depart

Remove this peer from the log-known roster, serialized through the log. Idempotent.

There is deliberately no depart(other): departing shrinks the ack set, which asserts the departing replica will never author another counter slot — a promise about the future that only the promiser can make (§6.1). The apply gate enforces it too, so a hand-built act from another peer is refused with a ControlConflict.Refused, identically on every peer.

Departing reclaims nothing. Holdings and earmarks stay exactly where they are, on the same terms as a crashed peer's (design §8.1 — v1 ships no automatic reclamation), so this is a clean, voluntary exit and not a way to recover a lost peer's entitlement. It also does not cancel this peer's local, unreplicated reservations: call it after quiescing local work, or the peer keeps a promise it has already broken. Recovering an absent peer's authority needs the fenced revocation seam, which v1 does not ship.

Departing also closes this node's isWritable boot gate: the promise a departure makes is "I will never author another slot", and a node that kept writing after making it would break the very quantifier the fence rests on. Re-enroll to become writable again.