docs(contracts)!: explain canonical URL and skill metadata ownership

BREAKING CHANGE: source-map URLs now live in target observations selected by declared_url_sha256, and doctor skill identity no longer emits installed_catalog_digest. Use the documented observation join and identity.skill.state instead.

docs/installation.md

@@ -199,6 +199,12 @@ use the shared `~/.agents/skills` directory. A mixed selection plans both
 paths. Selecting the skill without a client uses the shared directory. Setup
 leaves existing skill copies in other locations untouched.
 
+`doctor --skill --json` verifies the selected copies against the bundled
+instructions and references. Consumers should use `identity.skill.state`,
+`installed_version`, and `installed_tool_count` for skill readiness. The
+obsolete `installed_catalog_digest` field has been removed; current catalog
+identity remains available at `identity.catalog`.
+
 After selection, review the plan's exact paths and changes and approve before
 REA writes files or installs Hopper. You can cancel at any prompt.
 

docs/javascript-application-graph.md

@@ -81,6 +81,10 @@ one physical source map. The full URL is kept out of node identity, display
 label, and edge properties, so large inline data URLs are stored once per
 source-map reference.
 
+Consumers previously reading `edge.properties.declared_url` should follow
+`target_node_id` and select the observation by `declared_url_sha256` instead.
+Node labels serve display; the observation preserves the original URL.
+
 For example, a source-owned synthetic fixture proves this path without using a
 third-party application:
 

docs/javascript-artifact-reconstruction.md

@@ -112,6 +112,13 @@ Field selection remains useful when the caller needs a
 smaller view, for example `--format json --filter-output
 evidence_id,normalized_result.statistics`. Streaming output does not bound the
 memory needed to construct the analysis graph itself.
+
+CLI workflows still parse each JSON input as one value. A valid input exceeding
+the Node runtime's maximum string length returns `resource_constraint` with
+`input_reason: "too-large"` and the runtime limit. Produce smaller independent
+analysis inputs before retrying; streaming output does not imply streaming
+input parsing.
+
 MCP prepares the complete repeated response incrementally against the pinned
 SDK's 10 MiB stdio receive-buffer budget. Oversized results return an actionable
 transport constraint and the exact same-session Evidence reference. Use