perf: expand gateway capacity and prevent receipt replay

gateway/internal/upstream/connection.go

@@ -1,6 +1,7 @@
 package upstream
 
 import (
+	"cmpp-platform/gateway/internal/protocollog"
 	"cmpp-platform/gateway/internal/queue"
 	"context"
 	"fmt"
@@ -16,24 +17,38 @@ import (
 // the connection must wake pending submitters before scheduling pool recovery.
 
 type connection struct {
-	channelID  string
-	config     queue.UpstreamConfig
-	index      int
-	pool       *connectionPool
-	apiBaseURL string
-	httpClient *http.Client
+	channelID            string
+	config               queue.UpstreamConfig
+	index                int
+	pool                 *connectionPool
+	apiBaseURL           string
+	httpClient           *http.Client
+	protocolLogPublisher interface {
+		Publish(context.Context, protocollog.Event) error
+	}
+	gatewayInstanceID string
+	eventPublisher    interface {
+		PublishReceipt(context.Context, queue.ReceiptEvent) error
+		PublishUplink(context.Context, queue.UplinkEvent) error
+	}
 
-	mu               sync.Mutex
-	sendMu           sync.Mutex
-	client           *cmpp.Client
-	window           chan struct{}
-	pending          map[uint32]chan submitPartResponse
-	tracker          map[uint64]queue.SubmitCommand
-	longUplink       map[string]*longUplinkAssembly
-	readOnce         sync.Once
-	closed           bool
-	heartbeatCancel  context.CancelFunc
-	heartbeatPending map[uint32]time.Time
+	mu                  sync.Mutex
+	sendMu              sync.Mutex
+	client              *cmpp.Client
+	window              chan struct{}
+	windowLimit         int
+	draining            bool
+	retired             bool
+	lastSubmitRTT       time.Duration
+	consecutiveFailures int
+	cooldownUntil       time.Time
+	pending             map[uint32]chan submitPartResponse
+	tracker             map[uint64]queue.SubmitCommand
+	longUplink          map[string]*longUplinkAssembly
+	readOnce            sync.Once
+	closed              bool
+	heartbeatCancel     context.CancelFunc
+	heartbeatPending    map[uint32]time.Time
 }
 
 type submitPartResponse struct {
@@ -161,6 +176,14 @@ func (c *connection) identity() string {
 	return fmt.Sprintf("%s-%d", c.channelID, c.index)
 }
 
+func (c *connection) retire() {
+	c.mu.Lock()
+	c.draining = true
+	c.retired = true
+	c.mu.Unlock()
+	c.handleConnectionLoss(fmt.Errorf("connection retired after drain"))
+}
+
 func (c *connection) close() {
 	c.handleConnectionLoss(fmt.Errorf("connection closed"))
 }
@@ -191,7 +214,7 @@ func (c *connection) handleConnectionLoss(err error) {
 		default:
 		}
 	}
-	if c.pool != nil {
+	if c.pool != nil && !c.retired {
 		status := "disconnected"
 		if c.pool.countActiveConnections() > 0 {
 			status = "reconnecting"