A host adopts a delivered membership at start, not only after a declaration

The rescue path: an operator writes the membership file by hand on a machine no
bus can reach — rotated while it still held the old password — and restarts the
host. Same file, same check as the declaration path.

cmd/mesh-host/main.go

@@ -962,9 +962,14 @@ func runLink(ctx context.Context, opts options) error {
 		return nil // asked to stop while waiting
 	}
 
-	fmt.Printf("node %s, linking to %s\n", mine.Node, mine.Membership.Broker)
-
+	// **A membership delivered while this host was not running is adopted before the first dial.**
+	// The ordinary path is a declaration, read after it applies; the rescue path is an operator
+	// writing the file by hand on a machine no bus can reach — rotated while it held the old
+	// password, say — and restarting the host (design 28, task 5.2). Same file, same check.
 	say := func(line string) { fmt.Println(line) }
+	adoptDeliveredMembership(identity.Path(opts.state), &mine, say)
+
+	fmt.Printf("node %s, linking to %s\n", mine.Node, mine.Membership.Broker)
 
 	// One scheduler for the life of the process, re-established from each applied declaration
 	// (novox/hq ADR 0053). It fires scheduled steps on their cadence, surviving across applies and