clients that never restart never drop old guards
When we get a consensus we check whether to drop guards that have been down long enough.
But we only compare chosen_on_date to now when we're loading the state file, which we only do at start.
So if the Tor client stays running for more than a month or two, its guard behavior deviates from normal.
Discovered while talking to Tariq about his guard simulation attack graphs and trying to puzzle through his unintuitive results.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information