[jeremydmiller]

Fixes #5120.

Problem

A native batch (BatchMessagesOf<T>().UseDurableInbox()) whose handler fails under a ScheduleRetry policy was logged as rescheduled but never ran again. Its members' inbox rows sat Incoming, attempts 0, no execution_time, owned by the live node, which nothing reclaims until that node restarts.

The batch is a carrier envelope with no inbox row of its own; only its members are persisted. DurableReceiver.MoveToScheduledUntilAsync rescheduled it through ScheduleExecutionAsync, an UPDATE ... where id = @id on the carrier's id. That matched nothing and succeeded silently.

Fix

Batch retries are held in memory. DurableReceiver now schedules a batch carrier's retry in memory, the same way BufferedReceiver schedules everything, and re-enqueues the same carrier when it comes due.

• Its Attempts keeps counting, so the policy runs out and dead letters the batch as a unit instead of retrying forever. Spreading the schedule across the member rows would have rebuilt a fresh carrier at attempt 0 every time.
• The members' rows are untouched: owned by this node while the retry is pending, and recovered from their rows if the node goes away.
• DrainAsync cancels pending batch retries before it releases the members' rows, so a late retry cannot run them alongside the node that picks them up.
• Trade-off: a batch retry pending at the moment of a crash is not persisted. Its members are recovered from their rows, with their attempt count starting over.

An update that matches nothing now warns. The RDBMS inbox (SQL Server, PostgreSQL, MySQL, SQLite) and Oracle now log a warning when ScheduleExecutionAsync updates no row, instead of succeeding silently. RavenDB and Cosmos DB are not covered.

Tests

• SqlServerTests Bug_5120_scheduled_retry_of_a_durable_batch: the reporter's configuration.
  • A batch that fails once is retried and its members settle (red without the fix).
  • A batch that always fails runs exactly 4 times (1 + 3 retries), then is dead lettered and settles.
• SqlServerTests scheduling_an_envelope_with_no_inbox_row_5120: the warning is logged for a missing row and not for an existing one.
• CoreTests durable_batch_scheduled_retry_5120: the carrier is re-executed after its scheduled time; it is never rescheduled through the inbox; a pending retry does not fire after a drain. The first two are red without the fix.
• Full CoreTests: 3742 passed, 0 failed. Full SqlServerTests: 660 passed, 0 failed. dotnet build wolverine.slnx -c Release -f net9.0: clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DCggXgxnG3EBXoR9rrq37U