docs(rfc): consumer gate — runtime stop/start of individual queue controllers

[sbalabanov]

This RFC proposes a first-class stop/observe/start primitive for individual queue controllers: halt exactly one controller from taking new messages, observe some condition while it is stopped, then start it again — without stopping the service that hosts it. Motivations are deterministic e2e scenario control (interleaving in-flight messages across controllers) and operational pause of a consuming stage during incidents.

The mechanism is consumer middleware: a decorator installed around every registered controller consults gate state before invoking Process. When the gate is closed, the delivery is parked in-flight — the decorator blocks and periodically extends the visibility timeout, so parked messages never burn retry budget, never hit the DLQ, and are redelivered normally if the process dies. When the gate opens, the delivery proceeds as the same attempt, in partition order.

Gate state lives in a new shared extension at platform/extension/consumergate, with a file-based first implementation usable by both e2e tests and operators. This is a design doc only — no code changes.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}