security: check for channel closures to prevent busy-loops.

Move notice observer before channel send.

auth.go

@@ -74,7 +74,10 @@ func (m *AuthManager) routeInbox() {
 		select {
 		case <-m.ctx.Done():
 			return
-		case msg := <-m.inbox:
+		case msg, ok := <-m.inbox:
+			if !ok {
+				return
+			}
 			challenge, err := envelope.FindAuthChallenge(msg.Data)
 			if err != nil {
 				continue
@@ -116,7 +119,10 @@ func (m *AuthManager) handleEvents() {
 		select {
 		case <-m.ctx.Done():
 			return
-		case ev := <-m.events:
+		case ev, ok := <-m.events:
+			if !ok {
+				return
+			}
 			if ev.Kind == EventDisconnected {
 				m.mu.Lock()
 				m.challenge = ""

notice.go

@@ -55,21 +55,24 @@ func (h *NoticeHandler) route() {
 		select {
 		case <-h.ctx.Done():
 			return
-		case msg := <-h.inbox:
+		case msg, ok := <-h.inbox:
+			if !ok {
+				return
+			}
 			message, err := envelope.FindNotice(msg.Data)
 			if err != nil {
 				continue
 			}
 			now := time.Now()
+			h.envoy.Observer().Record(msg.URL, NoticeReceived{
+				Message: message,
+				At:      now,
+			})
 			h.notices <- Notice{
 				Peer:      msg.URL,
 				Message:   message,
 				Timestamp: now,
 			}
-			h.envoy.Observer().Record(msg.URL, NoticeReceived{
-				Message: message,
-				At:      now,
-			})
 		}
 	}
 }

publish.go

@@ -170,7 +170,10 @@ func (p *EventPublisher) routeInbox() {
 		select {
 		case <-p.ctx.Done():
 			return
-		case msg := <-p.inbox:
+		case msg, ok := <-p.inbox:
+			if !ok {
+				return
+			}
 			eventID, accepted, message, err := envelope.FindOK(msg.Data)
 			if err != nil {
 				continue
@@ -204,7 +207,10 @@ func (p *EventPublisher) handleEvents() {
 		select {
 		case <-p.ctx.Done():
 			return
-		case ev := <-p.events:
+		case ev, ok := <-p.events:
+			if !ok {
+				return
+			}
 			switch ev.Kind {
 			case EventConnected:
 				p.mu.Lock()