arkaik 0.2.0 → 0.4.0

package/dist/index.js

@@ -15216,6 +15216,13 @@ var QualityFindingResolvedEventSchema = external_exports.object({
   resolved_by: external_exports.string().optional(),
   node_ids: external_exports.array(external_exports.string()).optional()
 }).catchall(external_exports.unknown());
+var QualityFindingAcceptedEventSchema = external_exports.object({
+  ...envelope,
+  type: external_exports.literal("quality.finding.accepted"),
+  finding_id: external_exports.string(),
+  reason: external_exports.string(),
+  node_ids: external_exports.array(external_exports.string()).optional()
+}).catchall(external_exports.unknown());
 var QualitySignalTrippedEventSchema = external_exports.object({
   ...envelope,
   type: external_exports.literal("quality.signal.tripped"),
@@ -15243,6 +15250,7 @@ var JOURNAL_EVENT_SCHEMAS = {
   "quality.audit.completed": QualityAuditCompletedEventSchema,
   "quality.finding.opened": QualityFindingOpenedEventSchema,
   "quality.finding.resolved": QualityFindingResolvedEventSchema,
+  "quality.finding.accepted": QualityFindingAcceptedEventSchema,
   "quality.signal.tripped": QualitySignalTrippedEventSchema
 };
 var KnownJournalEventSchema = external_exports.union([
@@ -15264,6 +15272,7 @@ var KnownJournalEventSchema = external_exports.union([
   QualityAuditCompletedEventSchema,
   QualityFindingOpenedEventSchema,
   QualityFindingResolvedEventSchema,
+  QualityFindingAcceptedEventSchema,
   QualitySignalTrippedEventSchema
 ]);
 
@@ -15351,6 +15360,9 @@ var QualityFindingSchema = external_exports.object({
   remediation: external_exports.string().optional(),
   node_ids: external_exports.array(external_exports.string()).optional().meta({ description: "Graph nodes this finding is about \u2014 the tie deliverable.shipped already uses." }),
   issue_url: external_exports.string().optional(),
+  commit: external_exports.string().optional().meta({
+    description: "Commit SHA anchoring the file:line evidence. Required by policy on any finding written away from a checkout (issue #400 decision 4) \u2014 without it a stale citation is indistinguishable from a wrong one."
+  }),
   verification: external_exports.object({ verdict: external_exports.enum(["CONFIRMED", "REFUTED", "DOWNGRADED"]), note: external_exports.string().optional() }).catchall(external_exports.unknown()).optional().meta({ description: "Result of the adversarial refutation pass. Refuted findings are disclosed, not deleted." })
 }).catchall(external_exports.unknown()).meta({
   id: "QualityFinding",
@@ -16611,6 +16623,15 @@ function validateBundle(input) {
           );
         }
       }
+      if (type === "quality.finding.accepted" && typeof event.finding_id === "string") {
+        if (!openedInJournal.has(event.finding_id) && !seenFindingIds.has(event.finding_id)) {
+          warn(
+            `journal[${index}].finding_id`,
+            "quality-accepted-never-opened",
+            `Journal event ${index}: accepts finding "${event.finding_id}", which no quality.finding.opened event or stored finding ever declared`
+          );
+        }
+      }
     });
   }
   for (const finding of crossCheckJournal(bundle)) findings.push(finding);
@@ -17074,11 +17095,14 @@ function resolveFinding(findings, id, resolvedBy) {
     ...resolvedBy !== void 0 ? { resolved_by: resolvedBy } : {}
   });
 }
-function acceptFinding(findings, id, note) {
-  const existing = findings.find((candidate) => candidate.id === id);
-  const detail = existing === void 0 ? note : `${existing.detail}
+function acceptedDetail(detail, note) {
+  return `${detail}
 
 Accepted risk: ${note}`.trim();
+}
+function acceptFinding(findings, id, note) {
+  const existing = findings.find((candidate) => candidate.id === id);
+  const detail = existing === void 0 ? note : acceptedDetail(existing.detail, note);
   return patchFinding(findings, id, { status: "accepted-risk", detail });
 }
 function fillTemplate(text, values) {
@@ -17210,6 +17234,83 @@ function signalTrippedInput(trip) {
   };
 }
 
+// ../schema/src/quality-regressions.ts
+var REGRESSION_SIGNALS = {
+  "level-drop": "maturity on this cell does not regress",
+  "new-severe-finding": "no open Critical or High finding on this cell",
+  "reopened-finding": "a resolved finding stays resolved"
+};
+var cellKey = (criterionId, surface) => `${criterionId}::${surface}`;
+var rowsOf = (value) => Array.isArray(value) ? value : [];
+function assessmentsByCell(state) {
+  const cells = /* @__PURE__ */ new Map();
+  for (const assessment of rowsOf(state?.assessments)) {
+    if (typeof assessment?.criterion_id !== "string" || typeof assessment?.surface !== "string") continue;
+    cells.set(cellKey(assessment.criterion_id, assessment.surface), assessment);
+  }
+  return cells;
+}
+function severeByCell(state, library) {
+  const cells = /* @__PURE__ */ new Map();
+  for (const finding of rowsOf(state?.findings)) {
+    if (typeof finding?.criterion_id !== "string" || typeof finding?.surface !== "string") continue;
+    if (!isOpenFinding(finding)) continue;
+    const severity = severityOf(finding, library);
+    if (severity !== "critical" && severity !== "high") continue;
+    const key = cellKey(finding.criterion_id, finding.surface);
+    const existing = cells.get(key);
+    if (existing === void 0) cells.set(key, [finding]);
+    else existing.push(finding);
+  }
+  return cells;
+}
+function detectRegressions(previous, next, library) {
+  const before = assessmentsByCell(previous);
+  const after = assessmentsByCell(next);
+  const comparable = (key) => before.has(key) && after.has(key);
+  const regressions = [];
+  for (const [key, current] of after) {
+    const earlier = before.get(key);
+    if (earlier === void 0) continue;
+    if (!(Number(current.level) < Number(earlier.level))) continue;
+    regressions.push({
+      kind: "level-drop",
+      criterion_id: current.criterion_id,
+      surface: current.surface,
+      signal: REGRESSION_SIGNALS["level-drop"],
+      detail: `level ${earlier.level} \u2192 ${current.level} (${earlier.audit_id} \u2192 ${current.audit_id})`
+    });
+  }
+  const severeBefore = severeByCell(previous, library);
+  for (const [key, findings] of severeByCell(next, library)) {
+    if (!comparable(key)) continue;
+    if ((severeBefore.get(key) ?? []).length > 0) continue;
+    for (const finding of findings) {
+      regressions.push({
+        kind: "new-severe-finding",
+        criterion_id: finding.criterion_id,
+        surface: finding.surface,
+        signal: REGRESSION_SIGNALS["new-severe-finding"],
+        detail: `${finding.id} \u2014 ${severityOf(finding, library)} (impact ${finding.impact} \xD7 likelihood ${finding.likelihood})`
+      });
+    }
+  }
+  const resolvedBefore = new Set(
+    rowsOf(previous?.findings).filter((finding) => finding?.status === "resolved").map((finding) => finding.id)
+  );
+  for (const finding of rowsOf(next?.findings)) {
+    if (!isOpenFinding(finding) || !resolvedBefore.has(finding.id)) continue;
+    regressions.push({
+      kind: "reopened-finding",
+      criterion_id: finding.criterion_id,
+      surface: finding.surface,
+      signal: REGRESSION_SIGNALS["reopened-finding"],
+      detail: `${finding.id} \u2014 "${finding.title}"`
+    });
+  }
+  return regressions;
+}
+
 // src/commands/init.ts
 var DEFAULT_BUNDLE_PATH = "docs/arkaik/bundle.json";
 var DEFAULT_JOURNAL_PATH = "docs/arkaik/journal.jsonl";
@@ -18576,18 +18677,290 @@ ${USAGE6}`);
 }
 
