MF-M02: fix(rpc): release Serve wait group on processSink overflow

[philanton]

Summary

• readMessages returned without calling handleClosure when processSink was full, leaving the Serve wait group stuck at one outstanding Done. The parent closure callback never fired, the WebSocket was never closed, and the outer HTTP handler stayed blocked — connHub.Remove never ran. Unauthenticated clients could exhaust server resources by flooding messages faster than the queue drained.
• Call handleClosure(nil) before returning from the queue-full branch so the wait group invariant (every early return decrements exactly once) holds.
• Add a regression test that fills processSink without a consumer and asserts the parent closure fires and the underlying connection is closed.

Notes

• Same fix already exists on fix/nitronode-mf-c01 (part of broader frame-size + rate-limiter hardening). Three-way merge between this branch and c01 is clean — identical line addition, non-overlapping hunks.
• c01 also adds a parallel frameRateLimiter.Admit early-return path with the same handleClosure(nil) shape.

Test plan

• go test ./pkg/rpc/... -count=1 passes
• New test fails without the one-line fix (parent handleClosure not invoked after processSink overflow; goroutine leak)
• go vet ./pkg/rpc/... clean
• CI green

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a96f66ca-21ec-48d8-9843-bff0b0061843

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nitronode-mf-m02

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ihsraham]

approved for the m-02 fix. the queue-full read path now calls the shared closure hook before returning, so the connection wait group can finish and the outer handler can remove the websocket from the hub.

that closes the unauthenticated resource-exhaustion path from the finding, and the regression test covers the stuck cleanup case directly.