Bounded peer CID issuance, destination bindings, and retirement watermark.

Used CIDs cannot move to another destination. Contiguous unbound spent entries are retired through the watermark; lower live bindings or unseen sequence gaps defer retirement. Such gaps can exhaust the finite active map until the peer advances its retirement watermark or the lower bindings are released.