Gateway: durable turn idempotency and message-index reservation #178

Problem

A process-local conversation lock cannot protect retries across gateway instances or cancellation during a partially applied turn. Turn identity and message indexes must commit atomically with facts.

Evidence

Source: 5c1f313379a5cb2995a43a66ddba0b5cc9798b7f (inspected 2026-10-03). These are source findings; the acceptance scenarios below still need implementation and execution.

• gateway/src/main.rs:762: A process-local conversation lock guards the turn path.
• gateway/src/main.rs:940: Chat-mode uses the local per-conversation lock.

Acceptance criteria

• Store the turn idempotency key/result and monotone message indexes in the same engine transaction as its facts.
• Reserve/commit in short stages around extraction; do not hold the conversation lock across the model call. Own cancellation/shutdown/drain behavior with bounded tasks.
• Test two gateway instances retrying the same turn and cancellation before/during/after commit; exactly one result, unique indexes and no lost replacement.
• Use the per-tenant engine deployment model; shared-gateway isolation inputlayer/inputlayer-platform#18 is not a prerequisite. Pass Performance: baseline and mandatory pre-PR regression pipeline #163 under same- and different-conversation contention.

Delivery

Plan item: T04. R3 - Streaming SDK subscriptions.

Dependencies / related work: #170; contributes #131, inputlayer/inputlayer-symbolic#142 and inputlayer/inputlayer-symbolic#150.

Contributes to #131; completing this slice alone does not close the broader issue.