Release git-cas v6.5.7

BEARING.md

@@ -22,9 +22,11 @@ deterministic resource closure are published. Internal commits are independent
 of ambient Git identity. The coherent Bijou family is at 7.2.0, the interactive
 cockpit runs on Bijou's hosted framed-app boundary, and failed checked ref
 mutations are classified from structured post-failure posture instead of Git
-diagnostics. npm plus GitHub Releases are the active publication surfaces. JSR
-validation is healthy, but JSR publication remains outside the release
-workflow.
+diagnostics. The v6.5.7 release candidate reuses the persistent `cat-file`
+session for streaming blob reads at or below a fixed 10 MiB ceiling while
+preserving genuine one-shot streaming above that ceiling. npm plus GitHub
+Releases are the active publication surfaces. JSR validation is healthy, but
+JSR publication remains outside the release workflow.
 
 What exists now:
 
@@ -81,6 +83,10 @@ What exists now:
   still retires `mktree` after a bounded bulk write because Git's quick lookup
   cannot discover a pack created after that process prepared its object
   database.
+- **Bounded stream-session read candidate.** v6.5.7 routes blobs at or below a
+  fixed 10 MiB ceiling through the persistent `cat-file` session and returns one
+  bounded chunk. Larger objects are metadata-inspected but enter exactly one
+  genuine content stream; no session content read is attempted for them.
 - **Batched workspace page retention.** v6.5.4 adds
   `workspace.pages.putBatch()` so one bounded ordered page group is written and
   retained under one exact workspace generation instead of rewriting a growing
@@ -151,14 +157,14 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.6 shipped, active work is tracked in GitHub Issues and Milestones.
-Repo docs hold design and evidence records, not the active queue.
+With v6.5.6 shipped and the v6.5.7 candidate under release review, active work
+is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence
+records, not the active queue.
 
-The latest landed designs are
-[0056-bijou-7-framed-cockpit](./docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
-and
-[0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
-Their release evidence is retained under their witness directories.
+The candidate design is
+[0058-bounded-stream-session-reads](./docs/design/0058-bounded-stream-session-reads/bounded-stream-session-reads.md).
+Its release goalpost is [#115](https://github.com/git-stunts/git-cas/issues/115)
+in the [`v6.5.7` milestone](https://github.com/git-stunts/git-cas/milestone/17).
 
 The broader horizon remains:
 

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.5.7] — 2026-08-23
+
 ### Performance
 
 - **Bounded stream session reads** - `readBlobStream()` now reuses the

README.md

@@ -37,10 +37,10 @@ Unlike traditional LFS which moves files to external servers, `git-cas` treats t
   or publish them with generation-scoped evidence instead of managing Git
   objects, trees, or payload OIDs directly.
 - **Bounded Git Process Reuse**: Immutable object metadata and tree reads reuse
-  typed Git sessions behind the adapter, while explicitly bounded page batches
-  amortize writes without changing content identity. Read and payload streams
-  remain streaming; complete page-batch inputs are collected and validated only
-  within the explicit count-and-byte envelope.
+  typed Git sessions behind the adapter. On session-capable adapters, streaming
+  blob reads at or below a fixed 10 MiB ceiling use one bounded session read;
+  larger payloads retain the genuine one-shot streaming path. Explicitly
+  bounded page batches amortize writes without changing content identity.
 - **Key Lifecycle**: Envelope encryption separates DEKs from KEKs. Rotate passphrases across an entire vault without re-encrypting data blobs. Privacy mode HMAC-hashes slug names to prevent metadata discovery.
 - **Runtime-Adaptive**: A single core supports Node.js 22+, Bun, and Deno through a strict hexagonal port architecture with runtime-specific crypto adapters.
 
@@ -49,7 +49,7 @@ Unlike traditional LFS which moves files to external servers, `git-cas` treats t
 Existing v5 users should read [UPGRADING.md](./UPGRADING.md) and run
 `npm run upgrade` in dry-run mode before restoring old encrypted vault entries.
 For the release overview, see the
-[v6.5.6 Release Notes](./docs/releases/v6.5.6.md).
+[v6.5.7 Release Notes](./docs/releases/v6.5.7.md).
 
