…ound

Serilog 4.4.0 (serilog/serilog#2234) forwards optional sink interfaces —
including ISetLoggingFailureListener — through an OptionalInterfaceForwardingSink
for restricted sinks. That closes the gap where setting RestrictedToMinimumLevel
on a sink wrapped by WriteTo.FallbackChain(...) silently dropped failed batches
instead of routing them to the fallback.

With the minimum Serilog now at 4.4.0, the documentation workaround is obsolete:

- README: replace the "do not set RestrictedToMinimumLevel" gotcha with a note
  that it composes correctly on 4.4.0+; add a migration bullet for the raised
  minimum; bump the 9.0.0 compatibility row to Serilog 4.4.x.
- CHANGELOG: add the raised-minimum breaking-change bullet under 9.0.0.
- FallbackChainOutageTests: convert to a [Theory] and add the
  RestrictedToMinimumLevel case, pinning the upstream fix — the fallback still
  receives post-outage events through the RestrictedSink.

Also updates the remaining dev/runtime package versions to latest.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…log 4.4.0 (#333)

* Replace in-sink failure sink with WriteTo.FallbackChain composition

The in-sink failure sink and EmitEventFailureHandling enum are removed.
Publish failures now always propagate so Serilog's BatchingSink listener
observes them, which is what enables WriteTo.FallbackChain(...) and
WriteTo.Fallible(...) from Serilog core to compose with the RabbitMQ sink.
Diagnostics are written to SelfLog on every failure with no opt-in flag.

Public surface removed:
- EmitEventFailureHandling (enum)
- RabbitMQSinkConfiguration.EmitEventFailure
- WriteTo.RabbitMQ(..., failureSinkConfiguration) overloads
- emitEventFailure / failureSinkConfiguration flat parameters

Migration guidance and a code/JSON example for FallbackChain are added to
README under "Migrating to 9.0.0", including a callout for the Serilog
RestrictedSink listener-forwarding gap that silently breaks FallbackChain
when RestrictedToMinimumLevel is set on the wrapped sink config.

A new integration test (FallbackChainOutageTests) uses Testcontainers.RabbitMq
to drive a real broker outage and assert the fallback file receives the
post-outage events. A LoadTestSample is bundled for manual smoke-testing
the wire-up under load.

* Expose RetryTimeLimit, add IAsyncDisposable, simplify batched-sink registration

- RabbitMQSinkConfiguration.RetryTimeLimit (default 10m, matching Serilog's
  BatchingOptions default) wires through to BatchingSink so callers can tune
  how long a failed batch is retried before it is handed to the registered
  ILoggingFailureListener (the next link in WriteTo.FallbackChain). Exposed
  on the public flat overload as retryTimeLimit; default substitution lives
  in RegisterSink alongside BatchPostingLimit / BufferingTimeLimit.

- RabbitMQSink now implements IAsyncDisposable on net8.0 / net10.0 (gated by
  FEATURE_ASYNCDISPOSABLE, mirroring Serilog core). DisposeAsync awaits the
  client directly without the AsyncHelpers.RunSync bridge; both Dispose paths
  share _disposedValue and are mutually idempotent. netstandard2.0 keeps
  IDisposable only.

- RegisterSink now calls Sink(IBatchedLogEventSink, BatchingOptions,
  LogEventLevel) directly instead of materialising the BatchingSink via
  CreateSink and wrapping it again. Same RestrictedSink -> BatchingSink ->
  RabbitMQSink chain, fewer steps; private-only simplification.

CHANGELOG and README updated. Approved API surface regenerated.

* Bump packages incl. Serilog 4.4.0; retire fixed RestrictedSink workaround

Serilog 4.4.0 (serilog/serilog#2234) forwards optional sink interfaces —
including ISetLoggingFailureListener — through an OptionalInterfaceForwardingSink
for restricted sinks. That closes the gap where setting RestrictedToMinimumLevel
on a sink wrapped by WriteTo.FallbackChain(...) silently dropped failed batches
instead of routing them to the fallback.

With the minimum Serilog now at 4.4.0, the documentation workaround is obsolete:

- README: replace the "do not set RestrictedToMinimumLevel" gotcha with a note
  that it composes correctly on 4.4.0+; add a migration bullet for the raised
  minimum; bump the 9.0.0 compatibility row to Serilog 4.4.x.
- CHANGELOG: add the raised-minimum breaking-change bullet under 9.0.0.
- FallbackChainOutageTests: convert to a [Theory] and add the
  RestrictedToMinimumLevel case, pinning the upstream fix — the fallback still
  receives post-outage events through the RestrictedSink.

Also updates the remaining dev/runtime package versions to latest.

* Fix RetryTimeLimit=Zero being clobbered to the 10-minute default

The documented "TimeSpan.Zero disables retries → immediate fallback" contract was
unreachable. RegisterSink used `RetryTimeLimit == default` as its "unset" sentinel,
and default(TimeSpan) is TimeSpan.Zero — so every Zero (whether omitted or set
explicitly to disable retries) was overwritten with the 10-minute default. Both
public paths were affected, and two tests locked in the wrong behaviour.

Fix distinguishes "unset" from "explicit Zero":

- The flat overload's `retryTimeLimit` parameter is now `TimeSpan?` (default null);
  null resolves to the library default before the config is built, any value —
  including TimeSpan.Zero — is honored.
- Removed the RetryTimeLimit default-substitution block from RegisterSink. The
  property already initializes to DEFAULT_RETRY_TIME_LIMIT at construction, so the
  delegate and direct-config paths keep the 10-minute default while a caller-set
  Zero now survives to BatchingOptions.RetryTimeLimit.

Tests: dropped the RetryTimeLimit=Zero assertion from the batching-defaults test
(Zero is no longer "unset"), added a regression test asserting Zero survives, and
refreshed the stale RegisterSink comments. Public API snapshot regenerated
(retryTimeLimit is now TimeSpan?). CHANGELOG and README updated.

* Clear CodeQL alerts in test/sample code

- cs/dispose-not-called-on-throw (warning, the PR-gating alert): the two
  cross-path dispose idempotency tests called DisposeAsync/Dispose in sequence
  without guaranteeing the second ran if the first threw. Wrapped each in
  try/finally so the sink is always disposed; assertions unchanged.
- cs/path-combine (note): wrapped the fallback file name in Path.GetFileName so
  the second Path.Combine segment is provably relative.

The two cs/catch-of-all-exceptions notes in LoadTestSample are intentional (a
load-test harness must survive a mid-run broker restart) and are left as-is.

* Potential fix for pull request finding 'CodeQL / Call to 'System.IO.Path.Combine' may silently drop its earlier arguments'

* Potential fix for pull request finding 'CodeQL / Missed 'using' opportunity'

* Potential fix for pull request finding 'CodeQL / Generic catch clause'

* Potential fix for pull request finding 'CodeQL / Generic catch clause'

* Remove unused System.IO using in LoadTestSample

The CodeQL catch-narrowing autofixes left `using System.IO;` unused, which
IDE0005 fails under TreatWarningsAsErrors (the buildcheck/format CI step).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>