[Freshair129]

Summary

• Preflight retained journal events against the pinned peer roster and MASTER authority before membership-aware startup replays them.
• Apply the same check when peer membership is configured after a plain recovery; roll back staged membership on failure and prevent gossip from starting until membership is configured.
• Add legacy and compacted-history regression coverage and document the recovery contract in the sync specifications, ADR, and RCA.

Verification

• cargo build --no-default-features --features bins — passed.
• Focused backup restore, gossip membership, and P6 suites — 48 passed.
• cargo fmt --all and git diff --check — passed.
• Full cargo test --no-default-features -- --test-threads=1 compiled but was interrupted at concurrency::bulk_add_edges_1000 after the process exceeded 4 GiB working set without reporting progress. The full suite is not claimed as passing.

Security review

A fresh independent source-only review found no remaining authorization bypass in startup, late membership configuration, or gossip startup.

Known limitation: preflight currently holds retained journal events in memory, so memory use scales with full-retention journal size (conditional P3 / CWE-400; no threshold measured). This is tracked in #245 and documented in the RCA; this PR does not claim to bound that memory use.

RCA

.brain/rca/RCA--SECURITY-MEMBERSHIP-JOURNAL-REPLAY-2026-10-19.md