release: git-cas v6.5.2

BEARING.md

@@ -126,16 +126,16 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.1 shipped and the v6.5.2 performance candidate under review, active
-work is tracked in GitHub Issues and Milestones. Repo docs hold design and
-evidence records, not the active queue.
+With v6.5.1 shipped and the versioned v6.5.2 release candidate being prepared,
+active work is tracked in GitHub Issues and Milestones. Repo docs hold design
+and evidence records, not the active queue.
 
-The current design under review is
+The latest landed design is
 [0052-persistent-git-object-sessions](./docs/design/0052-persistent-git-object-sessions/persistent-git-object-sessions.md).
 Its release evidence is attached to
 [#90](https://github.com/git-stunts/git-cas/issues/90) and the
-[`v6.5.2` milestone](https://github.com/git-stunts/git-cas/milestone/12). No
-later design is selected here; GitHub owns that decision.
+[`v6.5.2` milestone](https://github.com/git-stunts/git-cas/milestone/12). Tag
+and publication evidence remain pending; no later design is selected here.
 
 The broader horizon remains:
 

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.5.2] — 2026-07-19
+
 ### Added
 
 - **Bounded page batches and explicit resource closure** -

README.md

@@ -49,7 +49,7 @@ Unlike traditional LFS which moves files to external servers, `git-cas` treats t
 Existing v5 users should read [UPGRADING.md](./UPGRADING.md) and run
 `npm run upgrade` in dry-run mode before restoring old encrypted vault entries.
 For the release overview, see the
-[v6.5.1 Release Notes](./docs/releases/v6.5.1.md).
+[v6.5.2 Release Notes](./docs/releases/v6.5.2.md).
 
 ### 1. CLI Usage
 
@@ -214,6 +214,8 @@ All three runtimes are tested in CI on every push. The hexagonal architecture is
   references, immutable metadata reuse, and corrected concurrency settlement.
 - **[v6.5.1 Release Notes](./docs/releases/v6.5.1.md)**: Bounded immutable page
   payload reuse with zero-command warm reads.
+- **[v6.5.2 Release Notes](./docs/releases/v6.5.2.md)**: Persistent bounded Git
+  object sessions, scoped page batches, and deterministic resource closure.
 - **[Upgrading](./UPGRADING.md)**: Migration guide for v5 → v6.
 - **[Changelog](./CHANGELOG.md)**: Version history and migration notes.
 

ROADMAP.md

@@ -44,9 +44,9 @@ GitHub wins and this file should be corrected.
 | [`v6.7.0`](https://github.com/git-stunts/git-cas/milestone/10) | Browser and edge read-path exploration                      | [#41](https://github.com/git-stunts/git-cas/issues/41)                                                                                                                                                                         |
 | [`v7.0.0`](https://github.com/git-stunts/git-cas/milestone/6)  | Protocol break only if audit requires it                    | [#42](https://github.com/git-stunts/git-cas/issues/42), only when justified                                                                                                                                                    |
 
-## Current Design
+## Latest Landed Design
 
-The current active design record is:
+The latest landed design record is:
 
 - [0052-persistent-git-object-sessions](./docs/design/0052-persistent-git-object-sessions/persistent-git-object-sessions.md)
 