 // src/commands/pack.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname5, extname, resolve as resolve5 } from "node:path";
+
+// src/lib/kritik-io.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { basename as basename3, dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// ../schema/src/cli/kritik-audit.ts
+import { existsSync as existsSync6, readdirSync as readdirSync2, statSync } from "node:fs";
+import { join as join4 } from "node:path";
+
+// ../schema/src/cli/kritik-paths.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname3, extname, resolve as resolve3 } from "node:path";
-var DEFAULT_BUNDLE_PATH5 = "docs/arkaik/bundle.json";
-var USAGE7 = `arkaik pack [--no-journal] [--inline-assets] [--out <path>] [path]
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+var QUALITY_DIR = "docs/quality";
+var PROFILE_FILE = "profile.json";
+var OVERLAY_FILE = "criteria.custom.json";
+var AUDITS_DIR = "audits";
+var PACK_FILE = "library.json";
+function readJson(path6) {
+  const text = readFileSync6(path6, "utf8");
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    throw new Error(`${path6}: not valid JSON \u2014 ${e.message}`);
+  }
+}
+function writeJson(path6, value) {
+  mkdirSync3(dirname3(path6), { recursive: true });
+  writeFileSync5(path6, JSON.stringify(value, null, 2) + "\n");
+}
+var profilePath = (root) => join3(root, QUALITY_DIR, PROFILE_FILE);
+var overlayPath = (root) => join3(root, QUALITY_DIR, OVERLAY_FILE);
+var auditsDir = (root) => join3(root, QUALITY_DIR, AUDITS_DIR);
+var auditDir = (root, auditId) => join3(auditsDir(root), auditId);
+function loadProfile(root) {
+  const path6 = profilePath(root);
+  return existsSync5(path6) ? readJson(path6) : null;
+}
+function loadOverlay(root) {
+  const path6 = overlayPath(root);
+  return existsSync5(path6) ? readJson(path6) : null;
+}
+
+// ../schema/src/cli/kritik-audit.ts
+var SCORES_FILE = "scores.json";
+var FINDINGS_FILE = "findings.json";
+var MATRIX_FILE = "matrix.json";
+var scoresPath = (root, auditId) => join4(auditDir(root, auditId), SCORES_FILE);
+var findingsPath = (root, auditId) => join4(auditDir(root, auditId), FINDINGS_FILE);
+var matrixPath = (root, auditId) => join4(auditDir(root, auditId), MATRIX_FILE);
+function listAuditIds(root) {
+  const dir = auditsDir(root);
+  if (!existsSync6(dir)) return [];
+  return readdirSync2(dir).filter((name) => statSync(join4(dir, name)).isDirectory()).sort();
+}
+function newestAuditId(root) {
+  const dir = auditsDir(root);
+  if (!existsSync6(dir)) throw new Error(`no audits directory at ${dir}`);
+  const ids = listAuditIds(root);
+  if (ids.length === 0) throw new Error(`no audits found under ${dir}`);
+  return ids[ids.length - 1];
+}
+function loadScores(root, auditId) {
+  const path6 = scoresPath(root, auditId);
+  if (!existsSync6(path6)) throw new Error(`no ${SCORES_FILE} at ${path6}`);
+  const file2 = readJson(path6);
+  return { ...file2, assessments: Array.isArray(file2.assessments) ? file2.assessments : [] };
+}
+function loadScoresOrEmpty(root, auditId) {
+  return existsSync6(scoresPath(root, auditId)) ? loadScores(root, auditId) : { audit_id: auditId, assessments: [] };
+}
+function loadFindings(root, auditId) {
+  const path6 = findingsPath(root, auditId);
+  if (!existsSync6(path6)) return { audit_id: auditId, findings: [] };
+  const file2 = readJson(path6);
+  return { ...file2, findings: Array.isArray(file2.findings) ? file2.findings : [] };
+}
+function saveScores(root, auditId, file2) {
+  writeJson(scoresPath(root, auditId), file2);
+}
+function saveFindings(root, auditId, file2) {
+  writeJson(findingsPath(root, auditId), file2);
+}
+function requireProfile(root) {
+  const profile = loadProfile(root);
+  if (!profile) {
+    throw new Error(
+      `no profile at ${join4(root, QUALITY_DIR, "profile.json")} \u2014 pick this project's surfaces first (\`arkaik kritik profile\`, or the plugin's init-profile.js).`
+    );
+  }
+  return profile;
+}
+function loadQualitySection(root, auditId, library, scores = loadScores(root, auditId)) {
+  const findings = loadFindings(root, auditId);
+  return {
+    framework_version: scores.framework_version ?? library.version,
+    profile: requireProfile(root),
+    assessments: scores.assessments,
+    findings: findings.findings
+  };
+}
+function stripDerived(finding) {
+  const { severity: _severity, priority: _priority, ...rest } = finding;
+  void _severity;
+  void _priority;
+  return rest;
+}
+function requireAudit(root, auditId) {
+  if (!listAuditIds(root).includes(auditId)) {
+    throw new Error(`no audit "${auditId}" under ${auditsDir(root)}`);
+  }
+}
+function loadCurrentQualitySection(root, library) {
+  const auditIds = listAuditIds(root);
+  if (auditIds.length === 0) return void 0;
+  const profile = loadProfile(root);
+  if (!profile) return void 0;
+  const cells = /* @__PURE__ */ new Map();
+  const findings = [];
+  let frameworkVersion;
+  for (const id of auditIds) {
+    const scores = loadScoresOrEmpty(root, id);
+    if (typeof scores.framework_version === "string") frameworkVersion = scores.framework_version;
+    for (const assessment of scores.assessments) {
+      cells.set(`${assessment.criterion_id}\0${assessment.surface}`, assessment);
+    }
+    for (const finding of loadFindings(root, id).findings) findings.push(stripDerived(finding));
+  }
+  return {
+    framework_version: frameworkVersion ?? library.version,
+    library,
+    profile,
+    assessments: [...cells.values()],
+    findings
+  };
+}
+function loadAuditQualitySection(root, auditId, library) {
+  requireAudit(root, auditId);
+  const section = loadQualitySection(root, auditId, library, loadScoresOrEmpty(root, auditId));
+  return { ...section, library, findings: section.findings.map(stripDerived) };
+}
+function computeAuditMatrix(root, auditId, library) {
+  const scores = loadScores(root, auditId);
+  const section = loadQualitySection(root, auditId, library, scores);
+  const matrix = deriveQualityMatrix({ quality: section }, library);
+  const file2 = {
+    audit_id: auditId,
+    commit: scores.commit,
+    framework_version: section.framework_version,
+    matrix: matrix.matrix,
+    overall: matrix.overall,
+    finding_counts: matrix.finding_counts
+  };
+  writeJson(matrixPath(root, auditId), file2);
+  return { section, matrix, file: file2 };
+}
+function renderMatrixMarkdown(matrix, domainNames) {
+  const cell = (value) => value ? `${value.score} (${value.grade}${value.capped ? "*" : ""})` : "\u2014";
+  const lines = [];
+  lines.push(`| Domain | ${matrix.surfaces.join(" | ")} |`);
+  lines.push(`| --- | ${matrix.surfaces.map(() => "---").join(" | ")} |`);
+  for (const domain2 of matrix.domains) {
+    const label = domainNames.get(domain2) ?? domain2;
+    lines.push(
+      `| **${domain2}** ${label} | ${matrix.surfaces.map((s) => cell(matrix.matrix[domain2]?.[s])).join(" | ")} |`
+    );
+  }
+  lines.push(
+    `| **Overall (weighted)** | ${matrix.surfaces.map((s) => {
+      const score = matrix.overall[s];
+      return score === null || score === void 0 ? "\u2014" : `**${score} (${gradeOf(score)})**`;
+    }).join(" | ")} |`
+  );
+  return lines.join("\n");
+}
+function locateFinding(root, id) {
+  for (const auditId of [...listAuditIds(root)].reverse()) {
+    const file2 = loadFindings(root, auditId);
+    const finding = file2.findings.find((candidate) => candidate.id === id);
+    if (finding) return { auditId, file: file2, finding };
+  }
+  return void 0;
+}
+
+// src/lib/kritik-io.ts
+var KRITIK_ACTOR = "arkaik-cli";
+var DEFAULT_BUNDLE_PATH5 = join5("docs", "arkaik", "bundle.json");
+var VENDORED_PACK = join5(QUALITY_DIR, PACK_FILE);
+var BUNDLED_PACK = join5(dirname4(fileURLToPath2(import.meta.url)), "assets", "kritik", "library.json");
+function resolvePack(root) {
+  const vendored = join5(root, VENDORED_PACK);
+  if (existsSync7(vendored)) return { library: readJson(vendored), path: vendored, vendored: true };
+  if (!existsSync7(BUNDLED_PACK)) {
+    throw new Error(
+      `no criteria pack found. Looked in:
+  ${vendored}
+  ${BUNDLED_PACK}
+The second is shipped with this CLI, so its absence means a broken install \u2014 reinstall \`arkaik\`.`
+    );
+  }
+  return { library: readJson(BUNDLED_PACK), path: BUNDLED_PACK, vendored: false };
+}
+function loadKritikLibrary(root) {
+  const pack = resolvePack(root);
+  return { library: mergeKritikLibrary(pack.library, loadOverlay(root)), pack };
+}
+function resolveJournal(root, bundlePath) {
+  const resolved = bundlePath ?? join5(root, DEFAULT_BUNDLE_PATH5);
+  return { bundlePath: resolved, journalPath: journalPathFor(resolved), present: existsSync7(resolved) };
+}
+function appendQualityEvents(root, inputs, options = {}) {
+  if (inputs.length === 0) return { events: [] };
+  const actor = options.actor ?? KRITIK_ACTOR;
+  const journal = resolveJournal(root, options.bundlePath);
+  if (!journal.present) return { events: [] };
+  const bundle = readBundle(journal.bundlePath);
+  const baseline = ensureJournalBaseline(journal.journalPath, bundle, actor);
+  const events = inputs.map((input) => makeEvent(input.type, input.payload, { actor }));
+  for (const event of events) appendJournalEvent(journal.journalPath, event);
+  return { journalPath: journal.journalPath, events, ...baseline !== void 0 ? { baseline } : {} };
+}
+function isQualitySection(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function foldQualitySection(bundle, root, auditId) {
+  const notFolded = (reason) => {
+    const carriedSection = isQualitySection(bundle.quality);
+    return {
+      folded: false,
+      carriedSection,
+      notice: carriedSection ? `Quality: ${reason}
+  Kept the quality section this bundle already carried \u2014 nothing replaced it.` : `Quality: ${reason}`
+    };
+  };
+  if (auditId !== void 0) requireAudit(root, auditId);
+  const auditIds = listAuditIds(root);
+  if (auditIds.length === 0) {
+    return notFolded(`none to fold \u2014 no audits under ${auditsDir(root)} (run \`arkaik kritik score\` to open one)`);
+  }
+  if (!loadProfile(root)) {
+    return notFolded(`skipped, no profile \u2014 nothing at ${profilePath(root)} (run \`arkaik kritik profile\`)`);
+  }
+  let library;
+  try {
+    ({ library } = loadKritikLibrary(root));
+  } catch (e) {
+    return notFolded(`skipped, no pack \u2014 ${e.message}`);
+  }
+  const section = auditId === void 0 ? loadCurrentQualitySection(root, library) : loadAuditQualitySection(root, auditId, library);
+  if (section === void 0) {
+    return notFolded(`nothing to fold \u2014 no audits under ${auditsDir(root)}, or no profile at ${profilePath(root)}`);
+  }
+  bundle.quality = section;
+  const count = auditId === void 0 ? auditIds.length : 1;
+  return {
+    folded: true,
+    carriedSection: false,
+    notice: `Quality: folded ${section.assessments.length} assessment(s), ${section.findings.length} finding(s) from ${count} audit(s)`
+  };
+}
+function resolveQualityRoot(options) {
+  if (options.root !== void 0) return resolve4(options.fallback, options.root);
+  const envRoot = (options.env ?? process.env).ARKAIK_QUALITY_ROOT;
+  if (envRoot) return resolve4(envRoot);
+  const dir = dirname4(options.bundlePath);
+  if (basename3(dir) === "arkaik" && basename3(dirname4(dir)) === "docs") return resolve4(dir, "..", "..");
+  return options.fallback;
+}
+
+// src/commands/pack.ts
+var DEFAULT_BUNDLE_PATH6 = "docs/arkaik/bundle.json";
+var USAGE7 = `arkaik pack [--no-journal] [--no-quality] [--inline-assets] [--audit <id>]
+            [--root <dir>] [--out <path>] [path]
 
 Produce a single self-contained interchange bundle: fold in the sidecar
-journal (or keep an existing embedded one) and, with --inline-assets, inline
-local screenshot files as data: URIs. Written canonically via serializeBundle.
-Unknown top-level keys and unknown fields always round-trip.
+journal (or keep an existing embedded one), fold docs/quality/ into the
+quality section, and, with --inline-assets, inline local screenshot files as
+data: URIs. Written canonically via serializeBundle. Unknown top-level keys
+and unknown fields always round-trip.
 
