Guarantee bounded mutation receipts

docs/MCP_CONTRACT.md

@@ -95,6 +95,15 @@ Changeset listing returns draft and ready work by default. Stale, applied, and a
 remain available through an explicit status or history request. Applied and abandoned proposals no
 longer participate in overlap conflict detection.
 
+Successful mutations return their existing full result while it fits the configured output limit.
+Before any proposal, preview, or canonical mutation, the server verifies that a minimum exact
+success receipt can fit. An impossible receipt fails with `result_too_large`,
+`stage = "preflight"`, and `mutation_committed = false` before calling the mutation. If a successful
+full result is too large, the server returns a version-1 compact receipt containing the exact
+changeset ID and hash plus the operation outcome. It may fall back to a preflight-guaranteed
+minimum receipt, but it never replaces a committed mutation with a failure response. Direct Python
+and CLI integrations retain their detailed return values.
+
 ## Canonical application tool
 
 - `docforge_apply_changeset`
@@ -112,6 +121,10 @@ application with a degraded derived-refresh report and explicit remediation; the
 caller to apply the same canonical change twice. DocForge does not run project commands, shell,
 Git, builds, deployment, or publication.
 
+When the full application result exceeds the tool-output limit, its compact success receipt retains
+the applied lifecycle, exact hash, changed-source counts, and a derived-refresh summary. Detailed
+index, render, and error payloads remain available through the corresponding read and status tools.
+
 ## Render boundary
 
 `docforge_render_status` recomputes expected hashes without writing. `docforge_preview_changeset`