release: prepare git-cas v6.5.1

[flyingrobots]

Summary

• version npm, JSR, and runtime metadata as 6.5.1
• package and document the bounded immutable page-payload reuse release
• record an explicitly unpublished release-candidate witness
• enforce candidate/publication truth and packaged documentation with tests

Why

This is the release follow-through for #85 and the implementation merged in #87. The retained-page structural optimization remains separately tracked in #86 and is not overclaimed here.

Compatibility

This patch release changes no persisted format or existing method signature and requires no stored-data migration. pageCacheEntries and pageCacheBytes are additive options; pages.open() remains uncached and streaming.

Verification

• pnpm run release:verify on the final committed tree: 14/14 gates, 6,676 observed tests
• unit tests: Node 2,036; Bun 2,035; Deno 2,026
• real-Git integration tests: 193 each on Node, Bun, and Deno
• focused release-documentation contracts: 29/29
• pre-push lint and 2,036 Node unit tests: passed
• npm pack dry-run and JSR publish dry-run: passed
• Graft: no structural source change; its sole alert is the intentional package.json.files addition of docs/releases/v6.5.1.md, with zero impacted files

Publication boundary

No tag, npm publication, or GitHub Release is claimed by this PR. Publication remains gated on this PR merging cleanly, a signed immutable v6.5.1 tag, the release workflow, and post-publication registry evidence.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2adc1d14-5dbd-4ecc-806a-ec9f471760a6

📥 Commits

Reviewing files that changed from the base of the PR and between ad5b91b and b73ee15.

📒 Files selected for processing (15)

• CHANGELOG.md
• README.md
• ROADMAP.md
• STATUS.md
• UPGRADING.md
• docs/design/0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md
• docs/design/0051-bounded-page-payload-reuse/witness/release-candidate.md
• docs/design/README.md
• docs/releases/v6.5.1.md
• jsr.json
• package.json
• src/package-version.js
• test/unit/docs/package-docs.test.js
• test/unit/docs/release-state.test.js
• test/unit/docs/release-truth.test.js

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

docs/design/**

📄 CodeRabbit inference engine (AGENTS.md)

Use docs/design/ directory for durable design contracts and proof plans

Files:

• docs/design/0051-bounded-page-payload-reuse/witness/release-candidate.md
• docs/design/0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md
• docs/design/README.md

README.md

📄 CodeRabbit inference engine (AGENTS.md)

Use README.md as the public front door, core value prop, and quick start documentation

Files:

• README.md

CHANGELOG.md

📄 CodeRabbit inference engine (AGENTS.md)

Use CHANGELOG.md to record the historical truth of merged behavior

Files:

• CHANGELOG.md

ROADMAP.md

📄 CodeRabbit inference engine (AGENTS.md)

Use ROADMAP.md as a signpost to the GitHub release tracker

Files:

• ROADMAP.md

STATUS.md

📄 CodeRabbit inference engine (AGENTS.md)

Use STATUS.md as a compact snapshot of release and runtime truth

Files:

• STATUS.md

🧠 Learnings (3)

📚 Learning: 2026-07-13T17:00:46.222Z

Learnt from: flyingrobots
Repo: git-stunts/git-cas PR: 65
File: src/domain/helpers/isCanonicalCollectionKey.js:21-35
Timestamp: 2026-07-13T17:00:46.222Z
Learning: In git-stunts/git-cas, the codebase is intended to run on multiple JavaScript runtimes (Node, Bun, and Deno), not just Node. During code review, don’t suggest replacing existing portable helper logic with newer Node-only built-ins (e.g., Node 20+ APIs like `String.prototype.isWellFormed()`) unless the change preserves Bun/Deno compatibility (via portable/polyfill implementations or safe runtime gating). If a file includes manual implementations (such as `src/domain/helpers/isCanonicalCollectionKey.js`), treat them as intentional to avoid requiring a higher host built-in baseline.

Applied to files:

• src/package-version.js

📚 Learning: 2026-02-28T19:21:13.982Z

Learnt from: flyingrobots
Repo: git-stunts/git-cas PR: 15
File: test/unit/domain/services/CasService.envelope.test.js:326-330
Timestamp: 2026-02-28T19:21:13.982Z
Learning: In fuzz tests for cryptographic operations, use a seeded PRNG (e.g., xorshift32) for control-flow variables such as plaintext size selection and recipient index selection to ensure reproducibility. Continue to use randomBytes() for cryptographic keys and nonces to preserve realistic randomness and avoid security anti-patterns. This guideline applies to test files that perform fuzz testing of crypto logic; implement a consistent seed setup (e.g., fixed seed in test initialization) and document the rationale to enable deterministic replays across runs.

Applied to files:

• test/unit/docs/release-truth.test.js
• test/unit/docs/package-docs.test.js
• test/unit/docs/release-state.test.js

📚 Learning: 2026-03-30T19:53:48.000Z

Learnt from: flyingrobots
Repo: git-stunts/git-cas PR: 29
File: docs/design/TR-010-planning-index-consistency-review.md:121-131
Timestamp: 2026-03-30T19:53:48.000Z
Learning: In this repo, CHANGELOG.md entries should be user-facing and descriptive (bullet points) rather than cycle-ID headings (e.g., use a phrase like “Planning-index consistency review” instead of a “TR-010 — …” heading). When searching the changelog, don’t rely on grepping for cycle IDs (e.g., “TR-010”) because it may cause false negatives; search for the descriptive keywords/phrases from the bullet entries instead.

