arkaik 0.1.2 → 0.3.0

package/dist/index.js

@@ -14942,6 +14942,7 @@ function crossCheckJournal(bundle) {
   });
   const everNodes = new Set(snapshotNodeStatus.keys());
   const everEdges = new Set(snapshotEdgeIds);
+  const baselined = /* @__PURE__ */ new Set();
   for (const { ev } of valid) {
     if (ev.type === "node.created") {
       const nid = str2(ev.node_id);
@@ -14949,6 +14950,14 @@ function crossCheckJournal(bundle) {
     } else if (ev.type === "edge.added") {
       const eid = str2(ev.edge_id);
       if (eid) everEdges.add(eid);
+    } else if (ev.type === "journal.baseline" && Array.isArray(ev.node_ids)) {
+      for (const raw of ev.node_ids) {
+        const nid = str2(raw);
+        if (nid) {
+          baselined.add(nid);
+          everNodes.add(nid);
+        }
+      }
     }
   }
   const ordered = orderEvents(valid.map((v) => v.ev));
@@ -15014,7 +15023,7 @@ function crossCheckJournal(bundle) {
     }
   }
   for (const [nodeId, status] of snapshotNodeStatus) {
-    if (!created.has(nodeId)) {
+    if (!created.has(nodeId) && !baselined.has(nodeId)) {
       findings.push({
         path: "journal",
         rule: "journal-missing-node-created",
@@ -15046,6 +15055,26 @@ function crossCheckJournal(bundle) {
   }
   return findings;
 }
+function missingProvenanceNodeIds(snapshotNodeIds, events) {
+  const covered = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (ev.type === "node.created") {
+      if (typeof ev.node_id === "string") covered.add(ev.node_id);
+    } else if (ev.type === "journal.baseline" && Array.isArray(ev.node_ids)) {
+      for (const id of ev.node_ids) {
+        if (typeof id === "string") covered.add(id);
+      }
+    }
+  }
+  const missing = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of snapshotNodeIds) {
+    if (covered.has(id) || seen.has(id)) continue;
+    seen.add(id);
+    missing.push(id);
+  }
+  return missing;
+}
 
 // ../schema/src/journal-events.ts
 var envelope = {
@@ -15112,7 +15141,12 @@ var DeliverableShippedEventSchema = external_exports.object({
   summary: external_exports.string().optional(),
   url: external_exports.string().optional(),
   node_ids: external_exports.array(external_exports.string()).optional(),
-  platform: PlatformSchema.optional()
+  platform: PlatformSchema.optional(),
+  lab_note: external_exports.object({
+    en: external_exports.object({ title: external_exports.string(), summary: external_exports.string() }).catchall(external_exports.unknown()),
+    fr: external_exports.object({ title: external_exports.string().optional(), summary: external_exports.string().optional() }).catchall(external_exports.unknown()).optional(),
+    suggested: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).catchall(external_exports.unknown()).optional().meta({ description: "The Lab Note a merged PR carried (slice 3); en.title/en.summary required when present." })
 }).catchall(external_exports.unknown());
 var IdeaProposedEventSchema = external_exports.object({
   ...envelope,
@@ -15147,6 +15181,49 @@ var RefStatusChangedEventSchema = external_exports.object({
   to: external_exports.string(),
   synced_at: external_exports.string()
 }).catchall(external_exports.unknown());
+var JournalBaselineEventSchema = external_exports.object({ ...envelope, type: external_exports.literal("journal.baseline"), node_ids: external_exports.array(external_exports.string()) }).catchall(external_exports.unknown());
+var QualityAuditCompletedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.audit.completed"),
+  audit_id: external_exports.string(),
+  framework_version: external_exports.string(),
+  commit: external_exports.string().optional(),
+  scores: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.number())).optional(),
+  counts: external_exports.object({
+    critical: external_exports.number().optional(),
+    high: external_exports.number().optional(),
+    medium: external_exports.number().optional(),
+    low: external_exports.number().optional(),
+    info: external_exports.number().optional()
+  }).catchall(external_exports.unknown()).optional()
+}).catchall(external_exports.unknown());
+var QualityFindingOpenedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.finding.opened"),
+  finding_id: external_exports.string(),
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  severity: external_exports.string(),
+  priority: external_exports.string(),
+  title: external_exports.string(),
+  node_ids: external_exports.array(external_exports.string()).optional(),
+  issue_url: external_exports.string().optional()
+}).catchall(external_exports.unknown());
+var QualityFindingResolvedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.finding.resolved"),
+  finding_id: external_exports.string(),
+  resolved_by: external_exports.string().optional(),
+  node_ids: external_exports.array(external_exports.string()).optional()
+}).catchall(external_exports.unknown());
+var QualitySignalTrippedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.signal.tripped"),
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  signal: external_exports.string(),
+  detail: external_exports.string().optional()
+}).catchall(external_exports.unknown());
 var JOURNAL_EVENT_SCHEMAS = {
   "node.created": NodeCreatedEventSchema,
   "node.updated": NodeUpdatedEventSchema,
@@ -15161,7 +15238,12 @@ var JOURNAL_EVENT_SCHEMAS = {
   "request.filed": RequestFiledEventSchema,
   "ref.added": RefAddedEventSchema,
   "ref.removed": RefRemovedEventSchema,
-  "ref.status_changed": RefStatusChangedEventSchema
+  "ref.status_changed": RefStatusChangedEventSchema,
+  "journal.baseline": JournalBaselineEventSchema,
+  "quality.audit.completed": QualityAuditCompletedEventSchema,
+  "quality.finding.opened": QualityFindingOpenedEventSchema,
+  "quality.finding.resolved": QualityFindingResolvedEventSchema,
+  "quality.signal.tripped": QualitySignalTrippedEventSchema
 };
 var KnownJournalEventSchema = external_exports.union([
   NodeCreatedEventSchema,
@@ -15177,9 +15259,114 @@ var KnownJournalEventSchema = external_exports.union([
   RequestFiledEventSchema,
   RefAddedEventSchema,
   RefRemovedEventSchema,
-  RefStatusChangedEventSchema
+  RefStatusChangedEventSchema,
+  JournalBaselineEventSchema,
+  QualityAuditCompletedEventSchema,
+  QualityFindingOpenedEventSchema,
+  QualityFindingResolvedEventSchema,
+  QualitySignalTrippedEventSchema
 ]);
 
+// ../schema/src/quality-schemas.ts
+var GradeSchema = external_exports.enum(["A", "B", "C", "D", "E"]);
+var KritikScalesSchema = external_exports.object({
+  grades: external_exports.partialRecord(GradeSchema, external_exports.number()).optional(),
+  severity_buckets: external_exports.partialRecord(external_exports.enum(["critical", "high", "medium", "low", "info"]), external_exports.tuple([external_exports.number(), external_exports.number()])).optional(),
+  caps: external_exports.object({ critical_open: GradeSchema.optional(), high_open: GradeSchema.optional() }).catchall(external_exports.unknown()).optional()
+}).catchall(external_exports.unknown()).meta({
+  id: "KritikScales",
+  description: "Overridable maturity/severity/grade scales carried by a criteria pack. Absent entries fall back to the framework defaults (packages/kritik-library/SPEC.md \xA7 4)."
+});
+var KritikReferenceSchema = external_exports.object({ title: external_exports.string(), anchor: external_exports.string().optional(), url: external_exports.string().optional() }).catchall(external_exports.unknown()).meta({ id: "KritikReference", description: "A stable external anchor behind a criterion (OWASP control, GDPR article, WCAG SC\u2026)." });
+var KritikIssueTemplateSchema = external_exports.object({
+  title_template: external_exports.string().optional(),
+  labels: external_exports.array(external_exports.string()).optional(),
+  body_skeleton: external_exports.string().optional()
+}).catchall(external_exports.unknown()).meta({ id: "KritikIssueTemplate", description: "Per-criterion issue skeleton \u2014 what `arkaik kritik issue` prefills." });
+var KritikDomainSchema = external_exports.object({ code: external_exports.string(), name: external_exports.string(), description: external_exports.string().optional() }).catchall(external_exports.unknown()).meta({ id: "KritikDomain", description: "A top-level criteria category owning a roll-up row in the matrix." });
+var KritikCriterionSchema = external_exports.object({
+  id: external_exports.string().meta({ description: "Stable identifier, `<DOMAIN>-NN`. Never redefined \u2014 retired via superseded_by." }),
+  domain: external_exports.string(),
+  subcategory: external_exports.string().optional(),
+  name: external_exports.string().optional(),
+  question: external_exports.string().optional(),
+  definition: external_exports.string().optional(),
+  rationale: external_exports.string().optional(),
+  applies_to: external_exports.array(external_exports.string()).optional().meta({ description: "Surface ids where the criterion is meaningful; absence means N/A." }),
+  level_anchors: external_exports.record(external_exports.string(), external_exports.string()).optional().meta({ description: "Observable descriptions per maturity level, keyed l0\u2026l4." }),
+  default_impact: external_exports.number().optional(),
+  weight: external_exports.number().optional().meta({ description: "Weight in the domain roll-up (1\u20133; 3 = load-bearing). Absent means 1." }),
+  references: external_exports.array(KritikReferenceSchema).optional(),
+  checklist: external_exports.array(external_exports.string()).optional(),
+  signals: external_exports.array(external_exports.string()).optional().meta({ description: "Mechanically checkable monitoring hooks run between audits." }),
+  remediation: external_exports.string().optional(),
+  issue: KritikIssueTemplateSchema.optional(),
+  superseded_by: external_exports.string().optional()
+}).catchall(external_exports.unknown()).meta({ id: "KritikCriterion", description: "The atomic auditable unit (packages/kritik-library/SPEC.md \xA7 5)." });
+var KritikLibrarySchema = external_exports.object({
+  version: external_exports.string().meta({ description: "Semver of the pack; matrices are comparable only within a major." }),
+  domains: external_exports.array(KritikDomainSchema),
+  criteria: external_exports.array(KritikCriterionSchema),
+  scales: KritikScalesSchema.optional()
+}).catchall(external_exports.unknown()).meta({
+  id: "KritikLibrary",
+  description: "A versioned criteria pack. Embedded on export; repos may instead pin it as a sidecar file."
+});
+var SurfaceDefSchema = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  platform: PlatformSchema.optional().meta({
+    description: "Optional bridge to PLATFORM_IDS where a surface is also a view-shipping platform. Surfaces are not platforms (RFC \xA7 2)."
+  }),
+  path: external_exports.string().optional()
+}).catchall(external_exports.unknown()).meta({ id: "SurfaceDef", description: "One independently assessable body of code \u2014 an audit target, chosen at install." });
+var QualityProfileSchema = external_exports.object({
+  surfaces: external_exports.array(SurfaceDefSchema),
+  domain_weights: external_exports.record(external_exports.string(), external_exports.number()).optional().meta({
+    description: "Per-domain weight in the surface roll-up, keyed by domain code. A missing weight is 1."
+  })
+}).catchall(external_exports.unknown()).meta({ id: "QualityProfile", description: "The project's parameterization of the pack (RFC \xA7 6)." });
+var QualityAssessmentSchema = external_exports.object({
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  level: external_exports.union([external_exports.literal(0), external_exports.literal(1), external_exports.literal(2), external_exports.literal(3), external_exports.literal(4)]).meta({
+    description: "Maturity 0\u20134. N/A is the absence of the row, never a level."
+  }),
+  evidence: external_exports.string().meta({ description: "file:line / config citations. A score without evidence is an opinion, not an assessment." }),
+  audit_id: external_exports.string(),
+  commit: external_exports.string().optional(),
+  ts: external_exports.string()
+}).catchall(external_exports.unknown()).meta({ id: "QualityAssessment", description: "One (criterion \xD7 surface) score \u2014 latest wins; history lives in the journal." });
+var QualityFindingSchema = external_exports.object({
+  id: external_exports.string(),
+  criterion_id: external_exports.string(),
+  surface: external_exports.string(),
+  title: external_exports.string(),
+  detail: external_exports.string(),
+  evidence: external_exports.string(),
+  impact: external_exports.number().meta({ description: "Worst plausible consequence, 1\u20135." }),
+  likelihood: external_exports.number().meta({ description: "Probability it materializes, 1\u20135." }),
+  cost: external_exports.enum(["S", "M", "L", "XL"]),
+  status: external_exports.enum(["open", "resolved", "refuted", "accepted-risk"]),
+  remediation: external_exports.string().optional(),
+  node_ids: external_exports.array(external_exports.string()).optional().meta({ description: "Graph nodes this finding is about \u2014 the tie deliverable.shipped already uses." }),
+  issue_url: external_exports.string().optional(),
+  verification: external_exports.object({ verdict: external_exports.enum(["CONFIRMED", "REFUTED", "DOWNGRADED"]), note: external_exports.string().optional() }).catchall(external_exports.unknown()).optional().meta({ description: "Result of the adversarial refutation pass. Refuted findings are disclosed, not deleted." })
+}).catchall(external_exports.unknown()).meta({
+  id: "QualityFinding",
+  description: "One concrete defect. Severity and priority are deliberately absent \u2014 they are derived from impact \xD7 likelihood and cost (deriveQualityMatrix), so a finding can never carry a severity its own numbers disagree with."
+});
+var QualitySectionSchema = external_exports.object({
+  framework_version: external_exports.string(),
+  library: KritikLibrarySchema.optional(),
+  profile: QualityProfileSchema,
+  assessments: external_exports.array(QualityAssessmentSchema),
+  findings: external_exports.array(QualityFindingSchema)
+}).catchall(external_exports.unknown()).meta({
+  id: "QualitySection",
+  description: "The project's Kritik state (docs/rfcs/kritik.md \xA7 4.1) \u2014 profile, assessments, findings. Criteria are library content, not graph nodes; the matrix is a projection, never stored."
+});
+
 // ../schema/src/bundle.ts
 var PlatformStatusMapSchema = external_exports.partialRecord(
   PlatformSchema,
@@ -15321,7 +15508,8 @@ var ProjectMetadataSchema = external_exports.object({
   }),
   products: external_exports.array(ProductDefinitionSchema).optional().meta({
     description: "Product definitions (docs/spec/bundle-format.md \xA7 Products) \u2014 additive; unknown fields preserved."
-  })
+  }),
+  pollen: external_exports.object({ plant: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*$/).optional() }).catchall(external_exports.unknown()).optional().meta({ description: "Federation settings \u2014 docs/spec/services.md \xA7 Pollen feed. `plant` enables the feed." })
 }).catchall(external_exports.unknown()).meta({ id: "ProjectMetadata", description: "Optional project-level UI settings." });
 var ProjectSchema = external_exports.object({
   id: external_exports.string().meta({ description: "Unique project identifier." }),
@@ -15349,6 +15537,9 @@ var ProjectBundleSchema = external_exports.object({
   edges: external_exports.array(EdgeSchema).meta({ description: "All edges (relationships) between nodes." }),
   journal: external_exports.array(JournalEventSchema).optional().meta({
     description: "Optional embedded journal events \u2014 the Level 2 interchange projection (docs/spec/journal.md). Canonical storage in repos is the JSONL sidecar; a bundle without a journal is Level 0/1, not an error."
+  }),
+  quality: QualitySectionSchema.optional().meta({
+    description: "Optional Kritik quality state (docs/rfcs/kritik.md \xA7 4.1) \u2014 the pinned pack version, the project's surface profile, its assessments and findings. Additive: a bundle without it is not an error, and the comparative matrix is derived from it (deriveQualityMatrix), never stored."
   })
 }).catchall(external_exports.unknown()).meta({
   id: "ProjectBundle",
@@ -15356,15 +15547,6 @@ var ProjectBundleSchema = external_exports.object({
   description: "The import/export format for an Arkaik product graph. Contains a project, its nodes (flows, views, data models, API endpoints), and edges (relationships between nodes)."
 });
 
-// ../schema/src/maps.ts
-var MAP_FLOW_PLATFORMS_MODES = ["rings", "bars"];
-var MAP_VIEW_PLATFORMS_MODES = ["chips", "rows"];
-var MAP_MINIMAP_COLOR_MODES = ["status", "species"];
-var BUILT_IN_MAP_IDS = ["journey", "system"];
-function isBuiltInMapId(id) {
-  return BUILT_IN_MAP_IDS.includes(id);
-}
-
 // ../schema/src/products.ts
 var PRODUCT_MEMBERSHIP_SPECIES = ["flow", "view", "acceptance"];
 function resolveProducts(project) {
@@ -15382,6 +15564,214 @@ function resolveProducts(project) {
   return products;
 }
 
