[tony]

Part of #111

The "release rehearsal" job failed on the r10 pin PR with tmux-workspace left a tmux server running: s (run 41330914569). No server was leaked. The guard from #123 took a server that was still exiting for one, because the cli build swept its run directory straight after stopping its own server.

Why

kill-server returns before the server has exited, and the server keeps listening for about a millisecond after it does. The module-tests/cli build stopped its server on the explicit socket s that way and ignored the result, and e4961f20 (a review fix in #123, "Sweep the cli run dir") made the sweep that follows cover the whole directory, s included. The sweep connected inside that window, counted the exiting server as a leak, stopped it again and failed the build naming s. The job passed on #123's own head by timing luck.

Measured, with an isolated server per run on tmux 3.8a: a connect straight after kill-server returned still succeeded in 162 of 200 runs, and the socket stopped answering after a median of 1.2 ms (at most 1.4 ms). The staged rehearsal passed 8 of 8 at master ef44575d on this host, because the JVM takes longer than that window to reach the sweep. With a tmux first in PATH whose kill-server returns at once and takes effect 0.3 s later, the same build at ef44575d fails with exactly the CI message, and with this change it passes and leaves no server. #125 is not involved: it changes jar contents and the staged-release check, not module-tests or the workspace CLI.

What

• LeakedServers.stop kills a server and waits for it to stop answering. LeakedServers.sweep uses it for each server it stops, so its behaviour is unchanged, and it is exposed to the module-tests builds as stopServer.
• The cli build stops and awaits its own server through it before the sweep, where it ignored the result of kill-server. What the sweep finds after that is still a leak, so the guard is as strict as before for anything the children leave.

Checked

Each break was applied alone and the named test run.

Break	Failing test
stop returns without waiting	a server still exiting after kill-server is awaited, not swept as a leak, which starts a server through a tmux whose kill-server takes effect 0.4 s late and requires the sweep to find nothing
the cli build does not call stopServer	the cli build scrubs its children, gives them a TMUX_TMPDIR and stops what they leave

build-logic check passes (16 TmuxQuarantineTest cases, 3 QuarantineGateTest, 2 ModuleTestsQuarantineTest, 11 and 4 in test-sandbox). The cli build, run locally against a release staged at ef44575d, passed with the late-exiting tmux and 4 times without it. The probe test cleans up by the server's pid, so a failing run leaves nothing behind. CI's release rehearsal runs the real build.