Runs SWIM-style membership live: a GenServer, one per broker, that drives the pure Malachi.Cluster.Membership view with a failure detector and gossip dissemination.

Each protocol period it pings a random alive peer; if no ack arrives within ack_timeout, it does not suspect immediately: it asks indirect_fanout random other peers to ping the target on its behalf (indirect ping), and only marks the peer :suspect if no ack (direct or relayed) arrives within indirect_timeout. This cuts false positives from a transiently lost direct path. If the suspicion is not refuted within suspicion_timeout, it confirms the peer :dead. Every message piggybacks the sender's view (a list of {member, status, incarnation} updates), so peers learn of joins, suspicions, deaths and refutations by anti-entropy and the views converge. A node that is wrongly suspected learns of it from the ack to its own next ping and refutes by bumping its incarnation.

Peers are reachable by GenServer references (a registered name locally, a {name, node} tuple across nodes), so the same code runs in-process for tests and over distributed Erlang. Sends are fire-and-forget: pinging a dead peer simply yields no ack, which is exactly how failure is detected.

On startup a node joins by sending each seed (its :peers) a {:join, ...}; the seed adds the joiner as :alive and replies with its full view, so the joiner learns the whole cluster at once instead of waiting for gossip to converge. Join is best-effort, gossip is the safety net if a seed is unreachable. (A node that restarts after being declared dead would rejoin at incarnation 0, which an existing :dead entry outranks; durable/higher rejoin incarnations are a later concern.)

The same gossip also piggybacks the cluster's versioned routing topology (a Malachi.Cluster.RingTopology): every message carries it alongside the view updates, and peers keep the higher version (last-version-wins), so a vnode split's ring change disseminates and converges the same way membership does: NorthGuard's "minimal global state" spread over the SWIM dissemination path.

Scope: direct ping, indirect ping, suspicion, gossip (membership + topology), and a join handshake.