TimeoutNowSenderNotEstablishedLeader

onTimeoutNow guard 4 (#1900, landed in #1938): the sender is not the node leaderForTerm holds as this term's established leader.

Authenticated against leaderForTerm, not _leader — and the two differ precisely where it matters. _leader answers "a live leader I can talk to" and is cleared on a same-term step-down (LostQuorum, RemovedFromConfig), so a node that led term T and stood down at T would sit at _leader == null for the rest of T and accept a TimeoutNow from any voter. leaderForTerm is sticky for the term and now durable, so that node still holds itself as the term's leader and the frame is refused.

This is the guard whose total refusal un-pinned the ones above it: leaderForTerm is a fact about currentTerm, so wherever it reads null this guard refuses every sender, producing exactly the state effects an earlier guard would have produced (#1980). Undoing that is what RaftTraceEvent.FrameRefused exists for.