Add bounded generation transition receipts

docs/USER_MANUAL.md

@@ -478,8 +478,15 @@ backlinks NODE_ID [--relation RELATION] [--limit N]
 dependencies NODE_ID [--depth N] [--limit N]
 impact NODE_ID [--depth N] [--limit N]
 context PROFILE [--budget N] [--limit N] [--cursor OPAQUE]
+generation-diff [--limit N] [--cursor OPAQUE]
 ```
 
+`generation-diff` returns the latest verified primary-graph transition. It is not a history query.
+Current results carry a version-1 page, a `receipt_header` bound to the complete stored receipt by
+`stored_receipt_hash`, and one top-level pagination cursor. Missing, unsafe, stale, corrupt, or
+unprovable disposable evidence is reported as a non-repairing receipt status. The command never
+builds or repairs the index.
+
 ### Render and proposal commands
 
 ```text
@@ -588,6 +595,7 @@ Example MCP client configuration:
 - `docforge_visualize`
 - `docforge_visualization_status`
 - `docforge_stop_visualization`
+- `docforge_get_generation_diff`
 
 ### Proposal tools
 
@@ -644,6 +652,24 @@ Task context never exceeds 1,000 evidence items, 100,000 examined candidate edge
 query characters, even when a project configures broader general limits. An edge-work or
 unclassified-relation ceiling appears as an explicit omission rather than an unbounded response.
 
+Use `docforge_get_generation_diff` after synchronization or a completed implementation slice to
+inspect the one latest verified primary-graph transition. The version-1 receipt reports exact
+added, removed, and changed node counts plus added and removed edge counts. Retained node details
+identify changed fields and before/after hashes and source paths. Edge details retain the exact raw
+relation triple. The receipt stores no source text, rendered content, Logic identities, or
+historical sequence.
+
+The first successful publication is an explicit baseline and does not claim every current node was
+added. A corrupt, foreign, unsafe, or unavailable predecessor produces an unavailable comparison
+rather than fabricated removals. A same-generation reindex preserves the latest meaningful
+transition. Each later real transition atomically replaces the single disposable receipt.
+
+Generation-diff reads use only the bounded receipt, stable file identities, and an adapter's cheap
+source-generation proof. They do not open SQLite, load a complete adapter projection, parse source,
+synchronize, build, or repair. Legacy adapters without cheap identity report `unknown`. Missing,
+corrupt, foreign, oversized, or concurrently changed receipts report an explicit receipt state and
+do not trigger hidden recovery.
+
 Recommended release-candidate sequence:
 
 1. Call `docforge_bootstrap`. It synchronizes derived state and reports the exact fixed binding.
@@ -711,6 +737,11 @@ followed by capsule omissions. Keep the semantic task arguments unchanged while
 may change. Every page retains the same plan, collection, and capsule hashes. A `stale_cursor`
 means that the generation, policy, plan, or collection changed; discard earlier pages and restart.
 
+`docforge_get_generation_diff` paginates only the details retained in the latest bounded receipt.
+Its summary counts and full collection hash still cover permanently truncated details. The cursor
+binds the exact receipt, target generation, retained and full collection hashes, receipt state, and
+effective policy. A replacement receipt returns `stale_cursor`; restart from its first page.
+
 Canonical application records its terminal receipt immediately after the project-owned serializer
 verifies the new canonical state. A later index or render refresh failure is reported as degraded
 derived state with remediation, not as permission to apply the same canonical change again.