v0.9.0-rc.31

Abstract hierarchy vocabulary (ADR-066 Phase 3) + Coalition tier — a wire-format-breaking rename release — plus collection-name alignment, a CRDT/transport dependency refresh, and persisted-sync-state hardening. Six landed PRs (#208, #209, #210, #211, #212, #213) advancing the workspace-wide peat#904 rename epic and refreshing the dependency floor.

Changed — BREAKING

• Hierarchy vocabulary renamed Squad/Platoon/Company → Cell/Cohort/Federation, plus a new top Coalition tier (ADR-066 Phase 3, #208). The model is now four fixed tiers above the platform: Platform → Cell → Cohort → Federation → Coalition. HierarchyLevel gains Coalition (= 4); strategies, routing, partition, and QoS are extended for the new tier. Wire-format break on HierarchyLevel Serialize/Deserialize — peers must run matching major-rename builds. 22 files renamed across hierarchy/routing/topology/beacon/qos; an end-to-end Federation→Coalition glue test wires PeerSelector → SelectedPeer → TopologyState → SelectiveRouter through the new tier. Tier 5+ is deferred to a future parametric N-tier ADR.
• Collection names adopt the canonical hyphenated peat-schema convention (#209). SyncMode, QoSClass, DeletionPolicy, PropagationDirection, ResurrectionPolicy, SyncDirection, and TtlConfig dispatch tables now use node-states, cell-summaries, cohort-summaries, federation-summaries, coalition-summaries, contact-reports, audit-logs, track-history, capability-history, node-positions. The legacy underscored names (and the pre-ADR-066 squad_summaries/platoon_summaries/company_summaries) are still accepted as transitional backward-compat shims — SyncMode::default_for_collection emits a once-per-name deprecation warning naming the canonical replacement. These shims will be removed in a future release after operator migration.

Fixed

• SyncStatePersistence tolerates undecodable persisted sync state instead of erroring (#211). A persisted automerge::sync::State blob that no longer decodes (e.g. after an automerge version upgrade changed the encoding) previously failed the load — and in load_all (full recovery on restart), a single undecodable entry aborted recovery of every peer/doc sync state. Decode failures now degrade gracefully: load_sync_state returns Ok(None) (the peer re-negotiates sync from scratch — no data loss), and load_all/load_all_for_peer skip the bad entry and keep the good ones. redb I/O errors remain fatal.

Dependencies

• automerge 0.7 → 0.9, iroh =1.0.0-rc.0 → =1.0.0-rc.1 (with iroh-blobs 0.101→0.102 and iroh-mdns-address-lookup 0.2→0.3 in lockstep), plus rustls/lru patch bumps (#210). No on-disk Automerge document-format change across 0.8/0.9 (in-place store upgrade is safe). FIPS posture preserved: aws-lc-rs remains the runtime QUIC crypto provider; ring stays a compile-time transitive only. Mixed-version wire compat (rc.30 ↔ rc.31) verified via a local two-process harness — iroh QUIC handshake + automerge sync converge both directions.

Testing / CI

• mDNS rendezvous contract pinned for iroh-mdns-address-lookup 0.3 (#212). New #[ignore]-gated integration test dials a peer by EndpointId only, exercising the real _peat._udp.local advertise/browse/resolve + QUIC handshake end-to-end.
• P2P Functional Tests CI job on the self-hosted multicast runner (#213). Runs the networking-dependent #[ignore]'d functional tests (cargo test --features automerge-backend --tests -- --ignored) that the GH-hosted job can't (no multicast). Auto-discovering and airgap-safe (external-infra tests stay feature-gated out). Gates releases via the release.yml → ci.yml workflow_call.