 Arguments:
-  path              Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH5}).
+  path              Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH6}).
 
 Options:
   --no-journal      Omit the embedded journal[] (Publik-safe posture \u2014 history
@@ -18596,12 +18969,33 @@ Options:
                      interchange) \u2014 embedded wins over the sidecar when the
                      bundle already carries one, otherwise the sidecar is used
                      (same precedence "arkaik validate" folds by).
+  --no-quality      DELETE the quality section rather than folding one in \u2014
+                     not merely "skip the fold", because the source bundle may
+                     already carry a section of its own and that one goes too.
+                     For any bundle that must not travel with open findings:
+                     a finding names an unfixed vulnerability and the file to
+                     find it in. ("arkaik push" packs this way by default;
+                     its --include-quality opts back in.)
+                     Default: docs/quality/ IS folded in.
   --inline-assets   Convert relative-path metadata.platformScreenshots values
                      into data: URIs by reading the file from disk (resolved
                      against the bundle's directory). Absolute https:// URLs
                      and existing data: URIs are left as-is. v1 scope: local
                      files only \u2014 uploading a remote/hosted copy is not
                      implemented.
+  --audit <id>      Pin ONE audit's snapshot instead of the default merge.
+                     They answer different questions: the merge (every audit,
+                     latest score per criterion x surface) answers "where does
+                     the product stand", while a pinned audit answers "how did
+                     that audit go" \u2014 the question its own matrix.json
+                     answers. An id that is not on disk is an error, not an
+                     empty section.
+  --root <dir>      Where docs/quality/ lives. Default: NOT the current
+                     directory \u2014 it is derived from the bundle's own path, so
+                     packing <repo>/docs/arkaik/bundle.json folds <repo>'s
+                     audits whatever directory you run from. Only a bundle
+                     kept outside that conventional layout falls back to the
+                     cwd, and that is the case this flag is for.
   --out <path>      Write the packed bundle here instead of stdout.
   -h, --help        Show this help.`;
 function fail7(message) {
@@ -18639,7 +19033,7 @@ function fatalResult2(bundlePath, message) {
 }
 function runPack(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const filePath = resolve3(cwd, options.path ?? DEFAULT_BUNDLE_PATH5);
+  const filePath = resolve5(cwd, options.path ?? DEFAULT_BUNDLE_PATH6);
   const noJournal = options.noJournal ?? false;
   const inlineAssets = options.inlineAssets ?? false;
   let bundle;
@@ -18660,10 +19054,24 @@ function runPack(options = {}) {
       journalEventCount = events.length;
     }
   }
+  let qualityFolded;
+  let qualityNotice;
+  if (options.noQuality ?? false) {
+    delete bundle.quality;
+  } else {
+    const root = resolveQualityRoot({ root: options.root, bundlePath: filePath, fallback: cwd });
+    try {
+      const fold = foldQualitySection(bundle, root, options.audit);
+      qualityFolded = fold.folded;
+      qualityNotice = fold.notice;
+    } catch (e) {
+      return fatalResult2(filePath, e.message);
+    }
+  }
   const inlinedAssets = [];
   const assetWarnings = [];
   if (inlineAssets) {
-    const bundleDir = dirname3(filePath);
+    const bundleDir = dirname5(filePath);
     const nodes = Array.isArray(bundle.nodes) ? bundle.nodes : [];
     for (const node of nodes) {
       const nodeId = typeof node.id === "string" ? node.id : "?";
@@ -18674,12 +19082,12 @@ function runPack(options = {}) {
       const map2 = screenshots;
       for (const [platform, value] of Object.entries(map2)) {
         if (typeof value !== "string" || !isRelativeAssetPath(value)) continue;
-        const assetPath = resolve3(bundleDir, value);
-        if (!existsSync5(assetPath)) {
+        const assetPath = resolve5(bundleDir, value);
+        if (!existsSync8(assetPath)) {
           assetWarnings.push(`${nodeId}/${platform}: asset not found at ${assetPath} \u2014 left as-is`);
           continue;
         }
-        const bytes = readFileSync6(assetPath);
+        const bytes = readFileSync7(assetPath);
         const mime = mimeForExtension(extname(assetPath));
         map2[platform] = `data:${mime};base64,${bytes.toString("base64")}`;
         inlinedAssets.push({ nodeId, platform, path: value });
@@ -18689,15 +19097,18 @@ function runPack(options = {}) {
   const output = serializeBundle(bundle);
   let outPath;
   if (options.out !== void 0) {
-    outPath = resolve3(cwd, options.out);
-    mkdirSync3(dirname3(outPath), { recursive: true });
-    writeFileSync5(outPath, output);
+    outPath = resolve5(cwd, options.out);
+    mkdirSync4(dirname5(outPath), { recursive: true });
+    writeFileSync6(outPath, output);
   }
-  return { ok: true, bundlePath: filePath, outPath, journalIncluded, journalEventCount, inlinedAssets, assetWarnings, output };
+  return { ok: true, bundlePath: filePath, outPath, journalIncluded, journalEventCount, inlinedAssets, assetWarnings, qualityFolded, qualityNotice, output };
 }
 function runPackCli(args) {
   let noJournal = false;
+  let noQuality = false;
   let inlineAssets = false;
+  let audit;
+  let root;
   let out;
   const positionals = [];
   for (let i = 0; i < args.length; i++) {
@@ -18707,8 +19118,22 @@ function runPackCli(args) {
       process.exit(0);
     } else if (arg === "--no-journal") {
       noJournal = true;
+    } else if (arg === "--no-quality") {
+      noQuality = true;
     } else if (arg === "--inline-assets") {
       inlineAssets = true;
+    } else if (arg === "--audit") {
+      const value = args[++i];
+      if (value === void 0) fail7(`Missing value for --audit
+
+${USAGE7}`);
+      audit = value;
+    } else if (arg === "--root") {
+      const value = args[++i];
+      if (value === void 0) fail7(`Missing value for --root
+
+${USAGE7}`);
+      root = value;
     } else if (arg === "--out") {
       const value = args[++i];
       if (value === void 0) fail7(`Missing value for --out
@@ -18723,8 +19148,13 @@ ${USAGE7}`);
       positionals.push(arg);
     }
   }
-  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH5;
-  const result = runPack({ path: filePath, out, noJournal, inlineAssets });
+  if (noQuality && audit !== void 0) {
+    fail7(`--audit and --no-quality contradict each other: one names an audit to fold, the other removes the section
+
+${USAGE7}`);
+  }
+  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH6;
+  const result = runPack({ path: filePath, out, noJournal, inlineAssets, noQuality, audit, root });
   if (!result.ok) fail7(`FATAL: ${result.fatal}`);
   if (result.journalIncluded) {
     console.error(`Journal: embedded ${result.journalEventCount} event(s)`);
@@ -18733,6 +19163,9 @@ ${USAGE7}`);
   } else {
     console.error("Journal: none to embed (no embedded journal, no sidecar)");
   }
+  if (result.qualityNotice !== void 0) {
+    console.error(result.qualityNotice);
+  }
   for (const asset of result.inlinedAssets) {
     console.error(`Inlined asset: ${asset.nodeId}/${asset.platform} (${asset.path})`);
   }
@@ -18749,10 +19182,10 @@ ${USAGE7}`);
 
 // src/commands/open.ts
 import { spawn } from "node:child_process";
-import { mkdtempSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join3, resolve as resolve4 } from "node:path";
-var DEFAULT_BUNDLE_PATH6 = "docs/arkaik/bundle.json";
+import { join as join6, resolve as resolve6 } from "node:path";
+var DEFAULT_BUNDLE_PATH7 = "docs/arkaik/bundle.json";
 var OPEN_URL = "https://arkaik.app/projects";
 var USAGE8 = `arkaik open [--out <path>] [--no-open] [path]
 
@@ -18763,7 +19196,7 @@ ${OPEN_URL} (the project list's "Import JSON" picker). On an invalid bundle,
 findings are printed and nothing is packed, written, or opened.
 
 Arguments:
-  path            Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH6}).
+  path            Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH7}).
 
 Options:
   --out <path>    Write the packed bundle here instead of a temp file.
@@ -18785,7 +19218,7 @@ function fatalResult3(bundlePath, message) {
 }
 async function runOpen(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const filePath = resolve4(cwd, options.path ?? DEFAULT_BUNDLE_PATH6);
+  const filePath = resolve6(cwd, options.path ?? DEFAULT_BUNDLE_PATH7);
   const noOpen = options.noOpen ?? false;
   let v;
   try {
@@ -18804,9 +19237,9 @@ async function runOpen(options = {}) {
   }
   let outPath = packed.outPath;
   if (outPath === void 0) {
-    const dir = mkdtempSync(join3(tmpdir(), "arkaik-open-"));
-    outPath = join3(dir, "bundle.json");
-    writeFileSync6(outPath, packed.output);
+    const dir = mkdtempSync(join6(tmpdir(), "arkaik-open-"));
+    outPath = join6(dir, "bundle.json");
+    writeFileSync7(outPath, packed.output);
   }
   let opened = false;
   if (!noOpen) {
@@ -18814,7 +19247,17 @@ async function runOpen(options = {}) {
     await opener(OPEN_URL);
     opened = true;
   }
-  return { ok: true, bundlePath: filePath, valid: true, errorLines, warningLines, outPath, url: OPEN_URL, opened };
+  return {
+    ok: true,
+    bundlePath: filePath,
+    valid: true,
+    errorLines,
+    warningLines,
+    outPath,
+    url: OPEN_URL,
+    opened,
+    qualityNotice: packed.qualityNotice
+  };
 }
 function runOpenCli(args) {
   let out;
@@ -18841,7 +19284,7 @@ ${USAGE8}`);
       positionals.push(arg);
     }
   }
-  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH6;
+  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH7;
   runOpen({ path: filePath, out, noOpen }).then((result) => {
     if (!result.ok) fail8(`FATAL: ${result.fatal}`);
     if (result.warningLines.length > 0) {
@@ -18854,6 +19297,9 @@ ${USAGE8}`);
       console.error("\nInvalid bundle \u2014 not packed, not opened.");
       process.exit(1);
     }
+    if (result.qualityNotice !== void 0) {
+      console.error(result.qualityNotice);
+    }
     console.log(`Packed -> ${result.outPath}`);
     if (result.opened) {
       console.log(`Opened ${result.url}`);
@@ -18865,10 +19311,10 @@ ${USAGE8}`);
 }
 
 // src/commands/push.ts
-import { resolve as resolve5 } from "node:path";
-var DEFAULT_BUNDLE_PATH7 = "docs/arkaik/bundle.json";
+import { resolve as resolve7 } from "node:path";
+var DEFAULT_BUNDLE_PATH8 = "docs/arkaik/bundle.json";
 var DEFAULT_API_BASE = "https://arkaik.app";
-var USAGE9 = `arkaik push [--include-journal] [--api <base-url>] [path]
+var USAGE9 = `arkaik push [--include-journal] [--include-quality] [--api <base-url>] [path]
 arkaik push --delete <id> --key <owner_key> [--api <base-url>]
 
 Publish a project bundle to Publik (anonymous, account-less snapshot
@@ -18882,18 +19328,29 @@ Publik-safe posture (docs/spec/journal.md). --include-journal embeds it
 (like a bare "arkaik pack") and forwards ?include_journal=true so the server
 knows to keep it.
 