+// ../schema/src/maps.ts
+var MAP_FLOW_PLATFORMS_MODES = ["rings", "bars"];
+var MAP_VIEW_PLATFORMS_MODES = ["chips", "rows"];
+var MAP_MINIMAP_COLOR_MODES = ["status", "species"];
+var BUILT_IN_MAP_IDS = ["journey", "system"];
+function isBuiltInMapId(id) {
+  return BUILT_IN_MAP_IDS.includes(id);
+}
+
+// ../schema/src/quality.ts
+var asArray = (value) => Array.isArray(value) ? value : [];
+var FINDING_SEVERITIES = ["critical", "high", "medium", "low", "info"];
+var REMEDIATION_COSTS = ["S", "M", "L", "XL"];
+var QUALITY_GRADES = ["A", "B", "C", "D", "E"];
+var DEFAULT_GRADE_BANDS = { A: 85, B: 70, C: 55, D: 40, E: 0 };
+var DEFAULT_SEVERITY_BUCKETS = {
+  critical: [20, 25],
+  high: [12, 19],
+  medium: [6, 11],
+  low: [2, 5],
+  info: [1, 1]
+};
+var DEFAULT_CAPS = {
+  critical_open: "D",
+  high_open: "B"
+};
+var CROSS_SURFACE_ID = "cross-surface";
+function mergeKritikLibrary(pack, overlay) {
+  if (!overlay || typeof overlay !== "object") return pack;
+  const domains = [...asArray(pack.domains)];
+  for (const domain2 of asArray(overlay.domains)) {
+    if (typeof domain2?.code !== "string" || domain2.code === "") continue;
+    const at2 = domains.findIndex((existing) => existing?.code === domain2.code);
+    if (at2 >= 0) domains[at2] = domain2;
+    else domains.push(domain2);
+  }
+  const criteria = [...asArray(pack.criteria)];
+  for (const criterion of asArray(overlay.criteria)) {
+    if (typeof criterion?.id !== "string" || criterion.id === "") continue;
+    const at2 = criteria.findIndex((existing) => existing?.id === criterion.id);
+    if (at2 >= 0) criteria[at2] = criterion;
+    else criteria.push(criterion);
+  }
+  const scales = pack.scales || overlay.scales ? { ...pack.scales ?? {}, ...overlay.scales ?? {} } : void 0;
+  return { ...pack, domains, criteria, ...scales ? { scales } : {} };
+}
+function bucketsOf(library) {
+  const stored = library?.scales?.severity_buckets;
+  const out = { ...DEFAULT_SEVERITY_BUCKETS };
+  if (!stored || typeof stored !== "object") return out;
+  for (const severity of FINDING_SEVERITIES) {
+    const band = stored[severity];
+    if (Array.isArray(band) && typeof band[0] === "number" && typeof band[1] === "number") {
+      out[severity] = [band[0], band[1]];
+    }
+  }
+  return out;
+}
+function bandsOf(library) {
+  const stored = library?.scales?.grades;
+  const out = { ...DEFAULT_GRADE_BANDS };
+  if (!stored || typeof stored !== "object") return out;
+  for (const grade of QUALITY_GRADES) {
+    const min = stored[grade];
+    if (typeof min === "number" && Number.isFinite(min)) out[grade] = min;
+  }
+  return out;
+}
+function capsOf(library) {
+  const stored = library?.scales?.caps;
+  const pick2 = (value, fallback) => typeof value === "string" && QUALITY_GRADES.includes(value) ? value : fallback;
+  return {
+    critical_open: pick2(stored?.critical_open, DEFAULT_CAPS.critical_open),
+    high_open: pick2(stored?.high_open, DEFAULT_CAPS.high_open)
+  };
+}
+function severityOf(finding, library) {
+  const impact = typeof finding.impact === "number" ? finding.impact : 0;
+  const likelihood = typeof finding.likelihood === "number" ? finding.likelihood : 0;
+  const score = impact * likelihood;
+  const buckets = bucketsOf(library);
+  const worstFirst = [...FINDING_SEVERITIES].sort((a, b) => buckets[b][0] - buckets[a][0]);
+  for (const severity of worstFirst) {
+    if (score >= buckets[severity][0]) return severity;
+  }
+  return "info";
+}
+function priorityOf(finding, library) {
+  const severity = severityOf(finding, library);
+  const cheap = finding.cost === "S";
+  if (severity === "critical") return "P0";
+  if (severity === "high") return cheap ? "P0" : "P1";
+  if (severity === "medium") return cheap ? "P1" : "P2";
+  if (severity === "low") return cheap ? "P2" : "P3";
+  return "P3";
+}
+function gradeOf(score, library) {
+  const bands = bandsOf(library);
+  const bestFirst = [...QUALITY_GRADES].sort((a, b) => bands[b] - bands[a]);
+  for (const grade of bestFirst) {
+    if (score >= bands[grade]) return grade;
+  }
+  return "E";
+}
+function capGrade(grade, cap) {
+  return QUALITY_GRADES[Math.max(QUALITY_GRADES.indexOf(grade), QUALITY_GRADES.indexOf(cap))];
+}
+function isOpenFinding(finding) {
+  return (finding.status ?? "open") === "open";
+}
+function resolveKritikLibrary(section, library) {
+  const explicit = library ?? section?.library;
+  if (explicit && Array.isArray(explicit.criteria) && Array.isArray(explicit.domains)) return explicit;
+  if (!section) return void 0;
+  const ids = /* @__PURE__ */ new Set();
+  for (const row of [...asArray(section.assessments), ...asArray(section.findings)]) {
+    if (typeof row?.criterion_id === "string" && row.criterion_id !== "") ids.add(row.criterion_id);
+  }
+  if (ids.size === 0) return void 0;
+  const domainOf = (id) => id.includes("-") ? id.slice(0, id.lastIndexOf("-")) : id;
+  const criteria = [...ids].sort().map((id) => ({ id, domain: domainOf(id), weight: 1 }));
+  const domains = [...new Set(criteria.map((c) => c.domain))].sort().map((code) => ({ code, name: code }));
+  return { version: explicit?.version ?? "unknown", domains, criteria, scales: explicit?.scales };
+}
+function deriveQualityMatrix(bundle, library) {
+  const section = bundle.quality;
+  const pack = resolveKritikLibrary(section, library);
+  const assessments = asArray(section?.assessments);
+  const findings = asArray(section?.findings);
+  const openFindings = findings.filter((finding) => isOpenFinding(finding));
+  const declared = asArray(section?.profile?.surfaces).map((surface) => surface?.id).filter((id) => typeof id === "string" && id !== "");
+  const surfaces = declared.length > 0 ? [...new Set(declared)] : [...new Set(assessments.map((a) => a.surface).filter((id) => typeof id === "string" && id !== ""))].sort();
+  const domains = asArray(pack?.domains).map((domain2) => domain2?.code).filter((code) => typeof code === "string" && code !== "");
+  const domainOfCriterion = /* @__PURE__ */ new Map();
+  const weightOfCriterion = /* @__PURE__ */ new Map();
+  for (const criterion of asArray(pack?.criteria)) {
+    if (typeof criterion?.id !== "string") continue;
+    if (typeof criterion.domain === "string") domainOfCriterion.set(criterion.id, criterion.domain);
+    weightOfCriterion.set(criterion.id, typeof criterion.weight === "number" && criterion.weight > 0 ? criterion.weight : 1);
+  }
+  const caps = capsOf(pack);
+  const weights = section?.profile?.domain_weights;
+  const matrix = {};
+  for (const domain2 of domains) {
+    matrix[domain2] = {};
+    for (const surface of surfaces) {
+      const rows = assessments.filter((a) => a.surface === surface && domainOfCriterion.get(a.criterion_id) === domain2);
+      if (rows.length === 0) {
+        matrix[domain2][surface] = null;
+        continue;
+      }
+      let earned = 0;
+      let available = 0;
+      for (const row of rows) {
+        const weight = weightOfCriterion.get(row.criterion_id) ?? 1;
+        const level = typeof row.level === "number" ? Math.min(Math.max(row.level, 0), 4) : 0;
+        earned += level * weight;
+        available += 4 * weight;
+      }
+      if (available === 0) {
+        matrix[domain2][surface] = null;
+        continue;
+      }
+      const score = Math.round(earned / available * 100);
+      const cellSeverities = openFindings.filter((finding) => finding.surface === surface && domainOfCriterion.get(finding.criterion_id) === domain2).map((finding) => severityOf(finding, pack));
+      const banded = gradeOf(score, pack);
+      let grade = banded;
+      if (cellSeverities.includes("critical")) grade = capGrade(grade, caps.critical_open);
+      else if (cellSeverities.includes("high")) grade = capGrade(grade, caps.high_open);
+      matrix[domain2][surface] = {
+        score,
+        grade,
+        capped: grade !== banded,
+        criteria: rows.length,
+        findings: {
+          critical: cellSeverities.filter((s) => s === "critical").length,
+          high: cellSeverities.filter((s) => s === "high").length,
+          medium: cellSeverities.filter((s) => s === "medium").length,
+          low: cellSeverities.filter((s) => s === "low").length
+        }
+      };
+    }
+  }
+  const overall = {};
+  for (const surface of surfaces) {
+    let weighted = 0;
+    let total = 0;
+    for (const domain2 of domains) {
+      const cell = matrix[domain2]?.[surface];
+      if (!cell) continue;
+      const weight = typeof weights?.[domain2] === "number" ? weights[domain2] : 1;
+      weighted += cell.score * weight;
+      total += weight;
+    }
+    overall[surface] = total > 0 ? Math.round(weighted / total) : null;
+  }
+  const finding_counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const finding of openFindings) finding_counts[severityOf(finding, pack)]++;
+  return {
+    framework_version: section?.framework_version,
+    surfaces,
+    domains,
+    matrix,
+    overall,
+    finding_counts
+  };
+}
+
 // ../schema/src/validate.ts
 var VALID_STAGES = ["beta", "monitoring", "deprecated"];
 var VALID_VIEW_CARD_VARIANTS = ["compact", "large"];
@@ -15898,13 +16288,98 @@ function validateBundle(input) {
       composesSet.add(`${sourceId}->${targetId}`);
     }
   });
+  const PLAYLIST_ENTRY_TYPES = ["view", "flow", "condition", "junction"];
+  const checkPlaylistShape = (entries, flowId, path6, depth = 0) => {
+    if (depth > 50) return;
+    if (!Array.isArray(entries)) {
+      error51(path6, "playlist-entry-shape", `Flow ${flowId}: ${path6} must be an array of playlist entries`);
+      return;
+    }
+    entries.forEach((raw, i) => {
+      const p = `${path6}[${i}]`;
+      if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        error51(p, "playlist-entry-shape", `Flow ${flowId}: ${p} must be a playlist entry object`);
+        return;
+      }
+      const entry = raw;
+      const type = entry.type;
+      if (typeof type !== "string" || !PLAYLIST_ENTRY_TYPES.includes(type)) {
+        error51(
+          `${p}.type`,
+          "playlist-entry-shape",
+          `Flow ${flowId}: ${p}.type must be one of ${PLAYLIST_ENTRY_TYPES.join(", ")} (got ${JSON.stringify(type)})`
+        );
+        return;
+      }
+      if (type === "view") {
+        if (typeof entry.view_id !== "string") {
+          error51(`${p}.view_id`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a view entry with no view_id string`);
+        }
+      } else if (type === "flow") {
+        if (typeof entry.flow_id !== "string") {
+          error51(`${p}.flow_id`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a flow entry with no flow_id string`);
+        }
+      } else if (type === "condition") {
+        if (typeof entry.label !== "string") {
+          error51(`${p}.label`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a condition with no label string`);
+        }
+        for (const branch of ["if_true", "if_false"]) {
+          if (!Array.isArray(entry[branch])) {
+            error51(
+              `${p}.${branch}`,
+              "playlist-entry-shape",
+              `Flow ${flowId}: ${p}.${branch} must be an array of playlist entries (both branches are required, use [] for an empty one)`
+            );
+          } else {
+            checkPlaylistShape(entry[branch], flowId, `${p}.${branch}`, depth + 1);
+          }
+        }
+      } else {
+        if (typeof entry.label !== "string") {
+          error51(`${p}.label`, "playlist-entry-shape", `Flow ${flowId}: ${p} is a junction with no label string`);
+        }
+        if (!Array.isArray(entry.cases)) {
+          error51(`${p}.cases`, "playlist-entry-shape", `Flow ${flowId}: ${p}.cases must be an array of junction cases`);
+          return;
+        }
+        entry.cases.forEach((rawCase, j) => {
+          const cp = `${p}.cases[${j}]`;
+          if (typeof rawCase !== "object" || rawCase === null || Array.isArray(rawCase)) {
+            error51(cp, "playlist-entry-shape", `Flow ${flowId}: ${cp} must be a junction case object`);
+            return;
+          }
+          const branch = rawCase;
+          if (typeof branch.label !== "string") {
+            error51(`${cp}.label`, "playlist-entry-shape", `Flow ${flowId}: ${cp} has no label string`);
+          }
+          if (!Array.isArray(branch.entries)) {
+            error51(
+              `${cp}.entries`,
+              "playlist-entry-shape",
+              `Flow ${flowId}: ${cp}.entries must be an array of playlist entries \u2014 a junction case holds its own entries, not a bare view_id/flow_id`
+            );
+          } else {
+            checkPlaylistShape(branch.entries, flowId, `${cp}.entries`, depth + 1);
+          }
+        });
+      }
+    });
+  };
+  nodes.forEach((node, i) => {
+    const md = node.metadata;
+    if (node.species === "flow" && md?.playlist?.entries) {
+      checkPlaylistShape(md.playlist.entries, node.id, `nodes[${i}].metadata.playlist.entries`);
+    }
+  });
   const collectPlaylistRefs = (entries, flowId, path6, depth = 0) => {
     if (depth > 50) {
       error51(path6, "playlist-depth", `Flow ${flowId}: playlist nesting too deep (possible cycle)`);
       return [];
     }
     const refs = [];
+    if (!Array.isArray(entries)) return refs;
     for (const entry of entries) {
+      if (typeof entry !== "object" || entry === null) continue;
       if (entry.type === "view") {
         if (!nodeIds.has(entry.view_id)) {
           error51(path6, "playlist-ref-exists", `Flow ${flowId}: playlist references non-existent view "${entry.view_id}"`);
@@ -15956,7 +16431,9 @@ function validateBundle(input) {
       const nodeId = node.id;
       const subFlows = [];
       const findSubFlows = (entries) => {
+        if (!Array.isArray(entries)) return;
         for (const e of entries) {
+          if (typeof e !== "object" || e === null) continue;
           if (e.type === "flow") subFlows.push(e.flow_id);
           if (e.type === "condition") {
             if (e.if_true) findSubFlows(e.if_true);
@@ -15991,6 +16468,151 @@ function validateBundle(input) {
   for (const id of flowGraph.keys()) {
     dfs(id);
   }
+  const quality = bundle.quality;
+  if (typeof quality === "object" && quality !== null && !Array.isArray(quality)) {
+    const section = quality;
+    const assessments = Array.isArray(section.assessments) ? section.assessments : [];
+    const qualityFindings = Array.isArray(section.findings) ? section.findings : [];
+    const profile = typeof section.profile === "object" && section.profile !== null ? section.profile : void 0;
+    const declaredSurfaces = /* @__PURE__ */ new Set();
+    if (Array.isArray(profile?.surfaces)) {
+      profile.surfaces.forEach((entry, index) => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+        const surface = entry;
+        const surfaceId = typeof surface.id === "string" ? surface.id : void 0;
+        if (surfaceId === void 0 || surfaceId.trim() === "") return;
+        if (declaredSurfaces.has(surfaceId)) {
+          warn(`quality.profile.surfaces[${index}].id`, "quality-duplicate-surface", `Duplicate surface id "${surfaceId}" \u2014 the first wins`);
+        }
+        declaredSurfaces.add(surfaceId);
+      });
+    }
+    if (declaredSurfaces.size === 0 && (assessments.length > 0 || qualityFindings.length > 0)) {
+      warn(
+        "quality.profile.surfaces",
+        "quality-no-surfaces",
+        "Quality data is stored but the profile declares no surfaces \u2014 the matrix falls back to the surfaces the assessments name"
+      );
+    }
+    const library = typeof section.library === "object" && section.library !== null ? section.library : void 0;
+    const knownCriteria = /* @__PURE__ */ new Set();
+    const retiredCriteria = /* @__PURE__ */ new Map();
+    if (Array.isArray(library?.criteria)) {
+      for (const entry of library.criteria) {
+        if (typeof entry !== "object" || entry === null) continue;
+        const criterion = entry;
+        if (typeof criterion.id !== "string") continue;
+        knownCriteria.add(criterion.id);
+        if (typeof criterion.superseded_by === "string" && criterion.superseded_by !== "") {
+          retiredCriteria.set(criterion.id, criterion.superseded_by);
+        }
+      }
+    } else if (assessments.length > 0 || qualityFindings.length > 0) {
+      warn(
+        "quality.library",
+        "quality-library-missing",
+        "No criteria pack is embedded \u2014 criterion ids cannot be resolved to domains or weights; the matrix uses a synthesized library"
+      );
+    }
+    if (typeof section.framework_version !== "string" || section.framework_version === "") {
+      warn("quality.framework_version", "quality-framework-version-missing", "Quality section has no framework_version \u2014 scores are not comparable across audits without one");
+    }
+    const checkRowRefs = (row, path6, label) => {
+      const criterionId = typeof row.criterion_id === "string" ? row.criterion_id : void 0;
+      if (criterionId !== void 0 && knownCriteria.size > 0 && !knownCriteria.has(criterionId)) {
+        warn(`${path6}.criterion_id`, "quality-unknown-criterion", `${label}: criterion "${criterionId}" is not in the pinned library`);
+      }
+      const supersededBy = criterionId !== void 0 ? retiredCriteria.get(criterionId) : void 0;
+      if (supersededBy !== void 0) {
+        warn(`${path6}.criterion_id`, "quality-retired-criterion", `${label}: criterion "${criterionId}" is retired \u2014 superseded by "${supersededBy}"`);
+      }
+      const surface = typeof row.surface === "string" ? row.surface : void 0;
+      if (surface !== void 0 && surface !== CROSS_SURFACE_ID && declaredSurfaces.size > 0 && !declaredSurfaces.has(surface)) {
+        warn(`${path6}.surface`, "quality-unknown-surface", `${label}: surface "${surface}" is not declared in the profile`);
+      }
+    };
+    const seenCells = /* @__PURE__ */ new Set();
+    assessments.forEach((entry, index) => {
+      if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+      const assessment = entry;
+      const path6 = `quality.assessments[${index}]`;
+      const label = `Assessment ${index}`;
+      checkRowRefs(assessment, path6, label);
+      const level = assessment.level;
+      if (typeof level !== "number" || !Number.isInteger(level) || level < 0 || level > 4) {
+        warn(`${path6}.level`, "quality-level-range", `${label}: level must be an integer 0-4 (N/A is the absence of the row, not a level)`);
+      }
+      if (assessment.surface === CROSS_SURFACE_ID) {
+        warn(`${path6}.surface`, "quality-cross-surface-assessment", `${label}: "${CROSS_SURFACE_ID}" is a findings-only lens \u2014 it carries no matrix column, so this score would render nowhere`);
+      }
+      if (typeof assessment.evidence !== "string" || assessment.evidence.trim() === "") {
+        warn(`${path6}.evidence`, "quality-assessment-no-evidence", `${label}: scored with no evidence \u2014 a score without a citation is an opinion, not an assessment`);
+      }
+      const criterionId = typeof assessment.criterion_id === "string" ? assessment.criterion_id : void 0;
+      const surface = typeof assessment.surface === "string" ? assessment.surface : void 0;
+      if (criterionId !== void 0 && surface !== void 0) {
+        const cell = `${criterionId}\0${surface}`;
+        if (seenCells.has(cell)) {
+          warn(`${path6}`, "quality-duplicate-assessment", `${label}: a second score for (${criterionId} x ${surface}) \u2014 the section stores latest-per-cell, so this cell is ambiguous`);
+        }
+        seenCells.add(cell);
+      }
+    });
+    const seenFindingIds = /* @__PURE__ */ new Set();
+    qualityFindings.forEach((entry, index) => {
+      if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+      const finding = entry;
+      const path6 = `quality.findings[${index}]`;
+      const label = `Finding ${index}`;
+      checkRowRefs(finding, path6, label);
+      const findingId = typeof finding.id === "string" ? finding.id : void 0;
+      if (findingId !== void 0) {
+        if (seenFindingIds.has(findingId)) {
+          warn(`${path6}.id`, "quality-duplicate-finding-id", `Duplicate finding id "${findingId}"`);
+        }
+        seenFindingIds.add(findingId);
+      }
+      for (const field of ["impact", "likelihood"]) {
+        const value = finding[field];
+        if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 5) {
+          warn(`${path6}.${field}`, "quality-risk-range", `${label}: ${field} must be an integer 1-5 \u2014 severity is derived from impact x likelihood`);
+        }
+      }
+      for (const derived of ["severity", "priority"]) {
+        if (derived in finding) {
+          warn(`${path6}.${derived}`, "quality-derived-field-stored", `${label}: ${derived} is derived from impact, likelihood and cost \u2014 storing it lets it drift from the numbers behind it`);
+        }
+      }
+      if (finding.status === "accepted-risk" && (typeof finding.detail !== "string" || finding.detail.trim() === "")) {
+        warn(`${path6}.detail`, "quality-accepted-risk-no-note", `${label}: accepted-risk with no note \u2014 an accepted risk is a decision and reads like one`);
+      }
+    });
+    const openedInJournal = /* @__PURE__ */ new Set();
+    const journalEvents = Array.isArray(bundle.journal) ? bundle.journal : [];
+    journalEvents.forEach((entry) => {
+      if (typeof entry !== "object" || entry === null) return;
+      const event = entry;
+      if (event.type === "quality.finding.opened" && typeof event.finding_id === "string") openedInJournal.add(event.finding_id);
+    });
+    journalEvents.forEach((entry, index) => {
+      if (typeof entry !== "object" || entry === null) return;
+      const event = entry;
+      const type = typeof event.type === "string" ? event.type : "";
+      if (!type.startsWith("quality.")) return;
+      if (typeof event.actor !== "string" || event.actor.trim() === "") {
+        warn(`journal[${index}].actor`, "quality-event-no-actor", `Journal event ${index}: ${type} has no actor \u2014 human, agent and CI scores become indistinguishable`);
+      }
+      if (type === "quality.finding.resolved" && typeof event.finding_id === "string") {
+        if (!openedInJournal.has(event.finding_id) && !seenFindingIds.has(event.finding_id)) {
+          warn(
+            `journal[${index}].finding_id`,
+            "quality-resolved-never-opened",
+            `Journal event ${index}: resolves finding "${event.finding_id}", which no quality.finding.opened event or stored finding ever declared`
+          );
+        }
+      }
+    });
+  }
   for (const finding of crossCheckJournal(bundle)) findings.push(finding);
   return result();
 }
@@ -16379,6 +17001,292 @@ function promotionPatch(node, promotion) {
   };
 }
 
