fix(gateway): secure control and terminal ownership

gateway/apollo_native_test.go

@@ -858,6 +858,34 @@ func TestNativeApolloSessionForwardsEncryptedHostFeedback(t *testing.T) {
 	}
 }
 
+func TestApolloTerminalEventSurvivesFullFeedbackQueue(t *testing.T) {
+	session := newNativeApolloSession("session-full-feedback")
+	key := []byte("0123456789abcdef")
+	codec, err := newApolloControlCodec(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	session.control = codec
+	for range cap(session.events) {
+		session.events <- ProviderEvent{Kind: ProviderEventRumble, Payload: []byte{1, 0, 0, 0, 0}}
+	}
+
+	session.handleApolloControlPayload(
+		apolloChannelGeneric,
+		true,
+		sourceSealHostControl(t, key, 0, apolloControlTypeTerm, []byte{1, 2, 3, 4}),
+	)
+
+	foundTerminal := false
+	for range cap(session.events) {
+		event := <-session.events
+		foundTerminal = foundTerminal || event.Kind == ProviderEventTerminated
+	}
+	if !foundTerminal {
+		t.Fatal("encrypted host termination was lost behind a full feedback queue")
+	}
+}
+
 func TestPushLatestDropsExactlyOneOldPayload(t *testing.T) {
 	queue := make(chan []byte, 1)
 	if dropped := pushLatest(queue, []byte("old")); dropped {