arkaik 0.1.2 → 0.2.0

package/dist/index.js

@@ -14942,6 +14942,7 @@ function crossCheckJournal(bundle) {
   });
   const everNodes = new Set(snapshotNodeStatus.keys());
   const everEdges = new Set(snapshotEdgeIds);
+  const baselined = /* @__PURE__ */ new Set();
   for (const { ev } of valid) {
     if (ev.type === "node.created") {
       const nid = str2(ev.node_id);
@@ -14949,6 +14950,14 @@ function crossCheckJournal(bundle) {
     } else if (ev.type === "edge.added") {
       const eid = str2(ev.edge_id);
       if (eid) everEdges.add(eid);
+    } else if (ev.type === "journal.baseline" && Array.isArray(ev.node_ids)) {
+      for (const raw of ev.node_ids) {
+        const nid = str2(raw);
+        if (nid) {
+          baselined.add(nid);
+          everNodes.add(nid);
+        }
+      }
     }
   }
   const ordered = orderEvents(valid.map((v) => v.ev));
@@ -15014,7 +15023,7 @@ function crossCheckJournal(bundle) {
     }
   }
   for (const [nodeId, status] of snapshotNodeStatus) {
-    if (!created.has(nodeId)) {
+    if (!created.has(nodeId) && !baselined.has(nodeId)) {
       findings.push({
         path: "journal",
         rule: "journal-missing-node-created",
@@ -15046,6 +15055,26 @@ function crossCheckJournal(bundle) {
   }
   return findings;
 }
+function missingProvenanceNodeIds(snapshotNodeIds, events) {
+  const covered = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (ev.type === "node.created") {
+      if (typeof ev.node_id === "string") covered.add(ev.node_id);
+    } else if (ev.type === "journal.baseline" && Array.isArray(ev.node_ids)) {
+      for (const id of ev.node_ids) {
+        if (typeof id === "string") covered.add(id);
+      }
+    }
+  }
+  const missing = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of snapshotNodeIds) {
+    if (covered.has(id) || seen.has(id)) continue;
+    seen.add(id);
+    missing.push(id);
+  }
+  return missing;
+}
 
 // ../schema/src/journal-events.ts
 var envelope = {
@@ -15112,7 +15141,12 @@ var DeliverableShippedEventSchema = external_exports.object({
   summary: external_exports.string().optional(),
   url: external_exports.string().optional(),
   node_ids: external_exports.array(external_exports.string()).optional(),
-  platform: PlatformSchema.optional()
+  platform: PlatformSchema.optional(),
+  lab_note: external_exports.object({
+    en: external_exports.object({ title: external_exports.string(), summary: external_exports.string() }).catchall(external_exports.unknown()),
+    fr: external_exports.object({ title: external_exports.string().optional(), summary: external_exports.string().optional() }).catchall(external_exports.unknown()).optional(),
+    suggested: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).catchall(external_exports.unknown()).optional().meta({ description: "The Lab Note a merged PR carried (slice 3); en.title/en.summary required when present." })
 }).catchall(external_exports.unknown());
 var IdeaProposedEventSchema = external_exports.object({
   ...envelope,
@@ -15147,6 +15181,49 @@ var RefStatusChangedEventSchema = external_exports.object({
   to: external_exports.string(),
   synced_at: external_exports.string()
 }).catchall(external_exports.unknown());
+var JournalBaselineEventSchema = external_exports.object({ ...envelope, type: external_exports.literal("journal.baseline"), node_ids: external_exports.array(external_exports.string()) }).catchall(external_exports.unknown());
+var QualityAuditCompletedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.audit.completed"),
+  audit_id: external_exports.string(),
+  framework_version: external_exports.string(),
+  commit: external_exports.string().optional(),
+  scores: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.number())).optional(),
+  counts: external_exports.object({
+    critical: external_exports.number().optional(),
+    high: external_exports.number().optional(),
+    medium: external_exports.number().optional(),
+    low: external_exports.number().optional(),
+    info: external_exports.number().optional()
+  }).catchall(external_exports.unknown()).optional()
+}).catchall(external_exports.unknown());
+var QualityFindingOpenedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.finding.opened"),
+  finding_id: external_exports.string(),
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  severity: external_exports.string(),
+  priority: external_exports.string(),
+  title: external_exports.string(),
+  node_ids: external_exports.array(external_exports.string()).optional(),
+  issue_url: external_exports.string().optional()
+}).catchall(external_exports.unknown());
+var QualityFindingResolvedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.finding.resolved"),
+  finding_id: external_exports.string(),
+  resolved_by: external_exports.string().optional(),
+  node_ids: external_exports.array(external_exports.string()).optional()
+}).catchall(external_exports.unknown());
+var QualitySignalTrippedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.signal.tripped"),
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  signal: external_exports.string(),
+  detail: external_exports.string().optional()
+}).catchall(external_exports.unknown());
 var JOURNAL_EVENT_SCHEMAS = {
   "node.created": NodeCreatedEventSchema,
   "node.updated": NodeUpdatedEventSchema,
@@ -15161,7 +15238,12 @@ var JOURNAL_EVENT_SCHEMAS = {
   "request.filed": RequestFiledEventSchema,
   "ref.added": RefAddedEventSchema,
   "ref.removed": RefRemovedEventSchema,
-  "ref.status_changed": RefStatusChangedEventSchema
+  "ref.status_changed": RefStatusChangedEventSchema,
+  "journal.baseline": JournalBaselineEventSchema,
+  "quality.audit.completed": QualityAuditCompletedEventSchema,
+  "quality.finding.opened": QualityFindingOpenedEventSchema,
+  "quality.finding.resolved": QualityFindingResolvedEventSchema,
+  "quality.signal.tripped": QualitySignalTrippedEventSchema
 };
 var KnownJournalEventSchema = external_exports.union([
   NodeCreatedEventSchema,
@@ -15177,9 +15259,114 @@ var KnownJournalEventSchema = external_exports.union([
   RequestFiledEventSchema,
   RefAddedEventSchema,
   RefRemovedEventSchema,
-  RefStatusChangedEventSchema
+  RefStatusChangedEventSchema,
+  JournalBaselineEventSchema,
+  QualityAuditCompletedEventSchema,
+  QualityFindingOpenedEventSchema,
+  QualityFindingResolvedEventSchema,
+  QualitySignalTrippedEventSchema
 ]);
 
+// ../schema/src/quality-schemas.ts
+var GradeSchema = external_exports.enum(["A", "B", "C", "D", "E"]);
+var KritikScalesSchema = external_exports.object({
+  grades: external_exports.partialRecord(GradeSchema, external_exports.number()).optional(),
+  severity_buckets: external_exports.partialRecord(external_exports.enum(["critical", "high", "medium", "low", "info"]), external_exports.tuple([external_exports.number(), external_exports.number()])).optional(),
+  caps: external_exports.object({ critical_open: GradeSchema.optional(), high_open: GradeSchema.optional() }).catchall(external_exports.unknown()).optional()
+}).catchall(external_exports.unknown()).meta({
+  id: "KritikScales",
+  description: "Overridable maturity/severity/grade scales carried by a criteria pack. Absent entries fall back to the framework defaults (packages/kritik-library/SPEC.md \xA7 4)."
+});
+var KritikReferenceSchema = external_exports.object({ title: external_exports.string(), anchor: external_exports.string().optional(), url: external_exports.string().optional() }).catchall(external_exports.unknown()).meta({ id: "KritikReference", description: "A stable external anchor behind a criterion (OWASP control, GDPR article, WCAG SC\u2026)." });
+var KritikIssueTemplateSchema = external_exports.object({
+  title_template: external_exports.string().optional(),
+  labels: external_exports.array(external_exports.string()).optional(),
+  body_skeleton: external_exports.string().optional()
+}).catchall(external_exports.unknown()).meta({ id: "KritikIssueTemplate", description: "Per-criterion issue skeleton \u2014 what `arkaik kritik issue` prefills." });
+var KritikDomainSchema = external_exports.object({ code: external_exports.string(), name: external_exports.string(), description: external_exports.string().optional() }).catchall(external_exports.unknown()).meta({ id: "KritikDomain", description: "A top-level criteria category owning a roll-up row in the matrix." });
+var KritikCriterionSchema = external_exports.object({
+  id: external_exports.string().meta({ description: "Stable identifier, `<DOMAIN>-NN`. Never redefined \u2014 retired via superseded_by." }),
+  domain: external_exports.string(),
+  subcategory: external_exports.string().optional(),
+  name: external_exports.string().optional(),
+  question: external_exports.string().optional(),
+  definition: external_exports.string().optional(),
+  rationale: external_exports.string().optional(),
+  applies_to: external_exports.array(external_exports.string()).optional().meta({ description: "Surface ids where the criterion is meaningful; absence means N/A." }),
+  level_anchors: external_exports.record(external_exports.string(), external_exports.string()).optional().meta({ description: "Observable descriptions per maturity level, keyed l0\u2026l4." }),
+  default_impact: external_exports.number().optional(),
+  weight: external_exports.number().optional().meta({ description: "Weight in the domain roll-up (1\u20133; 3 = load-bearing). Absent means 1." }),
+  references: external_exports.array(KritikReferenceSchema).optional(),
+  checklist: external_exports.array(external_exports.string()).optional(),
+  signals: external_exports.array(external_exports.string()).optional().meta({ description: "Mechanically checkable monitoring hooks run between audits." }),
+  remediation: external_exports.string().optional(),
+  issue: KritikIssueTemplateSchema.optional(),
+  superseded_by: external_exports.string().optional()
+}).catchall(external_exports.unknown()).meta({ id: "KritikCriterion", description: "The atomic auditable unit (packages/kritik-library/SPEC.md \xA7 5)." });
+var KritikLibrarySchema = external_exports.object({
+  version: external_exports.string().meta({ description: "Semver of the pack; matrices are comparable only within a major." }),
+  domains: external_exports.array(KritikDomainSchema),
+  criteria: external_exports.array(KritikCriterionSchema),
+  scales: KritikScalesSchema.optional()
+}).catchall(external_exports.unknown()).meta({
+  id: "KritikLibrary",
+  description: "A versioned criteria pack. Embedded on export; repos may instead pin it as a sidecar file."
+});
+var SurfaceDefSchema = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  platform: PlatformSchema.optional().meta({
+    description: "Optional bridge to PLATFORM_IDS where a surface is also a view-shipping platform. Surfaces are not platforms (RFC \xA7 2)."
+  }),
+  path: external_exports.string().optional()
+}).catchall(external_exports.unknown()).meta({ id: "SurfaceDef", description: "One independently assessable body of code \u2014 an audit target, chosen at install." });
+var QualityProfileSchema = external_exports.object({
+  surfaces: external_exports.array(SurfaceDefSchema),
+  domain_weights: external_exports.record(external_exports.string(), external_exports.number()).optional().meta({
+    description: "Per-domain weight in the surface roll-up, keyed by domain code. A missing weight is 1."
+  })
+}).catchall(external_exports.unknown()).meta({ id: "QualityProfile", description: "The project's parameterization of the pack (RFC \xA7 6)." });
+var QualityAssessmentSchema = external_exports.object({
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  level: external_exports.union([external_exports.literal(0), external_exports.literal(1), external_exports.literal(2), external_exports.literal(3), external_exports.literal(4)]).meta({
+    description: "Maturity 0\u20134. N/A is the absence of the row, never a level."
+  }),
+  evidence: external_exports.string().meta({ description: "file:line / config citations. A score without evidence is an opinion, not an assessment." }),
+  audit_id: external_exports.string(),
+  commit: external_exports.string().optional(),
+  ts: external_exports.string()
+}).catchall(external_exports.unknown()).meta({ id: "QualityAssessment", description: "One (criterion \xD7 surface) score \u2014 latest wins; history lives in the journal." });
+var QualityFindingSchema = external_exports.object({
+  id: external_exports.string(),
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  evidence: external_exports.string(),
+  impact: external_exports.number().meta({ description: "Worst plausible consequence, 1\u20135." }),
+  likelihood: external_exports.number().meta({ description: "Probability it materializes, 1\u20135." }),
+  cost: external_exports.enum(["S", "M", "L", "XL"]),
+  status: external_exports.enum(["open", "resolved", "refuted", "accepted-risk"]),
+  remediation: external_exports.string().optional(),
+  node_ids: external_exports.array(external_exports.string()).optional().meta({ description: "Graph nodes this finding is about \u2014 the tie deliverable.shipped already uses." }),
+  issue_url: external_exports.string().optional(),
+  verification: external_exports.object({ verdict: external_exports.enum(["CONFIRMED", "REFUTED", "DOWNGRADED"]), note: external_exports.string().optional() }).catchall(external_exports.unknown()).optional().meta({ description: "Result of the adversarial refutation pass. Refuted findings are disclosed, not deleted." })
+}).catchall(external_exports.unknown()).meta({
+  id: "QualityFinding",
+  description: "One concrete defect. Severity and priority are deliberately absent \u2014 they are derived from impact \xD7 likelihood and cost (deriveQualityMatrix), so a finding can never carry a severity its own numbers disagree with."
+});
+var QualitySectionSchema = external_exports.object({
+  framework_version: external_exports.string(),
+  library: KritikLibrarySchema.optional(),
+  profile: QualityProfileSchema,
+  assessments: external_exports.array(QualityAssessmentSchema),
+  findings: external_exports.array(QualityFindingSchema)
+}).catchall(external_exports.unknown()).meta({
+  id: "QualitySection",
+  description: "The project's Kritik state (docs/rfcs/kritik.md \xA7 4.1) \u2014 profile, assessments, findings. Criteria are library content, not graph nodes; the matrix is a projection, never stored."
+});
+
 // ../schema/src/bundle.ts
 var PlatformStatusMapSchema = external_exports.partialRecord(
   PlatformSchema,
@@ -15321,7 +15508,8 @@ var ProjectMetadataSchema = external_exports.object({
   }),
   products: external_exports.array(ProductDefinitionSchema).optional().meta({
     description: "Product definitions (docs/spec/bundle-format.md \xA7 Products) \u2014 additive; unknown fields preserved."
-  })
+  }),
+  pollen: external_exports.object({ plant: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*$/).optional() }).catchall(external_exports.unknown()).optional().meta({ description: "Federation settings \u2014 docs/spec/services.md \xA7 Pollen feed. `plant` enables the feed." })
 }).catchall(external_exports.unknown()).meta({ id: "ProjectMetadata", description: "Optional project-level UI settings." });
 var ProjectSchema = external_exports.object({
   id: external_exports.string().meta({ description: "Unique project identifier." }),
@@ -15349,6 +15537,9 @@ var ProjectBundleSchema = external_exports.object({
   edges: external_exports.array(EdgeSchema).meta({ description: "All edges (relationships) between nodes." }),
   journal: external_exports.array(JournalEventSchema).optional().meta({
     description: "Optional embedded journal events \u2014 the Level 2 interchange projection (docs/spec/journal.md). Canonical storage in repos is the JSONL sidecar; a bundle without a journal is Level 0/1, not an error."
+  }),
+  quality: QualitySectionSchema.optional().meta({
+    description: "Optional Kritik quality state (docs/rfcs/kritik.md \xA7 4.1) \u2014 the pinned pack version, the project's surface profile, its assessments and findings. Additive: a bundle without it is not an error, and the comparative matrix is derived from it (deriveQualityMatrix), never stored."
   })
 }).catchall(external_exports.unknown()).meta({
   id: "ProjectBundle",
@@ -15356,15 +15547,6 @@ var ProjectBundleSchema = external_exports.object({
   description: "The import/export format for an Arkaik product graph. Contains a project, its nodes (flows, views, data models, API endpoints), and edges (relationships between nodes)."
 });
 
