Stop shattering agent Uris that contain a comma (GH-3733)

[jeremydmiller]

Closes #3733.

The defect

AgentsStarted, StartAgents, AgentsStopped and StopAgents all round-trip their Uri[] payload as a comma-joined string. A comma is a legal URI character — RFC 3986 lists it as a sub-delim, permitted unescaped in a path segment — and there is no escaping here, so one agent URI containing a comma is split into fragments and new Uri(fragment) throws.

Agent URIs embed operator- and tenant-supplied strings. An event-subscription URI is event-subscriptions://marten/main/<host>.<db>/<projection>/all/v<n>/<tenant>, so a tenant id with a comma in it reaches this code without anyone doing anything exotic.

Because the read side built the whole array in one LINQ projection, the throw took out the entire batch. AgentsStarted is the reply that confirms an agent start, and AssignAgents.ExecuteAsync treats a null response as "no confirmation" and moves on — so one comma-bearing agent voided the confirmation for every agent in its chunk. On #3698's cluster that is exactly the state that looked like a stall: the leader's own local starts need no reply and kept landing, while remote chunks went unconfirmed.

The fix

Newline is the delimiter — not legal unescaped in a URI, and Uri.ToString() never emits a bare one.

The comma stays the default on the wire. It is what every 6.24.0-and-earlier node both writes and reads, and a rolling upgrade has to keep working in both directions. Only a payload that actually contains a comma — the case that was already broken on both sides — switches to the newline form, and it announces itself with a leading newline. The two formats can never be confused, because a legacy payload always begins with a URI scheme character.

Without that, an upgraded leader sending \n-joined StartAgents to a not-yet-upgraded follower would break agent starts that work today, which is a worse trade than the bug being fixed.

Entries are also parsed one at a time now, so an unreadable one names itself and the full payload rather than surfacing as a bare Invalid URI: The format of the URI could not be determined. with no way to tell which agent, or which node, was responsible.

Sibling audit

As suggested on the issue, checked the other ISerializable agent commands. StartAgent and StopAgent carry a single URI, CheckAgentHealth an empty payload, and NodeRecord is JSON. None share the pattern.

Tests

In agent_command_serialization:

• a [Theory] over three comma-bearing shapes (comma in a tenant id, comma-space, and the production case — two agents where only one has a comma, previously voiding both), asserted across all four commands;
• the no-comma payload still produces the byte-identical legacy wire format;
• a legacy comma-joined payload still reads;
• an unreadable entry names itself and the payload.

All green, full wolverine.slnx Release build clean.

🤖 Generated with Claude Code