same on IServiceCollection.
• Every instrument name is a published constant. ApplicationDiagnostics.Metrics carries a
  …Name constant beside each instrument — EventsAppendedName, ProjectionEventsProcessedName,
  SagasInFlightName and the others — so a query or listener references the name instead of a literal.
  ApplicationDiagnostics.MetricTags.TypeNameValue gives the value a type tag carries for a type name.
• LogEvents.Messaging.WorkerQueueDeclaredWithOtherArguments (108_112), the warning a RabbitMQ
  worker logs when it uses an existing queue declared with other arguments.

Changed

• event.type and aggregate.type carry the simple type name on every instrument. On
  projection.events.processed, saga.events.processed and event_source.append.conflicts the tag
  value changes from the assembly-qualified name (Shop.Orders.OrderPlaced, Shop.Orders) to the simple
  name (OrderPlaced), the form event_source.events.appended already used, so write and read series
  join on the same value. A dashboard or alert that filters those three series on the qualified name
  needs its filter updated; no instrument or tag name changes.
• AddAuthorizingCommandOutboxDispatcher() decorates whichever command dispatcher is registered, not
  only the RabbitMQ one, and composes with a dispatcher registered after it.

Fixed

• RabbitMQ: changing the retry bounds no longer stops a worker from subscribing. A worker queue
  carries x-delivery-limit from the bounds it was first declared with, and RabbitMQ refuses a
  redeclaration with a different value — so a deployment that changed MessageRetry failed every
  subscription with PRECONDITION_FAILED. An existing queue is now used as it is, and the bus logs
  108_112 naming it. From RabbitMQ 4.3 the old limit does not cut the new bounds short; before 4.3
  a raised bound needs the drained queue deleted once.
• Azure Service Bus: a subscription whose MaxDeliveryCount is below the bounds no longer hides
  its dead-lettering. Where the host can read the subscription, the bounds for it are lowered to
  fit under the broker's limit, so the framework makes the move and it reaches 108_110 and
  messaging.dead_lettered. The warning 108_111 now says so. A failure to read the subscription
  of any kind other than cancellation ends the check instead of the subscription.
• A unique violation is a concurrency conflict whatever exception type carries it. The event
  source consulted the registered IStoreConflictDetectors only for an Entity Framework
  DbUpdateException, so a unit of work that surfaced the provider's exception unwrapped got a
  persistence failure instead of a ConcurrencyException. Every detector now sees the exception
  as the save threw it, as its contract says.
• Proxy credentials and response cookies are redacted from traces in the form the semantic
  conventions name them. The HTTP client and ASP.NET Core enrichment callbacks replaced
  http.request.header.proxy_authorization and http.response.header.set_cookie, but the
  OpenTelemetry semantic conventions keep the dash — proxy-authorization, set-cookie — so a host
  that captured headers under those names exported the values. Both forms are redacted now.
• The concurrency-conflict policy retries a conflict the event source reports. An append that
  lost the race surfaces from IEventSource.SaveChangesAsync as ConcurrencyException, and
  ResilienceNames.ConcurrencyConflict retried only ConcurrencyConflictException — so an
  IResilientRequest whose handler appends events ran once and failed on the first conflict. The
  policy now retries both, and still nothing else.
• A revoked encrypted field of a value type reads as its default instead of failing the object.
  Deserialization wrote an unreadable field back as JSON null, which a decimal, int or other
  non-nullable value type cannot hold — so erasing a subject's key made every record with such a
  field throw instead of degrading. The field now reads as the type's default, and the object's
  other fields are recovered.
• InMemoryKeyStore keeps a scope usable after its current version is revoked. Revoking the
  current key left the scope pointing at a key that no longer existed, so the next
  GetOrCreateCurrentKeyAsync threw. It now falls back to the highest remaining version, or creates
  a new one, as EnvelopeFileKeyStore does.
• IAggregationService.AggregateAsync no longer documents fromVersion as a start version. The
  parameter has never been honoured: a rebuild starts from the stream's beginning, or from the latest
  snapshot at or below toVersion. Its documentation now says so; the signature is unchanged.