+A Kritik "quality" section is stripped by default too, and separately:
+publishing your history and publishing your open findings are two decisions,
+not one, and both default to no. --include-quality opts in.
+
 Snapshots are immutable: there is no update verb. Pushing again always mints
 a new id. The owner key printed on success is shown exactly once and cannot
 be recovered \u2014 save it if you may need to delete the snapshot later.
 
 Arguments:
-  path                Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH7}).
+  path                Path to the bundle JSON file (default: ${DEFAULT_BUNDLE_PATH8}).
                        Ignored with --delete.
 
 Options:
   --include-journal   Embed the journal in the pushed bundle and forward
                        ?include_journal=true. Default: stripped, omitted
                        entirely from the request body.
+  --include-quality   Embed the Kritik quality section and forward
+                       ?include_quality=true. Opt-in rather than opt-out
+                       because an open finding is an unfixed vulnerability
+                       plus the path to find it in (docs/rfcs/kritik.md
+                       \xA7 8.3) \u2014 publishing that is a decision worth typing.
+                       Default: deleted before packing, so it is never in the
+                       request body at all.
   --api <base-url>    Publik API base URL (default: ${DEFAULT_API_BASE}).
                        Point at a self-hosted deployment.
   --delete <id>       Delete a snapshot by id instead of pushing. Requires
@@ -18918,8 +19375,9 @@ function fatalResult4(bundlePath, message) {
 }
 async function runPush(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const filePath = resolve5(cwd, options.path ?? DEFAULT_BUNDLE_PATH7);
+  const filePath = resolve7(cwd, options.path ?? DEFAULT_BUNDLE_PATH8);
   const includeJournal = options.includeJournal ?? false;
+  const includeQuality = options.includeQuality ?? false;
   const apiBase = options.apiBase ?? DEFAULT_API_BASE;
   const httpClient = options.httpClient ?? DEFAULT_HTTP_CLIENT;
   let v;
@@ -18933,11 +19391,15 @@ async function runPush(options = {}) {
   if (!v.valid) {
     return { ok: true, bundlePath: filePath, valid: false, errorLines, warningLines, requestSent: false };
   }
-  const packed = runPack({ path: filePath, noJournal: !includeJournal, cwd });
+  const packed = runPack({ path: filePath, noJournal: !includeJournal, noQuality: !includeQuality, cwd });
   if (!packed.ok) {
     return fatalResult4(filePath, packed.fatal ?? "pack failed");
   }
-  const url2 = `${apiBase}/api/publik${includeJournal ? "?include_journal=true" : ""}`;
+  const qualityNotice = packed.qualityNotice ?? "Quality: stripped, not sent (pass --include-quality to publish it)";
+  const params = [];
+  if (includeJournal) params.push("include_journal=true");
+  if (includeQuality) params.push("include_quality=true");
+  const url2 = `${apiBase}/api/publik${params.length > 0 ? `?${params.join("&")}` : ""}`;
   let res;
   try {
     res = await httpClient(url2, {
@@ -18967,6 +19429,7 @@ async function runPush(options = {}) {
       warningLines,
       requestSent: true,
       status,
+      qualityNotice,
       id: body.id,
       url: body.url,
       ownerKey: body.owner_key
@@ -18985,6 +19448,7 @@ async function runPush(options = {}) {
     warningLines,
     requestSent: true,
     status,
+    qualityNotice,
     serverFindings: errBody.findings,
     retryAfter: status === 429 ? res.headers.get("retry-after") : void 0,
     errorMessage: errBody.message ?? `Request failed with status ${status}`
@@ -18995,6 +19459,9 @@ function reportPush(result) {
     console.error(`Warnings: ${result.warningLines.length}`);
     result.warningLines.forEach((w) => console.error(`  ${w}`));
   }
+  if (result.qualityNotice !== void 0) {
+    console.error(result.qualityNotice);
+  }
   if (!result.valid) {
     console.error(`Errors: ${result.errorLines.length}`);
     result.errorLines.forEach((e) => console.error(`  ${e}`));
@@ -19076,6 +19543,7 @@ function reportDelete(id, result) {
 }
 function runPushCli(args) {
   let includeJournal = false;
+  let includeQuality = false;
   let apiBase;
   let deleteId;
   let key;
@@ -19087,6 +19555,8 @@ function runPushCli(args) {
       process.exit(0);
     } else if (arg === "--include-journal") {
       includeJournal = true;
+    } else if (arg === "--include-quality") {
+      includeQuality = true;
     } else if (arg === "--api") {
       const value = args[++i];
       if (value === void 0) fail9(`Missing value for --api
@@ -19128,16 +19598,16 @@ ${USAGE9}`);
   if (key !== void 0) fail9(`--key is only valid with --delete
 
 ${USAGE9}`);
-  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH7;
-  runPush({ path: filePath, includeJournal, apiBase }).then((result) => {
+  const filePath = positionals[0] ?? DEFAULT_BUNDLE_PATH8;
+  runPush({ path: filePath, includeJournal, includeQuality, apiBase }).then((result) => {
     if (!result.ok) fail9(`FATAL: ${result.fatal}`);
     reportPush(result);
   }).catch((e) => fail9(`FATAL: ${e.message}`));
 }
 
 // src/commands/link.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname4, join as join4, resolve as resolve6 } from "node:path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname6, join as join7, resolve as resolve8 } from "node:path";
 var LINK_FILE = "docs/arkaik/arkaik.json";
 var DEFAULT_BASE_URL = "https://arkaik.app";
 var USAGE10 = `arkaik link \u2014 point this repo at a hosted Arkaik project
@@ -19208,15 +19678,15 @@ async function runLink(argv, options = {}) {
     return { ok: false };
   }
   const { bundle } = await res.json();
-  const target = resolve6(cwd, argv.find((a) => !a.startsWith("--") && a !== projectId && a !== baseUrl) ?? ".");
-  const linkPath = join4(target, LINK_FILE);
-  mkdirSync4(dirname4(linkPath), { recursive: true });
+  const target = resolve8(cwd, argv.find((a) => !a.startsWith("--") && a !== projectId && a !== baseUrl) ?? ".");
+  const linkPath = join7(target, LINK_FILE);
+  mkdirSync5(dirname6(linkPath), { recursive: true });
   let existing = {};
   try {
-    existing = JSON.parse(readFileSync7(linkPath, "utf8"));
+    existing = JSON.parse(readFileSync8(linkPath, "utf8"));
   } catch {
   }
-  writeFileSync7(
+  writeFileSync8(
     linkPath,
     `${JSON.stringify({ ...existing, project_id: projectId, remote: baseUrl }, null, 2)}
 `
@@ -19243,14 +19713,15 @@ function runLinkCli(argv) {
 }
 
 // src/commands/restore.ts
-import { existsSync as existsSync6, linkSync, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join5, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync9, linkSync, mkdirSync as mkdirSync6, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join8, resolve as resolve9 } from "node:path";
 var LINK_FILE2 = "docs/arkaik/arkaik.json";
-var DEFAULT_BUNDLE_PATH8 = "docs/arkaik/bundle.json";
+var DEFAULT_BUNDLE_PATH9 = "docs/arkaik/bundle.json";
 var DEFAULT_API_BASE2 = "https://arkaik.app";
 var USAGE11 = `arkaik restore [options] [path]
 
-Replace the linked hosted project's bundle AND journal with a local bundle \u2014
+Replace the linked hosted project's bundle, journal AND quality section with
+a local bundle \u2014
 the landing step for a bootstrapped map. Before sending anything, this
 exports the CURRENT hosted state (snapshot + journal) to
 docs/arkaik/.backups/<timestamp>-bundle.json (next to the link file \u2014 not
@@ -19260,9 +19731,10 @@ only way back if the restore turns out to be wrong.
 
 Arguments:
   path                Path to the local bundle JSON file
-                       (default: ${DEFAULT_BUNDLE_PATH8}). Its journal.jsonl
+                       (default: ${DEFAULT_BUNDLE_PATH9}). Its journal.jsonl
                        sidecar (or an embedded journal, which wins) is folded
-                       in automatically.
+                       in automatically, as is the docs/quality/ tree of the
+                       repo that bundle belongs to.
 
