Guarantee bounded mutation receipts

docs/MCP_CONTRACT.md

@@ -95,6 +95,15 @@ Changeset listing returns draft and ready work by default. Stale, applied, and a
 remain available through an explicit status or history request. Applied and abandoned proposals no
 longer participate in overlap conflict detection.
 
+Successful mutations return their existing full result while it fits the configured output limit.
+Before any proposal, preview, or canonical mutation, the server verifies that a minimum exact
+success receipt can fit. An impossible receipt fails with `result_too_large`,
+`stage = "preflight"`, and `mutation_committed = false` before calling the mutation. If a successful
+full result is too large, the server returns a version-1 compact receipt containing the exact
+changeset ID and hash plus the operation outcome. It may fall back to a preflight-guaranteed
+minimum receipt, but it never replaces a committed mutation with a failure response. Direct Python
+and CLI integrations retain their detailed return values.
+
 ## Canonical application tool
 
 - `docforge_apply_changeset`
@@ -112,6 +121,10 @@ application with a degraded derived-refresh report and explicit remediation; the
 caller to apply the same canonical change twice. DocForge does not run project commands, shell,
 Git, builds, deployment, or publication.
 
+When the full application result exceeds the tool-output limit, its compact success receipt retains
+the applied lifecycle, exact hash, changed-source counts, and a derived-refresh summary. Detailed
+index, render, and error payloads remain available through the corresponding read and status tools.
+
 ## Render boundary
 
 `docforge_render_status` recomputes expected hashes without writing. `docforge_preview_changeset`

docs/USER_MANUAL.md

@@ -614,6 +614,12 @@ The older create-and-append tools remain supported for interactive proposal cons
 For update, move, and delete operations it captures the synchronized current node hash when
 `expected_content_hash` is omitted.
 
+MCP mutations are preflighted against the configured response limit. Small mutations keep their
+full response. Large successful mutations return a compact or minimum version-1 receipt with
+`mutation_committed = true` and the exact current changeset hash. A preflight size failure has
+`mutation_committed = false`; it is safe to correct the request or policy before retrying. A
+committed mutation is never reported as `result_too_large`.
+
 Active changeset listing includes draft and ready proposals. Stale work remains available through
 an explicit `status="stale"` query for rebase decisions. Applied and abandoned proposals are
 terminal history, remain available by status or history request, and no longer block new proposals