From fa62d29346b21a19f9d2be7a0c8b4a4f623a0892 Mon Sep 17 00:00:00 2001
From: James Ross <james@flyingrobots.dev>
Date: Thu, 30 Jul 2026 00:40:42 -0700
Subject: [PATCH 1/2] release: prepare v6.5.6

---
 BEARING.md                                    | 32 ++++---
 CHANGELOG.md                                  |  2 +
 README.md                                     |  4 +-
 ROADMAP.md                                    |  6 +-
 STATUS.md                                     | 27 +++---
 UPGRADING.md                                  | 16 ++++
 .../witness/release-publication.md            | 56 +++++++++++++
 .../bijou-7-framed-cockpit.md                 | 17 ++--
 .../deterministic-ref-conflict-posture.md     | 17 ++--
 .../witness/release-candidate.md              | 77 +++++++++++++++++
 docs/design/README.md                         |  4 +-
 docs/releases/v6.5.6.md                       | 55 ++++++++++++
 jsr.json                                      |  2 +-
 package.json                                  |  3 +-
 src/package-version.js                        |  2 +-
 test/unit/docs/package-docs.test.js           |  2 +
 test/unit/docs/release-state.test.js          | 84 ++++++++++++++++---
 test/unit/docs/release-truth.test.js          | 15 ++++
 18 files changed, 369 insertions(+), 52 deletions(-)
 create mode 100644 docs/design/0055-internal-commit-identity/witness/release-publication.md
 create mode 100644 docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md
 create mode 100644 docs/releases/v6.5.6.md

diff --git a/BEARING.md b/BEARING.md
index ec202e1..581d662 100644
--- a/BEARING.md
+++ b/BEARING.md
@@ -19,11 +19,12 @@ expiry, witness, and repository-diagnostics APIs sit above mutable root sets
 and the low-level CAS pipeline. Direct bundle-reference reads and bounded
 immutable metadata/page reuse, bounded Git object sessions, page batches, and
 deterministic resource closure are published. Internal commits are independent
-of ambient Git identity. The active v6.5.6 cycle updates the coherent Bijou
-family to 7.2.0 and moves the interactive cockpit onto Bijou's hosted framed-app
-boundary. npm plus GitHub Releases are the active publication surfaces. JSR
-validation is healthy, but JSR publication remains outside the release
-workflow.
+of ambient Git identity. The v6.5.6 release candidate updates the coherent
+Bijou family to 7.2.0, moves the interactive cockpit onto Bijou's hosted
+framed-app boundary, and classifies failed checked ref mutations from structured
+post-failure posture instead of Git diagnostics. npm plus GitHub Releases are
+the active publication surfaces. JSR validation is healthy, but JSR publication
+remains outside the release workflow.
 
 What exists now:
 
@@ -91,6 +92,10 @@ What exists now:
   complete Bijou family and makes the frame the sole owner of terminal
   lifecycle, outer chrome, help, command/search palettes, settings,
   notifications, performance telemetry, and quit confirmation.
+- **Deterministic checked-ref conflict candidate.** Failed checked updates,
+  atomic anchors, and checked deletes inspect direct, symbolic, or absent
+  post-failure ref posture. Only disproved compare-and-swap preconditions become
+  the existing conflict result; unrelated operational failures remain original.
 - **Migration script.** `scripts/migrate-encryption.js` upgrades legacy v1/v2
   manifests to the current scheme identifiers.
 
@@ -146,15 +151,18 @@ These were the active tensions from the previous bearing. All resolved.
 
 ## Next Horizon
 
-With v6.5.5 shipped and the v6.5.6 framed-cockpit cycle being prepared, active
-work is tracked in GitHub Issues and Milestones. Repo docs hold design and
-evidence records, not the active queue.
+With v6.5.5 shipped and the v6.5.6 candidate under release review, active work
+is tracked in GitHub Issues and Milestones. Repo docs hold design and evidence
+records, not the active queue.
 
-The active design is
-[0056-bijou-7-framed-cockpit](./docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md).
-Its goalpost and hosted-shell slice are
+The candidate designs are
+[0056-bijou-7-framed-cockpit](./docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
+and
+[0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
+Their tracker issues are
 [#105](https://github.com/git-stunts/git-cas/issues/105) and
-[#106](https://github.com/git-stunts/git-cas/issues/106) in the
+[#106](https://github.com/git-stunts/git-cas/issues/106), plus
+[#111](https://github.com/git-stunts/git-cas/issues/111), in the
 [`v6.5.6` milestone](https://github.com/git-stunts/git-cas/milestone/16).
 
 The broader horizon remains:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56fdc98..4a8ba45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.5.6] — 2026-07-30
+
 ### Changed
 
 - **Bijou 7 framed cockpit** - updates the coherent Bijou dependency family to
diff --git a/README.md b/README.md
index ab1dab8..43dbcf0 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,7 @@ Unlike traditional LFS which moves files to external servers, `git-cas` treats t
 Existing v5 users should read [UPGRADING.md](./UPGRADING.md) and run
 `npm run upgrade` in dry-run mode before restoring old encrypted vault entries.
 For the release overview, see the
-[v6.5.5 Release Notes](./docs/releases/v6.5.5.md).
+[v6.5.6 Release Notes](./docs/releases/v6.5.6.md).
 
