release: prepare git-cas v6.5.1

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.5.1] — 2026-07-18
+
 ### Performance
 
 - **Bounded immutable page payload reuse** - repeated `pages.get()` calls now

README.md

@@ -44,7 +44,7 @@ Unlike traditional LFS which moves files to external servers, `git-cas` treats t
 Existing v5 users should read [UPGRADING.md](./UPGRADING.md) and run
 `npm run upgrade` in dry-run mode before restoring old encrypted vault entries.
 For the release overview, see the
-[v6.5.0 Release Notes](./docs/releases/v6.5.0.md).
+[v6.5.1 Release Notes](./docs/releases/v6.5.1.md).
 
 ### 1. CLI Usage
 
@@ -204,6 +204,8 @@ All three runtimes are tested in CI on every push. The hexagonal architecture is
   workspaces for temporary multi-object reachability, promotion, and cleanup.
 - **[v6.5.0 Release Notes](./docs/releases/v6.5.0.md)**: Bounded direct bundle
   references, immutable metadata reuse, and corrected concurrency settlement.
+- **[v6.5.1 Release Notes](./docs/releases/v6.5.1.md)**: Bounded immutable page
+  payload reuse with zero-command warm reads.
 - **[Upgrading](./UPGRADING.md)**: Migration guide for v5 → v6.
 - **[Changelog](./CHANGELOG.md)**: Version history and migration notes.
 

ROADMAP.md

@@ -38,6 +38,7 @@ GitHub wins and this file should be corrected.
 | [`v6.4.0`](https://github.com/git-stunts/git-cas/milestone/4)  | Scoped staging workspaces                                   | [#75](https://github.com/git-stunts/git-cas/issues/75), [#77](https://github.com/git-stunts/git-cas/issues/77)                                                                                                                 |
 | [`v6.4.1`](https://github.com/git-stunts/git-cas/milestone/8)  | Historical bounded-residency proof closeout                 | [#38](https://github.com/git-stunts/git-cas/issues/38), [#46](https://github.com/git-stunts/git-cas/issues/46)                                                                                                                 |
 | [`v6.5.0`](https://github.com/git-stunts/git-cas/milestone/5)  | Bounded lazy bundle references and immutable metadata reads | [#81](https://github.com/git-stunts/git-cas/issues/81)                                                                                                                                                                         |
+| [`v6.5.1`](https://github.com/git-stunts/git-cas/milestone/11) | Bounded immutable page payload reuse                        | [#85](https://github.com/git-stunts/git-cas/issues/85)                                                                                                                                                                         |
 | [`v6.6.0`](https://github.com/git-stunts/git-cas/milestone/9)  | Operator TUI and agent automation follow-through            | [#39](https://github.com/git-stunts/git-cas/issues/39), [#40](https://github.com/git-stunts/git-cas/issues/40)                                                                                                                 |
 | [`v6.7.0`](https://github.com/git-stunts/git-cas/milestone/10) | Browser and edge read-path exploration                      | [#41](https://github.com/git-stunts/git-cas/issues/41)                                                                                                                                                                         |
 | [`v7.0.0`](https://github.com/git-stunts/git-cas/milestone/6)  | Protocol break only if audit requires it                    | [#42](https://github.com/git-stunts/git-cas/issues/42), only when justified                                                                                                                                                    |
@@ -46,10 +47,10 @@ GitHub wins and this file should be corrected.
 
 The latest landed design record is:
 
-- [0050-lazy-bundle-reference-reads](./docs/design/0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md)
+- [0051-bounded-page-payload-reuse](./docs/design/0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md)
 
 Its GitHub goalpost issue,
-[#81](https://github.com/git-stunts/git-cas/issues/81), owns the release
+[#85](https://github.com/git-stunts/git-cas/issues/85), owns the release
 evidence. The design doc is the durable contract; GitHub records completion.
 