-// ../schema/src/maps.ts
-var MAP_FLOW_PLATFORMS_MODES = ["rings", "bars"];
-var MAP_VIEW_PLATFORMS_MODES = ["chips", "rows"];
-var MAP_MINIMAP_COLOR_MODES = ["status", "species"];
-var BUILT_IN_MAP_IDS = ["journey", "system"];
-function isBuiltInMapId(id) {
-  return BUILT_IN_MAP_IDS.includes(id);
-}
-
 // ../schema/src/products.ts
 var PRODUCT_MEMBERSHIP_SPECIES = ["flow", "view", "acceptance"];
 function resolveProducts(project) {
@@ -15382,6 +15564,214 @@ function resolveProducts(project) {
   return products;
 }
 
+// ../schema/src/maps.ts
+var MAP_FLOW_PLATFORMS_MODES = ["rings", "bars"];
+var MAP_VIEW_PLATFORMS_MODES = ["chips", "rows"];
+var MAP_MINIMAP_COLOR_MODES = ["status", "species"];
+var BUILT_IN_MAP_IDS = ["journey", "system"];
+function isBuiltInMapId(id) {
+  return BUILT_IN_MAP_IDS.includes(id);
+}
+
+// ../schema/src/quality.ts
+var asArray = (value) => Array.isArray(value) ? value : [];
+var FINDING_SEVERITIES = ["critical", "high", "medium", "low", "info"];
+var REMEDIATION_COSTS = ["S", "M", "L", "XL"];
+var QUALITY_GRADES = ["A", "B", "C", "D", "E"];
+var DEFAULT_GRADE_BANDS = { A: 85, B: 70, C: 55, D: 40, E: 0 };
+var DEFAULT_SEVERITY_BUCKETS = {
+  critical: [20, 25],
+  high: [12, 19],
+  medium: [6, 11],
+  low: [2, 5],
+  info: [1, 1]
+};
+var DEFAULT_CAPS = {
+  critical_open: "D",
+  high_open: "B"
+};
+var CROSS_SURFACE_ID = "cross-surface";
+function mergeKritikLibrary(pack, overlay) {
+  if (!overlay || typeof overlay !== "object") return pack;
+  const domains = [...asArray(pack.domains)];
+  for (const domain2 of asArray(overlay.domains)) {
+    if (typeof domain2?.code !== "string" || domain2.code === "") continue;
+    const at2 = domains.findIndex((existing) => existing?.code === domain2.code);
+    if (at2 >= 0) domains[at2] = domain2;
+    else domains.push(domain2);
+  }
+  const criteria = [...asArray(pack.criteria)];
+  for (const criterion of asArray(overlay.criteria)) {
+    if (typeof criterion?.id !== "string" || criterion.id === "") continue;
+    const at2 = criteria.findIndex((existing) => existing?.id === criterion.id);
+    if (at2 >= 0) criteria[at2] = criterion;
+    else criteria.push(criterion);
+  }
+  const scales = pack.scales || overlay.scales ? { ...pack.scales ?? {}, ...overlay.scales ?? {} } : void 0;
+  return { ...pack, domains, criteria, ...scales ? { scales } : {} };
+}
+function bucketsOf(library) {
+  const stored = library?.scales?.severity_buckets;
+  const out = { ...DEFAULT_SEVERITY_BUCKETS };
+  if (!stored || typeof stored !== "object") return out;
+  for (const severity of FINDING_SEVERITIES) {
+    const band = stored[severity];
+    if (Array.isArray(band) && typeof band[0] === "number" && typeof band[1] === "number") {
+      out[severity] = [band[0], band[1]];
+    }
+  }
+  return out;
+}
+function bandsOf(library) {
+  const stored = library?.scales?.grades;
+  const out = { ...DEFAULT_GRADE_BANDS };
+  if (!stored || typeof stored !== "object") return out;
+  for (const grade of QUALITY_GRADES) {
+    const min = stored[grade];
+    if (typeof min === "number" && Number.isFinite(min)) out[grade] = min;
+  }
+  return out;
+}
+function capsOf(library) {
+  const stored = library?.scales?.caps;
+  const pick2 = (value, fallback) => typeof value === "string" && QUALITY_GRADES.includes(value) ? value : fallback;
+  return {
+    critical_open: pick2(stored?.critical_open, DEFAULT_CAPS.critical_open),
+    high_open: pick2(stored?.high_open, DEFAULT_CAPS.high_open)
+  };
+}
+function severityOf(finding, library) {
+  const impact = typeof finding.impact === "number" ? finding.impact : 0;
+  const likelihood = typeof finding.likelihood === "number" ? finding.likelihood : 0;
+  const score = impact * likelihood;
+  const buckets = bucketsOf(library);
+  const worstFirst = [...FINDING_SEVERITIES].sort((a, b) => buckets[b][0] - buckets[a][0]);
+  for (const severity of worstFirst) {
+    if (score >= buckets[severity][0]) return severity;
+  }
+  return "info";
+}
+function priorityOf(finding, library) {
+  const severity = severityOf(finding, library);
+  const cheap = finding.cost === "S";
+  if (severity === "critical") return "P0";
+  if (severity === "high") return cheap ? "P0" : "P1";
+  if (severity === "medium") return cheap ? "P1" : "P2";
+  if (severity === "low") return cheap ? "P2" : "P3";
+  return "P3";
+}
+function gradeOf(score, library) {
+  const bands = bandsOf(library);
+  const bestFirst = [...QUALITY_GRADES].sort((a, b) => bands[b] - bands[a]);
+  for (const grade of bestFirst) {
+    if (score >= bands[grade]) return grade;
+  }
+  return "E";
+}
+function capGrade(grade, cap) {
+  return QUALITY_GRADES[Math.max(QUALITY_GRADES.indexOf(grade), QUALITY_GRADES.indexOf(cap))];
+}
+function isOpenFinding(finding) {
+  return (finding.status ?? "open") === "open";
+}
+function resolveKritikLibrary(section, library) {
+  const explicit = library ?? section?.library;
+  if (explicit && Array.isArray(explicit.criteria) && Array.isArray(explicit.domains)) return explicit;
+  if (!section) return void 0;
+  const ids = /* @__PURE__ */ new Set();
+  for (const row of [...asArray(section.assessments), ...asArray(section.findings)]) {
+    if (typeof row?.criterion_id === "string" && row.criterion_id !== "") ids.add(row.criterion_id);
+  }
+  if (ids.size === 0) return void 0;
+  const domainOf = (id) => id.includes("-") ? id.slice(0, id.lastIndexOf("-")) : id;
+  const criteria = [...ids].sort().map((id) => ({ id, domain: domainOf(id), weight: 1 }));
+  const domains = [...new Set(criteria.map((c) => c.domain))].sort().map((code) => ({ code, name: code }));
+  return { version: explicit?.version ?? "unknown", domains, criteria, scales: explicit?.scales };
+}
+function deriveQualityMatrix(bundle, library) {
+  const section = bundle.quality;
+  const pack = resolveKritikLibrary(section, library);
+  const assessments = asArray(section?.assessments);
+  const findings = asArray(section?.findings);
+  const openFindings = findings.filter((finding) => isOpenFinding(finding));
+  const declared = asArray(section?.profile?.surfaces).map((surface) => surface?.id).filter((id) => typeof id === "string" && id !== "");
+  const surfaces = declared.length > 0 ? [...new Set(declared)] : [...new Set(assessments.map((a) => a.surface).filter((id) => typeof id === "string" && id !== ""))].sort();
+  const domains = asArray(pack?.domains).map((domain2) => domain2?.code).filter((code) => typeof code === "string" && code !== "");
+  const domainOfCriterion = /* @__PURE__ */ new Map();
+  const weightOfCriterion = /* @__PURE__ */ new Map();
+  for (const criterion of asArray(pack?.criteria)) {
+    if (typeof criterion?.id !== "string") continue;
+    if (typeof criterion.domain === "string") domainOfCriterion.set(criterion.id, criterion.domain);
+    weightOfCriterion.set(criterion.id, typeof criterion.weight === "number" && criterion.weight > 0 ? criterion.weight : 1);
+  }
+  const caps = capsOf(pack);
+  const weights = section?.profile?.domain_weights;
+  const matrix = {};
+  for (const domain2 of domains) {
+    matrix[domain2] = {};
+    for (const surface of surfaces) {
+      const rows = assessments.filter((a) => a.surface === surface && domainOfCriterion.get(a.criterion_id) === domain2);
+      if (rows.length === 0) {
+        matrix[domain2][surface] = null;
+        continue;
+      }
+      let earned = 0;
+      let available = 0;
+      for (const row of rows) {
+        const weight = weightOfCriterion.get(row.criterion_id) ?? 1;
+        const level = typeof row.level === "number" ? Math.min(Math.max(row.level, 0), 4) : 0;
+        earned += level * weight;
+        available += 4 * weight;
+      }
+      if (available === 0) {
+        matrix[domain2][surface] = null;
+        continue;
+      }
+      const score = Math.round(earned / available * 100);
+      const cellSeverities = openFindings.filter((finding) => finding.surface === surface && domainOfCriterion.get(finding.criterion_id) === domain2).map((finding) => severityOf(finding, pack));
+      const banded = gradeOf(score, pack);
+      let grade = banded;
+      if (cellSeverities.includes("critical")) grade = capGrade(grade, caps.critical_open);
+      else if (cellSeverities.includes("high")) grade = capGrade(grade, caps.high_open);
+      matrix[domain2][surface] = {
+        score,
+        grade,
+        capped: grade !== banded,
+        criteria: rows.length,
+        findings: {
+          critical: cellSeverities.filter((s) => s === "critical").length,
+          high: cellSeverities.filter((s) => s === "high").length,
+          medium: cellSeverities.filter((s) => s === "medium").length,
+          low: cellSeverities.filter((s) => s === "low").length
+        }
+      };
+    }
+  }
+  const overall = {};
+  for (const surface of surfaces) {
+    let weighted = 0;
+    let total = 0;
+    for (const domain2 of domains) {
+      const cell = matrix[domain2]?.[surface];
+      if (!cell) continue;
+      const weight = typeof weights?.[domain2] === "number" ? weights[domain2] : 1;
+      weighted += cell.score * weight;
+      total += weight;
+    }
+    overall[surface] = total > 0 ? Math.round(weighted / total) : null;
+  }
+  const finding_counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const finding of openFindings) finding_counts[severityOf(finding, pack)]++;
+  return {
+    framework_version: section?.framework_version,
+    surfaces,
+    domains,
+    matrix,
+    overall,
+    finding_counts
+  };
+}
+
 // ../schema/src/validate.ts
 var VALID_STAGES = ["beta", "monitoring", "deprecated"];
 var VALID_VIEW_CARD_VARIANTS = ["compact", "large"];
@@ -15898,13 +16288,98 @@ function validateBundle(input) {
       composesSet.add(`${sourceId}->${targetId}`);
     }
   });
+  const PLAYLIST_ENTRY_TYPES = ["view", "flow", "condition", "junction"];
+  const checkPlaylistShape = (entries, flowId, path6, depth = 0) => {
+    if (depth > 50) return;
+    if (!Array.isArray(entries)) {
+      error51(path6, "playlist-entry-shape", `Flow ${flowId}: ${path6} must be an array of playlist entries`);
+      return;
+    }
+    entries.forEach((raw, i) => {
+      const p = `${path6}[${i}]`;
+      if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        error51(p, "playlist-entry-shape", `Flow ${flowId}: ${p} must be a playlist entry object`);
+        return;
+      }
+      const entry = raw;
+      const type = entry.type;
+      if (typeof type !== "string" || !PLAYLIST_ENTRY_TYPES.includes(type)) {
+        error51(
+          `${p}.type`,
+          "playlist-entry-shape",
+          `Flow ${flowId}: ${p}.type must be one of ${PLAYLIST_ENTRY_TYPES.join(", ")} (got ${JSON.stringify(type)})`
+        );
+        return;
+      }
+      if (type === "view") {
+        if (typeof entry.view_id !== "string") {
+          error51(`${p}.view_id`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a view entry with no view_id string`);
+        }
+      } else if (type === "flow") {
+        if (typeof entry.flow_id !== "string") {
+          error51(`${p}.flow_id`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a flow entry with no flow_id string`);
+        }
+      } else if (type === "condition") {
+        if (typeof entry.label !== "string") {
+          error51(`${p}.label`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a condition with no label string`);
+        }
+        for (const branch of ["if_true", "if_false"]) {
+          if (!Array.isArray(entry[branch])) {
+            error51(
+              `${p}.${branch}`,
+              "playlist-entry-shape",
+              `Flow ${flowId}: ${p}.${branch} must be an array of playlist entries (both branches are required, use [] for an empty one)`
+            );
+          } else {
+            checkPlaylistShape(entry[branch], flowId, `${p}.${branch}`, depth + 1);
+          }
+        }
+      } else {
+        if (typeof entry.label !== "string") {
+          error51(`${p}.label`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a junction with no label string`);
+        }
+        if (!Array.isArray(entry.cases)) {
+          error51(`${p}.cases`, "playlist-entry-shape", `Flow ${flowId}: ${p}.cases must be an array of junction cases`);
+          return;
+        }
+        entry.cases.forEach((rawCase, j) => {
+          const cp = `${p}.cases[${j}]`;
+          if (typeof rawCase !== "object" || rawCase === null || Array.isArray(rawCase)) {
+            error51(cp, "playlist-entry-shape", `Flow ${flowId}: ${cp} must be a junction case object`);
+            return;
+          }
+          const branch = rawCase;
+          if (typeof branch.label !== "string") {
+            error51(`${cp}.label`, "playlist-entry-shape", `Flow ${flowId}: ${cp} has no label string`);
+          }
+          if (!Array.isArray(branch.entries)) {
+            error51(
+              `${cp}.entries`,
+              "playlist-entry-shape",
+              `Flow ${flowId}: ${cp}.entries must be an array of playlist entries \u2014 a junction case holds its own entries, not a bare view_id/flow_id`
+            );
+          } else {
+            checkPlaylistShape(branch.entries, flowId, `${cp}.entries`, depth + 1);
+          }
+        });
+      }
+    });
+  };
+  nodes.forEach((node, i) => {
+    const md = node.metadata;
+    if (node.species === "flow" && md?.playlist?.entries) {
+      checkPlaylistShape(md.playlist.entries, node.id, `nodes[${i}].metadata.playlist.entries`);
+    }
+  });
   const collectPlaylistRefs = (entries, flowId, path6, depth = 0) => {
     if (depth > 50) {
       error51(path6, "playlist-depth", `Flow ${flowId}: playlist nesting too deep (possible cycle)`);
       return [];
     }
     const refs = [];
+    if (!Array.isArray(entries)) return refs;
     for (const entry of entries) {
+      if (typeof entry !== "object" || entry === null) continue;
       if (entry.type === "view") {
         if (!nodeIds.has(entry.view_id)) {
           error51(path6, "playlist-ref-exists", `Flow ${flowId}: playlist references non-existent view "${entry.view_id}"`);
@@ -15956,7 +16431,9 @@ function validateBundle(input) {
       const nodeId = node.id;
       const subFlows = [];
       const findSubFlows = (entries) => {
+        if (!Array.isArray(entries)) return;
         for (const e of entries) {
+          if (typeof e !== "object" || e === null) continue;
           if (e.type === "flow") subFlows.push(e.flow_id);
           if (e.type === "condition") {
             if (e.if_true) findSubFlows(e.if_true);
@@ -15991,6 +16468,151 @@ function validateBundle(input) {
   for (const id of flowGraph.keys()) {
     dfs(id);
   }
+  const quality = bundle.quality;
+  if (typeof quality === "object" && quality !== null && !Array.isArray(quality)) {
+    const section = quality;
+    const assessments = Array.isArray(section.assessments) ? section.assessments : [];
+    const qualityFindings = Array.isArray(section.findings) ? section.findings : [];
+    const profile = typeof section.profile === "object" && section.profile !== null ? section.profile : void 0;
+    const declaredSurfaces = /* @__PURE__ */ new Set();
+    if (Array.isArray(profile?.surfaces)) {
+      profile.surfaces.forEach((entry, index) => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+        const surface = entry;
+        const surfaceId = typeof surface.id === "string" ? surface.id : void 0;
+        if (surfaceId === void 0 || surfaceId.trim() === "") return;
+        if (declaredSurfaces.has(surfaceId)) {
+          warn(`quality.profile.surfaces[${index}].id`, "quality-duplicate-surface", `Duplicate surface id "${surfaceId}" \u2014 the first wins`);
+        }
+        declaredSurfaces.add(surfaceId);
+      });
+    }
+    if (declaredSurfaces.size === 0 && (assessments.length > 0 || qualityFindings.length > 0)) {
+      warn(
+        "quality.profile.surfaces",
+        "quality-no-surfaces",
+        "Quality data is stored but the profile declares no surfaces \u2014 the matrix falls back to the surfaces the assessments name"
+      );
+    }
+    const library = typeof section.library === "object" && section.library !== null ? section.library : void 0;
+    const knownCriteria = /* @__PURE__ */ new Set();
+    const retiredCriteria = /* @__PURE__ */ new Map();
+    if (Array.isArray(library?.criteria)) {
+      for (const entry of library.criteria) {
+        if (typeof entry !== "object" || entry === null) continue;
+        const criterion = entry;
+        if (typeof criterion.id !== "string") continue;
+        knownCriteria.add(criterion.id);
+        if (typeof criterion.superseded_by === "string" && criterion.superseded_by !== "") {
+          retiredCriteria.set(criterion.id, criterion.superseded_by);
+        }
+      }
+    } else if (assessments.length > 0 || qualityFindings.length > 0) {
+      warn(
+        "quality.library",
+        "quality-library-missing",
+        "No criteria pack is embedded \u2014 criterion ids cannot be resolved to domains or weights; the matrix uses a synthesized library"
+      );
+    }
+    if (typeof section.framework_version !== "string" || section.framework_version === "") {
+      warn("quality.framework_version", "quality-framework-version-missing", "Quality section has no framework_version \u2014 scores are not comparable across audits without one");
+    }
+    const checkRowRefs = (row, path6, label) => {
+      const criterionId = typeof row.criterion_id === "string" ? row.criterion_id : void 0;
+      if (criterionId !== void 0 && knownCriteria.size > 0 && !knownCriteria.has(criterionId)) {
+        warn(`${path6}.criterion_id`, "quality-unknown-criterion", `${label}: criterion "${criterionId}" is not in the pinned library`);
+      }
+      const supersededBy = criterionId !== void 0 ? retiredCriteria.get(criterionId) : void 0;
+      if (supersededBy !== void 0) {
+        warn(`${path6}.criterion_id`, "quality-retired-criterion", `${label}: criterion "${criterionId}" is retired \u2014 superseded by "${supersededBy}"`);
+      }
+      const surface = typeof row.surface === "string" ? row.surface : void 0;
+      if (surface !== void 0 && surface !== CROSS_SURFACE_ID && declaredSurfaces.size > 0 && !declaredSurfaces.has(surface)) {
+        warn(`${path6}.surface`, "quality-unknown-surface", `${label}: surface "${surface}" is not declared in the profile`);
+      }
+    };
+    const seenCells = /* @__PURE__ */ new Set();
+    assessments.forEach((entry, index) => {
+      if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+      const assessment = entry;
+      const path6 = `quality.assessments[${index}]`;
+      const label = `Assessment ${index}`;
+      checkRowRefs(assessment, path6, label);
+      const level = assessment.level;
+      if (typeof level !== "number" || !Number.isInteger(level) || level < 0 || level > 4) {
+        warn(`${path6}.level`, "quality-level-range", `${label}: level must be an integer 0-4 (N/A is the absence of the row, not a level)`);
+      }
+      if (assessment.surface === CROSS_SURFACE_ID) {
+        warn(`${path6}.surface`, "quality-cross-surface-assessment", `${label}: "${CROSS_SURFACE_ID}" is a findings-only lens \u2014 it carries no matrix column, so this score would render nowhere`);
+      }
+      if (typeof assessment.evidence !== "string" || assessment.evidence.trim() === "") {
+        warn(`${path6}.evidence`, "quality-assessment-no-evidence", `${label}: scored with no evidence \u2014 a score without a citation is an opinion, not an assessment`);
+      }
+      const criterionId = typeof assessment.criterion_id === "string" ? assessment.criterion_id : void 0;
+      const surface = typeof assessment.surface === "string" ? assessment.surface : void 0;
+      if (criterionId !== void 0 && surface !== void 0) {
+        const cell = `${criterionId}\0${surface}`;
+        if (seenCells.has(cell)) {
+          warn(`${path6}`, "quality-duplicate-assessment", `${label}: a second score for (${criterionId} x ${surface}) \u2014 the section stores latest-per-cell, so this cell is ambiguous`);
+        }
+        seenCells.add(cell);
+      }
+    });
+    const seenFindingIds = /* @__PURE__ */ new Set();
+    qualityFindings.forEach((entry, index) => {
+      if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+      const finding = entry;
+      const path6 = `quality.findings[${index}]`;
+      const label = `Finding ${index}`;
+      checkRowRefs(finding, path6, label);
+      const findingId = typeof finding.id === "string" ? finding.id : void 0;
+      if (findingId !== void 0) {
+        if (seenFindingIds.has(findingId)) {
+          warn(`${path6}.id`, "quality-duplicate-finding-id", `Duplicate finding id "${findingId}"`);
+        }
+        seenFindingIds.add(findingId);
+      }
+      for (const field of ["impact", "likelihood"]) {
+        const value = finding[field];
+        if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 5) {
+          warn(`${path6}.${field}`, "quality-risk-range", `${label}: ${field} must be an integer 1-5 \u2014 severity is derived from impact x likelihood`);
+        }
+      }
+      for (const derived of ["severity", "priority"]) {
+        if (derived in finding) {
+          warn(`${path6}.${derived}`, "quality-derived-field-stored", `${label}: ${derived} is derived from impact, likelihood and cost \u2014 storing it lets it drift from the numbers behind it`);
+        }
+      }
+      if (finding.status === "accepted-risk" && (typeof finding.detail !== "string" || finding.detail.trim() === "")) {
+        warn(`${path6}.detail`, "quality-accepted-risk-no-note", `${label}: accepted-risk with no note \u2014 an accepted risk is a decision and reads like one`);
+      }
+    });
+    const openedInJournal = /* @__PURE__ */ new Set();
+    const journalEvents = Array.isArray(bundle.journal) ? bundle.journal : [];
+    journalEvents.forEach((entry) => {
+      if (typeof entry !== "object" || entry === null) return;
+      const event = entry;
+      if (event.type === "quality.finding.opened" && typeof event.finding_id === "string") openedInJournal.add(event.finding_id);
+    });
+    journalEvents.forEach((entry, index) => {
+      if (typeof entry !== "object" || entry === null) return;
+      const event = entry;
+      const type = typeof event.type === "string" ? event.type : "";
+      if (!type.startsWith("quality.")) return;
+      if (typeof event.actor !== "string" || event.actor.trim() === "") {
+        warn(`journal[${index}].actor`, "quality-event-no-actor", `Journal event ${index}: ${type} has no actor \u2014 human, agent and CI scores become indistinguishable`);
+      }
+      if (type === "quality.finding.resolved" && typeof event.finding_id === "string") {
+        if (!openedInJournal.has(event.finding_id) && !seenFindingIds.has(event.finding_id)) {
+          warn(
+            `journal[${index}].finding_id`,
+            "quality-resolved-never-opened",
+            `Journal event ${index}: resolves finding "${event.finding_id}", which no quality.finding.opened event or stored finding ever declared`
+          );
+        }
+      }
+    });
+  }
   for (const finding of crossCheckJournal(bundle)) findings.push(finding);
   return result();
 }
@@ -16379,6 +17001,215 @@ function promotionPatch(node, promotion) {
   };
 }
 
