Make EventSubscriptionAgentFamily.DatabaseKeyOf and TenantNeutralKeyOf public (GH-3819)

[jeremydmiller]

Closes #3819.

EventSubscriptionAgentFamily.DatabaseKeyOf is the key group affinity distributes event-subscription agents on. It was internal, so anything outside Wolverine that wants to reason about agent placement per database — an admin view, a readiness probe, a test asserting co-location — had to re-implement the agent URI grammar.

The drift risk is already real inside this repo

MartenTests/MultiTenancy/blue_green_version_bump_assignment.cs carried a verbatim copy:

// The (type, name, databaseId) prefix of an agent URI, mirroring the internal
// EventSubscriptionAgentFamily.DatabaseKeyOf that group affinity keys on.
private static string DatabaseKeyOf(Uri uri) =>
    uri.Segments.Length >= 3
        ? $"{uri.Host}/{uri.Segments[1].Trim('/')}/{uri.Segments[2].Trim('/')}"
        : uri.AbsoluteUri;

…while its siblings (sharded_two_databases_affine_colocation.cs, durability_projection_affinity_real_stores.cs) call the real thing. That is the failure mode worth naming: a copy asserting co-location can silently stop matching the key the distribution actually groups on, and the test would keep passing while proving nothing. The copy is deleted here and delegates to the real method.

Changes

• DatabaseKeyOf → public, with XML docs replacing the // comment (matching DatabaseIdOf right above it).
• TenantNeutralKeyOf → public, as the issue suggests in the same pass: it is the supersession relation's key, it already carried full XML documentation written as if it were public, and CoreTests reaches for it too.
• The duplicated private helper in blue_green_version_bump_assignment.cs now calls the public method.

Consistent with the existing position that consumers should not hand-build event-subscription agent URIs but call the public helpers — this is the read side of the same rule.

Verification

• CoreTests event_subscription_family*: 24 passed
• MartenTests blue_green_version_bump_assignment: 2 passed — and since the deleted copy was byte-identical to the real implementation, that confirms no behaviour change
• Full wolverine.slnx Release build clean, 0 warnings

Raised from marten#5170, whose reporter runs a 512-shard-database deployment.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WHAuhdWS3XeAk16swV9G8m