+// ../schema/src/quality-ops.ts
+var DEFAULT_TARGET_LEVEL = 3;
+function upsertAssessment(assessments, next) {
+  const index = assessments.findIndex(
+    (candidate) => candidate.criterion_id === next.criterion_id && candidate.surface === next.surface
+  );
+  if (index === -1) return { assessments: [...assessments, next] };
+  const updated = [...assessments];
+  const replaced = updated[index];
+  updated[index] = next;
+  return { assessments: updated, replaced };
+}
+function parseSurfaceSpec(spec) {
+  const parts = spec.split(":");
+  const id = (parts[0] ?? "").trim();
+  if (id === "") throw new Error(`--surface needs an id (got "${spec}")`);
+  if (id === CROSS_SURFACE_ID) {
+    throw new Error(
+      `"${CROSS_SURFACE_ID}" is reserved \u2014 it is the contract lens between surfaces. Findings may carry it; it holds no assessments and never becomes a matrix column, so it is not declared here.`
+    );
+  }
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(id)) {
+    throw new Error(
+      `surface id "${id}" is not kebab-case \u2014 assessments reference it, so it has to be stable and typo-proof`
+    );
+  }
+  const title2 = (parts[1] ?? "").trim() || id;
+  const platform = (parts[2] ?? "").trim();
+  if (platform !== "" && !PLATFORM_IDS.includes(platform)) {
+    throw new Error(
+      `"${platform}" is not an Arkaik platform (${PLATFORM_IDS.join(", ")}). A surface that ships no views simply has none \u2014 leave it off rather than inventing one.`
+    );
+  }
+  return platform === "" ? { id, title: title2 } : { id, title: title2, platform };
+}
+function domainCodeOf(criterionId, library) {
+  const criterion = (library?.criteria ?? []).find((candidate) => candidate.id === criterionId);
+  if (typeof criterion?.domain === "string" && criterion.domain !== "") return criterion.domain;
+  const dash = criterionId.indexOf("-");
+  return dash > 0 ? criterionId.slice(0, dash) : criterionId;
+}
+function mintFindingId(auditId, criterionId, surface, taken, library) {
+  const prefix = `F-${auditId}-${domainCodeOf(criterionId, library)}-${surface}-`;
+  const used = new Set(taken);
+  for (let n = 1; n < 1e3; n++) {
+    const candidate = `${prefix}${String(n).padStart(2, "0")}`;
+    if (!used.has(candidate)) return candidate;
+  }
+  throw new Error(`Kritik: exhausted finding ids for ${prefix}NN \u2014 999 findings on one cell is a data problem, not a numbering one`);
+}
+function upsertFinding(findings, next) {
+  const index = findings.findIndex((candidate) => candidate.id === next.id);
+  if (index === -1) return { findings: [...findings, next] };
+  const updated = [...findings];
+  const replaced = updated[index];
+  updated[index] = next;
+  return { findings: updated, replaced };
+}
+function patchFinding(findings, id, patch) {
+  const index = findings.findIndex((candidate) => candidate.id === id);
+  if (index === -1) return { findings: [...findings] };
+  const updated = [...findings];
+  const previous = updated[index];
+  const finding = { ...previous, ...patch };
+  updated[index] = finding;
+  return { findings: updated, finding, previous };
+}
+function resolveFinding(findings, id, resolvedBy) {
+  return patchFinding(findings, id, {
+    status: "resolved",
+    ...resolvedBy !== void 0 ? { resolved_by: resolvedBy } : {}
+  });
+}
+function acceptFinding(findings, id, note) {
+  const existing = findings.find((candidate) => candidate.id === id);
+  const detail = existing === void 0 ? note : `${existing.detail}
+
+Accepted risk: ${note}`.trim();
+  return patchFinding(findings, id, { status: "accepted-risk", detail });
+}
+function fillTemplate(text, values) {
+  return text.replace(/\{(\w+)\}/g, (whole, key) => values[key] ?? whole);
+}
+function renderIssue(criterion, options) {
+  const { surface, finding, library } = options;
+  const anchors = criterion.level_anchors ?? {};
+  const level = options.level === void 0 || options.level === "" ? "" : String(options.level);
+  const observed = level === "" ? "{observed_level}" : level;
+  const target = options.targetLevel !== void 0 && options.targetLevel !== "" ? String(options.targetLevel) : level === "" ? "{target_level}" : String(Math.min(Number(level) + 1, 4));
+  const values = {
+    surface,
+    observed_level: observed,
+    target_level: target,
+    observed_level_name: anchors[`l${observed}`] ?? "{observed_level_name}",
+    target_level_name: anchors[`l${target}`] ?? "{target_level_name}",
+    target_anchor_text: anchors[`l${target}`] ?? "{target_anchor_text}",
+    impact: String(finding?.impact ?? criterion.default_impact ?? 3)
+  };
+  if (finding !== void 0) {
+    values.likelihood = String(finding.likelihood);
+    values.evidence_bullets_with_file_paths = finding.evidence;
+    values.risk_narrative = finding.detail;
+    if (typeof finding.remediation === "string" && finding.remediation !== "") {
+      values.remediation_step_1 = finding.remediation;
+    }
+  }
+  const issue2 = criterion.issue ?? {};
+  const labels = [.../* @__PURE__ */ new Set([...issue2.labels ?? ["quality"], surface])];
+  const body = fillTemplate(issue2.body_skeleton ?? "", values);
+  return {
+    title: fillTemplate(issue2.title_template ?? `[Quality] ${criterion.id} on {surface}`, values),
+    labels,
+    body: finding === void 0 ? body : `${body}
+${findingFooter(finding, library)}`,
+    ...typeof criterion.remediation === "string" && criterion.remediation !== "" ? { remediation: criterion.remediation } : {}
+  };
+}
+function findingFooter(finding, library) {
+  const lines = [
+    ``,
+    `---`,
+    `<sub>Kritik finding \`${finding.id}\` \u2014 **${severityOf(finding, library)} / ${priorityOf(finding, library)}** (impact ${finding.impact} x likelihood ${finding.likelihood}, cost ${finding.cost})</sub>`,
+    ``,
+    `**Evidence**`,
+    finding.evidence
+  ];
+  if (typeof finding.remediation === "string" && finding.remediation !== "") {
+    lines.push(``, `**Remediation**`, finding.remediation);
+  }
+  return lines.join("\n");
+}
+function signalRunSheet(library, surfaces, filter = {}) {
+  const surfaceIds = surfaces.map((surface) => surface.id).filter((id) => id !== CROSS_SURFACE_ID);
+  const rows = [];
+  for (const criterion of library.criteria ?? []) {
+    if (criterion.superseded_by !== void 0) continue;
+    if (filter.criterion !== void 0 && criterion.id !== filter.criterion) continue;
+    if (filter.domain !== void 0 && criterion.domain !== filter.domain) continue;
+    const signals = criterion.signals ?? [];
+    if (signals.length === 0) continue;
+    const appliesTo = criterion.applies_to;
+    for (const surfaceId of surfaceIds) {
+      if (Array.isArray(appliesTo) && !appliesTo.includes(surfaceId)) continue;
+      if (filter.surface !== void 0 && surfaceId !== filter.surface) continue;
+      signals.forEach((signal, index) => {
+        rows.push({ criterion_id: criterion.id, surface: surfaceId, index, signal });
+      });
+    }
+  }
+  return rows;
+}
+function auditCompletedInput(matrix, meta3) {
+  const scores = {};
+  for (const surface of matrix.surfaces) {
+    const bySurface = {};
+    for (const domain2 of matrix.domains) {
+      const cell = matrix.matrix[domain2]?.[surface];
+      if (cell) bySurface[domain2] = cell.score;
+    }
+    scores[surface] = bySurface;
+  }
+  return {
+    type: "quality.audit.completed",
+    payload: {
+      audit_id: meta3.audit_id,
+      framework_version: meta3.framework_version,
+      ...meta3.commit !== void 0 ? { commit: meta3.commit } : {},
+      scores,
+      counts: matrix.finding_counts
+    }
+  };
+}
+function findingOpenedInput(finding, library) {
+  return {
+    type: "quality.finding.opened",
+    payload: {
+      finding_id: finding.id,
+      criterion_id: finding.criterion_id,
+      surface: finding.surface,
+      severity: severityOf(finding, library),
+      priority: priorityOf(finding, library),
+      title: finding.title,
+      ...finding.node_ids !== void 0 ? { node_ids: finding.node_ids } : {},
+      ...finding.issue_url !== void 0 ? { issue_url: finding.issue_url } : {}
+    }
+  };
+}
+function findingResolvedInput(finding, resolvedBy) {
+  return {
+    type: "quality.finding.resolved",
+    payload: {
+      finding_id: finding.id,
+      ...resolvedBy !== void 0 ? { resolved_by: resolvedBy } : {},
+      ...finding.node_ids !== void 0 ? { node_ids: finding.node_ids } : {}
+    }
+  };
+}
+function signalTrippedInput(trip) {
+  return {
+    type: "quality.signal.tripped",
+    payload: {
+      criterion_id: trip.criterion_id,
+      surface: trip.surface,
+      signal: trip.signal,
+      ...trip.detail !== void 0 ? { detail: trip.detail } : {}
+    }
+  };
+}
+
+// ../schema/src/quality-regressions.ts
+var REGRESSION_SIGNALS = {
+  "level-drop": "maturity on this cell does not regress",
+  "new-severe-finding": "no open Critical or High finding on this cell",
+  "reopened-finding": "a resolved finding stays resolved"
+};
+var cellKey = (criterionId, surface) => `${criterionId}::${surface}`;
+var rowsOf = (value) => Array.isArray(value) ? value : [];
+function assessmentsByCell(state) {
+  const cells = /* @__PURE__ */ new Map();
+  for (const assessment of rowsOf(state?.assessments)) {
+    if (typeof assessment?.criterion_id !== "string" || typeof assessment?.surface !== "string") continue;
+    cells.set(cellKey(assessment.criterion_id, assessment.surface), assessment);
+  }
+  return cells;
+}
+function severeByCell(state, library) {
+  const cells = /* @__PURE__ */ new Map();
+  for (const finding of rowsOf(state?.findings)) {
+    if (typeof finding?.criterion_id !== "string" || typeof finding?.surface !== "string") continue;
+    if (!isOpenFinding(finding)) continue;
+    const severity = severityOf(finding, library);
+    if (severity !== "critical" && severity !== "high") continue;
+    const key = cellKey(finding.criterion_id, finding.surface);
+    const existing = cells.get(key);
+    if (existing === void 0) cells.set(key, [finding]);
+    else existing.push(finding);
+  }
+  return cells;
+}
+function detectRegressions(previous, next, library) {
+  const before = assessmentsByCell(previous);
+  const after = assessmentsByCell(next);
+  const comparable = (key) => before.has(key) && after.has(key);
+  const regressions = [];
+  for (const [key, current] of after) {
+    const earlier = before.get(key);
+    if (earlier === void 0) continue;
+    if (!(Number(current.level) < Number(earlier.level))) continue;
+    regressions.push({
+      kind: "level-drop",
+      criterion_id: current.criterion_id,
+      surface: current.surface,
+      signal: REGRESSION_SIGNALS["level-drop"],
+      detail: `level ${earlier.level} \u2192 ${current.level} (${earlier.audit_id} \u2192 ${current.audit_id})`
+    });
+  }
+  const severeBefore = severeByCell(previous, library);
+  for (const [key, findings] of severeByCell(next, library)) {
+    if (!comparable(key)) continue;
+    if ((severeBefore.get(key) ?? []).length > 0) continue;
+    for (const finding of findings) {
+      regressions.push({
+        kind: "new-severe-finding",
+        criterion_id: finding.criterion_id,
+        surface: finding.surface,
+        signal: REGRESSION_SIGNALS["new-severe-finding"],
+        detail: `${finding.id} \u2014 ${severityOf(finding, library)} (impact ${finding.impact} \xD7 likelihood ${finding.likelihood})`
+      });
+    }
+  }
+  const resolvedBefore = new Set(
+    rowsOf(previous?.findings).filter((finding) => finding?.status === "resolved").map((finding) => finding.id)
+  );
+  for (const finding of rowsOf(next?.findings)) {
+    if (!isOpenFinding(finding) || !resolvedBefore.has(finding.id)) continue;
+    regressions.push({
+      kind: "reopened-finding",
+      criterion_id: finding.criterion_id,
+      surface: finding.surface,
+      signal: REGRESSION_SIGNALS["reopened-finding"],
+      detail: `${finding.id} \u2014 "${finding.title}"`
+    });
+  }
+  return regressions;
+}
+
 // src/commands/init.ts
 var DEFAULT_BUNDLE_PATH = "docs/arkaik/bundle.json";
 var DEFAULT_JOURNAL_PATH = "docs/arkaik/journal.jsonl";
@@ -16672,7 +17580,7 @@ function runInit(args) {
 }
 
 // src/commands/validate.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
 
 // src/lib/bundle-io.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
@@ -16703,9 +17611,80 @@ function nodesByIdOf(bundle) {
 }
 
 // src/lib/bundle-validate.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import { basename as basename2 } from "node:path";
+
+// src/lib/journal-io.ts
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join2 } from "node:path";
 var JOURNAL_SIDECAR = "journal.jsonl";
+function journalPathFor(bundlePath) {
+  return join2(dirname2(bundlePath), JOURNAL_SIDECAR);
+}
+function archivePathFor(journalPath, version2) {
+  return join2(dirname2(journalPath), "journal", `archive-${version2}.jsonl`);
+}
+function archivePathsFor(journalPath) {
+  const dir = join2(dirname2(journalPath), "journal");
+  if (!existsSync3(dir)) return [];
+  return readdirSync(dir).filter((name) => name.startsWith("archive-") && name.endsWith(".jsonl")).sort().map((name) => join2(dir, name));
+}
+function readJournalEvents(journalPath) {
+  if (!existsSync3(journalPath)) return [];
+  return parseJournalLines(readFileSync3(journalPath, "utf8")).events;
+}
+function readFullJournalEvents(journalPath) {
+  const events = readJournalEvents(journalPath);
+  for (const archivePath of archivePathsFor(journalPath)) {
+    events.push(...readJournalEvents(archivePath));
+  }
+  return events;
+}
+function loadJournalEvents(bundle, bundlePath) {
+  if (Array.isArray(bundle.journal)) return bundle.journal;
+  return readJournalEvents(journalPathFor(bundlePath));
+}
+function toLine(event) {
+  return JSON.stringify(event) + "\n";
+}
+function appendJournalEvent(journalPath, event) {
+  const line2 = toLine(event);
+  if (!existsSync3(journalPath)) {
+    mkdirSync2(dirname2(journalPath), { recursive: true });
+    writeFileSync2(journalPath, line2);
+    return;
+  }
+  const existing = readFileSync3(journalPath, "utf8");
+  const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  appendFileSync(journalPath, prefix + line2);
+}
+function ensureJournalBaseline(journalPath, bundle, actor) {
+  const snapshotNodeIds = (Array.isArray(bundle.nodes) ? bundle.nodes : []).map((node) => node?.id).filter((id) => typeof id === "string");
+  const missing = missingProvenanceNodeIds(snapshotNodeIds, readFullJournalEvents(journalPath));
+  if (missing.length === 0) return void 0;
+  const event = makeEvent("journal.baseline", { node_ids: missing }, { actor });
+  appendJournalEvent(journalPath, event);
+  return event;
+}
+function compactSlice(journalPath, slice, version2) {
+  if (slice.length === 0) return;
+  const sliceIds = new Set(slice.map((ev) => ev.id));
+  const all = readJournalEvents(journalPath);
+  const surviving = all.filter((ev) => !sliceIds.has(ev.id));
+  const archivePath = archivePathFor(journalPath, version2);
+  mkdirSync2(dirname2(archivePath), { recursive: true });
+  const archiveLines = slice.map(toLine).join("");
+  if (existsSync3(archivePath)) {
+    const existing = readFileSync3(archivePath, "utf8");
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    appendFileSync(archivePath, prefix + archiveLines);
+  } else {
+    writeFileSync2(archivePath, archiveLines);
+  }
+  writeFileSync2(journalPath, surviving.map(toLine).join(""));
+}
+
+// src/lib/bundle-validate.ts
 function validateBundleAt(filePath) {
   const bundle = readBundle(filePath);
   const loose = bundle;
@@ -16714,21 +17693,49 @@ function validateBundleAt(filePath) {
   }
   let sidecarFindings = [];
   let sidecarLoaded = false;
+  const archiveFindings = [];
+  const archivesLoaded = [];
   if (loose.journal === void 0) {
-    const sidecarPath = join2(dirname2(filePath), JOURNAL_SIDECAR);
-    if (existsSync3(sidecarPath)) {
-      const { events, findings } = parseJournalLines(readFileSync3(sidecarPath, "utf8"));
+    const sidecarPath = journalPathFor(filePath);
+    const folded = [];
+    if (existsSync4(sidecarPath)) {
+      const { events, findings } = parseJournalLines(readFileSync4(sidecarPath, "utf8"));
       sidecarFindings = findings;
       sidecarLoaded = true;
-      loose.journal = events;
+      folded.push(...events);
     }
+    for (const archivePath of archivePathsFor(sidecarPath)) {
+      const { events, findings } = parseJournalLines(readFileSync4(archivePath, "utf8"));
+      const file2 = basename2(archivePath);
+      for (const finding of findings) archiveFindings.push({ ...finding, file: file2 });
+      archivesLoaded.push(file2);
+      folded.push(...events);
+    }
+    if (sidecarLoaded || archivesLoaded.length > 0) loose.journal = folded;
   }
   const nodes = Array.isArray(loose.nodes) ? loose.nodes : [];
   const edges = Array.isArray(loose.edges) ? loose.edges : [];
   const journal = Array.isArray(loose.journal) ? loose.journal : [];
   const result = validateBundle(bundle);
-  const valid = sidecarFindings.length === 0 && result.errors.length === 0;
-  return { bundle, nodes, edges, journal, sidecarLoaded, sidecarFindings, result, valid };
+  const valid = sidecarFindings.length === 0 && archiveFindings.length === 0 && result.errors.length === 0;
+  return {
+    bundle,
+    nodes,
+    edges,
+    journal,
+    sidecarLoaded,
+    sidecarFindings,
+    archivesLoaded,
+    archiveFindings,
+    result,
+    valid
+  };
+}
+function journalLineErrorLines(v) {
+  return [
+    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
+    ...v.archiveFindings.map((f) => `ERROR [${f.rule}] ${f.file} line ${f.line}: ${f.message}`)
+  ];
 }
 
 // src/commands/validate.ts
@@ -16765,12 +17772,12 @@ function fixFormat(filePath) {
   } catch (e) {
     return fail2(`FATAL: ${e.message}`);
   }
-  const before = readFileSync4(filePath, "utf8");
+  const before = readFileSync5(filePath, "utf8");
   const after = serializeBundle(bundle);
   if (after === before) {
     console.log(`Already canonical: ${filePath}`);
   } else {
-    writeFileSync2(filePath, after);
+    writeFileSync3(filePath, after);
     console.log(`Reformatted: ${filePath}`);
   }
   process.exit(0);
@@ -16789,8 +17796,12 @@ function validate(filePath) {
     `  Nodes: ${v.nodes.length} (${countBySpecies(v.nodes, "view")} views, ${countBySpecies(v.nodes, "flow")} flows, ${countBySpecies(v.nodes, "data-model")} data-models, ${countBySpecies(v.nodes, "api-endpoint")} api-endpoints)`
   );
   console.log(`  Edges: ${v.edges.length}`);
-  if (v.sidecarLoaded) {
-    console.log(`  Journal: ${v.journal.length} event(s) from ${JOURNAL_SIDECAR} sidecar`);
+  if (v.sidecarLoaded || v.archivesLoaded.length > 0) {
+    const from = [
+      ...v.sidecarLoaded ? [`${JOURNAL_SIDECAR} sidecar`] : [],
+      ...v.archivesLoaded.length > 0 ? [`${v.archivesLoaded.length} archive(s)`] : []
+    ].join(" + ");
+    console.log(`  Journal: ${v.journal.length} event(s) from ${from}`);
   } else if (v.journal.length > 0) {
     console.log(`  Journal: ${v.journal.length} embedded event(s)`);
   }
@@ -16800,10 +17811,7 @@ function validate(filePath) {
     v.result.warnings.forEach((w) => console.log(`    ${formatFinding(w)}`));
     console.log("");
   }
-  const errorLines = [
-    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
-    ...v.result.errors.map(formatFinding)
-  ];
+  const errorLines = [...journalLineErrorLines(v), ...v.result.errors.map(formatFinding)];
   if (errorLines.length === 0) {
     console.log("  Result: VALID\n");
     process.exit(0);
@@ -16843,59 +17851,9 @@ ${USAGE2}`);
   }
 }
 
-// src/lib/journal-io.ts
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join3 } from "node:path";
-var JOURNAL_SIDECAR2 = "journal.jsonl";
-function journalPathFor(bundlePath) {
-  return join3(dirname3(bundlePath), JOURNAL_SIDECAR2);
-}
-function archivePathFor(journalPath, version2) {
-  return join3(dirname3(journalPath), "journal", `archive-${version2}.jsonl`);
-}
-function readJournalEvents(journalPath) {
-  if (!existsSync4(journalPath)) return [];
-  return parseJournalLines(readFileSync5(journalPath, "utf8")).events;
-}
-function loadJournalEvents(bundle, bundlePath) {
-  if (Array.isArray(bundle.journal)) return bundle.journal;
-  return readJournalEvents(journalPathFor(bundlePath));
-}
-function toLine(event) {
-  return JSON.stringify(event) + "\n";
-}
-function appendJournalEvent(journalPath, event) {
-  const line2 = toLine(event);
-  if (!existsSync4(journalPath)) {
-    mkdirSync2(dirname3(journalPath), { recursive: true });
-    writeFileSync3(journalPath, line2);
-    return;
-  }
-  const existing = readFileSync5(journalPath, "utf8");
-  const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  appendFileSync(journalPath, prefix + line2);
-}
-function compactSlice(journalPath, slice, version2) {
-  if (slice.length === 0) return;
-  const sliceIds = new Set(slice.map((ev) => ev.id));
-  const all = readJournalEvents(journalPath);
-  const surviving = all.filter((ev) => !sliceIds.has(ev.id));
-  const archivePath = archivePathFor(journalPath, version2);
-  mkdirSync2(dirname3(archivePath), { recursive: true });
-  const archiveLines = slice.map(toLine).join("");
-  if (existsSync4(archivePath)) {
-    const existing = readFileSync5(archivePath, "utf8");
-    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    appendFileSync(archivePath, prefix + archiveLines);
-  } else {
-    writeFileSync3(archivePath, archiveLines);
-  }
-  writeFileSync3(journalPath, surviving.map(toLine).join(""));
-}
-
-// src/lib/render-event.ts
-function str(value) {
-  return typeof value === "string" ? value : void 0;
+// src/lib/render-event.ts
+function str(value) {
+  return typeof value === "string" ? value : void 0;
 }
 function title(id, nodesById) {
   const nodeId = str(id);
@@ -16957,6 +17915,10 @@ function renderEventLine(event, nodesById) {
       const to = str(event.to) ?? "?";
       return `${title(event.node_id, nodesById)}: reference ${from ? `${from} -> ${to}` : to}`;
     }
+    case "journal.baseline": {
+      const count = Array.isArray(event.node_ids) ? event.node_ids.length : 0;
+      return `Journal baseline: ${count} pre-existing node(s) recorded`;
+    }
     default:
       return event.type;
   }
@@ -17160,7 +18122,12 @@ ${USAGE4}`);
   } catch (e) {
     fail4(`FATAL: could not build release event \u2014 ${e.message}`);
   }
+  const baseline = ensureJournalBaseline(journalPath, bundle, ACTOR);
   appendJournalEvent(journalPath, event);
+  if (baseline !== void 0) {
+    console.log(`
+  ${renderEventLine(baseline)} -> ${journalPath}`);
+  }
   console.log(`
   Tagged release ${version2}${platform ? ` [${platform}]` : ""} -> ${journalPath}`);
   const all = [...existing, event];
@@ -17317,7 +18284,12 @@ ${USAGE5}`);
     fail5(`FATAL: could not build deliverable event \u2014 ${e.message}`);
   }
   const journalPath = journalPathFor(filePath);
+  const baseline = ensureJournalBaseline(journalPath, bundle, ACTOR2);
   appendJournalEvent(journalPath, event);
+  if (baseline !== void 0) {
+    console.log(`
+  ${renderEventLine(baseline)} -> ${journalPath}`);
+  }
   console.log(
     `
   Recorded deliverable ${deliverableId} \u2014 ${title2} -> ${journalPath}
@@ -17504,6 +18476,13 @@ async function runSync(options = {}) {
   const errors = [];
   const nodeTitles = /* @__PURE__ */ new Map();
   let dirty = false;
+  let baseline;
+  let baselineChecked = false;
+  const adoptJournal = () => {
+    if (baselineChecked) return;
+    baselineChecked = true;
+    baseline = ensureJournalBaseline(journalPath, bundle, actor);
+  };
   for (const node of nodes) {
     const nodeId = typeof node.id === "string" ? node.id : void 0;
     if (nodeId !== void 0 && typeof node.title === "string") nodeTitles.set(nodeId, node.title);
@@ -17556,6 +18535,7 @@ async function runSync(options = {}) {
         },
         { actor, ts: syncedAt }
       );
+      adoptJournal();
       appendJournalEvent(journalPath, event);
     }
   }
@@ -17570,6 +18550,7 @@ async function runSync(options = {}) {
       const patch = promotionPatch(node, promotion);
       Object.assign(node, patch);
       dirty = true;
+      adoptJournal();
       appendJournalEvent(
         journalPath,
         makeEvent(
@@ -17588,7 +18569,7 @@ async function runSync(options = {}) {
   if (dirty && !dryRun) {
     writeFileSync4(filePath, serializeBundle(bundle));
   }
-  return { ok: true, bundlePath: filePath, journalPath, dryRun, changed, unchanged, skipped, errors, nodeTitles, promoted };
+  return { ok: true, bundlePath: filePath, journalPath, dryRun, changed, unchanged, skipped, errors, nodeTitles, promoted, baseline };
 }
 function changeLine(change, nodeTitles) {
   const event = {
@@ -17626,6 +18607,9 @@ function report(result) {
     for (const s of stubSkips) byProvider.set(s.provider ?? "?", (byProvider.get(s.provider ?? "?") ?? 0) + 1);
     for (const [provider, count] of byProvider) console.log(`    - ${provider}: ${count} ref(s)`);
   }
+  if (result.baseline !== void 0) {
+    console.log(`  ${renderEventLine(result.baseline)}`);
+  }
   if (result.errors.length > 0) {
     console.log(`  Errors: ${result.errors.length}`);
     result.errors.forEach((e) => console.log(`    - ${e.nodeId}/${e.refId} (${e.refType}): ${e.message}`));
@@ -17669,18 +18653,288 @@ ${USAGE6}`);
 }
 