 Options:
   --dry-run             Ask the server what this restore WOULD do and print
@@ -19282,6 +19754,25 @@ Options:
                         local copy (edited in the app), not an intended
                         deletion. Undoing a restore from a backup is the
                         common case where it IS intended.
+  --no-quality          Do not send a quality section: skip the docs/quality/
+                        fold AND drop any section the local bundle already
+                        carries. Does NOT by itself permit erasing the hosted
+                        one \u2014 that needs --allow-quality-loss too, because
+                        "don't send mine" and "destroy theirs" are different
+                        decisions and only one of them is irreversible.
+  --allow-quality-loss  Proceed even though the restore would erase a quality
+                        section the hosted project currently has. Without this
+                        flag, that refuses outright \u2014 it usually means
+                        docs/quality/ was looked for in the wrong place, which
+                        --root fixes, rather than an intended wipe.
+  --audit <id>          Fold ONE audit's snapshot rather than merging every
+                        audit into current state. An id that is not on disk is
+                        an error, not an empty section.
+  --root <dir>          Where docs/quality/ lives. Default: derived from the
+                        bundle's own path, so restoring <repo>/docs/arkaik/
+                        bundle.json folds <repo>'s audits whatever directory
+                        you run from; only a bundle kept outside that layout
+                        falls back to the cwd.
   --api <base-url>      Override the remote from docs/arkaik/arkaik.json
                         (also overridable with $ARKAIK_URL).
   -h, --help            Show this help.
@@ -19294,8 +19785,8 @@ function fail10(message) {
   console.error(message);
   process.exit(1);
 }
-function fatalResult5(dryRun, message) {
-  return { ok: false, fatal: message, dryRun, requestSent: false };
+function fatalResult5(dryRun, message, quality = {}) {
+  return { ok: false, fatal: message, dryRun, requestSent: false, ...quality };
 }
 async function safeJson(res) {
   try {
@@ -19321,7 +19812,9 @@ async function interpretPutResponse(res, ctx) {
     bundlePath: ctx.bundlePath,
     backupPath: ctx.backupPath,
     requestSent: true,
-    status: res.status
+    status: res.status,
+    qualityFolded: ctx.qualityFolded,
+    qualityNotice: ctx.qualityNotice
   };
   const backupNote = backupNoteFor(ctx.backupPath);
   if (res.status === 200) {
@@ -19385,7 +19878,7 @@ async function interpretPutResponse(res, ctx) {
 }
 function writeBackupFile(filePath, content) {
   const tmpPath = `${filePath}.tmp-${process.pid}`;
-  writeFileSync8(tmpPath, content);
+  writeFileSync9(tmpPath, content);
   try {
     linkSync(tmpPath, filePath);
   } finally {
@@ -19426,20 +19919,50 @@ function describeDeletions(removedNodes, removedEdges, bundlePath) {
   );
   return lines.join("\n");
 }
+function describeQualityLoss(hostedQuality, qualityRoot, noQuality, foldNotice) {
+  const findings = Array.isArray(hostedQuality.findings) ? hostedQuality.findings.length : 0;
+  const assessments = Array.isArray(hostedQuality.assessments) ? hostedQuality.assessments.length : 0;
+  const parts = [];
+  if (findings > 0) parts.push(`${findings} open finding${findings === 1 ? "" : "s"}`);
+  if (assessments > 0) parts.push(`${assessments} assessment${assessments === 1 ? "" : "s"}`);
+  const held = parts.length > 0 ? parts.join(" and ") : "no findings or assessments";
+  const lines = [
+    `This restore would ERASE the hosted project's quality section (${held}). Nothing was sent.`
+  ];
+  if (noQuality) {
+    lines.push(
+      `You passed --no-quality, which says "do not send my quality data" \u2014 not "destroy what is already there". Those are different decisions, and this verb has no server-side undo, so the second one has to be typed: re-run with --allow-quality-loss as well if you really mean to wipe it.`
+    );
+  } else {
+    if (foldNotice !== void 0) {
+      lines.push("The outbound bundle has no section because the fold found nothing to build one from:");
+      lines.push(`  ${foldNotice}`);
+    }
+    if (!existsSync9(join8(qualityRoot, QUALITY_DIR))) {
+      lines.push(
+        `There is no ${QUALITY_DIR}/ under ${qualityRoot} at all. If this project's sidecars live somewhere else, point --root at that repo and the section is rebuilt rather than removed.`
+      );
+    }
+    lines.push(`If the hosted section really is meant to go, re-run with --allow-quality-loss.`);
+  }
+  return lines.join("\n");
+}
 async function runRestore(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const env = options.env ?? process.env;
   const dryRun = options.dryRun ?? false;
   const allowHistoryLoss = options.allowHistoryLoss ?? false;
   const allowDeletions = options.allowDeletions ?? false;
+  const noQuality = options.noQuality ?? false;
+  const allowQualityLoss = options.allowQualityLoss ?? false;
   const httpClient = options.httpClient ?? DEFAULT_HTTP_CLIENT;
-  const linkPath = join5(cwd, LINK_FILE2);
-  if (!existsSync6(linkPath)) {
+  const linkPath = join8(cwd, LINK_FILE2);
+  if (!existsSync9(linkPath)) {
     return fatalResult5(dryRun, `No ${LINK_FILE2}. Run \`arkaik link\` first \u2014 restore only targets hosted projects.`);
   }
   let link;
   try {
-    link = JSON.parse(readFileSync8(linkPath, "utf8"));
+    link = JSON.parse(readFileSync9(linkPath, "utf8"));
   } catch (e) {
     return fatalResult5(dryRun, `Could not parse ${LINK_FILE2}: ${e.message}`);
   }
@@ -19449,11 +19972,11 @@ async function runRestore(options = {}) {
   const encodedProjectId = encodeURIComponent(projectId);
   const token = env.ARKAIK_TOKEN;
   if (!token) return fatalResult5(dryRun, `ARKAIK_TOKEN is not set. Create a token at ${baseUrl}/settings/tokens and export it.`);
-  const bundlePath = resolve7(cwd, options.path ?? DEFAULT_BUNDLE_PATH8);
-  if (!existsSync6(bundlePath)) return fatalResult5(dryRun, `No bundle at ${bundlePath}. Run \`arkaik merge\` (or \`arkaik pack\`) first.`);
+  const bundlePath = resolve9(cwd, options.path ?? DEFAULT_BUNDLE_PATH9);
+  if (!existsSync9(bundlePath)) return fatalResult5(dryRun, `No bundle at ${bundlePath}. Run \`arkaik merge\` (or \`arkaik pack\`) first.`);
   let localRaw;
   try {
-    localRaw = JSON.parse(readFileSync8(bundlePath, "utf8"));
+    localRaw = JSON.parse(readFileSync9(bundlePath, "utf8"));
   } catch (e) {
     return fatalResult5(dryRun, `Could not parse ${bundlePath}: ${e.message}`);
   }
@@ -19463,6 +19986,22 @@ async function runRestore(options = {}) {
   const local = localRaw;
   const journalEvents = loadJournalEvents(local, bundlePath);
   const outboundBundle = { ...local, journal: journalEvents };
+  const qualityRoot = resolveQualityRoot({ root: options.root, bundlePath, fallback: cwd });
+  let qualityFolded = false;
+  let qualityNotice;
+  if (noQuality) {
+    delete outboundBundle.quality;
+    qualityNotice = "Quality: deleted before sending (--no-quality)";
+  } else {
+    try {
+      const fold = foldQualitySection(outboundBundle, qualityRoot, options.audit);
+      qualityFolded = fold.folded;
+      qualityNotice = fold.notice;
+    } catch (e) {
+      return fatalResult5(dryRun, e.message);
+    }
+  }
+  const qualityFields = { qualityFolded, qualityNotice };
   const headers = { Authorization: `Bearer ${token}` };
   let version2;
   try {
@@ -19491,7 +20030,7 @@ async function runRestore(options = {}) {
     } catch (e) {
       return { ok: true, dryRun, bundlePath, requestSent: false, errorMessage: `Network error: ${e.message}` };
     }
-    return interpretPutResponse(res2, { dryRun, bundlePath, version: version2 });
+    return interpretPutResponse(res2, { dryRun, bundlePath, version: version2, ...qualityFields });
   }
   let exported;
   try {
@@ -19518,28 +20057,34 @@ async function runRestore(options = {}) {
   if (journalEvents.length < hostedEventCount && !allowHistoryLoss) {
     return fatalResult5(
       dryRun,
-      `This restore would replace ${hostedEventCount} hosted journal events with ${journalEvents.length}. Nothing was sent. If that is intended, re-run with --allow-history-loss; otherwise check that ${journalPathFor(bundlePath)} exists and is current.`
+      `This restore would replace ${hostedEventCount} hosted journal events with ${journalEvents.length}. Nothing was sent. If that is intended, re-run with --allow-history-loss; otherwise check that ${journalPathFor(bundlePath)} exists and is current.`,
+      qualityFields
     );
   }
+  const hostedQuality = exportedBundle.quality;
+  if (isQualitySection(hostedQuality) && !isQualitySection(outboundBundle.quality) && !allowQualityLoss) {
+    return fatalResult5(dryRun, describeQualityLoss(hostedQuality, qualityRoot, noQuality, qualityNotice), qualityFields);
+  }
   const removedNodes = removedIds(exportedBundle.nodes, Array.isArray(local.nodes) ? local.nodes : []);
   const removedEdges = removedIds(exportedBundle.edges, Array.isArray(local.edges) ? local.edges : []);
   if ((removedNodes.length > 0 || removedEdges.length > 0) && !allowDeletions) {
-    return fatalResult5(dryRun, describeDeletions(removedNodes, removedEdges, bundlePath));
+    return fatalResult5(dryRun, describeDeletions(removedNodes, removedEdges, bundlePath), qualityFields);
   }
-  const backupDir = join5(cwd, "docs", "arkaik", ".backups");
+  const backupDir = join8(cwd, "docs", "arkaik", ".backups");
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupPath = join5(backupDir, `${stamp}-bundle.json`);
+  const backupPath = join8(backupDir, `${stamp}-bundle.json`);
   const backupContent = `${JSON.stringify(exported, null, 2)}
 `;
   try {
-    mkdirSync5(backupDir, { recursive: true });
+    mkdirSync6(backupDir, { recursive: true });
     writeBackupFile(backupPath, backupContent);
-    JSON.parse(readFileSync8(backupPath, "utf8"));
+    JSON.parse(readFileSync9(backupPath, "utf8"));
   } catch (e) {
     return fatalResult5(
       dryRun,
       `Could not write the pre-restore backup to ${backupPath}: ${e.message}
-Refusing to restore \u2014 this verb replaces the hosted project's snapshot AND journal, and the backup is the only way back.`
+Refusing to restore \u2014 this verb replaces the hosted project's snapshot AND journal, and the backup is the only way back.`,
+      qualityFields
     );
   }
   let res;
@@ -19559,7 +20104,7 @@ Refusing to restore \u2014 this verb replaces the hosted project's snapshot AND
       errorMessage: `Network error: ${e.message}. Nothing was sent.${backupNoteFor(backupPath)}`
     };
   }
-  return interpretPutResponse(res, { dryRun, bundlePath, backupPath, version: version2 });
+  return interpretPutResponse(res, { dryRun, bundlePath, backupPath, version: version2, ...qualityFields });
 }
 function printDelta(delta) {
   if (!delta) return;
@@ -19590,6 +20135,9 @@ function reportRestore(result) {
   if (result.backupPath) {
     console.log(`Backed up the current hosted project (snapshot + journal) to ${result.backupPath}`);
   }
+  if (result.qualityNotice !== void 0) {
+    console.log(result.qualityNotice);
+  }
   if (!result.requestSent) {
     console.error(result.errorMessage ?? "Restore failed before a request could be sent.");
     process.exit(1);
@@ -19598,7 +20146,9 @@ function reportRestore(result) {
     if (result.dryRun) {
       console.log("[dry-run] server preview \u2014 nothing was written:");
       printDelta(result.delta);
-      console.log("Re-run without --dry-run to apply \u2014 that run takes the backup.");
+      console.log(
+        "Re-run without --dry-run to apply \u2014 that run takes the backup, and only that run checks the history, deletion and quality-loss guards (all three read the export, which a dry run never fetches)."
+      );
     } else {
       console.log(`Restored. New version ${result.version}.`);
       printDelta(result.delta);
@@ -19619,6 +20169,10 @@ function runRestoreCli(argv) {
   let dryRun = false;
   let allowHistoryLoss = false;
   let allowDeletions = false;
+  let noQuality = false;
+  let allowQualityLoss = false;
+  let audit;
+  let root;
   let apiBase;
   const positionals = [];
   for (let i = 0; i < argv.length; i++) {
@@ -19633,6 +20187,22 @@ function runRestoreCli(argv) {
       allowHistoryLoss = true;
     } else if (arg === "--allow-deletions") {
       allowDeletions = true;
+    } else if (arg === "--no-quality") {
+      noQuality = true;
+    } else if (arg === "--allow-quality-loss") {
+      allowQualityLoss = true;
+    } else if (arg === "--audit") {
+      const value = argv[++i];
+      if (value === void 0) fail10(`Missing value for --audit
+
+${USAGE11}`);
+      audit = value;
+    } else if (arg === "--root") {
+      const value = argv[++i];
+      if (value === void 0) fail10(`Missing value for --root
+
+${USAGE11}`);
+      root = value;
     } else if (arg === "--api") {
       const value = argv[++i];
       if (value === void 0) fail10(`Missing value for --api
@@ -19650,28 +20220,33 @@ ${USAGE11}`);
   if (positionals.length > 1) fail10(`Unexpected argument(s): ${positionals.slice(1).join(" ")}
 
