fix: recover send-on-closed-channel panic in byteChannel sink

[myleshorton]

Problem

byteChannel.UpdateFrom did an unguarded send to a caller-owned channel:

func (s *byteChannel) UpdateFrom(r io.Reader) error {
	b, err := ioutil.ReadAll(r)
	if err != nil { return err }
	s.ch <- b   // sink.go:80 — panics if ch was closed
	return nil
}

A Runner (Start) calls syncOnce → UpdateFrom on a ticker. The channel is owned by the caller (ToChannel takes a caller channel), and consumers close it on shutdown / config reload:

• getlantern/fronted — fronted.go:257 (keeps the masquerade list current)
• getlantern/radiance — kindling/dnstt/parser.go:162

When a tick fires the send while/after the consumer has closed the channel, s.ch <- b panics with send on closed channel, which crashes the whole process.

Observed crashing the macOS v9 client (9.1.9) — four Runner goroutines panicked simultaneously on shutdown. User-visible as "beta cannot be used, and can't even submit an in-app report" (a crashed app can't upload the report). Freshdesk #176970 / lantern-forum-cn #1543.

Fix

The sink can't know whether the caller's channel is closed, so make the send close-safe: recover the panic and return it as a sink error. Runner.syncOnce already treats sink failures as recoverable via OnSinkError (keepcurrent.go:128-130) — so a closed channel now degrades to a logged sink error instead of a process crash. No consumer changes required; fixes every consumer at once.

Tests

Added sink_test.go:

• TestByteChannelClosedDoesNotPanic — send to a closed channel returns an error, no panic (regression).
• TestByteChannelDelivers — healthy send still delivers unchanged.

go build, go vet, and the full test suite pass.

Notes

• This was not fixed on main before this PR, and it's cross-platform (keepcurrent + fronted run on every client), so any v9 build could hit the crash whenever fronted/dnstt reloads at the wrong instant — macOS just happened to capture the crash log.
• Optional follow-up (separate, not required to stop the crash): consumers could Stop() the Runner before close(ch) to coordinate shutdown cleanly.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR prevents a process-crashing send on closed channel panic in the ToChannel sink by making byteChannel.UpdateFrom recover from a closed-channel send and return it as a sink error, and adds regression tests to validate both the closed-channel and normal-delivery behaviors.

Changes:

• Add a defer/recover guard around the channel send in byteChannel.UpdateFrom to convert the panic into an error.
• Add unit tests covering closed-channel behavior (no panic, returns error) and successful delivery.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
sink.go	Adds panic recovery in the byte-channel sink to avoid crashing when the caller closes the channel.
sink_test.go	Adds regression + happy-path tests for byte-channel sink behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[garmr-ulfr]

LGTM!

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.