TimeoutNowFutureTerm

onTimeoutNow guard 3 (#1889): the frame's term is strictly above ours, so it carries no authority this node can check.

The per-term leader identity the next guard reads is meaningful only at our own term, so at a higher term there is nothing to authenticate the sender against — which is why the higher-term lane was a free, repeatable, pre-vote-less election for any peer that could address us. Refused without adopting the term, matching the precedence the two gates above it set: sender-authority validation comes before §5.1 term adoption, or an unauthenticated frame gets to move durable state on its way to the floor.

Fail-safe-then-retry, not "cannot happen". An honest §3.10 target normally reaches our term before the frame exists, but becomeLeader resets matchIndex only for the current configuration's members, so a peer removed while its matchIndex was high and later re-admitted can satisfy the caught-up test on that stale value and be sent a TimeoutNow at a term it never adopted. The premature frame is dropped with no state touched, and the next heartbeat ACK re-fires it correctly — well inside the transfer's one-election-timeout auto-abandon window.