fix(sqlserver): make EnsureDatabaseExistsAsync safe under concurrent callers (weasel#415) - #418

Closes #415.

SqlServerMigrator.EnsureDatabaseExistsAsync did a check-then-create against master. Two gaps show up as soon as more than one process calls it at once:

1. Both callers see DB_ID return null, both issue CREATE DATABASE, and the loser gets SqlException 1801 — "Database 'x' already exists".
2. The method returned as soon as CREATE DATABASE completed, so the caller's next OpenAsync against the new catalog could still fail — a freshly created SQL Server database briefly refuses logins.

Neither mattered while a single process bootstrapped a single database at startup. Both matter as soon as parallel test workers each provision their own database against a cold container.

Promoting proven code, not writing new logic

SqlServerDatabaseBootstrap in Weasel.EntityFrameworkCore.Tests already solved exactly this and has been stranded where nothing outside those tests could reach it. This moves it into the shipped assembly; that helper is now a thin shim that delegates.

What changed

• 1801 is caught and treated as success. The IF DB_ID(...) IS NULL CREATE DATABASE form was considered and rejected as the whole answer — SQL Server does not make that pair atomic against a concurrent CREATE, so it only narrows the window. The 1801 catch is what closes it, so the cheap parameterized DB_ID check stays as the fast path and the catch does the real work.
• The method now polls until the database accepts a connection. Unconditionally, not only when we created it — a concurrent creator leaves us the same window. When it returns, callers can take the postcondition at face value: the database exists and is reachable.
• The wait is bounded and expires loudly. TimeoutException names the database, points at the knob, and carries the last SqlException as InnerException. Silence after a timeout would be worse than the old behaviour.
• ] in the database name is escaped. CREATE DATABASE takes no parameters, so the name has to be interpolated into a delimited identifier.

Answering the issue's open questions

Should the retry ceiling be configurable? Yes. DatabaseAvailabilityTimeout defaults to 30s (matching the test helper's 30 × 1s) and DatabaseAvailabilityPollingInterval to 1s. TimeSpan.Zero makes a single attempt and fails fast, which is what a developer with a warm container wants.

Do the other providers need the same treatment? PostgreSQL has the same check-then-create shape and the same race, so PostgresqlMigrator.EnsureDatabaseExistsAsync now catches 42P04 duplicate_database. It needs no availability wait — Postgres accepts connections to a new database as soon as CREATE DATABASE returns, so that half is genuinely SQL-Server-specific. Oracle/MySql/Sqlite are not audited here.

Is EnsureDatabaseExistsAsync the right home? Yes. Provisioning N databases is N calls, and the awkwardness of the DbConnection-shaped signature is a separate concern from the race.

Verification

• ensure_database_is_safe_under_concurrent_callers races 8 concurrent callers at one new database. Confirmed failing against master (verified by disabling only the 1801 catch) and passing here.
• times_out_with_a_clear_message_when_the_database_never_accepts_connections uses an offline database as the reproducible stand-in for "created but refusing logins", and pins the message and inner exception.
• ensure_database_escapes_a_bracket_in_the_database_name covers the identifier escaping.
• Full Weasel.SqlServer suite green: 343 passed, 8 pre-existing skips.
• Weasel.EntityFrameworkCore SQL Server tests green (17) running on the delegating bootstrap.

🤖 Generated with Claude Code