GeezerVison

A tmux command can wait indefinitely when the expected signal never arrives. tmux_cmd and the four object cmd facades now accept an optional per-call timeout in seconds. Defaults and returned command results retain their current behavior. For example, server.cmd("wait-for", "ready", timeout=0.5) raises exc.TmuxTimeout if its client exceeds the bound; timeout=None waits indefinitely.

Expiry kills and reaps only the client this call spawned, closes its pipes, and raises exc.TmuxTimeout. An accepted server mutation may remain; the call never retries it. Large finite bounds use safe native wait slices under one monotonic deadline and one client.

Timed object commands refuse custom server dispatchers and injected engines before effects, including dispatchers that accept arbitrary keywords while discarding the requested bound. Untimed custom routing remains unchanged.

The exception matches the inspected engine proposal's name, base, fields, message and suppressed native cause. This PR imports no unmerged engine code, changes no tmux minimum, and adds no server-wide default. Shared workflow budgets, async cancellation, channel-wait deadlines and the wider engine migration remain separate slices.

The minimum remains tmux 3.2a. Its ordinary channel wait blocks for a signal; this deadline bounds the owned client.

Related to #689 and #629. This is a focused alternative to the broader timeout proposals in #735 and #757; it builds directly from current master with sibling branches absent.

Validation:

• New deadline cases fail before implementation and pass afterward.
• Removing reaping deliberately makes the owned-client regression fail.
• Custom-dispatch regressions fail before the guard and when the guard is deliberately removed.
• Large-deadline overflow and same-client wait-slice regressions fail before repair and pass afterward.
• Public command consumers, common doctests, Ruff, mypy, and the repository documentation build pass.
• Full configured pytest suite on stable tmux 3.8: FAIL. Its failures and failure messages match unchanged master; tests fail with tmux 3.8 #775 separately tracks the hooks, popup and floating-pane corrections. The complete failing run is retained with retries disabled.

Local evidence covers Linux/WSL, Python 3.15, and client-and-daemon pairs verified as tmux 3.2a and stable 3.8. The local development 3.8a build is recorded separately. Hosted checks at fa3f91cd67e3798979f90f7f476836e5c32f24e4 remain FAIL: tmux 3.3a pass; 3.2a, 3.4, 3.5, 3.6, 3.7a, 3.7b fail. CodeQL passes; codecov/project fails. The development-tmux job allows failures and is not full-suite pass evidence. The 3.2a failure is the existing capture test accepting an echoed, unexecuted completion marker; the other stable failures include the cached-binary ABI problem tracked in #825. The failed mandatory full-suite gate keeps this delivery slice unfinished. No macOS CI or qualification work is added, and existing support is preserved.