Oracle: run the durability agent through the shared batching mechanics

[jeremydmiller]

Supersedes #3615. Fixes #3614.

Builds on @pedroandrade03's diagnosis and carries their test coverage forward — retargeted at this design and extended with end-to-end assertions. Thank you for the careful root-cause work on this one.

Why not the approach in #3615

#3615 gave Oracle a provider-specific IDatabaseOperationBatchExecutor hook, then repaired the already-compiled SQL with Regex.Replace(sql, "@(?=[A-Za-z_])", ":") and sql.Split(';'). That works, but it leaves Oracle on its own execution path forever and does string surgery on SQL that should never have been generated in the wrong shape to begin with.

Two of the three things it fixed were already solved in Weasel and simply not wired up:

• The @ markers came from OracleMessageStore.ToCommandBuilder() returning new Weasel.Core.DbCommandBuilder(...), whose constructor hardcodes '@'. Weasel.Oracle.CommandBuilder has used ':' all along — but it's a sibling of DbCommandBuilder, not a subclass, so it couldn't be returned where IMessageDatabase expects one.
• The Guid → RAW(16) conversion already existed in Weasel.Oracle.CommandBuilder.

The third thing is real and unavoidable: ODP.NET cannot execute several statements from one command. Verified directly against 23.7.0:

CanCreateBatch = False
CreateBatch threw: NotSupportedException

What this does instead

Teaches the shared batching mechanics about statement boundaries, and lets each provider decide what a boundary means. Paired with JasperFx/weasel#390 (Weasel 9.19.0).

DatabaseOperationBatch now marks a boundary before each operation and executes whatever CompileCommands() returns:

• Every provider except Oracle: StartNewCommand() is a no-op, CompileCommands() returns a single command holding every statement, and behaviour is byte-for-byte what it was.
• Oracle: returns Weasel's OracleDbCommandBuilder, which emits : markers, sets BindByName, types parameters through OracleProvider, and splits into one OracleCommand per statement.

No public API change — IMessageDatabase.ToCommandBuilder() still returns DbCommandBuilder; Oracle just returns an Oracle-shaped one.

Three things per-operation splitting would have missed

1. Four operations write more than one statement each — both ReleaseOrphanedMessages* variants, MoveReplayableErrorMessagesToIncomingOperation (insert + delete), and PersistNodeRecord (one insert per event). Splitting per operation isn't enough, so those now mark their internal boundaries explicitly.
2. :replayable is bound by two different statements. AddNamedParameter finds-or-adds, so the parameter exists exactly once; any index-range slicing binds it to one command and the other fails at execution. Weasel now also matches parameters by name reference (whole-token, so :p1 isn't mistaken for :p11).
3. MoveReplayableErrorMessagesToIncomingOperation hardcoded @replayable in its SQL text, so the marker abstraction leaked regardless of provider. It reads builder.ParameterPrefix now.

Also documented

OracleMessageStore.EnqueueAsync is a no-op that silently drops its operation. The comment claimed it was about @ parameter syntax; the real reason is that OracleMessageStore implements IMessageDatabase directly rather than deriving from MessageDatabase, so it has no DatabaseBatcher. The durability agent doesn't use that path — it builds its own DatabaseOperationBatch — and the one caller that does (OracleNodePersistence.LogRecordsAsync) works around it with direct inserts. Comment corrected, behaviour unchanged; worth its own issue.

Validation

Red-baselined: reverting only ToCommandBuilder() makes all three new end-to-end recovery tests fail with ORA-03405, then pass with the fix.

Suite	Result
OracleTests (live Oracle, full suite)	109/109
PersistenceTests	77/77
PostgresqlMessageStoreTests	49/49
SqliteMessageStoreTests	48/48
SqlServerTests (store + durability)	160/160
dotnet build wolverine.slnx -c Release	clean

New coverage:

• oracle_durability_command_translation — Pedro's cases, retargeted at the real durability operations rather than internal string helpers: bind markers, per-statement splitting, per-command parameter ownership, Guid/bool/DateTimeOffset typing.
• oracle_durability_agent_recovery — runs the real DurabilityAgent.buildOperationBatch() set against a real Oracle database, and asserts orphaned messages are released and replayable dead letters move back to the inbox.

🤖 Generated with Claude Code