 ${USAGE11}`);
-  runRestore({ path: positionals[0], dryRun, allowHistoryLoss, allowDeletions, apiBase }).then((result) => reportRestore(result)).catch((e) => fail10(`FATAL: ${e.message}`));
+  if (noQuality && audit !== void 0) {
+    fail10(`--audit and --no-quality contradict each other: one names an audit to fold, the other removes the section
+
+${USAGE11}`);
+  }
+  runRestore({ path: positionals[0], dryRun, allowHistoryLoss, allowDeletions, noQuality, allowQualityLoss, audit, root, apiBase }).then((result) => reportRestore(result)).catch((e) => fail10(`FATAL: ${e.message}`));
 }
 
 // src/commands/bootstrap.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, renameSync, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, renameSync, writeFileSync as writeFileSync13 } from "node:fs";
 import path5 from "node:path";
 
 // src/lib/bootstrap/corpus.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "node:fs";
 import path2 from "node:path";
 
 // src/lib/bootstrap/paths.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import path from "node:path";
 var BOOTSTRAP_ROOT = ".arkaik";
 var CORPUS_DIR = ".arkaik/corpus";
 var PLAN_DIR = ".arkaik/bootstrap";
 var FRAGMENTS_DIR = ".arkaik/bootstrap/fragments";
 var MANIFEST_FILE = ".arkaik/bootstrap/manifest.json";
-var PROFILE_FILE = ".arkaik/bootstrap/profile.json";
+var PROFILE_FILE2 = ".arkaik/bootstrap/profile.json";
 var PRS_FILE = ".arkaik/corpus/prs.jsonl";
 var DOCS_FILE = ".arkaik/corpus/docs.json";
 var SURFACES_FILE = ".arkaik/corpus/surfaces.json";
@@ -19679,16 +20254,16 @@ function at(cwd, relative) {
   return path.join(cwd, relative);
 }
 function ensureDir(dirPath) {
-  mkdirSync6(dirPath, { recursive: true });
+  mkdirSync7(dirPath, { recursive: true });
 }
 function ensureGitignored(cwd) {
   const file2 = path.join(cwd, ".gitignore");
   const line2 = `${BOOTSTRAP_ROOT}/`;
-  const current = existsSync7(file2) ? readFileSync9(file2, "utf8") : "";
+  const current = existsSync10(file2) ? readFileSync10(file2, "utf8") : "";
   const ignored = current.split("\n").map((l) => l.trim()).some((l) => l === line2 || l === BOOTSTRAP_ROOT);
   if (ignored) return false;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
-  writeFileSync9(file2, `${current}${prefix}${line2}
+  writeFileSync10(file2, `${current}${prefix}${line2}
 `);
   return true;
 }
@@ -19785,7 +20360,7 @@ function fetchPrsViaGit(cwd) {
 function walk(root, cwd, out) {
   let entries;
   try {
-    entries = readdirSync2(root, { withFileTypes: true });
+    entries = readdirSync3(root, { withFileTypes: true });
   } catch {
     return;
   }
@@ -19803,7 +20378,7 @@ function listFiles(cwd) {
 }
 function buildDocsManifest(cwd, files) {
   return files.filter((f) => f.startsWith("docs/") && f.endsWith(".md")).map((f) => {
-    const text = readFileSync10(path2.join(cwd, f), "utf8");
+    const text = readFileSync11(path2.join(cwd, f), "utf8");
     const heading = /^#\s+(.+)$/m.exec(text);
     return { path: f, title: heading ? heading[1].trim() : path2.basename(f, ".md") };
   });
@@ -19818,7 +20393,7 @@ function buildSurfaceInventory(files) {
 }
 function buildCorpus(options) {
   const { cwd } = options;
-  const raw = options.fromJson ? JSON.parse(readFileSync10(path2.resolve(cwd, options.fromJson), "utf8")) : options.fromGit ? fetchPrsViaGit(cwd) : fetchPrsViaGh(cwd, options.limit);
+  const raw = options.fromJson ? JSON.parse(readFileSync11(path2.resolve(cwd, options.fromJson), "utf8")) : options.fromGit ? fetchPrsViaGit(cwd) : fetchPrsViaGh(cwd, options.limit);
   let prs = normalizePrs(raw);
   let sinceDroppedUndated = 0;
   if (options.since) {
@@ -19839,21 +20414,21 @@ function buildCorpus(options) {
   const docs = buildDocsManifest(cwd, files);
   const surfaces = buildSurfaceInventory(files);
   ensureDir(at(cwd, CORPUS_DIR));
-  writeFileSync10(at(cwd, PRS_FILE), prs.map((pr) => JSON.stringify(pr)).join("\n") + (prs.length ? "\n" : ""));
-  writeFileSync10(at(cwd, DOCS_FILE), `${JSON.stringify(docs, null, 2)}
+  writeFileSync11(at(cwd, PRS_FILE), prs.map((pr) => JSON.stringify(pr)).join("\n") + (prs.length ? "\n" : ""));
+  writeFileSync11(at(cwd, DOCS_FILE), `${JSON.stringify(docs, null, 2)}
 `);
-  writeFileSync10(at(cwd, SURFACES_FILE), `${JSON.stringify(surfaces, null, 2)}
+  writeFileSync11(at(cwd, SURFACES_FILE), `${JSON.stringify(surfaces, null, 2)}
 `);
   return { prs: prs.length, docs: docs.length, surfaces: surfaces.length, sinceDroppedUndated };
 }
 function readCorpusPrs(cwd) {
   const file2 = at(cwd, PRS_FILE);
-  if (!existsSync8(file2)) return [];
-  return readFileSync10(file2, "utf8").split("\n").filter(Boolean).map((line2) => JSON.parse(line2));
+  if (!existsSync11(file2)) return [];
+  return readFileSync11(file2, "utf8").split("\n").filter(Boolean).map((line2) => JSON.parse(line2));
 }
 
 // src/lib/bootstrap/fragments.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
 import path3 from "node:path";
 function isArrayOfObjects(value) {
   return value === void 0 || Array.isArray(value) && value.every((v) => typeof v === "object" && v !== null && !Array.isArray(v));
@@ -19879,13 +20454,13 @@ function loadFragments(cwd, manifest) {
       problems.push({ unit: String(unit2.id), message: err instanceof Error ? err.message : String(err) });
       continue;
     }
-    if (!existsSync9(file2)) {
+    if (!existsSync12(file2)) {
       missing.push(unit2.id);
       continue;
     }
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync11(file2, "utf8"));
+      parsed = JSON.parse(readFileSync12(file2, "utf8"));
     } catch (err) {
       problems.push({ unit: unit2.id, message: `not valid JSON: ${err instanceof Error ? err.message : "parse error"}` });
       continue;
@@ -19922,7 +20497,7 @@ function renderIndex(bundle) {
 }
 
 // src/lib/bootstrap/manifest.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "node:fs";
 import path4 from "node:path";
 
 // src/lib/bootstrap/era-window.ts
@@ -20030,19 +20605,19 @@ function assertValidProfile(profile) {
 
 // src/lib/bootstrap/manifest.ts
 function readProfile(cwd) {
-  const file2 = at(cwd, PROFILE_FILE);
-  if (!existsSync10(file2)) return null;
+  const file2 = at(cwd, PROFILE_FILE2);
+  if (!existsSync13(file2)) return null;
   try {
-    return JSON.parse(readFileSync12(file2, "utf8"));
+    return JSON.parse(readFileSync13(file2, "utf8"));
   } catch (err) {
-    throw new Error(`cannot read ${PROFILE_FILE}: ${err instanceof Error ? err.message : String(err)}`);
+    throw new Error(`cannot read ${PROFILE_FILE2}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function readManifest(cwd) {
   const file2 = at(cwd, MANIFEST_FILE);
-  if (!existsSync10(file2)) return null;
+  if (!existsSync13(file2)) return null;
   try {
-    return JSON.parse(readFileSync12(file2, "utf8"));
+    return JSON.parse(readFileSync13(file2, "utf8"));
   } catch (err) {
     throw new Error(`cannot read ${MANIFEST_FILE}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -20050,15 +20625,15 @@ function readManifest(cwd) {
 function writeManifest(cwd, manifest) {
   ensureDir(at(cwd, PLAN_DIR));
   ensureDir(at(cwd, FRAGMENTS_DIR));
-  writeFileSync11(at(cwd, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync12(at(cwd, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
 }
 function detectMode(cwd, bundlePath) {
   const file2 = path4.resolve(cwd, bundlePath);
-  if (!existsSync10(file2)) return "greenfield";
+  if (!existsSync13(file2)) return "greenfield";
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(file2, "utf8"));
+    parsed = JSON.parse(readFileSync13(file2, "utf8"));
   } catch (err) {
     throw new Error(`cannot read bundle at ${bundlePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -20511,7 +21086,7 @@ function mergeFragments(input) {
 }
 