+// ../schema/src/quality-ops.ts
+var DEFAULT_TARGET_LEVEL = 3;
+function upsertAssessment(assessments, next) {
+  const index = assessments.findIndex(
+    (candidate) => candidate.criterion_id === next.criterion_id && candidate.surface === next.surface
+  );
+  if (index === -1) return { assessments: [...assessments, next] };
+  const updated = [...assessments];
+  const replaced = updated[index];
+  updated[index] = next;
+  return { assessments: updated, replaced };
+}
+function parseSurfaceSpec(spec) {
+  const parts = spec.split(":");
+  const id = (parts[0] ?? "").trim();
+  if (id === "") throw new Error(`--surface needs an id (got "${spec}")`);
+  if (id === CROSS_SURFACE_ID) {
+    throw new Error(
+      `"${CROSS_SURFACE_ID}" is reserved \u2014 it is the contract lens between surfaces. Findings may carry it; it holds no assessments and never becomes a matrix column, so it is not declared here.`
+    );
+  }
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(id)) {
+    throw new Error(
+      `surface id "${id}" is not kebab-case \u2014 assessments reference it, so it has to be stable and typo-proof`
+    );
+  }
+  const title2 = (parts[1] ?? "").trim() || id;
+  const platform = (parts[2] ?? "").trim();
+  if (platform !== "" && !PLATFORM_IDS.includes(platform)) {
+    throw new Error(
+      `"${platform}" is not an Arkaik platform (${PLATFORM_IDS.join(", ")}). A surface that ships no views simply has none \u2014 leave it off rather than inventing one.`
+    );
+  }
+  return platform === "" ? { id, title: title2 } : { id, title: title2, platform };
+}
+function domainCodeOf(criterionId, library) {
+  const criterion = (library?.criteria ?? []).find((candidate) => candidate.id === criterionId);
+  if (typeof criterion?.domain === "string" && criterion.domain !== "") return criterion.domain;
+  const dash = criterionId.indexOf("-");
+  return dash > 0 ? criterionId.slice(0, dash) : criterionId;
+}
+function mintFindingId(auditId, criterionId, surface, taken, library) {
+  const prefix = `F-${auditId}-${domainCodeOf(criterionId, library)}-${surface}-`;
+  const used = new Set(taken);
+  for (let n = 1; n < 1e3; n++) {
+    const candidate = `${prefix}${String(n).padStart(2, "0")}`;
+    if (!used.has(candidate)) return candidate;
+  }
+  throw new Error(`Kritik: exhausted finding ids for ${prefix}NN \u2014 999 findings on one cell is a data problem, not a numbering one`);
+}
+function upsertFinding(findings, next) {
+  const index = findings.findIndex((candidate) => candidate.id === next.id);
+  if (index === -1) return { findings: [...findings, next] };
+  const updated = [...findings];
+  const replaced = updated[index];
+  updated[index] = next;
+  return { findings: updated, replaced };
+}
+function patchFinding(findings, id, patch) {
+  const index = findings.findIndex((candidate) => candidate.id === id);
+  if (index === -1) return { findings: [...findings] };
+  const updated = [...findings];
+  const previous = updated[index];
+  const finding = { ...previous, ...patch };
+  updated[index] = finding;
+  return { findings: updated, finding, previous };
+}
+function resolveFinding(findings, id, resolvedBy) {
+  return patchFinding(findings, id, {
+    status: "resolved",
+    ...resolvedBy !== void 0 ? { resolved_by: resolvedBy } : {}
+  });
+}
+function acceptFinding(findings, id, note) {
+  const existing = findings.find((candidate) => candidate.id === id);
+  const detail = existing === void 0 ? note : `${existing.detail}
+
+Accepted risk: ${note}`.trim();
+  return patchFinding(findings, id, { status: "accepted-risk", detail });
+}
+function fillTemplate(text, values) {
+  return text.replace(/\{(\w+)\}/g, (whole, key) => values[key] ?? whole);
+}
+function renderIssue(criterion, options) {
+  const { surface, finding, library } = options;
+  const anchors = criterion.level_anchors ?? {};
+  const level = options.level === void 0 || options.level === "" ? "" : String(options.level);
+  const observed = level === "" ? "{observed_level}" : level;
+  const target = options.targetLevel !== void 0 && options.targetLevel !== "" ? String(options.targetLevel) : level === "" ? "{target_level}" : String(Math.min(Number(level) + 1, 4));
+  const values = {
+    surface,
+    observed_level: observed,
+    target_level: target,
+    observed_level_name: anchors[`l${observed}`] ?? "{observed_level_name}",
+    target_level_name: anchors[`l${target}`] ?? "{target_level_name}",
+    target_anchor_text: anchors[`l${target}`] ?? "{target_anchor_text}",
+    impact: String(finding?.impact ?? criterion.default_impact ?? 3)
+  };
+  if (finding !== void 0) {
+    values.likelihood = String(finding.likelihood);
+    values.evidence_bullets_with_file_paths = finding.evidence;
+    values.risk_narrative = finding.detail;
+    if (typeof finding.remediation === "string" && finding.remediation !== "") {
+      values.remediation_step_1 = finding.remediation;
+    }
+  }
+  const issue2 = criterion.issue ?? {};
+  const labels = [.../* @__PURE__ */ new Set([...issue2.labels ?? ["quality"], surface])];
+  const body = fillTemplate(issue2.body_skeleton ?? "", values);
+  return {
+    title: fillTemplate(issue2.title_template ?? `[Quality] ${criterion.id} on {surface}`, values),
+    labels,
+    body: finding === void 0 ? body : `${body}
+${findingFooter(finding, library)}`,
+    ...typeof criterion.remediation === "string" && criterion.remediation !== "" ? { remediation: criterion.remediation } : {}
+  };
+}
+function findingFooter(finding, library) {
+  const lines = [
+    ``,
+    `---`,
+    `<sub>Kritik finding \`${finding.id}\` \u2014 **${severityOf(finding, library)} / ${priorityOf(finding, library)}** (impact ${finding.impact} x likelihood ${finding.likelihood}, cost ${finding.cost})</sub>`,
+    ``,
+    `**Evidence**`,
+    finding.evidence
+  ];
+  if (typeof finding.remediation === "string" && finding.remediation !== "") {
+    lines.push(``, `**Remediation**`, finding.remediation);
+  }
+  return lines.join("\n");
+}
+function signalRunSheet(library, surfaces, filter = {}) {
+  const surfaceIds = surfaces.map((surface) => surface.id).filter((id) => id !== CROSS_SURFACE_ID);
+  const rows = [];
+  for (const criterion of library.criteria ?? []) {
+    if (criterion.superseded_by !== void 0) continue;
+    if (filter.criterion !== void 0 && criterion.id !== filter.criterion) continue;
+    if (filter.domain !== void 0 && criterion.domain !== filter.domain) continue;
+    const signals = criterion.signals ?? [];
+    if (signals.length === 0) continue;
+    const appliesTo = criterion.applies_to;
+    for (const surfaceId of surfaceIds) {
+      if (Array.isArray(appliesTo) && !appliesTo.includes(surfaceId)) continue;
+      if (filter.surface !== void 0 && surfaceId !== filter.surface) continue;
+      signals.forEach((signal, index) => {
+        rows.push({ criterion_id: criterion.id, surface: surfaceId, index, signal });
+      });
+    }
+  }
+  return rows;
+}
+function auditCompletedInput(matrix, meta3) {
+  const scores = {};
+  for (const surface of matrix.surfaces) {
+    const bySurface = {};
+    for (const domain2 of matrix.domains) {
+      const cell = matrix.matrix[domain2]?.[surface];
+      if (cell) bySurface[domain2] = cell.score;
+    }
+    scores[surface] = bySurface;
+  }
+  return {
+    type: "quality.audit.completed",
+    payload: {
+      audit_id: meta3.audit_id,
+      framework_version: meta3.framework_version,
+      ...meta3.commit !== void 0 ? { commit: meta3.commit } : {},
+      scores,
+      counts: matrix.finding_counts
+    }
+  };
+}
+function findingOpenedInput(finding, library) {
+  return {
+    type: "quality.finding.opened",
+    payload: {
+      finding_id: finding.id,
+      criterion_id: finding.criterion_id,
+      surface: finding.surface,
+      severity: severityOf(finding, library),
+      priority: priorityOf(finding, library),
+      title: finding.title,
+      ...finding.node_ids !== void 0 ? { node_ids: finding.node_ids } : {},
+      ...finding.issue_url !== void 0 ? { issue_url: finding.issue_url } : {}
+    }
+  };
+}
+function findingResolvedInput(finding, resolvedBy) {
+  return {
+    type: "quality.finding.resolved",
+    payload: {
+      finding_id: finding.id,
+      ...resolvedBy !== void 0 ? { resolved_by: resolvedBy } : {},
+      ...finding.node_ids !== void 0 ? { node_ids: finding.node_ids } : {}
+    }
+  };
+}
+function signalTrippedInput(trip) {
+  return {
+    type: "quality.signal.tripped",
+    payload: {
+      criterion_id: trip.criterion_id,
+      surface: trip.surface,
+      signal: trip.signal,
+      ...trip.detail !== void 0 ? { detail: trip.detail } : {}
+    }
+  };
+}
+
 // src/commands/init.ts
 var DEFAULT_BUNDLE_PATH = "docs/arkaik/bundle.json";
 var DEFAULT_JOURNAL_PATH = "docs/arkaik/journal.jsonl";
@@ -16672,7 +17503,7 @@ function runInit(args) {
 }
 