 ### 1. CLI Usage
 
@@ -228,6 +228,8 @@ All three runtimes are tested in CI on every push. The hexagonal architecture is
   retained under one exact staging-workspace generation.
 - **[v6.5.5 Release Notes](./docs/releases/v6.5.5.md)**: Self-contained
   identity for git-cas-owned commits in unconfigured bare repositories.
+- **[v6.5.6 Release Notes](./docs/releases/v6.5.6.md)**: Bijou 7 hosted
+  cockpit ownership and deterministic checked-ref conflict classification.
 - **[Upgrading](./UPGRADING.md)**: Migration guide for v5 → v6.
 - **[Changelog](./CHANGELOG.md)**: Version history and migration notes.
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 0ef49c7..ddfade6 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -43,7 +43,7 @@ GitHub wins and this file should be corrected.
 | [`v6.5.3`](https://github.com/git-stunts/git-cas/milestone/13) | Coherent Git object sessions across immutable writes        | [#94](https://github.com/git-stunts/git-cas/issues/94)                                                                                                                                                                         |
 | [`v6.5.4`](https://github.com/git-stunts/git-cas/milestone/14) | Batched staging-workspace page retention                    | [#99](https://github.com/git-stunts/git-cas/issues/99)                                                                                                                                                                         |
 | [`v6.5.5`](https://github.com/git-stunts/git-cas/milestone/15) | Identity-independent internal Git commits                   | [#102](https://github.com/git-stunts/git-cas/issues/102)                                                                                                                                                                       |
-| [`v6.5.6`](https://github.com/git-stunts/git-cas/milestone/16) | Bijou 7 framed cockpit                                      | [#105](https://github.com/git-stunts/git-cas/issues/105), [#106](https://github.com/git-stunts/git-cas/issues/106)                                                                                                             |
+| [`v6.5.6`](https://github.com/git-stunts/git-cas/milestone/16) | Bijou 7 framed cockpit and deterministic ref conflicts      | [#105](https://github.com/git-stunts/git-cas/issues/105), [#106](https://github.com/git-stunts/git-cas/issues/106), [#111](https://github.com/git-stunts/git-cas/issues/111)                                                    |
 | [`v6.6.0`](https://github.com/git-stunts/git-cas/milestone/9)  | Operator TUI and agent automation follow-through            | [#39](https://github.com/git-stunts/git-cas/issues/39), [#40](https://github.com/git-stunts/git-cas/issues/40)                                                                                                                 |
 | [`v6.7.0`](https://github.com/git-stunts/git-cas/milestone/10) | Browser and edge read-path exploration                      | [#41](https://github.com/git-stunts/git-cas/issues/41)                                                                                                                                                                         |
 | [`v7.0.0`](https://github.com/git-stunts/git-cas/milestone/6)  | Protocol break only if audit requires it                    | [#42](https://github.com/git-stunts/git-cas/issues/42), only when justified                                                                                                                                                    |
@@ -52,10 +52,10 @@ GitHub wins and this file should be corrected.
 
 The latest landed design record is:
 
-- [0055-internal-commit-identity](./docs/design/0055-internal-commit-identity/internal-commit-identity.md)
+- [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md)
 
 Its GitHub goalpost issue,
-[#102](https://github.com/git-stunts/git-cas/issues/102), owns the release
+[#111](https://github.com/git-stunts/git-cas/issues/111), owns the release
 evidence. The design doc is the durable contract; GitHub records completion.
 
 The `v6.2.0` slice record is:
diff --git a/STATUS.md b/STATUS.md
index 55fdcf1..97b5059 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -1,8 +1,8 @@
 # STATUS
 
-**Last tagged release:** `v6.5.4` (`2026-07-26`)
-**Current release state:** `v6.5.5` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
-**Latest verification:** the versioned `v6.5.5` candidate passed 14/14 release-verifier steps with 6,850 observed tests across Node, Bun, Deno, and all three real-Git integration suites; tag and publication verification remain pending.
+**Last tagged release:** `v6.5.5` (`2026-07-26`)
+**Current release state:** `v6.5.6` release candidate; tag, npm publication, and GitHub Release remain pending the reviewed tag workflow.
+**Latest verification:** the versioned `v6.5.6` candidate at implementation merge `4327effd` passed 14/14 release-verifier steps with 6,898 observed tests across Node, Bun, Deno, and all three real-Git integration suites.
 **Playback truth:** `main`
 **Runtimes:** Node.js 22.x, Bun, Deno
 **Current planning method:** [WORKFLOW.md](./WORKFLOW.md)
@@ -18,12 +18,19 @@
 - The machine-facing `git cas agent` surface exists and now supports
   OS-keychain passphrase sources for vault-derived key flows, but parity and
   portability are still partial.
-- **v6.5.5 candidate posture** — internal root-set, publication, and vault
-  commits now supply a git-cas-owned author and committer identity instead of
-  depending on ambient Git user configuration. Implementation PR
-  [#103](https://github.com/git-stunts/git-cas/pull/103) merged as
-  `fa3d5f64`; npm, JSR, and runtime metadata identify `6.5.5`, while tag and
-  registry artifacts remain deliberately absent pending release review.
+- **v6.5.6 candidate posture** — PR
+  [#109](https://github.com/git-stunts/git-cas/pull/109) merged the Bijou 7.2
+  framed cockpit as `e802269a`; PR
+  [#112](https://github.com/git-stunts/git-cas/pull/112) merged deterministic
+  checked-ref conflict classification as `4327effd`. npm, JSR, and runtime
+  metadata identify `6.5.6`; tag and registry artifacts remain deliberately
+  absent pending release review.
+- **v6.5.5 artifact posture** — signed tag `v6.5.5` resolves to reviewed merge
+  `9ea91a73`; npm reports `@git-stunts/git-cas@6.5.5` as the retained published
+  predecessor with SLSA provenance, and release workflow `30211630524`
+  published the final GitHub Release. Identity-independent git-cas-owned
+  commits are shipped. JSR dry-run validation is healthy, but JSR publication
+  is not part of the release workflow.
 - **v6.5.4 artifact posture** — signed tag `v6.5.4` resolves to reviewed merge
   `a2d23f5b`; npm reports `@git-stunts/git-cas@6.5.4` as `latest` with SLSA
   provenance, and release workflow `30205009357` published the final GitHub
@@ -146,7 +153,7 @@
   under the
   [`v6.6.0` milestone](https://github.com/git-stunts/git-cas/milestone/9).
 - The latest landed design record is
-  [0055-internal-commit-identity](./docs/design/0055-internal-commit-identity/internal-commit-identity.md).
+  [0057-deterministic-ref-conflict-posture](./docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md).
 
