Bump WolverineFx from 6.36.0 to 6.38.0

[dependabot]

Updated WolverineFx from 6.36.0 to 6.38.0.

Release notes

Sourced from WolverineFx's releases.

6.38.0

Eight issues, no breaking changes.

This is a correctness and operability release. Most of it is one shape of bug — something resolved against the wrong scope, which looked right only because two defaults usually coincide — plus the two remaining halves of recurring-schedule operability.

Multi-store and multi-tenancy

• The multi-tenanted message store no longer swallows batch failures (#​4435). A durable batch spanning several tenants was split across stores, but RetryBlock never rethrows — so a store that refused its share failed silently while the receiver acknowledged the whole batch. Messages no store had accepted were acked and lost. The batch is now split by the resolved store and a failure propagates.

• Natural keys resolve through the store the chain is routed to (#​4439).

• Identity types resolve through the store the chain is routed to (#​4441).

  These two are a matched pair: a saga's natural key and its identity type are facts about the store, not about the application. A modular monolith with an ancillary store per module resolved both against the main store, so a saga in module B was looked up with module A's rules.

• A Wolverine service name reaches JasperFx, so the Event Model canvas stays whole (#​4448). WolverineOptions.ServiceName and JasperFxOptions.ServiceName both name the one running service, but the value only ever travelled one way — so the documented way to name a Wolverine service left the JasperFx side on its default, the entry assembly name. The visible damage was an Event Model canvas splitting in two: Wolverine's source named its model one thing, a store's source named it another, and neither canvas held both halves. It only ever looked correct when a host's assembly name and service name happened to coincide, which is exactly why no test caught it.

Recurring schedules

The remaining core operability gaps from #​4437, which is closed by these two. (Durable last-run state, #​4447, stays closed as not-planned: run state lives in OpenTelemetry, and the operability view belongs in CritterWatch.)

• Non-UTC recurring schedules now record their tracking row (#​4436). Cronos returns each occurrence carrying the schedule's offset, and Npgsql's timestamptz binder refuses any non-zero offset — so every tick of every zoned schedule threw on the bookkeeping write. Delivery was never affected; only the tracking row was missing. Normalizing in RecurringMessageRecord's init accessors fixes it in one place for all four relational providers.

• Occurrences carry their schedule and their firing instant (#​4445). The schedule name already reached the handler span. The occurrence instant did not: ScheduledTime is cleared by the scheduled machinery at fire time, so a handler could only learn which firing it was serving by string-parsing the deduplication id. Occurrences now carry a recurring-occurrence header, surfaced as the wolverine.schedule.occurrence trace tag.

  Metrics also gained a schedule.name tag, so the success, failure and effective-time counters can finally be sliced per cron job. It is read off the envelope header rather than set locally, because the metric tag list is never serialized — an occurrence published on one node and handled on another would otherwise reach the counters with no attribution at all. The occurrence instant is deliberately trace-only: one distinct value per firing would make those series unbounded in cardinality.

• IRecurringScheduleControl.TriggerAsync runs a schedule once, on demand (#​4446). Previously an operator's only option was hand-publishing the message type out of band, which bypasses the occurrence and deduplication machinery entirely. The request is recorded on the schedule's durable tracking row and the agent publishes one occurrence for it on its next pass, so it works from any node — the same reason pause already goes through the store.

  A manual run carries its own deduplication id, so a "run now" issued in the same instant as a scheduled firing is never silently collapsed into it. Triggering a paused schedule is refused: pausing says the schedule must not fire. A trigger is extra rather than a replacement — it leaves the cron cadence and the pending occurrence untouched, and it fires even for a fixed-date schedule whose occurrences have run out.

gRPC

• A code-first gRPC contract can be registered without [WolverineGrpcService] on the interface (#​4396). A contract you do not own — or one carrying only [ServiceContract] — could not be registered at all. AddWolverineGrpc(grpc => grpc.IncludeCodeFirstContract<IMyService>()) now registers it explicitly. Thanks to @​erikshafer for the PR.

6.37.0

Eight issues, one of them breaking.

⚠️ Breaking change

ServiceCapabilities.EventModel is now an EventModelSetDescriptor rather than a single EventModelDescriptor (#​4424). A host can legitimately assemble several Event Models — each store names its own through StoreOptions.EventModelName, and a modular monolith registers an ancillary store per module — and the export used to fold them all into one named for the service, losing a model's name outright and reporting nothing.

This is a compile break for anything reading that property, and the capabilities wire shape changes with it. A consumer that can only render one model asks .Sole, or folds explicitly with .Collapse() and gets a ModelCollapse hotspot recording what it lost. CritterWatch consumes this shape and has the equivalent fold still to follow.

Everything else in the public surface is additive.

Event Modeling

• The Automation rule is derived from the model's own links (#​4419). FinishModel carried a private copy of the cross-slice join; it is re-based on EventModelDescriptor.Links, so the pattern Wolverine derives and the arrow a viewer draws cannot disagree. A slice triggered by another slice's event through TriggerType — not only CommandType — is now classified too.
• ReadsFrom is split out of ReadModelTypes (#​4419). [ReadModel] and [Entity] parameters are things a slice reads; IStorageAction<T> returns are what it produces. They shared one list, which meant the Automation input edge — Event → Read Model → ⚙ Command — could not be drawn at all.
• Each derived source stamps its own Origin (#​4425). Wolverine registers two sources on the Derived rung, so a disagreement between them used to render as Derived claims X; Derived claims Y, naming neither file. It now reads event-model://wolverine against event-model://wolverine-http.

Native AOT

• codegen write emits its own [DynamicDependency] rooting (#​4426). Every Native AOT application had to hand-write a rooting block covering the generated registry, every generated handler, every handler class, every message type, and MessageRouter<T>/EmptyMessageRouter<T> closed over each one. Codegen now emits an AotRoots companion anchored by [ModuleInitializer] — an unconditional ILC root — so there is no app-side code at all. Verified by a real PublishAot binary booting and dispatching with the hand-written roots deleted.

Bug fixes

• An outgoing envelope recovered from an ancillary store is acknowledged there (#​4417). Envelope.Store does not survive persistence, so the acknowledgement fell back to the main store — the ancillary row survived, and the message was recovered, sent and handled again on every restart. Thanks to @​raypet-visma for the diagnosis and the fix sketch.
• Kafka consumer teardown is bounded (#​4422). _consumer.Close() is a synchronous P/Invoke that can block forever against a degraded broker, so IHost.StopAsync never completed — observed wedged 20+ minutes, past both DrainTimeout and ShutdownTimeout. It now runs under the drain budget on a dedicated thread, and an abandoned teardown suppresses the consumer Dispose rather than destroying a handle another thread still owns.
• A handler-class OnException returning OutgoingMessages compiles again (#​4416). It failed code generation with "Frame chain is being re-arranged" while the same method on a middleware class worked. Thanks to @​uniquelau for the report and for locating the exact divergence. The error-handling docs gained an example of using the hook to publish messages when the original message fails.

Build & dependencies

• JasperFx 2.69.3, with Marten 9.35.0, Polecat 5.29.0, Fisher 1.10.0 and Weasel 9.32.0 on that line (#​4421). The committed codegen write output is regenerated and a CICodegenDrift gate now guards it — meaningful only now that the emitted statement order is deterministic. Regenerating surfaced real staleness rather than the expected reordering: six orphaned handler files and four missing registry files.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)