 // src/commands/validate.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
 
 // src/lib/bundle-io.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
@@ -16703,9 +17534,80 @@ function nodesByIdOf(bundle) {
 }
 
 // src/lib/bundle-validate.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import { basename as basename2 } from "node:path";
+
+// src/lib/journal-io.ts
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join2 } from "node:path";
 var JOURNAL_SIDECAR = "journal.jsonl";
+function journalPathFor(bundlePath) {
+  return join2(dirname2(bundlePath), JOURNAL_SIDECAR);
+}
+function archivePathFor(journalPath, version2) {
+  return join2(dirname2(journalPath), "journal", `archive-${version2}.jsonl`);
+}
+function archivePathsFor(journalPath) {
+  const dir = join2(dirname2(journalPath), "journal");
+  if (!existsSync3(dir)) return [];
+  return readdirSync(dir).filter((name) => name.startsWith("archive-") && name.endsWith(".jsonl")).sort().map((name) => join2(dir, name));
+}
+function readJournalEvents(journalPath) {
+  if (!existsSync3(journalPath)) return [];
+  return parseJournalLines(readFileSync3(journalPath, "utf8")).events;
+}
+function readFullJournalEvents(journalPath) {
+  const events = readJournalEvents(journalPath);
+  for (const archivePath of archivePathsFor(journalPath)) {
+    events.push(...readJournalEvents(archivePath));
+  }
+  return events;
+}
+function loadJournalEvents(bundle, bundlePath) {
+  if (Array.isArray(bundle.journal)) return bundle.journal;
+  return readJournalEvents(journalPathFor(bundlePath));
+}
+function toLine(event) {
+  return JSON.stringify(event) + "\n";
+}
+function appendJournalEvent(journalPath, event) {
+  const line2 = toLine(event);
+  if (!existsSync3(journalPath)) {
+    mkdirSync2(dirname2(journalPath), { recursive: true });
+    writeFileSync2(journalPath, line2);
+    return;
+  }
+  const existing = readFileSync3(journalPath, "utf8");
+  const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  appendFileSync(journalPath, prefix + line2);
+}
+function ensureJournalBaseline(journalPath, bundle, actor) {
+  const snapshotNodeIds = (Array.isArray(bundle.nodes) ? bundle.nodes : []).map((node) => node?.id).filter((id) => typeof id === "string");
+  const missing = missingProvenanceNodeIds(snapshotNodeIds, readFullJournalEvents(journalPath));
+  if (missing.length === 0) return void 0;
+  const event = makeEvent("journal.baseline", { node_ids: missing }, { actor });
+  appendJournalEvent(journalPath, event);
+  return event;
+}
+function compactSlice(journalPath, slice, version2) {
+  if (slice.length === 0) return;
+  const sliceIds = new Set(slice.map((ev) => ev.id));
+  const all = readJournalEvents(journalPath);
+  const surviving = all.filter((ev) => !sliceIds.has(ev.id));
+  const archivePath = archivePathFor(journalPath, version2);
+  mkdirSync2(dirname2(archivePath), { recursive: true });
+  const archiveLines = slice.map(toLine).join("");
+  if (existsSync3(archivePath)) {
+    const existing = readFileSync3(archivePath, "utf8");
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    appendFileSync(archivePath, prefix + archiveLines);
+  } else {
+    writeFileSync2(archivePath, archiveLines);
+  }
+  writeFileSync2(journalPath, surviving.map(toLine).join(""));
+}
+
+// src/lib/bundle-validate.ts
 function validateBundleAt(filePath) {
   const bundle = readBundle(filePath);
   const loose = bundle;
@@ -16714,21 +17616,49 @@ function validateBundleAt(filePath) {
   }
   let sidecarFindings = [];
   let sidecarLoaded = false;
+  const archiveFindings = [];
+  const archivesLoaded = [];
   if (loose.journal === void 0) {
-    const sidecarPath = join2(dirname2(filePath), JOURNAL_SIDECAR);
-    if (existsSync3(sidecarPath)) {
-      const { events, findings } = parseJournalLines(readFileSync3(sidecarPath, "utf8"));
+    const sidecarPath = journalPathFor(filePath);
+    const folded = [];
+    if (existsSync4(sidecarPath)) {
+      const { events, findings } = parseJournalLines(readFileSync4(sidecarPath, "utf8"));
       sidecarFindings = findings;
       sidecarLoaded = true;
-      loose.journal = events;
+      folded.push(...events);
+    }
+    for (const archivePath of archivePathsFor(sidecarPath)) {
+      const { events, findings } = parseJournalLines(readFileSync4(archivePath, "utf8"));
+      const file2 = basename2(archivePath);
+      for (const finding of findings) archiveFindings.push({ ...finding, file: file2 });
+      archivesLoaded.push(file2);
+      folded.push(...events);
     }
+    if (sidecarLoaded || archivesLoaded.length > 0) loose.journal = folded;
   }
   const nodes = Array.isArray(loose.nodes) ? loose.nodes : [];
   const edges = Array.isArray(loose.edges) ? loose.edges : [];
   const journal = Array.isArray(loose.journal) ? loose.journal : [];
   const result = validateBundle(bundle);
-  const valid = sidecarFindings.length === 0 && result.errors.length === 0;
-  return { bundle, nodes, edges, journal, sidecarLoaded, sidecarFindings, result, valid };
+  const valid = sidecarFindings.length === 0 && archiveFindings.length === 0 && result.errors.length === 0;
+  return {
+    bundle,
+    nodes,
+    edges,
+    journal,
+    sidecarLoaded,
+    sidecarFindings,
+    archivesLoaded,
+    archiveFindings,
+    result,
+    valid
+  };
+}
+function journalLineErrorLines(v) {
+  return [
+    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
+    ...v.archiveFindings.map((f) => `ERROR [${f.rule}] ${f.file} line ${f.line}: ${f.message}`)
+  ];
 }
 
 // src/commands/validate.ts
@@ -16765,12 +17695,12 @@ function fixFormat(filePath) {
   } catch (e) {
     return fail2(`FATAL: ${e.message}`);
   }
-  const before = readFileSync4(filePath, "utf8");
+  const before = readFileSync5(filePath, "utf8");
   const after = serializeBundle(bundle);
   if (after === before) {
     console.log(`Already canonical: ${filePath}`);
   } else {
-    writeFileSync2(filePath, after);
+    writeFileSync3(filePath, after);
     console.log(`Reformatted: ${filePath}`);
   }
   process.exit(0);
@@ -16789,8 +17719,12 @@ function validate(filePath) {
     `  Nodes: ${v.nodes.length} (${countBySpecies(v.nodes, "view")} views, ${countBySpecies(v.nodes, "flow")} flows, ${countBySpecies(v.nodes, "data-model")} data-models, ${countBySpecies(v.nodes, "api-endpoint")} api-endpoints)`
   );
   console.log(`  Edges: ${v.edges.length}`);
-  if (v.sidecarLoaded) {
-    console.log(`  Journal: ${v.journal.length} event(s) from ${JOURNAL_SIDECAR} sidecar`);
+  if (v.sidecarLoaded || v.archivesLoaded.length > 0) {
+    const from = [
+      ...v.sidecarLoaded ? [`${JOURNAL_SIDECAR} sidecar`] : [],
+      ...v.archivesLoaded.length > 0 ? [`${v.archivesLoaded.length} archive(s)`] : []
+    ].join(" + ");
+    console.log(`  Journal: ${v.journal.length} event(s) from ${from}`);
   } else if (v.journal.length > 0) {
     console.log(`  Journal: ${v.journal.length} embedded event(s)`);
   }
@@ -16800,10 +17734,7 @@ function validate(filePath) {
     v.result.warnings.forEach((w) => console.log(`    ${formatFinding(w)}`));
     console.log("");
   }
-  const errorLines = [
-    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
-    ...v.result.errors.map(formatFinding)
-  ];
+  const errorLines = [...journalLineErrorLines(v), ...v.result.errors.map(formatFinding)];
   if (errorLines.length === 0) {
     console.log("  Result: VALID\n");
     process.exit(0);
@@ -16843,64 +17774,14 @@ ${USAGE2}`);
   }
 }
 
-// src/lib/journal-io.ts
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join3 } from "node:path";
-var JOURNAL_SIDECAR2 = "journal.jsonl";
-function journalPathFor(bundlePath) {
-  return join3(dirname3(bundlePath), JOURNAL_SIDECAR2);
-}
-function archivePathFor(journalPath, version2) {
-  return join3(dirname3(journalPath), "journal", `archive-${version2}.jsonl`);
-}
-function readJournalEvents(journalPath) {
-  if (!existsSync4(journalPath)) return [];
-  return parseJournalLines(readFileSync5(journalPath, "utf8")).events;
-}
-function loadJournalEvents(bundle, bundlePath) {
-  if (Array.isArray(bundle.journal)) return bundle.journal;
-  return readJournalEvents(journalPathFor(bundlePath));
+// src/lib/render-event.ts
+function str(value) {
+  return typeof value === "string" ? value : void 0;
 }
-function toLine(event) {
-  return JSON.stringify(event) + "\n";
-}
-function appendJournalEvent(journalPath, event) {
-  const line2 = toLine(event);
-  if (!existsSync4(journalPath)) {
-    mkdirSync2(dirname3(journalPath), { recursive: true });
-    writeFileSync3(journalPath, line2);
-    return;
-  }
-  const existing = readFileSync5(journalPath, "utf8");
-  const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  appendFileSync(journalPath, prefix + line2);
-}
-function compactSlice(journalPath, slice, version2) {
-  if (slice.length === 0) return;
-  const sliceIds = new Set(slice.map((ev) => ev.id));
-  const all = readJournalEvents(journalPath);
-  const surviving = all.filter((ev) => !sliceIds.has(ev.id));
-  const archivePath = archivePathFor(journalPath, version2);
-  mkdirSync2(dirname3(archivePath), { recursive: true });
-  const archiveLines = slice.map(toLine).join("");
-  if (existsSync4(archivePath)) {
-    const existing = readFileSync5(archivePath, "utf8");
-    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync(archivePath, prefix + archiveLines);
-  } else {
-    writeFileSync3(archivePath, archiveLines);
-  }
-  writeFileSync3(journalPath, surviving.map(toLine).join(""));
-}
-
-// src/lib/render-event.ts
-function str(value) {
-  return typeof value === "string" ? value : void 0;
-}
-function title(id, nodesById) {
-  const nodeId = str(id);
-  if (nodeId === void 0) return "?";
-  return nodesById?.get(nodeId)?.title ?? nodeId;
+function title(id, nodesById) {
+  const nodeId = str(id);
+  if (nodeId === void 0) return "?";
+  return nodesById?.get(nodeId)?.title ?? nodeId;
 }
 function renderEventLine(event, nodesById) {
   switch (event.type) {
@@ -16957,6 +17838,10 @@ function renderEventLine(event, nodesById) {
       const to = str(event.to) ?? "?";
       return `${title(event.node_id, nodesById)}: reference ${from ? `${from} -> ${to}` : to}`;
     }
+    case "journal.baseline": {
+      const count = Array.isArray(event.node_ids) ? event.node_ids.length : 0;
+      return `Journal baseline: ${count} pre-existing node(s) recorded`;
+    }
     default:
       return event.type;
   }
@@ -17160,7 +18045,12 @@ ${USAGE4}`);
   } catch (e) {
     fail4(`FATAL: could not build release event \u2014 ${e.message}`);
   }
+  const baseline = ensureJournalBaseline(journalPath, bundle, ACTOR);
   appendJournalEvent(journalPath, event);
+  if (baseline !== void 0) {
+    console.log(`
+  ${renderEventLine(baseline)} -> ${journalPath}`);
+  }
   console.log(`
   Tagged release ${version2}${platform ? ` [${platform}]` : ""} -> ${journalPath}`);
   const all = [...existing, event];
@@ -17317,7 +18207,12 @@ ${USAGE5}`);
     fail5(`FATAL: could not build deliverable event \u2014 ${e.message}`);
   }
   const journalPath = journalPathFor(filePath);
+  const baseline = ensureJournalBaseline(journalPath, bundle, ACTOR2);
   appendJournalEvent(journalPath, event);
+  if (baseline !== void 0) {
+    console.log(`
+  ${renderEventLine(baseline)} -> ${journalPath}`);
+  }
   console.log(
     `
   Recorded deliverable ${deliverableId} \u2014 ${title2} -> ${journalPath}
@@ -17504,6 +18399,13 @@ async function runSync(options = {}) {
   const errors = [];
   const nodeTitles = /* @__PURE__ */ new Map();
   let dirty = false;
+  let baseline;
+  let baselineChecked = false;
+  const adoptJournal = () => {
+    if (baselineChecked) return;
+    baselineChecked = true;
+    baseline = ensureJournalBaseline(journalPath, bundle, actor);
+  };
   for (const node of nodes) {
     const nodeId = typeof node.id === "string" ? node.id : void 0;
     if (nodeId !== void 0 && typeof node.title === "string") nodeTitles.set(nodeId, node.title);
@@ -17556,6 +18458,7 @@ async function runSync(options = {}) {
         },
         { actor, ts: syncedAt }
       );
+      adoptJournal();
       appendJournalEvent(journalPath, event);
     }
   }
@@ -17570,6 +18473,7 @@ async function runSync(options = {}) {
       const patch = promotionPatch(node, promotion);
       Object.assign(node, patch);
       dirty = true;
+      adoptJournal();
       appendJournalEvent(
         journalPath,
         makeEvent(
@@ -17588,7 +18492,7 @@ async function runSync(options = {}) {
   if (dirty && !dryRun) {
     writeFileSync4(filePath, serializeBundle(bundle));
   }
-  return { ok: true, bundlePath: filePath, journalPath, dryRun, changed, unchanged, skipped, errors, nodeTitles, promoted };
+  return { ok: true, bundlePath: filePath, journalPath, dryRun, changed, unchanged, skipped, errors, nodeTitles, promoted, baseline };
 }
 function changeLine(change, nodeTitles) {
   const event = {
@@ -17626,6 +18530,9 @@ function report(result) {
     for (const s of stubSkips) byProvider.set(s.provider ?? "?", (byProvider.get(s.provider ?? "?") ?? 0) + 1);
     for (const [provider, count] of byProvider) console.log(`    - ${provider}: ${count} ref(s)`);
   }
+  if (result.baseline !== void 0) {
+    console.log(`  ${renderEventLine(result.baseline)}`);
+  }
   if (result.errors.length > 0) {
     console.log(`  Errors: ${result.errors.length}`);
     result.errors.forEach((e) => console.log(`    - ${e.nodeId}/${e.refId} (${e.refType}): ${e.message}`));
@@ -17670,7 +18577,7 @@ ${USAGE6}`);
 
