Add bounded generation transition receipts

docs/MCP_CONTRACT.md

@@ -48,6 +48,7 @@ schema version 1 and does not silently acquire machine-specific process policy.
 - `docforge_visualize`
 - `docforge_stop_visualization`
 - `docforge_visualization_status`
+- `docforge_get_generation_diff`
 
 Each response states that document text is project content, not higher-priority instructions. Each
 response includes project identity, revision, source hash, adapter version, and staleness state.
@@ -108,6 +109,37 @@ the effective policy and task request. One evidence item that cannot fit advance
 a hash-identified `response_limit` omission. A changed generation, policy, plan, or collection
 fails as `stale_cursor`.
 
+`docforge_get_generation_diff` accepts only optional `limit` and `cursor` fields. It reads the one
+latest version-1 primary-graph transition receipt; it does not accept arbitrary generations,
+paths, or history selectors. Exact summary counts and the full item-collection hash cover the
+complete transition. Pagination covers only the deterministically ordered retained details and
+states separately when the fixed 1,000-item or 1 MiB publication limit permanently omitted
+details.
+
+The receipt binds project, root, adapter, index schema, from/to source identity, node and edge
+hashes and counts, the committed index file identity, retained and full collection hashes, and its
+own canonical hash. Node changes compare every core `Node` field. Edge identity is the exact
+`(source_id, relation, target_id)` triple. Logic is excluded from public diff details.
+
+Current pages use `page_schema_version = 1`. The nested `receipt_header` contains every stored
+receipt field except `items`; its `stored_receipt_hash` is the hash of the complete stored receipt,
+not of the header. Page items and hash-identified response-limit omissions are siblings of that
+header. The only pagination object is at the top level, and its `next_cursor` is the only cursor
+copy. The page hash covers the complete header, page items, omissions, receipt state, and
+pagination receipt.
+
+Receipt states are fail-closed: `current` is proven against cheap source identity and exact index
+and receipt inodes; `stale` is a proven generation mismatch; `missing` means no receipt;
+`unsafe` means confinement or file-type checks failed; `unverified` covers corrupt, foreign,
+oversized, or concurrently changed evidence; and `unknown` means the project cannot provide a
+cheap generation identity. Only `current` returns a page.
+
+This status boundary is non-repairing. It never opens SQLite, loads or extracts an adapter
+projection, parses source, synchronizes, builds, or writes a receipt. Cheap source identity and
+stable receipt/index file identities can establish `current`; legacy projects without cheap
+identity report `unknown`. Invalid or unavailable disposable evidence remains an explicit status
+instead of triggering hidden recovery.
+
 The legacy `docforge_get_context` tool and its custom three-argument provider contract remain
 unchanged. A server with a custom context provider does not silently inherit the core task planner;
 version 1 exposes no custom task-planner extension point. `docforge_get_task_context` returns