 // src/lib/bootstrap/slice.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
 
 // src/lib/bootstrap/body-budget.ts
 var LAB_NOTE_HEADING_RE = /^##\s+Lab Note.*$/m;
@@ -20553,8 +21128,8 @@ function boundBody(body) {
 
 // src/lib/bootstrap/slice.ts
 function readJsonArray(file2) {
-  if (!existsSync11(file2)) return [];
-  const parsed = JSON.parse(readFileSync13(file2, "utf8"));
+  if (!existsSync14(file2)) return [];
+  const parsed = JSON.parse(readFileSync14(file2, "utf8"));
   return Array.isArray(parsed) ? parsed : [];
 }
 function toPosix(value) {
@@ -20575,7 +21150,7 @@ function eraWindows(cwd, slugs) {
     const era = bySlug.get(slug);
     if (!era) {
       throw new Error(
-        `era "${slug}" is not declared in ${PROFILE_FILE}'s "eras" list, but a work unit's slice references it. profile.json may have been edited (or the era removed) since \`arkaik bootstrap plan\` last ran. Restore the era in profile.json and re-run \`arkaik bootstrap plan\`, or reconcile the manifest by hand.`
+        `era "${slug}" is not declared in ${PROFILE_FILE2}'s "eras" list, but a work unit's slice references it. profile.json may have been edited (or the era removed) since \`arkaik bootstrap plan\` last ran. Restore the era in profile.json and re-run \`arkaik bootstrap plan\`, or reconcile the manifest by hand.`
       );
     }
     assertEraWindow(era);
@@ -20664,7 +21239,7 @@ ${usage}`);
 }
 function writeFileAtomic(filePath, content) {
   const tmpPath = `${filePath}.tmp-${process.pid}`;
-  writeFileSync12(tmpPath, content);
+  writeFileSync13(tmpPath, content);
   renameSync(tmpPath, filePath);
 }
 function runCorpus(argv) {
@@ -20699,7 +21274,7 @@ ${CORPUS_USAGE}`);
 ${CORPUS_USAGE}`);
     }
   }
-  if (!existsSync12(path5.join(cwd, ".git"))) {
+  if (!existsSync15(path5.join(cwd, ".git"))) {
     fail11("`arkaik bootstrap corpus` must run from the repository root (no .git here).");
   }
   try {
@@ -20761,7 +21336,7 @@ ${PLAN_USAGE}`);
 
 ${PLAN_USAGE}`);
   }
-  if (!existsSync12(path5.join(cwd, ".git"))) {
+  if (!existsSync15(path5.join(cwd, ".git"))) {
     fail11("`arkaik bootstrap plan` must run from the repository root (no .git here).");
   }
   try {
@@ -20900,7 +21475,7 @@ ${MERGE_USAGE}`);
   }
   try {
     const bundlePath = path5.resolve(cwd, manifest.bundle);
-    const base = existsSync12(bundlePath) ? readBundle(bundlePath) : {
+    const base = existsSync15(bundlePath) ? readBundle(bundlePath) : {
       schema_version: 3,
       project: {
         id: path5.basename(cwd),
@@ -20936,7 +21511,7 @@ ${MERGE_USAGE}`);
     const journalPath = journalPathFor(bundlePath);
     const journalText = result.journal.map((e) => JSON.stringify(e)).join("\n") + (result.journal.length ? "\n" : "");
     if (!dryRun) {
-      mkdirSync7(path5.dirname(bundlePath), { recursive: true });
+      mkdirSync8(path5.dirname(bundlePath), { recursive: true });
       writeFileAtomic(bundlePath, serialized);
       writeFileAtomic(journalPath, journalText);
     }
@@ -20985,138 +21560,6 @@ ${USAGE12}`);
   }
 }
 
-// ../schema/src/cli/kritik-audit.ts
-import { existsSync as existsSync14, readdirSync as readdirSync3, statSync } from "node:fs";
-import { join as join7 } from "node:path";
-
-// ../schema/src/cli/kritik-paths.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname5, join as join6, resolve as resolve8 } from "node:path";
-var QUALITY_DIR = "docs/quality";
-var PROFILE_FILE2 = "profile.json";
-var OVERLAY_FILE = "criteria.custom.json";
-var AUDITS_DIR = "audits";
-var PACK_FILE = "library.json";
-function readJson(path6) {
-  return JSON.parse(readFileSync14(path6, "utf8"));
-}
-function writeJson(path6, value) {
-  mkdirSync8(dirname5(path6), { recursive: true });
-  writeFileSync13(path6, JSON.stringify(value, null, 2) + "\n");
-}
-var profilePath = (root) => join6(root, QUALITY_DIR, PROFILE_FILE2);
-var overlayPath = (root) => join6(root, QUALITY_DIR, OVERLAY_FILE);
-var auditDir = (root, auditId) => join6(root, QUALITY_DIR, AUDITS_DIR, auditId);
-function loadProfile(root) {
-  const path6 = profilePath(root);
-  return existsSync13(path6) ? readJson(path6) : null;
-}
-function loadOverlay(root) {
-  const path6 = overlayPath(root);
-  return existsSync13(path6) ? readJson(path6) : null;
-}
-
-// ../schema/src/cli/kritik-audit.ts
-var SCORES_FILE = "scores.json";
-var FINDINGS_FILE = "findings.json";
-var MATRIX_FILE = "matrix.json";
-var scoresPath = (root, auditId) => join7(auditDir(root, auditId), SCORES_FILE);
-var findingsPath = (root, auditId) => join7(auditDir(root, auditId), FINDINGS_FILE);
-var matrixPath = (root, auditId) => join7(auditDir(root, auditId), MATRIX_FILE);
-function listAuditIds(root) {
-  const dir = join7(root, QUALITY_DIR, AUDITS_DIR);
-  if (!existsSync14(dir)) return [];
-  return readdirSync3(dir).filter((name) => statSync(join7(dir, name)).isDirectory()).sort();
-}
-function newestAuditId(root) {
-  const dir = join7(root, QUALITY_DIR, AUDITS_DIR);
-  if (!existsSync14(dir)) throw new Error(`no audits directory at ${dir}`);
-  const ids = listAuditIds(root);
-  if (ids.length === 0) throw new Error(`no audits found under ${dir}`);
-  return ids[ids.length - 1];
-}
-function loadScores(root, auditId) {
-  const path6 = scoresPath(root, auditId);
-  if (!existsSync14(path6)) throw new Error(`no ${SCORES_FILE} at ${path6}`);
-  const file2 = readJson(path6);
-  return { ...file2, assessments: Array.isArray(file2.assessments) ? file2.assessments : [] };
-}
-function loadScoresOrEmpty(root, auditId) {
-  return existsSync14(scoresPath(root, auditId)) ? loadScores(root, auditId) : { audit_id: auditId, assessments: [] };
-}
-function loadFindings(root, auditId) {
-  const path6 = findingsPath(root, auditId);
-  if (!existsSync14(path6)) return { audit_id: auditId, findings: [] };
-  const file2 = readJson(path6);
-  return { ...file2, findings: Array.isArray(file2.findings) ? file2.findings : [] };
-}
-function saveScores(root, auditId, file2) {
-  writeJson(scoresPath(root, auditId), file2);
-}
-function saveFindings(root, auditId, file2) {
-  writeJson(findingsPath(root, auditId), file2);
-}
-function requireProfile(root) {
-  const profile = loadProfile(root);
-  if (!profile) {
-    throw new Error(
-      `no profile at ${join7(root, QUALITY_DIR, "profile.json")} \u2014 pick this project's surfaces first (\`arkaik kritik profile\`, or the plugin's init-profile.js).`
-    );
-  }
-  return profile;
-}
-function loadQualitySection(root, auditId, library, scores = loadScores(root, auditId)) {
-  const findings = loadFindings(root, auditId);
-  return {
-    framework_version: scores.framework_version ?? library.version,
-    profile: requireProfile(root),
-    assessments: scores.assessments,
-    findings: findings.findings
-  };
-}
-function computeAuditMatrix(root, auditId, library) {
-  const scores = loadScores(root, auditId);
-  const section = loadQualitySection(root, auditId, library, scores);
-  const matrix = deriveQualityMatrix({ quality: section }, library);
-  const file2 = {
-    audit_id: auditId,
-    commit: scores.commit,
-    framework_version: section.framework_version,
-    matrix: matrix.matrix,
-    overall: matrix.overall,
-    finding_counts: matrix.finding_counts
-  };
-  writeJson(matrixPath(root, auditId), file2);
-  return { section, matrix, file: file2 };
-}
-function renderMatrixMarkdown(matrix, domainNames) {
-  const cell = (value) => value ? `${value.score} (${value.grade}${value.capped ? "*" : ""})` : "\u2014";
-  const lines = [];
-  lines.push(`| Domain | ${matrix.surfaces.join(" | ")} |`);
-  lines.push(`| --- | ${matrix.surfaces.map(() => "---").join(" | ")} |`);
-  for (const domain2 of matrix.domains) {
-    const label = domainNames.get(domain2) ?? domain2;
-    lines.push(
-      `| **${domain2}** ${label} | ${matrix.surfaces.map((s) => cell(matrix.matrix[domain2]?.[s])).join(" | ")} |`
-    );
-  }
-  lines.push(
-    `| **Overall (weighted)** | ${matrix.surfaces.map((s) => {
-      const score = matrix.overall[s];
-      return score === null || score === void 0 ? "\u2014" : `**${score} (${gradeOf(score)})**`;
-    }).join(" | ")} |`
-  );
-  return lines.join("\n");
-}
-function locateFinding(root, id) {
-  for (const auditId of [...listAuditIds(root)].reverse()) {
-    const file2 = loadFindings(root, auditId);
-    const finding = file2.findings.find((candidate) => candidate.id === id);
-    if (finding) return { auditId, file: file2, finding };
-  }
-  return void 0;
-}
-
 // ../schema/src/cli/kritik-overlay.ts
 var ANCHOR_KEYS = ["l0", "l1", "l2", "l3", "l4"];
 var CRITERION_TEMPLATE = {
@@ -21247,49 +21690,6 @@ Pass --domain-name "<display name>" to define it, or use an existing domain code
 
