reaperCommand(root:)

Arm it in the same invocation that creates the server's first session, and give it the directory holding the socket. Public because the benchmark provisions its own servers — with a counting shim standing in for tmux — and a second copy of this reasoning is a second copy to get wrong.

defer and kill-server both run *in the process that started the server*, which makes them useless in the one case that actually leaks: the run is killed outright by a harness timeout or an impatient operator, and every tmux server it started survives with no owner and no way to reach it. Cleanup that depends on the cleaner surviving is not deterministic.

So the reaper lives inside the tmux server instead, as a background job. It watches the owning process and, once that is gone, removes the directory and kills the server. Three details carry the design:

• The directory goes first. kill ends the server, and tmux kills its jobs when it exits, so anything sequenced after it would not run.
• The server is addressed by pid, not by socket, because the socket is inside the directory just removed.
• #{pid} is left for tmux to expand rather than asked for first, which is what lets arming ride in the same invocation that creates the session. Sent separately, a run killed in the gap between the two leaves a server no reaper ever covered — measurably, under load, about one server in six.
• The interval is whole seconds. Fractions are a GNU and BSD extension that POSIX does not require, and a sleep that rejects its argument turns this into a busy loop per server rather than a slower one. Reaping a second later costs nothing here.