 // src/commands/pack.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, extname, resolve as resolve3 } from "node:path";
+import { dirname as dirname3, extname, resolve as resolve3 } from "node:path";
 var DEFAULT_BUNDLE_PATH5 = "docs/arkaik/bundle.json";
 var USAGE7 = `arkaik pack [--no-journal] [--inline-assets] [--out <path>] [path]
 
@@ -17756,7 +18663,7 @@ function runPack(options = {}) {
   const inlinedAssets = [];
   const assetWarnings = [];
   if (inlineAssets) {
-    const bundleDir = dirname4(filePath);
+    const bundleDir = dirname3(filePath);
     const nodes = Array.isArray(bundle.nodes) ? bundle.nodes : [];
     for (const node of nodes) {
       const nodeId = typeof node.id === "string" ? node.id : "?";
@@ -17783,7 +18690,7 @@ function runPack(options = {}) {
   let outPath;
   if (options.out !== void 0) {
     outPath = resolve3(cwd, options.out);
-    mkdirSync3(dirname4(outPath), { recursive: true });
+    mkdirSync3(dirname3(outPath), { recursive: true });
     writeFileSync5(outPath, output);
   }
   return { ok: true, bundlePath: filePath, outPath, journalIncluded, journalEventCount, inlinedAssets, assetWarnings, output };
@@ -17844,7 +18751,7 @@ ${USAGE7}`);
 import { spawn } from "node:child_process";
 import { mkdtempSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join4, resolve as resolve4 } from "node:path";
+import { join as join3, resolve as resolve4 } from "node:path";
 var DEFAULT_BUNDLE_PATH6 = "docs/arkaik/bundle.json";
 var OPEN_URL = "https://arkaik.app/projects";
 var USAGE8 = `arkaik open [--out <path>] [--no-open] [path]
@@ -17887,10 +18794,7 @@ async function runOpen(options = {}) {
     return fatalResult3(filePath, e.message);
   }
   const warningLines = v.result.warnings.map(formatFinding);
-  const errorLines = [
-    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
-    ...v.result.errors.map(formatFinding)
-  ];
+  const errorLines = [...journalLineErrorLines(v), ...v.result.errors.map(formatFinding)];
   if (!v.valid) {
     return { ok: true, bundlePath: filePath, valid: false, errorLines, warningLines, opened: false };
   }
@@ -17900,8 +18804,8 @@ async function runOpen(options = {}) {
   }
   let outPath = packed.outPath;
   if (outPath === void 0) {
-    const dir = mkdtempSync(join4(tmpdir(), "arkaik-open-"));
-    outPath = join4(dir, "bundle.json");
+    const dir = mkdtempSync(join3(tmpdir(), "arkaik-open-"));
+    outPath = join3(dir, "bundle.json");
     writeFileSync6(outPath, packed.output);
   }
   let opened = false;
@@ -18025,10 +18929,7 @@ async function runPush(options = {}) {
     return fatalResult4(filePath, e.message);
   }
   const warningLines = v.result.warnings.map(formatFinding);
-  const errorLines = [
-    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
-    ...v.result.errors.map(formatFinding)
-  ];
+  const errorLines = [...journalLineErrorLines(v), ...v.result.errors.map(formatFinding)];
   if (!v.valid) {
     return { ok: true, bundlePath: filePath, valid: false, errorLines, warningLines, requestSent: false };
   }
@@ -18236,7 +19137,7 @@ ${USAGE9}`);
 
 // src/commands/link.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname5, join as join5, resolve as resolve6 } from "node:path";
+import { dirname as dirname4, join as join4, resolve as resolve6 } from "node:path";
 var LINK_FILE = "docs/arkaik/arkaik.json";
 var DEFAULT_BASE_URL = "https://arkaik.app";
 var USAGE10 = `arkaik link \u2014 point this repo at a hosted Arkaik project
@@ -18308,8 +19209,8 @@ async function runLink(argv, options = {}) {
   }
   const { bundle } = await res.json();
   const target = resolve6(cwd, argv.find((a) => !a.startsWith("--") && a !== projectId && a !== baseUrl) ?? ".");
-  const linkPath = join5(target, LINK_FILE);
-  mkdirSync4(dirname5(linkPath), { recursive: true });
+  const linkPath = join4(target, LINK_FILE);
+  mkdirSync4(dirname4(linkPath), { recursive: true });
   let existing = {};
   try {
     existing = JSON.parse(readFileSync7(linkPath, "utf8"));
@@ -18343,7 +19244,7 @@ function runLinkCli(argv) {
 
 // src/commands/restore.ts
 import { existsSync as existsSync6, linkSync, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join6, resolve as resolve7 } from "node:path";
+import { join as join5, resolve as resolve7 } from "node:path";
 var LINK_FILE2 = "docs/arkaik/arkaik.json";
 var DEFAULT_BUNDLE_PATH8 = "docs/arkaik/bundle.json";
 var DEFAULT_API_BASE2 = "https://arkaik.app";
@@ -18374,6 +19275,13 @@ Options:
                         means a missing/gitignored journal.jsonl or a bundle
                         from the wrong directory, not an intended history
                         rewrite.
+  --allow-deletions     Proceed even though the local bundle drops nodes or
+                        edges the hosted project currently has. Without this
+                        flag, that refuses outright and names the ids \u2014 it
+                        usually means the hosted project moved ahead of your
+                        local copy (edited in the app), not an intended
+                        deletion. Undoing a restore from a backup is the
+                        common case where it IS intended.
   --api <base-url>      Override the remote from docs/arkaik/arkaik.json
                         (also overridable with $ARKAIK_URL).
   -h, --help            Show this help.
@@ -18484,13 +19392,48 @@ function writeBackupFile(filePath, content) {
     unlinkSync(tmpPath);
   }
 }
+function removedIds(before, after) {
+  const kept = /* @__PURE__ */ new Set();
+  for (const item of after) {
+    const id = item?.id;
+    if (typeof id === "string") kept.add(id);
+  }
+  const removed = [];
+  for (const item of before) {
+    const id = item?.id;
+    if (typeof id === "string" && !kept.has(id)) removed.push(id);
+  }
+  return removed;
+}
+function listIds(ids, limit = 10) {
+  if (ids.length <= limit) return ids.join(", ");
+  return `${ids.slice(0, limit).join(", ")}, and ${ids.length - limit} more`;
+}
+function describeDeletions(removedNodes, removedEdges, bundlePath) {
+  const parts = [];
+  if (removedNodes.length > 0) parts.push(`${removedNodes.length} node${removedNodes.length === 1 ? "" : "s"}`);
+  if (removedEdges.length > 0) parts.push(`${removedEdges.length} edge${removedEdges.length === 1 ? "" : "s"}`);
+  const lines = [
+    `This restore would DELETE ${parts.join(" and ")} the hosted project currently has and ${bundlePath} does not. Nothing was sent.`
+  ];
+  if (removedNodes.length > 0) lines.push(`  nodes: ${listIds(removedNodes)}`);
+  if (removedEdges.length > 0) lines.push(`  edges: ${listIds(removedEdges)}`);
+  lines.push(
+    `Usually this means the hosted project moved ahead of your local copy (someone edited it in the app) and the local bundle is the stale side \u2014 not that you meant to delete anything. Adopt the hosted state locally first: \`GET /api/graph/projects/<id>/export\` is what answers "what am I about to overwrite".`
+  );
+  lines.push(
+    `If the deletions really are intended \u2014 undoing an earlier restore from a backup legitimately removes what that restore added \u2014 re-run with --allow-deletions.`
+  );
+  return lines.join("\n");
+}
 async function runRestore(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const env = options.env ?? process.env;
   const dryRun = options.dryRun ?? false;
   const allowHistoryLoss = options.allowHistoryLoss ?? false;
+  const allowDeletions = options.allowDeletions ?? false;
   const httpClient = options.httpClient ?? DEFAULT_HTTP_CLIENT;
-  const linkPath = join6(cwd, LINK_FILE2);
+  const linkPath = join5(cwd, LINK_FILE2);
   if (!existsSync6(linkPath)) {
     return fatalResult5(dryRun, `No ${LINK_FILE2}. Run \`arkaik link\` first \u2014 restore only targets hosted projects.`);
   }
@@ -18578,9 +19521,14 @@ async function runRestore(options = {}) {
       `This restore would replace ${hostedEventCount} hosted journal events with ${journalEvents.length}. Nothing was sent. If that is intended, re-run with --allow-history-loss; otherwise check that ${journalPathFor(bundlePath)} exists and is current.`
     );
   }
-  const backupDir = join6(cwd, "docs", "arkaik", ".backups");
+  const removedNodes = removedIds(exportedBundle.nodes, Array.isArray(local.nodes) ? local.nodes : []);
+  const removedEdges = removedIds(exportedBundle.edges, Array.isArray(local.edges) ? local.edges : []);
+  if ((removedNodes.length > 0 || removedEdges.length > 0) && !allowDeletions) {
+    return fatalResult5(dryRun, describeDeletions(removedNodes, removedEdges, bundlePath));
+  }
+  const backupDir = join5(cwd, "docs", "arkaik", ".backups");
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupPath = join6(backupDir, `${stamp}-bundle.json`);
+  const backupPath = join5(backupDir, `${stamp}-bundle.json`);
   const backupContent = `${JSON.stringify(exported, null, 2)}
 `;
   try {
@@ -18625,6 +19573,17 @@ function printDelta(delta) {
   console.log(
     `  events ${n("eventsBefore")} -> ${n("eventsAfter")}  (+${n("eventsAdded")} -${n("eventsDropped")} ~${n("eventsChanged")}${delta.eventsMalformed ? `, ${delta.eventsMalformed} malformed` : ""})`
   );
+  const count = (k) => typeof delta[k] === "number" ? delta[k] : 0;
+  const nodesRemoved = count("nodesRemoved");
+  const edgesRemoved = count("edgesRemoved");
+  if (nodesRemoved > 0 || edgesRemoved > 0) {
+    const parts = [];
+    if (nodesRemoved > 0) parts.push(`${nodesRemoved} node${nodesRemoved === 1 ? "" : "s"}`);
+    if (edgesRemoved > 0) parts.push(`${edgesRemoved} edge${edgesRemoved === 1 ? "" : "s"}`);
+    console.log(
+      `  WARNING: this DELETES ${parts.join(" and ")} from the hosted project. Bootstrap never deletes \u2014 check the hosted project has not moved ahead of your local bundle.`
+    );
+  }
 }
 function reportRestore(result) {
   if (!result.ok) fail10(`FATAL: ${result.fatal}`);
@@ -18659,6 +19618,7 @@ function reportRestore(result) {
 function runRestoreCli(argv) {
   let dryRun = false;
   let allowHistoryLoss = false;
+  let allowDeletions = false;
   let apiBase;
   const positionals = [];
   for (let i = 0; i < argv.length; i++) {
@@ -18671,6 +19631,8 @@ function runRestoreCli(argv) {
       dryRun = true;
     } else if (arg === "--allow-history-loss") {
       allowHistoryLoss = true;
+    } else if (arg === "--allow-deletions") {
+      allowDeletions = true;
     } else if (arg === "--api") {
       const value = argv[++i];
       if (value === void 0) fail10(`Missing value for --api
@@ -18688,7 +19650,7 @@ ${USAGE11}`);
   if (positionals.length > 1) fail10(`Unexpected argument(s): ${positionals.slice(1).join(" ")}
 
 ${USAGE11}`);
-  runRestore({ path: positionals[0], dryRun, allowHistoryLoss, apiBase }).then((result) => reportRestore(result)).catch((e) => fail10(`FATAL: ${e.message}`));
+  runRestore({ path: positionals[0], dryRun, allowHistoryLoss, allowDeletions, apiBase }).then((result) => reportRestore(result)).catch((e) => fail10(`FATAL: ${e.message}`));
 }
 
 // src/commands/bootstrap.ts
@@ -18698,7 +19660,7 @@ import path5 from "node:path";
 
 // src/lib/bootstrap/corpus.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import path2 from "node:path";
 
 // src/lib/bootstrap/paths.ts
@@ -18823,7 +19785,7 @@ function fetchPrsViaGit(cwd) {
 function walk(root, cwd, out) {
   let entries;
   try {
-    entries = readdirSync(root, { withFileTypes: true });
+    entries = readdirSync2(root, { withFileTypes: true });
   } catch {
     return;
   }
@@ -19320,7 +20282,7 @@ function mergeJournal(base, fresh) {
 }
 
 // src/lib/bootstrap/merge.ts
-function asArray(value) {
+function asArray2(value) {
   return Array.isArray(value) ? value : [];
 }
 function mergeFragments(input) {
@@ -19328,14 +20290,14 @@ function mergeFragments(input) {
   const projectId = String(input.base.project?.id ?? "");
   const nodes = /* @__PURE__ */ new Map();
   const nodeOrigin = /* @__PURE__ */ new Map();
-  for (const node of asArray(input.base.nodes)) {
+  for (const node of asArray2(input.base.nodes)) {
     const id = String(node.id);
     nodes.set(id, { ...node });
     nodeOrigin.set(id, "(already in the bundle)");
   }
   const edges = /* @__PURE__ */ new Map();
   const edgeOrigin = /* @__PURE__ */ new Map();
-  for (const edge of asArray(input.base.edges)) {
+  for (const edge of asArray2(input.base.edges)) {
     const id = String(edge.id ?? edgeId(String(edge.source_id), String(edge.target_id)));
     edges.set(id, { ...edge });
     edgeOrigin.set(id, "(already in the bundle)");
@@ -20023,8 +20985,1119 @@ ${USAGE12}`);
   }
 }
 