 ### 1. CLI Usage
 
@@ -230,6 +230,8 @@ All three runtimes are tested in CI on every push. The hexagonal architecture is
   identity for git-cas-owned commits in unconfigured bare repositories.
 - **[v6.5.6 Release Notes](./docs/releases/v6.5.6.md)**: Bijou 7 hosted
   cockpit ownership and deterministic checked-ref conflict classification.
+- **[v6.5.7 Release Notes](./docs/releases/v6.5.7.md)**: Bounded persistent
+  sessions for small streaming blob reads while large payloads remain streamed.
 - **[Upgrading](./UPGRADING.md)**: Migration guide for v5 → v6.
 - **[Changelog](./CHANGELOG.md)**: Version history and migration notes.
 

ROADMAP.md

@@ -53,10 +53,10 @@ GitHub wins and this file should be corrected.
 
 The latest landed design record is:
 
-- [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md)
+- [0058-bounded-stream-session-reads](./docs/design/0058-bounded-stream-session-reads/bounded-stream-session-reads.md)
 
 Its GitHub goalpost issue,
-[#111](https://github.com/git-stunts/git-cas/issues/111), owns the release
+[#115](https://github.com/git-stunts/git-cas/issues/115), owns the release
 evidence. The design doc is the durable contract; GitHub records completion.
 
 The `v6.2.0` slice record is:

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS
 
 **Last tagged release:** `v6.5.6` (`2026-07-30`)
-**Current release state:** `v6.5.6` is published to npm and GitHub Releases; JSR remains validation-only.
-**Latest verification:** reviewed merge `257e8821` passed 14/14 release-verifier steps with 6,898 observed tests before tagging; release workflow `30526282895` then passed tag validation, lint, unit, Node/Bun/Deno real-Git integration, npm OIDC publication, and final GitHub Release creation.
+**Current release state:** `v6.5.7` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
+**Latest verification:** versioned `v6.5.7` candidate-preparation commit `7631d597` (the direct child of implementation merge `1e30740c`) passed 14/14 release-verifier steps with 6,922 observed tests across Node, Bun, Deno, and all three real-Git integration suites.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,6 +18,12 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
+- **v6.5.7 candidate posture** — implementation PR
+  [#116](https://github.com/git-stunts/git-cas/pull/116) merged bounded
+  session-backed small stream reads as `1e30740c`. npm, JSR, and runtime
+  metadata identify `6.5.7`; the signed tag and registry artifacts remain
+  deliberately absent pending release review. The fixed 10 MiB ceiling is
+  independent of `maxBlobSize`, and larger objects remain genuinely streamed.
 - **v6.5.6 artifact posture** — signed tag `v6.5.6` resolves to reviewed release
   merge `257e8821`; npm reports `@git-stunts/git-cas@6.5.6` as `latest` with
   publish and SLSA provenance, and release workflow `30526282895` published the
@@ -156,7 +162,7 @@
   goalposts remain queued under
   [`v6.6.0`](https://github.com/git-stunts/git-cas/milestone/9).
 - The latest landed design record is
-  [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
+  [0058-bounded-stream-session-reads](./docs/design/0058-bounded-stream-session-reads/bounded-stream-session-reads.md).
 
 ## Read Next
 

UPGRADING.md

@@ -2,6 +2,25 @@
 
 v6.0.0 is a major release that simplifies the encryption model, hardens security defaults, and cleans up the architecture. This guide covers every breaking change and what you need to do.
 
+## v6.5.6 To v6.5.7
+
+v6.5.7 changes no public API, package export, object identity, manifest, ref,
+or retention contract and requires no application or stored-data migration.
+
+On session-capable Git persistence adapters, `readBlobStream()` now inspects
+immutable object metadata through the persistent `cat-file` session. Blobs at
+or below a fixed 10 MiB ceiling are returned as one bounded chunk through that
+session. This changes backpressure granularity for admitted small reads, but
+the method remains an `AsyncIterable` with identical bytes and errors.
+
+Objects above 10 MiB retain the genuine one-shot streaming path and are never
+speculatively session-read. Raising `maxBlobSize` cannot raise this fixed
+ceiling. Adapters without typed sessions, plus exceptional metadata or bounded
+read failures, retain the existing one-shot fallback.
+
+See [v6.5.7 Release Notes](./docs/releases/v6.5.7.md) for the measured process
+topology, fixed residency boundary, and compatibility details.
+
 ## v6.5.5 To v6.5.6
 
 v6.5.6 changes no public API or stored-data schema and requires no migration.

