v0.9.0-rc.26

Behavioural UAT for peat-mesh#175 — delivery-ratio thresholds under constrained bandwidth in-CI — adds peat-mesh#184, the in-CI behavioural counterpart to the rc.25 architectural pin from peat-mesh#180. Two AutomergeBackend::with_iroh peers route their iroh QUIC traffic through a userspace UDP relay applying per-direction token-bucket pacing (256 kbps, ~MTU burst capacity, 100 ms one-way delay) — same shape as the netem setup in the original issue. Bidirectional emission for 30 s steady + 10 s drain per case; worst-direction delivery ratio asserted against peat-mesh#175's thresholds:

Rate	peat-mesh#175 threshold	rc.26 in-CI (MTU bucket, both directions)
1 Hz	≥ 99.5%	100% / 100%
10 Hz	≥ 99.0%	100% / 100%
25 Hz	≥ 95.0%	100% / 100%

Total wall-clock 124.7 s for all three cases. Fits in the main PR test job — no #[ignore], no nightly tier.

Added — regression tests

• tests/persistent_sync_delivery_under_constrained_bandwidth.rs (peat-mesh#184, refs peat-mesh#175): three #[tokio::test] cases pin the issue's delivery-ratio thresholds under constrained-bandwidth shaping. Pairs with tests/two_backend_persistent_sync_e2e.rs (architectural pin from rc.25) — code-shape + measurement coverage for the peat-mesh#178 BLOCKER class. UAT scope is functional validation only (does the persistent stream hit the issue's thresholds — yes/no); parameter sweeps and slow-leak hunting belong in peat-sim, not in this per-repo UAT. Bucket capacity sized at ~MTU rather than 1 second of bandwidth so each packet pays its own refill wait at link rate (resolves the peat-mesh#184 QA round-1 [WARNING] that the shaping might be effectively unconstrained for the workload sizes).

CI

• QA review workflow: Sonnet 4.6 fallback after 3 failed Opus 4.7 attempts (peat-mesh#182): qa-review.yml falls back to Claude Sonnet 4.6 when the primary Opus 4.7 model repeatedly fails to complete, keeping review coverage alive when the primary is degraded.

Out of scope (acknowledged follow-up)

• AutomergeBackend::get perf bug. Surfaced while sizing the rc.26 UAT: AutomergeBackend doesn't override the DocumentStore::get trait default, so single-doc lookups route through query() → scan_prefix + Automerge deserialize of the entire collection. Every single-doc get(collection, id) is O(N); any caller looping over IDs is O(N²). The UAT's count_delivered works around it with a single Query::All + Rust set-intersection; the underlying ~10-line keyed-lookup override on AutomergeBackend (using Self::key_for(collection, id), the same key shape the upsert path builds) will be filed as a separate peat-mesh perf issue with a reproducing micro-bench.
• Workload-characterisation gap (peat-mesh#175 remains partly open): rc.25's release notes call out the 5-platform concurrent case under bandwidth contention with attachment download — that's bandwidth-bound, not sync-coordinator-bound, and remains workload-side characterisation work, not closed by this UAT.