Stop ingress retry loops during gateway suspension
Changed the shared durable-ingress monitor so suspension pauses drain work, racing claims are released without consuming an attempt, and queued delivery resumes through the existing admission-reopen signal.
openclaw/openclaw · #142064
Messaging reliability fix
Queued channel messages now remain parked while gateway admission is suspended instead of repeatedly entering delivery and generating retry work.
Problem
Messages arriving while the gateway settled accepted work could be reclaimed under new lease tokens and rejected repeatedly with suspension errors. Attempt counters remained unchanged, making the repeated work difficult to detect through normal queue metrics.
Approach
Blocks the ingress pump while suspension admission is closed, requests a drain when admission reopens, and rechecks suspension after awaited claims. A maintainer added a real-SQLite race regression covering one delivery after reopening.
Impact and scope
- Prevents retry storms and redundant claim work while the gateway is intentionally unavailable for new traffic.
- Keeps messages durable and pending during suspension, then resumes them through the existing lifecycle signal.
- Handles the claim-versus-suspension race without spending a delivery attempt or requiring a manual drain.
Validation
- A live baseline reproduced repeated claims during suspension; the candidate kept all 30 sampled rows pending and unchanged before delivering once after resume.
- The added real-SQLite race regression fails on the original behavior and verifies exactly one delivery after reopening with the fix.
- The maintainer merged the authored product fix with a maintainer-authored regression commit; the GitHub-verified merge commit credits Goutam Adwant.