isWritable

Whether this peer may author entitlement yet — the boot gate of docs/heddle-ledger-relocation-design.md §6.5 residual 3 and §13.2. It opens when this peer's own enroll(self) has committed and been applied here, and it closes again on restart.

Two holes, one gate

• §6.5.3, the restored-mark hole. A peer's quiesce marks are local, in-memory state (HeddleNode quiescedEdges), so a restart loses them. Until the control log is replayed they are gone, and a mutator run in that window could charge an edge the cluster has already fenced — the straggler the fence exists to make impossible. enroll(self) closes it exactly: because Raft applies in index order, a peer that has applied its own post-boot enroll has applied every entry before it, so every barrier committed before that point is restored, and every barrier committed after it arrives in order. No readIndex() is involved, so it works on a follower and cannot be wedged by an entry Raft withholds from committedFrom.

• §13.2, the unenrolled-writer hole. The fence quantifies over the enrolled set, so a peer that authors a slot without enrolling is a writer no barrier ever waits for — finding 2 through a side door. Slice 2 could only document that as an obligation; requiring the enrollment to have landed before the first write is what makes it structural.

While closed, reserve returns null and schedule returns 0 — the two entry points through which this node authors a counter slot. Reads, advertise (an ephemeral, advisory board that authorizes nothing), and every control verb stay open, so a peer can mint, reshape and enroll before it is writable.

complete carries no gate of its own, and "transitively gated" is exact only for the boot window. In that window the gate has never been open, so reserve has handed out no ReservationId at all and there is nothing completable — the transitivity is airtight. It is not airtight for the other way the gate closes: depart closes it too, and a reservation taken while the gate was open stays live across the departure, so a complete afterwards does author a slot. That case is a documented caller obligation, not a gate — see depart ("call it after quiescing local work, or the peer keeps a promise it has already broken"). Stated precisely here because the fence's quantifier rests on the departure promise, and an overstated "it is transitively gated" would invite a reader to assume enforcement that this class does not perform.