 ## Read Next
 
diff --git a/UPGRADING.md b/UPGRADING.md
index b6ade9e..5128c51 100644
--- a/UPGRADING.md
+++ b/UPGRADING.md
@@ -2,6 +2,22 @@
 
 v6.0.0 is a major release that simplifies the encryption model, hardens security defaults, and cleans up the architecture. This guide covers every breaking change and what you need to do.
 
+## v6.5.5 To v6.5.6
+
+v6.5.6 changes no public API or stored-data schema and requires no migration.
+Interactive terminals now run the cockpit through Bijou 7.2's hosted
+`FramedApp`; noninteractive output and machine-readable command behavior are
+unchanged.
+
+Checked ref updates, atomic anchors, and checked deletes now classify
+concurrency from structured post-failure ref posture instead of Git's
+human-readable diagnostics. Existing callers keep the same boolean and
+`GIT_REF_CONFLICT` contracts. Operational failures remain unchanged when the
+attempted ref precondition still holds.
+
+See [v6.5.6 Release Notes](./docs/releases/v6.5.6.md) for the framed-cockpit,
+progress, contrast, and deterministic conflict details.
+
 ## v6.5.4 To v6.5.5
 
 v6.5.5 changes no public API and requires no stored-data migration. New
diff --git a/docs/design/0055-internal-commit-identity/witness/release-publication.md b/docs/design/0055-internal-commit-identity/witness/release-publication.md
new file mode 100644
index 0000000..34943a8
--- /dev/null
+++ b/docs/design/0055-internal-commit-identity/witness/release-publication.md
@@ -0,0 +1,56 @@
+# INFRA-0055 v6.5.5 Publication Witness
+
+Date: 2026-07-26
+
+Issue: #102
+
+## Immutable Release Identity
+
+- Implementation PR: [#103](https://github.com/git-stunts/git-cas/pull/103)
+- Release PR: [#104](https://github.com/git-stunts/git-cas/pull/104)
+- Reviewed merge commit: `9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e`
+- Signed annotated tag: `v6.5.5`
+- Tag object: `c1dc40fa3b25902be4abf6588da75f309a0153c7`
+- Peeled tag target: `9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e`
+- Signing key: `01A63D8E9DBEEDE32918AF9C39560E0406CA9135`
+- GitHub Release:
+  [v6.5.5](https://github.com/git-stunts/git-cas/releases/tag/v6.5.5)
+  (final, not a draft or prerelease; published `2026-07-26T17:04:28Z`)
+
+Local `git tag -v v6.5.5` reported a good signature. The tag peels to the
+reviewed release merge exactly.
+
+## Release Workflow
+
+[Release run 30211630524](https://github.com/git-stunts/git-cas/actions/runs/30211630524)
+completed successfully against `v6.5.5`:
+
+| Job | Result | Evidence |
+| --- | --- | --- |
+| Validate | pass | Tag version matched `package.json` |
+| Test | pass | Lint, unit, Node/Bun/Deno real-Git integration |
+| Publish npm | pass | OIDC trusted publication completed |
+| GitHub Release | pass | Final release created after npm publication |
+
+Before tagging, the release candidate passed all 14 verifier steps with 6,850
+observed tests, public type compatibility, examples, build stamping, and npm
+and JSR dry-runs.
+
+## npm Registry Evidence
+
+Independent registry queries after the workflow completed reported:
+
+| Field | Value |
+| --- | --- |
+| Package | `@git-stunts/git-cas@6.5.5` |
+| Published | `2026-07-26T17:04:16.205Z` |
+| Dist-tag at publication | `latest` -> `6.5.5` |
+| Integrity | `sha512-x2ohvIq04o5W3eFmn/x6WQ8UuXcqIxcdKuQOhttZJ80ZokuY+97xqqi7cJCDdrmeJMkbcuSW1VvWFzcz6K6TAg==` |
+| Shasum | `92d2be5d262dd8f24273d518d60bb23f81d7d427` |
+| File count | `256` |
+| Unpacked size | `2,213,032` bytes |
+| Tarball | `https://registry.npmjs.org/@git-stunts/git-cas/-/git-cas-6.5.5.tgz` |
+
+The registry exposes the package-version
+[attestation endpoint](https://registry.npmjs.org/-/npm/v1/attestations/@git-stunts%2fgit-cas@6.5.5)
+with npm publish and `https://slsa.dev/provenance/v1` predicates.
diff --git a/docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md b/docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md
index 0542ec0..9b099b9 100644
--- a/docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md
+++ b/docs/design/0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md
@@ -7,7 +7,7 @@ release_home: 'v6.5.6'
 issue: 'https://github.com/git-stunts/git-cas/issues/105'
 goalpost_issue: 'https://github.com/git-stunts/git-cas/issues/105'
 tracker_source: 'github'
-status: 'active'
+status: 'landed'
 base_commit: '9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e'
 owners:
   - '@git-stunts'
@@ -18,7 +18,7 @@ blocking_issues: []
 supersedes: []
 superseded_by: null
 created: '2026-07-27'
-updated: '2026-07-27'
+updated: '2026-07-30'
 ---
 
