[Freshair129]

Summary

• Enforce operator-configured peer membership and explicit MASTER authority across gossip, reconciliation, and consensus.
• Bind consensus votes to the complete signed proposal event, and validate imported/exported proposals.
• Negotiate gossip protocol and storage schema versions before synchronization.
• Preserve compaction and schema-6 migration authority through WAL fold/replay; reject relay-selected embeddings.
• Rebuild projections whenever an existing snapshot is rejected, skipped, or lacks a P6 projection digest. Read-only opens fail closed when recovery is required.
• Add regressions for peer admission, proof binding, migration recovery, proposal/vote handling, REST/N-API parity, and projection recovery.

Closes #236
Closes #237

Validation

Latest follow-up commit: 10997ad (raises the Rust test job timeout to 240 minutes after Ubuntu hit the previous 120-minute ceiling during WAL compaction tests).

• cargo test --no-default-features --test sqlite_substrate_s0_tests — 8 passed on cc5cc5d.
• cargo build --no-default-features --features "mobile ffi android-jni" — passed on cc5cc5d (one existing unused_mut warning in src/jni.rs).
• cargo fmt --all -- --check and git diff --check — passed on cc5cc5d.
• Focused recovery/security-related test suites previously passed: edge projection 10, WAL tail replay 5, projection replay recovery 6, epoch E2 8, metadata migration 4, schema-6 migration 19.
• Formal Codex Security diff scan 5e8dda40-dc22-4c15-9914-bfd64bec84b5 covered edb06f32189193d0f636707acd528b69e0dbb147 → 908ffe3996e643bed4fffbf6208710bcb781771b. It found no validated reportable vulnerabilities; semantic coverage is partial because a finite-CI-timeout candidate was deferred pending repository policy/quota evidence. The latest cc5cc5d changes tests only.
• RCA: .brain/rca/RCA--projection-snapshot-recovery-2026-10-17.md.

Exact-head CI status

• Current PR head: 10997ad843faafb58d3e65e498365813d830ebc7; all 10 exact-head GitHub Actions workflows completed successfully, including Ubuntu/Windows/macOS Rust tests and mobile host build/tests.
• On prior head cc5cc5d1b4a0d315832da0d78eece940b45e10a3, all other workflows and Rust jobs passed; the Ubuntu Rust job was cancelled at its 120-minute timeout while wal_compaction_tests was still running, with no assertion failure reported. Commit 10997ad raises that job's timeout to 240 minutes.
• On previous head 908ffe3, macOS CI showed that a test changed the projection directly without journaling the change and then expected that cache-only value to survive recovery. The test is now split: equal-clock event writes check peer-ID LWW under both arrival orders, and a schema-6 unjournaled edit test verifies that WAL state wins recovery.
• On previous head 283e52e6736daaa02c837f32d62b0893b78474e2, macOS CI showed that the migration test inserted a receipt directly into an unverified projection without a journal transaction and expected it to survive. It now verifies that recovery discards the cache-only receipt and creates the current projection schema.
• Previous head 90e2f24 failed the mobile-feature Rust suite because a rejected projection snapshot left the edge table empty. Commit 275b8c0 fixes projection recovery, including mixed-component rejection, skipped snapshots, and legacy snapshots without a projection digest.
• CI on 275b8c0 found a metadata migration test that claimed to be schema 4 after generating schema-6 journal events. The test fixture now starts from schema 4; it no longer downgrades only state.json.
• Commit 90e2f24 raised the mobile-feature host-test timeout to 240 minutes. Ubuntu/mobile-host skip only hnsw_capacity_tests::index_grows_past_initial_floor, which repeatedly caused Linux runner shutdowns without assertion failures; Windows and macOS retain the test.
• Earlier CI on parent head 8f18ecc passed 47 checks with 5 skipped, including Ubuntu and Windows Rust suites and the macOS suite. That is historical evidence, not a result for the current head.

Scope

Security implementation, protocol/specification documentation, regression tests, recovery RCA, and the CI timeout needed to finish the mobile-feature test suite. No reproduction steps or proof of concept are included.