[jeremydmiller]

Closes #5123.

The first of two coarse PRs from a durable inbox compliance effort. A new Bobcat rig (src/Testing/DurableComplianceRig, outside both solutions and CI) exercised the durable inbox end to end across PostgreSQL, SQL Server, Marten and EF Core over local, database, RabbitMQ and SQS endpoints. Every fix here has a regression test in a normal CI test project that was red before the fix and green after, and the rig specs that found it now pass. Groups A and B (listener lifecycle and durable batching) follow in a second PR.

Transactions and idempotency

• R1: a handler using the documented outbox pattern on PostgreSQL could kill another handler's transaction. MessageContext.ClearState() disposed the enlisted DatabaseEnvelopeTransaction, which disposed a DbTransaction its owner had already finished, and Npgsql reuses that object on the pooled connector. DatabaseEnvelopeTransaction no longer disposes a transaction it does not own.
• R2 / E1: eager idempotency committed a "handled" placeholder before the handler ran. A failed handler that was requeued came back as a duplicate of itself and was dead-lettered, and a rollback left the envelope flags set, so idempotency was lost after a retry. The placeholder is now written inside the handler's own transaction (Marten, EF Core, Polecat, Fisher), and the flags are restored on rollback.
• F25: EF Core set Status = Handled before its own commit, so a failed commit followed by Discard left the row Incoming. The status is now set only after the commit succeeds.
• E3: EF Core with a database per tenant never marked the inbox row inside the tenant transaction. It does now.
• F13: a handler that called ReScheduleAsync and then returned normally had its scheduled row overwritten to Handled, losing the retry. It isn't now.

Logical deduplication

• D1: on the plain RDBMS stores, a [Deduplicated] claim stranded by a crash mid-handler made inbox recovery discard the message for the whole window. Claims now record the envelope that took them (envelope_id, a new nullable column), so the same envelope can take its claim over and a different one is still refused.
  • This comes through a new opt-in IEnvelopeAwareDeduplicationStore; IDeduplicationStore is unchanged.
  • A table without the new column keeps the old behaviour and logs one warning, so upgrading never breaks an app running AutoCreate.None.
• D2: Envelope.DeduplicationId did not cross RabbitMQ, or any broker built on the generic EnvelopeMapper or the MQTT mappers. Those mappers now map it.

GH-5123

• Duplicates inside one batch: two copies of one envelope in a single batch made the RDBMS stores rethrow the raw provider exception. A single store then paused the listener, and a store per tenant tripped the tenant write brake and looped. The batch insert now reports it as DuplicateIncomingEnvelopeException, as RavenDB already did, across PostgreSQL, SQL Server, MySQL, SQLite and Oracle. Oracle's batch insert, which committed everything but the failing statement, is now all-or-nothing.
• Quorum queues: on RabbitMQ 4.2.5 a requeueing reject, a requeueing nack and a channel close all spend the delivery limit, so switching to nack, as suggested in the issue, would not help. Added:
  • an opt-in x-delivery-limit for queues Wolverine declares: .DeliveryLimit(n) per listener, DeliveryLimitForDurableQuorumQueues(n) per transport. Nothing changes by default;
  • a startup warning for a durable listener on a quorum queue that Wolverine declared without a limit;
  • a new docs section, "Quorum Queues and the Durable Inbox".
• Defer ordering: RabbitMqEnvelope.DeferAsync now publishes the copy before it acks the original.

CI

• CISqlServer had outgrown the 20 minute cap: 658 tests and about 2300s of test time, against 405 tests and 1367s on Aug 26. It is now split by namespace like CIPolecat: CISqlServerTransport, plus CISqlServer as the catch-all.
• SqlServerMessageStore_with_IdAndDestination_Identity dropped and rebuilt its schema before every test (314s in CI). It now does that once per process.

Local verification

• dotnet build wolverine.slnx -c Release -f net9.0: clean.
• The full projects each lane touched passed. The only failures were known flakes that passed on rerun.
• The combined branch's local gate finished CoreTests (3754/0) and PostgresqlTests (909 passed, 2 flakes that passed on rerun). It was then stopped to free the machine, and CI runs the rest.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DCggXgxnG3EBXoR9rrq37U