Re-hydrate claim-check [Blob] properties on a local queue

[prom3theu5]

Fixes #3047.

The bug

A [Blob]-marked message delivered through an in-process durable local queue reaches its handler with the blob property null. ClaimCheckMessageSerializer.Write off-loads the payload and calls Clear(message), nulling the property on the live in-memory message. A durable local queue serializes the envelope on store (DurableLocalQueue.writeMessageData → Serializer.Write) but then re-enqueues that same Envelope instance, and the receive path skips deserialization when envelope.Message != null (HandlerPipeline: if (envelope.Message == null) is false). So ReadFromData/LoadBlobsAsync never run and the off-loaded property is never re-hydrated.

Invisible across a real transport because that path forces a serialize→deserialize round-trip.

The fix

Mirror the EncryptingMessageSerializer precedent: a serializer-decorator must not leave the in-memory message mutated. StoreBlobsAsync still nulls each blob property so the inner serializer omits it from the persisted/wire body, but now returns the off-loaded payloads; Write/WriteAsync/WriteMessage restore them onto the live message (via the same ApplyLoaded routine the receive path uses) in a finally, after the inner serializer has produced the bytes.

The bytes on the bus are unchanged — blob absent, header token present. Only the leaked mutation is undone.

Tests

Adds local_queue_round_trip (CoreTests) with two guards on the durable-local path:

1. the handler must see the re-hydrated body (the bug), and
2. the serialized envelope body must not contain the off-loaded payload (header token only) — so the restore can't silently defeat claim-check.

Verified by temporarily moving the restore before serialization: guard (2) fails as expected, confirming it has teeth.

The existing cross-transport end_to_end_round_trip suite stays green. Full wolverine.slnx builds clean in Release.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Fixes a claim-check mutation bug on durable local queues by restoring offloaded blob properties on the live in-memory message after serialization, while ensuring the serialized envelope body still excludes the blob payload.

Changes:

• Track and restore offloaded blob payloads in ClaimCheckMessageSerializer via try/finally around inner serialization.
• Update blob offload routine to return the captured payloads for later restoration.
• Add durable local-queue regression tests for both string and byte[] blob properties, including assertions that body bytes do not contain the offloaded payload.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Wolverine/Persistence/ClaimCheck/Internal/ClaimCheckMessageSerializer.cs	Restores blob properties after serialization to avoid leaking Clear() mutations into in-process delivery.
src/Testing/CoreTests/Persistence/ClaimCheck/local_queue_round_trip.cs	Adds regression coverage for durable local-queue claim-check behavior and body-payload exclusion.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[prom3theu5]

Follow-up (250bb8e): hardened the restore against a partial off-load failure. Previously the restore finally only wrapped the inner serializer; if the store itself threw after an earlier blob on the same message had already been cleared (e.g. it rejects the 2nd of two blobs), the exception unwound past the finally and left the live message with cleared properties — which would then leak into subsequent in-process handling of the same Envelope.

The off-load now runs inside the same try/finally as the inner write, and StoreBlobsAsync appends each cleared property to a caller-owned list the moment it clears it, so every property cleared before a failure is restored before the exception propagates. Added claim_check_serializer_restore covering the sync and async Write paths (fail on the 2nd store call against a two-blob message, assert both properties come back intact); verified it has teeth by moving the off-load back outside the try.