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
 **Last tagged release:** `v6.5.1` (`2026-07-18`)
-**Current release state:** `v6.5.1` is published to npm with provenance and to GitHub Releases.
-**Latest verification:** the reviewed release tree passed 14/14 release-verifier steps with 6,676 observed tests; release workflow `29666480492` then passed validation, tests, trusted npm publication, and final GitHub Release creation from merge `49b7d5cb`.
+**Current release state:** `v6.5.2` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
+**Latest verification:** the versioned `v6.5.2` candidate passed 14/14 release-verifier steps with 6,817 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -20,14 +20,16 @@
   portability are still partial.
 - **v6.5.2 candidate posture** - persistent bounded Git object sessions,
   scoped page-write batches, and deterministic local resource closure are
-  implemented under [#90](https://github.com/git-stunts/git-cas/issues/90).
-  Unit, Docker real-Git integration, and Node/Bun/Deno platform gates pass; PR,
-  review, merge, and publication evidence remain outstanding.
+  merged through reviewed commit `4ce37adc` under
+  [#90](https://github.com/git-stunts/git-cas/issues/90). npm, JSR, and runtime
+  version metadata identify `6.5.2`; tag and registry artifacts remain
+  deliberately absent until release-candidate review completes.
 - **v6.5.1 artifact posture** — signed tag `v6.5.1` resolves to reviewed merge
   `49b7d5cb`; npm reports `@git-stunts/git-cas@6.5.1` as `latest` with SLSA
-  provenance, and the final GitHub Release is published. Bounded immutable page
-  payload reuse is shipped. JSR dry-run validation is healthy, but JSR
-  publication is not part of the release workflow.
+  provenance, and release workflow `29666480492` published the final GitHub
+  Release. Bounded immutable page payload reuse is shipped. JSR dry-run
+  validation is healthy, but JSR publication is not part of the release
+  workflow.
 - **v6.5.0 artifact posture** — signed tag `v6.5.0` resolves to reviewed merge
   `f464b929`; npm reports `@git-stunts/git-cas@6.5.0` as `latest` with SLSA
   provenance, and the final GitHub Release is published. Bounded direct bundle
@@ -130,7 +132,7 @@
   [#40 v6.6.0: Agent automation follow-through](https://github.com/git-stunts/git-cas/issues/40)
   under the
   [`v6.6.0` milestone](https://github.com/git-stunts/git-cas/milestone/9).
-- The latest active design record is
+- The latest landed design record is
   [0052-persistent-git-object-sessions](./docs/design/0052-persistent-git-object-sessions/persistent-git-object-sessions.md).
 
 ## Read Next

UPGRADING.md

@@ -2,6 +2,29 @@
 
 v6.0.0 is a major release that simplifies the encryption model, hardens security defaults, and cleans up the architecture. This guide covers every breaking change and what you need to do.
 
+## v6.5.1 To v6.5.2
+
+v6.5.2 is API-additive and does not require stored-data migration. Immutable
+metadata and tree reads automatically reuse bounded typed Git sessions when the
+injected plumbing supports them. Existing structural adapters remain compatible
+and continue through the command-per-operation fallback.
+
+Use `pages.putBatch()` when an application already has an explicit bounded page
+group. The default envelope accepts at most 256 pages and 32 MiB, supports a
+lower `maxBytes` on each page, preserves input order, and performs no writes
+until the complete bounded batch is valid. Individual `pages.put()` calls remain
+one-shot so an externally pruned unreachable blob can be recreated correctly.
+
+Call `await cas.close()` when the store is no longer needed, especially when an
+operation may still be active or a stream may remain unconsumed. Closing drains
+or terminates local Git processes and releases bounded cache residency only; it
+does not delete stored objects, move refs, or change retention or publication
+state.
+
+See [v6.5.2 Release Notes](./docs/releases/v6.5.2.md) and
+[Application Storage](./docs/API.md#application-storage) for the complete batch,
+streaming, and lifecycle contracts.
+
 ## v6.5.0 To v6.5.1
 
 v6.5.1 is API-additive and does not require stored-data migration. Repeated

docs/design/0052-persistent-git-object-sessions/persistent-git-object-sessions.md

