Why tombstones have no age cap

Unlinking an agent leaves a tombstone, so that agent's stale hooks become no-ops and a session started outside the bridge can never silently revive. Every unlinked session id joins the set and stays.

The obvious objection is that the set grows forever. Cap it — drop the oldest, or prune anything older than a day.

I decided against a cap, and the reason is not tidiness. A cap has to decide that a tombstone is dead, and it cannot know that. It knows an id was rejected once. It does not know whether the agent behind that id is still running, still listening. Prune a live one and the exact failure the tombstone exists to prevent comes back, silently, at the worst moment.

A tombstone is not memory waiting to be reclaimed. It is a lock. Growth is one id per deliberate unlink, and a deliberate relink retires it — linear with slow, careful human actions.

A lock you forget to shut is not a lock.