docs/design/0058-bounded-stream-session-reads/bounded-stream-session-reads.md

@@ -7,7 +7,7 @@ release_home: 'v6.5.7'
 issue: 'https://github.com/git-stunts/git-cas/issues/115'
 goalpost_issue: 'https://github.com/git-stunts/git-cas/issues/115'
 tracker_source: 'github'
-status: 'active'
+status: 'landed'
 base_commit: '00661b07271d8ca7166c0b62beeb1408d72a3706'
 owners:
   - '@git-stunts'
@@ -400,7 +400,7 @@ The work is done when:
       unchanged.
 - [x] The fixed ceiling and nonclaims are documented consistently.
 - [x] Node, Bun, Deno, lint, package, JSR, and release gates pass.
-- [ ] The committed witness is linked from the reviewed PR.
+- [x] The committed witness is linked from the reviewed PR.
 - [ ] The implementation and release PRs merge normally.
 - [ ] Signed tag, npm package/provenance, workflow, and GitHub Release are
       independently verified.
@@ -427,6 +427,7 @@ the authoritative real-Git run is through Docker.
 
 - [Machine-readable process-topology witness](./witness/bounded-stream-session-reads.json)
 - [Human-readable verification record](./witness/verification.md)
+- [v6.5.7 release-candidate witness](./witness/release-candidate.md)
 
 The witness packet answers:
 
@@ -492,10 +493,15 @@ Implementation checkpoint before review:
   content stream, with no session content read;
 - the implementation tree passed all 14 release-verification gates with 6,919
   observed tests before publication work began.
+- implementation PR [#116](https://github.com/git-stunts/git-cas/pull/116)
+  merged normally as `1e30740c8670bf42b8bb863f8feb99a5e0f0f29b` after the
+  sole review finding was fixed and confirmed;
+- merged-main CI run `32635843285` repeated lint, unit, and Node/Bun/Deno
+  real-Git validation before the release candidate was prepared.
 
 Publication outcome will be appended after the signed tag, npm package,
 provenance, workflow, and GitHub Release are independently verified.
 
 PR:
 
-- pending
+- [#116 - Reuse bounded Git sessions for small streaming reads](https://github.com/git-stunts/git-cas/pull/116)

docs/design/0058-bounded-stream-session-reads/witness/release-candidate.md

@@ -0,0 +1,84 @@
+# PERF-0058 v6.5.7 Release Candidate Witness
+
+Date: 2026-08-23
+
+Issue: #115
+
+Implementation review: #116
+
+Release review: #117
+
+## Scope
+
+This witness records the pre-publication candidate for bounded session-backed
+small stream reads. It does not claim that a `v6.5.7` tag, npm artifact, or
+GitHub Release exists. This is an explicitly unpublished candidate.
+
+The candidate:
+
+- sets npm, JSR, and runtime package metadata to `6.5.7`;
+- moves bounded stream-session reads from `Unreleased` to `6.5.7`;
+- packages and links `docs/releases/v6.5.7.md`;
+- records v6.5.6 publication evidence as immutable history;
+- marks design 0058 landed after implementation merge #116; and
+- leaves v6.5.7 tag and registry claims deliberately absent.
+
+## Implementation Provenance
+
+| Capability | Review anchor | Commit |
+| --- | --- | --- |
+| Bounded stream-session route | #116 | `135a8ff416b12e6abede0b0f78a3e6ba00ca1255` |
+| Deterministic process witness | #116 | `a34762c9ef1cf0bf4f717d2892d1ca0744f7e762` |
+| Failure-safe real-Git cleanup | #116 | `c344d119fd2afb5f7c024b4912714acbfd156768` |
+
+Implementation review #116 merged normally as
+`1e30740c8670bf42b8bb863f8feb99a5e0f0f29b`. Its second parent is the exact
+reviewed head `c344d119fd2afb5f7c024b4912714acbfd156768`.
+
+The immutable versioned candidate-preparation commit is
+`7631d597b1091f5cb5c29c7c7770a5a2bf435cc7`. It is the direct child of
+implementation merge `1e30740c8670bf42b8bb863f8feb99a5e0f0f29b`; its tree is
+the exact candidate tree that produced the 6,922-test verification record
+below. Final release identity remains the normal merge of release review #117
+and the signed tag that peels to that merge.
+
+## Failure Witness
+
+At the RED commit, repeated `readBlobStream()` calls still opened one one-shot
+`cat-file` child per blob and never used the typed session content path. The
+GREEN witness uses 32 deterministic 4,096-byte objects: fallback opens 32
+children, the session route opens one child, and both routes produce the same
+semantic digest.
+
+The 10 MiB + 1 byte case opens one persistent child for metadata and exactly
+one one-shot child for content. It performs no session content read and leaves
+no active session after close.
+
+## Verification
+
+The implementation tree and the versioned release candidate each ran the
+complete `npm run release:verify` method. Final candidate counts are:
+
+| Gate | Result | Observed tests |
+| --- | --- | ---: |
+| Lint | PASS | - |
+| Unit tests (Node) | PASS | 2,109 |
+| Unit tests (Bun) | PASS | 2,108 |
+| Unit tests (Deno) | PASS | 2,099 |
+| Public type compatibility | PASS | - |
+| Integration tests (Node) | PASS | 202 |
+| Integration tests (Bun) | PASS | 202 |
+| Integration tests (Deno) | PASS | 202 |
+| Examples and build stamp | PASS | - |
+| npm and JSR dry-runs | PASS | - |
+| **Release method summary** | **PASS: 14/14 gates** | **6,922** |
+
+Tag and publication evidence remain deliberately absent from this candidate
+witness.
+
+## Publication Gate
+
+Publication remains blocked until the release PR passes GitHub CI and review,
+merges normally, the exact merged candidate passes full release verification,
+a signed annotated `v6.5.7` tag peels to that reviewed merge, and the release
+workflow publishes npm plus the final GitHub Release.

