fix(eventstream): M9 broker leaks fd + goroutine when a subscriber is evicted mid-publish

[TeoSlayer]

Addresses finding M9.

M9 — evicted subscriber leaks its descriptor, goroutine and rate bucket

service.go

When publishWith drops a subscriber after maxConsecutivePublishFailures, it called b.removeSub(s) and nothing else. That subscriber is by definition a peer that is not draining, so:

• its handleConn goroutine stays parked in ReadEvent on a stream nobody will ever write to — it never reaches the deferred teardown, so the descriptor is held for the lifetime of the daemon;
• the inner writer goroutine in the publish path (the one the publishWriteTimeout select abandons) stays blocked in write(s, evt) on the same stuck stream, and a fresh one accumulates on each publish until the eviction threshold is reached;
• b.rate[s] is never deleted, so the rate map grows without bound.

Eviction now performs the full teardown — removeSub + forgetPublisher + Close — and closing the stream is what returns both goroutines through their normal paths.

subscriber.Close now tolerates a nil stream, matching the existing nil handling in remote(); broker unit tests construct subscribers without one.

Tests

zz_evict_teardown_test.go — fails against the pre-fix eviction loop (handleConn still parked after eviction), passes here. Drives a real net.Pipe-backed subscriber that subscribes then goes quiet, fails it past the tolerance, and asserts handleConn returns, the rate bucket is dropped, and the stream is closed.

No wire-format or protocol changes.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!