+// ../schema/src/cli/kritik-audit.ts
+import { existsSync as existsSync14, readdirSync as readdirSync3, statSync } from "node:fs";
+import { join as join7 } from "node:path";
+
+// ../schema/src/cli/kritik-paths.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname5, join as join6, resolve as resolve8 } from "node:path";
+var QUALITY_DIR = "docs/quality";
+var PROFILE_FILE2 = "profile.json";
+var OVERLAY_FILE = "criteria.custom.json";
+var AUDITS_DIR = "audits";
+var PACK_FILE = "library.json";
+function readJson(path6) {
+  return JSON.parse(readFileSync14(path6, "utf8"));
+}
+function writeJson(path6, value) {
+  mkdirSync8(dirname5(path6), { recursive: true });
+  writeFileSync13(path6, JSON.stringify(value, null, 2) + "\n");
+}
+var profilePath = (root) => join6(root, QUALITY_DIR, PROFILE_FILE2);
+var overlayPath = (root) => join6(root, QUALITY_DIR, OVERLAY_FILE);
+var auditDir = (root, auditId) => join6(root, QUALITY_DIR, AUDITS_DIR, auditId);
+function loadProfile(root) {
+  const path6 = profilePath(root);
+  return existsSync13(path6) ? readJson(path6) : null;
+}
+function loadOverlay(root) {
+  const path6 = overlayPath(root);
+  return existsSync13(path6) ? readJson(path6) : null;
+}
+
+// ../schema/src/cli/kritik-audit.ts
+var SCORES_FILE = "scores.json";
+var FINDINGS_FILE = "findings.json";
+var MATRIX_FILE = "matrix.json";
+var scoresPath = (root, auditId) => join7(auditDir(root, auditId), SCORES_FILE);
+var findingsPath = (root, auditId) => join7(auditDir(root, auditId), FINDINGS_FILE);
+var matrixPath = (root, auditId) => join7(auditDir(root, auditId), MATRIX_FILE);
+function listAuditIds(root) {
+  const dir = join7(root, QUALITY_DIR, AUDITS_DIR);
+  if (!existsSync14(dir)) return [];
+  return readdirSync3(dir).filter((name) => statSync(join7(dir, name)).isDirectory()).sort();
+}
+function newestAuditId(root) {
+  const dir = join7(root, QUALITY_DIR, AUDITS_DIR);
+  if (!existsSync14(dir)) throw new Error(`no audits directory at ${dir}`);
+  const ids = listAuditIds(root);
+  if (ids.length === 0) throw new Error(`no audits found under ${dir}`);
+  return ids[ids.length - 1];
+}
+function loadScores(root, auditId) {
+  const path6 = scoresPath(root, auditId);
+  if (!existsSync14(path6)) throw new Error(`no ${SCORES_FILE} at ${path6}`);
+  const file2 = readJson(path6);
+  return { ...file2, assessments: Array.isArray(file2.assessments) ? file2.assessments : [] };
+}
+function loadScoresOrEmpty(root, auditId) {
+  return existsSync14(scoresPath(root, auditId)) ? loadScores(root, auditId) : { audit_id: auditId, assessments: [] };
+}
+function loadFindings(root, auditId) {
+  const path6 = findingsPath(root, auditId);
+  if (!existsSync14(path6)) return { audit_id: auditId, findings: [] };
+  const file2 = readJson(path6);
+  return { ...file2, findings: Array.isArray(file2.findings) ? file2.findings : [] };
+}
+function saveScores(root, auditId, file2) {
+  writeJson(scoresPath(root, auditId), file2);
+}
+function saveFindings(root, auditId, file2) {
+  writeJson(findingsPath(root, auditId), file2);
+}
+function requireProfile(root) {
+  const profile = loadProfile(root);
+  if (!profile) {
+    throw new Error(
+      `no profile at ${join7(root, QUALITY_DIR, "profile.json")} \u2014 pick this project's surfaces first (\`arkaik kritik profile\`, or the plugin's init-profile.js).`
+    );
+  }
+  return profile;
+}
+function loadQualitySection(root, auditId, library, scores = loadScores(root, auditId)) {
+  const findings = loadFindings(root, auditId);
+  return {
+    framework_version: scores.framework_version ?? library.version,
+    profile: requireProfile(root),
+    assessments: scores.assessments,
+    findings: findings.findings
+  };
+}
+function computeAuditMatrix(root, auditId, library) {
+  const scores = loadScores(root, auditId);
+  const section = loadQualitySection(root, auditId, library, scores);
+  const matrix = deriveQualityMatrix({ quality: section }, library);
+  const file2 = {
+    audit_id: auditId,
+    commit: scores.commit,
+    framework_version: section.framework_version,
+    matrix: matrix.matrix,
+    overall: matrix.overall,
+    finding_counts: matrix.finding_counts
+  };
+  writeJson(matrixPath(root, auditId), file2);
+  return { section, matrix, file: file2 };
+}
+function renderMatrixMarkdown(matrix, domainNames) {
+  const cell = (value) => value ? `${value.score} (${value.grade}${value.capped ? "*" : ""})` : "\u2014";
+  const lines = [];
+  lines.push(`| Domain | ${matrix.surfaces.join(" | ")} |`);
+  lines.push(`| --- | ${matrix.surfaces.map(() => "---").join(" | ")} |`);
+  for (const domain2 of matrix.domains) {
+    const label = domainNames.get(domain2) ?? domain2;
+    lines.push(
+      `| **${domain2}** ${label} | ${matrix.surfaces.map((s) => cell(matrix.matrix[domain2]?.[s])).join(" | ")} |`
+    );
+  }
+  lines.push(
+    `| **Overall (weighted)** | ${matrix.surfaces.map((s) => {
+      const score = matrix.overall[s];
+      return score === null || score === void 0 ? "\u2014" : `**${score} (${gradeOf(score)})**`;
+    }).join(" | ")} |`
+  );
+  return lines.join("\n");
+}
+function locateFinding(root, id) {
+  for (const auditId of [...listAuditIds(root)].reverse()) {
+    const file2 = loadFindings(root, auditId);
+    const finding = file2.findings.find((candidate) => candidate.id === id);
+    if (finding) return { auditId, file: file2, finding };
+  }
+  return void 0;
+}
+
+// ../schema/src/cli/kritik-overlay.ts
+var ANCHOR_KEYS = ["l0", "l1", "l2", "l3", "l4"];
+var CRITERION_TEMPLATE = {
+  id: "X-01",
+  domain: "ARC",
+  subcategory: "conventions",
+  name: "Short criterion name",
+  question: "The criterion as one question an auditor can actually answer?",
+  definition: "What good looks like on this surface, concretely.",
+  rationale: "Why this matters for this product in particular.",
+  applies_to: ["web"],
+  level_anchors: {
+    l0: "Not addressed at all.",
+    l1: "Addressed accidentally or in one spot; no visible intent.",
+    l2: "Deliberately addressed; visible intent; known gaps.",
+    l3: "Systematic across the surface; tested or reviewed.",
+    l4: "Enforced by automation or a CI gate; drift is detected, not hoped against."
+  },
+  default_impact: 3,
+  weight: 1,
+  references: [],
+  checklist: ["The grep, file, or flow an auditor should actually run."],
+  signals: ["A check that can run between audits and fail mechanically."],
+  remediation: "The typical fix path.",
+  issue: {
+    title_template: "[Quality] X-01 <name> at level {observed_level} on {surface} (target {target_level})",
+    labels: ["quality"],
+    body_skeleton: "## Quality finding: X-01 <name>\n\n**Surface:** {surface}\n**Observed level:** {observed_level}\n**Target level:** {target_level}\n\n### Evidence\n{evidence_bullets_with_file_paths}\n\n### Remediation\n- [ ] {remediation_step_1}\n\n### Acceptance criteria\n- [ ] Target anchor holds: {target_anchor_text}"
+  }
+};
+function buildCriterion(draft) {
+  for (const [label, value] of [
+    ["id", draft.id],
+    ["domain", draft.domain],
+    ["name", draft.name],
+    ["question", draft.question]
+  ]) {
+    if (typeof value !== "string" || value.trim() === "") throw new Error(`--${label} is required`);
+  }
+  if (draft.appliesTo.length === 0) throw new Error(`--applies-to is required \u2014 a criterion applies to at least one surface`);
+  const missing = ANCHOR_KEYS.filter((key) => !draft.anchors[key]);
+  if (missing.length > 0) {
+    throw new Error(
+      `missing anchors ${missing.join(", ")}.
+All five are required: a criterion without observable descriptions of each level cannot be scored consistently,
+and an inconsistently scored criterion makes its whole row incomparable.`
+    );
+  }
+  const weight = draft.weight ?? 1;
+  if (!Number.isInteger(weight) || weight < 1 || weight > 3) throw new Error(`--weight must be 1, 2 or 3`);
+  const impact = draft.impact ?? 3;
+  if (!Number.isInteger(impact) || impact < 1 || impact > 5) throw new Error(`--impact must be 1-5`);
+  const { id, name } = draft;
+  return {
+    id,
+    domain: draft.domain,
+    ...draft.subcategory ? { subcategory: draft.subcategory } : {},
+    name,
+    question: draft.question,
+    ...draft.definition ? { definition: draft.definition } : {},
+    ...draft.rationale ? { rationale: draft.rationale } : {},
+    applies_to: draft.appliesTo,
+    level_anchors: draft.anchors,
+    default_impact: impact,
+    weight,
+    references: [],
+    checklist: draft.checklist ?? [],
+    signals: draft.signals ?? [],
+    ...draft.remediation ? { remediation: draft.remediation } : {},
+    issue: {
+      title_template: `[Quality] ${id} ${name} at level {observed_level} on {surface} (target {target_level})`,
+      labels: draft.labels && draft.labels.length > 0 ? draft.labels : ["quality"],
+      body_skeleton: `## Quality finding: ${id} ${name}
+
+**Surface:** {surface}
+**Observed level:** {observed_level}
+**Target level:** {target_level}
+**Severity seed:** impact {impact} x likelihood {likelihood}
+
+### Evidence
+{evidence_bullets_with_file_paths}
+
+### Risk
+{risk_narrative}
+
+### Remediation
+- [ ] {remediation_step_1}
+
+### Acceptance criteria
+- [ ] Target anchor holds: {target_anchor_text}`
+    }
+  };
+}
+function addCriterionToOverlay(root, pack, criterion, options = {}) {
+  if (typeof criterion.id !== "string" || criterion.id === "") throw new Error(`the criterion has no id`);
+  if ((pack.criteria ?? []).some((c) => c.id === criterion.id) && !options.force) {
+    throw new Error(
+      `"${criterion.id}" is already a pack criterion.
+Overriding it changes what every score recorded against that id means.
+Use a project-reserved id (X-01, X-02, \u2026) instead, or pass --force if the override is deliberate.`
+    );
+  }
+  const path6 = overlayPath(root);
+  const overlay = loadOverlay(root) ?? { extends: pack.version, criteria: [] };
+  overlay.criteria = Array.isArray(overlay.criteria) ? overlay.criteria : [];
+  const at2 = overlay.criteria.findIndex((c) => c?.id === criterion.id);
+  if (at2 >= 0 && !options.force) {
+    throw new Error(`"${criterion.id}" is already in the overlay \u2014 pass --force to replace it`);
+  }
+  if (at2 >= 0) overlay.criteria[at2] = criterion;
+  else overlay.criteria.push(criterion);
+  const domainCode = criterion.domain;
+  const knownDomain = (pack.domains ?? []).some((d) => d.code === domainCode) || (overlay.domains ?? []).some((d) => d.code === domainCode);
+  let addedDomain;
+  if (!knownDomain) {
+    if (!options.domainName) {
+      throw new Error(
+        `"${domainCode}" is not a pack domain and the overlay does not define it.
+Pass --domain-name "<display name>" to define it, or use an existing domain code.`
+      );
+    }
+    overlay.domains = [...overlay.domains ?? [], { code: domainCode, name: options.domainName }];
+    addedDomain = domainCode;
+  }
+  writeJson(path6, overlay);
+  return { path: path6, overlay, replaced: at2 >= 0, ...addedDomain !== void 0 ? { addedDomain } : {} };
+}
+
+// src/commands/kritik.ts
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
+
+// src/lib/kritik-io.ts
+import { existsSync as existsSync15 } from "node:fs";
+import { dirname as dirname6, join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var KRITIK_ACTOR = "arkaik-cli";
+var DEFAULT_BUNDLE_PATH9 = join8("docs", "arkaik", "bundle.json");
+var VENDORED_PACK = join8(QUALITY_DIR, PACK_FILE);
+var BUNDLED_PACK = join8(dirname6(fileURLToPath2(import.meta.url)), "assets", "kritik", "library.json");
+function resolvePack(root) {
+  const vendored = join8(root, VENDORED_PACK);
+  if (existsSync15(vendored)) return { library: readJson(vendored), path: vendored, vendored: true };
+  if (!existsSync15(BUNDLED_PACK)) {
+    throw new Error(
+      `no criteria pack found. Looked in:
+  ${vendored}
+  ${BUNDLED_PACK}
+The second is shipped with this CLI, so its absence means a broken install \u2014 reinstall \`arkaik\`.`
+    );
+  }
+  return { library: readJson(BUNDLED_PACK), path: BUNDLED_PACK, vendored: false };
+}
+function loadKritikLibrary(root) {
+  const pack = resolvePack(root);
+  return { library: mergeKritikLibrary(pack.library, loadOverlay(root)), pack };
+}
+function resolveJournal(root, bundlePath) {
+  const resolved = bundlePath ?? join8(root, DEFAULT_BUNDLE_PATH9);
+  return { bundlePath: resolved, journalPath: journalPathFor(resolved), present: existsSync15(resolved) };
+}
+function appendQualityEvents(root, inputs, options = {}) {
+  if (inputs.length === 0) return { events: [] };
+  const actor = options.actor ?? KRITIK_ACTOR;
+  const journal = resolveJournal(root, options.bundlePath);
+  if (!journal.present) return { events: [] };
+  const bundle = readBundle(journal.bundlePath);
+  const baseline = ensureJournalBaseline(journal.journalPath, bundle, actor);
+  const events = inputs.map((input) => makeEvent(input.type, input.payload, { actor }));
+  for (const event of events) appendJournalEvent(journal.journalPath, event);
+  return { journalPath: journal.journalPath, events, ...baseline !== void 0 ? { baseline } : {} };
+}
+
+// src/commands/kritik.ts
+var USAGE13 = `arkaik kritik <subcommand> [options]
+
+Audit this product's quality with the Kritik framework: a maturity level per
+criterion per surface backed by evidence, findings carrying risk and cost, and
+a comparative matrix whose caps stop one open Critical being averaged into a B.
+
+Subcommands:
+  profile               Pick this project's surfaces (writes docs/quality/profile.json).
+  score <c> <s> <lvl>   Record one maturity level, with its evidence.
+  finding open ...      Open a finding on a (criterion x surface) cell.
+  finding resolve <id>  Close it because the fix merged.
+  finding accept <id>   Accept it as a known, owned risk.
+  matrix [audit-id]     Roll an audit up (writes matrix.json).
+  signals               The signal pack, and what has tripped since the last audit.
+  issue <criterion>     Print the prefilled GitHub issue skeleton.
+  criterion add ...     Add a project-specific criterion to the overlay.
+
+Common options:
+  --root <dir>      Repo root holding docs/quality/ (default: the current directory).
+  --actor <name>    Who is writing (default: ${KRITIK_ACTOR}). Recorded on every quality.* event.
+  --bundle <path>   The Arkaik bundle whose journal receives events
+                    (default: docs/arkaik/bundle.json; skipped when absent).
+  --no-journal      Write the audit files only; append no journal events.
+  -h, --help        Show this help, or a subcommand's.
+
+Run "arkaik kritik <subcommand> --help" for the flags each one takes.`;
+var SCORE_USAGE = `arkaik kritik score <criterion> <surface> <level> --evidence <text|@file> [options]
+
+Record one (criterion x surface) maturity level. A cell holds exactly one level,
+so re-scoring replaces in place \u2014 the correction reads as a correction.
+
+Arguments:
+  criterion         A criterion id from the pack or this project's overlay (e.g. SEC-01).
+  surface           A surface id declared in docs/quality/profile.json.
+  level             0-4. Absent from the file means N/A; 0 means "not addressed".
+
+Options:
+  --evidence <e>    file:line / config citations. \`@path\` reads them from a file.
+                    Required: a score without a citation is an opinion.
+  --audit <id>      The audit run (default: the newest, or the current YYYY-MM).
+  --commit <sha>    The commit the evidence is pinned to.
+
+Writes docs/quality/audits/<id>/scores.json`;
+var FINDING_USAGE = `arkaik kritik finding <open|resolve|accept> [options]
+
+  open <criterion> <surface> --title <t> --impact <1-5> --likelihood <1-5>
+       --cost <S|M|L|XL> --evidence <text|@file> [--detail <d>] [--remediation <r>]
+       [--nodes <id,id>] [--issue-url <u>] [--id <finding-id>] [--audit <id>]
+
+    Opens a finding and appends quality.finding.opened. Severity and priority are
+    printed, never stored \u2014 they are derived from impact x likelihood and cost, so
+    they can never drift from the numbers behind them. The surface may be
+    "${CROSS_SURFACE_ID}" for a defect that belongs to the contract between surfaces.
+
+  resolve <finding-id> [--by <pr-or-commit-url>]
+
+    Marks it resolved and appends quality.finding.resolved. Searched across every
+    audit: a finding opened in 2026-08 is routinely fixed during 2026-09.
+
+  accept <finding-id> --note <why>
+
+    Records it as a known, owned risk. The note is required \u2014 an accepted risk is a
+    decision and reads like one. No journal event: acceptance is a state of the
+    finding, not something that happened to the product.`;
+var MATRIX_USAGE = `arkaik kritik matrix [audit-id] [--json] [--record]
+
+Roll one audit up into its comparative matrix and write matrix.json \u2014 the only
+thing that may write that file.
+
+  audit-id          The audit under docs/quality/audits/ (default: the newest).
+  --json            Print matrix.json instead of the markdown table.
+  --record          Also append quality.audit.completed, carrying these scores
+                    and counts. Do this once per finished audit.`;
+var SIGNALS_USAGE = `arkaik kritik signals [--surface <s>] [--criterion <c>] [--domain <CODE>] [--json]
+arkaik kritik signals --trip <criterion> --surface <s> --signal <index|text> [--detail <d>]
+
+Signals are the cheap checks between full audits: a grep that must return
+nothing, a CI job that must exist. They are statements to check, not commands to
+run \u2014 the pack spans greps, CI introspection and database queries, so this
+prints the run sheet rather than pretending to execute it.
+
+Exits 1 when anything has tripped since the last recorded audit, which is what
+makes it usable as a CI step.
+
+  --trip            Record one as tripped: appends quality.signal.tripped.
+                    --signal takes the row's index from the run sheet, or the text.
+  --json            The full run sheet as JSON (what an agent should read).`;
+var ISSUE_USAGE = `arkaik kritik issue <criterion> --surface <s> [--level <n>] [--finding <id>]
+
+Print the criterion's GitHub issue skeleton, filled as far as what we know
+allows. Placeholders we cannot fill are left standing \u2014 a skeleton is a form to
+finish, and an empty "### Risk" reads as "no risk" where {risk_narrative} reads
+as "your turn".
+
+  --level <n>       The observed maturity, so the anchors fill in.
+  --finding <id>    Fill the risk numbers, evidence and narrative from a finding.
+                    This is the P0/P1 path: the issue exists because a defect does.`;
+var CRITERION_USAGE = `arkaik kritik criterion add --id <ID> --domain <CODE> --name <t> --question <q> \\
+    --applies-to <s1,s2> --anchor l0=<text> ... --anchor l4=<text> [options]
+
+Add a criterion the pack does not have to this project's overlay
+(docs/quality/criteria.custom.json). A pack upgrade never touches it.
+
+  --id              A project-reserved id, e.g. X-01. Never a pack id.
+  --domain          Owning domain code \u2014 an existing one (SEC, PRV, \u2026) or your own.
+  --domain-name     Display name, required only when --domain is a new code.
+  --anchor lN=<t>   What each level looks like HERE. All five are required: a
+                    criterion scored inconsistently makes its whole row incomparable.
+  --weight <1-3>    Weight in the domain roll-up (default 1).
+  --impact <1-5>    Seeds finding severity (default 3).
+  --signal <s>      A mechanically checkable hook; repeatable.
+  --check <s>       A concrete audit step; repeatable.
+  --label <s>       An issue label; repeatable (default: quality).
+  --from <file>     Read a complete criterion from JSON instead of these flags.
+  --template        Print a starting-point criterion and exit.
+  --force           Replace an existing criterion with this id.`;
+function fail12(message) {
+  console.error(message);
+  process.exit(1);
+}
+function takeCommon(args) {
+  const rest = [];
+  const common = { root: process.cwd(), actor: KRITIK_ACTOR, journal: true };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--root") common.root = args[++i] ?? common.root;
+    else if (arg === "--actor") common.actor = args[++i] ?? common.actor;
+    else if (arg === "--bundle") common.bundlePath = args[++i];
+    else if (arg === "--no-journal") common.journal = false;
+    else rest.push(arg);
+  }
+  return { rest, common };
+}
+function collect(args, repeatable = [], boolean4 = []) {
+  const single = {};
+  const many = Object.fromEntries(repeatable.map((key) => [key, []]));
+  const flags = /* @__PURE__ */ new Set();
+  const positionals = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const key = arg.slice(2);
+    if (boolean4.includes(key) || key === "help") {
+      flags.add(key);
+      continue;
+    }
+    const value = args[++i];
+    if (value === void 0) fail12(`kritik: --${key} needs a value`);
+    if (key in many) many[key].push(value);
+    else single[key] = value;
+  }
+  return { single, many, flags, positionals };
+}
+function textOrFile(value) {
+  if (!value.startsWith("@")) return value;
+  const path6 = value.slice(1);
+  if (!existsSync16(path6)) fail12(`kritik: no file at ${path6}`);
+  return readFileSync15(path6, "utf8").trim();
+}
+function currentAuditId() {
+  const now = /* @__PURE__ */ new Date();
+  return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
+}
+function auditForWrite(root, requested) {
+  if (requested !== void 0) return requested;
+  const existing = listAuditIds(root);
+  return existing.length > 0 ? existing[existing.length - 1] : currentAuditId();
+}
+function loadLibraryOrFail(root) {
+  try {
+    return loadKritikLibrary(root).library;
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+}
+function profileOrFail(root) {
+  try {
+    return requireProfile(root);
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+}
+function criterionOrFail(library, criterionId) {
+  const criterion = (library.criteria ?? []).find((candidate) => candidate.id === criterionId);
+  if (!criterion) {
+    const domain2 = criterionId.split("-")[0];
+    const siblings = (library.criteria ?? []).filter((c) => c.domain === domain2).map((c) => c.id);
+    return fail12(
+      `kritik: no criterion "${criterionId}" in the pack or this project's overlay.
+` + (siblings.length > 0 ? `Criteria in ${domain2}: ${siblings.join(", ")}` : `Domains: ${(library.domains ?? []).map((d) => d.code).join(", ")}`)
+    );
+  }
+  if (typeof criterion.superseded_by === "string") {
+    return fail12(
+      `kritik: criterion "${criterionId}" is retired \u2014 superseded by "${criterion.superseded_by}".
+Score that one instead; the old id is kept only so past audits still mean what they meant.`
+    );
+  }
+  return criterion;
+}
+function surfaceOrFail(profile, surface, options = {}) {
+  if (surface === CROSS_SURFACE_ID) {
+    if (options.allowCrossSurface) return surface;
+    return fail12(
+      `kritik: "${CROSS_SURFACE_ID}" is a findings-only lens \u2014 it carries no matrix column, so a score there would render nowhere.`
+    );
+  }
