SessionCatalog::SessionRuntimeInfo::killsRequested is incremented when a session is marked for kill, and is only decremented when the KillToken is consumed by checkOutSessionForKill or when the kill check-out times out. If the token is dropped on any other path the counter never returns to zero, and every subsequent non-kill check-out of that session blocks forever, since the normal check-out path has no deadline. There are several paths that can drop a token and it is extremely difficult to prove which one fires in production (see BF-45115), so we should fix the class of bug rather than the individual paths. Make KillToken RAII so its destructor returns the kill, guaranteeing every path ends with the kill either completing or being returned.