fix: harden upstream and downstream receipt delivery

gateway/internal/inbound/server_test.go

@@ -549,6 +549,41 @@ func TestRecoverableReceiptWaitsForClientConnection(t *testing.T) {
 	}
 }
 
+func TestReceiptWaitsUntilCurrentSubmitResponseHasBeenWritten(t *testing.T) {
+	resetDownstreamRegistry()
+	defer resetDownstreamRegistry()
+
+	conn := &cmpp.Conn{}
+	session := &downstreamSession{
+		messageID: "MSG-LONG-1",
+		account:   "100001",
+		conn:      conn,
+	}
+	downstreamRegistry.Lock()
+	downstreamRegistry.byMessageID[session.messageID] = session
+	downstreamRegistry.byAccount[session.account] = session
+	downstreamRegistry.byConn[conn] = session
+	downstreamRegistry.Unlock()
+
+	release := beginDownstreamSubmitBarrier(conn)
+	result, err := PushReceiptWithResult(DownstreamReceipt{
+		DeliveryID:    "delivery-long-failed",
+		Account:       session.account,
+		MessageID:     session.messageID,
+		ReceiptStatus: "undelivered",
+	})
+	if err != nil {
+		t.Fatalf("push guarded receipt: %v", err)
+	}
+	if result.Sent || !result.Retryable || result.ReasonCode != "SUBMIT_RESPONSE_PENDING" {
+		t.Fatalf("unexpected guarded result: %+v", result)
+	}
+	release()
+	if downstreamSubmitResponsePending(conn) {
+		t.Fatal("submit response barrier remained active after release")
+	}
+}
+
 func TestInboundServerNegotiatesCMPP2AndUsesAuthenticatedAccountForSubmit(t *testing.T) {
 	resetDownstreamRegistry()
 	defer resetDownstreamRegistry()
@@ -1058,6 +1093,9 @@ func resetDownstreamRegistry() {
 	}
 	downstreamAckRegistry.items = make(map[string]*downstreamAckTracker)
 	downstreamAckRegistry.Unlock()
+	downstreamSubmitBarrier.Lock()
+	downstreamSubmitBarrier.byConn = make(map[*cmpp.Conn]int)
+	downstreamSubmitBarrier.Unlock()
 }
 
 func reserveTCPAddr(t *testing.T) string {