 # TUI-0056 - Bijou 7 Framed Cockpit
@@ -318,7 +318,7 @@ outer-shell concern from the page model and renderer.
 - [x] application actions appear in frame help/commands/search;
 - [x] static mode and structured stdout boundaries are unchanged;
 - [x] all declared text/surface pairs pass at 4.5:1 or higher;
-- [ ] full validation and package/release checks pass.
+- [x] full validation and package/release checks pass.
 
 ## Validation Plan
 
@@ -359,8 +359,8 @@ fallback theme lookup, and payload review.
 
 ## Tracker Disposition
 
-GitHub issues #105 and #106 remain open until the implementation, witness,
-merge, and patch release are complete.
+GitHub issues #105 and #106 closed after implementation PR #109 merged. The
+patch-release evidence remains with the v6.5.6 candidate witness.
 
 ## Done Does Not Mean
 
@@ -371,4 +371,9 @@ merge, and patch release are complete.
 
 ## Retrospective
 
-Pending merge and release evidence.
+PR #109 merged the framed cockpit as
+`e802269ab6035eae75c2d61a8e8a898800cffbb8` after focused and hosted
+Node/Bun/Deno validation passed. Hosting one coherent cockpit page kept Bijou
+responsible for the application shell without splitting the shared vault and
+storage model across independently owned page states. The v6.5.6 release
+candidate then passed the repository's complete 14-step verifier.
diff --git a/docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md b/docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md
index 12dbe4b..b4084bb 100644
--- a/docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md
+++ b/docs/design/0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md
@@ -7,7 +7,7 @@ release_home: "v6.5.6"
 issue: "https://github.com/git-stunts/git-cas/issues/111"
 goalpost_issue: "https://github.com/git-stunts/git-cas/issues/105"
 tracker_source: "github"
-status: "active"
+status: "landed"
 base_commit: "e802269ab6035eae75c2d61a8e8a898800cffbb8"
 owners:
   - "@git-stunts"
@@ -18,7 +18,7 @@ blocking_issues: []
 supersedes: []
 superseded_by: null
 created: "2026-07-29"
-updated: "2026-07-29"
+updated: "2026-07-30"
 ---
 
 # TRUST-0057 - Deterministic Ref Conflict Posture
@@ -289,8 +289,8 @@ operation's precondition, and otherwise rethrow the original error.
 - [x] No checked ref classification depends on diagnostic text.
 - [x] The three mutation methods implement the documented posture decision.
 - [x] Focused unit and real-Git integration tests pass.
-- [ ] Full lint, unit, integration, and release verification pass.
-- [ ] PR review and CI are green.
+- [x] Full lint, unit, integration, and release verification pass.
+- [x] PR review and CI are green.
 - [ ] `v6.5.6` is tagged, published to npm, and represented by a GitHub Release.
 
