retired_aros tombstone gate: stop deleted AROs resurrecting via stale .aro bootstrap rejoins. Table retired_aros(aro PK, retired_at, retired_by); gate in /aro/join returns aro_retired before INSERT; POST /aro_retire + GET /aro_retire_ls (Elazar-only auth, mirrors /aro_allow); CLI aro-retire.sh; schema in init-db.sh + hub.mjs migration. Migration seeds the 7 dead -core/-small names. Un-retire via action=remove (reversible). Rides next restart. Durable fix for MSG-24 resurrection whack-a-mole.