 // src/commands/pack.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname5, extname, resolve as resolve5 } from "node:path";
+
+// src/lib/kritik-io.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { basename as basename3, dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// ../schema/src/cli/kritik-audit.ts
+import { existsSync as existsSync6, readdirSync as readdirSync2, statSync } from "node:fs";
+import { join as join4 } from "node:path";
+
+// ../schema/src/cli/kritik-paths.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, extname, resolve as resolve3 } from "node:path";
-var DEFAULT_BUNDLE_PATH5 = "docs/arkaik/bundle.json";
-var USAGE7 = `arkaik pack [--no-journal] [--inline-assets] [--out <path>] [path]
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+var QUALITY_DIR = "docs/quality";
+var PROFILE_FILE = "profile.json";
+var OVERLAY_FILE = "criteria.custom.json";
+var AUDITS_DIR = "audits";
+var PACK_FILE = "library.json";
+function readJson(path6) {
+  const text = readFileSync6(path6, "utf8");
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw new Error(`${path6}: not valid JSON \u2014 ${e.message}`);
+  }
+}
+function writeJson(path6, value) {
+  mkdirSync3(dirname3(path6), { recursive: true });
+  writeFileSync5(path6, JSON.stringify(value, null, 2) + "\n");
+}
+var profilePath = (root) => join3(root, QUALITY_DIR, PROFILE_FILE);
+var overlayPath = (root) => join3(root, QUALITY_DIR, OVERLAY_FILE);
+var auditsDir = (root) => join3(root, QUALITY_DIR, AUDITS_DIR);
+var auditDir = (root, auditId) => join3(auditsDir(root), auditId);
+function loadProfile(root) {
+  const path6 = profilePath(root);
+  return existsSync5(path6) ? readJson(path6) : null;
+}
+function loadOverlay(root) {
+  const path6 = overlayPath(root);
+  return existsSync5(path6) ? readJson(path6) : null;
+}
+
+// ../schema/src/cli/kritik-audit.ts
+var SCORES_FILE = "scores.json";
+var FINDINGS_FILE = "findings.json";
+var MATRIX_FILE = "matrix.json";
+var scoresPath = (root, auditId) => join4(auditDir(root, auditId), SCORES_FILE);
+var findingsPath = (root, auditId) => join4(auditDir(root, auditId), FINDINGS_FILE);
+var matrixPath = (root, auditId) => join4(auditDir(root, auditId), MATRIX_FILE);
+function listAuditIds(root) {
+  const dir = auditsDir(root);
+  if (!existsSync6(dir)) return [];
+  return readdirSync2(dir).filter((name) => statSync(join4(dir, name)).isDirectory()).sort();
+}
+function newestAuditId(root) {
+  const dir = auditsDir(root);
+  if (!existsSync6(dir)) throw new Error(`no audits directory at ${dir}`);
+  const ids = listAuditIds(root);
+  if (ids.length === 0) throw new Error(`no audits found under ${dir}`);
+  return ids[ids.length - 1];
+}
+function loadScores(root, auditId) {
+  const path6 = scoresPath(root, auditId);
+  if (!existsSync6(path6)) throw new Error(`no ${SCORES_FILE} at ${path6}`);
+  const file2 = readJson(path6);
+  return { ...file2, assessments: Array.isArray(file2.assessments) ? file2.assessments : [] };
+}
+function loadScoresOrEmpty(root, auditId) {
+  return existsSync6(scoresPath(root, auditId)) ? loadScores(root, auditId) : { audit_id: auditId, assessments: [] };
+}
+function loadFindings(root, auditId) {
+  const path6 = findingsPath(root, auditId);
+  if (!existsSync6(path6)) return { audit_id: auditId, findings: [] };
+  const file2 = readJson(path6);
+  return { ...file2, findings: Array.isArray(file2.findings) ? file2.findings : [] };
+}
+function saveScores(root, auditId, file2) {
+  writeJson(scoresPath(root, auditId), file2);
+}
+function saveFindings(root, auditId, file2) {
+  writeJson(findingsPath(root, auditId), file2);
+}
+function requireProfile(root) {
+  const profile = loadProfile(root);
+  if (!profile) {
+    throw new Error(
+      `no profile at ${join4(root, QUALITY_DIR, "profile.json")} \u2014 pick this project's surfaces first (\`arkaik kritik profile\`, or the plugin's init-profile.js).`
+    );
+  }
+  return profile;
+}
+function loadQualitySection(root, auditId, library, scores = loadScores(root, auditId)) {
+  const findings = loadFindings(root, auditId);
+  return {
+    framework_version: scores.framework_version ?? library.version,
+    profile: requireProfile(root),
+    assessments: scores.assessments,
+    findings: findings.findings
+  };
+}
+function stripDerived(finding) {
+  const { severity: _severity, priority: _priority, ...rest } = finding;
+  void _severity;
+  void _priority;
+  return rest;
+}
+function requireAudit(root, auditId) {
+  if (!listAuditIds(root).includes(auditId)) {
+    throw new Error(`no audit "${auditId}" under ${auditsDir(root)}`);
+  }
+}
+function loadCurrentQualitySection(root, library) {
+  const auditIds = listAuditIds(root);
+  if (auditIds.length === 0) return void 0;
+  const profile = loadProfile(root);
+  if (!profile) return void 0;
+  const cells = /* @__PURE__ */ new Map();
+  const findings = [];
+  let frameworkVersion;
+  for (const id of auditIds) {
+    const scores = loadScoresOrEmpty(root, id);
+    if (typeof scores.framework_version === "string") frameworkVersion = scores.framework_version;
+    for (const assessment of scores.assessments) {
+      cells.set(`${assessment.criterion_id}\0${assessment.surface}`, assessment);
+    }
+    for (const finding of loadFindings(root, id).findings) findings.push(stripDerived(finding));
+  }
+  return {
+    framework_version: frameworkVersion ?? library.version,
+    library,
+    profile,
+    assessments: [...cells.values()],
+    findings
+  };
+}
+function loadAuditQualitySection(root, auditId, library) {
+  requireAudit(root, auditId);
+  const section = loadQualitySection(root, auditId, library, loadScoresOrEmpty(root, auditId));
+  return { ...section, library, findings: section.findings.map(stripDerived) };
+}
+function computeAuditMatrix(root, auditId, library) {
+  const scores = loadScores(root, auditId);
+  const section = loadQualitySection(root, auditId, library, scores);
+  const matrix = deriveQualityMatrix({ quality: section }, library);
+  const file2 = {
+    audit_id: auditId,
+    commit: scores.commit,
+    framework_version: section.framework_version,
+    matrix: matrix.matrix,
+    overall: matrix.overall,
+    finding_counts: matrix.finding_counts
+  };
+  writeJson(matrixPath(root, auditId), file2);
+  return { section, matrix, file: file2 };
+}
+function renderMatrixMarkdown(matrix, domainNames) {
+  const cell = (value) => value ? `${value.score} (${value.grade}${value.capped ? "*" : ""})` : "\u2014";
+  const lines = [];
+  lines.push(`| Domain | ${matrix.surfaces.join(" | ")} |`);
+  lines.push(`| --- | ${matrix.surfaces.map(() => "---").join(" | ")} |`);
+  for (const domain2 of matrix.domains) {
+    const label = domainNames.get(domain2) ?? domain2;
+    lines.push(
+      `| **${domain2}** ${label} | ${matrix.surfaces.map((s) => cell(matrix.matrix[domain2]?.[s])).join(" | ")} |`
+    );
+  }
+  lines.push(
+    `| **Overall (weighted)** | ${matrix.surfaces.map((s) => {
+      const score = matrix.overall[s];
+      return score === null || score === void 0 ? "\u2014" : `**${score} (${gradeOf(score)})**`;
+    }).join(" | ")} |`
+  );
+  return lines.join("\n");
+}
+function locateFinding(root, id) {
+  for (const auditId of [...listAuditIds(root)].reverse()) {
+    const file2 = loadFindings(root, auditId);
+    const finding = file2.findings.find((candidate) => candidate.id === id);
+    if (finding) return { auditId, file: file2, finding };
+  }
+  return void 0;
+}
+
+// src/lib/kritik-io.ts
+var KRITIK_ACTOR = "arkaik-cli";
+var DEFAULT_BUNDLE_PATH5 = join5("docs", "arkaik", "bundle.json");
+var VENDORED_PACK = join5(QUALITY_DIR, PACK_FILE);
+var BUNDLED_PACK = join5(dirname4(fileURLToPath2(import.meta.url)), "assets", "kritik", "library.json");
+function resolvePack(root) {
+  const vendored = join5(root, VENDORED_PACK);
+  if (existsSync7(vendored)) return { library: readJson(vendored), path: vendored, vendored: true };
+  if (!existsSync7(BUNDLED_PACK)) {
+    throw new Error(
+      `no criteria pack found. Looked in:
+  ${vendored}
+  ${BUNDLED_PACK}
+The second is shipped with this CLI, so its absence means a broken install \u2014 reinstall \`arkaik\`.`
+    );
+  }
+  return { library: readJson(BUNDLED_PACK), path: BUNDLED_PACK, vendored: false };
+}
+function loadKritikLibrary(root) {
+  const pack = resolvePack(root);
+  return { library: mergeKritikLibrary(pack.library, loadOverlay(root)), pack };
+}
+function resolveJournal(root, bundlePath) {
+  const resolved = bundlePath ?? join5(root, DEFAULT_BUNDLE_PATH5);
+  return { bundlePath: resolved, journalPath: journalPathFor(resolved), present: existsSync7(resolved) };
+}
+function appendQualityEvents(root, inputs, options = {}) {
+  if (inputs.length === 0) return { events: [] };
+  const actor = options.actor ?? KRITIK_ACTOR;
+  const journal = resolveJournal(root, options.bundlePath);
+  if (!journal.present) return { events: [] };
+  const bundle = readBundle(journal.bundlePath);
+  const baseline = ensureJournalBaseline(journal.journalPath, bundle, actor);
+  const events = inputs.map((input) => makeEvent(input.type, input.payload, { actor }));
+  for (const event of events) appendJournalEvent(journal.journalPath, event);
+  return { journalPath: journal.journalPath, events, ...baseline !== void 0 ? { baseline } : {} };
+}
+function isQualitySection(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function foldQualitySection(bundle, root, auditId) {
+  const notFolded = (reason) => {
+    const carriedSection = isQualitySection(bundle.quality);
+    return {
+      folded: false,
+      carriedSection,
+      notice: carriedSection ? `Quality: ${reason}
+  Kept the quality section this bundle already carried \u2014 nothing replaced it.` : `Quality: ${reason}`
+    };
+  };
+  if (auditId !== void 0) requireAudit(root, auditId);
+  const auditIds = listAuditIds(root);
+  if (auditIds.length === 0) {
+    return notFolded(`none to fold \u2014 no audits under ${auditsDir(root)} (run \`arkaik kritik score\` to open one)`);
+  }
+  if (!loadProfile(root)) {
+    return notFolded(`skipped, no profile \u2014 nothing at ${profilePath(root)} (run \`arkaik kritik profile\`)`);
+  }
+  let library;
+  try {
+    ({ library } = loadKritikLibrary(root));
+  } catch (e) {
+    return notFolded(`skipped, no pack \u2014 ${e.message}`);
+  }
+  const section = auditId === void 0 ? loadCurrentQualitySection(root, library) : loadAuditQualitySection(root, auditId, library);
+  if (section === void 0) {
+    return notFolded(`nothing to fold \u2014 no audits under ${auditsDir(root)}, or no profile at ${profilePath(root)}`);
+  }
+  bundle.quality = section;
+  const count = auditId === void 0 ? auditIds.length : 1;
+  return {
+    folded: true,
+    carriedSection: false,
+    notice: `Quality: folded ${section.assessments.length} assessment(s), ${section.findings.length} finding(s) from ${count} audit(s)`
+  };
+}
+function resolveQualityRoot(cwd, filePath, root) {
+  if (root !== void 0) return resolve4(cwd, root);
+  const dir = dirname4(filePath);
+  if (basename3(dir) === "arkaik" && basename3(dirname4(dir)) === "docs") return resolve4(dir, "..", "..");
+  return cwd;
+}
+
+// src/commands/pack.ts
+var DEFAULT_BUNDLE_PATH6 = "docs/arkaik/bundle.json";
+var USAGE7 = `arkaik pack [--no-journal] [--no-quality] [--inline-assets] [--audit <id>]
+            [--root <dir>] [--out <path>] [path]
 
 Produce a single self-contained interchange bundle: fold in the sidecar
-journal (or keep an existing embedded one) and, with --inline-assets, inline
-local screenshot files as data: URIs. Written canonically via serializeBundle.
-Unknown top-level keys and unknown fields always round-trip.
+journal (or keep an existing embedded one), fold docs/quality/ into the
+quality section, and, with --inline-assets, inline local screenshot files as
+data: URIs. Written canonically via serializeBundle. Unknown top-level keys
+and unknown fields always round-trip.
 
 Arguments:
-  path              Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH5}).
+  path              Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH6}).
 
 Options:
   --no-journal      Omit the embedded journal[] (Publik-safe posture \u2014 history
@@ -17689,12 +18943,33 @@ Options:
                      interchange) \u2014 embedded wins over the sidecar when the
                      bundle already carries one, otherwise the sidecar is used
                      (same precedence "arkaik validate" folds by).
+  --no-quality      DELETE the quality section rather than folding one in \u2014
+                     not merely "skip the fold", because the source bundle may
+                     already carry a section of its own and that one goes too.
+                     For any bundle that must not travel with open findings:
+                     a finding names an unfixed vulnerability and the file to
+                     find it in. ("arkaik push" packs this way by default;
+                     its --include-quality opts back in.)
+                     Default: docs/quality/ IS folded in.
   --inline-assets   Convert relative-path metadata.platformScreenshots values
                      into data: URIs by reading the file from disk (resolved
                      against the bundle's directory). Absolute https:// URLs
                      and existing data: URIs are left as-is. v1 scope: local
                      files only \u2014 uploading a remote/hosted copy is not
                      implemented.
+  --audit <id>      Pin ONE audit's snapshot instead of the default merge.
+                     They answer different questions: the merge (every audit,
+                     latest score per criterion x surface) answers "where does
+                     the product stand", while a pinned audit answers "how did
+                     that audit go" \u2014 the question its own matrix.json
+                     answers. An id that is not on disk is an error, not an
+                     empty section.
+  --root <dir>      Where docs/quality/ lives. Default: NOT the current
+                     directory \u2014 it is derived from the bundle's own path, so
+                     packing <repo>/docs/arkaik/bundle.json folds <repo>'s
+                     audits whatever directory you run from. Only a bundle
+                     kept outside that conventional layout falls back to the
+                     cwd, and that is the case this flag is for.
   --out <path>      Write the packed bundle here instead of stdout.
   -h, --help        Show this help.`;
 function fail7(message) {
@@ -17732,7 +19007,7 @@ function fatalResult2(bundlePath, message) {
 }
 function runPack(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const filePath = resolve3(cwd, options.path ?? DEFAULT_BUNDLE_PATH5);
+  const filePath = resolve5(cwd, options.path ?? DEFAULT_BUNDLE_PATH6);
   const noJournal = options.noJournal ?? false;
   const inlineAssets = options.inlineAssets ?? false;
   let bundle;
@@ -17753,10 +19028,24 @@ function runPack(options = {}) {
       journalEventCount = events.length;
     }
   }
+  let qualityFolded;
+  let qualityNotice;
+  if (options.noQuality ?? false) {
+    delete bundle.quality;
+  } else {
+    const root = resolveQualityRoot(cwd, filePath, options.root);
+    try {
+      const fold = foldQualitySection(bundle, root, options.audit);
+      qualityFolded = fold.folded;
+      qualityNotice = fold.notice;
+    } catch (e) {
+      return fatalResult2(filePath, e.message);
+    }
+  }
   const inlinedAssets = [];
   const assetWarnings = [];
   if (inlineAssets) {
-    const bundleDir = dirname4(filePath);
+    const bundleDir = dirname5(filePath);
     const nodes = Array.isArray(bundle.nodes) ? bundle.nodes : [];
     for (const node of nodes) {
       const nodeId = typeof node.id === "string" ? node.id : "?";
@@ -17767,12 +19056,12 @@ function runPack(options = {}) {
       const map2 = screenshots;
       for (const [platform, value] of Object.entries(map2)) {
         if (typeof value !== "string" || !isRelativeAssetPath(value)) continue;
-        const assetPath = resolve3(bundleDir, value);
-        if (!existsSync5(assetPath)) {
+        const assetPath = resolve5(bundleDir, value);
+        if (!existsSync8(assetPath)) {
           assetWarnings.push(`${nodeId}/${platform}: asset not found at ${assetPath} \u2014 left as-is`);
           continue;
         }
-        const bytes = readFileSync6(assetPath);
+        const bytes = readFileSync7(assetPath);
         const mime = mimeForExtension(extname(assetPath));
         map2[platform] = `data:${mime};base64,${bytes.toString("base64")}`;
         inlinedAssets.push({ nodeId, platform, path: value });
@@ -17782,15 +19071,18 @@ function runPack(options = {}) {
   const output = serializeBundle(bundle);
   let outPath;
   if (options.out !== void 0) {
-    outPath = resolve3(cwd, options.out);
-    mkdirSync3(dirname4(outPath), { recursive: true });
-    writeFileSync5(outPath, output);
+    outPath = resolve5(cwd, options.out);
+    mkdirSync4(dirname5(outPath), { recursive: true });
+    writeFileSync6(outPath, output);
   }
-  return { ok: true, bundlePath: filePath, outPath, journalIncluded, journalEventCount, inlinedAssets, assetWarnings, output };
+  return { ok: true, bundlePath: filePath, outPath, journalIncluded, journalEventCount, inlinedAssets, assetWarnings, qualityFolded, qualityNotice, output };
 }
 function runPackCli(args) {
   let noJournal = false;
+  let noQuality = false;
   let inlineAssets = false;
+  let audit;
+  let root;
   let out;
   const positionals = [];
   for (let i = 0; i < args.length; i++) {
@@ -17800,8 +19092,22 @@ function runPackCli(args) {
       process.exit(0);
     } else if (arg === "--no-journal") {
       noJournal = true;
+    } else if (arg === "--no-quality") {
+      noQuality = true;
     } else if (arg === "--inline-assets") {
       inlineAssets = true;
+    } else if (arg === "--audit") {
+      const value = args[++i];
+      if (value === void 0) fail7(`Missing value for --audit
+
+${USAGE7}`);
+      audit = value;
+    } else if (arg === "--root") {
+      const value = args[++i];
+      if (value === void 0) fail7(`Missing value for --root
+
+${USAGE7}`);
+      root = value;
     } else if (arg === "--out") {
       const value = args[++i];
       if (value === void 0) fail7(`Missing value for --out
@@ -17816,8 +19122,13 @@ ${USAGE7}`);
       positionals.push(arg);
     }
   }
-  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH5;
-  const result = runPack({ path: filePath, out, noJournal, inlineAssets });
+  if (noQuality && audit !== void 0) {
+    fail7(`--audit and --no-quality contradict each other: one names an audit to fold, the other removes the section
+
+${USAGE7}`);
+  }
+  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH6;
+  const result = runPack({ path: filePath, out, noJournal, inlineAssets, noQuality, audit, root });
   if (!result.ok) fail7(`FATAL: ${result.fatal}`);
   if (result.journalIncluded) {
     console.error(`Journal: embedded ${result.journalEventCount} event(s)`);
@@ -17826,6 +19137,9 @@ ${USAGE7}`);
   } else {
     console.error("Journal: none to embed (no embedded journal, no sidecar)");
   }
+  if (result.qualityNotice !== void 0) {
+    console.error(result.qualityNotice);
+  }
   for (const asset of result.inlinedAssets) {
     console.error(`Inlined asset: ${asset.nodeId}/${asset.platform} (${asset.path})`);
   }
@@ -17842,10 +19156,10 @@ ${USAGE7}`);
 
 // src/commands/open.ts
 import { spawn } from "node:child_process";
-import { mkdtempSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join4, resolve as resolve4 } from "node:path";
-var DEFAULT_BUNDLE_PATH6 = "docs/arkaik/bundle.json";
+import { join as join6, resolve as resolve6 } from "node:path";
+var DEFAULT_BUNDLE_PATH7 = "docs/arkaik/bundle.json";
 var OPEN_URL = "https://arkaik.app/projects";
 var USAGE8 = `arkaik open [--out <path>] [--no-open] [path]
 
@@ -17856,7 +19170,7 @@ ${OPEN_URL} (the project list's "Import JSON" picker). On an invalid bundle,
 findings are printed and nothing is packed, written, or opened.
 
 Arguments:
-  path            Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH6}).
+  path            Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH7}).
 