 ## Validation Plan
@@ -337,4 +337,11 @@ Git exit codes.
 
 ## Retrospective
 
-Pending implementation and release.
+PR #112 merged the posture-based classifier as
+`4327effd31c6d8ff00980512d6c59fc5064432d7` after all six GitHub checks
+passed, CodeRabbit approved the exact head, and no review threads existed.
+Re-reading structured state after a failed checked mutation proved narrower
+than both diagnostic parsing and exit-code classification: only a contradicted
+precondition becomes concurrency, while repository and process failures retain
+their original identity. The v6.5.6 release candidate then passed the complete
+14-step verifier.
diff --git a/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md b/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md
new file mode 100644
index 0000000..d8e4253
--- /dev/null
+++ b/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md
@@ -0,0 +1,77 @@
+# TRUST-0057 v6.5.6 Release Candidate Witness
+
+Date: 2026-07-30
+
+Issue: #111
+
+Implementation reviews: #109 and #112
+
+Release review: pending
+
+## Scope
+
+This witness records the pre-publication candidate for the Bijou 7 hosted
+cockpit and deterministic checked-ref conflict classification. It does not
+claim that a `v6.5.6` tag, npm artifact, or GitHub Release exists. This is an
+explicitly unpublished candidate.
+
+The candidate:
+
+- sets npm, JSR, and runtime package metadata to `6.5.6`;
+- moves the framed cockpit and deterministic conflict repair from `Unreleased`
+  to `6.5.6`;
+- packages and links `docs/releases/v6.5.6.md`;
+- records v6.5.5 publication evidence as immutable history;
+- marks designs 0056 and 0057 landed after implementation merges; and
+- leaves v6.5.6 tag and registry claims deliberately absent.
+
+## Implementation Provenance
+
+| Capability | Review anchor | Commit |
+| --- | --- | --- |
+| Bijou 7.2 hosted framed cockpit | #109 | `e802269ab6035eae75c2d61a8e8a898800cffbb8` |
+| Deterministic checked-ref conflicts | #112 | `4327effd31c6d8ff00980512d6c59fc5064432d7` |
+
+The cockpit change moves outer-shell authority into Bijou without changing
+machine output or storage data. The ref adapter change classifies failed
+checked mutations from structured post-failure posture without changing public
+method signatures.
+
+## Failure Witness
+
+The prior adapter searched English Git diagnostics after failed atomic anchors
+and checked deletes, while checked updates had no equivalent normalization.
+Diagnostic-free RED tests leaked the original plumbing error for contradicted
+update, anchor, and delete preconditions. The GREEN implementation observes
+direct, symbolic, or absent posture and preserves the original failure whenever
+that posture still satisfies the attempted precondition.
+
+## Verification
+
+The synced implementation merge and the versioned candidate each ran the
+complete `pnpm run release:verify` method. The final versioned counts are
+recorded after the candidate rerun:
+
+| Gate | Result | Observed tests |
+| --- | --- | ---: |
+| Lint | PASS | - |
+| Unit tests (Node) | PASS | 2,104 |
+| Unit tests (Bun) | PASS | 2,103 |
+| Unit tests (Deno) | PASS | 2,094 |
+| Public type compatibility | PASS | - |
+| Integration tests (Node) | PASS | 199 |
+| Integration tests (Bun) | PASS | 199 |
+| Integration tests (Deno) | PASS | 199 |
+| Examples and build stamp | PASS | - |
+| npm and JSR dry-runs | PASS | - |
+| **Release method summary** | **PASS: 14/14 gates** | **6,898** |
+
+Tag and publication evidence remain deliberately absent from this candidate
+witness.
+
+## Publication Gate
+
+Publication remains blocked until the versioned candidate passes every
+release-verifier step, the release PR passes GitHub CI and review, the PR is
+merged, a signed annotated `v6.5.6` tag points at that reviewed merge, and the
+release workflow publishes npm plus the final GitHub Release.
diff --git a/docs/design/README.md b/docs/design/README.md
index 4469c9e..680822b 100644
--- a/docs/design/README.md
+++ b/docs/design/README.md
@@ -11,8 +11,6 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Active METHOD Cycles
 
-- [0057-deterministic-ref-conflict-posture - deterministic-ref-conflict-posture](./0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md)
-- [0056-bijou-7-framed-cockpit - bijou-7-framed-cockpit](./0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
 - [0054-batched-page-retention - batched-page-retention](./0054-batched-page-retention/batched-page-retention.md)
 - [0050-lazy-bundle-reference-reads - lazy-bundle-reference-reads](./0050-lazy-bundle-reference-reads/lazy-bundle-reference-reads.md)
 - [0049-scoped-staging-workspaces — scoped-staging-workspaces](./0049-scoped-staging-workspaces/scoped-staging-workspaces.md)
@@ -46,6 +44,8 @@ process in [docs/method/process.md](../method/process.md).
 