 The `v6.2.0` slice record is:

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
 **Last tagged release:** `v6.5.0` (`2026-07-18`)
-**Current release state:** `v6.5.0` is published to npm with provenance and to GitHub Releases.
-**Latest verification:** the exact reviewed merge `f464b929` passed 14/14 release-verifier steps with 6,625 observed tests across Node.js, Bun, and Deno; release workflow `29655337483` then passed validation, tests, trusted npm publication, and final GitHub Release creation.
+**Current release state:** `v6.5.1` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
+**Latest verification:** the versioned `v6.5.1` candidate passed 14/14 release-verifier steps with 6,676 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,6 +18,10 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
+- **v6.5.1 candidate posture** — bounded immutable page payload reuse is merged
+  through reviewed commit `ad5b91b2`; npm, JSR, and runtime version metadata
+  identify `6.5.1`, while the tag and registry artifacts remain deliberately
+  absent until release-candidate review completes.
 - **v6.5.0 artifact posture** — signed tag `v6.5.0` resolves to reviewed merge
   `f464b929`; npm reports `@git-stunts/git-cas@6.5.0` as `latest` with SLSA
   provenance, and the final GitHub Release is published. Bounded direct bundle
@@ -111,13 +115,11 @@
 - GitHub Issues are canonical. If this section and GitHub disagree, GitHub
   wins and this section should be corrected.
 - Current release goalpost:
-  [#39 v6.6.0: Operator TUI](https://github.com/git-stunts/git-cas/issues/39)
-  and
-  [#40 v6.6.0: Agent automation follow-through](https://github.com/git-stunts/git-cas/issues/40)
+  [#85 Bounded immutable page payload reuse](https://github.com/git-stunts/git-cas/issues/85)
   under the
-  [`v6.6.0` milestone](https://github.com/git-stunts/git-cas/milestone/9).
+  [`v6.5.1` milestone](https://github.com/git-stunts/git-cas/milestone/11).
 - The latest landed design record is
-  [0050-lazy-bundle-reference-reads](./docs/design/0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md).
+  [0051-bounded-page-payload-reuse](./docs/design/0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md).
 
 ## Read Next
 

UPGRADING.md

@@ -2,6 +2,28 @@
 
 v6.0.0 is a major release that simplifies the encryption model, hardens security defaults, and cleans up the architecture. This guide covers every breaking change and what you need to do.
 
+## v6.5.0 To v6.5.1
+
+v6.5.1 is API-additive and does not require stored-data migration. Repeated
+`pages.get()` calls now reuse immutable payload bytes through a process-local
+LRU bounded by entry count and aggregate bytes. Applications may tune the
+defaults with `pageCacheEntries` and `pageCacheBytes` when constructing the
+store.
+
+Every caller still receives an independent `Uint8Array`, and each call's
+`maxBytes` limit remains authoritative on cold, resident, and shared in-flight
+reads. Rejected work remains retryable, and an individually oversized payload
+does not displace unrelated residents.
+
+`pages.open()` remains the streaming API and never enters the payload cache.
+Cache residence is an optimization, not retention evidence; keep each handle
+reachable through a workspace, RootSet, cache acquisition, publication, or
+other documented lifetime while consuming it.
+
+See [v6.5.1 Release Notes](./docs/releases/v6.5.1.md) and
+[Application Storage](./docs/API.md#application-storage) for the complete
+residency and lifetime contract.
+
 ## v6.4.0 To v6.5.0
 
 v6.5.0 is API-additive and does not require stored-data migration. It adds

docs/design/0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md

@@ -2,7 +2,7 @@
 schema: 'method.design/v1'
 cycle: '0051'
 slug: 'bounded-page-payload-reuse'
-status: 'active'
+status: 'landed'
 sponsor_human: 'James Ross'
 sponsor_agent: 'Codex'
 created: '2026-07-18'