@@ -7,7 +7,7 @@ release_home: 'v6.5.2'
 issue: 'https://github.com/git-stunts/git-cas/issues/90'
 goalpost_issue: 'https://github.com/git-stunts/git-cas/issues/90'
 tracker_source: 'github'
-status: 'active'
+status: 'landed'
 base_commit: '12fd67200641f385d2d756c302bb2e5701beefbc'
 owners:
   - '@git-stunts'

docs/design/0052-persistent-git-object-sessions/witness/release-candidate.md

@@ -0,0 +1,97 @@
+# PERF-0052 v6.5.2 Release Candidate Witness
+
+Date: 2026-07-19
+
+Issue: #90
+
+Implementation review: #91
+
+Release review: #92
+
+## Scope
+
+This witness records the pre-publication release candidate for persistent
+bounded Git object sessions, bounded page batches, and deterministic local
+resource closure. It does not claim that a `v6.5.2` tag, npm artifact, or GitHub
+Release exists. This is an explicitly unpublished candidate.
+
+The candidate:
+
+- sets npm, JSR, and the runtime `PACKAGE_VERSION` export to `6.5.2`;
+- moves the persistent-session and page-batch changes from `Unreleased` to
+  `6.5.2`;
+- packages and links `docs/releases/v6.5.2.md`;
+- adds v6.5.1-to-v6.5.2 adoption guidance to `UPGRADING.md`;
+- marks design 0052 landed and records its release-candidate posture;
+- preserves all v6.5.1 publication evidence as immutable history; and
+- leaves tag and registry publication claims deliberately absent.
+
+## Implementation Provenance
+
+| Capability                                   | Review anchor | Commit                                     |
+| -------------------------------------------- | ------------- | ------------------------------------------ |
+| Persistent typed Git object sessions         | #91           | `27831926327afc7522b39ab435d29b46b7ac428e` |
+| Bounded page batching and facade closure     | #91           | `27831926327afc7522b39ab435d29b46b7ac428e` |
+| Lifecycle, teardown, and boundedness repairs | #91           | `1819d8572707d8846ffa7ace9847f490cdb6438b` |
+| Final review repairs                         | #91           | `efce7879348072a25759996dd159e35b638c4035` |
+| Reviewed feature merge                       | #91           | `4ce37adc57d49d2633507c3fbdc46e98617b26d6` |
+
+The public page capability exposes bounded ordered batches, and the root facade
+exposes explicit close and async disposal without making the optional
+persistence-port capabilities mandatory for legacy structural adapters.
+
+[cite: `index.d.ts#1466-1474@4ce37adc57d49d2633507c3fbdc46e98617b26d6`]
+[cite: `index.d.ts#1723-1742@4ce37adc57d49d2633507c3fbdc46e98617b26d6`]
+
+The Git adapter feature-detects typed sessions, bounds parsed-tree residency,
+keeps individual writes one-shot, and scopes bulk writes to one completed and
+closed `fast-import` process.
+
+[cite: `src/infrastructure/adapters/GitPersistenceAdapter.js#41-180@4ce37adc57d49d2633507c3fbdc46e98617b26d6`]
+[cite: `src/infrastructure/adapters/GitPersistenceAdapter.js#499-570@4ce37adc57d49d2633507c3fbdc46e98617b26d6`]
+
+The real-Git regression contract proves semantic identity, one-session reads,
+one-process bounded batch writes, assertion-safe cleanup, and correct rewrite
+after aggressive external pruning.
+
+[cite: `test/integration/bundle-reference-performance.test.js#165-246@4ce37adc57d49d2633507c3fbdc46e98617b26d6`]
+
+## Verification
+
+The versioned candidate passed the complete `pnpm run release:verify` method:
+
+| Gate                       | Result           | Observed tests |
+| -------------------------- | ---------------- | -------------: |
+| Lint                       | PASS             |              - |
+| Unit tests (Node)          | PASS             |          2,080 |
+| Unit tests (Bun)           | PASS             |          2,079 |
+| Unit tests (Deno)          | PASS             |          2,070 |
+| Public type compatibility  | PASS             |              - |
+| Integration tests (Node)   | PASS             |            196 |
+| Integration tests (Bun)    | PASS             |            196 |
+| Integration tests (Deno)   | PASS             |            196 |
+| Examples and build stamp   | PASS             |              - |
+| npm and JSR dry-runs       | PASS             |              - |
+| **Release method summary** | **PASS (14/14)** |      **6,817** |
+
+The implementation PR merged only after GitHub lint and all Node/Bun/Deno jobs
+passed, CodeRabbit approved, every review thread was resolved, and the complete
+diff received a clean self-review. Tag and publication evidence remain
+deliberately absent from this candidate witness.
+
+## Publication Gate
+
+Publication remains blocked until all of the following are true:
+
+1. the versioned candidate passes every release-verifier step;
+2. the release PR passes GitHub CI, self-review, Code Lawyer review, and the
+   agreed CodeRabbit posture;
+3. the release PR is merged without unresolved findings;
+4. a signed annotated `v6.5.2` tag points at the reviewed merge commit;
+5. the release workflow passes version validation and runtime tests;
+6. npm reports `@git-stunts/git-cas@6.5.2` with provenance; and
+7. GitHub reports the final non-draft `v6.5.2` Release.
+
+Downstream git-warp adoption and its process-tree CPU, wall-clock,
+Git-command, and bounded-memory evidence remain separate post-publication
+obligations.