+  const declared = (profile.surfaces ?? []).map((s) => s.id);
+  if (!declared.includes(surface)) {
+    return fail12(
+      `kritik: surface "${surface}" is not declared in ${profilePath(".")}.
+This project's surfaces: ${declared.join(", ") || "(none \u2014 run `arkaik kritik profile` first)"}`
+    );
+  }
+  return surface;
+}
+function intOrFail(label, value, min, max) {
+  if (value === void 0) fail12(`kritik: ${label} is required
+`);
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+    fail12(`kritik: ${label} must be an integer ${min}-${max} (got "${value}")`);
+  }
+  return parsed;
+}
+function reportJournal(root, inputs, common) {
+  if (!common.journal) {
+    console.log(`  journal: skipped (--no-journal)`);
+    return;
+  }
+  const journal = resolveJournal(root, common.bundlePath);
+  if (!journal.present) {
+    console.log(`  journal: none at ${journal.bundlePath} \u2014 Kritik does not need one, so nothing was appended`);
+    return;
+  }
+  const written = appendQualityEvents(root, inputs, { actor: common.actor, bundlePath: common.bundlePath });
+  if (written.baseline !== void 0) {
+    console.log(`  journal: adopted ${written.baseline.node_ids?.length ?? 0} pre-existing nodes first`);
+  }
+  console.log(`  journal: ${written.events.map((e) => e.type).join(", ")} -> ${written.journalPath}`);
+}
+var PROFILE_USAGE = `arkaik kritik profile --surface <id>[:<title>[:<platform>]] [...] [--weight <CODE>=<n>] [--force]
+
+Pick this project's surfaces \u2014 the one decision everything downstream is shaped
+by. Each criterion's applies_to intersects this list to produce the audit's
+cells, and the matrix has exactly these columns.
+
+  --surface         id[:title[:platform]]. \`platform\` (web|ios|android) is the
+                    optional bridge to the product map, for surfaces that ship
+                    views. A database contract or a CLI simply has none.
+  --weight CODE=n   How hard this product is graded on a domain (default 1).
+  --force           Overwrite an existing profile. Changing the surface list
+                    invalidates every score recorded against the old one.
+
+Writes docs/quality/profile.json`;
+function runProfile(args, common) {
+  const { many, flags } = collect(args, ["surface", "weight"], ["force"]);
+  if (flags.has("help")) {
+    console.log(PROFILE_USAGE);
+    process.exit(0);
+  }
+  if (many.surface.length === 0) fail12(`kritik: at least one --surface is required
+
+${PROFILE_USAGE}`);
+  const surfaces = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const spec of many.surface) {
+    let surface;
+    try {
+      surface = parseSurfaceSpec(spec);
+    } catch (error51) {
+      return fail12(`kritik: ${error51.message}`);
+    }
+    if (seen.has(surface.id)) fail12(`kritik: duplicate surface id "${surface.id}"`);
+    seen.add(surface.id);
+    surfaces.push(surface);
+  }
+  const weights = {};
+  for (const spec of many.weight) {
+    const at2 = spec.indexOf("=");
+    if (at2 <= 0) fail12(`kritik: --weight wants CODE=number (got "${spec}")`);
+    const code = spec.slice(0, at2).trim();
+    const value = Number(spec.slice(at2 + 1));
+    if (!Number.isFinite(value) || value <= 0) fail12(`kritik: weight for "${code}" must be a positive number`);
+    weights[code] = value;
+  }
+  const path6 = profilePath(common.root);
+  if (existsSync16(path6) && !flags.has("force")) {
+    fail12(
+      `kritik: ${path6} already exists.
+Changing the surface list invalidates every score recorded against the old one, so this refuses by default.
+Pass --force if that is genuinely what you want.`
+    );
+  }
+  const profile = Object.keys(weights).length > 0 ? { surfaces, domain_weights: weights } : { surfaces };
+  writeJson(path6, profile);
+  console.log(
+    `
+  wrote ${path6}
+  ${surfaces.length} surface${surfaces.length === 1 ? "" : "s"}: ${surfaces.map((s) => s.id).join(", ")}
+  ${Object.keys(weights).length > 0 ? `weights: ${Object.entries(weights).map(([k, v]) => `${k}=${v}`).join(" ")}` : "weights: 1 across every domain"}
+`
+  );
+  process.exit(0);
+}
+function runScore(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(SCORE_USAGE);
+    process.exit(0);
+  }
+  const [criterionId, surfaceArg, levelArg] = positionals;
+  if (criterionId === void 0 || surfaceArg === void 0 || levelArg === void 0) {
+    fail12(`kritik: score takes <criterion> <surface> <level>
+
+${SCORE_USAGE}`);
+  }
+  const library = loadLibraryOrFail(common.root);
+  const profile = profileOrFail(common.root);
+  const criterion = criterionOrFail(library, criterionId);
+  const surface = surfaceOrFail(profile, surfaceArg);
+  const level = intOrFail("level", levelArg, 0, 4);
+  const appliesTo = criterion.applies_to;
+  if (Array.isArray(appliesTo) && !appliesTo.includes(surface)) {
+    fail12(
+      `kritik: ${criterionId} does not apply to "${surface}" (applies to: ${appliesTo.join(", ")}).
+Scoring it there would produce a cell nothing rolls up.`
+    );
+  }
+  if (single.evidence === void 0 || single.evidence.trim() === "") {
+    fail12(`kritik: --evidence is required \u2014 a score without a citation is an opinion, not an assessment.
+
+${SCORE_USAGE}`);
+  }
+  const evidence = textOrFile(single.evidence);
+  const auditId = auditForWrite(common.root, single.audit);
+  const file2 = loadScoresOrEmpty(common.root, auditId);
+  const assessment = {
+    criterion_id: criterionId,
+    surface,
+    level,
+    evidence,
+    audit_id: auditId,
+    ...single.commit !== void 0 ? { commit: single.commit } : {},
+    ts: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const { assessments, replaced } = upsertAssessment(file2.assessments, assessment);
+  saveScores(common.root, auditId, {
+    ...file2,
+    audit_id: auditId,
+    framework_version: file2.framework_version ?? library.version,
+    ...single.commit !== void 0 ? { commit: single.commit } : {},
+    assessments
+  });
+  const anchor = criterion.level_anchors?.[`l${level}`];
+  console.log(
+    `
+  ${replaced ? `re-scored ${criterionId} x ${surface}: ${replaced.level} -> ${level}` : `scored ${criterionId} x ${surface} at ${level}`}${anchor ? ` \u2014 ${anchor}` : ""}
+  ${assessments.length} assessment${assessments.length === 1 ? "" : "s"} in ${auditId} -> ${scoresPath(common.root, auditId)}`
+  );
+  if (level < DEFAULT_TARGET_LEVEL) {
+    console.log(
+      `  below the level-${DEFAULT_TARGET_LEVEL} target \u2014 open a finding, or say in the evidence why this surface should not reach it.`
+    );
+  }
+  console.log("");
+  process.exit(0);
+}
+function runFinding(args, common) {
+  const [action, ...rest] = args;
+  if (action === void 0 || action === "--help" || action === "-h") {
+    console.log(FINDING_USAGE);
+    process.exit(action === void 0 ? 1 : 0);
+  }
+  if (action === "open") return runFindingOpen(rest, common);
+  if (action === "resolve") return runFindingResolve(rest, common);
+  if (action === "accept") return runFindingAccept(rest, common);
+  fail12(`kritik: unknown finding action "${action}"
+
+${FINDING_USAGE}`);
+}
+function runFindingOpen(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(FINDING_USAGE);
+    process.exit(0);
+  }
+  const [criterionId, surfaceArg] = positionals;
+  if (criterionId === void 0 || surfaceArg === void 0) {
+    fail12(`kritik: finding open takes <criterion> <surface>
+
+${FINDING_USAGE}`);
+  }
+  const library = loadLibraryOrFail(common.root);
+  const profile = profileOrFail(common.root);
+  criterionOrFail(library, criterionId);
+  const surface = surfaceOrFail(profile, surfaceArg, { allowCrossSurface: true });
+  if (single.title === void 0 || single.title.trim() === "") {
+    fail12(`kritik: --title is required \u2014 one line naming the actual defect, not the category.
+
+${FINDING_USAGE}`);
+  }
+  if (single.evidence === void 0 || single.evidence.trim() === "") {
+    fail12(`kritik: --evidence is required \u2014 file:line citations someone can check.
+
+${FINDING_USAGE}`);
+  }
+  const impact = intOrFail("--impact", single.impact, 1, 5);
+  const likelihood = intOrFail("--likelihood", single.likelihood, 1, 5);
+  const cost = single.cost;
+  if (cost === void 0 || !REMEDIATION_COSTS.includes(cost)) {
+    fail12(
+      `kritik: --cost must be one of ${REMEDIATION_COSTS.join(", ")} \u2014 it decides priority, so a High that is cheap to fix outranks a High that is not.`
+    );
+  }
+  const auditId = auditForWrite(common.root, single.audit);
+  const file2 = loadFindings(common.root, auditId);
+  const taken = new Set(file2.findings.map((f) => f.id));
+  const id = single.id ?? mintFindingId(auditId, criterionId, surface, taken, library);
+  if (single.id !== void 0 && taken.has(single.id)) {
+    fail12(`kritik: finding "${single.id}" already exists in ${auditId} \u2014 resolve or accept it rather than reopening the id.`);
+  }
+  const nodes = single.nodes?.split(",").map((n) => n.trim()).filter((n) => n !== "");
+  const finding = {
+    id,
+    criterion_id: criterionId,
+    surface,
+    title: single.title,
+    detail: single.detail ?? single.title,
+    evidence: textOrFile(single.evidence),
+    impact,
+    likelihood,
+    cost,
+    status: "open",
+    ...single.remediation !== void 0 ? { remediation: single.remediation } : {},
+    ...nodes !== void 0 && nodes.length > 0 ? { node_ids: nodes } : {},
+    ...single["issue-url"] !== void 0 ? { issue_url: single["issue-url"] } : {}
+  };
+  const { findings } = upsertFinding(file2.findings, finding);
+  saveFindings(common.root, auditId, {
+    ...file2,
+    audit_id: auditId,
+    framework_version: file2.framework_version ?? library.version,
+    findings
+  });
+  const severity = severityOf(finding, library);
+  const priority = priorityOf(finding, library);
+  console.log(
+    `
+  opened ${id} \u2014 ${finding.title}
+  ${severity} / ${priority} (impact ${impact} x likelihood ${likelihood} = ${impact * likelihood}, cost ${cost}) on ${surface}
+  ${findings.length} finding${findings.length === 1 ? "" : "s"} in ${auditId}`
+  );
+  reportJournal(common.root, [findingOpenedInput(finding, library)], common);
+  if (priority === "P0") {
+    console.log(`  P0: file the issue now \u2014 \`arkaik kritik issue ${criterionId} --surface ${surface} --finding ${id}\``);
+  }
+  console.log("");
+  process.exit(0);
+}
+function runFindingResolve(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(FINDING_USAGE);
+    process.exit(0);
+  }
+  const id = positionals[0];
+  if (id === void 0) fail12(`kritik: finding resolve takes <finding-id>
+
+${FINDING_USAGE}`);
+  const located = locateFinding(common.root, id);
+  if (!located) fail12(`kritik: no finding "${id}" in any audit under ${common.root}/docs/quality/audits/`);
+  if (located.finding.status === "resolved") {
+    console.log(`
+  ${id} is already resolved \u2014 nothing written.
+`);
+    process.exit(0);
+  }
+  const { findings, finding } = resolveFinding(located.file.findings, id, single.by);
+  saveFindings(common.root, located.auditId, { ...located.file, findings });
+  console.log(`
+  resolved ${id} \u2014 ${located.finding.title}` + (single.by ? `
+  by ${single.by}` : ""));
+  if (single.by === void 0) {
+    console.log(`  no --by: without the PR or commit that closed it, "resolved" means "we stopped looking".`);
+  }
+  reportJournal(common.root, [findingResolvedInput(finding ?? located.finding, single.by)], common);
+  console.log("");
+  process.exit(0);
+}
+function runFindingAccept(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(FINDING_USAGE);
+    process.exit(0);
+  }
+  const id = positionals[0];
+  if (id === void 0) fail12(`kritik: finding accept takes <finding-id>
+
+${FINDING_USAGE}`);
+  if (single.note === void 0 || single.note.trim() === "") {
+    fail12(`kritik: --note is required \u2014 an accepted risk is a decision and reads like one.`);
+  }
+  const located = locateFinding(common.root, id);
+  if (!located) fail12(`kritik: no finding "${id}" in any audit under ${common.root}/docs/quality/audits/`);
+  const { findings } = acceptFinding(located.file.findings, id, single.note);
+  saveFindings(common.root, located.auditId, { ...located.file, findings });
+  console.log(
+    `
+  accepted ${id} as a known risk \u2014 ${located.finding.title}
+  ${single.note}
+  no journal event: acceptance is a state of the finding, not something that happened to the product.
+`
+  );
+  process.exit(0);
+}
+function runMatrix(args, common) {
+  const { flags, positionals } = collect(args, [], ["json", "record"]);
+  if (flags.has("help")) {
+    console.log(MATRIX_USAGE);
+    process.exit(0);
+  }
+  const library = loadLibraryOrFail(common.root);
+  let auditId;
+  try {
+    auditId = positionals[0] ?? newestAuditId(common.root);
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  let computed;
+  try {
+    computed = computeAuditMatrix(common.root, auditId, library);
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  const { section, matrix, file: file2 } = computed;
+  if (flags.has("json")) {
+    console.log(JSON.stringify(file2, null, 2));
+  } else {
+    const domainNames = new Map((library.domains ?? []).map((d) => [d.code, d.name]));
+    console.log(`
+${renderMatrixMarkdown(matrix, domainNames)}
+`);
+    const open = section.findings.filter(isOpenFinding);
+    const lanes = { P0: 0, P1: 0, P2: 0, P3: 0 };
+    for (const finding of open) lanes[priorityOf(finding, library)]++;
+    const counts = matrix.finding_counts;
+    console.log(
+      `${section.assessments.length} assessments \xB7 ${open.length} open findings (${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low)
+lanes: P0 ${lanes.P0} \xB7 P1 ${lanes.P1} \xB7 P2 ${lanes.P2} \xB7 P3 ${lanes.P3}`
+    );
+    const p0 = open.filter((finding) => priorityOf(finding, library) === "P0");
+    if (p0.length > 0) {
+      console.log(`
+P0 \u2014 fix first:`);
+      for (const finding of p0) {
+        console.log(`  [${severityOf(finding, library)}] ${finding.surface} \xB7 ${finding.id} \u2014 ${finding.title}`);
+      }
+    }
+    console.log(`
+wrote ${matrixPath(common.root, auditId)}`);
+  }
+  if (flags.has("record")) {
+    reportJournal(
+      common.root,
+      [auditCompletedInput(matrix, { audit_id: auditId, framework_version: file2.framework_version, ...file2.commit !== void 0 ? { commit: file2.commit } : {} })],
+      common
+    );
+  }
+  console.log("");
+  process.exit(0);
+}
+function tripsSinceLastAudit(root, common) {
+  const journal = resolveJournal(root, common.bundlePath);
+  if (!journal.present) return [];
+  const events = orderEvents(readFullJournalEvents(journal.journalPath));
+  const lastAudit = events.map((event) => event.type).lastIndexOf("quality.audit.completed");
+  return events.slice(lastAudit + 1).filter((event) => event.type === "quality.signal.tripped");
+}
+function runSignals(args, common) {
+  const { single, flags } = collect(args, [], ["json"]);
+  if (flags.has("help")) {
+    console.log(SIGNALS_USAGE);
+    process.exit(0);
+  }
+  const library = loadLibraryOrFail(common.root);
+  const profile = profileOrFail(common.root);
+  if (single.trip !== void 0) {
+    const criterion = criterionOrFail(library, single.trip);
+    if (single.surface === void 0) fail12(`kritik: --trip needs --surface`);
+    const surface = surfaceOrFail(profile, single.surface);
+    if (single.signal === void 0) fail12(`kritik: --trip needs --signal (a run-sheet index, or the statement itself)`);
+    const signals = criterion.signals ?? [];
+    const index = Number(single.signal);
+    const signal = Number.isInteger(index) && index >= 0 && index < signals.length ? signals[index] : single.signal;
+    console.log(`
+  tripped ${criterion.id} x ${surface}
+  ${signal}`);
+    reportJournal(
+      common.root,
+      [signalTrippedInput({ criterion_id: criterion.id, surface, signal, ...single.detail !== void 0 ? { detail: single.detail } : {} })],
+      common
+    );
+    console.log(`  a tripped signal is not a finding \u2014 it is the prompt to go look.
+`);
+    process.exit(0);
+  }
+  const filter = {
+    ...single.surface !== void 0 ? { surface: surfaceOrFail(profile, single.surface) } : {},
+    ...single.criterion !== void 0 ? { criterion: criterionOrFail(library, single.criterion).id } : {},
+    ...single.domain !== void 0 ? { domain: single.domain } : {}
+  };
+  const rows = signalRunSheet(library, profile.surfaces ?? [], filter);
+  const trips = tripsSinceLastAudit(common.root, common);
+  if (flags.has("json")) {
+    console.log(JSON.stringify({ signals: rows, tripped_since_last_audit: trips }, null, 2));
+    process.exit(trips.length > 0 ? 1 : 0);
+  }
+  const filtered = Object.keys(filter).length > 0;
+  if (filtered) {
+    console.log("");
+    let current = "";
+    for (const row of rows) {
+      const key = `${row.criterion_id} x ${row.surface}`;
+      if (key !== current) {
+        current = key;
+        console.log(`  ${key}`);
+      }
+      console.log(`    [${row.index}] ${row.signal}`);
+    }
+    console.log(`
+  ${rows.length} check${rows.length === 1 ? "" : "s"}.`);
+  } else {
+    const criteria = new Set(rows.map((row) => row.criterion_id)).size;
+    console.log(
+      `
+  ${rows.length} checks across ${criteria} criteria and ${(profile.surfaces ?? []).length} surfaces.
+  Narrow it (--surface, --criterion, --domain) to read them, or --json to take the lot.`
+    );
+  }
+  if (trips.length > 0) {
+    console.log(`
+  tripped since the last recorded audit:`);
+    for (const trip of trips) {
+      const event = trip;
+      console.log(`    ${event.criterion_id} x ${event.surface} \u2014 ${event.signal}`);
+    }
+    console.log("");
+    process.exit(1);
+  }
+  console.log("");
+  process.exit(0);
+}
+function runIssue(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(ISSUE_USAGE);
+    process.exit(0);
+  }
+  const criterionId = positionals[0];
+  if (criterionId === void 0) fail12(`kritik: issue takes <criterion>
+
+${ISSUE_USAGE}`);
+  if (single.surface === void 0) fail12(`kritik: --surface is required
+
+${ISSUE_USAGE}`);
+  const library = loadLibraryOrFail(common.root);
+  const criterion = criterionOrFail(library, criterionId);
+  const declared = loadProfile(common.root);
+  if (declared) surfaceOrFail(declared, single.surface, { allowCrossSurface: true });
+  let finding;
+  if (single.finding !== void 0) {
+    const located = locateFinding(common.root, single.finding);
+    if (!located) fail12(`kritik: no finding "${single.finding}" in any audit`);
+    finding = located.finding;
+  }
+  const rendered = renderIssue(criterion, {
+    surface: single.surface,
+    ...single.level !== void 0 ? { level: single.level } : {},
+    ...finding !== void 0 ? { finding, library } : {}
+  });
+  process.stdout.write(`Title: ${rendered.title}
+`);
+  process.stdout.write(`Labels: ${rendered.labels.join(", ")}
+
+`);
+  process.stdout.write(`${rendered.body}
+`);
+  if (rendered.remediation) process.stdout.write(`
+<!-- Typical remediation: ${rendered.remediation} -->
+`);
+  process.exit(0);
+}
+function runCriterion(args, common) {
+  const [action, ...rest] = args;
+  if (action === void 0 || action === "--help" || action === "-h") {
+    console.log(CRITERION_USAGE);
+    process.exit(action === void 0 ? 1 : 0);
+  }
+  if (action !== "add") fail12(`kritik: unknown criterion action "${action}" (only \`add\`)
+
+${CRITERION_USAGE}`);
+  const { single, many, flags } = collect(rest, ["anchor", "signal", "check", "label"], ["template", "force"]);
+  if (flags.has("help")) {
+    console.log(CRITERION_USAGE);
+    process.exit(0);
+  }
+  const { library: pack } = (() => {
+    try {
+      const loaded = loadKritikLibrary(common.root);
+      return { library: loaded.pack.library };
+    } catch (error51) {
+      return fail12(`kritik: ${error51.message}`);
+    }
+  })();
+  if (flags.has("template")) {
+    console.log(JSON.stringify(CRITERION_TEMPLATE, null, 2));
+    process.exit(0);
+  }
+  let criterion;
+  try {
+    if (single.from !== void 0) {
+      if (!existsSync16(single.from)) fail12(`kritik: no file at ${single.from}`);
+      criterion = JSON.parse(readFileSync15(single.from, "utf8"));
+    } else {
+      const anchors = {};
+      for (const spec of many.anchor) {
+        const at2 = spec.indexOf("=");
+        if (at2 <= 0) fail12(`kritik: --anchor wants lN=<text> (got "${spec}")`);
+        anchors[spec.slice(0, at2).trim()] = spec.slice(at2 + 1);
+      }
+      const draft = {
+        id: single.id ?? "",
+        domain: single.domain ?? "",
+        ...single.subcategory !== void 0 ? { subcategory: single.subcategory } : {},
+        name: single.name ?? "",
+        question: single.question ?? "",
+        ...single.definition !== void 0 ? { definition: single.definition } : {},
+        ...single.rationale !== void 0 ? { rationale: single.rationale } : {},
+        appliesTo: (single["applies-to"] ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        anchors,
+        ...single.weight !== void 0 ? { weight: Number(single.weight) } : {},
+        ...single.impact !== void 0 ? { impact: Number(single.impact) } : {},
+        signals: many.signal,
+        checklist: many.check,
+        ...single.remediation !== void 0 ? { remediation: single.remediation } : {},
+        labels: many.label
+      };
+      criterion = buildCriterion(draft);
+    }
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}
+
+${CRITERION_USAGE}`);
+  }
+  let written;
+  try {
+    written = addCriterionToOverlay(common.root, pack, criterion, {
+      force: flags.has("force"),
+      ...single["domain-name"] !== void 0 ? { domainName: single["domain-name"] } : {}
+    });
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  console.log(
+    `
+  ${written.replaced ? "replaced" : "added"} ${criterion.id} (${criterion.domain}) -> ${written.path}
+  applies to ${(criterion.applies_to ?? []).join(", ") || "every surface"}` + (written.addedDomain !== void 0 ? `
+  declared a new domain: ${written.addedDomain}` : "") + `
+  it scores and rolls up exactly like a pack criterion \u2014 \`arkaik kritik issue ${criterion.id} --surface <s>\`
+`
+  );
+  process.exit(0);
+}
+function runKritik(args) {
+  const { rest, common } = takeCommon(args);
+  const [sub, ...subArgs] = rest;
+  if (sub === void 0 || sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(USAGE13);
+    process.exit(sub === void 0 ? 1 : 0);
+  }
+  switch (sub) {
+    case "profile":
+      return runProfile(subArgs, common);
+    case "score":
+      return runScore(subArgs, common);
+    case "finding":
+      return runFinding(subArgs, common);
+    case "matrix":
+      return runMatrix(subArgs, common);
+    case "signals":
+      return runSignals(subArgs, common);
+    case "issue":
+      return runIssue(subArgs, common);
+    case "criterion":
+      return runCriterion(subArgs, common);
+    default:
+      fail12(`kritik: unknown subcommand "${sub}"
+
+${USAGE13}`);
+  }
+}
+
 // src/index.ts
-var USAGE13 = `arkaik \u2014 CLI for Arkaik project bundles
+var USAGE14 = `arkaik \u2014 CLI for Arkaik project bundles
 