 Options:
   --out <path>    Write the packed bundle here instead of a temp file.
@@ -17878,7 +19192,7 @@ function fatalResult3(bundlePath, message) {
 }
 async function runOpen(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const filePath = resolve4(cwd, options.path ?? DEFAULT_BUNDLE_PATH6);
+  const filePath = resolve6(cwd, options.path ?? DEFAULT_BUNDLE_PATH7);
   const noOpen = options.noOpen ?? false;
   let v;
   try {
@@ -17887,10 +19201,7 @@ async function runOpen(options = {}) {
     return fatalResult3(filePath, e.message);
   }
   const warningLines = v.result.warnings.map(formatFinding);
-  const errorLines = [
-    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
-    ...v.result.errors.map(formatFinding)
-  ];
+  const errorLines = [...journalLineErrorLines(v), ...v.result.errors.map(formatFinding)];
   if (!v.valid) {
     return { ok: true, bundlePath: filePath, valid: false, errorLines, warningLines, opened: false };
   }
@@ -17900,9 +19211,9 @@ async function runOpen(options = {}) {
   }
   let outPath = packed.outPath;
   if (outPath === void 0) {
-    const dir = mkdtempSync(join4(tmpdir(), "arkaik-open-"));
-    outPath = join4(dir, "bundle.json");
-    writeFileSync6(outPath, packed.output);
+    const dir = mkdtempSync(join6(tmpdir(), "arkaik-open-"));
+    outPath = join6(dir, "bundle.json");
+    writeFileSync7(outPath, packed.output);
   }
   let opened = false;
   if (!noOpen) {
@@ -17910,7 +19221,17 @@ async function runOpen(options = {}) {
     await opener(OPEN_URL);
     opened = true;
   }
-  return { ok: true, bundlePath: filePath, valid: true, errorLines, warningLines, outPath, url: OPEN_URL, opened };
+  return {
+    ok: true,
+    bundlePath: filePath,
+    valid: true,
+    errorLines,
+    warningLines,
+    outPath,
+    url: OPEN_URL,
+    opened,
+    qualityNotice: packed.qualityNotice
+  };
 }
 function runOpenCli(args) {
   let out;
@@ -17937,7 +19258,7 @@ ${USAGE8}`);
       positionals.push(arg);
     }
   }
-  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH6;
+  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH7;
   runOpen({ path: filePath, out, noOpen }).then((result) => {
     if (!result.ok) fail8(`FATAL: ${result.fatal}`);
     if (result.warningLines.length > 0) {
@@ -17950,6 +19271,9 @@ ${USAGE8}`);
       console.error("\nInvalid bundle \u2014 not packed, not opened.");
       process.exit(1);
     }
+    if (result.qualityNotice !== void 0) {
+      console.error(result.qualityNotice);
+    }
     console.log(`Packed -> ${result.outPath}`);
     if (result.opened) {
       console.log(`Opened ${result.url}`);
@@ -17961,10 +19285,10 @@ ${USAGE8}`);
 }
 
 // src/commands/push.ts
-import { resolve as resolve5 } from "node:path";
-var DEFAULT_BUNDLE_PATH7 = "docs/arkaik/bundle.json";
+import { resolve as resolve7 } from "node:path";
+var DEFAULT_BUNDLE_PATH8 = "docs/arkaik/bundle.json";
 var DEFAULT_API_BASE = "https://arkaik.app";
-var USAGE9 = `arkaik push [--include-journal] [--api <base-url>] [path]
+var USAGE9 = `arkaik push [--include-journal] [--include-quality] [--api <base-url>] [path]
 arkaik push --delete <id> --key <owner_key> [--api <base-url>]
 
 Publish a project bundle to Publik (anonymous, account-less snapshot
@@ -17978,18 +19302,29 @@ Publik-safe posture (docs/spec/journal.md). --include-journal embeds it
 (like a bare "arkaik pack") and forwards ?include_journal=true so the server
 knows to keep it.
 
+A Kritik "quality" section is stripped by default too, and separately:
+publishing your history and publishing your open findings are two decisions,
+not one, and both default to no. --include-quality opts in.
+
 Snapshots are immutable: there is no update verb. Pushing again always mints
 a new id. The owner key printed on success is shown exactly once and cannot
 be recovered \u2014 save it if you may need to delete the snapshot later.
 
 Arguments:
-  path                Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH7}).
+  path                Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH8}).
                        Ignored with --delete.
 
 Options:
   --include-journal   Embed the journal in the pushed bundle and forward
                        ?include_journal=true. Default: stripped, omitted
                        entirely from the request body.
+  --include-quality   Embed the Kritik quality section and forward
+                       ?include_quality=true. Opt-in rather than opt-out
+                       because an open finding is an unfixed vulnerability
+                       plus the path to find it in (docs/rfcs/kritik.md
+                       \xA7 8.3) \u2014 publishing that is a decision worth typing.
+                       Default: deleted before packing, so it is never in the
+                       request body at all.
   --api <base-url>    Publik API base URL (default: ${DEFAULT_API_BASE}).
                        Point at a self-hosted deployment.
   --delete <id>       Delete a snapshot by id instead of pushing. Requires
@@ -18014,8 +19349,9 @@ function fatalResult4(bundlePath, message) {
 }
 async function runPush(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const filePath = resolve5(cwd, options.path ?? DEFAULT_BUNDLE_PATH7);
+  const filePath = resolve7(cwd, options.path ?? DEFAULT_BUNDLE_PATH8);
   const includeJournal = options.includeJournal ?? false;
+  const includeQuality = options.includeQuality ?? false;
   const apiBase = options.apiBase ?? DEFAULT_API_BASE;
   const httpClient = options.httpClient ?? DEFAULT_HTTP_CLIENT;
   let v;
@@ -18025,18 +19361,19 @@ async function runPush(options = {}) {
     return fatalResult4(filePath, e.message);
   }
   const warningLines = v.result.warnings.map(formatFinding);
-  const errorLines = [
-    ...v.sidecarFindings.map((f) => `ERROR [${f.rule}] line ${f.line}: ${f.message}`),
-    ...v.result.errors.map(formatFinding)
-  ];
+  const errorLines = [...journalLineErrorLines(v), ...v.result.errors.map(formatFinding)];
   if (!v.valid) {
     return { ok: true, bundlePath: filePath, valid: false, errorLines, warningLines, requestSent: false };
   }
-  const packed = runPack({ path: filePath, noJournal: !includeJournal, cwd });
+  const packed = runPack({ path: filePath, noJournal: !includeJournal, noQuality: !includeQuality, cwd });
   if (!packed.ok) {
     return fatalResult4(filePath, packed.fatal ?? "pack failed");
   }
-  const url2 = `${apiBase}/api/publik${includeJournal ? "?include_journal=true" : ""}`;
+  const qualityNotice = packed.qualityNotice ?? "Quality: stripped, not sent (pass --include-quality to publish it)";
+  const params = [];
+  if (includeJournal) params.push("include_journal=true");
+  if (includeQuality) params.push("include_quality=true");
+  const url2 = `${apiBase}/api/publik${params.length > 0 ? `?${params.join("&")}` : ""}`;
   let res;
   try {
     res = await httpClient(url2, {
@@ -18066,6 +19403,7 @@ async function runPush(options = {}) {
       warningLines,
       requestSent: true,
       status,
+      qualityNotice,
       id: body.id,
       url: body.url,
       ownerKey: body.owner_key
@@ -18084,6 +19422,7 @@ async function runPush(options = {}) {
     warningLines,
     requestSent: true,
     status,
+    qualityNotice,
     serverFindings: errBody.findings,
     retryAfter: status === 429 ? res.headers.get("retry-after") : void 0,
     errorMessage: errBody.message ?? `Request failed with status ${status}`
@@ -18094,6 +19433,9 @@ function reportPush(result) {
     console.error(`Warnings: ${result.warningLines.length}`);
     result.warningLines.forEach((w) => console.error(`  ${w}`));
   }
+  if (result.qualityNotice !== void 0) {
+    console.error(result.qualityNotice);
+  }
   if (!result.valid) {
     console.error(`Errors: ${result.errorLines.length}`);
     result.errorLines.forEach((e) => console.error(`  ${e}`));
@@ -18175,6 +19517,7 @@ function reportDelete(id, result) {
 }
 function runPushCli(args) {
   let includeJournal = false;
+  let includeQuality = false;
   let apiBase;
   let deleteId;
   let key;
@@ -18186,6 +19529,8 @@ function runPushCli(args) {
       process.exit(0);
     } else if (arg === "--include-journal") {
       includeJournal = true;
+    } else if (arg === "--include-quality") {
+      includeQuality = true;
     } else if (arg === "--api") {
       const value = args[++i];
       if (value === void 0) fail9(`Missing value for --api
@@ -18227,16 +19572,16 @@ ${USAGE9}`);
   if (key !== void 0) fail9(`--key is only valid with --delete
 
 ${USAGE9}`);
-  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH7;
-  runPush({ path: filePath, includeJournal, apiBase }).then((result) => {
+  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH8;
+  runPush({ path: filePath, includeJournal, includeQuality, apiBase }).then((result) => {
     if (!result.ok) fail9(`FATAL: ${result.fatal}`);
     reportPush(result);
   }).catch((e) => fail9(`FATAL: ${e.message}`));
 }
 
 // src/commands/link.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname5, join as join5, resolve as resolve6 } from "node:path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname6, join as join7, resolve as resolve8 } from "node:path";
 var LINK_FILE = "docs/arkaik/arkaik.json";
 var DEFAULT_BASE_URL = "https://arkaik.app";
 var USAGE10 = `arkaik link \u2014 point this repo at a hosted Arkaik project
@@ -18307,15 +19652,15 @@ async function runLink(argv, options = {}) {
     return { ok: false };
   }
   const { bundle } = await res.json();
-  const target = resolve6(cwd, argv.find((a) => !a.startsWith("--") && a !== projectId && a !== baseUrl) ?? ".");
-  const linkPath = join5(target, LINK_FILE);
-  mkdirSync4(dirname5(linkPath), { recursive: true });
+  const target = resolve8(cwd, argv.find((a) => !a.startsWith("--") && a !== projectId && a !== baseUrl) ?? ".");
+  const linkPath = join7(target, LINK_FILE);
+  mkdirSync5(dirname6(linkPath), { recursive: true });
   let existing = {};
   try {
-    existing = JSON.parse(readFileSync7(linkPath, "utf8"));
+    existing = JSON.parse(readFileSync8(linkPath, "utf8"));
   } catch {
   }
-  writeFileSync7(
+  writeFileSync8(
     linkPath,
     `${JSON.stringify({ ...existing, project_id: projectId, remote: baseUrl }, null, 2)}
 `
@@ -18342,14 +19687,15 @@ function runLinkCli(argv) {
 }
 
 // src/commands/restore.ts
-import { existsSync as existsSync6, linkSync, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join6, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync9, linkSync, mkdirSync as mkdirSync6, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join8, resolve as resolve9 } from "node:path";
 var LINK_FILE2 = "docs/arkaik/arkaik.json";
-var DEFAULT_BUNDLE_PATH8 = "docs/arkaik/bundle.json";
+var DEFAULT_BUNDLE_PATH9 = "docs/arkaik/bundle.json";
 var DEFAULT_API_BASE2 = "https://arkaik.app";
 var USAGE11 = `arkaik restore [options] [path]
 
-Replace the linked hosted project's bundle AND journal with a local bundle \u2014
+Replace the linked hosted project's bundle, journal AND quality section with
+a local bundle \u2014
 the landing step for a bootstrapped map. Before sending anything, this
 exports the CURRENT hosted state (snapshot + journal) to
 docs/arkaik/.backups/<timestamp>-bundle.json (next to the link file \u2014 not
@@ -18359,9 +19705,10 @@ only way back if the restore turns out to be wrong.
 
 Arguments:
   path                Path to the local bundle JSON file
-                       (default: ${DEFAULT_BUNDLE_PATH8}). Its journal.jsonl
+                       (default: ${DEFAULT_BUNDLE_PATH9}). Its journal.jsonl
                        sidecar (or an embedded journal, which wins) is folded
-                       in automatically.
+                       in automatically, as is the docs/quality/ tree of the
+                       repo that bundle belongs to.
 
 Options:
   --dry-run             Ask the server what this restore WOULD do and print
@@ -18374,6 +19721,32 @@ Options:
                         means a missing/gitignored journal.jsonl or a bundle
                         from the wrong directory, not an intended history
                         rewrite.
+  --allow-deletions     Proceed even though the local bundle drops nodes or
+                        edges the hosted project currently has. Without this
+                        flag, that refuses outright and names the ids \u2014 it
+                        usually means the hosted project moved ahead of your
+                        local copy (edited in the app), not an intended
+                        deletion. Undoing a restore from a backup is the
+                        common case where it IS intended.
+  --no-quality          Do not send a quality section: skip the docs/quality/
+                        fold AND drop any section the local bundle already
+                        carries. Does NOT by itself permit erasing the hosted
+                        one \u2014 that needs --allow-quality-loss too, because
+                        "don't send mine" and "destroy theirs" are different
+                        decisions and only one of them is irreversible.
+  --allow-quality-loss  Proceed even though the restore would erase a quality
+                        section the hosted project currently has. Without this
+                        flag, that refuses outright \u2014 it usually means
+                        docs/quality/ was looked for in the wrong place, which
+                        --root fixes, rather than an intended wipe.
+  --audit <id>          Fold ONE audit's snapshot rather than merging every
+                        audit into current state. An id that is not on disk is
+                        an error, not an empty section.
+  --root <dir>          Where docs/quality/ lives. Default: derived from the
+                        bundle's own path, so restoring <repo>/docs/arkaik/
+                        bundle.json folds <repo>'s audits whatever directory
+                        you run from; only a bundle kept outside that layout
+                        falls back to the cwd.
   --api <base-url>      Override the remote from docs/arkaik/arkaik.json
                         (also overridable with $ARKAIK_URL).
   -h, --help            Show this help.
@@ -18386,8 +19759,8 @@ function fail10(message) {
   console.error(message);
   process.exit(1);
 }
-function fatalResult5(dryRun, message) {
-  return { ok: false, fatal: message, dryRun, requestSent: false };
+function fatalResult5(dryRun, message, quality = {}) {
+  return { ok: false, fatal: message, dryRun, requestSent: false, ...quality };
 }
 async function safeJson(res) {
   try {
@@ -18413,7 +19786,9 @@ async function interpretPutResponse(res, ctx) {
     bundlePath: ctx.bundlePath,
     backupPath: ctx.backupPath,
     requestSent: true,
-    status: res.status
+    status: res.status,
+    qualityFolded: ctx.qualityFolded,
+    qualityNotice: ctx.qualityNotice
   };
   const backupNote = backupNoteFor(ctx.backupPath);
   if (res.status === 200) {
@@ -18477,26 +19852,91 @@ async function interpretPutResponse(res, ctx) {
 }
 function writeBackupFile(filePath, content) {
   const tmpPath = `${filePath}.tmp-${process.pid}`;
-  writeFileSync8(tmpPath, content);
+  writeFileSync9(tmpPath, content);
   try {
     linkSync(tmpPath, filePath);
   } finally {
     unlinkSync(tmpPath);
   }
 }
+function removedIds(before, after) {
+  const kept = /* @__PURE__ */ new Set();
+  for (const item of after) {
+    const id = item?.id;
+    if (typeof id === "string") kept.add(id);
+  }
+  const removed = [];
+  for (const item of before) {
+    const id = item?.id;
+    if (typeof id === "string" && !kept.has(id)) removed.push(id);
+  }
+  return removed;
+}
+function listIds(ids, limit = 10) {
+  if (ids.length <= limit) return ids.join(", ");
+  return `${ids.slice(0, limit).join(", ")}, and ${ids.length - limit} more`;
+}
+function describeDeletions(removedNodes, removedEdges, bundlePath) {
+  const parts = [];
+  if (removedNodes.length > 0) parts.push(`${removedNodes.length} node${removedNodes.length === 1 ? "" : "s"}`);
+  if (removedEdges.length > 0) parts.push(`${removedEdges.length} edge${removedEdges.length === 1 ? "" : "s"}`);
+  const lines = [
+    `This restore would DELETE ${parts.join(" and ")} the hosted project currently has and ${bundlePath} does not. Nothing was sent.`
+  ];
+  if (removedNodes.length > 0) lines.push(`  nodes: ${listIds(removedNodes)}`);
+  if (removedEdges.length > 0) lines.push(`  edges: ${listIds(removedEdges)}`);
+  lines.push(
+    `Usually this means the hosted project moved ahead of your local copy (someone edited it in the app) and the local bundle is the stale side \u2014 not that you meant to delete anything. Adopt the hosted state locally first: \`GET /api/graph/projects/<id>/export\` is what answers "what am I about to overwrite".`
+  );
+  lines.push(
+    `If the deletions really are intended \u2014 undoing an earlier restore from a backup legitimately removes what that restore added \u2014 re-run with --allow-deletions.`
+  );
+  return lines.join("\n");
+}
+function describeQualityLoss(hostedQuality, qualityRoot, noQuality, foldNotice) {
+  const findings = Array.isArray(hostedQuality.findings) ? hostedQuality.findings.length : 0;
+  const assessments = Array.isArray(hostedQuality.assessments) ? hostedQuality.assessments.length : 0;
+  const parts = [];
+  if (findings > 0) parts.push(`${findings} open finding${findings === 1 ? "" : "s"}`);
+  if (assessments > 0) parts.push(`${assessments} assessment${assessments === 1 ? "" : "s"}`);
+  const held = parts.length > 0 ? parts.join(" and ") : "no findings or assessments";
+  const lines = [
+    `This restore would ERASE the hosted project's quality section (${held}). Nothing was sent.`
+  ];
+  if (noQuality) {
+    lines.push(
+      `You passed --no-quality, which says "do not send my quality data" \u2014 not "destroy what is already there". Those are different decisions, and this verb has no server-side undo, so the second one has to be typed: re-run with --allow-quality-loss as well if you really mean to wipe it.`
+    );
+  } else {
+    if (foldNotice !== void 0) {
+      lines.push("The outbound bundle has no section because the fold found nothing to build one from:");
+      lines.push(`  ${foldNotice}`);
+    }
+    if (!existsSync9(join8(qualityRoot, QUALITY_DIR))) {
+      lines.push(
+        `There is no ${QUALITY_DIR}/ under ${qualityRoot} at all. If this project's sidecars live somewhere else, point --root at that repo and the section is rebuilt rather than removed.`
+      );
+    }
+    lines.push(`If the hosted section really is meant to go, re-run with --allow-quality-loss.`);
+  }
+  return lines.join("\n");
+}
 async function runRestore(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const env = options.env ?? process.env;
   const dryRun = options.dryRun ?? false;
   const allowHistoryLoss = options.allowHistoryLoss ?? false;
+  const allowDeletions = options.allowDeletions ?? false;
+  const noQuality = options.noQuality ?? false;
+  const allowQualityLoss = options.allowQualityLoss ?? false;
   const httpClient = options.httpClient ?? DEFAULT_HTTP_CLIENT;
-  const linkPath = join6(cwd, LINK_FILE2);
-  if (!existsSync6(linkPath)) {
+  const linkPath = join8(cwd, LINK_FILE2);
+  if (!existsSync9(linkPath)) {
     return fatalResult5(dryRun, `No ${LINK_FILE2}. Run \`arkaik link\` first \u2014 restore only targets hosted projects.`);
   }
   let link;
   try {
-    link = JSON.parse(readFileSync8(linkPath, "utf8"));
+    link = JSON.parse(readFileSync9(linkPath, "utf8"));
   } catch (e) {
     return fatalResult5(dryRun, `Could not parse ${LINK_FILE2}: ${e.message}`);
   }
@@ -18506,11 +19946,11 @@ async function runRestore(options = {}) {
   const encodedProjectId = encodeURIComponent(projectId);
   const token = env.ARKAIK_TOKEN;
   if (!token) return fatalResult5(dryRun, `ARKAIK_TOKEN is not set. Create a token at ${baseUrl}/settings/tokens and export it.`);
-  const bundlePath = resolve7(cwd, options.path ?? DEFAULT_BUNDLE_PATH8);
-  if (!existsSync6(bundlePath)) return fatalResult5(dryRun, `No bundle at ${bundlePath}. Run \`arkaik merge\` (or \`arkaik pack\`) first.`);
+  const bundlePath = resolve9(cwd, options.path ?? DEFAULT_BUNDLE_PATH9);
+  if (!existsSync9(bundlePath)) return fatalResult5(dryRun, `No bundle at ${bundlePath}. Run \`arkaik merge\` (or \`arkaik pack\`) first.`);
   let localRaw;
   try {
-    localRaw = JSON.parse(readFileSync8(bundlePath, "utf8"));
+    localRaw = JSON.parse(readFileSync9(bundlePath, "utf8"));
   } catch (e) {
     return fatalResult5(dryRun, `Could not parse ${bundlePath}: ${e.message}`);
   }
@@ -18520,6 +19960,22 @@ async function runRestore(options = {}) {
   const local = localRaw;
   const journalEvents = loadJournalEvents(local, bundlePath);
   const outboundBundle = { ...local, journal: journalEvents };
+  const qualityRoot = resolveQualityRoot(cwd, bundlePath, options.root);
+  let qualityFolded = false;
+  let qualityNotice;
+  if (noQuality) {
+    delete outboundBundle.quality;
+    qualityNotice = "Quality: deleted before sending (--no-quality)";
+  } else {
+    try {
+      const fold = foldQualitySection(outboundBundle, qualityRoot, options.audit);
+      qualityFolded = fold.folded;
+      qualityNotice = fold.notice;
+    } catch (e) {
+      return fatalResult5(dryRun, e.message);
+    }
+  }
+  const qualityFields = { qualityFolded, qualityNotice };
   const headers = { Authorization: `Bearer ${token}` };
   let version2;
   try {
@@ -18548,7 +20004,7 @@ async function runRestore(options = {}) {
     } catch (e) {
       return { ok: true, dryRun, bundlePath, requestSent: false, errorMessage: `Network error: ${e.message}` };
     }
-    return interpretPutResponse(res2, { dryRun, bundlePath, version: version2 });
+    return interpretPutResponse(res2, { dryRun, bundlePath, version: version2, ...qualityFields });
   }
   let exported;
   try {
@@ -18575,23 +20031,34 @@ async function runRestore(options = {}) {
   if (journalEvents.length < hostedEventCount && !allowHistoryLoss) {
     return fatalResult5(
       dryRun,
-      `This restore would replace ${hostedEventCount} hosted journal events with ${journalEvents.length}. Nothing was sent. If that is intended, re-run with --allow-history-loss; otherwise check that ${journalPathFor(bundlePath)} exists and is current.`
+      `This restore would replace ${hostedEventCount} hosted journal events with ${journalEvents.length}. Nothing was sent. If that is intended, re-run with --allow-history-loss; otherwise check that ${journalPathFor(bundlePath)} exists and is current.`,
+      qualityFields
     );
   }
-  const backupDir = join6(cwd, "docs", "arkaik", ".backups");
+  const hostedQuality = exportedBundle.quality;
+  if (isQualitySection(hostedQuality) && !isQualitySection(outboundBundle.quality) && !allowQualityLoss) {
+    return fatalResult5(dryRun, describeQualityLoss(hostedQuality, qualityRoot, noQuality, qualityNotice), qualityFields);
+  }
+  const removedNodes = removedIds(exportedBundle.nodes, Array.isArray(local.nodes) ? local.nodes : []);
+  const removedEdges = removedIds(exportedBundle.edges, Array.isArray(local.edges) ? local.edges : []);
+  if ((removedNodes.length > 0 || removedEdges.length > 0) && !allowDeletions) {
+    return fatalResult5(dryRun, describeDeletions(removedNodes, removedEdges, bundlePath), qualityFields);
+  }
+  const backupDir = join8(cwd, "docs", "arkaik", ".backups");
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupPath = join6(backupDir, `${stamp}-bundle.json`);
+  const backupPath = join8(backupDir, `${stamp}-bundle.json`);
   const backupContent = `${JSON.stringify(exported, null, 2)}
 `;
   try {
-    mkdirSync5(backupDir, { recursive: true });
+    mkdirSync6(backupDir, { recursive: true });
     writeBackupFile(backupPath, backupContent);
-    JSON.parse(readFileSync8(backupPath, "utf8"));
+    JSON.parse(readFileSync9(backupPath, "utf8"));
   } catch (e) {
     return fatalResult5(
       dryRun,
       `Could not write the pre-restore backup to ${backupPath}: ${e.message}
-Refusing to restore \u2014 this verb replaces the hosted project's snapshot AND journal, and the backup is the only way back.`
+Refusing to restore \u2014 this verb replaces the hosted project's snapshot AND journal, and the backup is the only way back.`,
+      qualityFields
     );
   }
   let res;
@@ -18611,7 +20078,7 @@ Refusing to restore \u2014 this verb replaces the hosted project's snapshot AND
       errorMessage: `Network error: ${e.message}. Nothing was sent.${backupNoteFor(backupPath)}`
     };
   }
-  return interpretPutResponse(res, { dryRun, bundlePath, backupPath, version: version2 });
+  return interpretPutResponse(res, { dryRun, bundlePath, backupPath, version: version2, ...qualityFields });
 }
 function printDelta(delta) {
   if (!delta) return;
@@ -18625,12 +20092,26 @@ function printDelta(delta) {
   console.log(
     `  events ${n("eventsBefore")} -> ${n("eventsAfter")}  (+${n("eventsAdded")} -${n("eventsDropped")} ~${n("eventsChanged")}${delta.eventsMalformed ? `, ${delta.eventsMalformed} malformed` : ""})`
   );
+  const count = (k) => typeof delta[k] === "number" ? delta[k] : 0;
+  const nodesRemoved = count("nodesRemoved");
+  const edgesRemoved = count("edgesRemoved");
+  if (nodesRemoved > 0 || edgesRemoved > 0) {
+    const parts = [];
+    if (nodesRemoved > 0) parts.push(`${nodesRemoved} node${nodesRemoved === 1 ? "" : "s"}`);
+    if (edgesRemoved > 0) parts.push(`${edgesRemoved} edge${edgesRemoved === 1 ? "" : "s"}`);
+    console.log(
+      `  WARNING: this DELETES ${parts.join(" and ")} from the hosted project. Bootstrap never deletes \u2014 check the hosted project has not moved ahead of your local bundle.`
+    );
+  }
 }
 function reportRestore(result) {
   if (!result.ok) fail10(`FATAL: ${result.fatal}`);
   if (result.backupPath) {
     console.log(`Backed up the current hosted project (snapshot + journal) to ${result.backupPath}`);
   }
+  if (result.qualityNotice !== void 0) {
+    console.log(result.qualityNotice);
+  }
   if (!result.requestSent) {
     console.error(result.errorMessage ?? "Restore failed before a request could be sent.");
     process.exit(1);
@@ -18639,7 +20120,9 @@ function reportRestore(result) {
     if (result.dryRun) {
       console.log("[dry-run] server preview \u2014 nothing was written:");
       printDelta(result.delta);
-      console.log("Re-run without --dry-run to apply \u2014 that run takes the backup.");
+      console.log(
+        "Re-run without --dry-run to apply \u2014 that run takes the backup, and only that run checks the history, deletion and quality-loss guards (all three read the export, which a dry run never fetches)."
+      );
     } else {
       console.log(`Restored. New version ${result.version}.`);
       printDelta(result.delta);
@@ -18659,6 +20142,11 @@ function reportRestore(result) {
 function runRestoreCli(argv) {
   let dryRun = false;
   let allowHistoryLoss = false;
+  let allowDeletions = false;
+  let noQuality = false;
+  let allowQualityLoss = false;
+  let audit;
+  let root;
   let apiBase;
   const positionals = [];
   for (let i = 0; i < argv.length; i++) {
@@ -18671,6 +20159,24 @@ function runRestoreCli(argv) {
       dryRun = true;
     } else if (arg === "--allow-history-loss") {
       allowHistoryLoss = true;
+    } else if (arg === "--allow-deletions") {
+      allowDeletions = true;
+    } else if (arg === "--no-quality") {
+      noQuality = true;
+    } else if (arg === "--allow-quality-loss") {
+      allowQualityLoss = true;
+    } else if (arg === "--audit") {
+      const value = argv[++i];
+      if (value === void 0) fail10(`Missing value for --audit
+
+${USAGE11}`);
+      audit = value;
+    } else if (arg === "--root") {
+      const value = argv[++i];
+      if (value === void 0) fail10(`Missing value for --root
+
+${USAGE11}`);
+      root = value;
     } else if (arg === "--api") {
       const value = argv[++i];
       if (value === void 0) fail10(`Missing value for --api
@@ -18688,28 +20194,33 @@ ${USAGE11}`);
   if (positionals.length > 1) fail10(`Unexpected argument(s): ${positionals.slice(1).join(" ")}
 
