leaveDoesNotReportFailureAsCancellation

UNGATED CORE. No leave() may report its failure as a cancellation (#1826).

A caller cannot tell a callee-minted CancellationException from its own by type, so one that escapes here cancels the caller rather than failing it: no handler runs, no stack trace, and every obligation behind the call is skipped. A host calls leave from a teardown path that is itself usually already cancelled, under a best-effort guard, so the cost is the rest of that host's cleanup rather than one leave — which is why both RoomHost implementations hand-write a catch (Throwable) around it.

Honest limit, carried over from the Seam analogue. This proves the obligation on the paths a 2-peer harness can reach with no fault at all — a live leave, the idempotent second leave, and a leave whose remote has already gone (the one most likely to be bounded by a timeout). It cannot reach a leave racing a genuinely wedged transport; leaveDoesNotMintACancellationWhenTeardownIsSlow is the arm that reaches the suspending teardown, and it needs the injector.