Bound paged retrieval responses

DEVELOPMENT_NOTES.md

@@ -267,6 +267,38 @@ workers, non-reuse, and zero-load status. The Milestone 1 benchmark now measures
 not-running, and unavailable visualization status separately with the same zero-work and 50 ms p95
 gates as other receipt status operations.
 
+#### Bounded pagination and exact large-result review
+
+The final Milestone 1 contract audit found that count limits and the global MCP output ceiling were
+not sufficient. A 1,000-node context response already exceeded the normal 200,000-character tool
+limit, and one allowed changeset operation can be larger than that limit. Returning
+`result_too_large` kept transport bounded but stranded useful evidence.
+
+Version-1 pagination now uses canonical, base64url cursors with a domain-separated SHA-256
+corruption checksum. Cursors bind the project, adapter, canonical generation, semantic query,
+collection hash, and position. They are deliberately unkeyed read tokens rather than authorization
+credentials. Corrupt tokens fail as `invalid_cursor`; changed generations or collections fail as
+`stale_cursor` with explicit pagination-restart remediation.
+
+Context transport flattens the compiler's deterministic selected entries followed by all explicit
+omissions, then partitions each page back into the existing arrays. Both item count and exact
+compact-JSON response size constrain packing. An individually oversized entry becomes a bounded,
+hash-identified omission and advances the cursor, avoiding an infinite retry while preserving the
+fact that evidence was excluded.
+
+Changeset list, inspection, validation, and diff reads preserve direct full-result defaults while
+MCP uses bounded pages. Pages retain exact changeset identity and hash. Large operation pages
+compact content-bearing fields into hashes and character counts. A single oversized structured
+diff is serialized once as canonical ASCII JSON and returned through hash-bound chunks that
+reconstruct the exact legacy `operations` and `changes` arrays. This solves transport growth
+without lowering canonical changeset limits or adding cursor storage.
+
+The benchmark now validates zero-work and operation-specific counters for every warmup and measured
+sample, records bounded semantic response summaries, covers filter, backlinks, outgoing and
+incoming traversal, and measures current/stale/missing/corrupt render receipts plus all
+visualization lifecycle states. A maintained query-plan test prevents the incoming traversal
+temporary sort from returning.
+
 ### Initial design constraints
 
 - Full rebuild remains the recovery and equivalence oracle.
@@ -290,5 +322,6 @@ These are notes, not commitments:
   risks.
 - The stat identity is a cheap publication proof, not a cryptographic integrity scan. Full index
   validation remains the launch and query oracle.
-- Large context and changeset payloads may need cursor pagination or compact immutable receipts.
-  The choice should follow actual client workflows rather than generic pagination machinery.
+- Cursor authentication remains deliberately absent. If read cursors ever carry authority rather
+  than bounded positions, they will need a different versioned security contract and persisted key
+  lifecycle.