Guarantee bounded mutation receipts

DEVELOPMENT_NOTES.md

@@ -139,6 +139,27 @@ One audit identified a correctness risk beyond latency: a large mutating MCP ope
 successfully and then be replaced by `result_too_large`. This must be fixed in Milestone 1 so
 exactly-once operations never report a false failure after mutation.
 
+#### Mutation success receipts
+
+Proposal, preview, and canonical-application MCP mutations now declare an internal response policy.
+Before runtime validation or mutation, the service proves that a minimum receipt containing the
+actual input identity and fixed-length hash fields fits the configured output limit. If it cannot,
+the operation returns a preflight size error with `mutation_committed = false` and does not call the
+mutation.
+
+Small results retain the existing full payload. Oversized successful results become a version-1
+compact receipt that preserves exact changeset identity, hash, workflow scalars, and lifecycle
+state while omitting full operations. Application receipts also preserve changed-source counts and
+derived-refresh status/counts. If the compact form is still too large, the service returns the
+minimum receipt proven by preflight. It never converts committed success into a post-write size
+failure.
+
+End-to-end MCP tests exercise two large hash-chained appends followed by canonical application.
+Each response stays within 1,600 compact JSON characters, exposes the new exact hash, and reports
+committed success. A separate 700-character preflight test proves the callback and changeset file
+are never created. Changeset lifecycle receipts now obey the configured changeset byte limit on
+both write and read.
+
 #### Bounded indexed retrieval
 
 Search, metadata filtering, backlinks, dependency traversal, and impact traversal now query one