docs/design/0052-persistent-git-object-sessions/witness/verification.md

@@ -6,7 +6,9 @@ Issue: [#90](https://github.com/git-stunts/git-cas/issues/90)
 
 Implementation commit: `27831926327afc7522b39ab435d29b46b7ac428e`
 
-Final reviewed source commit: `1819d8572707d8846ffa7ace9847f490cdb6438b`
+Final reviewed source commit: `efce7879348072a25759996dd159e35b638c4035`
+
+Reviewed feature merge: `4ce37adc57d49d2633507c3fbdc46e98617b26d6`
 
 ## Contract
 

docs/design/README.md

@@ -11,7 +11,6 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Active METHOD Cycles
 
-- [0052-persistent-git-object-sessions - persistent-git-object-sessions](./0052-persistent-git-object-sessions/persistent-git-object-sessions.md)
 - [0050-lazy-bundle-reference-reads - lazy-bundle-reference-reads](./0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md)
 - [0049-scoped-staging-workspaces — scoped-staging-workspaces](./0049-scoped-staging-workspaces/scoped-staging-workspaces.md)
 - [0048-scoped-cache-acquisitions — scoped-cache-acquisitions](./0048-scoped-cache-acquisitions/scoped-cache-acquisitions.md)
@@ -44,6 +43,7 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Landed METHOD Cycles
 
+- [0052-persistent-git-object-sessions - persistent-git-object-sessions](./0052-persistent-git-object-sessions/persistent-git-object-sessions.md)
 - [0051-bounded-page-payload-reuse - bounded-page-payload-reuse](./0051-bounded-page-payload-reuse/bounded-page-payload-reuse.md)
 - [0046-gc-retention-root-sets — gc-retention-root-sets](./0046-gc-retention-root-sets/gc-retention-root-sets.md)
 - [0047-application-storage-cache-boundary — application-storage-cache-boundary](./0047-application-storage-cache-boundary/application-storage-cache-boundary.md)

