Re-attach sender wire tap to recovered envelopes (GH-3263)

[jeremydmiller]

Closes #3263

Problem

An IWireTap registered on a sending endpoint (AllSenders(x => x.UseWireTap(...))) never fires RecordSuccessAsync for a scheduled message sent to a transport that does not support native scheduled send (e.g. Kafka). The user sees the send-side audit log for an immediate publish, but not for a ScheduleAsync message.

Root cause

Envelope.WireTap is an in-memory-only reference — it is not serialized. The normal send path stamps it from endpoint.WireTap in MessageRoute.CreateForSending, which is why immediate sends tap correctly.

But any envelope that is persisted and later recovered comes back with WireTap == null, and the recovery code rebuilds the sender/serializer without re-attaching the tap:

• Scheduled sends (the issue): a scheduled send to a non-native-scheduling transport is wrapped into a durable "scheduled-envelope", persisted, and later recovered + forwarded by ScheduledSendEnvelopeHandler → MessageContext.ForwardScheduledEnvelopeAsync. The recovered inner envelope has no wire tap.
• Durable outbox recovery (same defect, broader trigger): RecoverOutgoingMessagesCommand loads persisted outgoing envelopes after a restart / broker outage and enqueues them directly — these also have no wire tap.

Fix

Re-attach the wire tap from the resolved sending endpoint in both recovery paths:

envelope.WireTap ??= envelope.Sender.Endpoint.WireTap;       // ForwardScheduledEnvelopeAsync
envelope.WireTap ??= _sendingAgent.Endpoint.WireTap;          // RecoverOutgoingMessagesCommand

??= so an in-memory (non-recovered) forward keeps any existing tap. This mirrors exactly what MessageRoute already does on the normal send path.

Tests

Two focused CoreTests reproductions (Bug_3263_wire_tap_on_scheduled_send) that simulate the durable round trip (serialize → recover → forward / enqueue) against a stub sender configured with UseWireTap:

1. wire_tap_fires_for_scheduled_send_after_durable_recovery
2. wire_tap_fires_for_recovered_outgoing_message

Both fail without the fix (asserted by reverting) and pass with it. The existing wire-tap and durability suites stay green. No broker/DB required.

🤖 Generated with Claude Code