 ${USAGE11}`);
-  runRestore({ path: positionals[0], dryRun, allowHistoryLoss, apiBase }).then((result) => reportRestore(result)).catch((e) => fail10(`FATAL: ${e.message}`));
+  if (noQuality && audit !== void 0) {
+    fail10(`--audit and --no-quality contradict each other: one names an audit to fold, the other removes the section
+
+${USAGE11}`);
+  }
+  runRestore({ path: positionals[0], dryRun, allowHistoryLoss, allowDeletions, noQuality, allowQualityLoss, audit, root, apiBase }).then((result) => reportRestore(result)).catch((e) => fail10(`FATAL: ${e.message}`));
 }
 
 // src/commands/bootstrap.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, renameSync, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, renameSync, writeFileSync as writeFileSync13 } from "node:fs";
 import path5 from "node:path";
 
 // src/lib/bootstrap/corpus.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "node:fs";
 import path2 from "node:path";
 
 // src/lib/bootstrap/paths.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import path from "node:path";
 var BOOTSTRAP_ROOT = ".arkaik";
 var CORPUS_DIR = ".arkaik/corpus";
 var PLAN_DIR = ".arkaik/bootstrap";
 var FRAGMENTS_DIR = ".arkaik/bootstrap/fragments";
 var MANIFEST_FILE = ".arkaik/bootstrap/manifest.json";
-var PROFILE_FILE = ".arkaik/bootstrap/profile.json";
+var PROFILE_FILE2 = ".arkaik/bootstrap/profile.json";
 var PRS_FILE = ".arkaik/corpus/prs.jsonl";
 var DOCS_FILE = ".arkaik/corpus/docs.json";
 var SURFACES_FILE = ".arkaik/corpus/surfaces.json";
@@ -18717,16 +20228,16 @@ function at(cwd, relative) {
   return path.join(cwd, relative);
 }
 function ensureDir(dirPath) {
-  mkdirSync6(dirPath, { recursive: true });
+  mkdirSync7(dirPath, { recursive: true });
 }
 function ensureGitignored(cwd) {
   const file2 = path.join(cwd, ".gitignore");
   const line2 = `${BOOTSTRAP_ROOT}/`;
-  const current = existsSync7(file2) ? readFileSync9(file2, "utf8") : "";
+  const current = existsSync10(file2) ? readFileSync10(file2, "utf8") : "";
   const ignored = current.split("\n").map((l) => l.trim()).some((l) => l === line2 || l === BOOTSTRAP_ROOT);
   if (ignored) return false;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
-  writeFileSync9(file2, `${current}${prefix}${line2}
+  writeFileSync10(file2, `${current}${prefix}${line2}
 `);
   return true;
 }
@@ -18823,7 +20334,7 @@ function fetchPrsViaGit(cwd) {
 function walk(root, cwd, out) {
   let entries;
   try {
-    entries = readdirSync(root, { withFileTypes: true });
+    entries = readdirSync3(root, { withFileTypes: true });
   } catch {
     return;
   }
@@ -18841,7 +20352,7 @@ function listFiles(cwd) {
 }
 function buildDocsManifest(cwd, files) {
   return files.filter((f) => f.startsWith("docs/") && f.endsWith(".md")).map((f) => {
-    const text = readFileSync10(path2.join(cwd, f), "utf8");
+    const text = readFileSync11(path2.join(cwd, f), "utf8");
     const heading = /^#\s+(.+)$/m.exec(text);
     return { path: f, title: heading ? heading[1].trim() : path2.basename(f, ".md") };
   });
@@ -18856,7 +20367,7 @@ function buildSurfaceInventory(files) {
 }
 function buildCorpus(options) {
   const { cwd } = options;
-  const raw = options.fromJson ? JSON.parse(readFileSync10(path2.resolve(cwd, options.fromJson), "utf8")) : options.fromGit ? fetchPrsViaGit(cwd) : fetchPrsViaGh(cwd, options.limit);
+  const raw = options.fromJson ? JSON.parse(readFileSync11(path2.resolve(cwd, options.fromJson), "utf8")) : options.fromGit ? fetchPrsViaGit(cwd) : fetchPrsViaGh(cwd, options.limit);
   let prs = normalizePrs(raw);
   let sinceDroppedUndated = 0;
   if (options.since) {
@@ -18877,21 +20388,21 @@ function buildCorpus(options) {
   const docs = buildDocsManifest(cwd, files);
   const surfaces = buildSurfaceInventory(files);
   ensureDir(at(cwd, CORPUS_DIR));
-  writeFileSync10(at(cwd, PRS_FILE), prs.map((pr) => JSON.stringify(pr)).join("\n") + (prs.length ? "\n" : ""));
-  writeFileSync10(at(cwd, DOCS_FILE), `${JSON.stringify(docs, null, 2)}
+  writeFileSync11(at(cwd, PRS_FILE), prs.map((pr) => JSON.stringify(pr)).join("\n") + (prs.length ? "\n" : ""));
+  writeFileSync11(at(cwd, DOCS_FILE), `${JSON.stringify(docs, null, 2)}
 `);
-  writeFileSync10(at(cwd, SURFACES_FILE), `${JSON.stringify(surfaces, null, 2)}
+  writeFileSync11(at(cwd, SURFACES_FILE), `${JSON.stringify(surfaces, null, 2)}
 `);
   return { prs: prs.length, docs: docs.length, surfaces: surfaces.length, sinceDroppedUndated };
 }
 function readCorpusPrs(cwd) {
   const file2 = at(cwd, PRS_FILE);
-  if (!existsSync8(file2)) return [];
-  return readFileSync10(file2, "utf8").split("\n").filter(Boolean).map((line2) => JSON.parse(line2));
+  if (!existsSync11(file2)) return [];
+  return readFileSync11(file2, "utf8").split("\n").filter(Boolean).map((line2) => JSON.parse(line2));
 }
 
 // src/lib/bootstrap/fragments.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
 import path3 from "node:path";
 function isArrayOfObjects(value) {
   return value === void 0 || Array.isArray(value) && value.every((v) => typeof v === "object" && v !== null && !Array.isArray(v));
@@ -18917,13 +20428,13 @@ function loadFragments(cwd, manifest) {
       problems.push({ unit: String(unit2.id), message: err instanceof Error ? err.message : String(err) });
       continue;
     }
-    if (!existsSync9(file2)) {
+    if (!existsSync12(file2)) {
       missing.push(unit2.id);
       continue;
     }
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync11(file2, "utf8"));
+      parsed = JSON.parse(readFileSync12(file2, "utf8"));
     } catch (err) {
       problems.push({ unit: unit2.id, message: `not valid JSON: ${err instanceof Error ? err.message : "parse error"}` });
       continue;
@@ -18960,7 +20471,7 @@ function renderIndex(bundle) {
 }
 
 // src/lib/bootstrap/manifest.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "node:fs";
 import path4 from "node:path";
 
 // src/lib/bootstrap/era-window.ts
@@ -19068,19 +20579,19 @@ function assertValidProfile(profile) {
 
 // src/lib/bootstrap/manifest.ts
 function readProfile(cwd) {
-  const file2 = at(cwd, PROFILE_FILE);
-  if (!existsSync10(file2)) return null;
+  const file2 = at(cwd, PROFILE_FILE2);
+  if (!existsSync13(file2)) return null;
   try {
-    return JSON.parse(readFileSync12(file2, "utf8"));
+    return JSON.parse(readFileSync13(file2, "utf8"));
   } catch (err) {
-    throw new Error(`cannot read ${PROFILE_FILE}: ${err instanceof Error ? err.message : String(err)}`);
+    throw new Error(`cannot read ${PROFILE_FILE2}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function readManifest(cwd) {
   const file2 = at(cwd, MANIFEST_FILE);
-  if (!existsSync10(file2)) return null;
+  if (!existsSync13(file2)) return null;
   try {
-    return JSON.parse(readFileSync12(file2, "utf8"));
+    return JSON.parse(readFileSync13(file2, "utf8"));
   } catch (err) {
     throw new Error(`cannot read ${MANIFEST_FILE}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -19088,15 +20599,15 @@ function readManifest(cwd) {
 function writeManifest(cwd, manifest) {
   ensureDir(at(cwd, PLAN_DIR));
   ensureDir(at(cwd, FRAGMENTS_DIR));
-  writeFileSync11(at(cwd, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync12(at(cwd, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
 }
 function detectMode(cwd, bundlePath) {
   const file2 = path4.resolve(cwd, bundlePath);
-  if (!existsSync10(file2)) return "greenfield";
+  if (!existsSync13(file2)) return "greenfield";
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(file2, "utf8"));
+    parsed = JSON.parse(readFileSync13(file2, "utf8"));
   } catch (err) {
     throw new Error(`cannot read bundle at ${bundlePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -19320,7 +20831,7 @@ function mergeJournal(base, fresh) {
 }
 
 // src/lib/bootstrap/merge.ts
-function asArray(value) {
+function asArray2(value) {
   return Array.isArray(value) ? value : [];
 }
 function mergeFragments(input) {
@@ -19328,14 +20839,14 @@ function mergeFragments(input) {
   const projectId = String(input.base.project?.id ?? "");
   const nodes = /* @__PURE__ */ new Map();
   const nodeOrigin = /* @__PURE__ */ new Map();
-  for (const node of asArray(input.base.nodes)) {
+  for (const node of asArray2(input.base.nodes)) {
     const id = String(node.id);
     nodes.set(id, { ...node });
     nodeOrigin.set(id, "(already in the bundle)");
   }
   const edges = /* @__PURE__ */ new Map();
   const edgeOrigin = /* @__PURE__ */ new Map();
-  for (const edge of asArray(input.base.edges)) {
+  for (const edge of asArray2(input.base.edges)) {
     const id = String(edge.id ?? edgeId(String(edge.source_id), String(edge.target_id)));
     edges.set(id, { ...edge });
     edgeOrigin.set(id, "(already in the bundle)");
@@ -19549,7 +21060,7 @@ function mergeFragments(input) {
 }
 
 // src/lib/bootstrap/slice.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
 
 // src/lib/bootstrap/body-budget.ts
 var LAB_NOTE_HEADING_RE = /^##\s+Lab Note.*$/m;
@@ -19591,8 +21102,8 @@ function boundBody(body) {
 
 // src/lib/bootstrap/slice.ts
 function readJsonArray(file2) {
-  if (!existsSync11(file2)) return [];
-  const parsed = JSON.parse(readFileSync13(file2, "utf8"));
+  if (!existsSync14(file2)) return [];
+  const parsed = JSON.parse(readFileSync14(file2, "utf8"));
   return Array.isArray(parsed) ? parsed : [];
 }
 function toPosix(value) {
@@ -19613,7 +21124,7 @@ function eraWindows(cwd, slugs) {
     const era = bySlug.get(slug);
     if (!era) {
       throw new Error(
-        `era "${slug}" is not declared in ${PROFILE_FILE}'s "eras" list, but a work unit's slice references it. profile.json may have been edited (or the era removed) since \`arkaik bootstrap plan\` last ran. Restore the era in profile.json and re-run \`arkaik bootstrap plan\`, or reconcile the manifest by hand.`
+        `era "${slug}" is not declared in ${PROFILE_FILE2}'s "eras" list, but a work unit's slice references it. profile.json may have been edited (or the era removed) since \`arkaik bootstrap plan\` last ran. Restore the era in profile.json and re-run \`arkaik bootstrap plan\`, or reconcile the manifest by hand.`
       );
     }
     assertEraWindow(era);
@@ -19702,7 +21213,7 @@ ${usage}`);
 }
 function writeFileAtomic(filePath, content) {
   const tmpPath = `${filePath}.tmp-${process.pid}`;
-  writeFileSync12(tmpPath, content);
+  writeFileSync13(tmpPath, content);
   renameSync(tmpPath, filePath);
 }
 function runCorpus(argv) {
@@ -19737,7 +21248,7 @@ ${CORPUS_USAGE}`);
 ${CORPUS_USAGE}`);
     }
   }
-  if (!existsSync12(path5.join(cwd, ".git"))) {
+  if (!existsSync15(path5.join(cwd, ".git"))) {
     fail11("`arkaik bootstrap corpus` must run from the repository root (no .git here).");
   }
   try {
@@ -19799,7 +21310,7 @@ ${PLAN_USAGE}`);
 
 ${PLAN_USAGE}`);
   }
-  if (!existsSync12(path5.join(cwd, ".git"))) {
+  if (!existsSync15(path5.join(cwd, ".git"))) {
     fail11("`arkaik bootstrap plan` must run from the repository root (no .git here).");
   }
   try {
@@ -19938,7 +21449,7 @@ ${MERGE_USAGE}`);
   }
   try {
     const bundlePath = path5.resolve(cwd, manifest.bundle);
-    const base = existsSync12(bundlePath) ? readBundle(bundlePath) : {
+    const base = existsSync15(bundlePath) ? readBundle(bundlePath) : {
       schema_version: 3,
       project: {
         id: path5.basename(cwd),
@@ -19974,7 +21485,7 @@ ${MERGE_USAGE}`);
     const journalPath = journalPathFor(bundlePath);
     const journalText = result.journal.map((e) => JSON.stringify(e)).join("\n") + (result.journal.length ? "\n" : "");
     if (!dryRun) {
-      mkdirSync7(path5.dirname(bundlePath), { recursive: true });
+      mkdirSync8(path5.dirname(bundlePath), { recursive: true });
       writeFileAtomic(bundlePath, serialized);
       writeFileAtomic(journalPath, journalText);
     }
@@ -20023,8 +21534,1039 @@ ${USAGE12}`);
   }
 }
 
