leave

Signal graceful departure for replica: publishes a null-value entry with clock, which must be higher than any prior entry. Peers that merge this departure will suppress replica from live output.

Departure is permanent, not TTL-bounded. The tombstone outranks every entry the replica published before it, so no re-delivery of one of those — however late, whoever relays it — can bring the replica back; the join discards it, and EphemeralMapTracker will not evict a tombstone to let it in (#1675). A departed replica returns only by publishing a presence entry at a clock strictly above its own departure clock. A replica that restarts with a reset counter therefore cannot rejoin on the counter alone: carry a per-boot epoch in the clock's high bits (see the restart-recovery section of the class KDoc) so its first heartbeat outranks the tombstone.