docs/design/0058-bounded-stream-session-reads/witness/verification.md

@@ -97,7 +97,8 @@ checks and non-test packaging/type gates are not included in that total.
 
 ## Remaining Publication Gates
 
-- merge the reviewed implementation PR normally;
+- implementation PR [#116](https://github.com/git-stunts/git-cas/pull/116)
+  merged normally as `1e30740c8670bf42b8bb863f8feb99a5e0f0f29b`;
 - prepare and fully verify a separate v6.5.7 release candidate from merged
   `main`;
 - merge the reviewed release PR normally;

docs/design/README.md

@@ -11,7 +11,6 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Active METHOD Cycles
 
-- [0058-bounded-stream-session-reads - bounded-stream-session-reads](./0058-bounded-stream-session-reads/bounded-stream-session-reads.md)
 - [0054-batched-page-retention - batched-page-retention](./0054-batched-page-retention/batched-page-retention.md)
 - [0050-lazy-bundle-reference-reads - lazy-bundle-reference-reads](./0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md)
 - [0049-scoped-staging-workspaces — scoped-staging-workspaces](./0049-scoped-staging-workspaces/scoped-staging-workspaces.md)
@@ -45,6 +44,7 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Landed METHOD Cycles
 
+- [0058-bounded-stream-session-reads - bounded-stream-session-reads](./0058-bounded-stream-session-reads/bounded-stream-session-reads.md)
 - [0057-deterministic-ref-conflict-posture - deterministic-ref-conflict-posture](./0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md)
 - [0056-bijou-7-framed-cockpit - bijou-7-framed-cockpit](./0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
 - [0055-internal-commit-identity - internal-commit-identity](./0055-internal-commit-identity/internal-commit-identity.md)

docs/method/retro/0058-bounded-stream-session-reads/bounded-stream-session-reads.md

@@ -0,0 +1,37 @@
+# Retro — 0058 Bounded Stream Session Reads
+
+## Drift Check
+
+- The cycle stayed inside the Git persistence adapter, deterministic process
+  diagnostics, release evidence, and compatibility documentation.
+- It did not widen the public API, change storage or retention truth, cache
+  payloads in consumers, or buffer objects above the fixed ceiling.
+
+## What Shipped To Main
+
+- Small `readBlobStream()` payloads at or below 10 MiB can reuse one persistent
+  typed `cat-file` session.
+- Oversized content remains on exactly one genuine one-shot stream after a
+  bounded metadata lookup.
+- Unit and SHA-1/SHA-256 real-Git tests prove route selection, exact bytes,
+  fixed-bound authority, fallbacks, and deterministic close.
+- Implementation PR #116 merged normally as
+  `1e30740c8670bf42b8bb863f8feb99a5e0f0f29b`.
+
+## What Did Not Yet Ship
+
+- The `v6.5.7` signed tag, npm artifact, provenance, and GitHub Release remain
+  deliberately absent until the reviewed release candidate merges.
+- git-warp and Think remain untouched; their publication order begins only
+  after git-cas v6.5.7 is independently verified live.
+
+## Debt
+
+- None added in git-cas. A persistent truly streaming `cat-file` protocol would
+  require separate plumbing ownership and evidence if a future workload
+  justifies it.
+
+## Cool Ideas
+
+- Reuse the committed process-count schema when git-warp consumes v6.5.7 so
+  downstream improvement is compared structurally, not inferred from timing.