 ## Landed METHOD Cycles
 
+- [0057-deterministic-ref-conflict-posture - deterministic-ref-conflict-posture](./0057-deterministic-ref-conflict-posture/deterministic-ref-conflict-posture.md)
+- [0056-bijou-7-framed-cockpit - bijou-7-framed-cockpit](./0056-bijou-7-framed-cockpit/bijou-7-framed-cockpit.md)
 - [0055-internal-commit-identity - internal-commit-identity](./0055-internal-commit-identity/internal-commit-identity.md)
 - [0053-git-object-session-coherence - git-object-session-coherence](./0053-git-object-session-coherence/git-object-session-coherence.md)
 - [0052-persistent-git-object-sessions - persistent-git-object-sessions](./0052-persistent-git-object-sessions/persistent-git-object-sessions.md)
diff --git a/docs/releases/v6.5.6.md b/docs/releases/v6.5.6.md
new file mode 100644
index 0000000..216b365
--- /dev/null
+++ b/docs/releases/v6.5.6.md
@@ -0,0 +1,55 @@
+# git-cas v6.5.6 Release Notes
+
+v6.5.6 moves the interactive cockpit onto Bijou 7.2's hosted application
+boundary and makes checked Git ref conflicts independent of diagnostic prose.
+It changes no public package API or stored-data schema.
+
+## Bijou 7 Hosted Cockpit
+
+The interactive launcher now runs a `FramedApp`. Bijou owns terminal lifecycle,
+outer chrome, help, command and asset-search palettes, settings, notifications,
+performance telemetry, quit confirmation, and reference-counted cursor state.
+The git-cas page continues to own vault authentication, storage state,
+Explorer/Atlas/Operations navigation, filtering, and the Store Wizard.
+
+Store and restore progress use Bijou's shared cursor guard and render the
+initial `0/N` state without incrementing the processed count. Frame and page
+tests preserve ordinary modal input, page-first key ownership, structured
+stdout, and the static noninteractive fallback.
+
+Design Book selected the high-contrast foregrounds for the dark cockpit
+surfaces. Bijou's theme doctor and explicit text-tone tests enforce a minimum
+4.5:1 contrast ratio.
+
+## Deterministic Checked-Ref Conflicts
+
+Failed checked updates, atomic anchors, and checked deletes no longer inspect
+Git's human-readable diagnostics. The Git adapter reads structured post-failure
+posture—direct OID, symbolic target, or absence—and normalizes only when that
+posture disproves the attempted compare-and-swap precondition.
+
+The existing contracts remain:
+
+- checked updates and deletes reject with `GIT_REF_CONFLICT` plus structured
+  expected and observed posture;
+- atomic anchors return `false` when their source changed or target appeared;
+- operational failures remain the original error when the attempted ref
+  precondition still holds.
+
+Diagnostic-free unit and real-Git tests cover changed, absent, and symbolic
+posture across all three mutation paths.
+
+## Verification
+
+The release candidate passed the repository's complete 14-step verifier with
+6,898 observed tests across Node, Bun, and Deno. The matrix includes public
+type compatibility, executable examples, 199 real-Git integration tests on
+each runtime, build stamping, and npm and JSR dry-runs.
+
+## Compatibility
+
+This release requires no application or stored-data migration. Existing refs,
+objects, handles, cockpit lower modes, machine-readable output, and package
+exports remain valid. Interactive operators receive the hosted Bijou shell
+automatically; callers receive more reliable existing conflict semantics
+without changing method signatures.
diff --git a/jsr.json b/jsr.json
index 1374224..2c0f6eb 100644
--- a/jsr.json
+++ b/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@git-stunts/git-cas",
-  "version": "6.5.5",
+  "version": "6.5.6",
   "exports": {
     ".": "./index.js",
     "./service": "./src/domain/services/CasService.js",
diff --git a/package.json b/package.json
index 8727f76..232b14b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@git-stunts/git-cas",
-  "version": "6.5.5",
+  "version": "6.5.6",
   "description": "Content-addressed storage backed by Git's object database, with optional encryption and pluggable codecs",
   "type": "module",
   "main": "index.js",
@@ -42,6 +42,7 @@
     "docs/releases/v6.5.3.md",
     "docs/releases/v6.5.4.md",
     "docs/releases/v6.5.5.md",
+    "docs/releases/v6.5.6.md",
     "docs/THREAT_MODEL.md",
     "docs/VAULT_INTERNALS.md",
     "docs/WALKTHROUGH.md",
diff --git a/src/package-version.js b/src/package-version.js
index 907439f..a1be3bd 100644
--- a/src/package-version.js
+++ b/src/package-version.js
@@ -1 +1 @@
-export const PACKAGE_VERSION = '6.5.5';
+export const PACKAGE_VERSION = '6.5.6';
diff --git a/test/unit/docs/package-docs.test.js b/test/unit/docs/package-docs.test.js
index 66b32e6..e30915e 100644
--- a/test/unit/docs/package-docs.test.js
+++ b/test/unit/docs/package-docs.test.js
@@ -20,6 +20,7 @@ const requiredStandardDocs = [
   'docs/releases/v6.5.3.md',
   'docs/releases/v6.5.4.md',
   'docs/releases/v6.5.5.md',
+  'docs/releases/v6.5.6.md',
 ];
 const forbiddenPackagePrefixes = ['docs/audit/', 'docs/archive/', 'docs/method/'];
 const forbiddenPackageFiles = ['docs/cli.gif', 'docs/vault.gif'];
@@ -96,6 +97,7 @@ function publicPackagedMarkdownFiles(files) {
     'docs/releases/v6.5.3.md',
     'docs/releases/v6.5.4.md',
     'docs/releases/v6.5.5.md',
+    'docs/releases/v6.5.6.md',
     'docs/THREAT_MODEL.md',
     'docs/WALKTHROUGH.md',
   ].filter((file) => files.has(file));
diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js
index bc844af..cb63644 100644
--- a/test/unit/docs/release-state.test.js
+++ b/test/unit/docs/release-state.test.js
@@ -4,7 +4,11 @@ import path from 'node:path';
 
 const repoRoot = process.cwd();
 const v653PublishedMarker = '**v6.5.3 artifact posture**';
+const v656CandidatePath =
+  'docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md';
 const v655CandidatePath = 'docs/design/0055-internal-commit-identity/witness/release-candidate.md';
+const v655PublicationPath =
+  'docs/design/0055-internal-commit-identity/witness/release-publication.md';
 const v654CandidatePath = 'docs/design/0054-batched-page-retention/witness/release-candidate.md';
 const v654PublicationPath =
   'docs/design/0054-batched-page-retention/witness/release-publication.md';
@@ -33,10 +37,31 @@ function v6Heading(changelog) {
   return changelog.match(/^## \[6\.0\.0\] — (.+)$/m)?.[1];
 }
 