+// ../schema/src/cli/kritik-overlay.ts
+var ANCHOR_KEYS = ["l0", "l1", "l2", "l3", "l4"];
+var CRITERION_TEMPLATE = {
+  id: "X-01",
+  domain: "ARC",
+  subcategory: "conventions",
+  name: "Short criterion name",
+  question: "The criterion as one question an auditor can actually answer?",
+  definition: "What good looks like on this surface, concretely.",
+  rationale: "Why this matters for this product in particular.",
+  applies_to: ["web"],
+  level_anchors: {
+    l0: "Not addressed at all.",
+    l1: "Addressed accidentally or in one spot; no visible intent.",
+    l2: "Deliberately addressed; visible intent; known gaps.",
+    l3: "Systematic across the surface; tested or reviewed.",
+    l4: "Enforced by automation or a CI gate; drift is detected, not hoped against."
+  },
+  default_impact: 3,
+  weight: 1,
+  references: [],
+  checklist: ["The grep, file, or flow an auditor should actually run."],
+  signals: ["A check that can run between audits and fail mechanically."],
+  remediation: "The typical fix path.",
+  issue: {
+    title_template: "[Quality] X-01 <name> at level {observed_level} on {surface} (target {target_level})",
+    labels: ["quality"],
+    body_skeleton: "## Quality finding: X-01 <name>\n\n**Surface:** {surface}\n**Observed level:** {observed_level}\n**Target level:** {target_level}\n\n### Evidence\n{evidence_bullets_with_file_paths}\n\n### Remediation\n- [ ] {remediation_step_1}\n\n### Acceptance criteria\n- [ ] Target anchor holds: {target_anchor_text}"
+  }
+};
+function buildCriterion(draft) {
+  for (const [label, value] of [
+    ["id", draft.id],
+    ["domain", draft.domain],
+    ["name", draft.name],
+    ["question", draft.question]
+  ]) {
+    if (typeof value !== "string" || value.trim() === "") throw new Error(`--${label} is required`);
+  }
+  if (draft.appliesTo.length === 0) throw new Error(`--applies-to is required \u2014 a criterion applies to at least one surface`);
+  const missing = ANCHOR_KEYS.filter((key) => !draft.anchors[key]);
+  if (missing.length > 0) {
+    throw new Error(
+      `missing anchors ${missing.join(", ")}.
+All five are required: a criterion without observable descriptions of each level cannot be scored consistently,
+and an inconsistently scored criterion makes its whole row incomparable.`
+    );
+  }
+  const weight = draft.weight ?? 1;
+  if (!Number.isInteger(weight) || weight < 1 || weight > 3) throw new Error(`--weight must be 1, 2 or 3`);
+  const impact = draft.impact ?? 3;
+  if (!Number.isInteger(impact) || impact < 1 || impact > 5) throw new Error(`--impact must be 1-5`);
+  const { id, name } = draft;
+  return {
+    id,
+    domain: draft.domain,
+    ...draft.subcategory ? { subcategory: draft.subcategory } : {},
+    name,
+    question: draft.question,
+    ...draft.definition ? { definition: draft.definition } : {},
+    ...draft.rationale ? { rationale: draft.rationale } : {},
+    applies_to: draft.appliesTo,
+    level_anchors: draft.anchors,
+    default_impact: impact,
+    weight,
+    references: [],
+    checklist: draft.checklist ?? [],
+    signals: draft.signals ?? [],
+    ...draft.remediation ? { remediation: draft.remediation } : {},
+    issue: {
+      title_template: `[Quality] ${id} ${name} at level {observed_level} on {surface} (target {target_level})`,
+      labels: draft.labels && draft.labels.length > 0 ? draft.labels : ["quality"],
+      body_skeleton: `## Quality finding: ${id} ${name}
+
+**Surface:** {surface}
+**Observed level:** {observed_level}
+**Target level:** {target_level}
+**Severity seed:** impact {impact} x likelihood {likelihood}
+
+### Evidence
+{evidence_bullets_with_file_paths}
+
+### Risk
+{risk_narrative}
+
+### Remediation
+- [ ] {remediation_step_1}
+
+### Acceptance criteria
+- [ ] Target anchor holds: {target_anchor_text}`
+    }
+  };
+}
+function addCriterionToOverlay(root, pack, criterion, options = {}) {
+  if (typeof criterion.id !== "string" || criterion.id === "") throw new Error(`the criterion has no id`);
+  if ((pack.criteria ?? []).some((c) => c.id === criterion.id) && !options.force) {
+    throw new Error(
+      `"${criterion.id}" is already a pack criterion.
+Overriding it changes what every score recorded against that id means.
+Use a project-reserved id (X-01, X-02, \u2026) instead, or pass --force if the override is deliberate.`
+    );
+  }
+  const path6 = overlayPath(root);
+  const overlay = loadOverlay(root) ?? { extends: pack.version, criteria: [] };
+  overlay.criteria = Array.isArray(overlay.criteria) ? overlay.criteria : [];
+  const at2 = overlay.criteria.findIndex((c) => c?.id === criterion.id);
+  if (at2 >= 0 && !options.force) {
+    throw new Error(`"${criterion.id}" is already in the overlay \u2014 pass --force to replace it`);
+  }
+  if (at2 >= 0) overlay.criteria[at2] = criterion;
+  else overlay.criteria.push(criterion);
+  const domainCode = criterion.domain;
+  const knownDomain = (pack.domains ?? []).some((d) => d.code === domainCode) || (overlay.domains ?? []).some((d) => d.code === domainCode);
+  let addedDomain;
+  if (!knownDomain) {
+    if (!options.domainName) {
+      throw new Error(
+        `"${domainCode}" is not a pack domain and the overlay does not define it.
+Pass --domain-name "<display name>" to define it, or use an existing domain code.`
+      );
+    }
+    overlay.domains = [...overlay.domains ?? [], { code: domainCode, name: options.domainName }];
+    addedDomain = domainCode;
+  }
+  writeJson(path6, overlay);
+  return { path: path6, overlay, replaced: at2 >= 0, ...addedDomain !== void 0 ? { addedDomain } : {} };
+}
+
+// src/commands/kritik.ts
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
+var USAGE13 = `arkaik kritik <subcommand> [options]
+
+Audit this product's quality with the Kritik framework: a maturity level per
+criterion per surface backed by evidence, findings carrying risk and cost, and
+a comparative matrix whose caps stop one open Critical being averaged into a B.
+
+Subcommands:
+  profile               Pick this project's surfaces (writes docs/quality/profile.json).
+  score <c> <s> <lvl>   Record one maturity level, with its evidence.
+  finding open ...      Open a finding on a (criterion x surface) cell.
+  finding resolve <id>  Close it because the fix merged.
+  finding accept <id>   Accept it as a known, owned risk.
+  matrix [audit-id]     Roll an audit up (writes matrix.json).
+  signals               The signal pack, and what has tripped since the last audit.
+  regressions           What got worse between two audits.
+  issue <criterion>     Print the prefilled GitHub issue skeleton.
+  criterion add ...     Add a project-specific criterion to the overlay.
+
+Common options:
+  --root <dir>      Repo root holding docs/quality/ (default: the current directory).
+  --actor <name>    Who is writing (default: ${KRITIK_ACTOR}). Recorded on every quality.* event.
+  --bundle <path>   The Arkaik bundle whose journal receives events
+                    (default: docs/arkaik/bundle.json; skipped when absent).
+  --no-journal      Write the audit files only; append no journal events.
+  -h, --help        Show this help, or a subcommand's.
+
+Run "arkaik kritik <subcommand> --help" for the flags each one takes.`;
+var SCORE_USAGE = `arkaik kritik score <criterion> <surface> <level> --evidence <text|@file> [options]
+
+Record one (criterion x surface) maturity level. A cell holds exactly one level,
+so re-scoring replaces in place \u2014 the correction reads as a correction.
+
+Arguments:
+  criterion         A criterion id from the pack or this project's overlay (e.g. SEC-01).
+  surface           A surface id declared in docs/quality/profile.json.
+  level             0-4. Absent from the file means N/A; 0 means "not addressed".
+
+Options:
+  --evidence <e>    file:line / config citations. \`@path\` reads them from a file.
+                    Required: a score without a citation is an opinion.
+  --audit <id>      The audit run (default: the newest, or the current YYYY-MM).
+  --commit <sha>    The commit the evidence is pinned to.
+
+Writes docs/quality/audits/<id>/scores.json`;
+var FINDING_USAGE = `arkaik kritik finding <open|resolve|accept> [options]
+
+  open <criterion> <surface> --title <t> --impact <1-5> --likelihood <1-5>
+       --cost <S|M|L|XL> --evidence <text|@file> [--detail <d>] [--remediation <r>]
+       [--nodes <id,id>] [--issue-url <u>] [--id <finding-id>] [--audit <id>]
+
+    Opens a finding and appends quality.finding.opened. Severity and priority are
+    printed, never stored \u2014 they are derived from impact x likelihood and cost, so
+    they can never drift from the numbers behind them. The surface may be
+    "${CROSS_SURFACE_ID}" for a defect that belongs to the contract between surfaces.
+
+  resolve <finding-id> [--by <pr-or-commit-url>]
+
+    Marks it resolved and appends quality.finding.resolved. Searched across every
+    audit: a finding opened in 2026-08 is routinely fixed during 2026-09.
+
+  accept <finding-id> --note <why>
+
+    Records it as a known, owned risk. The note is required \u2014 an accepted risk is a
+    decision and reads like one. No journal event: acceptance is a state of the
+    finding, not something that happened to the product.`;
+var MATRIX_USAGE = `arkaik kritik matrix [audit-id] [--json] [--record]
+
+Roll one audit up into its comparative matrix and write matrix.json \u2014 the only
+thing that may write that file.
+
+  audit-id          The audit under docs/quality/audits/ (default: the newest).
+  --json            Print matrix.json instead of the markdown table.
+  --record          Also append quality.audit.completed, carrying these scores
+                    and counts. Do this once per finished audit.`;
+var SIGNALS_USAGE = `arkaik kritik signals [--surface <s>] [--criterion <c>] [--domain <CODE>] [--json]
+arkaik kritik signals --trip <criterion> --surface <s> --signal <index|text> [--detail <d>]
+
+Signals are the cheap checks between full audits: a grep that must return
+nothing, a CI job that must exist. They are statements to check, not commands to
+run \u2014 the pack spans greps, CI introspection and database queries, so this
+prints the run sheet rather than pretending to execute it.
+
+Exits 1 when anything has tripped since the last recorded audit, which is what
+makes it usable as a CI step.
+
+  --trip            Record one as tripped: appends quality.signal.tripped.
+                    --signal takes the row's index from the run sheet, or the text.
+  --json            The full run sheet as JSON (what an agent should read).`;
+var REGRESSIONS_USAGE = `arkaik kritik regressions [--from <audit>] [--to <audit>] [--record] [--json]
+
+What got worse between two audits: a cell whose maturity dropped, a cell that
+gained an open Critical or High finding, a finding that was resolved and is open
+again. Cells scored in only one of the two audits are not compared \u2014 a
+half-finished audit is not a regression.
+
+Exits 1 when anything regressed, which is what makes it usable as a CI step or a
+scheduled routine.
+
+  --from <audit>    The older reading (default: the audit before --to).
+  --to <audit>      The newer reading (default: the newest on disk).
+  --record          Append one quality.signal.tripped per regression.
+  --json            The full list as JSON.`;
+var ISSUE_USAGE = `arkaik kritik issue <criterion> --surface <s> [--level <n>] [--finding <id>]
+
+Print the criterion's GitHub issue skeleton, filled as far as what we know
+allows. Placeholders we cannot fill are left standing \u2014 a skeleton is a form to
+finish, and an empty "### Risk" reads as "no risk" where {risk_narrative} reads
+as "your turn".
+
+  --level <n>       The observed maturity, so the anchors fill in.
+  --finding <id>    Fill the risk numbers, evidence and narrative from a finding.
+                    This is the P0/P1 path: the issue exists because a defect does.`;
+var CRITERION_USAGE = `arkaik kritik criterion add --id <ID> --domain <CODE> --name <t> --question <q> \\
+    --applies-to <s1,s2> --anchor l0=<text> ... --anchor l4=<text> [options]
+
+Add a criterion the pack does not have to this project's overlay
+(docs/quality/criteria.custom.json). A pack upgrade never touches it.
+
+  --id              A project-reserved id, e.g. X-01. Never a pack id.
+  --domain          Owning domain code \u2014 an existing one (SEC, PRV, \u2026) or your own.
+  --domain-name     Display name, required only when --domain is a new code.
+  --anchor lN=<t>   What each level looks like HERE. All five are required: a
+                    criterion scored inconsistently makes its whole row incomparable.
+  --weight <1-3>    Weight in the domain roll-up (default 1).
+  --impact <1-5>    Seeds finding severity (default 3).
+  --signal <s>      A mechanically checkable hook; repeatable.
+  --check <s>       A concrete audit step; repeatable.
+  --label <s>       An issue label; repeatable (default: quality).
+  --from <file>     Read a complete criterion from JSON instead of these flags.
+  --template        Print a starting-point criterion and exit.
+  --force           Replace an existing criterion with this id.`;
+function fail12(message) {
+  console.error(message);
+  process.exit(1);
+}
+function takeCommon(args) {
+  const rest = [];
+  const common = { root: process.cwd(), actor: KRITIK_ACTOR, journal: true };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--root") common.root = args[++i] ?? common.root;
+    else if (arg === "--actor") common.actor = args[++i] ?? common.actor;
+    else if (arg === "--bundle") common.bundlePath = args[++i];
+    else if (arg === "--no-journal") common.journal = false;
+    else rest.push(arg);
+  }
+  return { rest, common };
+}
+function collect(args, repeatable = [], boolean4 = []) {
+  const single = {};
+  const many = Object.fromEntries(repeatable.map((key) => [key, []]));
+  const flags = /* @__PURE__ */ new Set();
+  const positionals = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const key = arg.slice(2);
+    if (boolean4.includes(key) || key === "help") {
+      flags.add(key);
+      continue;
+    }
+    const value = args[++i];
+    if (value === void 0) fail12(`kritik: --${key} needs a value`);
+    if (key in many) many[key].push(value);
+    else single[key] = value;
+  }
+  return { single, many, flags, positionals };
+}
+function textOrFile(value) {
+  if (!value.startsWith("@")) return value;
+  const path6 = value.slice(1);
+  if (!existsSync16(path6)) fail12(`kritik: no file at ${path6}`);
+  return readFileSync15(path6, "utf8").trim();
+}
+function currentAuditId() {
+  const now = /* @__PURE__ */ new Date();
+  return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
+}
+function auditForWrite(root, requested) {
+  if (requested !== void 0) return requested;
+  const existing = listAuditIds(root);
+  return existing.length > 0 ? existing[existing.length - 1] : currentAuditId();
+}
+function loadLibraryOrFail(root) {
+  try {
+    return loadKritikLibrary(root).library;
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+}
+function profileOrFail(root) {
+  try {
+    return requireProfile(root);
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+}
+function criterionOrFail(library, criterionId) {
+  const criterion = (library.criteria ?? []).find((candidate) => candidate.id === criterionId);
+  if (!criterion) {
+    const domain2 = criterionId.split("-")[0];
+    const siblings = (library.criteria ?? []).filter((c) => c.domain === domain2).map((c) => c.id);
+    return fail12(
+      `kritik: no criterion "${criterionId}" in the pack or this project's overlay.
+` + (siblings.length > 0 ? `Criteria in ${domain2}: ${siblings.join(", ")}` : `Domains: ${(library.domains ?? []).map((d) => d.code).join(", ")}`)
+    );
+  }
+  if (typeof criterion.superseded_by === "string") {
+    return fail12(
+      `kritik: criterion "${criterionId}" is retired \u2014 superseded by "${criterion.superseded_by}".
+Score that one instead; the old id is kept only so past audits still mean what they meant.`
+    );
+  }
+  return criterion;
+}
+function surfaceOrFail(profile, surface, options = {}) {
+  if (surface === CROSS_SURFACE_ID) {
+    if (options.allowCrossSurface) return surface;
+    return fail12(
+      `kritik: "${CROSS_SURFACE_ID}" is a findings-only lens \u2014 it carries no matrix column, so a score there would render nowhere.`
+    );
+  }
+  const declared = (profile.surfaces ?? []).map((s) => s.id);
+  if (!declared.includes(surface)) {
+    return fail12(
+      `kritik: surface "${surface}" is not declared in ${profilePath(".")}.
+This project's surfaces: ${declared.join(", ") || "(none \u2014 run `arkaik kritik profile` first)"}`
+    );
+  }
+  return surface;
+}
+function intOrFail(label, value, min, max) {
+  if (value === void 0) fail12(`kritik: ${label} is required
+`);
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+    fail12(`kritik: ${label} must be an integer ${min}-${max} (got "${value}")`);
+  }
+  return parsed;
+}
+function reportJournal(root, inputs, common) {
+  if (!common.journal) {
+    console.log(`  journal: skipped (--no-journal)`);
+    return;
+  }
+  const journal = resolveJournal(root, common.bundlePath);
+  if (!journal.present) {
+    console.log(`  journal: none at ${journal.bundlePath} \u2014 Kritik does not need one, so nothing was appended`);
+    return;
+  }
+  const written = appendQualityEvents(root, inputs, { actor: common.actor, bundlePath: common.bundlePath });
+  if (written.baseline !== void 0) {
+    console.log(`  journal: adopted ${written.baseline.node_ids?.length ?? 0} pre-existing nodes first`);
+  }
+  console.log(`  journal: ${written.events.map((e) => e.type).join(", ")} -> ${written.journalPath}`);
+}
+var PROFILE_USAGE = `arkaik kritik profile --surface <id>[:<title>[:<platform>]] [...] [--weight <CODE>=<n>] [--force]
+
+Pick this project's surfaces \u2014 the one decision everything downstream is shaped
+by. Each criterion's applies_to intersects this list to produce the audit's
+cells, and the matrix has exactly these columns.
+
+  --surface         id[:title[:platform]]. \`platform\` (web|ios|android) is the
+                    optional bridge to the product map, for surfaces that ship
+                    views. A database contract or a CLI simply has none.
+  --weight CODE=n   How hard this product is graded on a domain (default 1).
+  --force           Overwrite an existing profile. Changing the surface list
+                    invalidates every score recorded against the old one.
+
+Writes docs/quality/profile.json`;
+function runProfile(args, common) {
+  const { many, flags } = collect(args, ["surface", "weight"], ["force"]);
+  if (flags.has("help")) {
+    console.log(PROFILE_USAGE);
+    process.exit(0);
+  }
+  if (many.surface.length === 0) fail12(`kritik: at least one --surface is required
+
+${PROFILE_USAGE}`);
+  const surfaces = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const spec of many.surface) {
+    let surface;
+    try {
+      surface = parseSurfaceSpec(spec);
+    } catch (error51) {
+      return fail12(`kritik: ${error51.message}`);
+    }
+    if (seen.has(surface.id)) fail12(`kritik: duplicate surface id "${surface.id}"`);
+    seen.add(surface.id);
+    surfaces.push(surface);
+  }
+  const weights = {};
+  for (const spec of many.weight) {
+    const at2 = spec.indexOf("=");
+    if (at2 <= 0) fail12(`kritik: --weight wants CODE=number (got "${spec}")`);
+    const code = spec.slice(0, at2).trim();
+    const value = Number(spec.slice(at2 + 1));
+    if (!Number.isFinite(value) || value <= 0) fail12(`kritik: weight for "${code}" must be a positive number`);
+    weights[code] = value;
+  }
+  const path6 = profilePath(common.root);
+  if (existsSync16(path6) && !flags.has("force")) {
+    fail12(
+      `kritik: ${path6} already exists.
+Changing the surface list invalidates every score recorded against the old one, so this refuses by default.
+Pass --force if that is genuinely what you want.`
+    );
+  }
+  const profile = Object.keys(weights).length > 0 ? { surfaces, domain_weights: weights } : { surfaces };
+  writeJson(path6, profile);
+  console.log(
+    `
+  wrote ${path6}
+  ${surfaces.length} surface${surfaces.length === 1 ? "" : "s"}: ${surfaces.map((s) => s.id).join(", ")}
+  ${Object.keys(weights).length > 0 ? `weights: ${Object.entries(weights).map(([k, v]) => `${k}=${v}`).join(" ")}` : "weights: 1 across every domain"}
+`
+  );
+  process.exit(0);
+}
+function runScore(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(SCORE_USAGE);
+    process.exit(0);
+  }
+  const [criterionId, surfaceArg, levelArg] = positionals;
+  if (criterionId === void 0 || surfaceArg === void 0 || levelArg === void 0) {
+    fail12(`kritik: score takes <criterion> <surface> <level>
+
+${SCORE_USAGE}`);
+  }
+  const library = loadLibraryOrFail(common.root);
+  const profile = profileOrFail(common.root);
+  const criterion = criterionOrFail(library, criterionId);
+  const surface = surfaceOrFail(profile, surfaceArg);
+  const level = intOrFail("level", levelArg, 0, 4);
+  const appliesTo = criterion.applies_to;
+  if (Array.isArray(appliesTo) && !appliesTo.includes(surface)) {
+    fail12(
+      `kritik: ${criterionId} does not apply to "${surface}" (applies to: ${appliesTo.join(", ")}).
+Scoring it there would produce a cell nothing rolls up.`
+    );
+  }
+  if (single.evidence === void 0 || single.evidence.trim() === "") {
+    fail12(`kritik: --evidence is required \u2014 a score without a citation is an opinion, not an assessment.
+
+${SCORE_USAGE}`);
+  }
+  const evidence = textOrFile(single.evidence);
+  const auditId = auditForWrite(common.root, single.audit);
+  const file2 = loadScoresOrEmpty(common.root, auditId);
+  const assessment = {
+    criterion_id: criterionId,
+    surface,
+    level,
+    evidence,
+    audit_id: auditId,
+    ...single.commit !== void 0 ? { commit: single.commit } : {},
+    ts: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const { assessments, replaced } = upsertAssessment(file2.assessments, assessment);
+  saveScores(common.root, auditId, {
+    ...file2,
+    audit_id: auditId,
+    framework_version: file2.framework_version ?? library.version,
+    ...single.commit !== void 0 ? { commit: single.commit } : {},
+    assessments
+  });
+  const anchor = criterion.level_anchors?.[`l${level}`];
+  console.log(
+    `
+  ${replaced ? `re-scored ${criterionId} x ${surface}: ${replaced.level} -> ${level}` : `scored ${criterionId} x ${surface} at ${level}`}${anchor ? ` \u2014 ${anchor}` : ""}
+  ${assessments.length} assessment${assessments.length === 1 ? "" : "s"} in ${auditId} -> ${scoresPath(common.root, auditId)}`
+  );
+  if (level < DEFAULT_TARGET_LEVEL) {
+    console.log(
+      `  below the level-${DEFAULT_TARGET_LEVEL} target \u2014 open a finding, or say in the evidence why this surface should not reach it.`
+    );
+  }
+  console.log("");
+  process.exit(0);
+}
+function runFinding(args, common) {
+  const [action, ...rest] = args;
+  if (action === void 0 || action === "--help" || action === "-h") {
+    console.log(FINDING_USAGE);
+    process.exit(action === void 0 ? 1 : 0);
+  }
+  if (action === "open") return runFindingOpen(rest, common);
+  if (action === "resolve") return runFindingResolve(rest, common);
+  if (action === "accept") return runFindingAccept(rest, common);
+  fail12(`kritik: unknown finding action "${action}"
+
+${FINDING_USAGE}`);
+}
+function runFindingOpen(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(FINDING_USAGE);
+    process.exit(0);
+  }
+  const [criterionId, surfaceArg] = positionals;
+  if (criterionId === void 0 || surfaceArg === void 0) {
+    fail12(`kritik: finding open takes <criterion> <surface>
+
+${FINDING_USAGE}`);
+  }
+  const library = loadLibraryOrFail(common.root);
+  const profile = profileOrFail(common.root);
+  criterionOrFail(library, criterionId);
+  const surface = surfaceOrFail(profile, surfaceArg, { allowCrossSurface: true });
+  if (single.title === void 0 || single.title.trim() === "") {
+    fail12(`kritik: --title is required \u2014 one line naming the actual defect, not the category.
+
+${FINDING_USAGE}`);
+  }
+  if (single.evidence === void 0 || single.evidence.trim() === "") {
+    fail12(`kritik: --evidence is required \u2014 file:line citations someone can check.
+
+${FINDING_USAGE}`);
+  }
+  const impact = intOrFail("--impact", single.impact, 1, 5);
+  const likelihood = intOrFail("--likelihood", single.likelihood, 1, 5);
+  const cost = single.cost;
+  if (cost === void 0 || !REMEDIATION_COSTS.includes(cost)) {
+    fail12(
+      `kritik: --cost must be one of ${REMEDIATION_COSTS.join(", ")} \u2014 it decides priority, so a High that is cheap to fix outranks a High that is not.`
+    );
+  }
+  const auditId = auditForWrite(common.root, single.audit);
+  const file2 = loadFindings(common.root, auditId);
+  const taken = new Set(file2.findings.map((f) => f.id));
+  const id = single.id ?? mintFindingId(auditId, criterionId, surface, taken, library);
+  if (single.id !== void 0 && taken.has(single.id)) {
+    fail12(`kritik: finding "${single.id}" already exists in ${auditId} \u2014 resolve or accept it rather than reopening the id.`);
+  }
+  const nodes = single.nodes?.split(",").map((n) => n.trim()).filter((n) => n !== "");
+  const finding = {
+    id,
+    criterion_id: criterionId,
+    surface,
+    title: single.title,
+    detail: single.detail ?? single.title,
+    evidence: textOrFile(single.evidence),
+    impact,
+    likelihood,
+    cost,
+    status: "open",
+    ...single.remediation !== void 0 ? { remediation: single.remediation } : {},
+    ...nodes !== void 0 && nodes.length > 0 ? { node_ids: nodes } : {},
+    ...single["issue-url"] !== void 0 ? { issue_url: single["issue-url"] } : {}
+  };
+  const { findings } = upsertFinding(file2.findings, finding);
+  saveFindings(common.root, auditId, {
+    ...file2,
+    audit_id: auditId,
+    framework_version: file2.framework_version ?? library.version,
+    findings
+  });
+  const severity = severityOf(finding, library);
+  const priority = priorityOf(finding, library);
+  console.log(
+    `
+  opened ${id} \u2014 ${finding.title}
+  ${severity} / ${priority} (impact ${impact} x likelihood ${likelihood} = ${impact * likelihood}, cost ${cost}) on ${surface}
+  ${findings.length} finding${findings.length === 1 ? "" : "s"} in ${auditId}`
+  );
+  reportJournal(common.root, [findingOpenedInput(finding, library)], common);
+  if (priority === "P0") {
+    console.log(`  P0: file the issue now \u2014 \`arkaik kritik issue ${criterionId} --surface ${surface} --finding ${id}\``);
+  }
+  console.log("");
+  process.exit(0);
+}
+function runFindingResolve(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(FINDING_USAGE);
+    process.exit(0);
+  }
+  const id = positionals[0];
+  if (id === void 0) fail12(`kritik: finding resolve takes <finding-id>
+
+${FINDING_USAGE}`);
+  const located = locateFinding(common.root, id);
+  if (!located) fail12(`kritik: no finding "${id}" in any audit under ${common.root}/docs/quality/audits/`);
+  if (located.finding.status === "resolved") {
+    console.log(`
+  ${id} is already resolved \u2014 nothing written.
+`);
+    process.exit(0);
+  }
+  const { findings, finding } = resolveFinding(located.file.findings, id, single.by);
+  saveFindings(common.root, located.auditId, { ...located.file, findings });
+  console.log(`
+  resolved ${id} \u2014 ${located.finding.title}` + (single.by ? `
+  by ${single.by}` : ""));
+  if (single.by === void 0) {
+    console.log(`  no --by: without the PR or commit that closed it, "resolved" means "we stopped looking".`);
+  }
+  reportJournal(common.root, [findingResolvedInput(finding ?? located.finding, single.by)], common);
+  console.log("");
+  process.exit(0);
+}
+function runFindingAccept(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(FINDING_USAGE);
+    process.exit(0);
+  }
+  const id = positionals[0];
+  if (id === void 0) fail12(`kritik: finding accept takes <finding-id>
+
+${FINDING_USAGE}`);
+  if (single.note === void 0 || single.note.trim() === "") {
+    fail12(`kritik: --note is required \u2014 an accepted risk is a decision and reads like one.`);
+  }
+  const located = locateFinding(common.root, id);
+  if (!located) fail12(`kritik: no finding "${id}" in any audit under ${common.root}/docs/quality/audits/`);
+  const { findings } = acceptFinding(located.file.findings, id, single.note);
+  saveFindings(common.root, located.auditId, { ...located.file, findings });
+  console.log(
+    `
+  accepted ${id} as a known risk \u2014 ${located.finding.title}
+  ${single.note}
+  no journal event: acceptance is a state of the finding, not something that happened to the product.
+`
+  );
+  process.exit(0);
+}
+function runMatrix(args, common) {
+  const { flags, positionals } = collect(args, [], ["json", "record"]);
+  if (flags.has("help")) {
+    console.log(MATRIX_USAGE);
+    process.exit(0);
+  }
+  const library = loadLibraryOrFail(common.root);
+  let auditId;
+  try {
+    auditId = positionals[0] ?? newestAuditId(common.root);
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  let computed;
+  try {
+    computed = computeAuditMatrix(common.root, auditId, library);
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  const { section, matrix, file: file2 } = computed;
+  if (flags.has("json")) {
+    console.log(JSON.stringify(file2, null, 2));
+  } else {
+    const domainNames = new Map((library.domains ?? []).map((d) => [d.code, d.name]));
+    console.log(`
+${renderMatrixMarkdown(matrix, domainNames)}
+`);
+    const open = section.findings.filter(isOpenFinding);
+    const lanes = { P0: 0, P1: 0, P2: 0, P3: 0 };
+    for (const finding of open) lanes[priorityOf(finding, library)]++;
+    const counts = matrix.finding_counts;
+    console.log(
+      `${section.assessments.length} assessments \xB7 ${open.length} open findings (${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low)
+lanes: P0 ${lanes.P0} \xB7 P1 ${lanes.P1} \xB7 P2 ${lanes.P2} \xB7 P3 ${lanes.P3}`
+    );
+    const p0 = open.filter((finding) => priorityOf(finding, library) === "P0");
+    if (p0.length > 0) {
+      console.log(`
+P0 \u2014 fix first:`);
+      for (const finding of p0) {
+        console.log(`  [${severityOf(finding, library)}] ${finding.surface} \xB7 ${finding.id} \u2014 ${finding.title}`);
+      }
+    }
+    console.log(`
+wrote ${matrixPath(common.root, auditId)}`);
+  }
+  if (flags.has("record")) {
+    reportJournal(
+      common.root,
+      [auditCompletedInput(matrix, { audit_id: auditId, framework_version: file2.framework_version, ...file2.commit !== void 0 ? { commit: file2.commit } : {} })],
+      common
+    );
+  }
+  console.log("");
+  process.exit(0);
+}
+function tripsSinceLastAudit(root, common) {
+  const journal = resolveJournal(root, common.bundlePath);
+  if (!journal.present) return [];
+  const events = orderEvents(readFullJournalEvents(journal.journalPath));
+  const lastAudit = events.map((event) => event.type).lastIndexOf("quality.audit.completed");
+  return events.slice(lastAudit + 1).filter((event) => event.type === "quality.signal.tripped");
+}
+function runSignals(args, common) {
+  const { single, flags } = collect(args, [], ["json"]);
+  if (flags.has("help")) {
+    console.log(SIGNALS_USAGE);
+    process.exit(0);
+  }
+  const library = loadLibraryOrFail(common.root);
+  const profile = profileOrFail(common.root);
+  if (single.trip !== void 0) {
+    const criterion = criterionOrFail(library, single.trip);
+    if (single.surface === void 0) fail12(`kritik: --trip needs --surface`);
+    const surface = surfaceOrFail(profile, single.surface);
+    if (single.signal === void 0) fail12(`kritik: --trip needs --signal (a run-sheet index, or the statement itself)`);
+    const signals = criterion.signals ?? [];
+    const index = Number(single.signal);
+    const signal = Number.isInteger(index) && index >= 0 && index < signals.length ? signals[index] : single.signal;
+    console.log(`
+  tripped ${criterion.id} x ${surface}
+  ${signal}`);
+    reportJournal(
+      common.root,
+      [signalTrippedInput({ criterion_id: criterion.id, surface, signal, ...single.detail !== void 0 ? { detail: single.detail } : {} })],
+      common
+    );
+    console.log(`  a tripped signal is not a finding \u2014 it is the prompt to go look.
+`);
+    process.exit(0);
+  }
+  const filter = {
+    ...single.surface !== void 0 ? { surface: surfaceOrFail(profile, single.surface) } : {},
+    ...single.criterion !== void 0 ? { criterion: criterionOrFail(library, single.criterion).id } : {},
+    ...single.domain !== void 0 ? { domain: single.domain } : {}
+  };
+  const rows = signalRunSheet(library, profile.surfaces ?? [], filter);
+  const trips = tripsSinceLastAudit(common.root, common);
+  if (flags.has("json")) {
+    console.log(JSON.stringify({ signals: rows, tripped_since_last_audit: trips }, null, 2));
+    process.exit(trips.length > 0 ? 1 : 0);
+  }
+  const filtered = Object.keys(filter).length > 0;
+  if (filtered) {
+    console.log("");
+    let current = "";
+    for (const row of rows) {
+      const key = `${row.criterion_id} x ${row.surface}`;
+      if (key !== current) {
+        current = key;
+        console.log(`  ${key}`);
+      }
+      console.log(`    [${row.index}] ${row.signal}`);
+    }
+    console.log(`
+  ${rows.length} check${rows.length === 1 ? "" : "s"}.`);
+  } else {
+    const criteria = new Set(rows.map((row) => row.criterion_id)).size;
+    console.log(
+      `
+  ${rows.length} checks across ${criteria} criteria and ${(profile.surfaces ?? []).length} surfaces.
+  Narrow it (--surface, --criterion, --domain) to read them, or --json to take the lot.` + (listAuditIds(common.root).length > 1 ? `
+  Comparing two audits is \`arkaik kritik regressions\`.` : "")
+    );
+  }
+  if (trips.length > 0) {
+    console.log(`
+  tripped since the last recorded audit:`);
+    for (const trip of trips) {
+      const event = trip;
+      console.log(`    ${event.criterion_id} x ${event.surface} \u2014 ${event.signal}`);
+    }
+    console.log("");
+    process.exit(1);
+  }
+  console.log("");
+  process.exit(0);
+}
+function auditPair(root, from, to) {
+  const audits = listAuditIds(root);
+  if (audits.length < 2) {
+    fail12(
+      `kritik: regressions needs two audits to compare \u2014 ${audits.length === 0 ? "docs/quality/audits/ holds none" : `only "${audits[0]}" exists`}.
+A regression is the difference between two readings; one reading is a baseline.`
+    );
+  }
+  const known = (id) => {
+    if (!audits.includes(id)) fail12(`kritik: no audit "${id}" under docs/quality/audits/ (have: ${audits.join(", ")})`);
+    return id;
+  };
+  const newer = to === void 0 ? audits[audits.length - 1] : known(to);
+  const older = from === void 0 ? audits[audits.indexOf(newer) - 1] : known(from);
+  if (older === void 0) {
+    fail12(`kritik: "${newer}" is the oldest audit \u2014 there is nothing before it to compare against.`);
+  }
+  if (older === newer) {
+    fail12(`kritik: --from and --to name the same audit ("${newer}") \u2014 a regression needs two readings.`);
+  }
+  if (audits.indexOf(older) > audits.indexOf(newer)) {
+    fail12(`kritik: --from "${older}" is newer than --to "${newer}" \u2014 swap them, or the comparison inverts.`);
+  }
+  return { from: older, to: newer };
+}
+function runRegressions(args, common) {
+  const { single, flags } = collect(args, [], ["json", "record"]);
+  if (flags.has("help")) {
+    console.log(REGRESSIONS_USAGE);
+    process.exit(0);
+  }
+  const library = loadLibraryOrFail(common.root);
+  profileOrFail(common.root);
+  const { from, to } = auditPair(common.root, single.from, single.to);
+  let regressions;
+  try {
+    regressions = detectRegressions(
+      loadQualitySection(common.root, from, library),
+      loadQualitySection(common.root, to, library),
+      library
+    );
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  if (flags.has("json")) {
+    console.log(JSON.stringify({ from, to, total: regressions.length, regressions }, null, 2));
+  } else if (regressions.length === 0) {
+    console.log(`
+  nothing regressed between ${from} and ${to}.
+`);
+  } else {
+    console.log("");
+    for (const regression of regressions) {
+      console.log(`  [${regression.kind}] ${regression.criterion_id} x ${regression.surface}`);
+      console.log(`    ${regression.detail}`);
+    }
+    console.log(`
+  ${regressions.length} regression${regressions.length === 1 ? "" : "s"} between ${from} and ${to}.`);
+  }
+  if (flags.has("record") && regressions.length > 0) {
+    reportJournal(
+      common.root,
+      regressions.map(
+        (regression) => signalTrippedInput({
+          criterion_id: regression.criterion_id,
+          surface: regression.surface,
+          signal: regression.signal,
+          detail: regression.detail
+        })
+      ),
+      common
+    );
+    console.log(`  a tripped signal is not a finding \u2014 it is the prompt to go look.
+`);
+  }
+  process.exit(regressions.length > 0 ? 1 : 0);
+}
+function runIssue(args, common) {
+  const { single, flags, positionals } = collect(args);
+  if (flags.has("help")) {
+    console.log(ISSUE_USAGE);
+    process.exit(0);
+  }
+  const criterionId = positionals[0];
+  if (criterionId === void 0) fail12(`kritik: issue takes <criterion>
+
+${ISSUE_USAGE}`);
+  if (single.surface === void 0) fail12(`kritik: --surface is required
+
+${ISSUE_USAGE}`);
+  const library = loadLibraryOrFail(common.root);
+  const criterion = criterionOrFail(library, criterionId);
+  const declared = loadProfile(common.root);
+  if (declared) surfaceOrFail(declared, single.surface, { allowCrossSurface: true });
+  let finding;
+  if (single.finding !== void 0) {
+    const located = locateFinding(common.root, single.finding);
+    if (!located) fail12(`kritik: no finding "${single.finding}" in any audit`);
+    finding = located.finding;
+  }
+  const rendered = renderIssue(criterion, {
+    surface: single.surface,
+    ...single.level !== void 0 ? { level: single.level } : {},
+    ...finding !== void 0 ? { finding, library } : {}
+  });
+  process.stdout.write(`Title: ${rendered.title}
+`);
+  process.stdout.write(`Labels: ${rendered.labels.join(", ")}
+
+`);
+  process.stdout.write(`${rendered.body}
+`);
+  if (rendered.remediation) process.stdout.write(`
+<!-- Typical remediation: ${rendered.remediation} -->
+`);
+  process.exit(0);
+}
+function runCriterion(args, common) {
+  const [action, ...rest] = args;
+  if (action === void 0 || action === "--help" || action === "-h") {
+    console.log(CRITERION_USAGE);
+    process.exit(action === void 0 ? 1 : 0);
+  }
+  if (action !== "add") fail12(`kritik: unknown criterion action "${action}" (only \`add\`)
+
+${CRITERION_USAGE}`);
+  const { single, many, flags } = collect(rest, ["anchor", "signal", "check", "label"], ["template", "force"]);
+  if (flags.has("help")) {
+    console.log(CRITERION_USAGE);
+    process.exit(0);
+  }
+  const { library: pack } = (() => {
+    try {
+      const loaded = loadKritikLibrary(common.root);
+      return { library: loaded.pack.library };
+    } catch (error51) {
+      return fail12(`kritik: ${error51.message}`);
+    }
+  })();
+  if (flags.has("template")) {
+    console.log(JSON.stringify(CRITERION_TEMPLATE, null, 2));
+    process.exit(0);
+  }
+  let criterion;
+  try {
+    if (single.from !== void 0) {
+      if (!existsSync16(single.from)) fail12(`kritik: no file at ${single.from}`);
+      criterion = JSON.parse(readFileSync15(single.from, "utf8"));
+    } else {
+      const anchors = {};
+      for (const spec of many.anchor) {
+        const at2 = spec.indexOf("=");
+        if (at2 <= 0) fail12(`kritik: --anchor wants lN=<text> (got "${spec}")`);
+        anchors[spec.slice(0, at2).trim()] = spec.slice(at2 + 1);
+      }
+      const draft = {
+        id: single.id ?? "",
+        domain: single.domain ?? "",
+        ...single.subcategory !== void 0 ? { subcategory: single.subcategory } : {},
+        name: single.name ?? "",
+        question: single.question ?? "",
+        ...single.definition !== void 0 ? { definition: single.definition } : {},
+        ...single.rationale !== void 0 ? { rationale: single.rationale } : {},
+        appliesTo: (single["applies-to"] ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        anchors,
+        ...single.weight !== void 0 ? { weight: Number(single.weight) } : {},
+        ...single.impact !== void 0 ? { impact: Number(single.impact) } : {},
+        signals: many.signal,
+        checklist: many.check,
+        ...single.remediation !== void 0 ? { remediation: single.remediation } : {},
+        labels: many.label
+      };
+      criterion = buildCriterion(draft);
+    }
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}
+
+${CRITERION_USAGE}`);
+  }
+  let written;
+  try {
+    written = addCriterionToOverlay(common.root, pack, criterion, {
+      force: flags.has("force"),
+      ...single["domain-name"] !== void 0 ? { domainName: single["domain-name"] } : {}
+    });
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  console.log(
+    `
+  ${written.replaced ? "replaced" : "added"} ${criterion.id} (${criterion.domain}) -> ${written.path}
+  applies to ${(criterion.applies_to ?? []).join(", ") || "every surface"}` + (written.addedDomain !== void 0 ? `
+  declared a new domain: ${written.addedDomain}` : "") + `
+  it scores and rolls up exactly like a pack criterion \u2014 \`arkaik kritik issue ${criterion.id} --surface <s>\`
+`
+  );
+  process.exit(0);
+}
+function runKritik(args) {
+  const { rest, common } = takeCommon(args);
+  const [sub, ...subArgs] = rest;
+  if (sub === void 0 || sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(USAGE13);
+    process.exit(sub === void 0 ? 1 : 0);
+  }
+  switch (sub) {
+    case "profile":
+      return runProfile(subArgs, common);
+    case "score":
+      return runScore(subArgs, common);
+    case "finding":
+      return runFinding(subArgs, common);
+    case "matrix":
+      return runMatrix(subArgs, common);
+    case "signals":
+      return runSignals(subArgs, common);
+    case "regressions":
+      return runRegressions(subArgs, common);
+    case "issue":
+      return runIssue(subArgs, common);
+    case "criterion":
+      return runCriterion(subArgs, common);
+    default:
+      fail12(`kritik: unknown subcommand "${sub}"
+
+${USAGE13}`);
+  }
+}
+
 // src/index.ts
-var USAGE13 = `arkaik \u2014 CLI for Arkaik project bundles
+var USAGE14 = `arkaik \u2014 CLI for Arkaik project bundles
 
