# git-cas v6.5.7 Release Notes

v6.5.7 removes process-per-payload startup for small blobs requested through
the streaming persistence contract. It changes no public package API, object
identity, stored-data format, ref, or retention behavior.

## Bounded Session-Backed Stream Reads

On plumbing that exposes a typed `cat-file --batch-command` session,
`GitPersistenceAdapter.readBlobStream()` now inspects immutable object type and
size before choosing a content route. A blob at or below the fixed 10 MiB
ceiling is read through the existing repository-scoped session and returned as
one `Buffer` chunk.

The ceiling is fixed independently of `maxBlobSize`; callers cannot configure
the optimization into unbounded allocation. Returning one chunk changes
backpressure granularity for admitted small objects, but the public
`AsyncIterable` method, byte sequence, object identity, and error surface remain
unchanged.

Objects above 10 MiB retain the genuine one-shot streaming path. Metadata is
inspected first, so oversized content is streamed exactly once and never read
and discarded through the bounded session. Plumbing without typed sessions,
unsupported object posture, and failed bounded reads retain the previous
one-shot fallback.

## Process-Topology Witness

The committed diagnostic used 32 deterministic 4,096-byte objects. The legacy
fallback opened 32 one-shot `cat-file` children. The bounded session route
opened one persistent child, issued 32 metadata requests and 32 bounded reads,
returned the same semantic digest, and left zero active sessions after close.

A 10 MiB + 1 byte object opened one persistent child for metadata and one
one-shot content stream. It performed no session content read. Docker-backed
integration tests repeat the small-object law in SHA-1 and SHA-256 repositories
and verify exact bytes plus deterministic closure.

These are structural process-count and semantic-equality results. They are not
a wall-clock guarantee, a claim that every downstream Git child disappears, or
an aggregate caller-residency bound.

## Verification

The release candidate passed the repository's complete 14-step verifier with
6,922 observed tests across Node, Bun, and Deno. The matrix includes public
type compatibility, executable examples, 202 real-Git integration tests on
each runtime, build stamping, and npm and JSR dry-runs.

## Compatibility

This release requires no application or stored-data migration. Existing
objects, manifests, handles, refs, retention evidence, package exports, and
custom persistence adapters remain valid. Consumers automatically receive the
bounded route when their injected Git plumbing supports typed sessions; large
payloads and fallback implementations keep the prior streaming behavior.