revocation

The readIndex()-fenced revocation seam (design §9 #3) — reclaiming a crashed peer's stranded holdings remains specified, not shipped in v1 (part of #1602). The advisory-retire strand is a distinct, log-serialized recovery: see reconcile.