Stratara.EventSourcing.Pipeline.CommandAudit 4.0.4

• net10.0

  • JetBrains.Annotations (>= 2026.2.0)
  • Stratara.Abstractions (>= 4.0.4)

Three findings from a proof of concept of an alternative execution model, each fixed on the shipped
path. A message a handler cannot take is now redelivered a bounded number of times and then
dead-lettered on both brokers instead of being dropped on one of them; an opt-in closes the window
in which a committed fact could be lost between the commit and its publication; and a version
collision is a concurrency conflict on every supported database provider, not only on PostgreSQL.
Additive on every published surface, with one operator step on RabbitMQ: the worker queues change
name and type, and the old ones are deleted once drained.

### Added

- `Outbox:DurableBundles` (`OutboxOptions.DurableBundles`, default `false`): an event bundle is
 written to the outbox table in the transaction that commits its events, published after the
 commit, and removed once the bus has accepted it — so a process that ends between the commit and
 the publish no longer loses the bundle for every subscription. `IEventBundleOutboxDispatcher`
 gains `StoresBundlesWithCommit` and `StoreEventBundleAsync`, and `IOutboxRepository` an
 `AddAsync(Guid id, …)` overload, all default-implemented so a consumer's own implementations keep
 compiling and keep bus-first. `AddOutboxDispatcher()` now binds the `Outbox` section when the host
 carries a configuration. Log event `106_108` records a stored copy the bus accepted but the
 framework could not remove. The default path is unchanged; the specification now names its window.

- `IStoreConflictDetector` in `Stratara.Abstractions.EventSourcing`: recognises a database
 provider's refusal of a duplicate stream version, so the event source can surface it as a
 `ConcurrencyException` on that provider. `AddNpgsqlWriteDbContextFactory<T>()` registers the
 PostgreSQL detector and `AddStrataraTestingEventStore<T>()` the SQLite one; detectors accumulate,
 so a host on another provider adds its own without displacing the framework's. A host that
 registers its write context without `AddNpgsqlWriteDbContextFactory<T>()` gets no detector and
 no longer sees a `ConcurrencyException` on a version collision: it switches to that registration,
 or registers an `IStoreConflictDetector` of its own that recognises PostgreSQL's SQL state
 `23505` in the exception chain (the framework's implementations are not public).

- `MessageRetryOptions` (`Stratara.Abstractions.Messaging`, section `MessageRetry`):
 `MaxDeliveryAttempts` (default 3) and `MaxConflictRequeues` (default 100), bound and validated by
 `AddMessaging()` and by both `AddAzureServiceBus*` registrations. `MessageRetryPolicy` is the
 decision both transports apply. Log event `108_110` and counter `messaging.dead_lettered`
 (tags `messaging.topic`, `messaging.subscription`, `reason`) record every dead-lettering; `108_111`
 warns when a Service Bus subscription's `MaxDeliveryCount` is below the bounds.

### Changed

- A save now maps and signs its event bundle before the transaction opens, so a save with no
 session context — or a signer that fails — fails before anything is committed rather than after
 the commit with the events stranded unpublished.
- **RabbitMQ worker subscriptions are quorum queues with a dead-letter queue, under a new name.**
 A message whose handler throws is redelivered up to `MaxDeliveryAttempts` times (a concurrency
 conflict up to `MaxConflictRequeues` times) and then moved to `<subscription>.dead-letter`; it was
 rejected and dropped by the broker before (conflicts were requeued without bound). Because a
 classic queue cannot be redeclared as a quorum queue, the worker queue is now
 `<subscription>.v2`. **Rollout:** deploy — old and new consumers share the exchange and both
 receive every message — then delete the old `<subscription>` queue once it is drained, or it fills
 forever. Needs RabbitMQ 3.8+.
- **Azure Service Bus applies the same bounds.** A handler failure is abandoned for redelivery until
 `MaxDeliveryAttempts` and then dead-lettered with reason `failure` (it was dead-lettered on the
 first failure with the exception type as reason); a conflict is dead-lettered by the framework
 past `MaxConflictRequeues` with reason `conflict` (it was left to the broker's `MaxDeliveryCount`).
 Set the subscription's `MaxDeliveryCount` at least one above the larger bound.
- `AddAzureServiceBus` and `AddAzureServiceBusWithManagedIdentity` also register a
 `ServiceBusAdministrationClient` (try-add) for the advisory limit check.

### Fixed

- The `MediatorCommandWorker` remark said a failing command was dead-lettered; on RabbitMQ it was
 dropped. It is now dead-lettered on both brokers, and the remark and the
 `BusEnvelopeIntegrityMode.Strict` remark say what happens.
- A duplicate stream version on the SQLite test store (`Stratara.Testing.EntityFrameworkCore`) now
 surfaces as `ConcurrencyException`, as it does on PostgreSQL, instead of a bare
 `DbUpdateException`. A test that asserted the old exception type needs the new one.