Add bounded generation transition receipts

docs/CONTRACT.md

@@ -20,6 +20,8 @@ commit when Git is available; it cannot change repository state.
 - Changeset schema: `schemas/changeset.schema.json`, version 1.
 - Effective policy: `schemas/policy.schema.json`, version 1.
 - Task context capsule: `schemas/context-capsule.schema.json`, version 1.
+- Latest generation diff: `schemas/generation-diff.schema.json`, version 1.
+- Latest generation-diff page: `schemas/generation-diff-page.schema.json`, version 1.
 - Index schema: version 3, disposable and reproducible.
 - Index attestation: schema version 1, disposable and reproducible.
 - Core, CLI, and MCP server: version 1.3.0.dev0.
@@ -57,6 +59,22 @@ SQLite integrity verification. A fresh process may use that receipt to verify an
 without reconstructing all graph rows. A missing, malformed, or mismatched receipt falls back to
 complete verification and is repaired only after that verification succeeds.
 
+Index replacement is the derived publication commit point. Attestation, cheap source-generation,
+and latest-generation-diff receipts are independent post-commit evidence. Their failure produces
+bounded degraded success and never falsely reports that a committed index mutation failed.
+
+Before replacement, a build accepts a predecessor only when its exact main-file inode has a
+matching whole-file attestation, has no WAL, journal, or shared-memory sidecar, and passes the
+published SQLite identity, row, hash, FTS, integrity, and policy checks. It uses an immutable
+main-file read and never repairs predecessor evidence. The build then revalidates the new source
+snapshot including exact node and edge equality and rejects a stable source identity that produces
+different graph content as `generation_collision`.
+
+The version-1 generation-diff receipt stores one bounded latest primary-graph transition. It is
+not history and contains no Logic details or source text. Public pages carry one
+`receipt_header`; its `stored_receipt_hash` identifies the complete persisted receipt rather than
+the header alone. One top-level pagination object carries the only continuation cursor.
+
 ## Isolated proposal model
 
 Create, update, move, and delete are ordered node operations inside an isolated changeset. Every