Exempt Wolverine's Envelope from blanket multi-tenant doc policies (supersedes #2566 / marten#4268)

[jeremydmiller]

Supersedes #2566. Same change set, opened against the JasperFx repo so it can be merged directly. Closes #2566 once this lands.

Original reproducer authored by @erdtsieck (commit preserved with their authorship). Many thanks for the targeted repro — that's what made the root cause obvious.

The bug

Wolverine's internal Envelope outbox document silently inherited blanket Marten document policies (AllDocumentsAreMultiTenanted / AllDocumentsAreMultiTenantedWithPartitioning). When two stores share a database schema and one applies such a policy:

• Store A (with the blanket policy) creates mt_doc_envelope as conjoined + hash-partitioned by tenant_id.
• Store B (without it, or with a different one) describes Envelope as single-tenant. Its first SaveChangesAsync triggers a Marten schema diff that emits an impossible migration:

alter table … drop constraint pkey_mt_doc_envelope_id_tenant_id CASCADE;
alter table … add CONSTRAINT pkey_mt_doc_envelope_id PRIMARY KEY (id);  -- 0A000
alter table … drop column tenant_id;

Postgres rejects the ADD PRIMARY KEY (id) step on a still-partitioned table with 0A000: unique constraint on partitioned table must include all partitioning columns — exactly the error from marten#4268. Async projections hide the conflict; flipping to inline + EnableSideEffectsOnInlineProjections surfaces it on the first append.

The fix

In MartenOverrides.Configure:

options.Schema.For<Envelope>()
    .SingleTenanted()
    .DoNotPartition();

The _alterations registered by Schema.For<T>() run on the DocumentMappingBuilder<T> after applyPolicies and applyPostPolicies during DocumentMapping construction, so blanket ForAllDocuments policies cannot override them. Marten itself uses the same pattern internally to exempt DeadLetterEvent.

We considered an IDocumentPolicy approach (lazier — wouldn't pre-register Envelope at all). It loses ordering: Policies.OnDocuments(...) always Insert(0)s into _policies, so a later-registered blanket policy overwrites the per-type fix. Schema-builder alterations are the only public Marten hook that consistently wins. No Marten changes needed for this PR.

Verification

Bug_4268 reproducer	1/1 pass (was failing pre-fix with the exact marten#4268 error)
MartenTests subset (Bugs + MartenOutbox + publish_messages + AncillaryStores)	52/52 pass
Wolverine CoreTests	1346/1346 pass

🤖 Generated with Claude Code