The appsink callback closed its done channel on every sample. A second sample arriving before teardown (seen on CI runners, now that live thumbnails go through SegmentThumbnail) panicked the node with "close of closed channel", and would have appended a second image to the output.