 Usage:
   arkaik <command> [options]
@@ -20044,17 +22117,18 @@ Commands:
                                --list shows the projects your token can reach.
   restore [options] [path]    Replace the linked hosted project's bundle + journal (backs up first).
   bootstrap <sub> [options]   One-time onboarding: mine, plan, slice, merge a map from a repo.
+  kritik <sub> [options]      Quality audits: score criteria, open findings, roll up the matrix.
 
 Options:
   -h, --help        Show this help.
   -v, --version     Print the version.
 
 Run "arkaik <command> --help" for command-specific help.`;
-var VERSION = "0.1.1";
+var VERSION = "0.2.0";
 function main(argv) {
   const [command, ...rest] = argv;
   if (command === void 0 || command === "--help" || command === "-h" || command === "help") {
-    console.log(USAGE13);
+    console.log(USAGE14);
     process.exit(0);
   }
   if (command === "--version" || command === "-v" || command === "version") {
@@ -20098,10 +22172,13 @@ function main(argv) {
     case "bootstrap":
       runBootstrap(rest);
       return;
+    case "kritik":
+      runKritik(rest);
+      return;
     default:
       console.error(`Unknown command: ${command}
 `);
-      console.error(USAGE13);
+      console.error(USAGE14);
       process.exit(1);
   }
 }