 // src/commands/kritik.ts
 import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
-
-// src/lib/kritik-io.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { dirname as dirname6, join as join8 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var KRITIK_ACTOR = "arkaik-cli";
-var DEFAULT_BUNDLE_PATH9 = join8("docs", "arkaik", "bundle.json");
-var VENDORED_PACK = join8(QUALITY_DIR, PACK_FILE);
-var BUNDLED_PACK = join8(dirname6(fileURLToPath2(import.meta.url)), "assets", "kritik", "library.json");
-function resolvePack(root) {
-  const vendored = join8(root, VENDORED_PACK);
-  if (existsSync15(vendored)) return { library: readJson(vendored), path: vendored, vendored: true };
-  if (!existsSync15(BUNDLED_PACK)) {
-    throw new Error(
-      `no criteria pack found. Looked in:
-  ${vendored}
-  ${BUNDLED_PACK}
-The second is shipped with this CLI, so its absence means a broken install \u2014 reinstall \`arkaik\`.`
-    );
-  }
-  return { library: readJson(BUNDLED_PACK), path: BUNDLED_PACK, vendored: false };
-}
-function loadKritikLibrary(root) {
-  const pack = resolvePack(root);
-  return { library: mergeKritikLibrary(pack.library, loadOverlay(root)), pack };
-}
-function resolveJournal(root, bundlePath) {
-  const resolved = bundlePath ?? join8(root, DEFAULT_BUNDLE_PATH9);
-  return { bundlePath: resolved, journalPath: journalPathFor(resolved), present: existsSync15(resolved) };
-}
-function appendQualityEvents(root, inputs, options = {}) {
-  if (inputs.length === 0) return { events: [] };
-  const actor = options.actor ?? KRITIK_ACTOR;
-  const journal = resolveJournal(root, options.bundlePath);
-  if (!journal.present) return { events: [] };
-  const bundle = readBundle(journal.bundlePath);
-  const baseline = ensureJournalBaseline(journal.journalPath, bundle, actor);
-  const events = inputs.map((input) => makeEvent(input.type, input.payload, { actor }));
-  for (const event of events) appendJournalEvent(journal.journalPath, event);
-  return { journalPath: journal.journalPath, events, ...baseline !== void 0 ? { baseline } : {} };
-}
-
-// src/commands/kritik.ts
 var USAGE13 = `arkaik kritik <subcommand> [options]
 
 Audit this product's quality with the Kritik framework: a maturity level per
@@ -21304,6 +21704,7 @@ Subcommands:
   finding accept <id>   Accept it as a known, owned risk.
   matrix [audit-id]     Roll an audit up (writes matrix.json).
   signals               The signal pack, and what has tripped since the last audit.
+  regressions           What got worse between two audits.
   issue <criterion>     Print the prefilled GitHub issue skeleton.
   criterion add ...     Add a project-specific criterion to the overlay.
 
@@ -21377,6 +21778,20 @@ makes it usable as a CI step.
   --trip            Record one as tripped: appends quality.signal.tripped.
                     --signal takes the row's index from the run sheet, or the text.
   --json            The full run sheet as JSON (what an agent should read).`;
+var REGRESSIONS_USAGE = `arkaik kritik regressions [--from <audit>] [--to <audit>] [--record] [--json]
+
+What got worse between two audits: a cell whose maturity dropped, a cell that
+gained an open Critical or High finding, a finding that was resolved and is open
+again. Cells scored in only one of the two audits are not compared \u2014 a
+half-finished audit is not a regression.
+
+Exits 1 when anything regressed, which is what makes it usable as a CI step or a
+scheduled routine.
+
+  --from <audit>    The older reading (default: the audit before --to).
+  --to <audit>      The newer reading (default: the newest on disk).
+  --record          Append one quality.signal.tripped per regression.
+  --json            The full list as JSON.`;
 var ISSUE_USAGE = `arkaik kritik issue <criterion> --surface <s> [--level <n>] [--finding <id>]
 
 Print the criterion's GitHub issue skeleton, filled as far as what we know
@@ -21930,7 +22345,8 @@ function runSignals(args, common) {
     console.log(
       `
   ${rows.length} checks across ${criteria} criteria and ${(profile.surfaces ?? []).length} surfaces.
-  Narrow it (--surface, --criterion, --domain) to read them, or --json to take the lot.`
+  Narrow it (--surface, --criterion, --domain) to read them, or --json to take the lot.` + (listAuditIds(common.root).length > 1 ? `
+  Comparing two audits is \`arkaik kritik regressions\`.` : "")
     );
   }
   if (trips.length > 0) {
@@ -21946,6 +22362,83 @@ function runSignals(args, common) {
   console.log("");
   process.exit(0);
 }
+function auditPair(root, from, to) {
+  const audits = listAuditIds(root);
+  if (audits.length < 2) {
+    fail12(
+      `kritik: regressions needs two audits to compare \u2014 ${audits.length === 0 ? "docs/quality/audits/ holds none" : `only "${audits[0]}" exists`}.
+A regression is the difference between two readings; one reading is a baseline.`
+    );
+  }
+  const known = (id) => {
+    if (!audits.includes(id)) fail12(`kritik: no audit "${id}" under docs/quality/audits/ (have: ${audits.join(", ")})`);
+    return id;
+  };
+  const newer = to === void 0 ? audits[audits.length - 1] : known(to);
+  const older = from === void 0 ? audits[audits.indexOf(newer) - 1] : known(from);
+  if (older === void 0) {
+    fail12(`kritik: "${newer}" is the oldest audit \u2014 there is nothing before it to compare against.`);
+  }
+  if (older === newer) {
+    fail12(`kritik: --from and --to name the same audit ("${newer}") \u2014 a regression needs two readings.`);
+  }
+  if (audits.indexOf(older) > audits.indexOf(newer)) {
+    fail12(`kritik: --from "${older}" is newer than --to "${newer}" \u2014 swap them, or the comparison inverts.`);
+  }
+  return { from: older, to: newer };
+}
+function runRegressions(args, common) {
+  const { single, flags } = collect(args, [], ["json", "record"]);
+  if (flags.has("help")) {
+    console.log(REGRESSIONS_USAGE);
+    process.exit(0);
+  }
+  const library = loadLibraryOrFail(common.root);
+  profileOrFail(common.root);
+  const { from, to } = auditPair(common.root, single.from, single.to);
+  let regressions;
+  try {
+    regressions = detectRegressions(
+      loadQualitySection(common.root, from, library),
+      loadQualitySection(common.root, to, library),
+      library
+    );
+  } catch (error51) {
+    return fail12(`kritik: ${error51.message}`);
+  }
+  if (flags.has("json")) {
+    console.log(JSON.stringify({ from, to, total: regressions.length, regressions }, null, 2));
+  } else if (regressions.length === 0) {
+    console.log(`
+  nothing regressed between ${from} and ${to}.
+`);
+  } else {
+    console.log("");
+    for (const regression of regressions) {
+      console.log(`  [${regression.kind}] ${regression.criterion_id} x ${regression.surface}`);
+      console.log(`    ${regression.detail}`);
+    }
+    console.log(`
+  ${regressions.length} regression${regressions.length === 1 ? "" : "s"} between ${from} and ${to}.`);
+  }
+  if (flags.has("record") && regressions.length > 0) {
+    reportJournal(
+      common.root,
+      regressions.map(
+        (regression) => signalTrippedInput({
+          criterion_id: regression.criterion_id,
+          surface: regression.surface,
+          signal: regression.signal,
+          detail: regression.detail
+        })
+      ),
+      common
+    );
+    console.log(`  a tripped signal is not a finding \u2014 it is the prompt to go look.
+`);
+  }
+  process.exit(regressions.length > 0 ? 1 : 0);
+}
 function runIssue(args, common) {
   const { single, flags, positionals } = collect(args);
   if (flags.has("help")) {
@@ -22085,6 +22578,8 @@ function runKritik(args) {
       return runMatrix(subArgs, common);
     case "signals":
       return runSignals(subArgs, common);
+    case "regressions":
+      return runRegressions(subArgs, common);
     case "issue":
       return runIssue(subArgs, common);
     case "criterion":
@@ -22109,13 +22604,13 @@ Commands:
   release <version> [path]    Tag a release (append release.tagged) and draft its notes.
   deliverable <title> [path]  Record a deliverable (append deliverable.shipped).
   sync [options] [path]       Mirror external ref status (GitHub issues/PRs) into node refs.
-  pack [options] [path]       Produce a single self-contained interchange bundle (embeds the journal).
+  pack [options] [path]       Produce a self-contained interchange bundle (embeds journal + quality).
   open [options] [path]       Validate, then hand off the packed bundle to arkaik.app import.
-  push [options] [path]       Validate, pack (journal stripped), and publish to Publik.
+  push [options] [path]       Validate, pack (journal + quality stripped), and publish to Publik.
                                --delete <id> --key <owner_key> removes a snapshot.
   link [options] [path]       Point this repo at a hosted project so an agent can edit it.
                                --list shows the projects your token can reach.
-  restore [options] [path]    Replace the linked hosted project's bundle + journal (backs up first).
+  restore [options] [path]    Replace the linked project's bundle, journal + quality (backs up first).
   bootstrap <sub> [options]   One-time onboarding: mine, plan, slice, merge a map from a repo.
   kritik <sub> [options]      Quality audits: score criteria, open findings, roll up the matrix.
 
@@ -22124,7 +22619,7 @@ Options:
   -v, --version     Print the version.
 
 Run "arkaik <command> --help" for command-specific help.`;
-var VERSION = "0.2.0";
+var VERSION = "0.4.0";
 function main(argv) {
   const [command, ...rest] = argv;
   if (command === void 0 || command === "--help" || command === "-h" || command === "help") {