Finding 5 of the 2026-07-29 security review: nothing watched for a
connection ending, so players who left stayed on the client list
forever and the host kept trying to send to them.
cg-net--host-sentinel removes a closed connection from the list; it is
installed on every accepted connection. This also tidies the drops
made by the Finding 4 bounds, which delete-process over-limit peers.
Seat numbers are still not reused after a departure -- deliberate, and
recorded in the sentinel docstring: a stale seat must not be inherited
by a stranger mid-game. Named in the handback as remaining behavior.
Test cgt-net-reaps-disconnected fails against the previous code: after
the client disconnected the list still held it (= 0 1).
ade2f38ee3