feat: add isolated proposal changesets

SLICE_HISTORY.md

@@ -80,3 +80,51 @@ DFG-2: expose only the proven read operations through a project-bound local stdi
 ### Next gate
 
 DFG-3: add isolated, hash-bound proposal changesets without canonical write authority.
+
+## DFG-3 isolated changesets
+
+### Changed
+
+- Added a confined changeset root and project-declared proposal writers with explicit family and
+  operation permissions.
+- Bound proposal identity once at MCP server startup. Tools cannot select or impersonate a writer.
+- Added ordered, project-bound JSON changesets with canonical base revision and source hash, root
+  fingerprint, creator, optimistic changeset hash, expected node hashes, rationales, and structured
+  relationship changes.
+- Added create, update, same-format move, and delete proposals. Deletes require exact removal of every
+  incident relationship; required profile nodes cannot be deleted.
+- Added deterministic projected graph validation and structured metadata, content, source, and
+  relationship diffs without changing canonical files.
+- Added exact stale-base, stale-node, stale-changeset, ownership, family, operation, path, graph,
+  source, size, and cross-proposal conflict failures.
+- Added process-safe file locking, atomic replacement, symbolic-link rejection, source confinement,
+  configured limits, and rollback if canonical inputs change during proposal storage.
+- Added nine MCP proposal tools, including stale-safe proposal inspection and bounded listing.
+  Canonical application, previews, arbitrary commands, Git mutation, builds, deployment, and
+  publication remain absent.
+
+### Verification
+
+- Focused core tests cover all four operation types, deterministic diffs, canonical immutability,
+  simultaneous append serialization, overlapping changesets, stale identities, atomic failures,
+  family permissions, ownership, target confinement, symbolic links, and configuration validation.
+- Protocol tests call all four mutation tools through the official in-memory MCP transport and prove
+  fixed writer identity, isolated output, validation, deterministic diff retrieval, and the disabled
+  mutation behavior of a server without a writer.
+- Ruff formatting and lint checks, Python compilation, all five JSON schema parses, and the locked
+  dependency check passed.
+- All 29 core, CLI, changeset, concurrency, in-memory MCP, and real stdio tests passed with
+  `ResourceWarning` treated as an error.
+
+### Limits
+
+- Changesets are proposals only. DocForge does not apply them to canonical project files.
+- A changeset may operate on a node once; a later operation on the same node requires another
+  changeset after external integration.
+- Moves preserve the canonical source format. Cross-format conversion belongs to a future adapter or
+  explicit migration contract.
+- Preview generation and renderer orchestration remain unopened.
+
+### Next gate
+
+DFG-4: add deterministic previews and confined renderer orchestration without canonical application.