docs: describe complete application analysis outputs

docs/apple-application-analysis.md

@@ -0,0 +1,18 @@
+# Apple Application Inventory Projection
+
+REA can project one or more authenticated `inventory_artifact` Evidence records
+for the same IPA into an Apple application inventory. The projection is
+execution-free: it reports exact paths, content hashes, detected formats,
+runtime-family hints, and path-based bridge hypotheses. It does not parse plist
+or CMS semantics or claim observed runtime calls.
+
+The result includes every component in each inventory category and every
+JavaScript-to-native bridge candidate pair. It has no caller-selected component
+budget, prefix truncation, or omitted-count fields. Duplicate inventory pages
+are merged by artifact identity and occurrence path; their Evidence IDs remain
+attached as source Evidence.
+
+Coverage is `complete-within-inventory` when the supplied pages reconstruct the
+complete authenticated inventory, and `partial` otherwise. A partial result
+states that absence is unknown. Component and bridge-candidate arrays are still
+the complete projection of the inventory that was supplied.

docs/architecture.mermaid

@@ -16,8 +16,7 @@ graph TD
         APP["src/application/<br/>Shared CLI/MCP workflows<br/>enhanced analysis and investigations"]
         SESSION["SessionProviderRouter + BinarySession<br/>one immutable deep binding per target<br/>disjoint auxiliary routing"]
         REGISTRY["AnalysisProviderRegistry<br/>sorted deep candidates<br/>deterministic selection, no fallback"]
-        WORKSPACE["Investigation workspace store<br/>approved roots, canonical JSON<br/>atomic CAS revisions and locks"]
-        JS_RECON["JavaScript artifact reconstruction<br/>bounded directory/ASAR reads<br/>AST-only bundle projection"]
+        JS_RECON["JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
     end
 
     subgraph "Provider Layers"
@@ -37,7 +36,7 @@ graph TD
     end
 
     subgraph "Domain Layer"
-        DOMAIN["src/domain/<br/>Pure side-effect-free modules<br/>evidence, comparisons, application graphs, workspace commitments"]
+        DOMAIN["src/domain/<br/>Pure side-effect-free modules<br/>evidence, comparisons, application graphs"]
     end
 
     subgraph "Configuration"
@@ -59,7 +58,6 @@ graph TD
     REGISTRY --> HOPPER
     REGISTRY --> GHIDRA
     SESSION --> AUX
-    APP --> WORKSPACE
     APP --> JS_RECON
     APP --> INSTALL
     SERVER --> CONTRACTS

skills/reverse-engineer-anything/SKILL.md

@@ -4,7 +4,7 @@ description: Reverse engineer native, managed, Electron/JavaScript, packaged, an
 metadata:
   version: "23"
   tool_count: 111
-  catalog_digest: "d37c2bd4930e6065896ba8085f03681c2b376d9d236a6798d55b466ba42749d9"
+  catalog_digest: "ac4da7d924b2f65ff14108d03f3838cebbbf8c92c9ae3034165375e0b12678fd"
 ---
 
 # REA

skills/reverse-engineer-anything/references/javascript-applications.md

@@ -1,10 +1,12 @@
 # JavaScript and Electron application artifacts
 
-Use `analyze_javascript_application` for an operator-supplied ASAR or extracted
-tree beneath an approved investigation root. Every call requires `approved:
-true`; source-map contents require separate approval. Keep the default summary.
-Use its counts, roots, node kinds, top findings, coverage, unknowns, and graph
-page URIs before requesting more data.
+Use `analyze_javascript_application` directly on the operator-supplied ASAR or
+extracted tree. It reads the selected local path without an approval flag or
+configured investigation root. The complete result, graph, and Evidence context
+are returned inline, so inspect them directly without fetching resource links.
+Source-map contents are part of the static analysis. Start from its findings,
+coverage, unknowns, and graph context, then make a focused follow-up only when a
+specific question remains unanswered.
 
 BrowserWindow preferences, preload and contextBridge surfaces, IPC
 registrations, utility processes, and native binding requests are static syntax