 Usage:
   arkaik <command> [options]
@@ -20036,25 +22578,26 @@ Commands:
   release <version> [path]    Tag a release (append release.tagged) and draft its notes.
   deliverable <title> [path]  Record a deliverable (append deliverable.shipped).
   sync [options] [path]       Mirror external ref status (GitHub issues/PRs) into node refs.
-  pack [options] [path]       Produce a single self-contained interchange bundle (embeds the journal).
+  pack [options] [path]       Produce a self-contained interchange bundle (embeds journal + quality).
   open [options] [path]       Validate, then hand off the packed bundle to arkaik.app import.
-  push [options] [path]       Validate, pack (journal stripped), and publish to Publik.
+  push [options] [path]       Validate, pack (journal + quality stripped), and publish to Publik.
                                --delete <id> --key <owner_key> removes a snapshot.
   link [options] [path]       Point this repo at a hosted project so an agent can edit it.
                                --list shows the projects your token can reach.
-  restore [options] [path]    Replace the linked hosted project's bundle + journal (backs up first).
+  restore [options] [path]    Replace the linked project's bundle, journal + quality (backs up first).
   bootstrap <sub> [options]   One-time onboarding: mine, plan, slice, merge a map from a repo.
+  kritik <sub> [options]      Quality audits: score criteria, open findings, roll up the matrix.
 
 Options:
   -h, --help        Show this help.
   -v, --version     Print the version.
 
 Run "arkaik <command> --help" for command-specific help.`;
-var VERSION = "0.1.1";
+var VERSION = "0.3.0";
 function main(argv) {
   const [command, ...rest] = argv;
   if (command === void 0 || command === "--help" || command === "-h" || command === "help") {
-    console.log(USAGE13);
+    console.log(USAGE14);
     process.exit(0);
   }
   if (command === "--version" || command === "-v" || command === "version") {
@@ -20098,10 +22641,13 @@ function main(argv) {
     case "bootstrap":
       runBootstrap(rest);
       return;
+    case "kritik":
+      runKritik(rest);
+      return;
     default:
       console.error(`Unknown command: ${command}
 `);
-      console.error(USAGE13);
+      console.error(USAGE14);
       process.exit(1);
   }
 }