+function expectNoV656PublicationEvidence(...documents) {
+  const forbiddenMarkers = [
+    '**Last tagged release:** `v6.5.6`',
+    '**Current release state:** `v6.5.6` is published',
+    '- Signed annotated tag: `v6.5.6`',
+    'https://github.com/git-stunts/git-cas/releases/tag/v6.5.6',
+    '## npm Registry Evidence',
+    /\| Package\s+\| `@git-stunts\/git-cas@6\.5\.6`\s+\|/,
+    /\| Dist-tag\s+\| `latest` -> `6\.5\.6`\s+\|/,
+    'attestations/@git-stunts%2fgit-cas@6.5.6',
+  ];
+
+  for (const document of documents) {
+    for (const marker of forbiddenMarkers) {
+      if (marker instanceof RegExp) {
+        expect(document).not.toMatch(marker);
+      } else {
+        expect(document).not.toContain(marker);
+      }
+    }
+  }
+}
+
 function expectNoV655PublicationEvidence(...documents) {
   const forbiddenMarkers = [
-    '**Last tagged release:** `v6.5.5`',
-    '**Current release state:** `v6.5.5` is published',
     '- Signed annotated tag: `v6.5.5`',
     'https://github.com/git-stunts/git-cas/releases/tag/v6.5.5',
     '## npm Registry Evidence',
@@ -171,7 +196,6 @@ function expectV654CandidateEvidence(candidate) {
 }
 
 function expectV654PublishedEvidence(status, publication) {
-  expect(status).toContain('**Last tagged release:** `v6.5.4` (`2026-07-26`)');
   expect(status).toContain('**v6.5.4 artifact posture**');
   expect(status).toContain('a2d23f5b');
   expect(status).toContain('30205009357');
@@ -192,9 +216,7 @@ function expectV654PublishedEvidence(status, publication) {
   expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.4');
 }
 
-function expectV655CandidateEvidence(status, candidate) {
-  expect(status).toContain('**Last tagged release:** `v6.5.4` (`2026-07-26`)');
-  expect(status).toContain('**Current release state:** `v6.5.5` release candidate');
+function expectV655CandidateEvidence(candidate) {
   expect(candidate).toContain('# INFRA-0055 v6.5.5 Release Candidate Witness');
   expect(candidate).toContain('Implementation review: #103');
   expect(candidate).toContain('Release review: #104');
@@ -202,7 +224,42 @@ function expectV655CandidateEvidence(status, candidate) {
   expect(candidate).toContain('**PASS (14/14)**');
   expect(candidate).toContain('**6,850**');
   expect(candidate).toMatch(/explicitly\s+unpublished\s+candidate/);
-  expectNoV655PublicationEvidence(status, candidate);
+  expectNoV655PublicationEvidence(candidate);
+}
+
+function expectV655PublishedEvidence(status, publication) {
+  expect(status).toContain('**Last tagged release:** `v6.5.5` (`2026-07-26`)');
+  expect(status).toContain('**v6.5.5 artifact posture**');
+  expect(status).toContain('9ea91a73');
+  expect(status).toContain('30211630524');
+  expect(publication).toContain('# INFRA-0055 v6.5.5 Publication Witness');
+  expect(publication).toContain('9ea91a738f2cbadf2a20b5ac7c2c6d54ba9f409e');
+  expect(publication).toContain('c1dc40fa3b25902be4abf6588da75f309a0153c7');
+  expect(publication).toContain('01A63D8E9DBEEDE32918AF9C39560E0406CA9135');
+  expect(publication).toContain('- Signed annotated tag: `v6.5.5`');
+  expect(publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.5.5');
+  expect(publication).toContain('actions/runs/30211630524');
+  expect(publication).toMatch(/\| Package\s+\| `@git-stunts\/git-cas@6\.5\.5`\s+\|/);
+  expect(publication).toMatch(/\| Dist-tag at publication\s+\| `latest` -> `6\.5\.5`\s+\|/);
+  expect(publication).toContain(
+    'sha512-x2ohvIq04o5W3eFmn/x6WQ8UuXcqIxcdKuQOhttZJ80ZokuY+97xqqi7cJCDdrmeJMkbcuSW1VvWFzcz6K6TAg=='
+  );
+  expect(publication).toContain('92d2be5d262dd8f24273d518d60bb23f81d7d427');
+  expect(publication).toContain('2,213,032');
+  expect(publication).toContain('attestations/@git-stunts%2fgit-cas@6.5.5');
+}
+
+function expectV656CandidateEvidence(status, candidate) {
+  expect(status).toContain('**Last tagged release:** `v6.5.5` (`2026-07-26`)');
+  expect(status).toContain('**Current release state:** `v6.5.6` release candidate');
+  expect(candidate).toContain('# TRUST-0057 v6.5.6 Release Candidate Witness');
+  expect(candidate).toContain('Implementation reviews: #109 and #112');
+  expect(candidate).toContain('e802269ab6035eae75c2d61a8e8a898800cffbb8');
+  expect(candidate).toContain('4327effd31c6d8ff00980512d6c59fc5064432d7');
+  expect(candidate).toContain('**PASS: 14/14 gates**');
+  expect(candidate).toContain('**6,898**');
+  expect(candidate).toMatch(/explicitly\s+unpublished\s+candidate/);
+  expectNoV656PublicationEvidence(status, candidate);
 }
 
 function expectV653PublishedEvidence(status, publication) {
@@ -329,9 +386,11 @@ function expectCurrentV640PublicationEvidence(publication) {
 }
 
 describe('release state docs', () => {
-  it('enforces the v6.5.5 candidate while preserving published evidence', () => {
+  it('enforces the v6.5.6 candidate while preserving published evidence', () => {
     const status = read('STATUS.md');
+    const v656Candidate = read(v656CandidatePath);
     const v655Candidate = read(v655CandidatePath);
+    const v655Publication = read(v655PublicationPath);
     const v654Candidate = read(v654CandidatePath);
     const v654Publication = read(v654PublicationPath);
     const candidate = read(v653CandidatePath);
@@ -342,12 +401,15 @@ describe('release state docs', () => {
     const v653ReleaseNotes = read('docs/releases/v6.5.3.md');
     const v654ReleaseNotes = read('docs/releases/v6.5.4.md');
     const v655ReleaseNotes = read('docs/releases/v6.5.5.md');
+    const v656ReleaseNotes = read('docs/releases/v6.5.6.md');
     const v652ReleaseNotes = read('docs/releases/v6.5.2.md');
     const publication = read(v651PublicationPath);
     const v650Publication = read(v650PublicationPath);
     const v640Publication = read(v640PublicationPath);
 
