RevocationSeam

The readIndex()-fenced revocation seam of design §9 #3 — specified, not shipped in v1.

When a peer crashes, its holdings and earmarks stay safely stranded (a wrong reclaim is an overspend — the one unforgivable failure, §8.1). Reclaiming them is a control-plane act that must be fenced: the leader confirms it still holds a voter quorum at its term via RaftNode.readIndex (the same deposed-leader-cannot-pass-the-fence mechanism the coordinated path already uses) before proposing the revocation, so a partitioned ex-leader can never revoke against stale authority.

v1 defines this interface as the extension point and ships no reclamation — revoke performs none and returns RevocationOutcome.NotShipped. Reclamation is an explicit later feature (part of #1602); this seam is where it will hook. The raft handle is retained so a future impl can call raft.readIndex() without a signature change.