docs/design/0051-bounded-page-payload-reuse/witness/release-candidate.md

@@ -0,0 +1,94 @@
+# PERF-0051 v6.5.1 Release Candidate Witness
+
+Date: 2026-07-18
+
+Issue: #85
+
+Implementation review: #87
+
+Release review: #88
+
+## Scope
+
+This witness records the pre-publication release candidate for bounded immutable
+page payload reuse. It does not claim that a `v6.5.1` tag, npm artifact, or
+GitHub Release exists. This is an explicitly unpublished candidate.
+
+The candidate:
+
+- sets npm, JSR, and the runtime `PACKAGE_VERSION` export to `6.5.1`;
+- moves bounded page payload reuse from `Unreleased` to `6.5.1`;
+- packages and links `docs/releases/v6.5.1.md`;
+- adds v6.5.0-to-v6.5.1 adoption guidance to `UPGRADING.md`;
+- marks design 0051 landed and records the v6.5.1 milestone in `ROADMAP.md`;
+- records an honest release-candidate posture in `STATUS.md`; and
+- preserves the v6.5.0 publication witness as immutable history.
+
+## Implementation Provenance
+
+| Capability                                  | Review anchor | Commit                                     |
+| ------------------------------------------- | ------------- | ------------------------------------------ |
+| Bounded immutable page payload reuse        | #87           | `5495eefbc83a2dcc21366cf5e0ebd960998c3c48` |
+| Internal-only cache defaults                | #87           | `4343163ed18a6e8f96ecb39f21daf4de8c55b9f7` |
+| In-flight, metadata, and test review repairs | #87           | `3a5360d21656d62dc90c6632658cfefa0fbf3f36` |
+| Reviewed feature merge                      | #87           | `ad5b91b2ff7c156526961a8d0575be1a250d92c6` |
+
+The public constructor accepts independent entry and byte residency bounds.
+`pages.get()` probes immutable OID payload state before Git metadata, validates
+cold misses before materialization, checks every caller's limit after
+resolution, and returns an independent byte copy.
+
+[cite: `index.d.ts#709-712@ad5b91b2ff7c156526961a8d0575be1a250d92c6`]
+[cite: `index.js#135-137@ad5b91b2ff7c156526961a8d0575be1a250d92c6`]
+[cite: `src/domain/services/PageService.js#84-103@ad5b91b2ff7c156526961a8d0575be1a250d92c6`]
+
+The shared cache keeps unresolved work separate from completed LRU residence.
+Only completed entries participate in count and byte eviction, so capacity
+pressure cannot break A/B/A coalescing or displace a resident before an
+in-flight value's weight is known.
+
+[cite: `src/helpers/boundedPromiseCache.js#44-85@ad5b91b2ff7c156526961a8d0575be1a250d92c6`]
+[cite: `src/helpers/boundedPromiseCache.js#96-115@ad5b91b2ff7c156526961a8d0575be1a250d92c6`]
+
+The real-Git regression contract requires an identical warm page read to issue
+zero additional Git commands.
+
+[cite: `test/integration/bundle-reference-performance.test.js#111-125@ad5b91b2ff7c156526961a8d0575be1a250d92c6`]
+
+## Verification
+
+The versioned candidate passed the complete `pnpm run release:verify` method:
+
+| Gate                       | Result | Observed tests |
+| -------------------------- | ------ | -------------: |
+| Lint                       | PASS   |              - |
+| Unit tests (Node)          | PASS   |          2,036 |
+| Unit tests (Bun)           | PASS   |          2,035 |
+| Unit tests (Deno)          | PASS   |          2,026 |
+| Public type compatibility  | PASS   |              - |
+| Integration tests (Node)   | PASS   |            193 |
+| Integration tests (Bun)    | PASS   |            193 |
+| Integration tests (Deno)   | PASS   |            193 |
+| Examples and build stamp   | PASS   |              - |
+| npm and JSR dry-runs       | PASS   |              - |
+| **Release method summary** | **PASS (14/14)** |      **6,676** |
+
+The feature PR also merged only after GitHub lint and all Node/Bun/Deno jobs
+passed, CodeRabbit approved, and every review thread was resolved. Tag and
+publication evidence remain deliberately absent from this candidate witness.
+
+## Publication Gate
+
+Publication remains blocked until all of the following are true:
+
+1. the versioned candidate passes every release-verifier step;
+2. the release PR passes GitHub CI, self-review, Code Lawyer review, and the
+   agreed CodeRabbit posture;
+3. the release PR is merged without unresolved findings;
+4. a signed annotated `v6.5.1` tag points at the reviewed merge commit;
+5. the release workflow passes version validation and runtime tests;
+6. npm reports `@git-stunts/git-cas@6.5.1` with provenance; and
+7. GitHub reports the final non-draft `v6.5.1` Release.
+
+Downstream git-warp adoption and its CPU, wall-clock, Git-command, and
+bounded-memory evidence remain separate post-publication obligations.