-    expectV655CandidateEvidence(status, v655Candidate);
+    expectV656CandidateEvidence(status, v656Candidate);
+    expectV655CandidateEvidence(v655Candidate);
+    expectV655PublishedEvidence(status, v655Publication);
     expectV654CandidateEvidence(v654Candidate);
     expectV654PublishedEvidence(status, v654Publication);
     expectV653CandidateEvidence(candidate);
@@ -359,13 +421,15 @@ describe('release state docs', () => {
     expect(v653ReleaseNotes).toContain('release verifier passed all 14 steps with 6,829');
     expect(v654ReleaseNotes).toContain('full release verifier passed all 14 steps with 6,844');
     expect(v655ReleaseNotes).toMatch(/requires no\s+migration/);
+    expect(v656ReleaseNotes).toContain('14-step verifier with\n6,898 observed tests');
+    expect(v656ReleaseNotes).toMatch(/requires no application or stored-data\s+migration/);
     expect(v652ReleaseNotes).toContain('passed all 14 release-verifier steps with 6,817 observed');
     expectV650PublishedEvidence(status, v650Publication);
     expectCurrentV640PublicationEvidence(v640Publication);
     expect(status).toContain('Current release goalpost:');
     expect(status).toContain('#39 v6.6.0: Operator TUI');
     expect(status).toContain('#40 v6.6.0: Agent automation follow-through');
-    expect(status).toContain('0055-internal-commit-identity');
+    expect(status).toContain('0057-deterministic-ref-conflict-posture');
     expect(v640Publication).toContain('https://slsa.dev/provenance/v1');
     expect(v640Publication).toContain('https://github.com/git-stunts/git-cas/releases/tag/v6.4.0');
   });
diff --git a/test/unit/docs/release-truth.test.js b/test/unit/docs/release-truth.test.js
index 52cbc7b..c3ecdd2 100644
--- a/test/unit/docs/release-truth.test.js
+++ b/test/unit/docs/release-truth.test.js
@@ -308,6 +308,21 @@ describe('internal commit identity release documentation', () => {
   });
 });
 
+describe('hosted cockpit and checked-ref release documentation', () => {
+  it('ships and links the v6.5.6 compatibility contract', () => {
+    const readme = read('README.md');
+    const upgrading = read('UPGRADING.md');
+    const releaseNotes = read('docs/releases/v6.5.6.md');
+
+    expect(readme).toContain('[v6.5.6 Release Notes](./docs/releases/v6.5.6.md)');
+    expect(upgrading).toContain('## v6.5.5 To v6.5.6');
+    expect(upgrading).toMatch(/requires no migration/);
+    expect(releaseNotes).toContain('# git-cas v6.5.6 Release Notes');
+    expect(releaseNotes).toContain('structured post-failure');
+    expect(releaseNotes).toContain('FramedApp');
+  });
+});
+
 describe('advanced guide rendering', () => {
   it('keeps the table of contents rendered as Markdown links', () => {
     const advancedGuide = read('ADVANCED_GUIDE.md');

From d0a54dfb1a63da9b6ee282aebcf746ecbb36fc06 Mon Sep 17 00:00:00 2001
From: James Ross <james@flyingrobots.dev>
Date: Thu, 30 Jul 2026 00:42:10 -0700
Subject: [PATCH 2/2] docs: link v6.5.6 release review

---
 .../witness/release-candidate.md                                | 2 +-
 test/unit/docs/release-state.test.js                            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md b/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md
index d8e4253..ccedd71 100644
--- a/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md
+++ b/docs/design/0057-deterministic-ref-conflict-posture/witness/release-candidate.md
@@ -6,7 +6,7 @@ Issue: #111
 
 Implementation reviews: #109 and #112
 
-Release review: pending
+Release review: #113
 
 ## Scope
 
diff --git a/test/unit/docs/release-state.test.js b/test/unit/docs/release-state.test.js
index cb63644..2ae6d5c 100644
--- a/test/unit/docs/release-state.test.js
+++ b/test/unit/docs/release-state.test.js
@@ -254,6 +254,7 @@ function expectV656CandidateEvidence(status, candidate) {
   expect(status).toContain('**Current release state:** `v6.5.6` release candidate');
   expect(candidate).toContain('# TRUST-0057 v6.5.6 Release Candidate Witness');
   expect(candidate).toContain('Implementation reviews: #109 and #112');
+  expect(candidate).toContain('Release review: #113');
   expect(candidate).toContain('e802269ab6035eae75c2d61a8e8a898800cffbb8');
   expect(candidate).toContain('4327effd31c6d8ff00980512d6c59fc5064432d7');
   expect(candidate).toContain('**PASS: 14/14 gates**');