fix: harden dependencies and downstream delivery

gateway/internal/inbound/server_test.go

@@ -302,6 +302,43 @@ func TestSubmitResponsePrecedesQueuedFailureReceipt(t *testing.T) {
 	}
 }
 
+func TestReceiptWithoutOriginalSequenceIsUnrecoverable(t *testing.T) {
+	resetDownstreamRegistry()
+	defer resetDownstreamRegistry()
+
+	result, err := PushReceiptWithResult(DownstreamReceipt{
+		DeliveryID: "delivery-history",
+		Account: "100001",
+		MessageID: "MSG-HISTORY",
+		ReceiptStatus: "undelivered",
+	})
+	if err != nil {
+		t.Fatalf("push receipt: %v", err)
+	}
+	if result.Sent || result.Retryable || result.ReasonCode != "MISSING_SUBMIT_SEQUENCE_ID" {
+		t.Fatalf("unexpected result: %+v", result)
+	}
+}
+
+func TestRecoverableReceiptWaitsForClientConnection(t *testing.T) {
+	resetDownstreamRegistry()
+	defer resetDownstreamRegistry()
+
+	result, err := PushReceiptWithResult(DownstreamReceipt{
+		DeliveryID: "delivery-retry",
+		Account: "100001",
+		MessageID: "MSG-RETRY",
+		SubmitSequenceID: 77,
+		ReceiptStatus: "delivered",
+	})
+	if err != nil {
+		t.Fatalf("push receipt: %v", err)
+	}
+	if result.Sent || !result.Retryable || result.ReasonCode != "CLIENT_DISCONNECTED" {
+		t.Fatalf("unexpected result: %+v", result)
+	}
+}
+
 func TestInboundServerNegotiatesCMPP2AndUsesAuthenticatedAccountForSubmit(t *testing.T) {
 	resetDownstreamRegistry()
 	defer resetDownstreamRegistry()
@@ -571,8 +608,10 @@ func TestRecoverPendingCandidatesWritesWaitingConnectionStatus(t *testing.T) {
 			_ = json.NewEncoder(w).Encode([]pendingDelivery{{
 				ID:           "delivery-1",
 				DeliveryType: "receipt",
-				Payload:      json.RawMessage(`{"messageId":"MSG-404","phoneNumber":"13800000001","receiptStatus":"delivered"}`),
+				Payload:      json.RawMessage(`{"account":"100010","messageId":"MSG-404","submitSequenceId":77,"phoneNumber":"13800000001","receiptStatus":"delivered"}`),
 			}})
+		case "/api/gateway/events/downstream/failed":
+			w.WriteHeader(http.StatusOK)
 		case "/api/gateway/events/downstream/recovery-status":
 			w.WriteHeader(http.StatusOK)
 		default: