Keep an ended link ended, and pin the drop a listener closes over

todo.md

@@ -211,6 +211,13 @@ hardest, and the held-message flow across `incoming-requests.ts`, `held-messages
 
 ### Correctness
 
+- [ ] **Refuse to open a link that dropped while its rebind was answered.** A peer sending
+      `bind_resp` and FIN together can tear the link down before `comeBackUp()` resumes; it then
+      calls `link.open()` on a `down` link, `resetTimers()` skips, and `attempt()` reports success,
+      so the session is `up` on a destroyed socket with nothing to reconnect it until `close()`.
+      `open()` accepting only `binding`, and `comeBackUp()` returning an err when the link is no
+      longer attached, lets the loop retry. Unreproduced; from the stability review of #48.
+
 - [ ] **Register a multipart send's receipt merge before its segments go out.** `Session.sendSms()`
       calls `dlrMerger.expect()` only once `submitSms()` resolves, after the last segment's response,
       so a receipt for an early segment that arrives first is logged at `debug` as naming no merge,