Applied to files:

• CHANGELOG.md

🪛 LanguageTool

docs/design/0051-bounded-page-payload-reuse/witness/release-candidate.md

[style] ~82-~82: Consider removing “of” to be more concise
Context: ...Gate Publication remains blocked until all of the following are true: 1. the versioned c...

(ALL_OF_THE)

🔇 Additional comments (18)

CHANGELOG.md (1)

10-11: LGTM!

jsr.json (1)

3-3: LGTM!

package.json (1)

3-3: LGTM!

Also applies to: 40-40

src/package-version.js (1)

1-1: LGTM!

README.md (1)

47-47: LGTM!

Also applies to: 207-208

UPGRADING.md (1)

5-26: LGTM!

test/unit/docs/release-state.test.js (4)

6-10: LGTM!

---

28-37: LGTM!

---

51-88: LGTM!

---

103-115: LGTM!

test/unit/docs/release-truth.test.js (1)

236-250: LGTM!

docs/releases/v6.5.1.md (1)

32-44: LGTM!

docs/design/0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md (1)

5-5: LGTM!

docs/design/README.md (1)

14-14: LGTM!

Also applies to: 46-46

ROADMAP.md (1)

41-41: LGTM!

Also applies to: 50-53

STATUS.md (1)

4-5: LGTM!

Also applies to: 21-24, 118-122

docs/design/0051-bounded-page-payload-reuse/witness/release-candidate.md (1)

1-94: LGTM!

test/unit/docs/package-docs.test.js (1)

18-18: LGTM!

Also applies to: 90-90

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added bounded, process-local reuse of immutable page payloads for repeated pages.get() calls.
  • Added optional controls for cache entry and byte limits.
  • Preserved independent returned byte arrays and existing size-limit behavior; pages.open() remains streaming and uncached.
• Compatibility
  • No stored-data migration is required, and existing method signatures remain compatible.
• Release
  • Updated documentation and package metadata for version 6.5.1, including release-candidate verification details.

Walkthrough

This release updates the project to v6.5.1, documents bounded immutable page payload reuse, records the release-candidate state, marks its design as landed, and expands release documentation and state validation.

Changes

v6.5.1 release documentation

Layer / File(s)	Summary
Release metadata and links CHANGELOG.md, jsr.json, package.json, src/package-version.js, README.md	Version metadata, changelog entries, packaged release documentation, and README release-note links now reference v6.5.1.
Upgrade and release notes UPGRADING.md, docs/releases/v6.5.1.md	Documents bounded page payload reuse, cache options, compatibility guarantees, verification results, and the absence of stored-data migration.
Release records and candidate posture ROADMAP.md, STATUS.md, docs/design/0051-bounded-page-payload-reuse/*, docs/design/README.md	Marks the design as landed and records the v6.5.1 milestone, candidate posture, verification evidence, and publication gate.
Release validation test/unit/docs/package-docs.test.js, test/unit/docs/release-state.test.js, test/unit/docs/release-truth.test.js	Validates packaged release documentation, unpublished v6.5.1 candidate evidence, preserved v6.5.0 publication evidence, and documented cache contracts.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• v19 emergency: delegate all CAS and cache ownership to git-cas git-warp#734 — Relates to delegating page-read residency and cache policy to git-cas.

Possibly related PRs

• git-stunts/git-cas#73 — Updates version-specific release-candidate and publication evidence in the same release-state test surface.
• git-stunts/git-cas#80 — Modifies STATUS.md and release-state validation for publication evidence.
• git-stunts/git-cas#83 — Updates release documentation and contract validation infrastructure.

Suggested reviewers: git-stunts

Poem

A rabbit stamped the version bright,
“Six-five-one” beneath moonlight.
Cache bytes bounded, docs in line,
Candidate gates all neatly shine.
Hop, hop—release notes now align!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main release-prep change for git-cas v6.5.1.
Description check	✅ Passed	The description is mostly complete and covers summary, rationale, compatibility, verification, and publication boundary.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

@codex Please confirm this self-review verdict and flag any remaining issue before merge.

Self-Code Review / Code Lawyer

Reviewed origin/main...HEAD after a clean-worktree check and fresh git fetch. The branch fulfills its release-preparation intent without changing runtime source structure or persisted formats.

Remaining findings

Severity	Count	Status
Critical	0	Clear
High	0	Clear
Medium	0	Clear
Low	0	Clear

Resolved during review

Severity	Location	Infraction	Resolution
Low	docs/design/0051-bounded-page-payload-reuse/witness/release-candidate.md:7	The witness called implementation PR #87 simply “Review,” obscuring that release PR #88 owns candidate review.	Commit b73ee15a now distinguishes Implementation review: #87 from Release review: #88, with a documentation contract preventing regression.

Evidence

• Exact final commit b73ee15a: pnpm run release:verify passed 14/14 gates with 6,676 observed tests.
• Node/Bun/Deno unit counts: 2,036 / 2,035 / 2,026.
• Node/Bun/Deno real-Git integration counts: 193 / 193 / 193.
• Focused release contracts: 25/25 after the provenance repair.
• Pre-push lint and 2,036 Node unit tests passed.
• git diff --check origin/main...HEAD: clean.
• Graft found zero structural source files and zero impacted consumers. Its sole “breaking” classification is the intentional package.json.files growth from 33 to 34 entries so docs/releases/v6.5.1.md ships; no JS/TS export changed.
• Candidate truth and publication absence are enforced in test/unit/docs/release-state.test.js; the witness explicitly withholds tag/npm/GitHub Release claims.

Residual gate

Local review is clean. GitHub CI and CodeRabbit are still in progress and remain mandatory before merge.