Jacob,
You don't need to explicitly define all of the cluster members when you use the TCP/IP join method. You need to define some jump nodes (even just a single one would be enough). When nodes come up, they don't all need to be explicitly listed. They will connect to the listed jump node and negotiate joining the cluster. Listing two jump nodes is a good idea just in case either is down. Once you have your jump nodes listed, as long as their IP addresses don't change, you can shrink and grow the cluster without any further changes.
If you did need to change the configured jump node IPs, it should not require an outage. Just modify bitbucket.properties (formerly stash-config.properties) and list the new IPs and start the new nodes. Assuming any of your updated jump nodes is a node that's still up and in the cluster, the new nodes will simply start and join in. No downtime is required because there's no need to shutdown any of the nodes you already have running.
I've reached out directly to the Confuence team and they have confirmed that 5.9 has been updated to allow exactly the same configuration Bitbucket Server/Stash already had. It's still not done the same way JIRA is.
Best regards,
Bryan Turner
Atlassian Bitbucket
Cool; looking forward to 4.2!