[AdaAibaby]

Rebased follow-up to #3567 (closed inactive). The leak is still present on main, and this fixes a real race the original approach missed.

Bug

When ExpiredItems finds an orphaned expiration ZSET member (sandbox key already gone, confirmed by a nil MGET) it removes the ZSET member but leaves the sandbox ID in the per-team SET index. Those entries accumulate forever: TeamItems silently skips the nil MGET, the healer only restores missing ZSET members (it never repairs the team index), and Remove only cleans the team index on the normal path. The leftover comes from paths that delete the sandbox key without going through Remove — e.g. a pause (finishTransition DELs the key but does not SREM the index).

Fix — and why a plain SREM is unsafe

Sandbox IDs are reused across executions (a resume keeps the ID, changes the execution ID). A plain SREM would race a concurrent resume that re-creates the key and re-adds the ID between the MGET and the SREM. Because the healer does not repair the team index, that wrong removal would be permanent — the sandbox would vanish from TeamItems until it is next removed.

So the prune is an atomic EXISTS-guarded SREM (pruneOrphanIndexScript):

if redis.call('EXISTS', KEYS[1]) == 0 then
    return redis.call('SREM', KEYS[2], ARGV[1])
end
return 0

It removes the ID only if the sandbox key is still absent at that instant; a resume that re-created the key makes EXISTS != 0 and the SREM is skipped. Both keys share the {teamID} hash tag, so it is Redis-Cluster-safe. The orphan handler reads teamID from the batch it already iterates (no struct change); the ZSET member removal is unchanged.

Scope

This fixes only the orphan-index leak. The original #3567 also replaced the add/remove Lua scripts with TxPipelined — an unrelated refactor of the atomicity primitives in this concurrency-critical path — which is dropped here. (Notably this fix needs a Lua script for its atomic check-then-SREM, so removing Lua elsewhere was not the right direction.)

Tests

• orphan sandbox ID is pruned from the team index;
• a live sandbox key is never unindexed by the sweep (EXISTS guard), even when a dead execution of the same reused ID left an expired member.

go build ./... and go vet pass; the redis tests pass against a real Redis (REDIS_TEST_DATABASE_URL).

Closes #3566. Supersedes #3567.