docs/releases/v6.5.2.md

@@ -0,0 +1,63 @@
+# git-cas v6.5.2 Release Notes
+
+v6.5.2 removes repeated Git process startup from immutable object metadata and
+tree reads, adds an explicitly bounded page-batch write path, and gives store
+owners deterministic local resource cleanup.
+
+## Persistent Git Object Sessions
+
+`GitPersistenceAdapter` now reuses one lazily opened typed `cat-file` session
+for immutable metadata and tree reads. Tree creation uses typed `mktree`, while
+each explicit page batch uses one scoped `fast-import` process. Existing
+injected plumbing without typed session capabilities remains source-compatible
+and uses the command-per-operation fallback.
+
+Parsed tree residency is bounded by entry count and estimated bytes. Payload
+reads and streams preserve their existing bounds; streams are not buffered.
+Individual blob writes deliberately remain one-shot so a blob pruned by an
+external process is recreated on the next write rather than trusted through
+stale process state.
+
+## Bounded Page Batches
+
+`pages.putBatch()` accepts a complete explicit page group, defaults to at most
+256 pages and 32 MiB, and permits lower per-page and aggregate bounds. It
+collects and validates the bounded inputs before persistence, preserves input
+order, and returns immutable staged-page results with the same content identity
+as individual writes.
+
+## Resource Lifecycle
+
+`ContentAddressableStore.close()` and async disposal block new operations,
+drain work that already started, terminate abandoned streams and Git children,
+close typed sessions, and release bounded cache residency. Closing is local
+resource cleanup only. It never removes objects, moves refs, or changes
+retention and publication state.
+
+## Performance Evidence
+
+The controlled real-Git diagnostic reduced selected bundle-reference reads from
+225 Git processes to one and observed wall time from 288.647 ms to 50.366 ms.
+Bounded page writes fell from 32 processes to one and from 68.658 ms to
+33.490 ms. Semantic digests were identical in both comparisons. Timing is
+environment-specific; process counts and semantic equality are stable
+regression contracts.
+
+These measurements exclude Git child CPU and RSS. git-warp still owes its own
+process-tree CPU, end-to-end latency, and larger-than-memory streaming evidence
+after adopting this release.
+
+## Verification
+
+The versioned candidate passed all 14 release-verifier steps with 6,817 observed
+tests: 2,080 Node unit tests, 2,079 Bun unit tests, 2,070 Deno unit tests, and
+196 real-Git integration tests on each runtime. Lint, examples, public type
+compatibility, build stamping, npm packaging dry-run, and JSR publication
+dry-run also passed.
+
+## Compatibility
+
+This release does not require stored-data migration. Existing persisted formats,
+handles, refs, witnesses, and method signatures remain compatible. The batch and
+lifecycle methods are additive, and low-level persistence adapters may continue
+to omit the optional session, batch-write, and close capabilities.

jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@git-stunts/git-cas",
-  "version": "6.5.1",
+  "version": "6.5.2",
   "exports": {
     ".": "./index.js",
     "./service": "./src/domain/services/CasService.js",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@git-stunts/git-cas",
-  "version": "6.5.1",
+  "version": "6.5.2",
   "description": "Content-addressed storage backed by Git's object database, with optional encryption and pluggable codecs",
   "type": "module",
   "main": "index.js",
@@ -38,6 +38,7 @@
     "docs/releases/v6.4.0.md",
     "docs/releases/v6.5.0.md",
     "docs/releases/v6.5.1.md",
+    "docs/releases/v6.5.2.md",
     "docs/THREAT_MODEL.md",
     "docs/VAULT_INTERNALS.md",
     "docs/WALKTHROUGH.md",

src/package-version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '6.5.1';
+export const PACKAGE_VERSION = '6.5.2';

test/unit/docs/package-docs.test.js

@@ -16,6 +16,7 @@ const requiredStandardDocs = [
   'docs/releases/v6.4.0.md',
   'docs/releases/v6.5.0.md',
   'docs/releases/v6.5.1.md',
+  'docs/releases/v6.5.2.md',
 ];
 const forbiddenPackagePrefixes = ['docs/audit/', 'docs/archive/', 'docs/method/'];
 const forbiddenPackageFiles = ['docs/cli.gif', 'docs/vault.gif'];
@@ -88,6 +89,7 @@ function publicPackagedMarkdownFiles(files) {
     'docs/releases/v6.4.0.md',
     'docs/releases/v6.5.0.md',
     'docs/releases/v6.5.1.md',
+    'docs/releases/v6.5.2.md',
     'docs/THREAT_MODEL.md',
     'docs/WALKTHROUGH.md',
   ].filter((file) => files.has(file));