docs(release): record git-cas v6.5.0 publication

[flyingrobots]

Summary

• record the signed v6.5.0 tag, successful release workflow, npm provenance, and final GitHub Release
• advance STATUS.md from the release candidate to the published artifact and make v6.6.0 the active goalpost
• enforce the exact publication identity in release lifecycle tests, with formatting-tolerant Markdown table assertions

Closure Evidence

The public facade exposes direct bundle-member lookup and lazy reference iteration.

[cite: index.js#216-224@d5f770fb4589cd33d2244c83232ee7ede1df9ec1]
[cite: index.d.ts#1460-1501@d5f770fb4589cd33d2244c83232ee7ede1df9ec1]

Selected traversal validates descriptor summaries, bounded descriptor bytes, traversed tree edges, and the selected target type without recursively resolving the target support graph.

[cite: src/domain/services/BundleService.js#111-152@d5f770fb4589cd33d2244c83232ee7ede1df9ec1]
[cite: src/domain/services/BundleService.js#463-492@d5f770fb4589cd33d2244c83232ee7ede1df9ec1]

Bounded cache settlement and RootSet race recovery retain valid residents and recover only the exact failed compare-and-swap after an observed head advance.

[cite: src/helpers/boundedPromiseCache.js#51-78@d5f770fb4589cd33d2244c83232ee7ede1df9ec1]
[cite: src/domain/services/RootSetPersistence.js#49-65@d5f770fb4589cd33d2244c83232ee7ede1df9ec1]

Verification

• pnpm run lint
• pnpm exec vitest run test/unit/docs (62 tests)
• pre-push full Node unit gate (2,020 passed, 2 skipped)
• release workflow 29655337483
• npm @git-stunts/git-cas@6.5.0 is latest with SLSA provenance
• Graft structural review: documentation and tests only; no exported API changes

Closes #81

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 31 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c9eb3e2d-6a8a-48d6-946b-44859a59cf77

📥 Commits

Reviewing files that changed from the base of the PR and between f464b92 and 6293ac8.

📒 Files selected for processing (3)

• STATUS.md
• docs/design/0050-lazy-bundle-reference-reads/witness/release-publication.md
• test/unit/docs/release-state.test.js

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Self-Code Review

@codex please confirm the zero-finding review posture against origin/main.

Severity	Count	Result
Critical	0	No correctness, data-loss, or release-identity defects found
High	0	No contract, lifecycle, or issue-closure defects found
Medium	0	No stale-state or evidence-integrity defects found
Low	0	No Markdown, formatting, or maintainability defects found

Reviewed the complete origin/main...6293ac8b diff after fetching current refs from a clean worktree.

• Intent: publication facts match signed tag fa955936, peeled target f464b929, workflow 29655337483, npm registry metadata, and the SLSA attestation.
• Consequences: only release documentation and its lifecycle test change; Graft reports no exported API impact.
• Test posture: lint passed; all 62 documentation tests passed; the pre-push gate passed all 2,020 Node unit tests with 2 skips.
• Formatting: Prettier and git diff --check passed.
• Residual risk: registry and GitHub evidence are external snapshots, but exact immutable identities are pinned and executable tests guard drift.

Finding count: 0.