docs/design/README.md

@@ -11,7 +11,6 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Active METHOD Cycles
 
-- [0051-bounded-page-payload-reuse - bounded-page-payload-reuse](./0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md)
 - [0050-lazy-bundle-reference-reads - lazy-bundle-reference-reads](./0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md)
 - [0049-scoped-staging-workspaces — scoped-staging-workspaces](./0049-scoped-staging-workspaces/scoped-staging-workspaces.md)
 - [0048-scoped-cache-acquisitions — scoped-cache-acquisitions](./0048-scoped-cache-acquisitions/scoped-cache-acquisitions.md)
@@ -44,6 +43,7 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Landed METHOD Cycles
 
+- [0051-bounded-page-payload-reuse - bounded-page-payload-reuse](./0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md)
 - [0046-gc-retention-root-sets — gc-retention-root-sets](./0046-gc-retention-root-sets/gc-retention-root-sets.md)
 - [0047-application-storage-cache-boundary — application-storage-cache-boundary](./0047-application-storage-cache-boundary/application-storage-cache-boundary.md)
 

docs/releases/v6.5.1.md

@@ -29,7 +29,16 @@ The real-Git command-count integration contract proves that an identical warm
 end-to-end CPU, wall-clock, Git-command, and bounded-memory deltas after adopting
 this release.
 
+## Verification
+
+The versioned candidate passed all 14 release-verifier steps with 6,676 observed
+tests: 2,036 Node unit tests, 2,035 Bun unit tests, 2,026 Deno unit tests, and
+193 real-Git integration tests on each runtime. Lint, examples, public type
+compatibility, build stamping, npm packaging dry-run, and JSR publication
+dry-run also passed.
+
 ## Compatibility
 
-This release changes no persisted formats, handles, refs, witnesses, or existing
-method signatures. The two constructor options are additive and optional.
+This release does not require stored-data migration. It changes no persisted
+formats, handles, refs, witnesses, or existing method signatures. The two
+constructor options are additive and optional.

jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@git-stunts/git-cas",
-  "version": "6.5.0",
+  "version": "6.5.1",
   "exports": {
     ".": "./index.js",
     "./service": "./src/domain/services/CasService.js",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@git-stunts/git-cas",
-  "version": "6.5.0",
+  "version": "6.5.1",
   "description": "Content-addressed storage backed by Git's object database, with optional encryption and pluggable codecs",
   "type": "module",
   "main": "index.js",
@@ -37,6 +37,7 @@
     "docs/releases/v6.3.0.md",
     "docs/releases/v6.4.0.md",
     "docs/releases/v6.5.0.md",
+    "docs/releases/v6.5.1.md",
     "docs/THREAT_MODEL.md",
     "docs/VAULT_INTERNALS.md",
     "docs/WALKTHROUGH.md",

src/package-version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '6.5.0';
+export const PACKAGE_VERSION = '6.5.1';

test/unit/docs/package-docs.test.js

@@ -15,6 +15,7 @@ const requiredStandardDocs = [
   'docs/releases/v6.3.0.md',
   'docs/releases/v6.4.0.md',
   'docs/releases/v6.5.0.md',
+  'docs/releases/v6.5.1.md',
 ];
 const forbiddenPackagePrefixes = ['docs/audit/', 'docs/archive/', 'docs/method/'];
 const forbiddenPackageFiles = ['docs/cli.gif', 'docs/vault.gif'];
@@ -86,6 +87,7 @@ function publicPackagedMarkdownFiles(files) {
     'docs/releases/v6.3.0.md',
     'docs/releases/v6.4.0.md',
     'docs/releases/v6.5.0.md',
+    'docs/releases/v6.5.1.md',
     'docs/THREAT_MODEL.md',
     'docs/WALKTHROUGH.md',
   ].filter((file) => files.has(file));